Branch: refs/heads/master
Home: https://github.com/qemu/qemu
Commit: 196ac2544107121f64eeae5dccd2e72e72d55ab5
https://github.com/qemu/qemu/commit/196ac2544107121f64eeae5dccd2e72e72d55ab5
Author: Michael S. Tsirkin <[email protected]>
Date: 2026-02-03 (Tue, 03 Feb 2026)
Changed paths:
M docs/interop/vhost-user.rst
Log Message:
-----------
vhost-user: ancilliary -> ancillary
My dictionary says the former spelling is incorrect.
Message-ID: <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Gustavo Romero <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Commit: 6d8dd5ec084732a9933925aa2c4fdff9a1aae7ef
https://github.com/qemu/qemu/commit/6d8dd5ec084732a9933925aa2c4fdff9a1aae7ef
Author: Akihiko Odaki <[email protected]>
Date: 2026-02-05 (Thu, 05 Feb 2026)
Changed paths:
M hw/pci/shpc.c
Log Message:
-----------
pci/shpc: Do not unparent in instance_finalize()
Children are automatically unparented so manually unparenting is
unnecessary.
Worse, automatic unparenting happens before the instance_finalize()
callback of the parent gets called, so object_unparent() calls in
the callback will refer to objects that are already unparented, which
is semantically incorrect.
Signed-off-by: Akihiko Odaki <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Message-ID: <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-Id: <[email protected]>
Commit: c6caeed118ff069c720fb98d1f5d2bae70b05881
https://github.com/qemu/qemu/commit/c6caeed118ff069c720fb98d1f5d2bae70b05881
Author: Philippe Mathieu-Daudé <[email protected]>
Date: 2026-02-05 (Thu, 05 Feb 2026)
Changed paths:
M hw/pci-host/articia.c
M hw/pci-host/aspeed_pcie.c
M hw/pci-host/designware.c
M hw/pci-host/gpex.c
M hw/pci-host/grackle.c
M hw/pci-host/gt64120.c
M hw/pci-host/mv64361.c
M hw/pci-host/pnv_phb.c
M hw/pci-host/ppce500.c
M hw/pci-host/q35.c
M hw/pci-host/raven.c
M hw/pci-host/remote.c
M hw/pci-host/sabre.c
M hw/pci-host/uninorth.c
M hw/pci-host/xilinx-pcie.c
M hw/pci/pci_host.c
Log Message:
-----------
hw/pci-host: Set DEVICE_CATEGORY_BRIDGE once in parent class_init()
No need to set DEVICE_CATEGORY_BRIDGE for each device
implementing TYPE_PCI_HOST_BRIDGE: set it once in the
parent.
Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Marc-André Lureau <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Message-ID: <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-Id: <[email protected]>
Commit: cabeac1246724ae12eb935c2b2c06777675c5035
https://github.com/qemu/qemu/commit/cabeac1246724ae12eb935c2b2c06777675c5035
Author: CLEMENT MATHIEU--DRIF <[email protected]>
Date: 2026-02-05 (Thu, 05 Feb 2026)
Changed paths:
M hw/i386/intel_iommu.c
M hw/i386/intel_iommu_internal.h
Log Message:
-----------
intel_iommu: Add an IOMMU index for pre-translated addresses
Signed-off-by: Clement Mathieu--Drif <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-Id: <[email protected]>
Commit: 05f858cb67e4965db77f3fe223e6110ff3ca0dde
https://github.com/qemu/qemu/commit/05f858cb67e4965db77f3fe223e6110ff3ca0dde
Author: CLEMENT MATHIEU--DRIF <[email protected]>
Date: 2026-02-05 (Thu, 05 Feb 2026)
Changed paths:
M hw/i386/intel_iommu.c
Log Message:
-----------
intel_iommu: Support memory operations with pre-translated addresses
Signed-off-by: Clement Mathieu--Drif <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-Id: <[email protected]>
Commit: b7e31028a303129c12a7f35e380804a0c8b93bcd
https://github.com/qemu/qemu/commit/b7e31028a303129c12a7f35e380804a0c8b93bcd
Author: CLEMENT MATHIEU--DRIF <[email protected]>
Date: 2026-02-05 (Thu, 05 Feb 2026)
Changed paths:
M hw/pci/pcie.c
M include/hw/pci/pcie.h
Log Message:
-----------
pcie: Add a function to check if pasid privileged mode is enabled
Signed-off-by: Clement Mathieu--Drif <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-Id: <[email protected]>
Commit: ccd162e5be9dbd08e4f523d612f3ec72a2cba00a
https://github.com/qemu/qemu/commit/ccd162e5be9dbd08e4f523d612f3ec72a2cba00a
Author: CLEMENT MATHIEU--DRIF <[email protected]>
Date: 2026-02-05 (Thu, 05 Feb 2026)
Changed paths:
M hw/pci/pci.c
Log Message:
-----------
pci: Block ATS requests when privileged mode is disabled
Signed-off-by: Clement Mathieu--Drif <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-Id: <[email protected]>
Commit: e08a72d2179a6f0da2509d49082105f16ded580f
https://github.com/qemu/qemu/commit/e08a72d2179a6f0da2509d49082105f16ded580f
Author: CLEMENT MATHIEU--DRIF <[email protected]>
Date: 2026-02-05 (Thu, 05 Feb 2026)
Changed paths:
M hw/i386/intel_iommu.c
M hw/i386/intel_iommu_internal.h
Log Message:
-----------
intel_iommu: Handle insufficient permissions during translation requests
ATS translations should not fail when the write permission is not set.
