* [PULL v2 05/36] tests/qtest/ahci: test ATAPI read completing after engine restart
2026-07-07 15:13 [PULL v2 00/36] Misc HW patches for 2026-07-07 Philippe Mathieu-Daudé
@ 2026-07-07 15:13 ` Philippe Mathieu-Daudé
2026-07-07 15:13 ` [PULL v2 29/36] hw/arm/msf2-som: Fix spansion-cr2nv value for S25FL128S Philippe Mathieu-Daudé
` (3 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Philippe Mathieu-Daudé @ 2026-07-07 15:13 UTC (permalink / raw)
To: qemu-devel
From: "Denis V. Lunev" <den@openvz.org>
Add a regression test for the crash that occurs when a buffered ATAPI
read completes after the command engine has been restarted. Issue an
ATAPI READ_10 against a blkdebug-backed CD, suspend the backend read so
it stays in flight, stop and restart the port's command engine (which
re-maps the command list and clears cur_cmd), then release the read.
The PIO and DMA reply paths fault in different AHCI helpers
(ahci_pio_transfer() vs ahci_dma_rw_buf()), so cover both. The DMA
variant is the reliable guard: on engine restart check_cmd() can re-arm
cur_cmd before the old read completes, so the PIO variant does not fault
in every build.
The test only asserts that qemu survives a subsequent register access;
if the blkdebug breakpoint ever failed to park the read it would pass
without exercising the bug, as with the existing break/resume tests.
Signed-off-by: Denis V. Lunev <den@openvz.org>
Message-ID: <20260619112158.304782-3-den@openvz.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
---
tests/qtest/ahci-test.c | 67 +++++++++++++++++++++++++++++++++++++++++
1 file changed, 67 insertions(+)
diff --git a/tests/qtest/ahci-test.c b/tests/qtest/ahci-test.c
index 5c32ff20029..44799eea153 100644
--- a/tests/qtest/ahci-test.c
+++ b/tests/qtest/ahci-test.c
@@ -1625,6 +1625,69 @@ static void test_cdrom_pio_multi(void)
ahci_test_cdrom_read10(3, false);
}
+/*
+ * Regression test: a buffered ATAPI read completing after a command
+ * engine restart must not dereference the cleared cur_cmd. Cover both
+ * PIO and DMA; the DMA variant is the reliable guard.
+ */
+static void test_atapi_engine_restart_in_flight(bool dma)
+{
+ AHCIQState *ahci;
+ AHCICommand *cmd;
+ unsigned char *tx;
+ char *iso;
+ int fd;
+ uint8_t port;
+ uint64_t buffer;
+ uint64_t iso_size = (uint64_t)ATAPI_SECTOR_SIZE * 2;
+
+ fd = prepare_iso(iso_size, &tx, &iso);
+
+ ahci = ahci_boot_and_enable("-drive if=none,id=drive0,"
+ "file=blkdebug::%s,format=raw,readonly=on "
+ "-M q35 "
+ "-device ide-cd,drive=drive0 ", iso);
+ port = ahci_port_select(ahci);
+
+ buffer = ahci_alloc(ahci, ATAPI_SECTOR_SIZE);
+ qtest_memset(ahci->parent->qts, buffer, 0x00, ATAPI_SECTOR_SIZE);
+
+ /* Suspend the next backend read so the ATAPI read stays in flight. */
+ g_free(qtest_hmp(ahci->parent->qts,
+ "qemu-io drive0 \"break read_aio rd\""));
+
+ cmd = ahci_atapi_command_create(CMD_ATAPI_READ_10, ATAPI_SECTOR_SIZE,
+ dma);
+ ahci_command_adjust(cmd, 0, buffer, ATAPI_SECTOR_SIZE, 0);
+ ahci_command_commit(ahci, cmd, port);
+ ahci_command_issue_async(ahci, cmd);
+
+ /* Stop and restart the command engine to re-map the command list. */
+ ahci_px_clr(ahci, port, AHCI_PX_CMD, AHCI_PX_CMD_ST);
+ ahci_px_set(ahci, port, AHCI_PX_CMD, AHCI_PX_CMD_ST);
+
+ g_free(qtest_hmp(ahci->parent->qts, "qemu-io drive0 \"resume rd\""));
+
+ /* Round-trip through the device to confirm qemu is still alive. */
+ ahci_px_rreg(ahci, port, AHCI_PX_TFD);
+
+ ahci_command_free(cmd);
+ ahci_free(ahci, buffer);
+ g_free(tx);
+ ahci_shutdown(ahci);
+ remove_iso(fd, iso);
+}
+
+static void test_atapi_engine_restart_pio(void)
+{
+ test_atapi_engine_restart_in_flight(false);
+}
+
