)]}' { "log": [ { "commit": "4f4225874d4d3747ec1142e935dbd314218992fa", "tree": "c8ec6a7733c071f8ccaa97a20c6aa18ff3ac1da6", "parents": [ "ed698be7700160c74d24ef7830adccd2a28d840a", "cfa70f3a82f581ad758586ecf408fe7f3602850f" ], "author": { "name": "Richard Henderson", "email": "richard.henderson@linaro.org", "time": "Thu Oct 22 12:47:21 2026 +0200" }, "committer": { "name": "Richard Henderson", "email": "richard.henderson@linaro.org", "time": "Thu Oct 22 12:47:21 2026 +0200" }, "message": "Merge tag \u0027pull-request-2026-10-22\u0027 of https://gitlab.com/thuth/qemu into staging\n\nVarious fixes for the USB code\n\n# -----BEGIN PGP SIGNATURE-----\n#\n# iQIzBAABCgAdFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmrZ5qsACgkQLtnXdP5w\n# LbUwdRAAm5qnbGSu4FFUC79n9KNbIyoGdI6zO3GAPk9VomKhf1b6lrk5iGZP8Xk7\n# A/1wBmO9FkxQRqrzdVu7IIUyZNGCBdLlYLNNTuEoQOG5uTBW/P+McFTgJe3yQmF9\n# FStkCChMcZe5XPiRy5NXWRUZYMJcdWa5LCL7AJ1EBTxW4IlT6Rf3/hVw1e8fgruK\n# zheWP89zSoZnJI51dFw2rm5EllPX21ktW5I/7iLdhl4bmKAQKgdhl2CdK7OhCNNY\n# xAh2HN/7HZ7/y5ky8mB1EzsU3JfpuFoC/kq+aBGEJ+YQhFnY1DSHu0tpKMn8aTVo\n# gPdihq00kh0POJzP0gPrqTTICfYcYyS04pmHR0DKL4pmuyMqNwwQMMYNjcq5lbFg\n# CEuYqxLTYZD7bhgFI9yo2Evuk74ulMxc3ALwZ8Y26DY5zTkJzRQrPR1Umrsw9g0t\n# H6DlJ1y9AQl0QPJaKbU7lnJ3WN21oVeQIhOs1TDaI13fP/lRVjFa+Ezzamie7hnb\n# uovx+noo++9A9Lj79UVVAK53CTdt8RYTWEJljBIV4ugS/k9hhbPO8K1nLdBkIxHZ\n# iKhzMhJjUKE1xHySkOJxCgDfsfIkcNxeqhxYoGpg+HY0LLMc7q0MYgzwPWByaA1B\n# 40QD2Q5y0dIv+eUPRL95hqyKrkDOgzFg+g760eToMKLQYJR3tIM\u003d\n# \u003dS65/\n# -----END PGP SIGNATURE-----\n# gpg: Signature made Thu 22 Oct 2026 12:34:19 PM CEST\n# gpg: using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5\n# gpg: Good signature from \"Thomas Huth \u003cth.huth@gmx.de\u003e\" [unknown]\n# gpg: aka \"Thomas Huth \u003cthuth@redhat.com\u003e\" [unknown]\n# gpg: aka \"Thomas Huth \u003cth.huth@posteo.de\u003e\" [unknown]\n# gpg: aka \"Thomas Huth \u003chuth@tuxfamily.org\u003e\" [unknown]\n# gpg: aka \"Thomas Huth \u003cth.huth@posteo.eu\u003e\" [unknown]\n# gpg: WARNING: This key is not certified with a trusted signature!\n# gpg: There is no indication that the signature belongs to the owner.\n# Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5\n\n* tag \u0027pull-request-2026-10-22\u0027 of https://gitlab.com/thuth/qemu:\n hw/usb/hcd-xhci: More reentrancy guard fixes for the XHCI code\n hw/usb/dev-mtp: Fix heap OOB read in usb_mtp_write_metadata()\n hw/usb/dev-mtp: Fix assert crash on short CMD_SEND_OBJECT\n usb-host: delete bottom halves during unrealize\n usb-host: free request on libusb submit failure\n tests/qtest/usb-hcd-xhci: test interrupt pacing above 2^32\n usb-host: free configuration descriptors on error paths\n usb-host: validate interface number before indexing altsetting\n tests/qtest: Cover OHCI endpoint type mismatches\n hw/usb/hcd-ohci: Fail iso packets sent to non-iso endpoints and vice-versa\n hw/usb/dev-mtp: Fix assert crash on undersized BULK IN\n\nSigned-off-by: Richard Henderson \u003crichard.henderson@linaro.org\u003e\n" }, { "commit": "cfa70f3a82f581ad758586ecf408fe7f3602850f", "tree": "6883f35ce658d8326de1ae2d2671a0a91020d713", "parents": [ "6ab4cd2f13debf7682106ff1d9917478814dda10" ], "author": { "name": "Thomas Huth", "email": "thuth@redhat.com", "time": "Fri Oct 16 17:21:04 2026 +0200" }, "committer": { "name": "Thomas Huth", "email": "thuth@redhat.com", "time": "Thu Oct 22 12:33:17 2026 +0200" }, "message": "hw/usb/hcd-xhci: More reentrancy guard fixes for the XHCI code\n\nThe XHCI controller\u0027s USB port and bus callbacks -- xhci_complete(),\nxhci_wakeup_endpoint(), xhci_attach(), xhci_detach(), and\nxhci_wakeup() -- can be invoked from outside any MMIO handler context.\nThe device\u0027s mem_reentrancy_guard is therefore not engaged during\nthis processing.\n\nA malicious guest can exploit this gap via MSI-X self-targeting: it\nprograms the MSI-X vector\u0027s message address to point at the XHCI\ndoorbell register array (both reside in the same BAR0 MemoryRegion).\nWhen any of these callbacks posts an event via xhci_event() -\u003e\nxhci_intr_raise(), the resulting msix_notify() -\u003e pci_msi_trigger()\nissues an address_space_stl_le() that writes doorbell 0, triggering\nxhci_process_commands() reentrantly. A CR_DISABLE_SLOT command\nplanted on the command ring then frees XHCITransfer/XHCIEPContext\nobjects that the outer call stack still references, causing a\nheap use-after-free.\n\nFix this by setting engaged_in_io on the device\u0027s mem_reentrancy_guard\naround the processing in all five callbacks. The guard is set\nconditionally (only when not already engaged) because these callbacks\nmay also be reached from within a guarded MMIO context.\n\nxhci_child_detach() is intentionally left unguarded: it only calls\nxhci_detach_slot() which passes report\u003d0 to xhci_ep_nuke_xfers(),\nsuppressing event generation, so it never reaches xhci_event().\n\nNote: This is similar to the fixes done for CVE-2026-17588, see\nf91b0544fe (\"Set reentrancy guard in timer functions\").\n\nCVE: CVE-2026-111819\nMessage-ID: \u003c20261020114031.687929-1-thuth@redhat.com\u003e\nResolves: https://gitlab.com/qemu-project/qemu/-/work_items/4625\nReported-by: Ken Hsu, Royce Lu, and Bo Qu of Palo Alto Networks\nBuglink: https://gitlab.com/qemu-project/qemu/-/work_items/4642\nReported-by: Nikhil Agrawal \u003cnikhil.agrawal@mettlelabs.ai\u003e\nSigned-off-by: Thomas Huth \u003cthuth@redhat.com\u003e\n" }, { "commit": "6ab4cd2f13debf7682106ff1d9917478814dda10", "tree": "8cd4fa948bcabb6fac606361131f96a73aa86e30", "parents": [ "1ccf17e9dc6bba38a9bddd3d66fdab458a50c906" ], "author": { "name": "Tommaso Califano", "email": "tcalifano@redhat.com", "time": "Wed Oct 07 16:37:38 2026 +0200" }, "committer": { "name": "Thomas Huth", "email": "thuth@redhat.com", "time": "Thu Oct 22 12:33:17 2026 +0200" }, "message": "hw/usb/dev-mtp: Fix heap OOB read in usb_mtp_write_metadata()\n\nusb_mtp_write_metadata() computed the number of filename characters as\n\n filename_chars \u003d dlen - offsetof(ObjectInfo, filename)\n\nwhere dlen is the amount of data copied by the last USB packet of the\ntransfer, not the size of the ObjectInfo dataset. If the final packet has\nfewer than 53 bytes, filename_chars underflows to SIZE_MAX, causing\nutf16_to_str() to read far beyond the heap buffer, leaking QEMU host\nprocess memory.\n\nUse d-\u003elength instead: it is the size of the buffer holding the dataset,\nand usb_mtp_write_metadata() is only reached once all d-\u003elength bytes\nhave been received.\n\nd-\u003elength is guest-controlled, so reject datasets too small to hold the\nfixed part of ObjectInfo before dereferencing it. The check is \"\u003c\u003d\"\nrather than \"\u003c\" because a dataset of exactly offsetof(ObjectInfo,filename)\nbytes would yield an empty filename.\n\nFixes: 90c1a74271ce (\"usb-mtp: Limit filename to object information size\")\nResolves: https://gitlab.com/qemu-project/qemu/-/work_items/3992\nSigned-off-by: Tommaso Califano \u003ctcalifano@redhat.com\u003e\nReviewed-by: Luigi Leonardi \u003cleonardi@redhat.com\u003e\nMessage-ID: \u003c20261007143738.58509-1-tcalifano@redhat.com\u003e\nSigned-off-by: Thomas Huth \u003cthuth@redhat.com\u003e\n" }, { "commit": "1ccf17e9dc6bba38a9bddd3d66fdab458a50c906", "tree": "0db982ed13df6a2371b3bfb834c05a570b20639b", "parents": [ "a86338565ceaede2fd7d90a8e0376131a20f0655" ], "author": { "name": "Tommaso Califano", "email": "tcalifano@redhat.com", "time": "Thu Oct 08 14:29:36 2026 +0200" }, "committer": { "name": "Thomas Huth", "email": "thuth@redhat.com", "time": "Thu Oct 22 12:33:17 2026 +0200" }, "message": "hw/usb/dev-mtp: Fix assert crash on short CMD_SEND_OBJECT\n\nIn usb_mtp_get_data() there is a guest-triggerable assertion that fires\nwhen a guest declares a large object size in CMD_SEND_OBJECT_INFO but\nsends fewer bytes in the subsequent CMD_SEND_OBJECT. The assertion\ncompares the declared size against the actual bytes received.\n\nIf the guest sends CMD_SEND_OBJECT_INFO with size\u003d1000 and then\nCMD_SEND_OBJECT with only 50 bytes (short, non-64-byte-aligned\nfinal USB packet) the assertion fires, killing QEMU.\n\nTo prevent that is sufficient to remove the assertion, because the case\nis handled by usb_mtp_write_data() which returns RES_INCOMPLETE_TRANSFER.\n\nFixes: 3e096650a64d (\"dev-mtp: Add support for \u003e 4GB file transfers\")\nResolves: https://gitlab.com/qemu-project/qemu/-/work_items/3993\nSigned-off-by: Tommaso Califano \u003ctcalifano@redhat.com\u003e\nReviewed-by: Luigi Leonardi \u003cleonardi@redhat.com\u003e\nReviewed-by: Marc-André Lureau \u003cmarcandre.lureau@redhat.com\u003e\nMessage-ID: \u003c20261008122936.45081-1-tcalifano@redhat.com\u003e\nSigned-off-by: Thomas Huth \u003cthuth@redhat.com\u003e\n" }, { "commit": "a86338565ceaede2fd7d90a8e0376131a20f0655", "tree": "2eba80428d4e1612423e4c3aacde577d80130766", "parents": [ "59cb5109101330fdc4588cbd5a081deeed0cd493" ], "author": { "name": "Haotian Jiang", "email": "sundayjiang@tencent.com", "time": "Fri Oct 16 15:10:38 2026 +0200" }, "committer": { "name": "Thomas Huth", "email": "thuth@redhat.com", "time": "Thu Oct 22 12:32:18 2026 +0200" }, "message": "usb-host: delete bottom halves during unrealize\n\nusb_host_nodev() lazily creates s-\u003ebh_nodev and\nusb_host_post_load() lazily creates s-\u003ebh_postld, but\nusb_host_unrealize() never calls qemu_bh_delete() on either. If a BH\nis still pending when unrealize returns, its callback dereferences the\nfreed USBHostDevice.\n\nDelete both BHs in usb_host_unrealize() after usb_host_close()\nreturns. They must be deleted after close because usb_host_close()\ncan process libusb callbacks that call usb_host_nodev(), which lazily\nrecreates bh_nodev. Deleting it before close could therefore leave a\nrecreated BH alive after unrealize.\n\nBuglink: https://gitlab.com/qemu-project/qemu/-/work_items/3595\nFixes: 95efb20c7148 (\"usb-host: live migration support for the libusb version\")\nReported-by: Haotian Jiang of Tencent Security (Yunding Lab) \u003csundayjiang@tencent.com\u003e\nSigned-off-by: Haotian Jiang \u003csundayjiang@tencent.com\u003e\nCc: qemu-stable@nongnu.org\n" }, { "commit": "59cb5109101330fdc4588cbd5a081deeed0cd493", "tree": "68c05d3d5a327ebad95db54bb9285f2569a74381", "parents": [ "432f505fa65ee12544d34998f56f4754115f605f" ], "author": { "name": "Haotian Jiang", "email": "sundayjiang@tencent.com", "time": "Fri Oct 16 15:04:05 2026 +0200" }, "committer": { "name": "Thomas Huth", "email": "thuth@redhat.com", "time": "Thu Oct 22 12:32:18 2026 +0200" }, "message": "usb-host: free request on libusb submit failure\n\nWhen libusb_submit_transfer() fails in usb_host_handle_control() or\nusb_host_handle_data(), the USBHostRequest already queued via\nusb_host_req_alloc() is never freed and its r-\u003ep pointer is never\ncleared. The caller (xHCI) may then complete and free the\nXHCITransfer that embeds the USBPacket r-\u003ep points to, leaving a\ndangling pointer in s-\u003erequests. A subsequent\nusb_host_abort_xfers() -\u003e usb_host_req_abort() dereferences\nr-\u003ep-\u003estate on already-freed memory.\n\nCall usb_host_req_free(r) before returning, matching the existing\npattern in the #else branch of the BULK_STREAMS case.\n\nResolves: https://gitlab.com/qemu-project/qemu/-/work_items/3595\nFixes: 2b2325ff6491 (\"use libusb for usb-host\")\nReported-by: Haotian Jiang of Tencent Security (Yunding Lab) \u003csundayjiang@tencent.com\u003e\nSigned-off-by: Haotian Jiang \u003csundayjiang@tencent.com\u003e\nCc: qemu-stable@nongnu.org\n" }, { "commit": "432f505fa65ee12544d34998f56f4754115f605f", "tree": "e6095bcb393228f9ba7c306e27864d3094d97090", "parents": [ "322894eed304f7f96283206bd1c35ba7e8e11d62" ], "author": { "name": "Junjie Cao", "email": "junjie.cao@linux.dev", "time": "Sat Oct 03 23:48:03 2026 -0500" }, "committer": { "name": "Thomas Huth", "email": "thuth@redhat.com", "time": "Thu Oct 22 12:32:18 2026 +0200" }, "message": "tests/qtest/usb-hcd-xhci: test interrupt pacing above 2^32\n\nCommit bfb82d57e7 (\"hw/usb/hcd-xhci: fix interval alignment after\nMFINDEX passes 2^32\") fixed both isoch and interrupt scheduling, but\nthe regression test only covers the isoch path.\n\nQueue a keyboard report on an interrupt IN endpoint after stepping\npast 2^32 microframes. Check that the transfer remains pending until\nthe next interval boundary, then completes with the expected report.\nWith the old 32-bit mask, it completes as soon as the doorbell is rung.\n\nLink: https://lore.kernel.org/qemu-devel/52c9f935428f2cfc65e4dee7e37638fcb965c6b2.1789968699.git.junjie.cao@intel.com/\nSigned-off-by: Junjie Cao \u003cjunjie.cao@linux.dev\u003e\nMessage-ID: \u003c20261004044803.9740-1-junjie.cao@linux.dev\u003e\nSigned-off-by: Thomas Huth \u003cthuth@redhat.com\u003e\n" }, { "commit": "322894eed304f7f96283206bd1c35ba7e8e11d62", "tree": "fc78214ccccaa93ae364ab4134d222d60662c316", "parents": [ "e1b7f5e2a6715c4f7e9f5a4356101dc45b24b64f" ], "author": { "name": "Junjie Cao", "email": "junjie.cao@intel.com", "time": "Mon Oct 05 00:46:26 2026 -0500" }, "committer": { "name": "Thomas Huth", "email": "thuth@redhat.com", "time": "Thu Oct 22 12:31:48 2026 +0200" }, "message": "usb-host: free configuration descriptors on error paths\n\nusb_host_ep_update() returns before freeing the active configuration\ndescriptor when an endpoint address is invalid or duplicated.\nusb_host_claim_interfaces() also returns without freeing it when fewer\ninterfaces can be claimed than the descriptor declares. Each failure\nleaves one descriptor allocated.\n\nFixes: 2b2325ff6491 (\"use libusb for usb-host\")\nCc: qemu-stable@nongnu.org\nSigned-off-by: Junjie Cao \u003cjunjie.cao@intel.com\u003e\nReviewed-by: Marc-André Lureau \u003cmarcandre.lureau@redhat.com\u003e\nMessage-ID: \u003c20261005054626.131577-3-junjie.cao@linux.dev\u003e\nSigned-off-by: Thomas Huth \u003cthuth@redhat.com\u003e\n" }, { "commit": "e1b7f5e2a6715c4f7e9f5a4356101dc45b24b64f", "tree": "ef04596dddef9bc21264f4a53d08ad826a77299d", "parents": [ "46dcc681eac058198a7e909444373935a45687bb" ], "author": { "name": "Junjie Cao", "email": "junjie.cao@intel.com", "time": "Mon Oct 05 00:46:25 2026 -0500" }, "committer": { "name": "Thomas Huth", "email": "thuth@redhat.com", "time": "Thu Oct 22 12:31:01 2026 +0200" }, "message": "usb-host: validate interface number before indexing altsetting\n\nusb_host_ep_update() indexes USBDevice.altsetting with the interface\nnumber supplied by the active configuration descriptor. A descriptor\nwith bInterfaceNumber \u003e\u003d USB_MAX_INTERFACES reads past that array while\nthe host device is opened. Skip such interfaces before the lookup.\n\nRecord the descriptor\u0027s interface number on its endpoints as well. The\nloop index identifies the descriptor\u0027s position in the configuration,\nwhich need not equal bInterfaceNumber.\n\nFixes: 0dbe4768b95e (\"usb-host: use correct altsetting in usb_host_ep_update\")\nResolves: https://gitlab.com/qemu-project/qemu/-/issues/3975\nCc: qemu-stable@nongnu.org\nSigned-off-by: Junjie Cao \u003cjunjie.cao@intel.com\u003e\nReviewed-by: Marc-André Lureau \u003cmarcandre.lureau@redhat.com\u003e\nMessage-ID: \u003c20261005054626.131577-2-junjie.cao@linux.dev\u003e\nSigned-off-by: Thomas Huth \u003cthuth@redhat.com\u003e\n" }, { "commit": "46dcc681eac058198a7e909444373935a45687bb", "tree": "174a72e845985446dcbce71f83a7af7163223194", "parents": [ "9ad9a5a9239802aad163c8acd32f36e3d529cee1" ], "author": { "name": "Junjie Cao", "email": "junjie.cao@intel.com", "time": "Sat Oct 17 06:20:48 2026 +0000" }, "committer": { "name": "Thomas Huth", "email": "thuth@redhat.com", "time": "Thu Oct 22 09:35:49 2026 +0200" }, "message": "tests/qtest: Cover OHCI endpoint type mismatches\n\nCheck guest-visible state for OHCI transfers whose ED type disagrees with\nthe endpoint type. Successful control and isochronous transfers exercise\nthe same endpoint paths, ruling out inactive endpoints or an idle schedule.\n\nSigned-off-by: Junjie Cao \u003cjunjie.cao@intel.com\u003e\nMessage-ID: \u003c20261017062048.610930-1-junjie.cao@linux.dev\u003e\nSigned-off-by: Thomas Huth \u003cthuth@redhat.com\u003e\n" }, { "commit": "ed698be7700160c74d24ef7830adccd2a28d840a", "tree": "daa547f50f31ea7f2f330df4a2978d8aa09737b0", "parents": [ "3ad81d3d271cef6ce95b3a3a33bb71faabef56a2", "966572648f246483b2076149b4fb9d665789409a" ], "author": { "name": "Richard Henderson", "email": "richard.henderson@linaro.org", "time": "Thu Oct 22 08:20:10 2026 +0200" }, "committer": { "name": "Richard Henderson", "email": "richard.henderson@linaro.org", "time": "Thu Oct 22 08:20:10 2026 +0200" }, "message": "Merge tag \u0027firmware-20261021-pull-request\u0027 of https://gitlab.com/kraxel/qemu into staging\n\n- igvm: fix policy handling\n- igvm: misc minor fixes\n- igvm: add command line parameter support\n- hw/uefi: fix pkcs7 wrapping typo\n\n# -----BEGIN PGP SIGNATURE-----\n#\n# iQIzBAABCgAdFiEEoDKM/7k6F6eZAf59TLbY7tPocTgFAmrY6Q0ACgkQTLbY7tPo\n# cTg5QA/6A4Y57OE0sswzdg2p7mqZap/h2GnihCNoqDVca5nLv3fjbCCtP9r9pF/V\n# KJUWlNmd5n/6KUO+ry0jsFAUhveDGrj9X6kI68BnVqxG4DFuMKHNwsHydSdz2Zrw\n# BOjoBhJ5IvEZrqW2TKXVlnTitS3KfgVBs0ujTmwdFTEmzMZG8bKglCwuRnbmaWBq\n# yPWCpgdWSNq+n4QrhGmFAutiiKZkoF5DL2ejquI06k4mEHxGTYrwHwed61K70EVU\n# dSKj2+7eBP81S8ypYVXQLwSwVeFYAFJuEAFA8geFrWP2mZdfe/egmrJDTu4dC1rw\n# HNdR15n/FDEly0qW8Wd3ZHU4EiQxKWc6QzZMpcdFV6FG/R7PZcL4oQJdRT0Z67wt\n# w9+Vu54XIH6SxMjGztO8hCS5zobkYMAbafs1vnSQu8Du5/EhIaES5WXW/uXCVuUg\n# 4+Z7n8T9z2tVUCZCB3T26MMaXS1EG/FeDVWexdb+N+1CZw468JWOKhLuQpaOuEs4\n# +medbWYnHzwOxg+g8fhZx3WoCIfO9hpBy8/8drXh2V/Y3Johfw8sXvY6+iapWAhf\n# DSpgwMGCXXlIBFIE1uUwEWooburo5fbpk559NCSB98F9Bv6I2U5ZHtmyoQMd2gyV\n# HErXD0nvxmJd7K2o7TSSsbJMyojbusEwB+ZWMMd10feBpvwb9gM\u003d\n# \u003dweWe\n# -----END PGP SIGNATURE-----\n# gpg: Signature made Wed 21 Oct 2026 06:32:13 PM CEST\n# gpg: using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138\n# gpg: Good signature from \"Gerd Hoffmann (work) \u003ckraxel@redhat.com\u003e\" [unknown]\n# gpg: aka \"Gerd Hoffmann \u003cgerd@kraxel.org\u003e\" [unknown]\n# gpg: aka \"Gerd Hoffmann (private) \u003ckraxel@gmail.com\u003e\" [unknown]\n# gpg: WARNING: This key is not certified with a trusted signature!\n# gpg: There is no indication that the signature belongs to the owner.\n# Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138\n\n* tag \u0027firmware-20261021-pull-request\u0027 of https://gitlab.com/kraxel/qemu:\n backends/igvm: fix parameter area entries leak\n docs/system/igvm: document MADT, COMMAND_LINE and DEVICE_TREE directives\n igvm: add command line parameter support\n hw/uefi: fix ContentInfo detection in wrap_pkcs7()\n backends/igvm: supply an empty device tree when the machine has none\n igvm/sev: forward the IGVM guest policy to the platform before launch\n i386/sev: add a get_guest_policy callback\n i386/sev: convert the guest policy properties to custom accessors\n igvm: move set_id_block call into the SNP ID block directive handler\n sev: split set_guest_policy into set_guest_policy and set_id_block\n\nSigned-off-by: Richard Henderson \u003crichard.henderson@linaro.org\u003e\n" }, { "commit": "3ad81d3d271cef6ce95b3a3a33bb71faabef56a2", "tree": "acb19ff568e9e4c5d2d166036923fb57c3bc1ff3", "parents": [ "8967b2fe1b2aaae3c29e207d85fab901d580a2dc", "3a6d37c9883d21529a01e3615960696f91499153" ], "author": { "name": "Richard Henderson", "email": "richard.henderson@linaro.org", "time": "Thu Oct 22 08:19:49 2026 +0200" }, "committer": { "name": "Richard Henderson", "email": "richard.henderson@linaro.org", "time": "Thu Oct 22 08:19:49 2026 +0200" }, "message": "Merge tag \u0027pbouvier/pr/ci_gitlab-20261021\u0027 of https://gitlab.com/p-b-o/qemu into staging\n\nChanges:\n- [PATCH] ci: add automatic retry (Pierrick Bouvier \u003cpierrick.bouvier@oss.qualcomm.com\u003e)\n Link: https://lore.kernel.org/qemu-devel/20261020231602.24344-1-pierrick.bouvier@oss.qualcomm.com\n\n# -----BEGIN PGP SIGNATURE-----\n#\n# iQGzBAABCgAdFiEEN8FWlNi6l2Sxlz/btEQ30ZwoYt8FAmrZAi4ACgkQtEQ30Zwo\n# Yt+L9gwAujO6mEHpR2zRrYyhLD8McxzLzCFt8vS7AboASzVLQJGn8OqB4Gmc41JU\n# fCFitHnC1u0IvBABUhFIUFD9VN+OMqk8avvcdROYCJE6Z074xzk8QlMkvMpRT0Sc\n# jJdX6WC2OSF0a54f1NRYs7NJkChTHKE/CsKElb9nbQSpPEPxhxc8M1dhS6DBZe/K\n# 0IpJ0p02jK1KG5wEUIIb8aG2WIrWpS3u9U3wOiKIp/BB9ee52AB6OiRwW0FtadmI\n# IpCezAz2hXGn1jz+r7A0/rTdqy6ZdfV8xOKPe5RYnL2W81AMeKOEa4OSvjLsRbNl\n# dW66n+RaTaJHbUBt6QesYkV4usbWfIAJFHEBmOHJ54tqfH4VH8ltRLR3A0R8x8uC\n# 4GZCw2ME0uO8Wje4CaNorU5ny2ADidMEy+eSgftS3lD4DWCMU7PCYDh4YmcoOkrQ\n# 4HtnBzZ6QZsEu9AUFKu6qiEj1NyIYIjAG6tiKYI/U2o025Rgns1q8r7Qf8tKsxsw\n# 2BRCG5KN\n# \u003d+hPV\n# -----END PGP SIGNATURE-----\n# gpg: Signature made Wed 21 Oct 2026 08:19:26 PM CEST\n# gpg: using RSA key 37C15694D8BA9764B1973FDBB44437D19C2862DF\n# gpg: Good signature from \"Pierrick Bouvier \u003cpierrick.bouvier@oss.qualcomm.com\u003e\" [unknown]\n# gpg: WARNING: This key is not certified with a trusted signature!