Signed-off-by: Clement Mathieu--Drif <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-Id: <[email protected]>
Commit: 0acb2b193b01665300a1ab5007a144fdaa6e340d
https://github.com/qemu/qemu/commit/0acb2b193b01665300a1ab5007a144fdaa6e340d
Author: CLEMENT MATHIEU--DRIF <[email protected]>
Date: 2026-02-05 (Thu, 05 Feb 2026)
Changed paths:
M hw/i386/intel_iommu.c
Log Message:
-----------
intel_iommu: Minimal handling of privileged ATS request
The purpose of this commit is not to support privileged requests but
to prevent devices from doing things they wouldn't be able to do
with real hardware.
We simply block privileged requests when the SRS ecap is not set
and abort when the ecap is present.
For now, its not worth implementing support for privileged requests
because the kernel does not support it.
(https://lore.kernel.org/linux-iommu/[email protected]/)
However, we may consider working on it depending on how the development
goes in the kernel.
Signed-off-by: Clement Mathieu--Drif <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-Id: <[email protected]>
Commit: 952e1a6e90eb22a6deffa4e980277b135e9d077f
https://github.com/qemu/qemu/commit/952e1a6e90eb22a6deffa4e980277b135e9d077f
Author: CLEMENT MATHIEU--DRIF <[email protected]>
Date: 2026-02-05 (Thu, 05 Feb 2026)
Changed paths:
M hw/i386/intel_iommu.c
M hw/i386/intel_iommu_internal.h
M include/hw/i386/intel_iommu.h
Log Message:
-----------
intel_iommu: Add a CLI option to enable SVM
Signed-off-by: Clement Mathieu--Drif <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-Id: <[email protected]>
Commit: 23a4edb6dbe3dd5223326bdf03ae955321669b5c
https://github.com/qemu/qemu/commit/23a4edb6dbe3dd5223326bdf03ae955321669b5c
Author: Daniil Tatianin <[email protected]>
Date: 2026-02-05 (Thu, 05 Feb 2026)
Changed paths:
M hw/virtio/vhost.c
Log Message:
-----------
virtio/vhost: don't consider non-MAP_SHARED regions public
Just having a file descriptor is not enough to consider a memory region
public. If QEMU didn't map it as MAP_SHARED (in case of share=off), guest
writes to this region won't be visible to the vhost-user backend, thus
causing it to read all zeroes or garbage. Make sure we don't pass such
regions and include that to our definition of what a private region is.
Signed-off-by: Daniil Tatianin <[email protected]>
Fixes: 552b25229c ("vhost: Rework memslot filtering and fix "used_memslot"
tracking")
Acked-by: Stefano Garzarella <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-Id: <[email protected]>
Commit: fd3a2c601ab4a1bdb669e4c584b364e00a978702
https://github.com/qemu/qemu/commit/fd3a2c601ab4a1bdb669e4c584b364e00a978702
Author: Wafer Xie <[email protected]>
Date: 2026-02-05 (Thu, 05 Feb 2026)
Changed paths:
M hw/virtio/vhost-vdpa.c
M include/hw/virtio/vhost-vdpa.h
Log Message:
-----------
vdpa: fix vhost-vdpa suspended state not be shared
When stopping a vhost-vdpa device, only the first queue pair is marked as
suspended,
while the remaining queues are not updated to the suspended state.
As a result, when stopping a multi-queue vhost-vdpa device,
the following error message will be printed.
qemu-system-x86_64:vhost VQ 2 ring restore failed: -1: Operation not permitted
(1)
qemu-system-x86_64:vhost VQ 3 ring restore failed: -1: Operation not permitted
(1)
So move v->suspended to v->shared, and then all the vhost_vdpa devices cannot
have different suspended states.
Fixes: 0bb302a9960a ("vdpa: add vhost_vdpa_suspend")
Suggested-by: Eugenio Pérez <[email protected]>
Acked-by: Eugenio Pérez <[email protected]>
Acked-by: Jason Wang <[email protected]>
Signed-off-by: Wafer Xie <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Acked-by: Jason Wang <[email protected]>
Message-Id: <[email protected]>
Commit: 1ab76ad7608d4b3da66e4886067b116120433716
https://github.com/qemu/qemu/commit/1ab76ad7608d4b3da66e4886067b116120433716
Author: Gavin Shan <[email protected]>
Date: 2026-02-05 (Thu, 05 Feb 2026)
Changed paths:
M hw/acpi/ghes.c
Log Message:
-----------
acpi/ghes: Automate data block cleanup in acpi_ghes_memory_errors()
Use g_auto_ptr() to automate data block cleanup in the function so
that it won't be a burden to us.
Suggested-by: Markus Armbruster <[email protected]>
Signed-off-by: Gavin Shan <[email protected]>
Reviewed-by: Markus Armbruster <[email protected]>
Reviewed-by: Igor Mammedov <[email protected]>
Reviewed-by: Mauro Carvalho Chehab <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-Id: <[email protected]>
Commit: 27814d0e63f911432f493de2d74c4d030010afc0
https://github.com/qemu/qemu/commit/27814d0e63f911432f493de2d74c4d030010afc0
Author: Gavin Shan <[email protected]>
Date: 2026-02-05 (Thu, 05 Feb 2026)
Changed paths:
M hw/acpi/ghes-stub.c
Log Message:
-----------
acpi/ghes: Abort in acpi_ghes_memory_errors() if necessary
The function hw/acpi/ghes-stub.c::acpi_ghes_memory_errors() shouldn't
be called by any one. Take g_assert_not_reached() as a clearer indication.
