[PULL v2 00/36] Misc HW patches for 2026-07-07

[PULL v2 00/36] Misc HW patches for 2026-07-07

[Philippe Mathieu-Daudé]

The following changes since commit 94826ec1370328375c3b6d1e80fdc94c8f46c348:

  Merge tag 'accel-20260706' of https://github.com/philmd/qemu into staging (2026-07-06 18:38:14 +0200)

are available in the Git repository at:

  https://github.com/philmd/qemu.git tags/hw-misc-20260707

for you to fetch changes up to 01e53bea65945c483dbcfa02793f68463886fbe3:

  MAINTAINERS: update Chao Liu's email address (2026-07-07 17:11:52 +0200)

----------------------------------------------------------------
Misc HW patches

- MAINTAINERS update
- Fix in few trace event formats
- A pair of improvements in util/
- FlexCAN3 to imx8mp-evk board
- Various fixes in hw/
  (EDU, ATI VGA, IDE AHCI, PCA9552, i8257 DMA,
   e1000e/igb, MPT SAS, Hyper-V, QXL, M25P80)

v2:
- Missing IDE AHCI Qtest
- MSF2 M25P80 fix from Cédric
- Update Chao Liu email
----------------------------------------------------------------

BALATON Zoltan (1):
  hw/display/ati: Include vga state in the blit context

Bernhard Beschow (5):
  hw/net/can/flexcan: Wire clock control module via link property
  hw/net/can/flexcan: Subclass TYPE_CAN_FLEXCAN
  hw/arm/imx8mp-evk: Open code DEFINE_MACHINE_AARCH64
  hw/arm/imx8mp-evk: Introduce FslImx8mpEvkState
  hw/arm: Add basic FlexCAN3 support to TYPE_FSL_IMX8MP and imx8mp-evk

Bin Meng (9):
  hw/block: m25p80: Fix dummy byte handling for Winbond flash
  hw/block: m25p80: Fix dummy byte handling for Numonyx/Micron flash
  hw/block: m25p80: Fix dummy byte handling for Macronix flash
  hw/block: m25p80: Fix dummy byte handling for Spansion flash
  hw/ssi: npcm7xx_fiu: Correct the dummy cycle emulation logic
  hw/ssi: xilinx_spips: Fix dummy phase handling
  hw/ssi: aspeed_smc: Fix direct-read dummy bytes
  Revert "aspeed/smc: Fix number of dummy cycles for FAST_READ_4
    command"
  Revert "aspeed/smc: snoop SPI transfers to fake dummy cycles"

Chao Liu (1):
  MAINTAINERS: update Chao Liu's email address

Cédric Le Goater (1):
  hw/arm/msf2-som: Fix spansion-cr2nv value for S25FL128S

Denis V. Lunev (2):
  hw/ide/ahci: cancel in-flight buffered reads on command engine restart
  tests/qtest/ahci: test ATAPI read completing after engine restart

Dmitry Frolov (1):
  utils/module: fix memleak in module_load()

Evgeny Kolmakov (1):
  util/filemonitor-inotify: Use QEMU_LOCK_GUARD()

Junjie Cao (2):
  hw/display/ati: reset host_data.next in write handler after flush
  hw/display/ati: guard against zero bpp in ati_host_data_flush

Mark Cave-Ayland (2):
  hw/rtc/mc146818rtc: convert date from object prop to class prop
  hw/acpi/ich9: move initial property values into
    ich9_reset_properties()

Peter Maydell (3):
  hw/dma/i8257: Return zeroes for read_memory in verify mode
  hw/scsi/mptsas: Reset doorbell state on reset
  hw/hyperv: Avoid crash if hyperv_find_cpu() passed invalid vp_index

Sanjeeva Yerrapureddy (1):
  hw/net: fix e1000e/igb ip_len inflation by Ethernet minimum-frame
    padding

Shameer Kolothum (1):
  backends/iommufd: Fix dev_id and type order in viommu trace

Song Gao (1):
  hw/intc/loongarch_dintc: Fix OOB access in DINT MMIO write handler