\n# gpg: There is no indication that the signature belongs to the owner.\n# Primary key fingerprint: 37C1 5694 D8BA 9764 B197 3FDB B444 37D1 9C28 62DF\n\n* tag \u0027pbouvier/pr/ci_gitlab-20261021\u0027 of https://gitlab.com/p-b-o/qemu:\n ci: add automatic retry\n\nSigned-off-by: Richard Henderson \u003crichard.henderson@linaro.org\u003e\n" }, { "commit": "3a6d37c9883d21529a01e3615960696f91499153", "tree": "acb19ff568e9e4c5d2d166036923fb57c3bc1ff3", "parents": [ "8967b2fe1b2aaae3c29e207d85fab901d580a2dc" ], "author": { "name": "Pierrick Bouvier", "email": "pierrick.bouvier@oss.qualcomm.com", "time": "Tue Oct 20 23:16:02 2026 +0000" }, "committer": { "name": "Pierrick Bouvier", "email": "pierrick.bouvier@oss.qualcomm.com", "time": "Wed Oct 21 18:18:33 2026 +0000" }, "message": "ci: add automatic retry\n\nWhen merging PR on the project, it\u0027s possible to observe failures on CI\nthat can be related to sporadic test failures or infrastructure issues\n(pod eviction with Kubernetes). As a result, it adds latency on the\nprocess and workload for our top maintainers.\n\nThis patch sets an automatic retry (supported by gitlab out of the box),\nso failing jobs are automatically retriggered.\n\nIt\u0027s important to note that in case there is a real test or build\nfailure, concerned jobs will run a second time, and fail again. That\nsaid, it happens seldomly since sub maintainers are supposed to test for\nthis before sending it. Also, the retry is limited to the job that\nfailed, so it should be cheap in terms of CI minutes.\n\nAcked-by: Richard Henderson \u003crichard.henderson@linaro.org\u003e\nLink: https://lore.kernel.org/qemu-devel/20261020231602.24344-1-pierrick.bouvier@oss.qualcomm.com\nSigned-off-by: Pierrick Bouvier \u003cpierrick.bouvier@oss.qualcomm.com\u003e\n" }, { "commit": "966572648f246483b2076149b4fb9d665789409a", "tree": "0283d2dddb20e55b3b0021027cb8a30294cdcd9b", "parents": [ "edd5339a08551dcb0b4bb4dfb740ff45c31685ae" ], "author": { "name": "Stefano Garzarella", "email": "sgarzare@redhat.com", "time": "Wed Oct 21 10:24:59 2026 +0200" }, "committer": { "name": "Gerd Hoffmann", "email": "kraxel@redhat.com", "time": "Wed Oct 21 18:26:52 2026 +0200" }, "message": "backends/igvm: fix parameter area entries leak\n\nqigvm_directive_parameter_area() allocates a QIgvmParameterData entry\nfor each parameter area, allocates the data buffer, and queues it in\nthe list.\n\nAt the end of qigvm_process_file() we iterate the list to only free\nthe data buffer of each entry, but never the entry itself, so all of\nthem are leaked.\n\nLet\u0027s also free the entry itself and remove it from the list. We could\navoid the removal since the list lives on the stack, but it\u0027s better to\nleave the list consistent.\n\nFixes: c1d466d267cf (\"backends/igvm: Add IGVM loader and configuration\")\nSigned-off-by: Stefano Garzarella \u003csgarzare@redhat.com\u003e\nMessage-ID: \u003c20261021082459.72038-1-sgarzare@redhat.com\u003e\nSigned-off-by: Gerd Hoffmann \u003ckraxel@redhat.com\u003e\n" }, { "commit": "edd5339a08551dcb0b4bb4dfb740ff45c31685ae", "tree": "8a984703784ebe4aaec6379cc597cdf9ae654e1d", "parents": [ "fe2de89215ce045f087e1f916842fa0934b582e0" ], "author": { "name": "Luigi Leonardi", "email": "leonardi@redhat.com", "time": "Mon Oct 19 11:12:47 2026 +0200" }, "committer": { "name": "Gerd Hoffmann", "email": "kraxel@redhat.com", "time": "Wed Oct 21 18:26:46 2026 +0200" }, "message": "docs/system/igvm: document MADT, COMMAND_LINE and DEVICE_TREE directives\n\nThe MADT and DEVICE_TREE directives were added without updating the\nlist of supported directives. Document them, together with the\nCOMMAND_LINE directive added in the previous patch.\n\nSuggested-by: Stefano Garzarella \u003csgarzare@redhat.com\u003e\nSigned-off-by: Luigi Leonardi \u003cleonardi@redhat.com\u003e\nReviewed-by: Stefano Garzarella \u003csgarzare@redhat.com\u003e\nMessage-ID: \u003c20261019-igvm_command_line-v3-2-29aeacbd6cd7@redhat.com\u003e\nSigned-off-by: Gerd Hoffmann \u003ckraxel@redhat.com\u003e\n" }, { "commit": "fe2de89215ce045f087e1f916842fa0934b582e0", "tree": "36d1b1ab71af2d5bdd34479d64ea72c891abd155", "parents": [ "e90644eea1ce545482b923b81809b3b96bac1be3" ], "author": { "name": "Luigi Leonardi", "email": "leonardi@redhat.com", "time": "Mon Oct 19 11:12:46 2026 +0200" }, "committer": { "name": "Gerd Hoffmann", "email": "kraxel@redhat.com", "time": "Wed Oct 21 18:26:40 2026 +0200" }, "message": "igvm: add command line parameter support\n\nAdd a \"cmdline\" property to the igvm-cfg object and a handler for the\nIGVM_VHT_COMMAND_LINE directive, which copies the string into the\nparameter area the directive points at.\n\nThe command line is passed to whatever software the IGVM file loads,\nsuch as an SVSM. For example, SVSM can use it to select the serial port\nit logs to.\n\nAcked-by: Markus Armbruster \u003carmbru@redhat.com\u003e\nSigned-off-by: Luigi Leonardi \u003cleonardi@redhat.com\u003e\nReviewed-by: Stefano Garzarella \u003csgarzare@redhat.com\u003e\nMessage-ID: \u003c20261019-igvm_command_line-v3-1-29aeacbd6cd7@redhat.com\u003e\nSigned-off-by: Gerd Hoffmann \u003ckraxel@redhat.com\u003e\n" }, { "commit": "e90644eea1ce545482b923b81809b3b96bac1be3", "tree": "874430341a5cac4b9c33a25658f33438002a59e5", "parents": [ "ed9e629535543ef114bdc2f5bd45349dbc0adedf" ], "author": { "name": "Martin Pitt", "email": "martin@amutable.com", "time": "Sun Oct 18 22:01:25 2026 +0200" }, "committer": { "name": "Gerd Hoffmann", "email": "kraxel@redhat.com", "time": "Wed Oct 21 18:26:32 2026 +0200" }, "message": "hw/uefi: fix ContentInfo detection in wrap_pkcs7()\n\nFix wrap_pkcs7()\u0027s detection for an already present PKCS ContentInfo\nenvelope: It previously compared byte 15 with 0x0a (ASN.1\nENUMERATED) instead of 0xa0 (the [0] EXPLICIT context tag of\nContentInfo.content). See the original edk2 function [1] where this was\ntaken from.\n\nDue to that typo, an already wrapped signature got wrapped a second\ntime, and gnutls_pkcs7_import() rejected it. This breaks Secure Boot key\nenrollment with .auth files carrying the envelope, as created by\nsystemd\u0027s \"bootctl --secure-boot-auto-enroll\".\n\n[1] https://github.com/tianocore/edk2/blob/8f8372439d8ec5f565dbda1548c18deb068e0080/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyCommon.c#L68\n\nFixes: 3e33af2cb306 (\"hw/uefi: add var-service-pkcs7.c\")\nCc: qemu-stable@nongnu.org\nSigned-off-by: Martin Pitt \u003cmartin@amutable.com\u003e\nMessage-ID: \u003catUllV8bSaHylfKv@piware.de\u003e\nSigned-off-by: Gerd Hoffmann \u003ckraxel@redhat.com\u003e\n" }, { "commit": "ed9e629535543ef114bdc2f5bd45349dbc0adedf", "tree": "f4d4debe128edd94aab46c38b16336ff70cb35ea", "parents": [ "66a7181eedab350a3a4a33fd7e63c32a56c25424" ], "author": { "name": "Luigi Leonardi", "email": "leonardi@redhat.com", "time": "Wed Sep 23 18:20:55 2026 +0200" }, "committer": { "name": "Gerd Hoffmann", "email": "kraxel@redhat.com", "time": "Wed Oct 21 18:26:24 2026 +0200" }, "message": "backends/igvm: supply an empty device tree when the machine has none\n\nCommit 1c4bd8f13c (\"igvm: add device tree parameter support\") added\nhandling for the IGVM device tree parameter directive. The handler\nfails when the machine has not built a device tree of its own, so an\nIGVM file carrying that directive cannot be booted on such a machine,\nfor example q35.\n\nAn empty tree satisfies the IGVM file\u0027s request, so build and supply\none instead of rejecting the whole file.\n\nWhile at it, rename fdt_packed to fdt, which better reflects the\ncontent of the variable, as it does not always hold a packed fdt.\n\nSigned-off-by: Luigi Leonardi \u003cleonardi@redhat.com\u003e\nMessage-ID: \u003c20260923-relax_dt-v1-1-ff40f2a06acd@redhat.com\u003e\nSigned-off-by: Gerd Hoffmann \u003ckraxel@redhat.com\u003e\n" }, { "commit": "66a7181eedab350a3a4a33fd7e63c32a56c25424", "tree": "2ce0b467bbe7fb010a09031158f79ae37da420a7", "parents": [ "e2ccffd38f0c22eb615299b5e45596f7ef3900fb" ], "author": { "name": "Luigi Leonardi", "email": "leonardi@redhat.com", "time": "Mon Sep 07 17:57:01 2026 +0200" }, "committer": { "name": "Gerd Hoffmann", "email": "kraxel@redhat.com", "time": "Wed Oct 21 18:26:17 2026 +0200" }, "message": "igvm/sev: forward the IGVM guest policy to the platform before launch\n\nset_guest_policy was called from qigvm_handle_policy at the end of\nqigvm_process_file, after LAUNCH_START had already been issued for both\nSEV/SEV-ES and SEV-SNP. The guest was therefore launched with whatever\npolicy was already configured (the command-line value, or the platform\ndefault if none was given) instead of the one requested by the IGVM\nfile, quietly breaking attestation since the policy is part of the\nattestation report.\n\nMove the call into qigvm_initialization_guest_policy, which runs while\nthe initialization section is processed. Because that section is now\nhandled during the pre-launch pass (see previous patch), the call\nhappens before LAUNCH_START, so the policy is in effect for launch. Drop\nqigvm_handle_policy, whose only remaining job was that misplaced call.\ncgs_set_guest_policy no longer special-cases SEV_STATE_UNINIT: that\nguard used to skip the pre-processing pass so the policy was applied\nlater, but forwarding it during pre-processing, before LAUNCH_START, is\nnow precisely the point. The \u0027policy \u003d\u003d 0 means unset\u0027 guard is dropped\ntoo, since the call site now only fires when the IGVM file actually\nprovides a GUEST_POLICY header.\n\nThe command line can also set a policy. It now takes precedence: if it\ndiffers from the IGVM one, print a warning and keep the command-line\nvalue instead of silently overriding it. Also reject a policy that\ndoesn\u0027t fit in the 32-bit SEV/SEV-ES policy field instead of truncating\nit.\n\nFinally, use the get_guest_policy callback added by the previous patch\nto populate the SNP ID block\u0027s policy field. The command line sets its\npolicy directly into the SEV/SNP guest\u0027s own struct, bypassing IGVM\nentirely, so ctx-\u003esev_policy only ever reflects a GUEST_POLICY header\nand is 0 otherwise, causing SNP_LAUNCH_FINISH to reject the ID block\nwhenever the file relies on a command-line policy. Reading the policy\nback from the platform instead always gets the value actually in\neffect, regardless of its source. ctx-\u003esev_policy is now unused and\nremoved.\n\nLink: https://gitlab.com/qemu-project/qemu/-/work_items/4189\nFixes: 915b47078d (\"backends/igvm: Handle policy for SEV guests\")\nSigned-off-by: Luigi Leonardi \u003cleonardi@redhat.com\u003e\nMessage-ID: \u003c20260907-fix_igvm_policy-v2-5-c8c50f1dbfda@redhat.com\u003e\nSigned-off-by: Gerd Hoffmann \u003ckraxel@redhat.com\u003e\n" }, { "commit": "e2ccffd38f0c22eb615299b5e45596f7ef3900fb", "tree": "d8b9d449cd2b73dabe01d500996e3a42560ce5df", "parents": [ "c03834a570ed0212571555c65e78de7726656f17" ], "author": { "name": "Luigi Leonardi", "email": "leonardi@redhat.com", "time": "Mon Sep 07 17:57:00 2026 +0200" }, "committer": { "name": "Gerd Hoffmann", "email": "kraxel@redhat.com", "time": "Wed Oct 21 18:26:11 2026 +0200" }, "message": "i386/sev: add a get_guest_policy callback\n\nThe next patch populates the SEV-SNP ID block\u0027s policy field.\nThat value must be whatever policy is currently in effect on the platform\nbut there is no way to read it back: the policy can come either from an\nIGVM GUEST_POLICY header or from the command line, and the command line\nsets it directly into the SEV/SNP guest struct without going through IGVM.\nReading it back from the platform is the only source that always reflects\nthe value in effect, regardless of where it came from.\n\nAdd a get_guest_policy callback to ConfidentialGuestSupportClass for\nthis purpose. It is not yet used; the following patch wires it into the\nSNP ID block population.\n\nSigned-off-by: Luigi Leonardi \u003cleonardi@redhat.com\u003e\nMessage-ID: \u003c20260907-fix_igvm_policy-v2-4-c8c50f1dbfda@redhat.com\u003e\nSigned-off-by: Gerd Hoffmann \u003ckraxel@redhat.com\u003e\n" }, { "commit": "c03834a570ed0212571555c65e78de7726656f17", "tree": "8c9da15e28a21dd18834e894ef3e6ff047aac795", "parents": [ "110d14948b230837851bd203a238a20665c84df7" ], "author": { "name": "Luigi Leonardi", "email": "leonardi@redhat.com", "time": "Mon Sep 07 17:56:59 2026 +0200" }, "committer": { "name": "Gerd Hoffmann", "email": "kraxel@redhat.com", "time": "Wed Oct 21 18:26:05 2026 +0200" }, "message": "i386/sev: convert the guest policy properties to custom accessors\n\nBoth SEV/SEV-ES and SEV-SNP expose a \"policy\" object property. The\nSEV/SEV-ES one was registered as a plain uint32 pointer property, and\nthe SEV-SNP setter ignored the result of the visit.\n\nGive both properties explicit getter/setter functions and check the\nreturn value of the visit in the setters. This is preparation for\ntracking whether the guest policy was set on the command line.\n\nNo functional change intended.\n\nReviewed-by: Ani Sinha \u003canisinha@redhat.com\u003e\nSigned-off-by: Luigi Leonardi \u003cleonardi@redhat.com\u003e\nMessage-ID: \u003c20260907-fix_igvm_policy-v2-3-c8c50f1dbfda@redhat.com\u003e\nSigned-off-by: Gerd Hoffmann \u003ckraxel@redhat.com\u003e\n" }, { "commit": "110d14948b230837851bd203a238a20665c84df7", "tree": "a23aed093c4951e98a880c07d6fb00bb44e19901", "parents": [ "2f0796d98be1ffbe24d021207851c9f0050125a3" ], "author": { "name": "Luigi Leonardi", "email": "leonardi@redhat.com", "time": "Mon Sep 07 17:56:58 2026 +0200" }, "committer": { "name": "Gerd Hoffmann", "email": "kraxel@redhat.com", "time": "Wed Oct 21 18:25:59 2026 +0200" }, "message": "igvm: move set_id_block call into the SNP ID block directive handler\n\nset_id_block only makes sense when the IGVM file contains an\nIGVM_VHT_SNP_ID_BLOCK directive. Move the call from qigvm_handle_policy\n(which continues to handle the set_guest_policy call) into\nqigvm_directive_snp_id_block, where the ID block and ID auth are\npopulated. This avoids a no-op call to set_id_block when no ID block\nis present.\n\nThe ID block embeds the guest policy, so the policy must be known by the\ntime the directive is handled. Process the initialization section (which\ncarries the GUEST_POLICY header) before the directive section, and\ncopy ctx-\u003esev_policy into the ID block in the directive handler.\n\nSigned-off-by: Luigi Leonardi \u003cleonardi@redhat.com\u003e\nMessage-ID: \u003c20260907-fix_igvm_policy-v2-2-c8c50f1dbfda@redhat.com\u003e\nSigned-off-by: Gerd Hoffmann \u003ckraxel@redhat.com\u003e\n" }, { "commit": "2f0796d98be1ffbe24d021207851c9f0050125a3", "tree": "108bbe1e163d2121f8ec4b83c671c813e7941414", "parents": [ "8967b2fe1b2aaae3c29e207d85fab901d580a2dc" ], "author": { "name": "Luigi Leonardi", "email": "leonardi@redhat.com", "time": "Mon Sep 07 17:56:57 2026 +0200" }, "committer": { "name": "Gerd Hoffmann", "email": "kraxel@redhat.com", "time": "Wed Oct 21 18:25:48 2026 +0200" }, "message": "sev: split set_guest_policy into set_guest_policy and set_id_block\n\nThe set_guest_policy callback on ConfidentialGuestSupportClass mixed\ntwo unrelated jobs: writing the guest policy bits and providing the\nSEV-SNP ID block/ID auth for LAUNCH_FINISH. The two are only related\nbecause both come from the same \u0027policy\u0027 section of the SEV/SEV-SNP\nlaunch flow, but they need to be set at different times: the policy\nmust be in effect before LAUNCH_START, while the ID block is only\nneeded before LAUNCH_FINISH.\n\nSplit the combined callback into set_guest_policy(policy_type, policy,\nerrp) and set_id_block(id_block, id_block_size, id_auth, id_auth_size,\nerrp), keeping both call sites exactly where the combined callback used\nto be called from. No functional change.\n\nSigned-off-by: Luigi Leonardi \u003cleonardi@redhat.com\u003e\nReviewed-by: Ani Sinha \u003canisinha@redhat.com\u003e\nMessage-ID: \u003c20260907-fix_igvm_policy-v2-1-c8c50f1dbfda@redhat.com\u003e\nSigned-off-by: Gerd Hoffmann \u003ckraxel@redhat.com\u003e\n" }, { "commit": "9ad9a5a9239802aad163c8acd32f36e3d529cee1", "tree": "a4e8cbe2bf92b98dd70309b9cea09057407e114b", "parents": [ "b17205f23a9a8661394d30148b2c995ffa932019" ], "author": { "name": "Peter Maydell", "email": "peter.maydell@linaro.org", "time": "Thu Oct 01 20:47:56 2026 +0100" }, "committer": { "name": "Thomas Huth", "email": "thuth@redhat.com", "time": "Tue Oct 20 12:30:39 2026 +0200" }, "message": "hw/usb/hcd-ohci: Fail iso packets sent to non-iso endpoints and vice-versa\n\nThe OHCI USB controller requires software to set up an Endpoint\nDescriptor data structure. This specifies (among other things) both\nan EndpointNumber telling the controller which USB endpoint to talk\nto, and a Format (F) bit which is 1 for Isochronous transfers and 0\nfor General transfers.\n\nThe specification requires that software matches the F bit with the\nendpoint it\u0027s setting up the descriptor for, so that Control, Bulk\nand Interrupt endpoints use F\u003d0, and Isochronous endpoints use F\u003d1.\nIt doesn\u0027t require the controller to check whether software gets this\nright.\n\nThe spec isn\u0027t totally clear about what happens if software creates\nan ED with a mismatch, but I believe that the controller just trusts\nthe F bit, and tries to talk to the endpoint with the wrong sequence\nof USB tokens (notably, isochronous transactions have no handshaking\nand the others do). This probably results in the transfer failing.\n\nIn hcd-ehci.c we check for the \"iso transfer to non-iso endpoint\" and\nmake it fail, but we don\u0027t do this in hcd-ohci.c. The result is that\na guest that deliberately sets up this situation can cause us to hit\nthe assertion added in commit 7b1eba96aeca, where the endpoint is not\nisochronous and returns USB_RET_ASYNC to an iso TD handling function\nthat isn\u0027t prepared to deal with that.\n\nAdd checks for both \"iso transfer to non-iso endpoint\" and \"non-iso\ntransfer to iso endpoint\" and make those TDs fail rather than blindly\nsending them to the endpoint.