Suggested-by: Markus Armbruster <[email protected]>
Signed-off-by: Gavin Shan <[email protected]>
Reviewed-by: Igor Mammedov <[email protected]>
Reviewed-by: Mauro Carvalho Chehab <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-Id: <[email protected]>
Commit: 0352e85fe5d9233f1a3099eab207b54078a16cb9
https://github.com/qemu/qemu/commit/0352e85fe5d9233f1a3099eab207b54078a16cb9
Author: Gavin Shan <[email protected]>
Date: 2026-02-05 (Thu, 05 Feb 2026)
Changed paths:
M target/arm/kvm.c
Log Message:
-----------
target/arm/kvm: Exit on error from acpi_ghes_memory_errors()
A core dump is no sense as there isn't programming bugs related to
errors from acpi_ghes_memory_errors().
Exit instead of abort when the function returns errors, and the
excessive error message is also dropped.
Suggested-by: Igor Mammedov <[email protected]>
Suggested-by: Markus Armbruster <[email protected]>
Signed-off-by: Gavin Shan <[email protected]>
Reviewed-by: Igor Mammedov <[email protected]>
Reviewed-by: Mauro Carvalho Chehab <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-Id: <[email protected]>
Commit: b2782920e039a1d6bc0eff03a0cad316ec10a8e5
https://github.com/qemu/qemu/commit/b2782920e039a1d6bc0eff03a0cad316ec10a8e5
Author: Gavin Shan <[email protected]>
Date: 2026-02-05 (Thu, 05 Feb 2026)
Changed paths:
M hw/acpi/ghes.c
Log Message:
-----------
acpi/ghes: Bail early on error from get_ghes_source_offsets()
In ghes_record_cper_errors(), get_ghes_source_offsets() can return
a error initialized by error_setg(). Without bailing on this error,
it can call into the second error_setg() due to the unexpected value
returned from the read acknowledgement register. The second error_setg()
can trigger assert(*errp == NULL) in its callee error_setv(), which
isn't expected.
Bail early in ghes_record_cper_errors() when error is received from
get_ghes_source_offsets() to avoid the unexpected behavior.
Signed-off-by: Gavin Shan <[email protected]>
Reviewed-by: Jonathan Cameron <[email protected]>
Reviewed-by: Markus Armbruster <[email protected]>
Reviewed-by: Igor Mammedov <[email protected]>
Reviewed-by: Mauro Carvalho Chehab <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-Id: <[email protected]>
Commit: 0771574c2f985b917d6d323ac417bb256af76346
https://github.com/qemu/qemu/commit/0771574c2f985b917d6d323ac417bb256af76346
Author: Gavin Shan <[email protected]>
Date: 2026-02-05 (Thu, 05 Feb 2026)
Changed paths:
M hw/acpi/ghes-stub.c
M hw/acpi/ghes.c
M include/hw/acpi/ghes.h
M target/arm/kvm.c
Log Message:
-----------
acpi/ghes: Use error_fatal in acpi_ghes_memory_errors()
Use error_fatal in acpi_ghes_memory_errors() so that the caller needn't
explicitly call exit(). The return value of acpi_ghes_memory_errors()
and ghes_record_cper_errors() is changed to 'bool' indicating an error
has been raised, to be compatible with what's documented in error.h.
Suggested-by: Igor Mammedov <[email protected]>
Suggested-by: Markus Armbruster <[email protected]>
Signed-off-by: Gavin Shan <[email protected]>
Reviewed-by: Jonathan Cameron <[email protected]>
Reviewed-by: Markus Armbruster <[email protected]>
Reviewed-by: Igor Mammedov <[email protected]>
Reviewed-by: Mauro Carvalho Chehab <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-Id: <[email protected]>
Commit: 459cfb80a77f38b521a887338d05e82a9ea2f0fc
https://github.com/qemu/qemu/commit/459cfb80a77f38b521a887338d05e82a9ea2f0fc
Author: Eugenio Pérez <[email protected]>
Date: 2026-02-05 (Thu, 05 Feb 2026)
Changed paths:
M hw/virtio/vhost-shadow-virtqueue.c
Log Message:
-----------
vhost: accept indirect descriptors in shadow virtqueue
The device is not able to generate indirect descriptors by itself, only
the driver can do it. And SVQ is already able to handle them by reusing
VirtQueue struct.
Shadow VirtQueue just transform the indirect descriptors to chained
buffers. This way we don't need to map a new buffer for the indirect
table and handle its exhaustion etc. As they are only used in control
plane and HW devices don't like indirect, we should not see significant
downsides with these.
Signed-off-by: Eugenio Pérez <[email protected]>
--
Tested functionally by forwarding the CVQ descriptors.
Acked-by: Jason Wang <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-Id: <[email protected]>
Commit: fff77cfb8413190c6362b95203ef0973c83b50d2
https://github.com/qemu/qemu/commit/fff77cfb8413190c6362b95203ef0973c83b50d2
Author: Dorinda Bassey <[email protected]>
Date: 2026-02-05 (Thu, 05 Feb 2026)
Changed paths:
M hw/display/virtio-dmabuf.c
Log Message:
-----------
virtio-dmabuf: Ensure UUID persistence for hash table insertion
In `virtio_add_resource` function, the UUID used as a key for
`g_hash_table_insert` was temporary, which could lead to
invalid lookups when accessed later. This patch ensures that
the UUID remains valid by duplicating it into a newly allocated
memory space. The value is then inserted into the hash table
with this persistent UUID key to ensure that the key stored in
the hash table remains valid as long as the hash table entry
exists.