+static void test_atapi_engine_restart_dma(void)
+{
+ test_atapi_engine_restart_in_flight(true);
+}
+
/* Regression test: Test that a READ_CD command with a BCL of 0 but a size of 0
* completes as a NOP instead of erroring out. */
static void test_atapi_bcl(void)
@@ -2042,6 +2105,10 @@ int main(int argc, char **argv)
qtest_add_func("/ahci/cdrom/pio/bcl", test_atapi_bcl);
qtest_add_func("/ahci/cdrom/eject", test_atapi_tray);
+ qtest_add_func("/ahci/cdrom/engine_restart/pio",
+ test_atapi_engine_restart_pio);
+ qtest_add_func("/ahci/cdrom/engine_restart/dma",
+ test_atapi_engine_restart_dma);
ret = g_test_run();
--
2.53.0
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PULL v2 29/36] hw/arm/msf2-som: Fix spansion-cr2nv value for S25FL128S
2026-07-07 15:13 [PULL v2 00/36] Misc HW patches for 2026-07-07 Philippe Mathieu-Daudé
2026-07-07 15:13 ` [PULL v2 05/36] tests/qtest/ahci: test ATAPI read completing after engine restart Philippe Mathieu-Daudé
@ 2026-07-07 15:13 ` Philippe Mathieu-Daudé
2026-07-07 15:13 ` [PULL v2 30/36] hw/block: m25p80: Fix dummy byte handling for Spansion flash Philippe Mathieu-Daudé
` (2 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Philippe Mathieu-Daudé @ 2026-07-07 15:13 UTC (permalink / raw)
To: qemu-devel
From: Cédric Le Goater <clg@redhat.com>
The emcraft-sf2 board set spansion-cr2nv to 1, which the old m25p80
code treated as a byte count. With the dummy cycle to byte conversion
fix, CR2V=1 at SPI x1 is 1 bit, not byte-aligned, and triggers an
assertion. Use the S25FL128S default of 0x8 (8 cycles = 1 byte at
SPI x1), preserving the same runtime behavior.
Signed-off-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Bin Meng <bin.meng@processmission.com>
Tested-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-Id: <20d58663-a8d1-41ff-9348-cae4982c30f0@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
---
hw/arm/msf2-som.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/arm/msf2-som.c b/hw/arm/msf2-som.c
index caf6e7e1ad7..1ada1a13613 100644
--- a/hw/arm/msf2-som.c
+++ b/hw/arm/msf2-som.c
@@ -84,7 +84,7 @@ static void emcraft_sf2_s2s010_init(MachineState *machine)
/* Attach SPI flash to SPI0 controller */
spi_bus = qdev_get_child_bus(dev, "spi0");
spi_flash = qdev_new("s25sl12801"); /* Spansion S25FL128SDPBHICO */
- qdev_prop_set_uint8(spi_flash, "spansion-cr2nv", 1);
+ qdev_prop_set_uint8(spi_flash, "spansion-cr2nv", 0x8);
if (dinfo) {
qdev_prop_set_drive_err(spi_flash, "drive",
blk_by_legacy_dinfo(dinfo), &error_fatal);
--
2.53.0
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PULL v2 30/36] hw/block: m25p80: Fix dummy byte handling for Spansion flash
2026-07-07 15:13 [PULL v2 00/36] Misc HW patches for 2026-07-07 Philippe Mathieu-Daudé
2026-07-07 15:13 ` [PULL v2 05/36] tests/qtest/ahci: test ATAPI read completing after engine restart Philippe Mathieu-Daudé
2026-07-07 15:13 ` [PULL v2 29/36] hw/arm/msf2-som: Fix spansion-cr2nv value for S25FL128S Philippe Mathieu-Daudé
@ 2026-07-07 15:13 ` Philippe Mathieu-Daudé
2026-07-07 15:13 ` [PULL v2 36/36] MAINTAINERS: update Chao Liu's email address Philippe Mathieu-Daudé
2026-07-08 5:54 ` [PULL v2 00/36] Misc HW patches for 2026-07-07 Stefan Hajnoczi
4 siblings, 0 replies; 6+ messages in thread
From: Philippe Mathieu-Daudé @ 2026-07-07 15:13 UTC (permalink / raw)
To: qemu-devel
From: Bin Meng <bin.meng@processmission.com>
Spansion flashes expose the number of dummy clock cycles through CR2V
register [1]. The value is a cycle count, not a byte count, so the
m25p80 model has to convert it to the number of whole SSI transfer
bytes consumed while collecting read command data.