\n\nCc: qemu-stable@nongnu.org\nCVE: CVE-2026-7180 (together with 7b1eba96aecac32d186d4c16b81c7b4681186844)\nResolves: https://gitlab.com/qemu-project/qemu/-/work_items/3729\nSigned-off-by: Peter Maydell \u003cpeter.maydell@linaro.org\u003e\nMessage-ID: \u003c20261001194756.3003085-1-peter.maydell@linaro.org\u003e\nSigned-off-by: Thomas Huth \u003cthuth@redhat.com\u003e\n" }, { "commit": "b17205f23a9a8661394d30148b2c995ffa932019", "tree": "25d1d8734d9adfbb53c4a05ee604edc4584df77c", "parents": [ "8967b2fe1b2aaae3c29e207d85fab901d580a2dc" ], "author": { "name": "Tommaso Califano", "email": "tcalifano@redhat.com", "time": "Mon Oct 12 16:08:38 2026 +0200" }, "committer": { "name": "Thomas Huth", "email": "thuth@redhat.com", "time": "Tue Oct 20 12:30:39 2026 +0200" }, "message": "hw/usb/dev-mtp: Fix assert crash on undersized BULK IN\n\nThe EP_DATA_IN result path serializes the queued response as a 12\nbyte MTP container header followed by one 4 byte word per result\nargument (12 + 4 * argc bytes). The entry check at the top of the\nfunction only verifies that the guest-provided transfer buffer holds\nat least the 12 byte header.\n\nIf the queued result carries arguments, e.g. RES_SESSION_ALREADY_OPEN\nwhich returns the existing session ID, the second usb_packet_copy()\nwrites past the end of the guest-declared buffer and trips the\np-\u003eactual_length + bytes \u003c\u003d iov-\u003esize assertion, aborting QEMU. A\nguest can control the transfer size freely, e.g. TBYTES in the qTD\nof an EHCI BULK IN.\n\nA device must not send more data than the initiator signaled it would\naccept. Stall the transfer instead, and keep the result queued so that\na subsequent BULK IN with a sufficient buffer size delivers the full\nresponse.\n\nFixes: 840a178c94db (\"usb: mtp filesharing\")\nResolves: https://gitlab.com/qemu-project/qemu/-/work_items/3386\nSigned-off-by: Tommaso Califano \u003ctcalifano@redhat.com\u003e\nReviewed-by: Junjie Cao \u003cjunjie.cao@intel.com\u003e\nReviewed-by: Luigi Leonardi \u003cleonardi@redhat.com\u003e\nMessage-ID: \u003c20261012140839.93559-1-tcalifano@redhat.com\u003e\nSigned-off-by: Thomas Huth \u003cthuth@redhat.com\u003e\n" }, { "commit": "8967b2fe1b2aaae3c29e207d85fab901d580a2dc", "tree": "07274657e09d95c6a35a88467f6a11da610bb2ed", "parents": [ "288b6c9e78913401fac4880b3281ce431540b8df", "e727e0c5d7d31640708fe3cebe31cc1312eefadc" ], "author": { "name": "Richard Henderson", "email": "richard.henderson@linaro.org", "time": "Tue Oct 20 07:04:06 2026 +0200" }, "committer": { "name": "Richard Henderson", "email": "richard.henderson@linaro.org", "time": "Tue Oct 20 07:04:06 2026 +0200" }, "message": "Merge tag \u0027pull-9p-20261019\u0027 of https://github.com/cschoenebeck/qemu into staging\n\n9pfs changes:\n\n- Fix dir stream race via legacy 9p2000.u Tread request.\n\n- Tests: add 9p race test suite (registered as slow tests).\n\n# -----BEGIN PGP SIGNATURE-----\n#\n# iQJLBAABCgA1FiEEltjREM96+AhPiFkBNMK1h2Wkc5UFAmrWKLEXHHFlbXVfb3Nz\n# QGNydWRlYnl0ZS5jb20ACgkQNMK1h2Wkc5WrYw//V/K6pqpBlNHNBm9uAmWCQUcy\n# 1imcc3zjvWkuvXPpjvoDVWqOkBaXh7a/1foCHsr5yxFBoMisw4N6wvTN5kXGwZZ/\n# gUxpiERi8FmRyH27TNoOVQ6hf2ndY13B/1jX7IHhlJX1vclzwUYTT6vlybiJc0jJ\n# M8cyIRQ+NqFkjKl74IF0E+xdljNOxlAqSgL7fGBRGOBwS/9Wx5soCOajcfULsWba\n# 60scZgHb04xx11JIhy+qm2pTgLw7FLx5lhFqtnIE6tCh0F/mk7RHrpzr0B556+e+\n# lEGwdUJCE3w09bqfEtKwZmLT+C4XYiPEA+uc/wq31ydWmWwZjsvkxAF5c3GW+6Cp\n# gslpy0w0Qsb+ymvQG6LjB6rzQT28DFnuI7QPIA129QZVCmjjBeOJt9isL8xAG1FO\n# ivzpQjPAtthexJkMjoQh6DjJrlTZkmuVVh8S3zOYHJw46xYaYNJjLQPns7HfB+A/\n# A183ok2oIXT/ATQMPLguXKxLPcfPfJ34rDsfdYngzJwbGbNd2QEzrEGa86K0vA73\n# EBS7MoV7oJ5mXuLLmC5NFt+TN/Q2PuyKG8vYfTbyt6X0VAkf1+5oOftxxExXaV7W\n# /42pFYDMM6jmq09DlBAKh6D2KWvHC1eNcSOp5LEJrE0c5gBMK1stBc9geptoNhmB\n# wTH1mNkGf7OgWa3XC6A\u003d\n# \u003djenn\n# -----END PGP SIGNATURE-----\n# gpg: Signature made Mon 19 Oct 2026 04:26:57 PM CEST\n# gpg: using RSA key 96D8D110CF7AF8084F88590134C2B58765A47395\n# gpg: issuer \"qemu_oss@crudebyte.com\"\n# gpg: Good signature from \"Christian Schoenebeck \u003cqemu_oss@crudebyte.com\u003e\" [unknown]\n# gpg: WARNING: The key\u0027s User ID is not certified with a trusted signature!\n# gpg: There is no indication that the signature belongs to the owner.\n# Primary key fingerprint: ECAB 1A45 4014 1413 BA38 4926 30DB 47C3 A012 D5F4\n# Subkey fingerprint: 96D8 D110 CF7A F808 4F88 5901 34C2 B587 65A4 7395\n\n* tag \u0027pull-9p-20261019\u0027 of https://github.com/cschoenebeck/qemu:\n tests/9p-race: add Tread-on-dir race test\n tests/9p-client: track the negotiated 9p version for session\n tests/9p-client: add Tcreate / Rcreate test client functions\n hw/9pfs: fix dirent stream protection for legacy (9p2000.u) Tread\n tests/9p-race: add Treaddir race test\n tests/9p-client: add Tstat / Rstat test client functions\n tests/9p-client: add Rerror function (legacy 9p2000.u)\n tests/9p-race: add 9p race test suite (race FID-path mutations)\n tests/9p-client: add Txattrwalk / Rxattrwalk test client functions\n\nSigned-off-by: Richard Henderson \u003crichard.henderson@linaro.org\u003e\n" }, { "commit": "e727e0c5d7d31640708fe3cebe31cc1312eefadc", "tree": "07274657e09d95c6a35a88467f6a11da610bb2ed", "parents": [ "b1ba6810f10139f5346c8fe49102d534aa94ce88" ], "author": { "name": "Christian Schoenebeck", "email": "qemu_oss@crudebyte.com", "time": "Wed Oct 07 12:28:15 2026 +0200" }, "committer": { "name": "Christian Schoenebeck", "email": "qemu_oss@crudebyte.com", "time": "Mon Oct 19 16:07:26 2026 +0200" }, "message": "tests/9p-race: add Tread-on-dir race test\n\nAdd \"race/tread-dir\" test, a test racing legacy (9p2000.u)\nTread requests against each other on the same directory FID.\n\nThis test guards the previous fix patch (\"hw/9pfs: fix dirent\nstream protection for legacy (9p2000.u) Tread\").\n\nIn each round a configurable number (V9FS_RACE_NCONCURRENT) of\nconcurrent Tread requests are issued against each other, verifying\nthat every Tread response lists the same (leading) directory entries\nas a reference directory entry list taken before the actual\nconcurrent Tread request sequence starts.\n\nA vulnerable server would return directory entries either with\ncorrupted entry names, or entries in varying order, or even crash\nthe QEMU process due to garbage dirent seek targets.\n\nThis test is explicitly using a 9p2000.u session, as Tread on\ndirectories is not a 9p2000.L feature (the latter uses Treaddir\ninstead).\n\nThis test is registered as slow test (i.e. skipped by default) and\ntherefore requires -m slow to run.\n\nOn my test machine a full run of 20000 rounds took around 5 minutes\nto complete.\n\nLink: https://lore.kernel.org/qemu-devel/39f9fb4e48dfd08ed6d05519be5a28898a3bf872.1791368962.git.qemu_oss@crudebyte.com\nSigned-off-by: Christian Schoenebeck \u003cqemu_oss@crudebyte.com\u003e\n" }, { "commit": "b1ba6810f10139f5346c8fe49102d534aa94ce88", "tree": "8a378cba23931b055b0aaaff82b503b9c0c5a1c5", "parents": [ "d8dd4017095383bd4b14a7ee8151248f6902eb72" ], "author": { "name": "Christian Schoenebeck", "email": "qemu_oss@crudebyte.com", "time": "Wed Oct 07 12:27:59 2026 +0200" }, "committer": { "name": "Christian Schoenebeck", "email": "qemu_oss@crudebyte.com", "time": "Mon Oct 19 16:07:26 2026 +0200" }, "message": "tests/9p-client: track the negotiated 9p version for session\n\nSo far v9fs_tattach() always sent an implied Tversion request, which\nwas supposed to be a convenient mechanisms such that not every test\ncase code would need to call v9fs_tversion() prior to a\nv9fs_tattach(). The problem however is that this implicit Tversion\ndefaults to 9p2000.L, and it would also be (re)sent if an explicit\nv9fs_tversion() call had been issued with 9p2000.u before, which then\nwould reset the session to the unintended 9p2000.L protocol version.\n\nFix this by storing the initial Tversion request\u0027s (desired) protocol\nversion to the client object. And only issue the implicit Tversion\nrequest inside of v9fs_tattach() if no protocol version had been\nnegotiated already.\n\nThis is a preparatory patch for the subsequently added race test,\nwhich negotiates a 9p2000.u session.\n\nIt also allows request / response handling to later become more\nprotocol dialect aware (e.g. expecting specific request / response\ntypes according to negotiated protocol version during a session).\n\nLink: https://lore.kernel.org/qemu-devel/419b2b047c0f61b9e4a7e58f117c03ec6feea1ea.1791368962.git.qemu_oss@crudebyte.com\nSigned-off-by: Christian Schoenebeck \u003cqemu_oss@crudebyte.com\u003e\n" }, { "commit": "d8dd4017095383bd4b14a7ee8151248f6902eb72", "tree": "b7b17ea6b9c80ee978c8875e2d953fab526e70ce", "parents": [ "12df3256042c8db14984248d0660d14e380b312d" ], "author": { "name": "Christian Schoenebeck", "email": "qemu_oss@crudebyte.com", "time": "Wed Oct 07 12:27:55 2026 +0200" }, "committer": { "name": "Christian Schoenebeck", "email": "qemu_oss@crudebyte.com", "time": "Mon Oct 19 16:07:26 2026 +0200" }, "message": "tests/9p-client: add Tcreate / Rcreate test client functions\n\nAdd v9fs_tcreate() and v9fs_rcreate() functions to the 9p test\nclient for the legacy 9p2000(.u) Tcreate request type.\n\nThis is a preparatory patch, these functions will be used by the\nsubsequently added 9p race test.\n\nLink: https://lore.kernel.org/qemu-devel/532fed8595419fd57ec7d24dc5dbcbd8b1190e80.1791368962.git.qemu_oss@crudebyte.com\nSigned-off-by: Christian Schoenebeck \u003cqemu_oss@crudebyte.com\u003e\n" }, { "commit": "12df3256042c8db14984248d0660d14e380b312d", "tree": "1640f9eb04f347f6e2ffbb960a31bd711271eb7c", "parents": [ "4095ea6012b695e976d57604c28bc23862f76504" ], "author": { "name": "Christian Schoenebeck", "email": "qemu_oss@crudebyte.com", "time": "Wed Oct 07 12:27:49 2026 +0200" }, "committer": { "name": "Christian Schoenebeck", "email": "qemu_oss@crudebyte.com", "time": "Mon Oct 19 16:07:26 2026 +0200" }, "message": "hw/9pfs: fix dirent stream protection for legacy (9p2000.u) Tread\n\nConcurrent legacy Tread requests (9p2000.u) on the same directory FID\nrace the FID\u0027s shared dirent stream.\n\nIn the initial Tread implementation (a92315553d) the dirent stream\nwas entirely unprotected. Commit 7cde47d4a8 introduced a lock, which\nmitigated the problem, but without sufficient full coverage for this\nrequest type, as it only held the lock during individual dirent\nstream steps. A concurrent request could mutate the dirent stream in\nbetween. Furthermore the initial rewinddir() (to offset 0) was still\nnot protected at all.\n\nThis could cause corrupted directory entries being returned to\nclient, with entries missing, duplicate entries and wrong order, up\nto heap corruption of 9p server\u0027s QEMU process due to garbage seek\ntargets.\n\nFix this by holding the lock for the entire directory reading\ntransaction (i.e. for the whole v9fs_do_readdir_with_stat() call).\n\nFixes: a92315553d (\"virtio-9p: Add P9_TREAD support\")\nLink: https://lore.kernel.org/qemu-devel/2f0a6e10200bb3a0dbc0f762493cf1f4d642d61b.1791368962.git.qemu_oss@crudebyte.com\nSigned-off-by: Christian Schoenebeck \u003cqemu_oss@crudebyte.com\u003e\n" }, { "commit": "4095ea6012b695e976d57604c28bc23862f76504", "tree": "4d3992785ababff8984cd4cb9d2880ea2380a716", "parents": [ "a99e69adc75477caeebb3af14eed1cd21fd0c4fe" ], "author": { "name": "Christian Schoenebeck", "email": "qemu_oss@crudebyte.com", "time": "Wed Oct 07 12:27:44 2026 +0200" }, "committer": { "name": "Christian Schoenebeck", "email": "qemu_oss@crudebyte.com", "time": "Mon Oct 19 16:07:26 2026 +0200" }, "message": "tests/9p-race: add Treaddir race test\n\nAdd \"race/readdir\" test, a test racing Treaddir\u0027s directory stream.\n\nIn each round a Treaddir request is sent against another Treaddir\nrequest or Tstat request on the same FID.\n\nThis test is registered as slow test (i.e. skipped by default) and\ntherefore requires -m slow to run.\n\nOn my test machine a full run of 20000 rounds took around 1 minute\nto complete.\n\nLink: https://lore.kernel.org/qemu-devel/74993d75ee26e699b4543a2fb6f3b7c3b7f49442.1791368962.git.qemu_oss@crudebyte.com\nSigned-off-by: Christian Schoenebeck \u003cqemu_oss@crudebyte.com\u003e\n" }, { "commit": "a99e69adc75477caeebb3af14eed1cd21fd0c4fe", "tree": "f219212db354ef0a70bda8fa8a4e595e7a0329db", "parents": [ "8a9be26b0aac54d97b4228dc1bd61049d80472a8" ], "author": { "name": "Christian Schoenebeck", "email": "qemu_oss@crudebyte.com", "time": "Wed Oct 07 12:27:38 2026 +0200" }, "committer": { "name": "Christian Schoenebeck", "email": "qemu_oss@crudebyte.com", "time": "Mon Oct 19 16:07:26 2026 +0200" }, "message": "tests/9p-client: add Tstat / Rstat test client functions\n\nAdd v9fs_tstat() and v9fs_rstat() functions to the 9p test client.\n\nSince this is a request type that exists both in legacy 9p2000.u\nand modern 9p2000.L protocol version, error responses types might\ndiffer (Rerror vs. Rlerror). Therefore v9fs_tstat() is using an\nerror type tolerant helper function v9fs_req_check_err() for\nprocessing expected errors with this request type.\n\nLink: https://lore.kernel.org/qemu-devel/46192047d8b38e4d37cef7115de6cad11ea8f362.1791368962.git.qemu_oss@crudebyte.com\nSigned-off-by: Christian Schoenebeck \u003cqemu_oss@crudebyte.com\u003e\n" }, { "commit": "8a9be26b0aac54d97b4228dc1bd61049d80472a8", "tree": "968d1ee100110381cad43b7e6b8e17e5955a9d23", "parents": [ "2296ed61d2a38b5198d2fd9fe88056be4cd4adba" ], "author": { "name": "Christian Schoenebeck", "email": "qemu_oss@crudebyte.com", "time": "Wed Oct 07 12:27:33 2026 +0200" }, "committer": { "name": "Christian Schoenebeck", "email": "qemu_oss@crudebyte.com", "time": "Mon Oct 19 16:07:26 2026 +0200" }, "message": "tests/9p-client: add Rerror function (legacy 9p2000.u)\n\nAdd v9fs_rerror() function to the 9p test client. This function is\nthe legacy 9p2000.u variant for returned errors (i.e. in contrast\nto the already existing Rlerror response handler function\nv9fs_rlerror() for the 9p2000.L protocol version).\n\nLink: https://lore.kernel.org/qemu-devel/13b2cead57321d45b6503059e35c1ec1b49a629a.1791368962.git.qemu_oss@crudebyte.com\nSigned-off-by: Christian Schoenebeck \u003cqemu_oss@crudebyte.com\u003e\n" }, { "commit": "2296ed61d2a38b5198d2fd9fe88056be4cd4adba", "tree": "a7b4c9cffbf95adcac1d94f8bc8b7c26e07a1e9a", "parents": [ "69d00f0bb898e3e635d376e6a7e063e0aff072e0" ], "author": { "name": "Christian Schoenebeck", "email": "qemu_oss@crudebyte.com", "time": "Wed Oct 07 12:27:16 2026 +0200" }, "committer": { "name": "Christian Schoenebeck", "email": "qemu_oss@crudebyte.com", "time": "Mon Oct 19 16:07:26 2026 +0200" }, "message": "tests/9p-race: add 9p race test suite (race FID-path mutations)\n\nAdd a qtest-based stress test suite racing 9pfs server-side state.\n\nThis patch adds the first race test \"race/fid-path\" for this new\ntest suite: it races (per round) one Tlcreate (which is mutating\nthe FID path) against a number of reader requests (Twalk and\nTxattrwalk) on the same FID.\n\nThis very first 9pfs race test guards CVE-2026-93834 (fixed by\ncommit fe9e30899f \"hw/9pfs: Use read-write lock for protecting fid\npath.\").\n\nHitting the small race window is timing dependant, so this is a\nprobabilistic test, not a deterministic one. During my tests the\n(unpatched) vulnerability triggered sometimes after few hundred\nrounds, and sometimes after \u003e100k rounds. Furthermore, it expects\nQEMU being compiled with a sanitizer (e.g. ASan) which is\nsupposed to detect the actual race (e.g. by memory violation):\n\n ../configure --enable-virtfs --enable-debug \\\n --extra-cflags\u003d\"-fsanitize\u003daddress -fno-omit-frame-pointer\" \\\n --extra-ldflags\u003d\"-fsanitize\u003daddress\" ...\n\nEven though this is a new test suite, in the codebase separate\nfrom the already existing deterministic 9pfs test cases (while\n9p test client code being shared between the two test suites),\nthis new race test suite is run with the same binary as the\nother qtests. However being a very slow test, it is registered\nas such, so the -m slow argument is required for this race test\nto run (as it is skipped by default):\n\n ASAN_OPTIONS\u003ddetect_leaks\u003d0 \\\n tests/qtest/qos-test -m slow\n\nOr if you only want to run this single race test (e.g. on x86_64):\n\n ASAN_OPTIONS\u003ddetect_leaks\u003d0 \\\n tests/qtest/qos-test -m slow -p \\\n /x86_64/pc/i440FX-pcihost/pci-bus-pc/pci-bus/virtio-9p-pci/virtio-9p/virtio-9p-tests/race/fid-path\n\nOn other systems, use `tests/qtest/qos-test -l` to get the correct\n(arch dependent) full test name.\n\n`ASAN_OPTIONS\u003ddetect_leaks\u003d0` is currently required, it suppresses\na memory leak error at the end of each race test, which is a known\nQEMU shutdown memory leak, unrelated to 9p server or this race test\nsuite. The official QEMU CI pipeline sets\n`ASAN_OPTIONS\u003ddetect_leaks\u003d0` by default for this reason.\n\nThere are some knobs that can be controlled via environment\nvariables:\n\n V9FS_RACE: skip test suite by setting to 0 or force running by\n setting to 1\n\n V9FS_RACE_ROUNDS: total amount of rounds to run\n (default: 20000)\n\n V9FS_RACE_NCONCURRENT: amount of concurrent reader requests\n (default: 4)\n\nA full run with 20000 rounds took around 7 minutes on my test\nmachine. If you can\u0027t hit the (narrow) race window with\nunpatched QEMU, it might help to either add some load on the\nhost system and/or turning the two knobs above.\n\nLink: https://lore.kernel.org/qemu-devel/4a0eff0539f16434b48728cd8e5a89f906c293d8.1791368962.git.qemu_oss@crudebyte.com\nSigned-off-by: Christian Schoenebeck \u003cqemu_oss@crudebyte.com\u003e\n" }, { "commit": "69d00f0bb898e3e635d376e6a7e063e0aff072e0", "tree": "357fa03987dda6d96aa285362a32baec386e859e", "parents": [ "288b6c9e78913401fac4880b3281ce431540b8df" ], "author": { "name": "Christian Schoenebeck", "email": "qemu_oss@crudebyte.com", "time": "Wed Oct 07 12:26:58 2026 +0200" }, "committer": { "name": "Christian Schoenebeck", "email": "qemu_oss@crudebyte.com", "time": "Mon Oct 19 16:07:26 2026 +0200" }, "message": "tests/9p-client: add Txattrwalk / Rxattrwalk test client functions\n\nAdd v9fs_txattrwalk() and v9fs_rxattrwalk() functions to the 9p test\nclient. This can be used to retrieve a list of xattrs or to acquire\na FID that can subsequently be used to retrieve the value of an xattr.\n\nThis is a preparatory patch, these functions will be used by the\nsubsequently added 9p race test.\n\nLink: https://lore.kernel.org/qemu-devel/fcd4dd1ed8cf6ae9af99ba5ade8b5922875e442d.1791368962.git.qemu_oss@crudebyte.com\nSigned-off-by: Christian Schoenebeck \u003cqemu_oss@crudebyte.com\u003e\n" }, { "commit": "288b6c9e78913401fac4880b3281ce431540b8df", "tree": "6a8cc64e732331344b3620980696ed9101de435b", "parents": [ "11661d857254b27fca5568c6deacf4f6b6f3460f", "137374d861a3507e18d9154c5266e20c92371e20" ], "author": { "name": "Richard Henderson", "email": "richard.henderson@linaro.org", "time": "Mon Oct 19 10:54:44 2026 +0200" }, "committer": { "name": "Richard Henderson", "email": "richard.henderson@linaro.org", "time": "Mon Oct 19 10:54:44 2026 +0200" }, "message": "Merge tag \u0027pull-nbd-2026-10-08-v4\u0027 of https://gitlab.com/ebblake/qemu into staging\n\nNBD patches through 2026-10-08\n\nSeveral fixes, including:\n- Eric Blake: Update MAINTAINERS, support qemu-nbd -s -l\n- Fiona Ebner: Report flush error on qemu-img convert\n- Denis V. Lunev: Fix postcopy dirty bitmap migration\n- Eric Farman: Several iotest improvements\n\n# -----BEGIN PGP SIGNATURE-----\n#\n# iQEzBAABCAAdFiEEccLMIrHEYCkn0vOqp6FrSiUnQ2oFAmrSQYoACgkQp6FrSiUn\n# Q2qilAf/eEx7WDxnMW9/xNQ0xwFCJFfcwF7alPfORNS/tTQk+a1CpvvXVXqWNGc1\n# JIBQQtCbBteGh6QOlHE1uedZpeURgWluaOa3ZOmjWoB8xCo9iIz66lvMmV4+OaJM\n# iTn1ExR/rFGFoNu73S5+Zbusc3znWrClZmYIw1XPfM3pgol8HIz68q284oqkkMQ+\n# ddo1GnWbsZKd1e+90A0mZTFrqFEcUZiVaUbY+NCxo/OYFUwNGSxg/+QMIASJbv6H\n# zDUrs1+oC1d0qiaM8Rg6/V4dgfSsgxd4t0k+h5r1mJIQT9spevz6/2R44bAinPso\n# Mirbenl/KVOk30lvNAiQRRta8KsTVQ\u003d\u003d\n# \u003diDnD\n# -----END PGP SIGNATURE-----\n# gpg: Signature made Fri 16 Oct 2026 05:23:54 PM CEST\n# gpg: using RSA key 71C2CC22B1C4602927D2F3AAA7A16B4A2527436A\n# gpg: Good signature from \"Eric Blake \u003ceblake@redhat.com\u003e\" [unknown]\n# gpg: aka \"Eric Blake (Free Software Programmer) \u003cebb9@byu.net\u003e\" [unknown]\n# gpg: aka \"[jpeg image of size 6874]\" [unknown]\n# gpg: WARNING: This key is not certified with a trusted signature!