Fixes: faefdba847 ("hw/display: introduce virtio-dmabuf")
Signed-off-by: Dorinda Bassey <[email protected]>
Reviewed-by: Stefano Garzarella <[email protected]>
Reviewed-by: Albert Esteve <[email protected]>
Reviewed-by: Marc-André Lureau <[email protected]>
Reviewed-by: Jim MacArthur <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-Id: <[email protected]>
Commit: 623db856476806124e9ae45fbc39e75012261570
https://github.com/qemu/qemu/commit/623db856476806124e9ae45fbc39e75012261570
Author: Kevin Wolf <[email protected]>
Date: 2026-02-05 (Thu, 05 Feb 2026)
Changed paths:
M hw/virtio/virtio-pci.c
Log Message:
-----------
virtio: Fix crash when sriov-pf is set for non-PCI-Express device
Setting the sriov-pf property on devices that aren't PCI Express causes
an assertion failure:
$ qemu-system-x86_64 \
-blockdev null-co,node-name=null \
-blockdev null-co,node-name=null2 \
-device virtio-blk,drive=null,id=pf \
-device virtio-blk,sriov-pf=pf,drive=null2
qemu-system-x86_64: ../hw/pci/pcie.c:1062: void
pcie_add_capability(PCIDevice *, uint16_t, uint8_t, uint16_t, uint16_t):
Assertion `offset >= PCI_CONFIG_SPACE_SIZE' failed.
This is because proxy->last_pcie_cap_offset is only initialised to a
non-zero value in virtio_pci_realize() if it's a PCI Express device, and
then virtio_pci_device_plugged() still tries to use it.
To fix this, just skip the SR-IOV code for !pci_is_express(). Then the
next thing pci_qdev_realize() does is call pcie_sriov_register_device(),
which returns the appropriate error.
Cc: [email protected]
Fixes: d0c280d3fac6 ('pcie_sriov: Make a PCI device with user-created VF
ARI-capable')
Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Stefan Hajnoczi <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-Id: <[email protected]>
Commit: f73e5ed9bc4cfacf041323a6b40a85e6b6459b75
https://github.com/qemu/qemu/commit/f73e5ed9bc4cfacf041323a6b40a85e6b6459b75
Author: Kevin Wolf <[email protected]>
Date: 2026-02-05 (Thu, 05 Feb 2026)
Changed paths:
M hw/pci/pcie_sriov.c
Log Message:
-----------
pcie_sriov: Fix PCI_SRIOV_* accesses in pcie_sriov_pf_exit()
PCI_SRIOV_* are offsets into the SR-IOV capability, not into the PCI
config space. pcie_sriov_pf_exit() erroneously takes them as the latter,
which makes it read PCI_HEADER_TYPE and PCI_BIST when it tries to read
PCI_SRIOV_TOTAL_VF.
In many cases we're lucky enough that the PCI config space will be 0
there, so we just skip the whole for loop, but this isn't guaranteed.
For example, setting the multifunction bit on the PF and then doing a
'device_del' on it will get a larger number and cause a segfault.
Fix this and access the real PCI_SRIOV_* fields in the capability.
Cc: [email protected]
Fixes: 19e55471d4e8 ('pcie_sriov: Allow user to create SR-IOV device')
Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-Id: <[email protected]>
Commit: 66cf169e29b06dca104c5a229fba0da4ce33599c
https://github.com/qemu/qemu/commit/66cf169e29b06dca104c5a229fba0da4ce33599c
Author: Igor Mammedov <[email protected]>
Date: 2026-02-05 (Thu, 05 Feb 2026)
Changed paths:
M hw/pci-host/q35.c
M tests/qtest/q35-test.c
Log Message:
-----------
q35: Fix migration of SMRAM state
When migrating, dst QEMU by default has SMRAM unlocked,
and since wmask is not migrated, the migrated value of
MCH_HOST_BRIDGE_F_SMBASE in config space fall to prey of
mch_update_smbase_smram()
...
if (pd->wmask[MCH_HOST_BRIDGE_F_SMBASE] == 0xff) {
*reg = 0x00;
and is getting cleared and leads to unlocked smram
on dst even if on source it's been locked.
As Andrey has pointed out [1], we should derive wmask
from config and not other way around.
Drop offending chunk and resync wmask based on MCH_HOST_BRIDGE_F_SMBASE
register value. That would preserve the register during
migration and set smram regions into corresponding state.
What that changes is:
that it would let guest write junk values in register
(with no apparent effect) until it's stumbles upon
reserved 0x1 [|] 0x2 values, at which point it
would be only possible to lock register and trigger
switch to SMRAM blackhole in CPU AS.
While at it, fix up test by removing junk discard before negotiation hunk.
PS2:
Instead of adding a dedicated post_load handler for it,
reuse mch_update->mch_update_smbase_smram call chain
that is called on write/reset/post_load to be consistent
with how we handle mch registers.
PS3:
for prosterity here is erro message Andrey got due to this bug:
qemu: vfio_container_dma_map(0x..., 0x0, 0xa0000, 0x....) = -22 (Invalid
argument)
qemu: hardware error: vfio: DMA mapping failed, unable to continue
1) https://patchew.org/QEMU/[email protected]/
Fixes: f404220e279c ("q35: implement 128K SMRAM at default SMBASE address")
Reported-by: Andrey Ryabinin <[email protected]>
Signed-off-by: Igor Mammedov <[email protected]>
Reviewed-by: Andrey Ryabinin <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-Id: <[email protected]>
Commit: f4cc404c823b17c89c16e232ebebeaa51823be70
https://github.com/qemu/qemu/commit/f4cc404c823b17c89c16e232ebebeaa51823be70
Author: Haixu Cui <[email protected]>
Date: 2026-02-05 (Thu, 05 Feb 2026)
Changed paths:
A include/standard-headers/linux/virtio_spi.h
Log Message:
-----------
standard-headers: Update virtio_spi.h from Linux v6.18-rc3
Synced virtio_spi.h from upstream Linux kernelusing
scripts/update-linux-headers.sh.
Source:
- Linux commit dcb6fa37fd7bc9c3d2b066329b0d27dedf8becaa (v6.18-rc3)
- Author: Linus Torvalds <[email protected]>
- Date: Sun Oct 26 15:59:49 2025 -0700
This update ensures QEMU's standard headers are consistent with the latest
virtio SPI definitions from Linux v6.18-rc3.
