[ Reason ]
There's a new upstream minor/stable/bugfix release of qemu,
fixing a fair number of various issues in all areas, including
numerous security issues found so far.
[ Tests ]
This release passes the usual upstream testsuite, which is the
main indicator of its correctness. The majority of fixes are
small and touches just the problematic areas, and all of them
are additionally tested in the upstream master branch before
being back-ported to the stable branches.
Additionally I tested it lightly on my collection of various
guest images (several windows VMs, a few linux VMs, a FreeBSD
VM and a Hurd VM) - the basic functionality is ok.
[ Risks ]
This is a release with a rather big number of changes, so it
might be more risky than usual. However, history of previous
qemu stable/bugfix releases shows it's usually non-problematic.
I don't expect issues from this release too.
[ Checklist ]
[x] *all* changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in (old)stable
[x] the issue is verified as fixed in unstable
[ Changes ]
There's a debian/changelog in the debdiff below, with a list
of upstream commits between upstream releases with the tags
v10.0.12 and v10.0.13. Individual commits with all explanations
are available on the salsa qemu repository, starting from
https://salsa.debian.org/qemu-team/qemu/-/commits/v10.0.13 .
There's no changes in debian packaging, only reference to the
new version in d/control and d/changelog.
[ Other info ]
The debdiff is against previous release of qemu which is
proposed for trixie, but which hasn't been accepted yet --
1:10.0.12+ds-0+deb13u1.
It would be nice if this release of qemu is available in
trixie-proposed-updates before entering actual release, -
despite there's low risk, but just in case.
Thanks,
/mjt
diff -Nru qemu-10.0.12+ds/debian/changelog qemu-10.0.13+ds/debian/changelog
--- qemu-10.0.12+ds/debian/changelog 2026-07-25 09:35:02.000000000 +0300
+++ qemu-10.0.13+ds/debian/changelog 2026-08-29 20:55:40.000000000 +0300
@@ -1,3 +1,295 @@
+qemu (1:10.0.13+ds-0+deb13u1) trixie; urgency=medium
+
+ * new upstream stable/bugfix release, including multiple security fixes:
+ - Update version for 10.0.13 release
+ - target/riscv/tcg: sret in virtual user mode
+ raises virtual instruction exception
+ https://gitlab.com/qemu-project/qemu/-/work_items/3622
+ - target/riscv: enforce even register constraints for Zdinx fcvt pairs
+ https://gitlab.com/qemu-project/qemu/-/work_items/4109
+ - target/riscv: reject FMV.X.W/FMV.W.X under Zfinx
+ https://gitlab.com/qemu-project/qemu/-/work_items/4108
+ - target/riscv: honor zicbo* envcfg gating in linux-user mode
+ https://gitlab.com/qemu-project/qemu/-/work_items/4107
+ - disas/riscv: Fix typo in th.lbib format
+ - disas/riscv: Fix isa decoding of rev8
+ - disas/riscv: Fix rv32 encoding of zext.h
+ - target/riscv: allow menvcfg/henvcfg LPE and SSE bits on RV32
+ https://gitlab.com/qemu-project/qemu/-/work_items/4045
+ - hw/riscv/riscv-iommu: preserve requested perm in spa_fetch()
+ - hw/riscv/riscv-iommu: fix U-bit check to apply only to
+ leaf S/VS-stage PTEs
+ - disas/riscv: Decode unsigned vector immediates as unsigned
+ - disas/riscv: Use signed type for vector immediates
+ - disas/riscv: Fix 6-bit immediate extraction
+ - disas/riscv: Fix th.srri decoding
+ - target/riscv: use SXL instead of MXL for read_sstatus
+ - target/riscv: Fix PC sync in trans_sspopchk for CFI exception handling
+ https://gitlab.com/qemu-project/qemu/-/work_items/4118
+ - hw/watchdog: Add lower bound check for watchdogNumber
+ https://gitlab.com/qemu-project/qemu/-/work_items/3600
+ - tcg: Export tcg_gen_ussub_i{32,64,tl}
+ - tcg: Defer tb_flush when initial thread region alloc fails
+ https://gitlab.com/qemu-project/qemu/-/work_items/2984