Thomas Huth (1):
  hw/display/qxl: Fix mono cursor validation that can read past a cursor
    chunk

Torin Carey (1):
  hw/misc/edu: restrict dma access to dma buffer

yujun (3):
  hw/gpio/pca9552: fix off-by-one in QOM led index validation
  ebpf: fix swapped toeplitz/indirection args in set_data trace
  crypto/x509-utils: fix gnutls error code in crt_init failure path

 MAINTAINERS                   |   6 +-
 docs/system/arm/imx8m.rst     |   1 +
 include/hw/acpi/ich9.h        |   2 +
 include/hw/arm/fsl-imx8mp.h   |   8 ++
 include/hw/net/flexcan.h      |   4 +-
 include/hw/ssi/aspeed_smc.h   |   2 -
 include/hw/ssi/xilinx_spips.h |   2 +-
 crypto/x509-utils.c           |   3 +-
 ebpf/ebpf_rss.c               |   2 +-
 hw/acpi/ich9.c                |   8 +-
 hw/arm/fsl-imx6.c             |   5 +-
 hw/arm/fsl-imx8mp.c           |  38 +++++++++
 hw/arm/imx8mp-evk.c           |  64 +++++++++++---
 hw/arm/msf2-som.c             |   2 +-
 hw/block/m25p80.c             | 154 ++++++++++++++++++++++------------
 hw/display/ati.c              |   2 +
 hw/display/ati_2d.c           |  44 +++++-----
 hw/display/qxl-render.c       |   8 +-
 hw/dma/i8257.c                |  13 +++
 hw/gpio/pca9552.c             |   8 +-
 hw/hyperv/hyperv.c            |   4 +-
 hw/ide/ahci.c                 |   3 +
 hw/intc/loongarch_dintc.c     |  13 +++
 hw/isa/lpc_ich9.c             |   1 +
 hw/misc/edu.c                 |  24 +++---
 hw/misc/imx8mp_ccm.c          |   3 +
 hw/net/can/flexcan.c          |  90 ++++++++++++++++----
 hw/net/net_tx_pkt.c           |   7 +-
 hw/rtc/mc146818rtc.c          |   4 +-
 hw/scsi/mptsas.c              |   4 +
 hw/ssi/aspeed_smc.c           | 135 ++++-------------------------
 hw/ssi/npcm7xx_fiu.c          |  25 ++----
 hw/ssi/xilinx_spips.c         | 123 +++++++++++++++++++--------
 tests/qtest/ahci-test.c       |  67 +++++++++++++++
 util/filemonitor-inotify.c    |  28 ++-----
 util/module.c                 |   2 +-
 backends/trace-events         |   2 +-
 hw/arm/Kconfig                |   1 +
 hw/ssi/trace-events           |   1 -
 39 files changed, 579 insertions(+), 334 deletions(-)

-- 
2.53.0

[PULL v2 05/36] tests/qtest/ahci: test ATAPI read completing after engine restart

[Philippe Mathieu-Daudé]

From: "Denis V. Lunev" <den@openvz.org>

Add a regression test for the crash that occurs when a buffered ATAPI
read completes after the command engine has been restarted. Issue an
ATAPI READ_10 against a blkdebug-backed CD, suspend the backend read so
it stays in flight, stop and restart the port's command engine (which
re-maps the command list and clears cur_cmd), then release the read.

The PIO and DMA reply paths fault in different AHCI helpers
(ahci_pio_transfer() vs ahci_dma_rw_buf()), so cover both. The DMA
variant is the reliable guard: on engine restart check_cmd() can re-arm
cur_cmd before the old read completes, so the PIO variant does not fault
in every build.

The test only asserts that qemu survives a subsequent register access;
if the blkdebug breakpoint ever failed to park the read it would pass
without exercising the bug, as with the existing break/resume tests.