Signed-off-by: Haixu Cui <[email protected]>
Reviewed-by: Manos Pitsidianakis <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-Id: <[email protected]>
Commit: 6ab7b84fc248e99fc0d27981596216f202f0a568
https://github.com/qemu/qemu/commit/6ab7b84fc248e99fc0d27981596216f202f0a568
Author: Haixu Cui <[email protected]>
Date: 2026-02-05 (Thu, 05 Feb 2026)
Changed paths:
M MAINTAINERS
M docs/system/devices/virtio/vhost-user.rst
M hw/virtio/Kconfig
M hw/virtio/meson.build
A hw/virtio/vhost-user-spi-pci.c
A hw/virtio/vhost-user-spi.c
M hw/virtio/virtio.c
A include/hw/virtio/vhost-user-spi.h
Log Message:
-----------
virtio-spi: Add vhost-user-spi device support
This patch introduces support for vhost-user-spi and vhost-user-spi-pci
devices in QEMU, enabling virtio-based SPI communication via the vhost-user
protocol.
The implementation follows the virtio-spi specification and leverages
the upstream virtio-spi driver in Linux. Relevant references:
- Virtio SPI specification:
https://github.com/oasis-tcs/virtio-spec/tree/master/device-types/spi
- Linux virtio-spi driver:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/spi/spi-virtio.c?h=v6.18-rc3
- vhost-user-spi daemon:
https://github.com/rust-vmm/vhost-device/tree/main/vhost-device-spi
Example usage with rust-vmm vhost-user-spi daemon:
Start the vhost-user-spi daemon:
vhost-device-spi --socket-path=vspi.sock --socket-count=1 \
--device "/dev/spidev0.0"
Launch QEMU with:
qemu-system-aarch64 -m 1G \
-chardev socket,path=/home/root/vspi.sock0,id=vspi \
-device vhost-user-spi-device,chardev=vspi,id=spi \
-object memory-backend-file,id=mem,size=1G,mem-path=/dev/shm,share=on \
-numa node,memdev=mem
Signed-off-by: Haixu Cui <[email protected]>
Reviewed-by: Manos Pitsidianakis <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-Id: <[email protected]>
Commit: 91c6438caffc880e999a7312825479685d659b44
https://github.com/qemu/qemu/commit/91c6438caffc880e999a7312825479685d659b44
Author: zhenwei pi <[email protected]>
Date: 2026-02-05 (Thu, 05 Feb 2026)
Changed paths:
M hw/virtio/virtio-crypto.c
Log Message:
-----------
hw/virtio/virtio-crypto: verify asym request size
The total lenght of request is limited by cryptodev config, verify it
to avoid unexpected request from guest.
Fixes: CVE-2025-14876
Fixes: 0e660a6f90a ("crypto: Introduce RSA algorithm")
Reported-by: 이재영 <[email protected]>
Signed-off-by: zhenwei pi <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-Id: <[email protected]>
Commit: 7b913094c703641a0442bb1d1165323a019c591c
https://github.com/qemu/qemu/commit/7b913094c703641a0442bb1d1165323a019c591c
Author: zhenwei pi <[email protected]>
Date: 2026-02-05 (Thu, 05 Feb 2026)
Changed paths:
M backends/cryptodev-builtin.c
Log Message:
-----------
cryptodev-builtin: Limit the maximum size
This backend driver is used for demonstration purposes only, unlimited
size leads QEMU OOM.
Fixes: CVE-2025-14876
Fixes: 1653a5f3fc7 ("cryptodev: introduce a new cryptodev backend")
Reported-by: 이재영 <[email protected]>
Signed-off-by: zhenwei pi <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-Id: <[email protected]>
Commit: f0754cd386af3f2f68d35235f50c1426a4d0d3e2
https://github.com/qemu/qemu/commit/f0754cd386af3f2f68d35235f50c1426a4d0d3e2
Author: Jean-Philippe Brucker <[email protected]>
Date: 2026-02-05 (Thu, 05 Feb 2026)
Changed paths:
M MAINTAINERS
Log Message:
-----------
MAINTAINERS: Update VIOT maintainer
Unfortunately I can't contribute to QEMU for the time being, but Eric
has offered to take on maintainership of the ACPI VIOT. Thank you!
Signed-off-by: Jean-Philippe Brucker <[email protected]>
Reviewed-by: Eric Auger <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-Id: <[email protected]>
Commit: e27194e087aede62dbe3d2805c6f1aa30d3465df
https://github.com/qemu/qemu/commit/e27194e087aede62dbe3d2805c6f1aa30d3465df
Author: Joelle van Dyne <[email protected]>
Date: 2026-02-05 (Thu, 05 Feb 2026)
Changed paths:
M hw/display/virtio-gpu-virgl.c
Log Message:
-----------
virtio-gpu-virgl: correct parent for blob memory region
When `owner` == `mr`, `object_unparent` will crash:
object_unparent(mr) ->
object_property_del_child(mr, mr) ->
object_finalize_child_property(mr, name, mr) ->
object_unref(mr) ->
object_finalize(mr) ->
object_property_del_all(mr) ->
object_finalize_child_property(mr, name, mr) ->
object_unref(mr) ->
fail on g_assert(obj->ref > 0)
However, passing a different `owner` to `memory_region_init` does not
work. `memory_region_ref` has an optimization where it takes a ref
only on the owner. That means when flatviews are created, it does not
take a ref on the region and you can get a UAF from `flatview_destroy`
called from RCU.
The correct fix therefore is to use `NULL` as the name which will set
the `owner` but not the `parent` (which is still NULL). This allows us
to use `memory_region_ref` on itself while not having to rely on unparent
for cleanup.