\n# gpg: There is no indication that the signature belongs to the owner.\n# Primary key fingerprint: 71C2 CC22 B1C4 6029 27D2 F3AA A7A1 6B4A 2527 436A\n\n* tag \u0027pull-nbd-2026-10-08-v4\u0027 of https://gitlab.com/ebblake/qemu:\n iotests/iothreads-nbd-export: Skip on s390\n iotests/fuse-truncate: skip if FUSE is not usable\n iotests/nbd-tls-iothread: skip on non-x86 hardware\n iotests/nbd-in-qcow2-chain: use default machine\n iotests/migrate-bitmaps-postcopy-test: add a bitmap on a second node\n migration/block-dirty-bitmap: fix postcopy abort with bitmaps on several nodes\n migration: add QEMU_COUNTED_STRING_SIZE for counted string buffers\n qemu-img: convert: flush target image after copying\n block: report flush error during bdrv_close()\n iotests.py: add filter_qemu()\n iotests: add test cases for failing flush after qemu-img convert\n qemu-nbd: Support -s and -l at the same time\n maint: Update eblake\u0027s staging repo\n\nSigned-off-by: Richard Henderson \u003crichard.henderson@linaro.org\u003e\n" }, { "commit": "11661d857254b27fca5568c6deacf4f6b6f3460f", "tree": "adcbb1d159fe21b790a96fd66a01e4827d1d9926", "parents": [ "3d5133092d341647fe7e6291da5acd1d1f731b05", "5689c59055e7652cc4b6ac0a47b6e48faad4d59d" ], "author": { "name": "Richard Henderson", "email": "richard.henderson@linaro.org", "time": "Mon Oct 19 09:01:43 2026 +0200" }, "committer": { "name": "Richard Henderson", "email": "richard.henderson@linaro.org", "time": "Mon Oct 19 09:01:43 2026 +0200" }, "message": "Merge tag \u0027pull-block-2026-10-16\u0027 of https://gitlab.com/vsementsov/qemu into staging\n\nblock: block-jobs and bitmaps patches\n\n# -----BEGIN PGP SIGNATURE-----\n#\n# iQIzBAABCgAdFiEEi5wmzbL9FHyIDoahVh8kwfGfefsFAmrRyS4ACgkQVh8kwfGf\n# efuaAA/7BurKlQTH92WHwMhQ3GiKPv0oRS28C7xVLChSA3sw0nskOSUhYG6eJ6FG\n# NkubUCEMuzYkoD+tyNXvOlykB5tujugEF/43xfgQsfLT1QmFu42+cNNQKy4C5il+\n# LOKepS5N9pUVMDyldQlSm02DlVsSeu/IY3POt+mImpUfV3K873SYGst+nJ13c6/x\n# dCiuSSGcZjku3s1j0wxo1sCgoLTEOIVZVCe1ZTU8Z6t8cMAt9Yt6cGvri8e/C2SU\n# V6X8VIgZ6cE1LTxrTOgho6QVn3a5Rm8rhXBZL8jofFfIkY/ksG/QcV5dWdhLWgIQ\n# 7ek1B6hx75AY+oPQStuzjpuF12hdPV/lEUEeddLJAeV/J+Gmh+IA1kJHRVUmdOsb\n# hl48RJpHeBdzVMWBBlXH3doH7zzJndNF27S6oCT/Tq0wJe6GYwocHIAAVZtXaV+9\n# nYfwKjk+ahsCw4Qjdja303uE2RSA+E7Df15VbFy5I0fK2EauJl6/nOaEfSD2zSVJ\n# 6Ry+fYgOe+lLkmAqZpPVc1xiwT26XFJzm16vaIcK1NaFj1RWQfPOSTI1tLv10ZfN\n# UGZtmbXaqMH/5sm57w7RrWTmtDzePSiCcd82eyAvpC7Ys0Q/c+K82CbU8JtkQ72q\n# ovX8qKLzGx4uhagXGmhn/WWCRRvcRUQdx+ON4sS7PZnaVmTpZhw\u003d\n# \u003dFslc\n# -----END PGP SIGNATURE-----\n# gpg: Signature made Fri 16 Oct 2026 08:50:22 AM CEST\n# gpg: using RSA key 8B9C26CDB2FD147C880E86A1561F24C1F19F79FB\n# gpg: Good signature from \"Vladimir Sementsov-Ogievskiy \u003cvsementsov@yandex-team.ru\u003e\" [unknown]\n# gpg: aka \"Vladimir Sementsov-Ogievskiy \u003cvsementsov@virtuozzo.com\u003e\" [unknown]\n# gpg: WARNING: This key is not certified with a trusted signature!\n# gpg: There is no indication that the signature belongs to the owner.\n# Primary key fingerprint: 8B9C 26CD B2FD 147C 880E 86A1 561F 24C1 F19F 79FB\n\n* tag \u0027pull-block-2026-10-16\u0027 of https://gitlab.com/vsementsov/qemu:\n block/mirror: inherit the source node discard flag in mirror_top\n qcow2: add functionality to repair bitmaps\n\nSigned-off-by: Richard Henderson \u003crichard.henderson@linaro.org\u003e\n" }, { "commit": "3d5133092d341647fe7e6291da5acd1d1f731b05", "tree": "f6b416b1ed7712b8ec63a8583ca12d3455bdd7e1", "parents": [ "1c8440e9162d7f98d8e41ff4de0ccacb08fb65b8", "56ab4a7356ac7b6a18a4283d51e868e2cf366588" ], "author": { "name": "Richard Henderson", "email": "richard.henderson@linaro.org", "time": "Mon Oct 19 09:01:26 2026 +0200" }, "committer": { "name": "Richard Henderson", "email": "richard.henderson@linaro.org", "time": "Mon Oct 19 09:01:26 2026 +0200" }, "message": "Merge tag \u0027linux-user-next-pull-request\u0027 of https://github.com/hdeller/qemu-hppa into staging\n\nlinux user patches\n\nOne patch from Andreas Schwab to not trash the guest console when\nwarning about unhandled core dumps.\n\n# -----BEGIN PGP SIGNATURE-----\n#\n# iHUEABYKAB0WIQS86RI+GtKfB8BJu973ErUQojoPXwUCatPazwAKCRD3ErUQojoP\n# XwkiAP9B4pgmw1JsQhdmJUxwPhAMuyx5+ZQ7aZAJNu7kGQmyiwD/R0DLFL0URPe8\n# g0W11YhEqnzbT0Tp/zeJPln63nlHxQ4\u003d\n# \u003dyAw3\n# -----END PGP SIGNATURE-----\n# gpg: Signature made Sat 17 Oct 2026 10:30:07 PM CEST\n# gpg: using EDDSA key BCE9123E1AD29F07C049BBDEF712B510A23A0F5F\n# gpg: Good signature from \"Helge Deller \u003cdeller@gmx.de\u003e\" [unknown]\n# gpg: aka \"Helge Deller \u003cdeller@kernel.org\u003e\" [unknown]\n# gpg: aka \"Helge Deller \u003cdeller@debian.org\u003e\" [unknown]\n# gpg: WARNING: This key is not certified with a trusted signature!\n# gpg: There is no indication that the signature belongs to the owner.\n# Primary key fingerprint: 4544 8228 2CD9 10DB EF3D 25F8 3E5F 3D04 A7A2 4603\n# Subkey fingerprint: BCE9 123E 1AD2 9F07 C049 BBDE F712 B510 A23A 0F5F\n\n* tag \u0027linux-user-next-pull-request\u0027 of https://github.com/hdeller/qemu-hppa:\n linux-user: don\u0027t print core dump message by default\n\nSigned-off-by: Richard Henderson \u003crichard.henderson@linaro.org\u003e\n" }, { "commit": "1c8440e9162d7f98d8e41ff4de0ccacb08fb65b8", "tree": "72ace2856991e796e2e5bc12c733ffce419c34f4", "parents": [ "bddb785e791e415db38884848d068457e226f5e3", "e77a38d8944cafd7285b9f7caa4771e89027dd1c" ], "author": { "name": "Richard Henderson", "email": "richard.henderson@linaro.org", "time": "Mon Oct 19 09:01:09 2026 +0200" }, "committer": { "name": "Richard Henderson", "email": "richard.henderson@linaro.org", "time": "Mon Oct 19 09:01:10 2026 +0200" }, "message": "Merge tag \u0027pbouvier/pr/tcg_tests-20261017\u0027 of https://gitlab.com/p-b-o/qemu into staging\n\nChanges:\n- [PATCH] tests/tcg: match custom target name to executable name (Paolo Bonzini \u003cpbonzini@redhat.com\u003e)\n Link: https://lore.kernel.org/qemu-devel/20261017074226.1347492-1-pbonzini@redhat.com\n- [PATCH] tcg/tests: add an alias for all TCG tests of a target (Paolo Bonzini \u003cpbonzini@redhat.com\u003e)\n Link: https://lore.kernel.org/qemu-devel/20261017073952.1346449-1-pbonzini@redhat.com\n\n# -----BEGIN PGP SIGNATURE-----\n#\n# iQGzBAABCgAdFiEEN8FWlNi6l2Sxlz/btEQ30ZwoYt8FAmrTsyoACgkQtEQ30Zwo\n# Yt84qQv/ZKmc6Na+PeVPij+GrW5d9ebm6rFF9MfxyQ/UfWaJ9mYbUy57Ta2+bSD1\n# fnV/lf/lgz+qsuPM8UGtkSZKCULaHRrNHPq9QsHuawAS1Q4xwWj8VBkZjGgvGfbS\n# Beqp28YLZDNTiYejNUdWu7NTyPAaNrKJn7D/WLafUB+csG36LxpuZoBKumOXxGN7\n# BdcY5Zs8q8u4BWjnnCC11GlL/jRHGmzGd6YxC9o6v2v99bDS90xR4L/0nARib4Gr\n# 4Z9QbrDxeUYFQW252Q5+1c0sOjR6okggrTZxLWZamTD+S3lrqMMJawhhAZSH8sCB\n# Kprm6AqBAMeFmaZbzdNUqDcxz5kW4UMC9iHj4/W9deRB6gBbRGC8T+EnsU+iRHEk\n# r5SgtmJTvpHORaXafVmfutWAc2ODXKSXADmN2odmG/NNjh2nQ7OVPcSdwDtADDod\n# 0+6NAnlL/or8/jc8YbaX3+h/fLm0ij7tslhV37RD6mYdvKfnz5X1jELPbAjJN431\n# IhHaVVXQ\n# \u003dTiDa\n# -----END PGP SIGNATURE-----\n# gpg: Signature made Sat 17 Oct 2026 07:40:58 PM CEST\n# gpg: using RSA key 37C15694D8BA9764B1973FDBB44437D19C2862DF\n# gpg: Good signature from \"Pierrick Bouvier \u003cpierrick.bouvier@oss.qualcomm.com\u003e\" [unknown]\n# gpg: WARNING: This key is not certified with a trusted signature!\n# gpg: There is no indication that the signature belongs to the owner.\n# Primary key fingerprint: 37C1 5694 D8BA 9764 B197 3FDB B444 37D1 9C28 62DF\n\n* tag \u0027pbouvier/pr/tcg_tests-20261017\u0027 of https://gitlab.com/p-b-o/qemu:\n tcg/tests: add an alias for all TCG tests of a target\n tests/tcg: match custom target name to executable name\n\nSigned-off-by: Richard Henderson \u003crichard.henderson@linaro.org\u003e\n" }, { "commit": "e77a38d8944cafd7285b9f7caa4771e89027dd1c", "tree": "03071ecdd83b21b1e13087dbf4b0de36da58a1fb", "parents": [ "fe73524af4fcc578568794d919cd3e4e3955c350" ], "author": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sat Oct 17 09:39:52 2026 +0200" }, "committer": { "name": "Pierrick Bouvier", "email": "pierrick.bouvier@oss.qualcomm.com", "time": "Sat Oct 17 17:40:25 2026 +0000" }, "message": "tcg/tests: add an alias for all TCG tests of a target\n\nAllow building (without running) all the TCG tests that are available\nfor a target, so that they can be run manually.\n\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\nTested-by: Pierrick Bouvier \u003cpierrick.bouvier@oss.qualcomm.com\u003e\nReviewed-by: Pierrick Bouvier \u003cpierrick.bouvier@oss.qualcomm.com\u003e\nLink: https://lore.kernel.org/qemu-devel/20261017073952.1346449-1-pbonzini@redhat.com\nSigned-off-by: Pierrick Bouvier \u003cpierrick.bouvier@oss.qualcomm.com\u003e\n" }, { "commit": "fe73524af4fcc578568794d919cd3e4e3955c350", "tree": "582545763868b70571aa95ebbf7dee46330adc01", "parents": [ "a19f59a72d96056d9a8f48cf6c77f5787491e414" ], "author": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sat Oct 17 09:42:26 2026 +0200" }, "committer": { "name": "Pierrick Bouvier", "email": "pierrick.bouvier@oss.qualcomm.com", "time": "Sat Oct 17 17:40:25 2026 +0000" }, "message": "tests/tcg: match custom target name to executable name\n\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\nReviewed-by: Pierrick Bouvier \u003cpierrick.bouvier@oss.qualcomm.com\u003e\nLink: https://lore.kernel.org/qemu-devel/20261017074226.1347492-1-pbonzini@redhat.com\nSigned-off-by: Pierrick Bouvier \u003cpierrick.bouvier@oss.qualcomm.com\u003e\n" }, { "commit": "137374d861a3507e18d9154c5266e20c92371e20", "tree": "7d4610ef3cb1d7e18f0ba740d90292970191e4f0", "parents": [ "14e22f67ed0b6dd6abde1fb9443d9d28fc78e1ca" ], "author": { "name": "Eric Farman", "email": "farman@linux.ibm.com", "time": "Fri Sep 25 21:44:09 2026 +0200" }, "committer": { "name": "Eric Blake", "email": "eblake@redhat.com", "time": "Fri Oct 16 10:23:05 2026 -0500" }, "message": "iotests/iothreads-nbd-export: Skip on s390\n\nRunning this test on s390 causes long python exception tracebacks\nat the beginning of the system_reset loop. The problem appears to\nbe the same one described by commit ad302b21aab6, in that QEMU\nwill exit on s390 without any kernel or boot disk.\n\nIn other tests, this is addressed by adding -no-shutdown to the\ncommand line, and that does create a clean failure instead of a\nlong line of python exceptions:\n\n --- /home/farman/git/qemu/tests/qemu-iotests/tests/iothreads-nbd-export.out\n +++ /home/farman/git/qemu/build/scratch/qcow2-file-iothreads-nbd-export/iothreads-nbd-export.out.bad\n @@ -16,4 +16,4 @@\n {\"return\": {}}\n {\"return\": {}}\n Checking that it is still alive...\n -{\"return\": {\"running\": true, \"status\": \"running\"}}\n +{\"return\": {\"running\": false, \"status\": \"prelaunch\"}}\n Failures: iothreads-nbd-export\n Failed 1 of 1 iotests\n\n...but obviously this isn\u0027t still a successful test, since it is\nexpected that the guest will be still be usable after the reset loop.\nSo, barring a solution to that, just skip this test on s390.\n\nSigned-off-by: Eric Farman \u003cfarman@linux.ibm.com\u003e\nMessage-ID: \u003c20260925194409.716498-6-farman@linux.ibm.com\u003e\nReviewed-by: Eric Blake \u003ceblake@redhat.com\u003e\nSigned-off-by: Eric Blake \u003ceblake@redhat.com\u003e\n" }, { "commit": "14e22f67ed0b6dd6abde1fb9443d9d28fc78e1ca", "tree": "6805056ffa537d0439eaf4e584406ab2522e2d51", "parents": [ "f9a75891db4550f3176178d539a9c5b0b3c8e445" ], "author": { "name": "Eric Farman", "email": "farman@linux.ibm.com", "time": "Fri Sep 25 21:44:07 2026 +0200" }, "committer": { "name": "Eric Blake", "email": "eblake@redhat.com", "time": "Fri Oct 16 10:23:05 2026 -0500" }, "message": "iotests/fuse-truncate: skip if FUSE is not usable\n\nCommit 951227d3755 (\"iotests: skip FUSE tests when FUSE is not usable\")\nreworked some of the fuse-related tests to skip where needed,\nbut the new test fuse-truncate raced with that and missed out on the\nsame treatment. Add that same python-esque skip logic to this test.\n\nFixes: 7d06bbb2d9 (\"iotests: test O_TRUNC behavior for fuse exports\")\nSigned-off-by: Eric Farman \u003cfarman@linux.ibm.com\u003e\nMessage-ID: \u003c20260925194409.716498-4-farman@linux.ibm.com\u003e\nReviewed-by: Eric Blake \u003ceblake@redhat.com\u003e\nSigned-off-by: Eric Blake \u003ceblake@redhat.com\u003e\n" }, { "commit": "f9a75891db4550f3176178d539a9c5b0b3c8e445", "tree": "9ad352da359b9304c0ff3372ee2e68633edeaaee", "parents": [ "491b16721044353b980aa562cd163c6d51eac19a" ], "author": { "name": "Eric Farman", "email": "farman@linux.ibm.com", "time": "Fri Sep 25 21:44:06 2026 +0200" }, "committer": { "name": "Eric Blake", "email": "eblake@redhat.com", "time": "Fri Oct 16 10:23:05 2026 -0500" }, "message": "iotests/nbd-tls-iothread: skip on non-x86 hardware\n\nLike nbd-in-qcow2-chain, this test assumes a q35 machine is\npresent, which might not be available on other hosts.\nUnlike that test, simply allowing it to run with the default machine\nstill throws an errors. Fence this to PC-only machines for now.\n\nSigned-off-by: Eric Farman \u003cfarman@linux.ibm.com\u003e\nMessage-ID: \u003c20260925194409.716498-3-farman@linux.ibm.com\u003e\nReviewed-by: Eric Blake \u003ceblake@redhat.com\u003e\nSigned-off-by: Eric Blake \u003ceblake@redhat.com\u003e\n" }, { "commit": "491b16721044353b980aa562cd163c6d51eac19a", "tree": "8e1a7f11b95f6dd40b403322440fccfe1a54c169", "parents": [ "faa80b9847b9f326d7570c512d52e0a22a5bd5b3" ], "author": { "name": "Eric Farman", "email": "farman@linux.ibm.com", "time": "Fri Sep 25 21:44:05 2026 +0200" }, "committer": { "name": "Eric Blake", "email": "eblake@redhat.com", "time": "Fri Oct 16 10:23:04 2026 -0500" }, "message": "iotests/nbd-in-qcow2-chain: use default machine\n\nSome of the NBD tests explicitly specify `-machine q35` which won\u0027t work\nwhen running against, say, qemu-system-s390x.\n\nThe nbd-in-qcow2-chain test runs fine with the default machine on a z16\nhost, so allow it to run in other configurations.\n\nFixes: 24fd6d75b3 (\"iotests: Add coverage of recent NBD qio deadlock fix\")\nSigned-off-by: Eric Farman \u003cfarman@linux.ibm.com\u003e\nMessage-ID: \u003c20260925194409.716498-2-farman@linux.ibm.com\u003e\nReviewed-by: Eric Blake \u003ceblake@redhat.com\u003e\nSigned-off-by: Eric Blake \u003ceblake@redhat.com\u003e\n" }, { "commit": "faa80b9847b9f326d7570c512d52e0a22a5bd5b3", "tree": "fc5ab86850b65b1ba28dfd007917d3876036ba03", "parents": [ "4d11088a088d0915196e38b3e69df12d4f06fdb5" ], "author": { "name": "Denis V. Lunev", "email": "den@openvz.org", "time": "Tue Oct 06 19:07:38 2026 +0200" }, "committer": { "name": "Eric Blake", "email": "eblake@redhat.com", "time": "Fri Oct 16 10:23:04 2026 -0500" }, "message": "iotests/migrate-bitmaps-postcopy-test: add a bitmap on a second node\n\nAll bitmaps in the test live on drive0, so the source never switches\nnodes after setup and the destination never resolves a node name from\nthe postcopy listen thread. Add a second drive with one bitmap and check\nthat it arrives intact.\n\nSigned-off-by: Denis V. Lunev \u003cden@openvz.org\u003e\nTested-by: Eric Blake \u003ceblake@redhat.com\u003e\nReviewed-by: Eric Blake \u003ceblake@redhat.com\u003e\nCc: Peter Xu \u003cpeterx@redhat.com\u003e\nCc: Fabiano Rosas \u003cfarosas@suse.de\u003e\nCc: Vladimir Sementsov-Ogievskiy \u003cvsementsov@yandex-team.ru\u003e\nMessage-ID: \u003c20261006170738.453977-4-den@openvz.org\u003e\n[eblake: squash in fix to pass even after aborted run left behind stale\nfifo, and to avoid check-python-minreqs lint failure]\nSigned-off-by: Eric Blake \u003ceblake@redhat.com\u003e\n" }, { "commit": "4d11088a088d0915196e38b3e69df12d4f06fdb5", "tree": "5edd3b11d643e6b63bfe616b6fd05e362dd111fb", "parents": [ "319cd41f110ada2cbb7dd17700893327a3cb925e" ], "author": { "name": "Denis V. Lunev", "email": "den@openvz.org", "time": "Tue Oct 06 19:07:37 2026 +0200" }, "committer": { "name": "Eric Blake", "email": "eblake@redhat.com", "time": "Fri Oct 16 10:23:04 2026 -0500" }, "message": "migration/block-dirty-bitmap: fix postcopy abort with bitmaps on several nodes\n\nWith dirty bitmaps on more than one node, the source switches nodes\nduring the postcopy bulk phase and sends the node name again. The\ndestination reads those chunks in the postcopy listen thread, which does\nnot hold the BQL, and resolves the name through bdrv_lookup_bs():\n\n qemu-system-x86_64: ../block.c:6400: bdrv_lookup_bs: Assertion\n `qemu_in_main_thread()\u0027 failed.\n\nThe bdrv_find_dirty_bitmap() call right after it needs the BQL or the\ndirty bitmap lock as well. Taking the BQL there would deadlock: the\nlisten thread holds s-\u003elock, and dirty_bitmap_mig_before_vm_start()\ntakes s-\u003elock with the BQL held.\n\nEvery node and bitmap that a non-START chunk refers to was set up by a\nSTART chunk, and those are loaded under the BQL during setup. Record the\nnode alias there, and resolve all other chunks against s-\u003ebitmaps\ninstead of the block graph.\n\nBitmaps on a single node never resend the node name after setup, which\nis why migrate-bitmaps-postcopy-test does not catch this.\n\nFixes: f791bf7f93f2 (\"assertions for block global state API\")\nSigned-off-by: Denis V. Lunev \u003cden@openvz.org\u003e\nCc: Peter Xu \u003cpeterx@redhat.com\u003e\nCc: Fabiano Rosas \u003cfarosas@suse.de\u003e\nCc: Eric Blake \u003ceblake@redhat.com\u003e\nCc: Vladimir Sementsov-Ogievskiy \u003cvsementsov@yandex-team.ru\u003e\nCc: qemu-stable@nongnu.org\nMessage-ID: \u003c20261006170738.453977-3-den@openvz.org\u003e\nReviewed-by: Eric Blake \u003ceblake@redhat.com\u003e\nSigned-off-by: Eric Blake \u003ceblake@redhat.com\u003e\n" }, { "commit": "319cd41f110ada2cbb7dd17700893327a3cb925e", "tree": "638f79ff2ee402d378632ab241f450ea979fcba2", "parents": [ "901ac73874c2129a17b6e54482aee800a0f9b2d2" ], "author": { "name": "Denis V. Lunev", "email": "den@openvz.org", "time": "Tue Oct 06 19:07:36 2026 +0200" }, "committer": { "name": "Eric Blake", "email": "eblake@redhat.com", "time": "Fri Oct 16 10:23:04 2026 -0500" }, "message": "migration: add QEMU_COUNTED_STRING_SIZE for counted string buffers\n\nA counted string carries its length in one byte, so the buffer that\nqemu_get_counted_string() fills must hold 256 bytes. The dirty bitmap\nload state spells that size as a bare 256 for both of its alias buffers.\nName it next to the qemu_get_counted_string() prototype and use it there,\nin the length assert of qemu_put_counted_string() and in DBMLoadState.\n\nSuggested-by: Eric Blake \u003ceblake@redhat.com\u003e\nSigned-off-by: Denis V. Lunev \u003cden@openvz.org\u003e\nCc: Peter Xu \u003cpeterx@redhat.com\u003e\nCc: Fabiano Rosas \u003cfarosas@suse.de\u003e\nCc: Eric Blake \u003ceblake@redhat.com\u003e\nCc: Vladimir Sementsov-Ogievskiy \u003cvsementsov@yandex-team.ru\u003e\nCc: qemu-stable@nongnu.org\nMessage-ID: \u003c20261006170738.453977-2-den@openvz.org\u003e\nReviewed-by: Eric Blake \u003ceblake@redhat.com\u003e\nSigned-off-by: Eric Blake \u003ceblake@redhat.com\u003e\n" }, { "commit": "901ac73874c2129a17b6e54482aee800a0f9b2d2", "tree": "1538d115547784fbcedf1a8cde44a351758754c4", "parents": [ "c6c8bdc21af335ad72c899609d24844415a5af81" ], "author": { "name": "Fiona Ebner", "email": "f.ebner@proxmox.com", "time": "Wed Sep 30 15:19:25 2026 +0200" }, "committer": { "name": "Eric Blake", "email": "eblake@redhat.com", "time": "Fri Oct 16 09:08:52 2026 -0500" }, "message": "qemu-img: convert: flush target image after copying\n\nWith \u0027qemu-img convert\u0027, when using a cache mode with \u0027cache.no-flush\n\u003d off\u0027, the expectation is that the data is flushed to the disk, which\nhappens since commit 80ccf93b88 (\"qemu-img: let \u0027qemu-img convert\u0027\nflush data\"). This expectation also encompasses that failure to do so\nis properly reported, so ensure that \u0027qemu-img convert\u0027 exits with a\nnon-zero status code when the target image cannot be flushed.