Signed-off-by: Denis V. Lunev <den@openvz.org>
Message-ID: <20260619112158.304782-3-den@openvz.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
---
 tests/qtest/ahci-test.c | 67 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 67 insertions(+)

diff --git a/tests/qtest/ahci-test.c b/tests/qtest/ahci-test.c
index 5c32ff20029..44799eea153 100644
--- a/tests/qtest/ahci-test.c
+++ b/tests/qtest/ahci-test.c
@@ -1625,6 +1625,69 @@ static void test_cdrom_pio_multi(void)
     ahci_test_cdrom_read10(3, false);
 }
 
+/*
+ * Regression test: a buffered ATAPI read completing after a command
+ * engine restart must not dereference the cleared cur_cmd. Cover both
+ * PIO and DMA; the DMA variant is the reliable guard.
+ */
+static void test_atapi_engine_restart_in_flight(bool dma)
+{
+    AHCIQState *ahci;
+    AHCICommand *cmd;
+    unsigned char *tx;
+    char *iso;
+    int fd;
+    uint8_t port;
+    uint64_t buffer;
+    uint64_t iso_size = (uint64_t)ATAPI_SECTOR_SIZE * 2;
+
+    fd = prepare_iso(iso_size, &tx, &iso);
+
+    ahci = ahci_boot_and_enable("-drive if=none,id=drive0,"
+                                "file=blkdebug::%s,format=raw,readonly=on "
+                                "-M q35 "
+                                "-device ide-cd,drive=drive0 ", iso);
+    port = ahci_port_select(ahci);
+
+    buffer = ahci_alloc(ahci, ATAPI_SECTOR_SIZE);
+    qtest_memset(ahci->parent->qts, buffer, 0x00, ATAPI_SECTOR_SIZE);
+
+    /* Suspend the next backend read so the ATAPI read stays in flight. */
+    g_free(qtest_hmp(ahci->parent->qts,
+                     "qemu-io drive0 \"break read_aio rd\""));
+
+    cmd = ahci_atapi_command_create(CMD_ATAPI_READ_10, ATAPI_SECTOR_SIZE,
+                                    dma);
+    ahci_command_adjust(cmd, 0, buffer, ATAPI_SECTOR_SIZE, 0);
+    ahci_command_commit(ahci, cmd, port);
+    ahci_command_issue_async(ahci, cmd);
+
+    /* Stop and restart the command engine to re-map the command list. */
+    ahci_px_clr(ahci, port, AHCI_PX_CMD, AHCI_PX_CMD_ST);
+    ahci_px_set(ahci, port, AHCI_PX_CMD, AHCI_PX_CMD_ST);
+
+    g_free(qtest_hmp(ahci->parent->qts, "qemu-io drive0 \"resume rd\""));
+
+    /* Round-trip through the device to confirm qemu is still alive. */
+    ahci_px_rreg(ahci, port, AHCI_PX_TFD);
+
+    ahci_command_free(cmd);
+    ahci_free(ahci, buffer);
+    g_free(tx);
+    ahci_shutdown(ahci);
+    remove_iso(fd, iso);
+}
+
+static void test_atapi_engine_restart_pio(void)
+{
+    test_atapi_engine_restart_in_flight(false);
+}
+
+static void test_atapi_engine_restart_dma(void)
+{
+    test_atapi_engine_restart_in_flight(true);
+}
+
 /* Regression test: Test that a READ_CD command with a BCL of 0 but a size of 0
  * completes as a NOP instead of erroring out. */
 static void test_atapi_bcl(void)
@@ -2042,6 +2105,10 @@ int main(int argc, char **argv)
 
     qtest_add_func("/ahci/cdrom/pio/bcl", test_atapi_bcl);
     qtest_add_func("/ahci/cdrom/eject", test_atapi_tray);
+    qtest_add_func("/ahci/cdrom/engine_restart/pio",
+                   test_atapi_engine_restart_pio);
+    qtest_add_func("/ahci/cdrom/engine_restart/dma",
+                   test_atapi_engine_restart_dma);
 
     ret = g_test_run();
 
-- 
2.53.0

[PULL v2 29/36] hw/arm/msf2-som: Fix spansion-cr2nv value for S25FL128S

[Philippe Mathieu-Daudé]

From: Cédric Le Goater <clg@redhat.com>

The emcraft-sf2 board set spansion-cr2nv to 1, which the old m25p80
code treated as a byte count. With the dummy cycle to byte conversion
fix, CR2V=1 at SPI x1 is 1 bit, not byte-aligned, and triggers an
assertion. Use the S25FL128S default of 0x8 (8 cycles = 1 byte at
SPI x1), preserving the same runtime behavior.