Signed-off-by: Joelle van Dyne <[email protected]>
Reviewed-by: Akihiko Odaki <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-Id: <[email protected]>
Commit: efd581a8cd4405ca183ecd017072b0c878802d69
https://github.com/qemu/qemu/commit/efd581a8cd4405ca183ecd017072b0c878802d69
Author: Li Chen <[email protected]>
Date: 2026-02-05 (Thu, 05 Feb 2026)
Changed paths:
M hw/virtio/virtio-pmem.c
Log Message:
-----------
virtio-pmem: ignore empty queue notifications
virtio_pmem_flush() treats a NULL return from virtqueue_pop() as a fatal
error and calls virtio_error(), which puts the device into NEEDS_RESET.
However, virtqueue handlers can be invoked when no element is available,
so an empty queue should be handled as a benign no-op.
With a Linux guest this avoids spurious NEEDS_RESET and the resulting
-EIO propagation (e.g. EXT4 journal abort and remount-ro).
Signed-off-by: Li Chen <[email protected]>
Acked-by: Michael S. Tsirkin <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-Id: <[email protected]>
Commit: 3560b51979577afc3ab937fd8b02597515bdfbae
https://github.com/qemu/qemu/commit/3560b51979577afc3ab937fd8b02597515bdfbae
Author: Honglei Huang <[email protected]>
Date: 2026-02-05 (Thu, 05 Feb 2026)
Changed paths:
M hw/display/virtio-gpu-virgl.c
Log Message:
-----------
virtio-gpu: fix error handling in virgl_cmd_resource_create_blob
Fix inverted error check in virgl_cmd_resource_create_blob() that causes
the function to return error when virtio_gpu_create_mapping_iov() succeeds.
virtio_gpu_create_mapping_iov() returns 0 on success and negative values
on error. The check 'if (!ret)' incorrectly treats success (ret=0) as an
error condition, causing the function to fail when it should succeed.
Change the condition to 'if (ret != 0)' to properly detect errors.
Fixes: 7c092f17ccee ("virtio-gpu: Handle resource blob commands")
Signed-off-by: Honglei Huang <[email protected]>
Reviewed-by: Akihiko Odaki <[email protected]>
Reviewed-by: Dmitry Osipenko <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-Id: <[email protected]>
Commit: 12a2d5ca4561e63731274382ec90e3d12f726394
https://github.com/qemu/qemu/commit/12a2d5ca4561e63731274382ec90e3d12f726394
Author: Honglei Huang <[email protected]>
Date: 2026-02-05 (Thu, 05 Feb 2026)
Changed paths:
M hw/display/virtio-gpu-virgl.c
M hw/display/virtio-gpu.c
Log Message:
-----------
virtio-gpu: use consistent error checking for virtio_gpu_create_mapping_iov
Unify error checking style for virtio_gpu_create_mapping_iov() across the
codebase to improve consistency and readability.
virtio_gpu_create_mapping_iov() returns 0 on success and negative values
on error. The original code used inconsistent patterns for checking errors:
- Some used 'if (ret != 0)' in virtio-gpu-virgl.c and virtio-gpu.c
- Some used 'CHECK(!ret, cmd)' in virtio-gpu-rutabaga.c
For if-statement checks, change to 'if (ret < 0)' which is the preferred
QEMU coding convention for functions that return 0 on success and negative
on error. This makes the return value convention immediately clear to code
readers.
For CHECK macro usage in virtio-gpu-rutabaga.c, keep the original
'CHECK(!ret, cmd)' pattern as it is more concise and consistent with other
error checks in the same file.
Updated locations:
- hw/display/virtio-gpu-virgl.c: virgl_resource_attach_backing()
- hw/display/virtio-gpu-virgl.c: virgl_cmd_resource_create_blob()
- hw/display/virtio-gpu.c: virtio_gpu_resource_create_blob()
- hw/display/virtio-gpu.c: virtio_gpu_resource_attach_backing()
Signed-off-by: Honglei Huang <[email protected]>
Reviewed-by: Markus Armbruster <[email protected]>
Reviewed-by: Akihiko Odaki <[email protected]>
Reviewed-by: Dmitry Osipenko <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-Id: <[email protected]>
Commit: e7985b6a5652979460d28008f3ab8cd4166b6e55
https://github.com/qemu/qemu/commit/e7985b6a5652979460d28008f3ab8cd4166b6e55
Author: Alexandr Moshkov <[email protected]>
Date: 2026-02-05 (Thu, 05 Feb 2026)
Changed paths:
M docs/interop/vhost-user.rst
Log Message:
-----------
vhost-user.rst: specify vhost-user back-end action on GET_VRING_BASE
By default, we assume that server need to wait all inflight IO on
GET_VRING_BASE. However, this fact is not recorded anywhere in the
documentation.
So, add this info in rst.
Signed-off-by: Alexandr Moshkov <[email protected]>
Reviewed-by: Stefan Hajnoczi <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-Id: <[email protected]>
Commit: e0822e6085aecc15e2cfb2914d8cd827abae0249
https://github.com/qemu/qemu/commit/e0822e6085aecc15e2cfb2914d8cd827abae0249
Author: Alexandr Moshkov <[email protected]>
Date: 2026-02-05 (Thu, 05 Feb 2026)
Changed paths:
M docs/interop/vhost-user.rst
M hw/virtio/vhost-user.c
M include/hw/virtio/vhost-user.h
Log Message:
-----------
vhost-user: introduce protocol feature for skip drain on GET_VRING_BASE
Add vhost-user protocol feature
VHOST_USER_PROTOCOL_F_GET_VRING_BASE_INFLIGHT
Now on GET_VRING_BASE this feature can control whether to wait for
in-flight requests to complete or not.