\n\nIn particular, the reproducer below [0], based on a report by\nIng. Alfonso Kuen Arroyo [1], would result in\n\u003e rc\u003d0\n\u003e Content mismatch at offset XYZ!\nbefore this change, and in\n\u003e rc\u003d1\n\u003e Content mismatch at offset XYZ!\nafter this change.\n\nNote that this change does not affect the (default) \u0027unsafe\u0027 cache\nmode, because bdrv_co_flush() still skips flush to disk for that cache\nmode.\n\n[0]:\n\u003e #!/bin/bash -x\n\u003e dd if\u003d/dev/urandom of\u003dsrc.raw bs\u003d1M count\u003d500\n\u003e truncate -s 500M dst.img\n\u003e LOOP\u003d$(losetup --find --show dst.img)\n\u003e SIZE\u003d$(blockdev --getsz $LOOP)\n\u003e dd if\u003d/dev/zero of\u003d$LOOP bs\u003d1M count\u003d500 conv\u003dfsync status\u003dnone\n\u003e sync\n\u003e echo 3 \u003e /proc/sys/vm/drop_caches\n\u003e dmsetup create flk --table \"0 $SIZE flakey $LOOP 0 5 5\"\n\u003e qemu-img convert -t writeback -p -r 100M -f raw -O raw src.raw /dev/mapper/flk\n\u003e echo rc\u003d$?\n\u003e sleep 5\n\u003e dmsetup remove flk\n\u003e qemu-img compare src.raw $LOOP\n\u003e losetup -d $LOOP\n\u003e rm src.raw dst.img\n\n[1]: https://lore.proxmox.com/pve-devel/178961792132.43804.17173233935297903311@idkmanager.com/\n\nSigned-off-by: Fiona Ebner \u003cf.ebner@proxmox.com\u003e\nMessage-ID: \u003c20260930132140.2342574-5-f.ebner@proxmox.com\u003e\nReviewed-by: Eric Blake \u003ceblake@redhat.com\u003e\nSigned-off-by: Eric Blake \u003ceblake@redhat.com\u003e\n" }, { "commit": "c6c8bdc21af335ad72c899609d24844415a5af81", "tree": "16c121a6d5c191b7263c24d71058ce2ab536ba40", "parents": [ "9d2cdc4d3b716cf5c19af522237e8d3597d079c2" ], "author": { "name": "Fiona Ebner", "email": "f.ebner@proxmox.com", "time": "Wed Sep 30 15:19:24 2026 +0200" }, "committer": { "name": "Eric Blake", "email": "eblake@redhat.com", "time": "Fri Oct 16 09:08:52 2026 -0500" }, "message": "block: report flush error during bdrv_close()\n\nFlush during bdrv_close() was introduced back in 2012 in commit\n80ccf93b88 (\"qemu-img: let \u0027qemu-img convert\u0027 flush data\"). However, a\nfailing flush was quietly ignored [0]. Report the error instead, since\nthis could mean that the image contents are not as expected.\n\nAdapt the iotests accordingly. For all tests except \u0027080\u0027 and\n\u0027qsd-migrate\u0027 the failures come from blkdebug configurations. For\n\u0027080\u0027, the failures are also directly expected, because of invalid L1\ntable size and offset. For the \u0027qsd-migrate\u0027 test, the error happens,\nbecause the QSD node which is attached via NBD to the source VM was\ninactivated.\n\n[0]: Note that the errors reported for qcow2 come from\nqcow2_inactivate() which is only called as part of\nbs-\u003edrv-\u003ebdrv_close() after bdrv_flush(). In particular, adding\n\u003e \u0027once\u0027: \u0027on\u0027\nto the blkdebug driver in the relevant test case in the 122 iotest\nshows that the failure can be silent in case of qcow2 too.\n\nSigned-off-by: Fiona Ebner \u003cf.ebner@proxmox.com\u003e\nMessage-ID: \u003c20260930132140.2342574-4-f.ebner@proxmox.com\u003e\nReviewed-by: Eric Blake \u003ceblake@redhat.com\u003e\nSigned-off-by: Eric Blake \u003ceblake@redhat.com\u003e\n" }, { "commit": "9d2cdc4d3b716cf5c19af522237e8d3597d079c2", "tree": "28a2f6ae1093bf9db5db459db2c7fa34c80b2de4", "parents": [ "90b5f6ca171dcc7673c95e31f2a270b64608bb70" ], "author": { "name": "Fiona Ebner", "email": "f.ebner@proxmox.com", "time": "Wed Sep 30 15:19:23 2026 +0200" }, "committer": { "name": "Eric Blake", "email": "eblake@redhat.com", "time": "Fri Oct 16 09:08:52 2026 -0500" }, "message": "iotests.py: add filter_qemu()\n\nAdd a filter_qemu() helper function for replacing the QEMU program\nname with \u0027QEMU_PROG\u0027 in test\u0027s log messages.\n\nSigned-off-by: Fiona Ebner \u003cf.ebner@proxmox.com\u003e\nMessage-ID: \u003c20260930132140.2342574-3-f.ebner@proxmox.com\u003e\nReviewed-by: Eric Blake \u003ceblake@redhat.com\u003e\nSigned-off-by: Eric Blake \u003ceblake@redhat.com\u003e\n" }, { "commit": "90b5f6ca171dcc7673c95e31f2a270b64608bb70", "tree": "b6e8f35c47018272b347cc674ea57bc135b32ad8", "parents": [ "67a2606004afdea1b5bab2386ff7cf87c3cca526" ], "author": { "name": "Fiona Ebner", "email": "f.ebner@proxmox.com", "time": "Wed Sep 30 15:19:22 2026 +0200" }, "committer": { "name": "Eric Blake", "email": "eblake@redhat.com", "time": "Fri Oct 16 09:08:52 2026 -0500" }, "message": "iotests: add test cases for failing flush after qemu-img convert\n\nIn preparation to add more checks in the following commits and show\nhow the behavior changes.\n\nSigned-off-by: Fiona Ebner \u003cf.ebner@proxmox.com\u003e\nMessage-ID: \u003c20260930132140.2342574-2-f.ebner@proxmox.com\u003e\nReviewed-by: Eric Blake \u003ceblake@redhat.com\u003e\nSigned-off-by: Eric Blake \u003ceblake@redhat.com\u003e\n" }, { "commit": "67a2606004afdea1b5bab2386ff7cf87c3cca526", "tree": "7ad9378f5f82950024e03c368ee346b1fe1720f4", "parents": [ "b8c0e25800b49de98fd3d81cc2e48bcaf2d1e430" ], "author": { "name": "Eric Blake", "email": "eblake@redhat.com", "time": "Tue Apr 07 21:16:33 2026 -0500" }, "committer": { "name": "Eric Blake", "email": "eblake@redhat.com", "time": "Fri Oct 16 09:08:52 2026 -0500" }, "message": "qemu-nbd: Support -s and -l at the same time\n\nqemu-nbd already has the ability to wrap a read-write layer on top of\nthe export of a read-only image (-s) and the ability to export an\ninternal snapshot rather than the main image in a qcow2 file (-l\nSNAPID). But it gave a confusing error message when trying to mix the\ntwo, because the snapshot overlay created first no longer has access\nto the internal snapshots of the image being wrapped.\n\nWIth a bit of finesse, this useful scenario is now supported.\n\nhttps://gitlab.com/qemu-project/qemu/-/work_items/159\n\nSigned-off-by: Eric Blake \u003ceblake@redhat.com\u003e\nMessage-ID: \u003c20260408021636.794794-2-eblake@redhat.com\u003e\nReviewed-by: Vladimir Sementsov-Ogievskiy \u003cvsementsov@yandex-team.ru\u003e\n[eblake: improve test with Vladimir\u0027s suggestions, add lock to satisfy TSAN]\nSigned-off-by: Eric Blake \u003ceblake@redhat.com\u003e\n" }, { "commit": "b8c0e25800b49de98fd3d81cc2e48bcaf2d1e430", "tree": "4135ea0f720d54917422558dbaa6fd4a8b762dc1", "parents": [ "a19f59a72d96056d9a8f48cf6c77f5787491e414" ], "author": { "name": "Eric Blake", "email": "eblake@redhat.com", "time": "Wed Oct 07 07:26:06 2026 -0500" }, "committer": { "name": "Eric Blake", "email": "eblake@redhat.com", "time": "Fri Oct 16 09:08:52 2026 -0500" }, "message": "maint: Update eblake\u0027s staging repo\n\nrepo.or.cz is struggling with geofencing restrictions and frequent\nservice degredation from AI bot overloads; time to update my staging\nrepo to something with a bit more accessibility and uptime.\n\nSigned-off-by: Eric Blake \u003ceblake@redhat.com\u003e\nMessage-ID: \u003c20261007122951.1935165-2-eblake@redhat.com\u003e\nReviewed-by: Markus Armbruster \u003carmbru@redhat.com\u003e\n" }, { "commit": "bddb785e791e415db38884848d068457e226f5e3", "tree": "4a7bfcf773d2fc9b1296519e79b3b9842c4a14d9", "parents": [ "a19f59a72d96056d9a8f48cf6c77f5787491e414", "87e403247d318a6b782d3ffe20e1442197d032fe" ], "author": { "name": "Richard Henderson", "email": "richard.henderson@linaro.org", "time": "Fri Oct 16 15:47:44 2026 +0200" }, "committer": { "name": "Richard Henderson", "email": "richard.henderson@linaro.org", "time": "Fri Oct 16 15:47:44 2026 +0200" }, "message": "Merge tag \u0027misc-fixes-pull-request\u0027 of https://gitlab.com/berrange/qemu into staging\n\n* Really fix blocking of setns/execveat/unshare in seccomp\n* Fail fast in qtest when QEMU terminates before a connection\n is established\n* Deprecate use of instance properties in QOM to encourage greater\n use of class properties in new code\n* Drop obsolete, disabled \u0026 broken migration workaround for gnutls\n thread safety bug\n\n# -----BEGIN PGP SIGNATURE-----\n#\n# iQIzBAABCAAdFiEEOSEivHoFu8YQee2OpU5XPKwd8GwFAmrR8bwACgkQpU5XPKwd\n# 8GxfNw//SOBRjG+MyJdnWOXTE4Li1F8kqq7jHPPVND7h5s+q6K0RZXFO5ZLVCw4f\n# KQrSmBniJ6dtA+BQLn0/LECYV8PgvO0Zzxi9zMel6GENlRLa/CYY57QY4XRB+w15\n# 0LN+Dzigi/cfOi+bl0+T6T1RCVO2Y4uoMV1dSJR2m+uKHhsSZNwJ6yU7TrS3JzKM\n# kD7j+0cF0vuzzUkG28c3tnwTUayr7E05bcvPqCeUDupMzbldKQi6Ucd47f3UWhtf\n# yQyau6A7BhRh1iX7Fx4nlfApvjoVG0DzOxu75skQhlF3YwHCzrfclt2L1/iBEQN9\n# 6qbKQVznS2ppIZeC5aSjPMp7cvnqrXhiBWT9tghghPSaWhcuE13NcOIrQkqFuQkr\n# U3UTWE4uBn6FhGxpFTNZaHrKhfGZ6UoO1tDAOvvcs0e4KHQcWQ4+tRVtuoK+ZsJ3\n# Hf/QqcDyQ3X05Wg+jrGrOAqO/qn6wintr0A6fTxdqH9TrjXoWu83/8AF1WsUYMbA\n# 41atXLvgYPi7F2O2x5OGs2f3ftF1ivvQ7jnDD8Uf4Y6CqS1mwURwsOQOpIVICxwg\n# LgolKSRvUGjmEkJwWHwEPs+3k0D89biK+KPgr1lAEulqMRsLJ1/pBvU89o6TDgyQ\n# jaYWdPH9CrEAg4He2/MhZSze8MFs3Nl8FPJIwCsOni274b3yo9s\u003d\n# \u003dCbfR\n# -----END PGP SIGNATURE-----\n# gpg: Signature made Fri 16 Oct 2026 11:43:24 AM CEST\n# gpg: using RSA key 392122BC7A05BBC61079ED8EA54E573CAC1DF06C\n# gpg: Good signature from \"Daniel P. Berrange \u003cdan@berrange.com\u003e\" [unknown]\n# gpg: aka \"Daniel P. Berrange \u003cberrange@redhat.com\u003e\" [unknown]\n# gpg: WARNING: This key is not certified with a trusted signature!\n# gpg: There is no indication that the signature belongs to the owner.\n# Primary key fingerprint: DAF3 A6FD B26B 6291 2D0E 8E3F BE86 EBB4 1510 4FDF\n# Subkey fingerprint: 3921 22BC 7A05 BBC6 1079 ED8E A54E 573C AC1D F06C\n\n* tag \u0027misc-fixes-pull-request\u0027 of https://gitlab.com/berrange/qemu:\n Revert \"crypto: implement workaround for GNUTLS thread safety problems\"\n Revert \"crypto: add tracing \u0026 warning about GNUTLS countermeasures\"\n Revert \"io: add support for activating TLS thread safety workaround\"\n Revert \"migration: activate TLS thread safety workaround\"\n qom: deprecate use of instance level properties\n qtest: fail fast when QEMU terminates early\n seccomp: drop redundant match for clone() flags \u003d\u003d 0\n seccomp: really fix blocking of setns/execveat/unshare\n\nSigned-off-by: Richard Henderson \u003crichard.henderson@linaro.org\u003e\n" }, { "commit": "5689c59055e7652cc4b6ac0a47b6e48faad4d59d", "tree": "47222729a31c5f5ee2407950dc9c395259eea2c0", "parents": [ "49edb98a8114499df1f5957065ad99e5d3939f08" ], "author": { "name": "Haoqian He", "email": "haoqian.he@smartx.com", "time": "Tue Oct 13 14:05:49 2026 +0800" }, "committer": { "name": "Vladimir Sementsov-Ogievskiy", "email": "vsementsov@yandex-team.ru", "time": "Fri Oct 16 09:46:54 2026 +0300" }, "message": "block/mirror: inherit the source node discard flag in mirror_top\n\nmirror_start_job() inserts a mirror_top filter above the source node\nfor both mirror and active commit jobs. Previously, the filter was\nopened with BDRV_O_RDWR only, even when the source had BDRV_O_UNMAP\nenabled.\n\nThe block layer checks BDRV_O_UNMAP before invoking a node\u0027s discard\ncallback. Without this flag on mirror_top, discard requests return\nsuccess without reaching bdrv_mirror_top_pdiscard(). Consequently,\nstarting a job can silently suppress guest UNMAP/TRIM requests that\nwould otherwise reach the discard-enabled source.\n\nInitialize the filter\u0027s open flags with BDRV_O_RDWR and conditionally\nadd BDRV_O_UNMAP from bs-\u003eopen_flags. Pass the resulting flags to\nbdrv_new_open_driver() so that mirror_top follows the source node\u0027s\ndiscard setting.\n\nThis allows discard requests to reach the existing filter callback,\nwhich forwards them to the source and either tracks the affected\nrange in the dirty bitmap or synchronously propagates the discard\nto the target, depending on the copy mode.\n\nSigned-off-by: Haoqian He \u003chaoqian.he@smartx.com\u003e\nMessage-ID: \u003c20261013060549.3008438-1-haoqian.he@smartx.com\u003e\nReviewed-by: Vladimir Sementsov-Ogievskiy \u003cvsementsov@yandex-team.ru\u003e\nSigned-off-by: Vladimir Sementsov-Ogievskiy \u003cvsementsov@yandex-team.ru\u003e\n" }, { "commit": "49edb98a8114499df1f5957065ad99e5d3939f08", "tree": "e23f6e19f620e55ebd44b157f8ef4899914dc605", "parents": [ "62c31d1b6aa8e255c528df41c51a35dec9516be9" ], "author": { "name": "Jean-Louis Dupond", "email": "jean-louis@dupond.be", "time": "Wed Aug 26 12:10:05 2026 +0200" }, "committer": { "name": "Vladimir Sementsov-Ogievskiy", "email": "vsementsov@yandex-team.ru", "time": "Fri Oct 16 09:46:54 2026 +0300" }, "message": "qcow2: add functionality to repair bitmaps\n\nIn some cases, it might happen that bitmaps become corrupt.\nFor example when adding/removing bitmaps on a live image.\n\nOf course this should not happen, but in case this happens, the image is\ncorrupt and even cannot be opened anymore. You\u0027ll get something like the\nfollowing:\nqemu-img: Could not open \u0027disk.qcow2\u0027: Bitmap \u0027\u0027 doesn\u0027t satisfy the constraints\n\nSo the image becomes useless, and cannot be repaired. This while in fact\nonly (one) bitmap entry is corrupt, and the rest of the data is just\nintact.\n\nThis commit adds a way to fix this corruption, by just replacing the\nbitmap list in the qcow2 image with the valid bitmaps, and dropping the\nbitmaps that are corrupt.\n\n$ qemu-img check disk.qcow2\nqemu-img: Check failed: Invalid argument\nqemu-img: Lost persistent bitmaps during inactivation of node \u0027#block147\u0027: Bitmap \u0027\u0027 doesn\u0027t satisfy the constraints\n\n$ qemu-img check -r all disk.qcow2\nqcow2_free_clusters failed: Invalid argument\nLeaked cluster 3 refcount\u003d1 reference\u003d0\nLeaked cluster 26 refcount\u003d1 reference\u003d0\nERROR cluster 983214 refcount\u003d0 reference\u003d1\nRebuilding refcount structure\nRepairing cluster 1 refcount\u003d1 reference\u003d0\nRepairing cluster 2 refcount\u003d1 reference\u003d0\nRepairing cluster 32768 refcount\u003d1 reference\u003d0\n....\nRepairing cluster 983214 refcount\u003d1 reference\u003d0\nThe following inconsistencies were found and repaired:\n\n 2 leaked clusters\n 3 corruptions\n\nDouble checking the fixed image now...\nNo errors were found on the image.\n983056/1048576 \u003d 93.75% allocated, 0.05% fragmented, 0.00% compressed clusters\nImage end offset: 64437878784\n\nAnd the image is valid again!\nWorst case you lose all bitmaps, but at least the image and the data\nitself is useable again.\n\nSigned-off-by: Jean-Louis Dupond \u003cjean-louis@dupond.be\u003e\nMessage-ID: \u003c20260826101005.2345883-2-jean-louis@dupond.be\u003e\nReviewed-by: Vladimir Sementsov-Ogievskiy \u003cvsementsov@yandex-team.ru\u003e\nSigned-off-by: Vladimir Sementsov-Ogievskiy \u003cvsementsov@yandex-team.ru\u003e\n" }, { "commit": "a19f59a72d96056d9a8f48cf6c77f5787491e414", "tree": "ffd9f7e2128f6d7f8883eec29cd4bd2e2fc90044", "parents": [ "2cab0c10632960c01972727608196984d52c93bf", "34c91feed0817d3aae6c6beddc9446ccd2f78602" ], "author": { "name": "Richard Henderson", "email": "richard.henderson@linaro.org", "time": "Fri Oct 16 07:50:02 2026 +0200" }, "committer": { "name": "Richard Henderson", "email": "richard.henderson@linaro.org", "time": "Fri Oct 16 07:50:02 2026 +0200" }, "message": "Merge tag \u0027pull-hex-20261015\u0027 of https://github.com/qualcomm/qemu into staging\n\nHexagon: bugfixes + pcycle support\n\n# -----BEGIN PGP SIGNATURE-----\n#\n# iQIzBAABCgAdFiEEPWaq5HRZSCTIjOD4GlSvuOVkbDIFAmrRMWYACgkQGlSvuOVk\n# bDJBLA//WjANahTrYpC1WDwR1/kVhlbvUfQxuqR/XS4TE2xwRiNw2ZCGxC6IHXD+\n# Qw/65lwodATXEIjtKGCjZ0tgsG6eKCixn9d24VSx1TJW9wgWzPnh0qlj+0e7Jo+o\n# bQDdmsPwHxbGJk8PzI3i6BWntIky4WaffLBkav5H6kRXUvue48dRQp/OCkLn1ljg\n# 31+j8dK/E74BJcymAH2rn0UhHI+8b5hIG0TJjJ7ydICPLYw7UDJpsfEQEApNJ4eW\n# VcY6/GAJ4OQzWcNAMexLYb8yscVNdef3F5v5z9iq6q8oiC6hMrTta++2coUXyUTu\n# 10M4HMBtRhW9RXnYP4y3iiDnf3PzMriCc2tfkW6a+JlRbQ7KzmGzTfztuI04b4VQ\n# UC/6pcg3hN+kp3JSxEvZ5MMWlJU3bNjvrFJ+DJGxZUG1bRbj4IOpXhMAZx0IEuok\n# rWet9/Mhg4hH5Gwy2i7IEDw7ZGXKZMLIXcx9q+dYxAeK/LqnDbTXQfdI7D7Xo7Lz\n# 98apTsmC2HDvUmVOqhbiys91XhhYJ7povyNrljrcrCnzKjlhlYOUsZgf331fgfY+\n# KuoFaKGWgmU4nj3h2fun4Symv92wJSc6q9LToZtDBekJSlnRDL71YyZ8kShZxPT4\n# Vvqb6J8syU2xhNnf1HRIC3U6G/aZM/k5tszylcHmDtZx4c7bXlk\u003d\n# \u003dCVab\n# -----END PGP SIGNATURE-----\n# gpg: Signature made Thu 15 Oct 2026 10:02:46 PM CEST\n# gpg: using RSA key 3D66AAE474594824C88CE0F81A54AFB8E5646C32\n# gpg: Good signature from \"Brian Cain (OSS Qualcomm) \u003cbrian.cain@oss.qualcomm.com\u003e\" [unknown]\n# gpg: aka \"Brian Cain (QUIC) \u003cquic_bcain@quicinc.com\u003e\" [unknown]\n# gpg: aka \"Brian Cain \u003cbcain@kernel.org\u003e\" [unknown]\n# gpg: aka \"Brian Cain (QuIC) \u003cbcain@quicinc.com\u003e\" [unknown]\n# gpg: aka \"Brian Cain (CAF) \u003cbcain@codeaurora.org\u003e\" [unknown]\n# gpg: aka \"bcain\" [unknown]\n# gpg: WARNING: This key is not certified with a trusted signature!\n# gpg: There is no indication that the signature belongs to the owner.\n# Primary key fingerprint: 6350 20F9 67A7 7164 79EF 49E0 175C 464E 541B 6D47\n# Subkey fingerprint: 3D66 AAE4 7459 4824 C88C E0F8 1A54 AFB8 E564 6C32\n\n* tag \u0027pull-hex-20261015\u0027 of https://github.com/qualcomm/qemu:\n tests/functional/hexagon: add MiniVM, lock tests\n target/hexagon: set a started thread\u0027s enable bit when start retires\n target/hexagon: halt on tlblock when the TLB lock is contended\n target/hexagon: wake K0 and TLB lock waiters\n target/hexagon: check privilege mode for system instructions\n exec: correct translator_io_start documentation\n target/hexagon: mark clock-backed register reads as I/O\n hw/hexagon: model PCYCLE with virtual clock\n target/hexagon: remove packet-count PCYCLE implementation\n\nSigned-off-by: Richard Henderson \u003crichard.henderson@linaro.org\u003e\n" }, { "commit": "2cab0c10632960c01972727608196984d52c93bf", "tree": "7a19f490017fed588ca87c656cef896658045dc1", "parents": [ "62c31d1b6aa8e255c528df41c51a35dec9516be9", "269cab810cd7ee2f6955be2048979b206a711817" ], "author": { "name": "Richard Henderson", "email": "richard.henderson@linaro.org", "time": "Fri Oct 16 07:49:38 2026 +0200" }, "committer": { "name": "Richard Henderson", "email": "richard.henderson@linaro.org", "time": "Fri Oct 16 07:49:38 2026 +0200" }, "message": "Merge tag \u0027pbouvier/pr/multi_target-20261015\u0027 of https://gitlab.com/p-b-o/qemu into staging\n\nChanges:\n- [PATCH v3 00/12] multi-target: add hexagon (Pierrick Bouvier \u003cpierrick.bouvier@oss.qualcomm.com\u003e)\n Link: https://lore.kernel.org/qemu-devel/20261014210526.104215-1-pierrick.bouvier@oss.qualcomm.com\n- [PATCH 0/8] multi-target: remove qmp_query_cpu_definitions duplication (Pierrick Bouvier \u003cpierrick.bouvier@oss.qualcomm.com\u003e)\n Link: https://lore.kernel.org/qemu-devel/20261015005355.62406-1-pierrick.bouvier@oss.qualcomm.com\n\n# -----BEGIN PGP SIGNATURE-----\n#\n# iQGzBAABCgAdFiEEN8FWlNi6l2Sxlz/btEQ30ZwoYt8FAmrRKfoACgkQtEQ30Zwo\n# Yt8vngwApWYRZ/QCBIZF7cfLPJKKoZlEHuTGHogk4NcXmsQEjmW+uyFPaG72pjle\n# kfW6NaqQc/8dJuU1C5raZFeFFcQSt0kIusgUE7BzdFACPr6hwsSMh2Adnnmo37cd\n# 5fKyPavz5DEjo2dbEhEUVh/osGHCrRwxKtyzw8uZooRroyPnIYtoGUP6DuQowf4T\n# SDJx1NbgE6nDr+7+YUSFmb4zaAmIiByt61Oks2c1VZRGIkB9QMU4PHYz+b7mxBpJ\n# pTYKyI2cWZWQVe2t5NtyI7B8KNxbRriExjRdpPvyQXiFyzAljP/DJ9mh1PZnaQhN\n# zG7Xez4zWN1tBsqklpK9g48ZP7KMPRNwUoLUB95VMgj2ISZdS4LDSxIvzm55frqG\n# O7kJUczIvkeEqp+wiOB6qtlB5+zhT1HRYwRou3gIdNCt1jgNwUWHerRq0qV+s7Fn\n# XxqJcHR4jbHiO9+OeitmK7dQEERLSiLOnWgbfm26FRK7NKnPYtp5rIvos4OaPElS\n# Q25P7ojs\n# \u003d5zQl\n# -----END PGP SIGNATURE-----\n# gpg: Signature made Thu 15 Oct 2026 09:31:06 PM CEST\n# gpg: using RSA key 37C15694D8BA9764B1973FDBB44437D19C2862DF\n# gpg: Good signature from \"Pierrick Bouvier \u003cpierrick.bouvier@oss.qualcomm.com\u003e\" [unknown]\n# gpg: WARNING: This key is not certified with a trusted signature!