Signed-off-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Bin Meng <bin.meng@processmission.com>
Tested-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-Id: <20d58663-a8d1-41ff-9348-cae4982c30f0@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
---
 hw/arm/msf2-som.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/msf2-som.c b/hw/arm/msf2-som.c
index caf6e7e1ad7..1ada1a13613 100644
--- a/hw/arm/msf2-som.c
+++ b/hw/arm/msf2-som.c
@@ -84,7 +84,7 @@ static void emcraft_sf2_s2s010_init(MachineState *machine)
     /* Attach SPI flash to SPI0 controller */
     spi_bus = qdev_get_child_bus(dev, "spi0");
     spi_flash = qdev_new("s25sl12801"); /* Spansion S25FL128SDPBHICO */
-    qdev_prop_set_uint8(spi_flash, "spansion-cr2nv", 1);
+    qdev_prop_set_uint8(spi_flash, "spansion-cr2nv", 0x8);
     if (dinfo) {
         qdev_prop_set_drive_err(spi_flash, "drive",
                                 blk_by_legacy_dinfo(dinfo), &error_fatal);
-- 
2.53.0

[PULL v2 30/36] hw/block: m25p80: Fix dummy byte handling for Spansion flash

[Philippe Mathieu-Daudé]

From: Bin Meng <bin.meng@processmission.com>

Spansion flashes expose the number of dummy clock cycles through CR2V
register [1]. The value is a cycle count, not a byte count, so the
m25p80 model has to convert it to the number of whole SSI transfer
bytes consumed while collecting read command data.

Add a helper that multiplies the CR2V dummy cycle count by the phase
width and rounds up non-byte-aligned counts, matching the byte-oriented
SSI model. The default eight-cycle configuration keeps the same byte
counts as before.

[1] https://www.infineon.com/assets/row/public/documents/10/49/infineon-s25fs128s-s25fs256s-1-datasheet-en.pdf

Fixes: cf6f1efe0b57 ("m25p80: Fast read commands family changes")
Signed-off-by: Bin Meng <bin.meng@processmission.com>
Tested-by: Cédric Le Goater <clg@redhat.com>
Message-ID: <20260707083431.219671-5-bin.meng@processmission.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
---
 hw/block/m25p80.c | 32 ++++++++++++++++++++------------
 1 file changed, 20 insertions(+), 12 deletions(-)

diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
index d7a9d793737..545e0b57285 100644
--- a/hw/block/m25p80.c
+++ b/hw/block/m25p80.c
@@ -1057,6 +1057,23 @@ static uint8_t macronix_extract_cfg_dummy_bytes(Flash *s, uint8_t bus_width)
     return dummy_bits / 8;
 }
 