Also we have to validate that this feature will be enabled only when
qemu and back-end supports in-flight buffer and in-flight migration
It will be helpfull in future for in-flight requests migration in
vhost-user devices.
Update docs, add ref to label for inflight-io-tracking
Signed-off-by: Alexandr Moshkov <[email protected]>
Reviewed-by: Stefan Hajnoczi <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-Id: <[email protected]>
Commit: f6fdd8b2bdb2705adf05b21006cc29d6c123fea3
https://github.com/qemu/qemu/commit/f6fdd8b2bdb2705adf05b21006cc29d6c123fea3
Author: Alexandr Moshkov <[email protected]>
Date: 2026-02-05 (Thu, 05 Feb 2026)
Changed paths:
M include/migration/vmstate.h
Log Message:
-----------
vmstate: introduce VMSTATE_VBUFFER_UINT64
This is an analog of VMSTATE_VBUFFER_UINT32 macro, but for uint64 type.
Signed-off-by: Alexandr Moshkov <[email protected]>
Acked-by: Peter Xu <[email protected]>
Reviewed-by: Stefan Hajnoczi <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-Id: <[email protected]>
Commit: 3a80ff0721b641f9c70af0d416c5c9e171c29aa3
https://github.com/qemu/qemu/commit/3a80ff0721b641f9c70af0d416c5c9e171c29aa3
Author: Alexandr Moshkov <[email protected]>
Date: 2026-02-05 (Thu, 05 Feb 2026)
Changed paths:
M hw/virtio/vhost.c
Log Message:
-----------
vhost: add vmstate for inflight region with inner buffer
Prepare for future inflight region migration for vhost-user-blk.
We need to migrate size, queue_size, and inner buffer.
So firstly it migrate size and queue_size fields, then allocate memory
for buffer with
migrated size, then migrate inner buffer itself.
Signed-off-by: Alexandr Moshkov <[email protected]>
Reviewed-by: Stefan Hajnoczi <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-Id: <[email protected]>
Commit: 3dfd711ea9eeda8a0b44f73a65e19f3c1f7d428d
https://github.com/qemu/qemu/commit/3dfd711ea9eeda8a0b44f73a65e19f3c1f7d428d
Author: Alexandr Moshkov <[email protected]>
Date: 2026-02-05 (Thu, 05 Feb 2026)
Changed paths:
M hw/block/vhost-user-blk.c
M include/hw/virtio/vhost-user-blk.h
M include/hw/virtio/vhost.h
Log Message:
-----------
vhost-user-blk: support inter-host inflight migration
During inter-host migration, waiting for disk requests to be drained
in the vhost-user backend can incur significant downtime.
This can be avoided if QEMU migrates the inflight region in
vhost-user-blk.
Thus, during the qemu migration, with feature flag the vhost-user
back-end can immediately stop vrings, so all in-flight requests will be
migrated to another host.
Signed-off-by: Alexandr Moshkov <[email protected]>
Reviewed-by: Stefan Hajnoczi <[email protected]>
Reviewed-by: Raphael Norwitz <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-Id: <[email protected]>
Commit: 87f8e5a71d061964c9bfa4d6e02db47f54dd61f7
https://github.com/qemu/qemu/commit/87f8e5a71d061964c9bfa4d6e02db47f54dd61f7
Author: Jonathan Cameron <[email protected]>
Date: 2026-02-05 (Thu, 05 Feb 2026)
Changed paths:
M hw/cxl/cxl-mailbox-utils.c
Log Message:
-----------
hw/cxl: Check for overflow on santize media as both base and offset 64bit.
The both the size and base of a media sanitize operation are both provided
by the VM, an overflow is possible which may result in checks on valid
range passing when they should not. Close that by checking for overflow
on the addition.
Fixes: 40ab4ed10775 ("hw/cxl/cxl-mailbox-utils: Media operations Sanitize and
Write Zeros commands CXL r3.2(8.2.10.9.5.3)")
Closes:
https://lore.kernel.org/qemu-devel/cafeaca8rqop+ju0fuxn+0t57nbg+bep80z45f6py0ci2fz_...@mail.gmail.com/
Reported-by: Peter Maydell <[email protected]>
Signed-off-by: Jonathan Cameron <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-Id: <[email protected]>
Commit: 25465c0e1fd74d2118dfec03912f2595eeb497d7
https://github.com/qemu/qemu/commit/25465c0e1fd74d2118dfec03912f2595eeb497d7
Author: Jonathan Cameron <[email protected]>
Date: 2026-02-05 (Thu, 05 Feb 2026)
Changed paths:
M hw/cxl/cxl-mailbox-utils.c
Log Message:
-----------
hw/cxl: Take into account how many media operations are requested for param
check
Whilst the spec doesn't speak to it directly my assumption is that
a request for more operations than exist should result in an invalid
input error return.