\n# gpg: There is no indication that the signature belongs to the owner.\n# Primary key fingerprint: 37C1 5694 D8BA 9764 B197 3FDB B444 37D1 9C28 62DF\n\n* tag \u0027pbouvier/pr/multi_target-20261015\u0027 of https://gitlab.com/p-b-o/qemu:\n qmp: reimplement qmp_query_cpu_definitions as a dispatcher function\n target/s390x: rename qmp_query_cpu_definitions to qmp_query_s390x_cpu_definitions\n target/riscv: rename to qmp_query_cpu_definitions to qmp_query_riscv_cpu_definitions\n target/ppc: rename qmp_query_cpu_definitions to qmp_query_ppc_cpu_definitions\n target/mips: rename qmp_query_cpu_definitions to qmp_query_mips_cpu_definitions\n target/loongarch: rename to qmp_query_loongarch_cpu_definitions\n target/i386: rename qmp_query_cpu_definitions to qmp_query_i386_cpu_definitions\n target/arm: rename qmp_query_cpu_definitions to qmp_query_arm_cpu_definitions\n meson.build: add hexagon-softmmu to multi-target\n semihosting: remove common_* functions\n semihosting: use new semihosting ops\n target/arm: declare semihosting ops\n target/hexagon: declare semihosting ops\n target/riscv: declare semihosting ops\n target/riscv/cpu: constify cpu parameter for riscv_cpu_mxl\n semihosting: declare semihosting cpu ops\n hw/core/cpu: restrict tcg_ops to CONFIG_TCG only\n hw/hexagon/virt: make machine available for hexagon target only\n target-info: add target_hexagon\n target/hexagon: prefix helpers conflicting with other arch\n\nSigned-off-by: Richard Henderson \u003crichard.henderson@linaro.org\u003e\n" }, { "commit": "62c31d1b6aa8e255c528df41c51a35dec9516be9", "tree": "3b6deffedd318f8f838943ea36416573749bfb8c", "parents": [ "b11de76e085b64469bd9c78c20dedb6301225463", "bfdd4f6a918ffad4f013d4f53a9adca1adc0aa3b" ], "author": { "name": "Richard Henderson", "email": "richard.henderson@linaro.org", "time": "Fri Oct 16 06:09:05 2026 +0200" }, "committer": { "name": "Richard Henderson", "email": "richard.henderson@linaro.org", "time": "Fri Oct 16 06:09:05 2026 +0200" }, "message": "Merge tag \u0027pull-riscv-to-apply-20261016\u0027 of https://github.com/alistair23/qemu into staging\n\nRISC-V PR for 11.2\n\n* Check G-stage write permission for VS-stage A/D updates\n* Restore LCOFI handling in interrupt CSRs\n* Fix csrrs disasembly decoding\n* Stop translating after WFI\n* Raise virtual instruction exception on svinval instructions\n* Fix some KVM migration issues\n* Add support for Milk-V Duo board\n* Make MIP accesses atomic and BQL-safe\n* Add initial sdext support\n* Add SiFive Xsfvqmaccdod/Xsfvqmaccqoq int8 matmul extensions\n* Add the Server Platform Reference Board\n* Revert invalidate reservations after stores for linux user\n* Fix the UART register width in SPCR\n* Check Svnapot PTE before updating A/D bits\n* Add Tenstorrent Atlantis PRCM model\n* Fix RV32 fixed counter accesses\n* Write back fsgnjn.h and fsgnjx.h results\n* Ensure Zcmt jvt.mode is WARL\n\n# -----BEGIN PGP SIGNATURE-----\n#\n# iQIzBAABCgAdFiEEaukCtqfKh31tZZKWr3yVEwxTgBMFAmrRd48ACgkQr3yVEwxT\n# gBP2IA/+K3g3iCj5SdIb76OGghikQSYtGOby8fDmDgY9bVWtx9kPKgTJHan8RWpV\n# MmVUAx63K4E47lKr1rEOr2ADQRlPXtvXrUjEcatcX7bOvmfNB2rjSEZkUjRf6oWK\n# dBRbkCjB1iSAC0e9ftShTkIeAd+n+D0xh8XgjCMylaqWyqgLBDDlIApR9Q0mLOWN\n# /KF+d5CSMS71KJROMTdVfNJBgcbAOoSsRpEnnZiXFr2QhBwx8MHpnPrbgqvmaidG\n# b4PKr7AW7qZzD6ir4OecNm2b1jAW5/4lnEbsjvJEfHKakPJo7er1gPG99k29WQT9\n# mLXLeXIsKW2ZvAYDHyDUQiY4onJhdu3EV1KHhZuzN3iBz66lk9B+co7OH9g99q1n\n# la6U0RYTLyTY3fqlwBE0GgfY0acMb+sYCDOUmJ5Pn934g2IaASopLRdznuaAT2h+\n# gPX9q/avi/6WeUAzqo8eauL1+gVe9j/H6+OCvkfD/D3GKoU7s8RD/RfsEKjeHp79\n# YQBhLnxr4u/nFGCQGg79hJjZdaeocqEhmV+9V9kgYFWj2G7eQ/dl6fBQbAVetjPk\n# ANx6NMoSO/2sFhmSRiKCoSaSMhTHcAaBI05O93b/XDXjh5xyGmGwpF7Nf4S5pq0p\n# sVFJ/RLfhk20XJ/ljaCLc3+7A8bcoPBq+CfgRfn/onm1uBhFEq4\u003d\n# \u003dbjFp\n# -----END PGP SIGNATURE-----\n# gpg: Signature made Fri 16 Oct 2026 03:02:07 AM CEST\n# gpg: using RSA key 6AE902B6A7CA877D6D659296AF7C95130C538013\n# gpg: Good signature from \"Alistair Francis \u003calistair@alistair23.me\u003e\" [unknown]\n# gpg: WARNING: This key is not certified with a trusted signature!\n# gpg: There is no indication that the signature belongs to the owner.\n# Primary key fingerprint: 6AE9 02B6 A7CA 877D 6D65 9296 AF7C 9513 0C53 8013\n\n* tag \u0027pull-riscv-to-apply-20261016\u0027 of https://github.com/alistair23/qemu: (50 commits)\n target/riscv: normalize Zcmt jvt.mode on writes\n target/riscv: write back fsgnjn.h and fsgnjx.h results\n target/riscv: fix RV32 fixed counter accesses\n hw/riscv/tt-atlantis: Update UART and I2C to use clk from PRCM\n hw/riscv/tt-atlantis: Add PRCMs to tt-atlantis model\n hw/misc: Add Tenstorrent Atlantis PRCM model\n target/riscv: Check Svnapot PTE before updating A/D bits\n tests/qtest/bios-tables-test: Update riscv64 virt SPCR golden reference\n hw/riscv/virt-acpi-build: Fix the UART register width in SPCR\n tests/qtest/bios-tables-test: Allow changes to riscv64 virt SPCR\n Revert \"linux-user/riscv: invalidate reservations after stores\"\n docs: add riscv-server-ref.rst\n tests/functional/riscv64: add riscv-server-ref tests\n hw/riscv: server platform reference machine\n target/riscv: add riscv-server-ref CPU\n target/riscv/cpu.c: remove \u0027bare\u0027 condition for .profile\n tests/tcg/riscv64: Add tests for SiFive int8 matmul extensions\n disas/riscv: Add disassembler support for Xsfvqmaccdod/Xsfvqmaccqoq\n target/riscv: rvv: Add SiFive custom int8 matmul instructions\n target/riscv/cpu: Add SiFive custom int8 matmul extension implied rules\n ...\n\nSigned-off-by: Richard Henderson \u003crichard.henderson@linaro.org\u003e\n" }, { "commit": "bfdd4f6a918ffad4f013d4f53a9adca1adc0aa3b", "tree": "0a2760dcc028efc2c4fc62141f353c7049a1ee3d", "parents": [ "8e9ae00c217f1c66f13cf8eec584be58b84c501c" ], "author": { "name": "wangyang", "email": "wangyang25@otcaix.iscas.ac.cn", "time": "Fri Sep 04 09:26:08 2026 +0800" }, "committer": { "name": "Alistair Francis", "email": "alistair.francis@wdc.com", "time": "Fri Oct 16 10:40:39 2026 +1000" }, "message": "target/riscv: normalize Zcmt jvt.mode on writes\n\nOnly jvt.mode\u003d0 is implemented by QEMU. write_jvt() currently retains\nreserved mode bits, so a legal WARL write of base|1 is read back\nunchanged and causes a subsequent cm.jt to trap. Mask the write with\nJVT_BASE to normalize the unsupported mode.\n\nResolves: https://gitlab.com/qemu-project/qemu/-/work_items/4408\nSigned-off-by: wangyang \u003cwangyang25@otcaix.iscas.ac.cn\u003e\nReviewed-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\nMessage-ID: \u003ca64897d07c6b0c61451cd5382afafcd27201367d.20260904092608.git.wangyang25.otcaix.iscas.ac.cn\u003e\nSigned-off-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\n" }, { "commit": "8e9ae00c217f1c66f13cf8eec584be58b84c501c", "tree": "cdc5b6ce5a607b6b8ea8e3a09e37ad82fe4ec332", "parents": [ "57b484e2d232423c95ce559919b9624041254b0c" ], "author": { "name": "wangyang", "email": "wangyang25@otcaix.iscas.ac.cn", "time": "Fri Sep 04 09:26:08 2026 +0800" }, "committer": { "name": "Alistair Francis", "email": "alistair.francis@wdc.com", "time": "Fri Oct 16 10:40:39 2026 +1000" }, "message": "target/riscv: write back fsgnjn.h and fsgnjx.h results\n\nUnder Zfinx/Zhinx, trans_fsgnjn_h() and trans_fsgnjx_h() compute their\nresults into a temporary but return without calling gen_set_fpr_hs().\nThe instructions consequently retire without updating the corresponding\ninteger register. Add the missing writeback calls, matching\ntrans_fsgnj_h().\n\nResolves: https://gitlab.com/qemu-project/qemu/-/work_items/4407\nSigned-off-by: wangyang \u003cwangyang25@otcaix.iscas.ac.cn\u003e\nReviewed-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\nMessage-ID: \u003cebb7f8a1c374783dd585ee838e1d30f4d2bfbccc.20260904092608.git.wangyang25.otcaix.iscas.ac.cn\u003e\nSigned-off-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\n" }, { "commit": "57b484e2d232423c95ce559919b9624041254b0c", "tree": "3c8037ca51b252de11cc1d11f1a0f5feedffc45c", "parents": [ "3ba3371db53a06cc77363f8bbdb324621f90bb58" ], "author": { "name": "Zephyr Li", "email": "fritchleybohrer@gmail.com", "time": "Thu Oct 08 11:51:50 2026 +0800" }, "committer": { "name": "Alistair Francis", "email": "alistair.francis@wdc.com", "time": "Fri Oct 16 10:40:39 2026 +1000" }, "message": "target/riscv: fix RV32 fixed counter accesses\n\nSince commit cfc96df65e01, riscv_pmu_ctr_get_fixed_counters_val()\nreturns the complete 64-bit fixed-counter value. The RV32 counter\naccess paths, however, still perform parts of the offset calculation\non separately extracted 32-bit halves.\n\nIn particular, riscv_pmu_write_ctrh() deposits the low 32 bits of the\ncomplete fixed-counter value into the high half of mhpmcounter_prev.\nriscv_pmu_read_ctr() also subtracts a 32-bit half of the previous value\nfrom the complete 64-bit fixed-counter value. Consequently, writes to\nmcycleh can be lost and carries between the low and high halves are not\nhandled correctly.\n\nKeep the fixed-counter offset calculation entirely in 64 bits. Before\na running counter is partially written, materialize its current\narchitectural value and reset the fixed-counter baseline. On reads,\ncalculate the complete 64-bit counter value before extracting the half\nrequested by RV32.\n\nRegister RV32 system TCG tests with the Meson build. Add a test for\nhigh-half writes, low-to-high carry, and preserving the carried high\nhalf across a subsequent low-half write.\n\nFixes: cfc96df65e01 (\"target/riscv: Remove upper_half from riscv_pmu_ctr_get_fixed_counters_val\")\nResolves: https://gitlab.com/qemu-project/qemu/-/work_items/4219\nSigned-off-by: Zephyr Li \u003cfritchleybohrer@gmail.com\u003e\nReviewed-by: Daniel Henrique Barboza \u003cdaniel.barboza@oss.qualcomm.com\u003e\nReviewed-by: Chao Liu \u003cchao.liu@processmission.com\u003e\nMessage-ID: \u003c20261008035150.2223-1-fritchleybohrer@gmail.com\u003e\nSigned-off-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\n" }, { "commit": "3ba3371db53a06cc77363f8bbdb324621f90bb58", "tree": "a5a947e1cca9c5092b4dd4073347a7b7c3cfe207", "parents": [ "5fa42544d8717c65d05e5964d62a153589f54dbc" ], "author": { "name": "Anirudh Srinivasan", "email": "asrinivasan@oss.tenstorrent.com", "time": "Thu Oct 01 08:52:10 2026 -0500" }, "committer": { "name": "Alistair Francis", "email": "alistair.francis@wdc.com", "time": "Fri Oct 16 10:40:39 2026 +1000" }, "message": "hw/riscv/tt-atlantis: Update UART and I2C to use clk from PRCM\n\nNow that we have the PRCM modelled, update the DT nodes for UART1 and\nthe 5 I2C controllers to use the rcpu_prcm as a clock provider. This\nalso allows us to eliminate the periph_clk that was added to the DT\npreviously.\n\nSigned-off-by: Anirudh Srinivasan \u003casrinivasan@oss.tenstorrent.com\u003e\nAcked-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\nMessage-ID: \u003c20261001-atlantis_prcm-v4-3-95d33c470eeb@oss.tenstorrent.com\u003e\nSigned-off-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\n" }, { "commit": "5fa42544d8717c65d05e5964d62a153589f54dbc", "tree": "dc121c01b9ad97dc9a872dfbec9b4d1a4bbf382b", "parents": [ "f8419aafe9661c949c6782b0aba9bedc7883bb8d" ], "author": { "name": "Anirudh Srinivasan", "email": "asrinivasan@oss.tenstorrent.com", "time": "Thu Oct 01 08:52:09 2026 -0500" }, "committer": { "name": "Alistair Francis", "email": "alistair.francis@wdc.com", "time": "Fri Oct 16 10:40:39 2026 +1000" }, "message": "hw/riscv/tt-atlantis: Add PRCMs to tt-atlantis model\n\nAtlantis has 4 PRCMs that are visible from S mode by the Ascalon Core\n(RCPU, HSIO, PCIe and MM). The remaining 2 are only accessed by the\nboot cpu which isn\u0027t modelled yet.\n\nThis commit adds these 4 PRCM blocks to the tt-atlantis model, along\nwith necessary device tree nodes for them.\n\nReviewed-by: Chao Liu \u003cchao.liu@processmission.com\u003e\nReviewed-by: Joel Stanley \u003cjoel@jms.id.au\u003e\nSigned-off-by: Anirudh Srinivasan \u003casrinivasan@oss.tenstorrent.com\u003e\nAcked-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\nMessage-ID: \u003c20261001-atlantis_prcm-v4-2-95d33c470eeb@oss.tenstorrent.com\u003e\nSigned-off-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\n" }, { "commit": "f8419aafe9661c949c6782b0aba9bedc7883bb8d", "tree": "30e1aa230a0c7be56de64cbebd110cfe983e06c0", "parents": [ "cb82463fa9bf46d90e6a1779bb20aff2bf76a1a7" ], "author": { "name": "Anirudh Srinivasan", "email": "asrinivasan@oss.tenstorrent.com", "time": "Thu Oct 01 08:52:08 2026 -0500" }, "committer": { "name": "Alistair Francis", "email": "alistair.francis@wdc.com", "time": "Fri Oct 16 10:40:39 2026 +1000" }, "message": "hw/misc: Add Tenstorrent Atlantis PRCM model\n\nThis device present in Tenstorrent Atlantis has registers that control\nclocks, reset and other misc functionality in the SoC. This commit adds\nmodels for the RCPU, HSIO, PCIE, MM and 2 DDR PRCMs.\n\nCo-developed-by: Portia Stephens \u003cportias@oss.tenstorrent.com\u003e\nSigned-off-by: Portia Stephens \u003cportias@oss.tenstorrent.com\u003e\nReviewed-by: Joel Stanley \u003cjoel@jms.id.au\u003e\nSigned-off-by: Anirudh Srinivasan \u003casrinivasan@oss.tenstorrent.com\u003e\nAcked-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\nMessage-ID: \u003c20261001-atlantis_prcm-v4-1-95d33c470eeb@oss.tenstorrent.com\u003e\nSigned-off-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\n" }, { "commit": "cb82463fa9bf46d90e6a1779bb20aff2bf76a1a7", "tree": "5f88a05e87b0eb6f83134fdfb5cd5d9c566d9a6f", "parents": [ "71041ce05c95fe47fd24175bb2b974bb14f3d029" ], "author": { "name": "dodochicha", "email": "kevincheng60303@gmail.com", "time": "Mon Oct 05 19:59:16 2026 +0800" }, "committer": { "name": "Alistair Francis", "email": "alistair.francis@wdc.com", "time": "Fri Oct 16 10:40:38 2026 +1000" }, "message": "target/riscv: Check Svnapot PTE before updating A/D bits\n\nReserved Svnapot PTE encodings must raise a page fault without\nmodifying the PTE. Currently the A/D bits may be updated before\nthe Svnapot encoding is validated.\n\nMove the Svnapot validation before the A/D update so reserved\nPTEs fault without changing the PTE.\n\nCc: qemu-stable@nongnu.org\nSigned-off-by: dodochicha \u003ckevincheng60303@gmail.com\u003e\nMessage-ID: \u003c20261005115916.21196-1-kevincheng60303@gmail.com\u003e\nReviewed-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\nSigned-off-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\n" }, { "commit": "71041ce05c95fe47fd24175bb2b974bb14f3d029", "tree": "af6b0699079dc565379fa03e34aec5d030e09b0b", "parents": [ "ee23f530e99d1091f31585dd0ca1b948d4873939" ], "author": { "name": "Rick Richard", "email": "rick@sloservers.com", "time": "Mon Oct 05 03:40:08 2026 -0700" }, "committer": { "name": "Alistair Francis", "email": "alistair.francis@wdc.com", "time": "Fri Oct 16 10:40:38 2026 +1000" }, "message": "tests/qtest/bios-tables-test: Update riscv64 virt SPCR golden reference\n\nUpdate the riscv64 virt SPCR golden reference file to have the fix for\nthe UART register width.\n\nDiffs from iasl:\n\n@@ -1,58 +1,58 @@\n /*\n * Intel ACPI Component Architecture\n * AML/ASL+ Disassembler version 20230628 (64-bit version)\n * Copyright (c) 2000 - 2023 Intel Corporation\n *\n * Disassembly of tests/data/acpi/riscv64/virt/SPCR, Sat Oct 3 08:44:51 2026\n *\n * ACPI Data Table [SPCR]\n *\n * Format: [HexOffset DecimalOffset ByteLength] FieldName : FieldValue (in hex)\n */\n\n [000h 0000 004h] Signature : \"SPCR\" [Serial Port Console Redirection Table]\n [004h 0004 004h] Table Length : 0000005A\n [008h 0008 001h] Revision : 04\n-[009h 0009 001h] Checksum : 13\n+[009h 0009 001h] Checksum : 2B\n [00Ah 0010 006h] Oem ID : \"BOCHS \"\n [010h 0016 008h] Oem Table ID : \"BXPC \"\n [018h 0024 004h] Oem Revision : 00000001\n [01Ch 0028 004h] Asl Compiler ID : \"BXPC\"\n [020h 0032 004h] Asl Compiler Revision : 00000001\n\n [024h 0036 001h] Interface Type : 12\n [025h 0037 003h] Reserved : 000000\n\n [028h 0040 00Ch] Serial Port Register : [Generic Address Structure]\n [028h 0040 001h] Space ID : 00 [SystemMemory]\n-[029h 0041 001h] Bit Width : 20\n+[029h 0041 001h] Bit Width : 08\n [02Ah 0042 001h] Bit Offset : 00\n [02Bh 0043 001h] Encoded Access Width : 01 [Byte Access:8]\n [02Ch 0044 008h] Address : 0000000010000000\n\n [034h 0052 001h] Interrupt Type : 10\n [035h 0053 001h] PCAT-compatible IRQ : 00\n [036h 0054 004h] Interrupt : 0000000A\n [03Ah 0058 001h] Baud Rate : 07\n [03Bh 0059 001h] Parity : 00\n [03Ch 0060 001h] Stop Bits : 01\n [03Dh 0061 001h] Flow Control : 00\n [03Eh 0062 001h] Terminal Type : 03\n [04Ch 0076 001h] Reserved : 00\n [040h 0064 002h] PCI Device ID : FFFF\n [042h 0066 002h] PCI Vendor ID : FFFF\n [044h 0068 001h] PCI Bus : 00\n [045h 0069 001h] PCI Device : 00\n [046h 0070 001h] PCI Function : 00\n [047h 0071 004h] PCI Flags : 00000000\n [04Bh 0075 001h] PCI Segment : 00\n [04Ch 0076 004h] Reserved : 00000000\n\n Raw Table Data: Length 90 (0x5A)\n\n- 0000: 53 50 43 52 5A 00 00 00 04 13 42 4F 43 48 53 20 // SPCRZ.....BOCHS\n+ 0000: 53 50 43 52 5A 00 00 00 04 2B 42 4F 43 48 53 20 // SPCRZ....+BOCHS\n 0010: 42 58 50 43 20 20 20 20 01 00 00 00 42 58 50 43 // BXPC ....BXPC\n- 0020: 01 00 00 00 12 00 00 00 00 20 00 01 00 00 00 10 // ......... ......\n+ 0020: 01 00 00 00 12 00 00 00 00 08 00 01 00 00 00 10 // ................\n 0030: 00 00 00 00 10 00 0A 00 00 00 07 00 01 00 03 00 // ................\n 0040: FF FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 // ................\n 0050: 00 00 00 00 02 00 58 00 2E 00 // ......X...\n\nSigned-off-by: Rick Richard \u003crick@sloservers.com\u003e\nReviewed-by: Daniel Henrique Barboza \u003cdaniel.barboza@oss.qualcomm.com\u003e\nMessage-ID: \u003c20261005104008.214588-4-rick@sloservers.com\u003e\nCc: qemu-stable@nongnu.org\nSigned-off-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\n" }, { "commit": "ee23f530e99d1091f31585dd0ca1b948d4873939", "tree": "9c7237950d22395a00477718e3c486163c93eeb1", "parents": [ "ba280c351011618d2e7f9c3773fb4cdf109e40f6" ], "author": { "name": "Rick Richard", "email": "rick@sloservers.com", "time": "Mon Oct 05 03:40:07 2026 -0700" }, "committer": { "name": "Alistair Francis", "email": "alistair.francis@wdc.com", "time": "Fri Oct 16 10:40:38 2026 +1000" }, "message": "hw/riscv/virt-acpi-build: Fix the UART register width in SPCR\n\nThe riscv virt board uses a 16550 UART with an 8-bit register stride,\nbut the SPCR table reports 32, which looks to have been copied from\narm virt, whose PL011 has a 32-bit stride. Change it to the correct\nstride for a 16550.\n\nFixes: 3e6f1e61b4 (\"hw/riscv/virt-acpi-build.c: Generate SPCR table\")\nSigned-off-by: Rick Richard \u003crick@sloservers.com\u003e\nReviewed-by: Daniel Henrique Barboza \u003cdaniel.barboza@oss.qualcomm.com\u003e\nMessage-ID: \u003c20261005104008.214588-3-rick@sloservers.com\u003e\nCc: qemu-stable@nongnu.org\nSigned-off-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\n" }, { "commit": "ba280c351011618d2e7f9c3773fb4cdf109e40f6", "tree": "46fc025620cd92e1d398dbc6dfe792c00a48374c", "parents": [ "48e99b73e637e4fb78aee03489be9f4b092b6b6b" ], "author": { "name": "Rick Richard", "email": "rick@sloservers.com", "time": "Mon Oct 05 03:40:06 2026 -0700" }, "committer": { "name": "Alistair Francis", "email": "alistair.francis@wdc.com", "time": "Fri Oct 16 10:40:38 2026 +1000" }, "message": "tests/qtest/bios-tables-test: Allow changes to riscv64 virt SPCR\n\nAllow changes to the riscv64 virt board SPCR -- we are going to fix\nan error in the UART description there.