Add a helper that multiplies the CR2V dummy cycle count by the phase
width and rounds up non-byte-aligned counts, matching the byte-oriented
SSI model. The default eight-cycle configuration keeps the same byte
counts as before.
[1] https://www.infineon.com/assets/row/public/documents/10/49/infineon-s25fs128s-s25fs256s-1-datasheet-en.pdf
Fixes: cf6f1efe0b57 ("m25p80: Fast read commands family changes")
Signed-off-by: Bin Meng <bin.meng@processmission.com>
Tested-by: Cédric Le Goater <clg@redhat.com>
Message-ID: <20260707083431.219671-5-bin.meng@processmission.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
---
hw/block/m25p80.c | 32 ++++++++++++++++++++------------
1 file changed, 20 insertions(+), 12 deletions(-)
diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
index d7a9d793737..545e0b57285 100644
--- a/hw/block/m25p80.c
+++ b/hw/block/m25p80.c
@@ -1057,6 +1057,23 @@ static uint8_t macronix_extract_cfg_dummy_bytes(Flash *s, uint8_t bus_width)
return dummy_bits / 8;
}
+static uint8_t spansion_extract_cfg_dummy_bytes(Flash *s, uint8_t bus_width)
+{
+ uint8_t dummy_bits;
+
+ dummy_bits = extract32(s->spansion_cr2v, SPANSION_DUMMY_CLK_POS,
+ SPANSION_DUMMY_CLK_LEN);
+ dummy_bits *= bus_width;
+
+ /*
+ * Assert that the dummy bit count is byte-aligned
+ * as SSI core can only consume whole dummy bytes.
+ */
+ assert(dummy_bits % 8 == 0);
+
+ return dummy_bits / 8;
+}
+
static void decode_fast_read_cmd(Flash *s)
{
s->needed_bytes = get_addr_length(s);
@@ -1075,10 +1092,7 @@ static void decode_fast_read_cmd(Flash *s)
s->needed_bytes += macronix_extract_cfg_dummy_bytes(s, 1);
break;
case MAN_SPANSION:
- s->needed_bytes += extract32(s->spansion_cr2v,
- SPANSION_DUMMY_CLK_POS,
- SPANSION_DUMMY_CLK_LEN
- );
+ s->needed_bytes += spansion_extract_cfg_dummy_bytes(s, 1);
break;
case MAN_ISSI:
/*
@@ -1111,10 +1125,7 @@ static void decode_dio_read_cmd(Flash *s)
break;
case MAN_SPANSION:
s->needed_bytes += SPANSION_CONTINUOUS_READ_MODE_CMD_LEN;
- s->needed_bytes += extract32(s->spansion_cr2v,
- SPANSION_DUMMY_CLK_POS,
- SPANSION_DUMMY_CLK_LEN
- );
+ s->needed_bytes += spansion_extract_cfg_dummy_bytes(s, 2);
break;
case MAN_NUMONYX:
s->needed_bytes += numonyx_extract_cfg_dummy_bytes(s);
@@ -1151,10 +1162,7 @@ static void decode_qio_read_cmd(Flash *s)
break;
case MAN_SPANSION:
s->needed_bytes += SPANSION_CONTINUOUS_READ_MODE_CMD_LEN;
- s->needed_bytes += extract32(s->spansion_cr2v,
- SPANSION_DUMMY_CLK_POS,
- SPANSION_DUMMY_CLK_LEN
- );
+ s->needed_bytes += spansion_extract_cfg_dummy_bytes(s, 4);
break;
case MAN_NUMONYX:
s->needed_bytes += numonyx_extract_cfg_dummy_bytes(s);
--
2.53.0
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PULL v2 36/36] MAINTAINERS: update Chao Liu's email address
2026-07-07 15:13 [PULL v2 00/36] Misc HW patches for 2026-07-07 Philippe Mathieu-Daudé
` (2 preceding siblings ...)