+static uint8_t spansion_extract_cfg_dummy_bytes(Flash *s, uint8_t bus_width)
+{
+    uint8_t dummy_bits;
+
+    dummy_bits = extract32(s->spansion_cr2v, SPANSION_DUMMY_CLK_POS,
+                            SPANSION_DUMMY_CLK_LEN);
+    dummy_bits *= bus_width;
+
+    /*
+     * Assert that the dummy bit count is byte-aligned
+     * as SSI core can only consume whole dummy bytes.
+     */
+    assert(dummy_bits % 8 == 0);
+
+    return dummy_bits / 8;
+}
+
 static void decode_fast_read_cmd(Flash *s)
 {
     s->needed_bytes = get_addr_length(s);
@@ -1075,10 +1092,7 @@ static void decode_fast_read_cmd(Flash *s)
         s->needed_bytes += macronix_extract_cfg_dummy_bytes(s, 1);
         break;
     case MAN_SPANSION:
-        s->needed_bytes += extract32(s->spansion_cr2v,
-                                    SPANSION_DUMMY_CLK_POS,
-                                    SPANSION_DUMMY_CLK_LEN
-                                    );
+        s->needed_bytes += spansion_extract_cfg_dummy_bytes(s, 1);
         break;
     case MAN_ISSI:
         /*
@@ -1111,10 +1125,7 @@ static void decode_dio_read_cmd(Flash *s)
         break;
     case MAN_SPANSION:
         s->needed_bytes += SPANSION_CONTINUOUS_READ_MODE_CMD_LEN;
-        s->needed_bytes += extract32(s->spansion_cr2v,
-                                    SPANSION_DUMMY_CLK_POS,
-                                    SPANSION_DUMMY_CLK_LEN
-                                    );
+        s->needed_bytes += spansion_extract_cfg_dummy_bytes(s, 2);
         break;
     case MAN_NUMONYX:
         s->needed_bytes += numonyx_extract_cfg_dummy_bytes(s);
@@ -1151,10 +1162,7 @@ static void decode_qio_read_cmd(Flash *s)
         break;
     case MAN_SPANSION:
         s->needed_bytes += SPANSION_CONTINUOUS_READ_MODE_CMD_LEN;
-        s->needed_bytes += extract32(s->spansion_cr2v,
-                                    SPANSION_DUMMY_CLK_POS,
-                                    SPANSION_DUMMY_CLK_LEN
-                                    );
+        s->needed_bytes += spansion_extract_cfg_dummy_bytes(s, 4);
         break;
     case MAN_NUMONYX:
         s->needed_bytes += numonyx_extract_cfg_dummy_bytes(s);
-- 
2.53.0

[PULL v2 36/36] MAINTAINERS: update Chao Liu's email address

[Philippe Mathieu-Daudé]

From: Chao Liu <chao.liu@processmission.com>

I joined Process Mission over a month ago and have verified that sending
patches from my new email address works as expected.

Update my MAINTAINERS entries to use the new address for future upstream
contributions.

Signed-off-by: Chao Liu <chao.liu@processmission.com>
Reviewed-by: Bin Meng <bin.meng@processmission.com>
Message-ID: <20260707132701.71164-1-chao.liu@processmission.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
---
 MAINTAINERS | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index 1e239f21166..5029be1586b 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -353,7 +353,7 @@ M: Alistair Francis <alistair.francis@wdc.com>
 R: Weiwei Li <liwei1518@gmail.com>
 R: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
 R: Liu Zhiwei <zhiwei_liu@linux.alibaba.com>
-R: Chao Liu <chao.liu.zevorn@gmail.com>
+R: Chao Liu <chao.liu@processmission.com>
 L: qemu-riscv@nongnu.org
 S: Supported
 F: configs/targets/riscv*
@@ -1817,7 +1817,7 @@ F: hw/riscv/xiangshan_kmh.c
 F: include/hw/riscv/xiangshan_kmh.h
 
 K230 Machines
-M: Chao Liu <chao.liu.zevorn@gmail.com>
+M: Chao Liu <chao.liu@processmission.com>
 L: qemu-riscv@nongnu.org
 S: Maintained
 F: docs/system/riscv/k230.rst
@@ -3806,7 +3806,7 @@ F: hw/pci/pcie_doe.c
 F: docs/specs/spdm.rst
 
 Checkpatch
-R: Chao Liu <chao.liu.zevorn@gmail.com>
+R: Chao Liu <chao.liu@processmission.com>
 S: Odd Fixes
 F: scripts/checkpatch.pl
 
-- 
2.53.0

Re: [PULL v2 00/36] Misc HW patches for 2026-07-07

[Stefan Hajnoczi]

[-- Attachment #1: Type: text/plain, Size: 116 bytes --]

Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/11.1 for any user-visible changes.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]