\n\nSigned-off-by: Rick Richard \u003crick@sloservers.com\u003e\nReviewed-by: Daniel Henrique Barboza \u003cdaniel.barboza@oss.qualcomm.com\u003e\nMessage-ID: \u003c20261005104008.214588-2-rick@sloservers.com\u003e\nCc: qemu-stable@nongnu.org\nSigned-off-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\n" }, { "commit": "48e99b73e637e4fb78aee03489be9f4b092b6b6b", "tree": "131a1e1b3cd4feff53836cd1a0a0c367a95e84ab", "parents": [ "bde97423bbd60e357361d585bf51634274530aaf" ], "author": { "name": "Alistair Francis", "email": "alistair.francis@wdc.com", "time": "Fri Oct 02 09:21:19 2026 +1000" }, "committer": { "name": "Alistair Francis", "email": "alistair.francis@wdc.com", "time": "Fri Oct 16 10:40:38 2026 +1000" }, "message": "Revert \"linux-user/riscv: invalidate reservations after stores\"\n\nThis reverts commit 5089493e45d3be2bae9ffd2a22186f57b0cabe3f.\n\nRick reported that this patch results in large slowdowns when using\nmultiple threads. The original patch serialises all stores, resulting in\nall vCPUs stopping for every store, which would explain the slowdown.\n\nThe results from Rick show\n\nxz compressing 2 MB at -6, without and with the patch:\n\n without patch with patch\n xz -T1 5 s 122 s (identical output)\n xz -T8 1 s no output after 600 s\n\nThat is too large of an overhead, so let\u0027s revert this patch until a\nbetter solution is found.\n\nReported-by: Rick \u003crick@sloservers.com\u003e\nSigned-off-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\nReviewed-by: Daniel Henrique Barboza \u003cdaniel.barboza@oss.qualcomm.com\u003e\nMessage-ID: \u003c20261001232119.1765494-1-alistair.francis@wdc.com\u003e\nSigned-off-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\n" }, { "commit": "bde97423bbd60e357361d585bf51634274530aaf", "tree": "6961824a134eb6ffd2f56d7d36e698ce8a50c12e", "parents": [ "1ed67b571a7eb74a5379ad410055d3ad80589e8e" ], "author": { "name": "Daniel Henrique Barboza", "email": "daniel.barboza@oss.qualcomm.com", "time": "Mon Sep 28 17:11:06 2026 -0300" }, "committer": { "name": "Alistair Francis", "email": "alistair.francis@wdc.com", "time": "Fri Oct 16 10:40:38 2026 +1000" }, "message": "docs: add riscv-server-ref.rst\n\nAdd documentation for the new riscv-server-ref board.\n\nSigned-off-by: Daniel Henrique Barboza \u003cdaniel.barboza@oss.qualcomm.com\u003e\nReviewed-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\nReviewed-by: Chao Liu \u003cchao.liu@processmission.com\u003e\nReviewed-by: Sunil V L \u003csunilvl@oss.qualcomm.com\u003e\nReviewed-by: Andrew Jones \u003candrew.jones@oss.qualcomm.com\u003e\nMessage-ID: \u003c20260928201107.2049458-6-daniel.barboza@oss.qualcomm.com\u003e\nSigned-off-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\n" }, { "commit": "1ed67b571a7eb74a5379ad410055d3ad80589e8e", "tree": "2b8d9b3635aa2267d52c87dc0d1ad8238f238119", "parents": [ "c2fa4320803ba54fced5548482df76a03d83faec" ], "author": { "name": "Daniel Henrique Barboza", "email": "daniel.barboza@oss.qualcomm.com", "time": "Mon Sep 28 17:11:05 2026 -0300" }, "committer": { "name": "Alistair Francis", "email": "alistair.francis@wdc.com", "time": "Fri Oct 16 10:40:38 2026 +1000" }, "message": "tests/functional/riscv64: add riscv-server-ref tests\n\nAdd tests for the recently added riscv-server-ref machine:\n\n- a new test_opensbi.py test. The idea is to have a quick test that can\ncatch trivial regressions that would prevent OpenSBI to finish;\n- a new Linux boot \"thorough\" test that will boot the machine up to the\nbuildroot prompt.\n- a TPM specific selftest for the riscv-server-ref board. The test\nwill be skipped if there\u0027s no \u0027swtpm\u0027 in the host.\n\nSigned-off-by: Daniel Henrique Barboza \u003cdaniel.barboza@oss.qualcomm.com\u003e\nReviewed-by: Chao Liu \u003cchao.liu.zevorn@gmail.com\u003e\nReviewed-by: Nutty Liu \u003cnutty.liu@hotmail.com\u003e\nReviewed-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\nReviewed-by: Sunil V L \u003csunilvl@oss.qualcomm.com\u003e\nMessage-ID: \u003c20260928201107.2049458-5-daniel.barboza@oss.qualcomm.com\u003e\nSigned-off-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\n" }, { "commit": "c2fa4320803ba54fced5548482df76a03d83faec", "tree": "01f222be6af3cb836811a781b0369c52203f746f", "parents": [ "414ad1be16c8998f41a2e7776245d4003c904123" ], "author": { "name": "Daniel Henrique Barboza", "email": "daniel.barboza@oss.qualcomm.com", "time": "Mon Sep 28 17:11:04 2026 -0300" }, "committer": { "name": "Alistair Francis", "email": "alistair.francis@wdc.com", "time": "Fri Oct 16 10:40:38 2026 +1000" }, "message": "hw/riscv: server platform reference machine\n\nThe RISC-V Server Platform specification [1] defines a standardized set\nof hardware and software capabilities, that portable system software,\nsuch as OS and hypervisors can rely on being present in a RISC-V server\nplatform.\n\nThe main features included in this emulation are:\n\n- Based on riscv virt machine type;\n- A new memory map as close as virt machine as possible;\n- An always present IOMMU platform device (riscv-iommu-sys) that uses\n IRQs 36 to 39, one IRQ for queue, similar to the \u0027virt\u0027 board;\n- AIA;\n- No default AHCI (can be added via command line);\n- No default NIC (can be added via command line);\n- No virtio device;\n- No fw_cfg device;\n- No ACPI table provided;\n- Only minimal device tree nodes;\n- a platform bus for TPM support.\n\nA note about TPM support: TPM devices in QEMU comes usually in two\nflavors - emulated or passthrough. A passthrough device requires a host\nTPM device that the QEMU process can borrow and it\u0027s usually coupled\nwith KVM acceleration.\n\nTo use the TPM emulator we\u0027ll need help from an external TPM emulator\ncalled swtpm. More info can be found in [2]. For our purposes this is\na process that, if running Ubuntu, can be installed via \u0027swtpm\u0027 package.\nWe\u0027ll go back to it shortly.\n\nFor now, adding support for the emulated TPM device \u0027tpm-tis\u0027 (other TPM\nflavors might work as well, \u0027tpm-tis\u0027 is the one tested with this work)\nrequires a platform bus. Adding a platform bus will open the door for\nmore devices to be added in the board. This is ok - a reference board\nisn\u0027t a restricted board and users are free to add devices at their\nleisure.\n\nHere\u0027s how to use tpm-tis with the riscv-server-ref board:\n\n- in a separated shell/term run \u0027swtpm\u0027 (--log is optional):\n\n$ mkdir /tmp/mytpm1\n$ swtpm socket --tpmstate dir\u003d/tmp/mytpm1 \\\n\t--ctrl type\u003dunixio,path\u003d/tmp/mytpm1/swtpm-sock \\\n\t--tpm2 \\\n\t--log level\u003d20\n\nThen start QEMU with:\n\n$ qemu-system-riscv64 -M riscv-server-ref (...) \\\n\t-chardev socket,id\u003dchrtpm,path\u003d/tmp/mytpm1/swtpm-sock \\\n\t-tpmdev emulator,id\u003dtpm0,chardev\u003dchrtpm\\\n\t-device tpm-tis-device,tpmdev\u003dtpm0\n\n[1] https://github.com/riscv-non-isa/riscv-server-platform\n[2] https://qemu-project.gitlab.io/qemu/specs/tpm.html\n\nSigned-off-by: Daniel Henrique Barboza \u003cdaniel.barboza@oss.qualcomm.com\u003e\nReviewed-by: Nutty Liu \u003cnutty.liu@hotmail.com\u003e\nReviewed-by: Chao Liu \u003cchao.liu@processmission.com\u003e\nReviewed-by: Sunil V L \u003csunilvl@oss.qualcomm.com\u003e\nReviewed-by: Andrew Jones \u003candrew.jones@oss.qualcomm.com\u003e\nAcked-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\nMessage-ID: \u003c20260928201107.2049458-4-daniel.barboza@oss.qualcomm.com\u003e\nSigned-off-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\n" }, { "commit": "414ad1be16c8998f41a2e7776245d4003c904123", "tree": "32a13ab64c99bae68a6573afabea612b390e4b8e", "parents": [ "c09348f3d240eba2521d46a275806fbf49791ac0" ], "author": { "name": "Daniel Henrique Barboza", "email": "daniel.barboza@oss.qualcomm.com", "time": "Mon Sep 28 17:11:03 2026 -0300" }, "committer": { "name": "Alistair Francis", "email": "alistair.francis@wdc.com", "time": "Fri Oct 16 10:40:38 2026 +1000" }, "message": "target/riscv: add riscv-server-ref CPU\n\nThe harts requirements of RISC-V server platform [1] require RVA23 ISA\nprofile support and others.\n\nWe\u0027re going for a profile-based implementation, instead of a regular CPU\nthat can inherit RVA23, to allow future CPUs to use it internally as a\nstarting base for their own extension sets. There\u0027s also a new\n\u0027rvserver-ref-1.0\u0027 flag that can be used to set the extensions in the\ncommand line for other CPUs, which can be used for testing/debugging\npurposes.\n\nNote that for all intents and purposes \"riscv-server-ref\" is a regular\nCPU and no, we\u0027re not trying to set a precedent of calling the riscv\nserver platform spec a profile.\n\n[1] defines in rule SEE_020 that we must support at least 11 debug\ntriggers (4 for insn address, 4 for insn load/store, 1 for icount,\none for int, one for excp). We\u0027re going for the minimum. If more\ntriggers are needed users can set any trigger amount (N \u003c\u003d 1024)\nwith:\n\n-cpu riscv-server-ref,num-triggers\u003dN\n\n[1] https://github.com/riscv-non-isa/riscv-server-platform/blob/main/server_platform_requirements.adoc\n\nSuggested-by: Icenowy Zheng \u003cuwu@icenowy.me\u003e\nSigned-off-by: Daniel Henrique Barboza \u003cdaniel.barboza@oss.qualcomm.com\u003e\nReviewed-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\nReviewed-by: Matheus Ferst \u003cmatheus.ferst@eldorado.org.br\u003e\nReviewed-by: Chao Liu \u003cchao.liu@processmission.com\u003e\nReviewed-by: Sunil V L \u003csunilvl@oss.qualcomm.com\u003e\nReviewed-by: Andrew Jones \u003candrew.jones@oss.qualcomm.com\u003e\nMessage-ID: \u003c20260928201107.2049458-3-daniel.barboza@oss.qualcomm.com\u003e\nSigned-off-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\n" }, { "commit": "c09348f3d240eba2521d46a275806fbf49791ac0", "tree": "55803b057981a5363f72e3006e03a680b21bc0c2", "parents": [ "bbfcf9248b7f528ff38f775339492feac8b104f0" ], "author": { "name": "Daniel Henrique Barboza", "email": "daniel.barboza@oss.qualcomm.com", "time": "Mon Sep 28 17:11:02 2026 -0300" }, "committer": { "name": "Alistair Francis", "email": "alistair.francis@wdc.com", "time": "Fri Oct 16 10:40:38 2026 +1000" }, "message": "target/riscv/cpu.c: remove \u0027bare\u0027 condition for .profile\n\nWe want to configure other CPU types to use profiles as an alternative\nto adding every profile extension explicitly, i.e. a profile is nothing\nmore than an extension bundle.\n\nThis means that a vendor CPU can set .profile\u003drva23s64 while having the\nsame handling as any other vendor CPU. Same thing with all other CPU\ntypes.\n\nSigned-off-by: Daniel Henrique Barboza \u003cdaniel.barboza@oss.qualcomm.com\u003e\nReviewed-by: Andrew Jones \u003candrew.jones@oss.qualcomm.com\u003e\nReviewed-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\nReviewed-by: Chao Liu \u003cchao.liu@processmission.com\u003e\nReviewed-by: Sunil V L \u003csunilvl@oss.qualcomm.com\u003e\nMessage-ID: \u003c20260928201107.2049458-2-daniel.barboza@oss.qualcomm.com\u003e\nSigned-off-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\n" }, { "commit": "bbfcf9248b7f528ff38f775339492feac8b104f0", "tree": "2661b23a0f5559d4c20cb946496d6215dc4c2568", "parents": [ "86b14980dc78a2a0cff7a9afa70fa62000754b01" ], "author": { "name": "Max Chou", "email": "max.chou@sifive.com", "time": "Sun Sep 27 16:25:34 2026 +0800" }, "committer": { "name": "Alistair Francis", "email": "alistair.francis@wdc.com", "time": "Fri Oct 16 10:40:38 2026 +1000" }, "message": "tests/tcg/riscv64: Add tests for SiFive int8 matmul extensions\n\nAdd a test that exercises all SiFive int8 matrix-multiply instructions\nfrom the Xsfvqmaccqoq and Xsfvqmaccdod extensions.\n\nFor each tile shape the test covers the four signedness variants\n(sf.vqmaccu / sf.vqmacc / sf.vqmaccus / sf.vqmaccsu) and the\nreserved-encoding path: with vl set to a value that is not a multiple\nof the tile size the helper raises an illegal-instruction exception.\n\nReviewed-by: Daniel Henrique Barboza \u003cdaniel.barboza@oss.qualcomm.com\u003e\nAcked-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\nSigned-off-by: Max Chou \u003cmax.chou@sifive.com\u003e\nReviewed-by: Chao Liu \u003cchao.liu@processmission.com\u003e\nMessage-ID: \u003c20260927082534.3228237-7-max.chou@sifive.com\u003e\nSigned-off-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\n" }, { "commit": "86b14980dc78a2a0cff7a9afa70fa62000754b01", "tree": "7511167f2dad204bc21974798c1e3904fcc0edcd", "parents": [ "2eb9d17edc4cda8e25d5a70fb9458ce32e8a7638" ], "author": { "name": "Jason Chien", "email": "jason.chien@sifive.com", "time": "Sun Sep 27 16:25:33 2026 +0800" }, "committer": { "name": "Alistair Francis", "email": "alistair.francis@wdc.com", "time": "Fri Oct 16 10:40:38 2026 +1000" }, "message": "disas/riscv: Add disassembler support for Xsfvqmaccdod/Xsfvqmaccqoq\n\nAdd disassembler support for all SiFive custom int8 matrix-multiply\ninstructions: sf.vqmacc{u,,us,su}.4x8x4 and sf.vqmacc{u,,us,su}.2x8x2.\n\nThese instructions share opcode 0b1011011 and funct3 0b010, and are\ndistinguished by funct6: 60-63 for the 4x8x4 (Xsfvqmaccqoq) tile and\n44-47 for the 2x8x2 (Xsfvqmaccdod) tile.\n\nSigned-off-by: Jason Chien \u003cjason.chien@sifive.com\u003e\nReviewed-by: Daniel Henrique Barboza \u003cdaniel.barboza@oss.qualcomm.com\u003e\nAcked-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\nSigned-off-by: Max Chou \u003cmax.chou@sifive.com\u003e\nReviewed-by: Chao Liu \u003cchao.liu@processmission.com\u003e\nMessage-ID: \u003c20260927082534.3228237-6-max.chou@sifive.com\u003e\nSigned-off-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\n" }, { "commit": "2eb9d17edc4cda8e25d5a70fb9458ce32e8a7638", "tree": "94d5025ee748bdb77aec627ffea405b997b63191", "parents": [ "7d30199707819cbc9ad4f58d253f2ea662cf523b" ], "author": { "name": "Frank Chang", "email": "frank.chang@sifive.com", "time": "Sun Sep 27 16:25:32 2026 +0800" }, "committer": { "name": "Alistair Francis", "email": "alistair.francis@wdc.com", "time": "Fri Oct 16 10:40:38 2026 +1000" }, "message": "target/riscv: rvv: Add SiFive custom int8 matmul instructions\n\nAdd the 8 SiFive custom int8 matrix-multiply vector instructions:\nsf.vqmacc{u,,us,su}.4x8x4 and sf.vqmacc{u,,us,su}.2x8x2. Each name\nsuffix encodes the signedness of vs1/vs2.\nThe 4x8x4 forms multiply-accumulate a 4x8 by 8x4 int8 tile into a\n4x4 int32 result; the 2x8x2 forms use a 2x8 by 8x2 tile producing a\n2x2 int32 result. Both Xsfvqmaccqoq/Xsfvqmaccdod extensions are\ngated on vlenb \u003e\u003d 32, sew \u003d\u003d 8 and vm \u003d\u003d 1, per the SiFive Int8\nMatrix Multiplication Extensions Specification.\n\nSigned-off-by: Frank Chang \u003cfrank.chang@sifive.com\u003e\nReviewed-by: Daniel Henrique Barboza \u003cdaniel.barboza@oss.qualcomm.com\u003e\nAcked-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\nSigned-off-by: Max Chou \u003cmax.chou@sifive.com\u003e\nReviewed-by: Chao Liu \u003cchao.liu@processmission.com\u003e\nMessage-ID: \u003c20260927082534.3228237-5-max.chou@sifive.com\u003e\nSigned-off-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\n" }, { "commit": "7d30199707819cbc9ad4f58d253f2ea662cf523b", "tree": "6d1cdd7f608514749a2852c34e720c7f0d2c3edd", "parents": [ "efd422eab50f9bdd5e3977320495cb47571cde47" ], "author": { "name": "Frank Chang", "email": "frank.chang@sifive.com", "time": "Sun Sep 27 16:25:31 2026 +0800" }, "committer": { "name": "Alistair Francis", "email": "alistair.francis@wdc.com", "time": "Fri Oct 16 10:40:38 2026 +1000" }, "message": "target/riscv/cpu: Add SiFive custom int8 matmul extension implied rules\n\nAdd SiFive custom int8 matmul extension implied rules to enable the\nimplied extensions of SiFive custom int8 matmul extension recursively.\n\nSigned-off-by: Frank Chang \u003cfrank.chang@sifive.com\u003e\nReviewed-by: Daniel Henrique Barboza \u003cdaniel.barboza@oss.qualcomm.com\u003e\nReviewed-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\nSigned-off-by: Max Chou \u003cmax.chou@sifive.com\u003e\nReviewed-by: Chao Liu \u003cchao.liu@processmission.com\u003e\nMessage-ID: \u003c20260927082534.3228237-4-max.chou@sifive.com\u003e\nSigned-off-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\n" }, { "commit": "efd422eab50f9bdd5e3977320495cb47571cde47", "tree": "a192eb013e1dfd1096f7d4070909a0b152794005", "parents": [ "97a136f0e4d2c45a048c296d65fe305f9322a5ec" ], "author": { "name": "Max Chou", "email": "max.chou@sifive.com", "time": "Sun Sep 27 16:25:30 2026 +0800" }, "committer": { "name": "Alistair Francis", "email": "alistair.francis@wdc.com", "time": "Fri Oct 16 10:40:38 2026 +1000" }, "message": "target/riscv/cpu: List one implied-ext rule per line\n\nEvery entry added to riscv_multi_ext_implied_rules currently has to\nreflow whatever line it lands on, since entries are packed several\nper line. List one rule per line instead so future additions are a\npure append.\n\nSuggested-by: Daniel Henrique Barboza \u003cdaniel.barboza@oss.qualcomm.com\u003e\nReviewed-by: Daniel Henrique Barboza \u003cdaniel.barboza@oss.qualcomm.com\u003e\nReviewed-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\nSigned-off-by: Max Chou \u003cmax.chou@sifive.com\u003e\nReviewed-by: Chao Liu \u003cchao.liu@processmission.com\u003e\nMessage-ID: \u003c20260927082534.3228237-3-max.chou@sifive.com\u003e\nSigned-off-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\n" }, { "commit": "97a136f0e4d2c45a048c296d65fe305f9322a5ec", "tree": "3e4fe64226b27bd018de81bcc1564c179e9d194a", "parents": [ "e723a1e16319a781dec5f311359747dd2e13c324" ], "author": { "name": "Max Chou", "email": "max.chou@sifive.com", "time": "Sun Sep 27 16:25:29 2026 +0800" }, "committer": { "name": "Alistair Francis", "email": "alistair.francis@wdc.com", "time": "Fri Oct 16 10:40:38 2026 +1000" }, "message": "target/riscv: Add cfg property for SiFive int8 matmul extensions\n\nAdd the CPU config properties for SiFive\u0027s custom int8 matrix\nmultiply vector extensions:\n\n- Xsfvqmaccdod: 2x8x2 int8 matrix-multiply-accumulate operations\n- Xsfvqmaccqoq: 4x8x4 int8 matrix-multiply-accumulate operations\n\nAll instructions of these extensions require the Zve32x extension\nto be present whenever either extension is enabled. Validate this\nin riscv_cpu_validate_vendor_ext() alongside the existing vector\nextension validation in riscv_cpu_validate_set_extensions().\n\nReviewed-by: Daniel Henrique Barboza \u003cdaniel.barboza@oss.qualcomm.com\u003e\nReviewed-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\nSigned-off-by: Max Chou \u003cmax.chou@sifive.com\u003e\nReviewed-by: Chao Liu \u003cchao.liu@processmission.com\u003e\nMessage-ID: \u003c20260927082534.3228237-2-max.chou@sifive.com\u003e\nSigned-off-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\n" }, { "commit": "e723a1e16319a781dec5f311359747dd2e13c324", "tree": "d8e785b20a374b5e859ca596c174775da380aa8b", "parents": [ "bd2e4a81e0c168e159305c547c979078239aa4f1" ], "author": { "name": "Daniel Henrique Barboza", "email": "daniel.barboza@oss.qualcomm.com", "time": "Mon Sep 28 16:59:01 2026 -0300" }, "committer": { "name": "Alistair Francis", "email": "alistair.francis@wdc.com", "time": "Fri Oct 16 10:40:38 2026 +1000" }, "message": "tests/tcg/riscv64: add sdext \"not on Debug mode\" sigill tests\n\nAdding proper TCG automated tests to sdext CSRs requires enabling\ngdbstub support for riscv64, which we don\u0027t have, since the nature of\nthe CSRs added is that they run in a higher privilege than M mode.\n\nDCSR has bits to allow for context switching from other modes to Debug\nmode, but those bits must be set via an external entity (e.g. gdb)\nbeforehand.