2026-07-07 15:13 ` [PULL v2 30/36] hw/block: m25p80: Fix dummy byte handling for Spansion flash Philippe Mathieu-Daudé
@ 2026-07-07 15:13 ` Philippe Mathieu-Daudé
2026-07-08 5:54 ` [PULL v2 00/36] Misc HW patches for 2026-07-07 Stefan Hajnoczi
4 siblings, 0 replies; 6+ messages in thread
From: Philippe Mathieu-Daudé @ 2026-07-07 15:13 UTC (permalink / raw)
To: qemu-devel
From: Chao Liu <chao.liu@processmission.com>
I joined Process Mission over a month ago and have verified that sending
patches from my new email address works as expected.
Update my MAINTAINERS entries to use the new address for future upstream
contributions.
Signed-off-by: Chao Liu <chao.liu@processmission.com>
Reviewed-by: Bin Meng <bin.meng@processmission.com>
Message-ID: <20260707132701.71164-1-chao.liu@processmission.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
---
MAINTAINERS | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/MAINTAINERS b/MAINTAINERS
index 1e239f21166..5029be1586b 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -353,7 +353,7 @@ M: Alistair Francis <alistair.francis@wdc.com>
R: Weiwei Li <liwei1518@gmail.com>
R: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
R: Liu Zhiwei <zhiwei_liu@linux.alibaba.com>
-R: Chao Liu <chao.liu.zevorn@gmail.com>
+R: Chao Liu <chao.liu@processmission.com>
L: qemu-riscv@nongnu.org
S: Supported
F: configs/targets/riscv*
@@ -1817,7 +1817,7 @@ F: hw/riscv/xiangshan_kmh.c
F: include/hw/riscv/xiangshan_kmh.h
K230 Machines
-M: Chao Liu <chao.liu.zevorn@gmail.com>
+M: Chao Liu <chao.liu@processmission.com>
L: qemu-riscv@nongnu.org
S: Maintained
F: docs/system/riscv/k230.rst
@@ -3806,7 +3806,7 @@ F: hw/pci/pcie_doe.c
F: docs/specs/spdm.rst
Checkpatch
-R: Chao Liu <chao.liu.zevorn@gmail.com>
+R: Chao Liu <chao.liu@processmission.com>
S: Odd Fixes
F: scripts/checkpatch.pl
--
2.53.0
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PULL v2 00/36] Misc HW patches for 2026-07-07
2026-07-07 15:13 [PULL v2 00/36] Misc HW patches for 2026-07-07 Philippe Mathieu-Daudé
` (3 preceding siblings ...)
2026-07-07 15:13 ` [PULL v2 36/36] MAINTAINERS: update Chao Liu's email address Philippe Mathieu-Daudé
@ 2026-07-08 5:54 ` Stefan Hajnoczi
4 siblings, 0 replies; 6+ messages in thread
From: Stefan Hajnoczi @ 2026-07-08 5:54 UTC (permalink / raw)
To: Philippe Mathieu-Daudé; +Cc: qemu-devel
[-- Attachment #1: Type: text/plain, Size: 116 bytes --]
Applied, thanks.
Please update the changelog at https://wiki.qemu.org/ChangeLog/11.1 for any user-visible changes.
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread