[PULL 0/7] Trivial patches for 2026-07-24

[PULL 0/7] Trivial patches for 2026-07-24

[Michael Tokarev]

The following changes since commit 006a22cb26998998385b104db1ff9466ef2f3153:

  Merge tag 'firmware-20260722-pull-request' of https://gitlab.com/kraxel/qemu into staging (2026-07-22 11:17:49 -0400)

are available in the Git repository at:

  https://gitlab.com/mjt0k/qemu.git tags/pull-trivial-patches

for you to fetch changes up to 443e02410695b35a27fad18217424b6370358be7:

  hw/ide: replace assert with proper error handling (2026-07-24 12:42:11 +0300)

----------------------------------------------------------------
trivial patches for 2026-07-24

Nothing fancy, a few fixups here and there, some were
queued for a long time.

----------------------------------------------------------------
Artem Nasonov (1):
      hw/ide: replace assert with proper error handling

Evgeny Kolmakov (1):
      hw/hyperv/vmbus: Use QEMU_LOCK_GUARD()

Filip Hejsek (1):
      char-win-stdio: fix typo in spelling of 'stdio'

Michael Tokarev (1):
      spelling: happend

Thomas Huth (1):
      hw/display/vmware_vga: Don't allow guest to trigger long running loop in host

Vladimir Lobanov (1):
      block/curl: set User-Agent header

Ziyi Fu (1):
      hw/usb: record async control completion for parameter transfers

 block/curl.c                    |  2 ++
 chardev/char-win-stdio.c        |  6 +++---
 docs/about/removed-features.rst |  2 +-
 hw/display/vmware_vga.c         |  6 +++++-
 hw/hyperv/vmbus.c               | 16 +++++-----------
 hw/ide/core.c                   |  8 ++++++--
 hw/usb/core.c                   |  1 +
 migration/migration.c           |  2 +-
 qapi/migration.json             |  4 ++--
 9 files changed, 26 insertions(+), 21 deletions(-)

[PULL 1/7] spelling: happend

[Michael Tokarev]

Fixes: 44adb5fcc20d "target/riscv: Remove spike as default machine"
Fixes: 48814111366b "migration: Always set DEVICE state"
Fixes: 3345fb3b6d7f "migration/postcopy: Add latency distribution report for blocktime"
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 docs/about/removed-features.rst | 2 +-
 migration/migration.c           | 2 +-
 qapi/migration.json             | 4 ++--
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/docs/about/removed-features.rst b/docs/about/removed-features.rst
index f7a2aa326de..0735b4ea1d5 100644
--- a/docs/about/removed-features.rst
+++ b/docs/about/removed-features.rst
@@ -1241,7 +1241,7 @@ RISC-V default machine (removed in 11.1)
 ''''''''''''''''''''''''''''''''''''''''
 
 RISC-V used to define ``spike`` as the default machine if no machine option
-was given via the command line.  This happend because ``spike`` was the first
+was given via the command line.  This happened because ``spike`` was the first
 RISC-V machine implemented in QEMU and setting it as default was
 convenient at that time.  Now we have 7 riscv64 and 6 riscv32 machines
 and having ``spike`` as a default is no longer justified.
diff --git a/migration/migration.c b/migration/migration.c
index 9736c14458b..9df6da131ce 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -2806,7 +2806,7 @@ static bool migration_switchover_prepare(MigrationState *s)
     bql_lock();
     /*
      * After BQL released and retaken, the state can be CANCELLING if it
-     * happend during sem_wait().. Only change the state if it's still
+     * happened during sem_wait().. Only change the state if it's still
      * pre-switchover.
      */
     migrate_set_state(&s->state, MIGRATION_STATUS_PRE_SWITCHOVER,
diff --git a/qapi/migration.json b/qapi/migration.json
index 66bd900465a..b1eaf7b0545 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
@@ -270,8 +270,8 @@
 #     (Since 10.1)
 #
 # @postcopy-non-vcpu-latency: average remote page fault latency for
-#     all faults happend in non-vCPU threads (in ns).  It has the same
-#     definition of @postcopy-latency but this only provides
+#     all faults happened in non-vCPU threads (in ns).  It has the
+#     same definition of @postcopy-latency but this only provides
 #     statistics to non-vCPU faults.  This is only present when the
 #     postcopy-blocktime migration capability is enabled.
 #     (Since 10.1)
-- 
2.47.3

[PULL 2/7] char-win-stdio: fix typo in spelling of 'stdio'

[Michael Tokarev]

From: Filip Hejsek <filip.hejsek@gmail.com>

Signed-off-by: Filip Hejsek <filip.hejsek@gmail.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 chardev/char-win-stdio.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/chardev/char-win-stdio.c b/chardev/char-win-stdio.c
index bb9c195a8b1..0deba3bffb0 100644
--- a/chardev/char-win-stdio.c
+++ b/chardev/char-win-stdio.c
@@ -128,7 +128,7 @@ static void win_stdio_thread_wait_func(void *opaque)
     SetEvent(stdio->hInputDoneEvent);
 }
 
-static void win_stiod_chr_set_echo(Chardev *chr, bool echo)
+static void win_stdio_chr_set_echo(Chardev *chr, bool echo)
 {
     WinStdioChardev *stdio = WIN_STDIO_CHARDEV(chr);
     DWORD              dwMode = 0;
@@ -205,7 +205,7 @@ static bool win_stdio_chr_open(Chardev *chr,
 
     SetConsoleMode(stdio->hStdIn, dwMode);
 
-    win_stiod_chr_set_echo(chr, false);
+    win_stdio_chr_set_echo(chr, false);
 
     qemu_chr_be_event(chr, CHR_EVENT_OPENED);
     return true;
@@ -263,7 +263,7 @@ static void char_win_stdio_class_init(ObjectClass *oc, const void *data)
 
     cc->chr_open = win_stdio_chr_open;
     cc->chr_write = win_stdio_chr_write;
-    cc->chr_set_echo = win_stiod_chr_set_echo;
+    cc->chr_set_echo = win_stdio_chr_set_echo;
 }
 
 static const TypeInfo char_win_stdio_type_info = {
-- 
2.47.3

[PULL 3/7] block/curl: set User-Agent header

[Michael Tokarev]

From: Vladimir Lobanov <lobanov-vla@yandex.ru>

Some HTTP servers and WAFs (e.g. Amazon CloudFront) reject
requests without a User-Agent header with 403 Forbidden. This
makes qemu-img info and other curl-based operations fail on
such URLs without any obvious indication of the root cause.

Set a "QEMU/<version>" User-Agent string on all curl handles
to ensure compatibility with these endpoints.

Signed-off-by: Vladimir Lobanov <lobanov-vla@yandex.ru>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 block/curl.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/block/curl.c b/block/curl.c
index 684c677ef71..1958eb80d12 100644
--- a/block/curl.c
+++ b/block/curl.c
@@ -482,6 +482,8 @@ static int curl_init_state(BDRVCURLState *s, CURLState *state)
             }
         }
         if (curl_easy_setopt(state->curl, CURLOPT_TIMEOUT, (long)s->timeout) ||
+            curl_easy_setopt(state->curl, CURLOPT_USERAGENT,
+                             "QEMU/" QEMU_VERSION) ||
             curl_easy_setopt(state->curl, CURLOPT_WRITEFUNCTION,
                              (void *)curl_read_cb) ||
             curl_easy_setopt(state->curl, CURLOPT_WRITEDATA, (void *)state) ||
-- 
2.47.3

[PULL 4/7] hw/display/vmware_vga: Don't allow guest to trigger long running loop in host

[Michael Tokarev]

From: Thomas Huth <thuth@redhat.com>

The code in the SVGA_CMD_DEFINE_ALPHA_CURSOR handler in vmsvga_fifo_run()
basically does:

            x = vmsvga_fifo_read(s);
            y = vmsvga_fifo_read(s);
            args = x * y;
            goto badcmd;
            ...
badcmd:
            len -= args;
            if (len < 0) {
                goto rewind;
            }
            while (args--) {
                vmsvga_fifo_read(s);
            }

Thus by supplying huge values for x and y that overflow the result of
the multiplication, the guest can trigger a long-running loop here
that burns the host's CPU cycles.

Add some sanity checks so that this cannot happen anymore.

Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3782
Reported-by: Feifan Qian <bea1e@proton.me>
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4026
Reported-by: Tristan Madani <tristan@talencesecurity.com>
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4076
Reported-by: Sunday Jiang
Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/display/vmware_vga.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/hw/display/vmware_vga.c b/hw/display/vmware_vga.c
index f6f9edfd1d9..567806f0e47 100644
--- a/hw/display/vmware_vga.c
+++ b/hw/display/vmware_vga.c
@@ -737,6 +737,10 @@ static void vmsvga_fifo_run(struct vmsvga_state_s *s)
             vmsvga_fifo_read(s);
             x = vmsvga_fifo_read(s);
             y = vmsvga_fifo_read(s);
+            if (x < 0 || x >= SVGA_MAX_WIDTH ||
+                y < 0 || y >= SVGA_MAX_HEIGHT) {
+                goto rewind;
+            }
             args = x * y;
             goto badcmd;
         case SVGA_CMD_RECT_ROP_FILL:
@@ -776,7 +780,7 @@ static void vmsvga_fifo_run(struct vmsvga_state_s *s)
             if (len < 0) {
                 goto rewind;
             }
-            while (args--) {
+            while (args-- > 0) {
                 vmsvga_fifo_read(s);
             }
             printf("%s: Unknown command 0x%02x in SVGA command FIFO\n",
-- 
2.47.3

[PULL 5/7] hw/hyperv/vmbus: Use QEMU_LOCK_GUARD()

[Michael Tokarev]

From: Evgeny Kolmakov <randomjack94dev@gmail.com>

Replace manual qemu_mutex_(un)lock() calls with
QEMU_LOCK_GUARD() to remove 'goto out' code

Signed-off-by: Evgeny Kolmakov <randomjack94dev@gmail.com>
Reviewed-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/hyperv/vmbus.c | 16 +++++-----------
 1 file changed, 5 insertions(+), 11 deletions(-)

diff --git a/hw/hyperv/vmbus.c b/hw/hyperv/vmbus.c
index c5259d1a764..ab99f082d10 100644
--- a/hw/hyperv/vmbus.c
+++ b/hw/hyperv/vmbus.c
@@ -1525,14 +1525,12 @@ static VMBusChannel *find_channel(VMBus *vmbus, uint32_t id)
 static int enqueue_incoming_message(VMBus *vmbus,
                                     const struct hyperv_post_message_input *msg)
 {
-    int ret = 0;
     uint8_t idx, prev_size;
 
-    qemu_mutex_lock(&vmbus->rx_queue_lock);
+    QEMU_LOCK_GUARD(&vmbus->rx_queue_lock);
 
     if (vmbus->rx_queue_size == HV_MSG_QUEUE_LEN) {
-        ret = -ENOBUFS;
-        goto out;
+        return -ENOBUFS;
     }
 
     prev_size = vmbus->rx_queue_size;
@@ -1544,9 +1542,7 @@ static int enqueue_incoming_message(VMBus *vmbus,
     if (!prev_size) {
         vmbus_resched(vmbus);
     }
-out:
-    qemu_mutex_unlock(&vmbus->rx_queue_lock);
-    return ret;
+    return 0;
 }
 
 static uint16_t vmbus_recv_message(const struct hyperv_post_message_input *msg,
@@ -2097,10 +2093,10 @@ static void process_message(VMBus *vmbus)
     void *msgdata;
     uint32_t msglen;
 
-    qemu_mutex_lock(&vmbus->rx_queue_lock);
+    QEMU_LOCK_GUARD(&vmbus->rx_queue_lock);
 
     if (!vmbus->rx_queue_size) {
-        goto unlock;
+        return;
     }
 
     hv_msg = &vmbus->rx_queue[vmbus->rx_queue_head];
@@ -2149,8 +2145,6 @@ out:
     vmbus->rx_queue_head %= HV_MSG_QUEUE_LEN;
 
     vmbus_resched(vmbus);
-unlock:
-    qemu_mutex_unlock(&vmbus->rx_queue_lock);
 }
 
 static const struct {
-- 
2.47.3

[PULL 6/7] hw/usb: record async control completion for parameter transfers

[Michael Tokarev]

From: Ziyi Fu <ziyi.fu@cyberus-technology.de>

Record the completion side of parameter-based control transfers when they
complete asynchronously. This lets pcap captures include descriptor
response data for requests such as GET_DESCRIPTOR from usb-host devices.

The synchronous path already recorded the completion, but the async
SETUP_STATE_PARAM path was missing it.

Signed-off-by: Ziyi Fu <ziyi.fu@cyberus-technology.de>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Fixes: 0f6dba145a4b ("usb: add pcap support.")
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/usb/core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/usb/core.c b/hw/usb/core.c
index 9572a870cc0..d71204c5c80 100644
--- a/hw/usb/core.c
+++ b/hw/usb/core.c
@@ -345,6 +345,7 @@ void usb_generic_async_ctrl_complete(USBDevice *s, USBPacket *p)
             p->actual_length = 0;
             usb_packet_copy(p, s->data_buf, s->setup_len);
         }
+        usb_pcap_ctrl(p, false);
         break;
 
     default:
-- 
2.47.3

[PULL 7/7] hw/ide: replace assert with proper error handling

[Michael Tokarev]

From: Artem Nasonov <anasonov@astralinux.ru>

In ide_dma_cb(), the call to prepare_buf() might return a negative
result and cause an assertion failure. This was found during fuzzing
and can be triggered with some qtest commands. Replace the assert with
proper error handling in case the result is negative, but keep the
assert for failing to respect the limit upon success. If that happens,
it is an implementation error.

Found by Linux Verification Center (linuxtesting.org) with libFuzzer.

Cc: qemu-stable@nongnu.org
Fixes: ed78352a59 ("ide: Fix incorrect handling of some PRDTs in ide_dma_cb()")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/2777
Signed-off-by: Artem Nasonov <anasonov@astralinux.ru>
Link: https://lore.kernel.org/qemu-devel/20250116111600.2570490-1-anasonov@astralinux.ru
[FE: improve commit message
     keep assert for failing to respect the limit]
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/ide/core.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/hw/ide/core.c b/hw/ide/core.c
index f78b00220b8..4c1ee19d8e8 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -921,8 +921,12 @@ static void ide_dma_cb(void *opaque, int ret)
     s->io_buffer_index = 0;
     s->io_buffer_size = n * 512;
     prep_size = s->bus->dma->ops->prepare_buf(s->bus->dma, s->io_buffer_size);
-    /* prepare_buf() must succeed and respect the limit */
-    assert(prep_size >= 0 && prep_size <= n * 512);
+    if (prep_size < 0) {
+        ide_dma_error(s);
+        return;
+    }
+    /* If prepare_buf() succeeds, it must respect the limit. */
+    assert(prep_size <= n * 512);
 
     /*
      * Now prep_size stores the number of bytes in the sglist, and
-- 
2.47.3

Re: [PULL 0/7] Trivial patches for 2026-07-24

[Stefan Hajnoczi]

[-- Attachment #1: Type: text/plain, Size: 116 bytes --]

Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/11.1 for any user-visible changes.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]