\n\nWhat we can do for now is a \"negative\" TCG test to ensure that we\u0027ll\nthrow illegal insn traps when trying to write sdext CSRs in machine\nmode.\n\nSigned-off-by: Daniel Henrique Barboza \u003cdaniel.barboza@oss.qualcomm.com\u003e\nAcked-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\nMessage-ID: \u003c20260928195902.2045235-8-daniel.barboza@oss.qualcomm.com\u003e\nSigned-off-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\n" }, { "commit": "bd2e4a81e0c168e159305c547c979078239aa4f1", "tree": "86fb200f9c8c084266da1933712a20fedfbc1ff4", "parents": [ "ef8770d18e6e4284e6ad5712beb3763944c3a203" ], "author": { "name": "Chao Liu", "email": "chao.liu.zevorn@gmail.com", "time": "Mon Sep 28 16:59:00 2026 -0300" }, "committer": { "name": "Alistair Francis", "email": "alistair.francis@wdc.com", "time": "Fri Oct 16 10:40:38 2026 +1000" }, "message": "target/riscv: add sdtrig trigger action\u003ddebug mode\n\nRISC-V Debug Specification:\nhttps://github.com/riscv/riscv-debug-spec/releases/tag/1.0\n\nAllow mcontrol/mcontrol6 action\u003d1 when Sdext is enabled. When such a\ntrigger hits, enter Debug Mode with cause\u003dtrigger and stop with\nEXCP_DEBUG.\n\nAlso report inst-count triggers in tinfo and read their action field.\n\nSigned-off-by: Chao Liu \u003cchao.liu.zevorn@gmail.com\u003e\nReviewed-by: Daniel Henrique Barboza \u003cdaniel.barboza@oss.qualcomm.com\u003e\nTested-by: Tao Tang \u003ctangtao1634@phytium.com.cn\u003e\nSigned-off-by: Daniel Henrique Barboza \u003cdaniel.barboza@oss.qualcomm.com\u003e\nAcked-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\nMessage-ID: \u003c20260928195902.2045235-7-daniel.barboza@oss.qualcomm.com\u003e\nSigned-off-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\n" }, { "commit": "ef8770d18e6e4284e6ad5712beb3763944c3a203", "tree": "5a54f09f830a92adb0f1229ae6a1ffe4506c4ac8", "parents": [ "77700e13c1cdd1e8cfc6b0a77e8924427742b9bb" ], "author": { "name": "Chao Liu", "email": "chao.liu.zevorn@gmail.com", "time": "Mon Sep 28 16:58:59 2026 -0300" }, "committer": { "name": "Alistair Francis", "email": "alistair.francis@wdc.com", "time": "Fri Oct 16 10:40:38 2026 +1000" }, "message": "target/riscv: add sdext single-step support\n\nRISC-V Debug Specification:\nhttps://github.com/riscv/riscv-debug-spec/releases/tag/1.0\n\nUse a TB flag when dcsr.step is set (and we are not in Debug Mode).\nWhen the flag is on, build 1-insn TBs and do not chain to the next TB.\nAdd a TB-exit helper that enters Debug Mode with cause\u003dstep and sets\ndpc to the next pc, then stops with EXCP_DEBUG.\n\nIf dcsr.stepie is 0, do not take interrupts while stepping. Treat WFI\nas a nop so the hart does not sleep during a step.\n\nPS: This patch references Max Chou\u0027s handling of ext_tb_flags.\nhttps://lore.kernel.org/qemu-devel/20260108132631.9429-6-max.chou@sifive.com/\n\nSigned-off-by: Chao Liu \u003cchao.liu.zevorn@gmail.com\u003e\nReviewed-by: Daniel Henrique Barboza \u003cdaniel.barboza@oss.qualcomm.com\u003e\nTested-by: Tao Tang \u003ctangtao1634@phytium.com.cn\u003e\nSigned-off-by: Daniel Henrique Barboza \u003cdaniel.barboza@oss.qualcomm.com\u003e\nReviewed-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\nReviewed-by: Nutty Liu \u003cnutty.liu@hotmail.com\u003e\nMessage-ID: \u003c20260928195902.2045235-6-daniel.barboza@oss.qualcomm.com\u003e\nSigned-off-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\n" }, { "commit": "77700e13c1cdd1e8cfc6b0a77e8924427742b9bb", "tree": "406f06dc95f460f8ba73d6d8525d90063554e390", "parents": [ "96b92b7e0a71d6cea5ff0e6c34963fb13a5e993c" ], "author": { "name": "Chao Liu", "email": "chao.liu.zevorn@gmail.com", "time": "Mon Sep 28 16:58:58 2026 -0300" }, "committer": { "name": "Alistair Francis", "email": "alistair.francis@wdc.com", "time": "Fri Oct 16 10:40:38 2026 +1000" }, "message": "target/riscv: add sdext enter Debug Mode on ebreak\n\nRISC-V Debug Specification:\nhttps://github.com/riscv/riscv-debug-spec/releases/tag/1.0\n\nRoute EBREAK via helper_sdext_ebreak. If Sdext is enabled and the\nmatching dcsr.ebreak* bit is set, enter Debug Mode with cause\u003debreak\nand stop with EXCP_DEBUG. Otherwise keep the normal breakpoint trap.\n\nSigned-off-by: Chao Liu \u003cchao.liu.zevorn@gmail.com\u003e\nReviewed-by: Daniel Henrique Barboza \u003cdaniel.barboza@oss.qualcomm.com\u003e\nTested-by: Tao Tang \u003ctangtao1634@phytium.com.cn\u003e\nSigned-off-by: Daniel Henrique Barboza \u003cdaniel.barboza@oss.qualcomm.com\u003e\nReviewed-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\nReviewed-by: Nutty Liu \u003cnutty.liu@hotmail.com\u003e\nMessage-ID: \u003c20260928195902.2045235-5-daniel.barboza@oss.qualcomm.com\u003e\nSigned-off-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\n" }, { "commit": "96b92b7e0a71d6cea5ff0e6c34963fb13a5e993c", "tree": "30259780b1b1d1f84c5ef06748df9dd04e0a5f2a", "parents": [ "5a360f3c9d068454d399a0f548e164298d496889" ], "author": { "name": "Chao Liu", "email": "chao.liu.zevorn@gmail.com", "time": "Mon Sep 28 16:58:57 2026 -0300" }, "committer": { "name": "Alistair Francis", "email": "alistair.francis@wdc.com", "time": "Fri Oct 16 10:40:38 2026 +1000" }, "message": "target/riscv: add dret instruction\n\nRISC-V Debug Specification:\nhttps://github.com/riscv/riscv-debug-spec/releases/tag/1.0\n\nAdd DRET decode/translate and a helper to leave Debug Mode and return\nto dpc. Executing DRET outside Debug Mode raises illegal instruction.\n\nSigned-off-by: Chao Liu \u003cchao.liu.zevorn@gmail.com\u003e\nReviewed-by: Daniel Henrique Barboza \u003cdaniel.barboza@oss.qualcomm.com\u003e\nTested-by: Tao Tang \u003ctangtao1634@phytium.com.cn\u003e\nSigned-off-by: Daniel Henrique Barboza \u003cdaniel.barboza@oss.qualcomm.com\u003e\nReviewed-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\nReviewed-by: Nutty Liu \u003cnutty.liu@hotmail.com\u003e\nMessage-ID: \u003c20260928195902.2045235-4-daniel.barboza@oss.qualcomm.com\u003e\nSigned-off-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\n" }, { "commit": "5a360f3c9d068454d399a0f548e164298d496889", "tree": "3b0c1974c7901047ad2440a8849204e98badf468", "parents": [ "3065350ec908179c89de6901b2991883aee64f47" ], "author": { "name": "Chao Liu", "email": "chao.liu.zevorn@gmail.com", "time": "Mon Sep 28 16:58:56 2026 -0300" }, "committer": { "name": "Alistair Francis", "email": "alistair.francis@wdc.com", "time": "Fri Oct 16 10:40:38 2026 +1000" }, "message": "target/riscv: add sdext Debug Mode helpers\n\nRISC-V Debug Specification:\nhttps://github.com/riscv/riscv-debug-spec/releases/tag/1.0\n\nAdd helpers to enter/leave Debug Mode and to update dpc/dcsr.\nModel resume without a Debug Module by leaving Debug Mode at\ncpu_exec_enter and continuing from dpc.\n\nSigned-off-by: Chao Liu \u003cchao.liu.zevorn@gmail.com\u003e\nReviewed-by: Daniel Henrique Barboza \u003cdaniel.barboza@oss.qualcomm.com\u003e\nTested-by: Tao Tang \u003ctangtao1634@phytium.com.cn\u003e\nSigned-off-by: Daniel Henrique Barboza \u003cdaniel.barboza@oss.qualcomm.com\u003e\nReviewed-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\nMessage-ID: \u003c20260928195902.2045235-3-daniel.barboza@oss.qualcomm.com\u003e\nSigned-off-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\n" }, { "commit": "3065350ec908179c89de6901b2991883aee64f47", "tree": "a78ac56055c1624f205c85043b49b009d691e075", "parents": [ "b0accd7a2be216a258b170cca7e43b6c95332e72" ], "author": { "name": "Chao Liu", "email": "chao.liu.zevorn@gmail.com", "time": "Mon Sep 28 16:58:55 2026 -0300" }, "committer": { "name": "Alistair Francis", "email": "alistair.francis@wdc.com", "time": "Fri Oct 16 10:40:38 2026 +1000" }, "message": "target/riscv: add sdext debug CSRs state\n\nRISC-V Debug Specification:\nhttps://github.com/riscv/riscv-debug-spec/releases/tag/1.0\n\nAdd architectural state for Sdext Debug Mode: debug_mode, dcsr, dpc\nand dscratch0/1. Wire up CSR access for dcsr/dpc/dscratch and gate\nthem to Debug Mode (or host debugger access).\n\nThe Sdext is not fully implemented, so it is disabled by default.\n\nSigned-off-by: Chao Liu \u003cchao.liu.zevorn@gmail.com\u003e\nReviewed-by: Daniel Henrique Barboza \u003cdaniel.barboza@oss.qualcomm.com\u003e\nTested-by: Tao Tang \u003ctangtao1634@phytium.com.cn\u003e\nSigned-off-by: Daniel Henrique Barboza \u003cdaniel.barboza@oss.qualcomm.com\u003e\nReviewed-by: Nutty Liu \u003cnutty.liu@hotmail.com\u003e\nAcked-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\nMessage-ID: \u003c20260928195902.2045235-2-daniel.barboza@oss.qualcomm.com\u003e\nSigned-off-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\n" }, { "commit": "b0accd7a2be216a258b170cca7e43b6c95332e72", "tree": "d74e9c363b6b00c09a5055c31eef627a9ecaf523", "parents": [ "8edf31a885e2a13274ea5b801a6031db028d2736" ], "author": { "name": "Philippe Mathieu-Daudé", "email": "philmd@oss.qualcomm.com", "time": "Wed Sep 30 19:45:06 2026 +0200" }, "committer": { "name": "Alistair Francis", "email": "alistair.francis@wdc.com", "time": "Fri Oct 16 10:40:38 2026 +1000" }, "message": "target/riscv: Access MIP atomically\n\nMake riscv_cpu_get_mip() read env-\u003emip with qatomic_read() and\nriscv_cpu_update_mip() store it with qatomic_set(). This makes\nMIP reads and writes safe for riscv_cpu_has_work(), which may\nrun without the BQL.\n\nReported-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\nSigned-off-by: Philippe Mathieu-Daudé \u003cphilmd@oss.qualcomm.com\u003e\nReviewed-by: Richard Henderson \u003crichard.henderson@linaro.org\u003e\nReviewed-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\nMessage-ID: \u003c20260930174508.81497-7-philmd@oss.qualcomm.com\u003e\nSigned-off-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\n" }, { "commit": "8edf31a885e2a13274ea5b801a6031db028d2736", "tree": "4695a42ff3a4cb79fa8cfb757961bbc21d918598", "parents": [ "e92dd795db12bf8b7c0355cfca5d533b8a31527d" ], "author": { "name": "Philippe Mathieu-Daudé", "email": "philmd@oss.qualcomm.com", "time": "Wed Sep 30 19:45:05 2026 +0200" }, "committer": { "name": "Alistair Francis", "email": "alistair.francis@wdc.com", "time": "Fri Oct 16 10:40:38 2026 +1000" }, "message": "target/riscv: Add riscv_cpu_get_mip()\n\nRoute MIP reads in the interrupt, CSR, ACLINT and pending-IRQ\ncode through a single riscv_cpu_get_mip() accessor, so the\nimplementation can change in one place.\n\nriscv_cpu_update_mip() now reads the old value under the BQL,\nso the returned value matches the one written.\n\nSigned-off-by: Philippe Mathieu-Daudé \u003cphilmd@oss.qualcomm.com\u003e\nReviewed-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\nMessage-ID: \u003c20260930174508.81497-6-philmd@oss.qualcomm.com\u003e\nSigned-off-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\n" }, { "commit": "e92dd795db12bf8b7c0355cfca5d533b8a31527d", "tree": "e5cf723fd5109923561f034599ef5f50aea8236f", "parents": [ "5a8ca3974d9500a7cd9b3ec4d90216ad293f1348" ], "author": { "name": "Philippe Mathieu-Daudé", "email": "philmd@oss.qualcomm.com", "time": "Wed Sep 30 19:45:04 2026 +0200" }, "committer": { "name": "Alistair Francis", "email": "alistair.francis@wdc.com", "time": "Fri Oct 16 10:40:38 2026 +1000" }, "message": "target/riscv: Have riscv_cpu_set_mode() call riscv_cpu_interrupt()\n\nriscv_cpu_set_mode() only want the interrupt re-poll: the mip update\nwith a zero mask is a no-op. Call riscv_cpu_interrupt() directly.\n\nSuggested-by: Richard Henderson \u003crichard.henderson@linaro.org\u003e\nSigned-off-by: Philippe Mathieu-Daudé \u003cphilmd@oss.qualcomm.com\u003e\nReviewed-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\nMessage-ID: \u003c20260930174508.81497-5-philmd@oss.qualcomm.com\u003e\nSigned-off-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\n" }, { "commit": "5a8ca3974d9500a7cd9b3ec4d90216ad293f1348", "tree": "45cefe25715f013ae7df5923c84930c6cbcbebbe", "parents": [ "33aeb29083829054d2a68ea32808414fcae011f7" ], "author": { "name": "Philippe Mathieu-Daudé", "email": "philmd@oss.qualcomm.com", "time": "Wed Sep 30 19:45:03 2026 +0200" }, "committer": { "name": "Alistair Francis", "email": "alistair.francis@wdc.com", "time": "Fri Oct 16 10:40:38 2026 +1000" }, "message": "target/riscv: Clarify riscv_accel_set_irq() arguments\n\nUse per-accelerator locals to make the differing conventions\nexplicit: TCG takes a MIP bitmask and value, KVM takes an IRQ\nnumber and a level.\n\nSigned-off-by: Philippe Mathieu-Daudé \u003cphilmd@oss.qualcomm.com\u003e\nReviewed-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\nMessage-ID: \u003c20260930174508.81497-4-philmd@oss.qualcomm.com\u003e\nSigned-off-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\n" }, { "commit": "33aeb29083829054d2a68ea32808414fcae011f7", "tree": "71aa92dfb616ec62711be089ac57e6ef8bd06bbf", "parents": [ "3bcd0c6c6dc857a0cb78684b6b41849b3335f15e" ], "author": { "name": "Philippe Mathieu-Daudé", "email": "philmd@oss.qualcomm.com", "time": "Wed Sep 30 19:45:02 2026 +0200" }, "committer": { "name": "Alistair Francis", "email": "alistair.francis@wdc.com", "time": "Fri Oct 16 10:40:38 2026 +1000" }, "message": "target/riscv: Document kvm_riscv_set_irq()\n\nDescribe the supported interrupt and the effect of @level.\n\nSigned-off-by: Philippe Mathieu-Daudé \u003cphilmd@oss.qualcomm.com\u003e\nReviewed-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\nMessage-ID: \u003c20260930174508.81497-3-philmd@oss.qualcomm.com\u003e\nSigned-off-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\n" }, { "commit": "3bcd0c6c6dc857a0cb78684b6b41849b3335f15e", "tree": "115c52907168e7ea38606c33bfcda9cb16a6ac6e", "parents": [ "14812062ace92c8a342b922724183c70641d4a0d" ], "author": { "name": "Philippe Mathieu-Daudé", "email": "philmd@oss.qualcomm.com", "time": "Wed Sep 30 19:45:01 2026 +0200" }, "committer": { "name": "Alistair Francis", "email": "alistair.francis@wdc.com", "time": "Fri Oct 16 10:40:38 2026 +1000" }, "message": "target/riscv: Document riscv_cpu_update_mip()\n\nSigned-off-by: Philippe Mathieu-Daudé \u003cphilmd@oss.qualcomm.com\u003e\nReviewed-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\nMessage-ID: \u003c20260930174508.81497-2-philmd@oss.qualcomm.com\u003e\nSigned-off-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\n" }, { "commit": "14812062ace92c8a342b922724183c70641d4a0d", "tree": "f5ae535cdd32ded683f4b44128afb9df2b5437ce", "parents": [ "4cfc06f7a266116aa1a5c30c48f955e65817be7b" ], "author": { "name": "Kuan-Wei Chiu", "email": "visitorckw@gmail.com", "time": "Sun Sep 27 20:13:26 2026 +0000" }, "committer": { "name": "Alistair Francis", "email": "alistair.francis@wdc.com", "time": "Fri Oct 16 10:40:38 2026 +1000" }, "message": "docs/system/riscv: Add Milk-V Duo board documentation\n\nAdd documentation for the Milk-V Duo board. This includes a brief\noverview of the hardware, a list of supported devices, and practical\ninstructions on how to boot the machine using OpenSBI and a Linux\nkernel with an emulated SD card.\n\nSigned-off-by: Kuan-Wei Chiu \u003cvisitorckw@gmail.com\u003e\nAcked-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\nMessage-ID: \u003c20260927201326.650943-8-visitorckw@gmail.com\u003e\nSigned-off-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\n" }, { "commit": "4cfc06f7a266116aa1a5c30c48f955e65817be7b", "tree": "da8dd4605716e41f1a0993c2f0a50005e2ac0fcd", "parents": [ "e15368b55740624d8751cb25313be02f5f9a8b2d" ], "author": { "name": "Kuan-Wei Chiu", "email": "visitorckw@gmail.com", "time": "Sun Sep 27 20:13:25 2026 +0000" }, "committer": { "name": "Alistair Francis", "email": "alistair.francis@wdc.com", "time": "Fri Oct 16 10:40:38 2026 +1000" }, "message": "tests/functional/riscv64: Add boot test for Milk-V Duo board\n\nAdd a functional boot test for the Milk-V Duo board to validate the\nend-to-end boot flow.\n\n$ ./build/run ./tests/functional/riscv64/test_milkv_duo.py\nTAP version 13\nok 1 test_milkv_duo.MilkvDuoMachine.test_riscv64_milkv_duo\n1..1\n\nSigned-off-by: Kuan-Wei Chiu \u003cvisitorckw@gmail.com\u003e\nMessage-ID: \u003c20260927201326.650943-7-visitorckw@gmail.com\u003e\nSigned-off-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\n" }, { "commit": "e15368b55740624d8751cb25313be02f5f9a8b2d", "tree": "e185aecc05cc22f1a741d0cfad80bbc69a79672f", "parents": [ "38d3861d28486625ff22d88d32ca3a6023d4bac5" ], "author": { "name": "Kuan-Wei Chiu", "email": "visitorckw@gmail.com", "time": "Sun Sep 27 20:13:24 2026 +0000" }, "committer": { "name": "Alistair Francis", "email": "alistair.francis@wdc.com", "time": "Fri Oct 16 10:40:38 2026 +1000" }, "message": "tests/qtest: Add qtest for Milk-V Duo board\n\nAdd minimal qtest coverage for the Milk-V Duo machine to validate basic\nMMIO mapping and register access.\n\nCurrently tested:\n- Verify DW8250 UART component version and type signatures.\n- Test read/write access to CV1800B clock bypass register.\n\nTested with:\n$ meson test -C build -v qemu:qtest-riscv64/milkv-duo-test\n[...]\nOk: 1\nFail: 0\n\nSigned-off-by: Kuan-Wei Chiu \u003cvisitorckw@gmail.com\u003e\nAcked-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\nMessage-ID: \u003c20260927201326.650943-6-visitorckw@gmail.com\u003e\nSigned-off-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\n" }, { "commit": "38d3861d28486625ff22d88d32ca3a6023d4bac5", "tree": "7893581fa59c6c77b65745f0a417ffa6977f3037", "parents": [ "ec48d0112915769291f32cca61e1bd7a25d84078" ], "author": { "name": "Kuan-Wei Chiu", "email": "visitorckw@gmail.com", "time": "Sun Sep 27 20:13:23 2026 +0000" }, "committer": { "name": "Alistair Francis", "email": "alistair.francis@wdc.com", "time": "Fri Oct 16 10:40:38 2026 +1000" }, "message": "hw/riscv: Add Milk-V Duo board support\n\nAdd support for the Milk-V Duo development board, which is powered by\nthe Sophgo CV1800B SoC.\n\nThe implementation includes:\n- Board-level machine initialization with 64mb of default ram.\n- Integration of the CV1800B SoC.\n- Support for loading external FDT, kernel, and initrd images.\n- Proper setup of the reset vector to match the CV1800B\u0027s boot flow.\n\nSigned-off-by: Kuan-Wei Chiu \u003cvisitorckw@gmail.com\u003e\nAcked-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\nReviewed-by: Chao Liu \u003cchao.liu.zevorn@gmail.com\u003e\nMessage-ID: \u003c20260927201326.650943-5-visitorckw@gmail.com\u003e\nSigned-off-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\n" }, { "commit": "ec48d0112915769291f32cca61e1bd7a25d84078", "tree": "376ef54c75920c5c104e058f5bf62aa520726ef7", "parents": [ "87d19757aa8c44488e48b0197bf3be0ea7dc057e" ], "author": { "name": "Kuan-Wei Chiu", "email": "visitorckw@gmail.com", "time": "Sun Sep 27 20:13:22 2026 +0000" }, "committer": { "name": "Alistair Francis", "email": "alistair.francis@wdc.com", "time": "Fri Oct 16 10:40:38 2026 +1000" }, "message": "hw/riscv: Add Sophgo CV1800B SoC support\n\nAdd the Sophgo CV1800B SoC, which is the heart of the Milk-V Duo board.\n\nThe SoC features a T-Head C906 CPU along with integrated PLIC, CLINT,\nand dw8250 UART. The memory map and interrupts are configured according\nto the CV1800B datasheet. [1]\n\nSeveral peripheral blocks are included as unimplemented devices to\nensure that drivers can probe successfully without causing errors\nduring boot.\n\nLink: https://github.com/milkv-duo/duo-files/tree/main/duo/datasheet [1]\nSigned-off-by: Kuan-Wei Chiu \u003cvisitorckw@gmail.com\u003e\nAcked-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\nMessage-ID: \u003c20260927201326.650943-4-visitorckw@gmail.com\u003e\nSigned-off-by: Alistair Francis \u003calistair.francis@wdc.com\u003e\n" } ], "next": "87d19757aa8c44488e48b0197bf3be0ea7dc057e" }