Fixes: 77a8e9fe0ecb ("hw/cxl/cxl-mailbox-utils: Add support for Media
operations discovery commands cxl r3.2 (8.2.10.9.5.3)")
Closes:
https://lore.kernel.org/qemu-devel/cafeaca-p5wzknxk7wnvq_3pazee-muod1def-0o-fspck4d...@mail.gmail.com/
Reported-by: Peter Maydell <[email protected]>
Signed-off-by: Jonathan Cameron <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-Id: <[email protected]>
Commit: cd5a79dc98e3087e7658e643bdbbb0baec77ac8a
https://github.com/qemu/qemu/commit/cd5a79dc98e3087e7658e643bdbbb0baec77ac8a
Author: Peter Maydell <[email protected]>
Date: 2026-02-05 (Thu, 05 Feb 2026)
Changed paths:
M MAINTAINERS
M backends/cryptodev-builtin.c
M docs/interop/vhost-user.rst
M docs/system/devices/virtio/vhost-user.rst
M hw/acpi/ghes-stub.c
M hw/acpi/ghes.c
M hw/block/vhost-user-blk.c
M hw/cxl/cxl-mailbox-utils.c
M hw/display/virtio-dmabuf.c
M hw/display/virtio-gpu-virgl.c
M hw/display/virtio-gpu.c
M hw/i386/intel_iommu.c
M hw/i386/intel_iommu_internal.h
M hw/pci-host/articia.c
M hw/pci-host/aspeed_pcie.c
M hw/pci-host/designware.c
M hw/pci-host/gpex.c
M hw/pci-host/grackle.c
M hw/pci-host/gt64120.c
M hw/pci-host/mv64361.c
M hw/pci-host/pnv_phb.c
M hw/pci-host/ppce500.c
M hw/pci-host/q35.c
M hw/pci-host/raven.c
M hw/pci-host/remote.c
M hw/pci-host/sabre.c
M hw/pci-host/uninorth.c
M hw/pci-host/xilinx-pcie.c
M hw/pci/pci.c
M hw/pci/pci_host.c
M hw/pci/pcie.c
M hw/pci/pcie_sriov.c
M hw/pci/shpc.c
M hw/virtio/Kconfig
M hw/virtio/meson.build
M hw/virtio/vhost-shadow-virtqueue.c
A hw/virtio/vhost-user-spi-pci.c
A hw/virtio/vhost-user-spi.c
M hw/virtio/vhost-user.c
M hw/virtio/vhost-vdpa.c
M hw/virtio/vhost.c
M hw/virtio/virtio-crypto.c
M hw/virtio/virtio-pci.c
M hw/virtio/virtio-pmem.c
M hw/virtio/virtio.c
M include/hw/acpi/ghes.h
M include/hw/i386/intel_iommu.h
M include/hw/pci/pcie.h
M include/hw/virtio/vhost-user-blk.h
A include/hw/virtio/vhost-user-spi.h
M include/hw/virtio/vhost-user.h
M include/hw/virtio/vhost-vdpa.h
M include/hw/virtio/vhost.h
M include/migration/vmstate.h
A include/standard-headers/linux/virtio_spi.h
M target/arm/kvm.c
M tests/qtest/q35-test.c
Log Message:
-----------
Merge tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu
into staging
virtio,pci,pc: features, fixes
intel_iommu:
SVM support
vhost:
support for indirect descriptors in shadow virtqueue
vhost-user:
vhost-user-spi support
vhost-user-blk inflight migration support
vhost-user-blk inflight migration support
misc fixes in pci, vhost, virtio, acpi, cxl
cleanups in acpi/ghes
Signed-off-by: Michael S. Tsirkin <[email protected]>
# -----BEGIN PGP SIGNATURE-----
#
# iQFDBAABCgAtFiEEXQn9CHHI+FuUyooNKB8NuNKNVGkFAmmEa9APHG1zdEByZWRo
# YXQuY29tAAoJECgfDbjSjVRpqj8H/iBqAHZSTmAdBJgoLnmgoTLB01J9aUTrQU2H
# BHKyrd+G3m54pwjgUNN5ieZARtlXscigf6fr0Gq2wrc8/kV/O5G5jViw9+1Bo8nW
# OkLDW45nDzZGhap4oUedV+PJ3fCuW2fC8Jyb1n8OGlkadbhq0NU6GtqiEx6/7QIh
# hk5WUDE/3LH4cTp8qNtr0/nYfM4FZk2sjq7aRyg4cz/uC7rIAFRq7BCZ/dfRqMh/
# T+rLnizSSAg9PFMd8slWqoxOGF9NzT9LIoDSkAlso1L9lUekUSNoUblhlWDrRlLn
# DEEqqGCVounfBzA95WrTRmvWs6JodppjjAjI0M4isrMKGXXg8dg=
# =HdgY
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu Feb 5 10:07:12 2026 GMT
# gpg: using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469
# gpg: issuer "[email protected]"
# gpg: Good signature from "Michael S. Tsirkin <[email protected]>" [full]
# gpg: aka "Michael S. Tsirkin <[email protected]>" [full]
# Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67
# Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469
* tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu: (38
commits)
hw/cxl: Take into account how many media operations are requested for param
check
hw/cxl: Check for overflow on santize media as both base and offset 64bit.
vhost-user-blk: support inter-host inflight migration
vhost: add vmstate for inflight region with inner buffer
vmstate: introduce VMSTATE_VBUFFER_UINT64
vhost-user: introduce protocol feature for skip drain on GET_VRING_BASE
vhost-user.rst: specify vhost-user back-end action on GET_VRING_BASE
virtio-gpu: use consistent error checking for virtio_gpu_create_mapping_iov
virtio-gpu: fix error handling in virgl_cmd_resource_create_blob
virtio-pmem: ignore empty queue notifications
virtio-gpu-virgl: correct parent for blob memory region
MAINTAINERS: Update VIOT maintainer
cryptodev-builtin: Limit the maximum size
hw/virtio/virtio-crypto: verify asym request size
virtio-spi: Add vhost-user-spi device support
standard-headers: Update virtio_spi.h from Linux v6.18-rc3
q35: Fix migration of SMRAM state
pcie_sriov: Fix PCI_SRIOV_* accesses in pcie_sriov_pf_exit()
virtio: Fix crash when sriov-pf is set for non-PCI-Express device
virtio-dmabuf: Ensure UUID persistence for hash table insertion
...
Signed-off-by: Peter Maydell <[email protected]>
Compare: https://github.com/qemu/qemu/compare/739ae3df7b56...cd5a79dc98e3
To unsubscribe from these emails, change your notification settings at
https://github.com/qemu/qemu/settings/notifications