+ - tcg: Return success from tcg_region_alloc
+ - tcg: Return success from tcg_region_alloc__locked
+ - target/loongarch: check FPE before reading fcc in bceqz/bcnez
+ https://gitlab.com/qemu-project/qemu/-/work_items/4209
+ - meson: make linker warnings non-fatal on Linux
+ - serial: clear transmit retry callback on unrealize
+ https://gitlab.com/qemu-project/qemu/-/work_items/4125
+ - target/i386: decode opcode extensions group 3 /1 as TEST
+ https://gitlab.com/qemu-project/qemu/-/work_items/3580
+ - target/i386: allow transition to virtual-8086 mode
+ only if CPL == 0 and CPU is not in long mode
+ https://gitlab.com/qemu-project/qemu/-/work_items/3583
+ - target/i386: fix long mode segment override prefix decoding
+ https://gitlab.com/qemu-project/qemu/-/work_items/3391
+ - target/i386: fix incorrect decoding of EXTRQ_i
+ https://gitlab.com/qemu-project/qemu/-/work_items/3611
+ - target/i386: Clear OF, SF, and AF for fcomi/fucomi
+ https://gitlab.com/qemu-project/qemu/-/work_items/4133
+ - target/i386: Use correct type for get_float_exception_flags() values
+ - tcg/optimize: Fix s_mask computation for shifts
+ - tcg/optimize: INDEX_op_mul is commutative
+ - hw/elf_ops: defend against weird elf headers
+ - hw/nvme: add SPDM_SOCKET Kconfig dependency
+ - hw/block/pflash_cfi01: Restore ROMD mode after migration
+ https://gitlab.com/qemu-project/qemu/-/work_items/4042
+ - hw/net/rtl8139: Send whole of vlan-tagged packet when doing loopback
+ - hw/net/rtl8139: Fix handling of VLAN tags on incoming short packets
+ https://gitlab.com/qemu-project/qemu/-/work_items/3518
+ - tests/qtest/ahci: regression test for ATAPI read vs. drain
+ - hw/ide/atapi: read the whole elementary transfer asynchronously
+ - tests/qtest/ahci: cover raw (2352-byte) ATAPI CD reads
+ - tests/qtest/libqos/ahci: support raw (2352-byte) READ CD
+ - tests/qtest/ide-test: cover raw (2352-byte) ATAPI CD reads
+ - tests/qtest/ide-test: add a multi-sector ATAPI DMA read test
+ - tests/qtest/ide-test: parametrize the ATAPI CD-ROM read test
+ - hw/net/vmxnet3: Do not abort if guest provides bad interrupt numbers
+ https://gitlab.com/qemu-project/qemu/-/work_items/539
+ - hw/usb/dev-uas: Don't abort if guest provided an undersized buffer
+ for status
+ https://gitlab.com/qemu-project/qemu/-/work_items/3900
+ - hw/intc/loongarch_pch_pic: Validate htmsi_vector before indexing
+ parent_irq
+ https://gitlab.com/qemu-project/qemu/-/work_items/4114
+ - migration/multifd: Replace assert() with error_setg() in recv paths
+ - migration/multifd: Validate next_packet_size in zlib/zstd recv
+ https://gitlab.com/qemu-project/qemu/-/work_items/3737
+ - tests/tcg/s390x: Test STCKF condition code on a faulting store
+ - target/s390x/tcg: Set STCK/STCKF condition code after the store
+ - pc-bios/s390-ccw.img: update s390x bios
+ - pc-bios/s390-ccw: bound zipl menu strlen and replace VLA
+ in zipl_print_entry
+ - pc-bios/s390-ccw: bounds-check zipl menu entry index before array write
+ - pc-bios/s390-ccw: fix out-of-bounds read in iso_get_file_size()
+ - s390x/ipl: validate num_comp against iplb length before iterating
+ - hw/char/sclpconsole-lm: avoid guest triggerable assert
+ - tests/tcg/s390x: Test DR overflow (INT64_MIN / -1)
+ - target/s390x: Fix DR/D INT64_MIN / -1 host crash
+ - tests/tcg/s390x: Test PRNO TRNG interruptibility
+ - target/s390x: Make PRNO TRNG interruptible
+ - target/s390x: Have MSA helper pass a mmu_idx argument
+ - hw/arm/aspeed: Add missing Kconfig dependencies on required components
+ - linux-user: implement mount_setattr(2)
+ - linux-user/sh4: Fix crashes on signal delivery in conditional delay slot
+ - linux-user/sh4: Initialize the FPSCR register on signal
+ - linux-user/sh4: Deliver SIGILL on invalid instruction
+ - gitlab: disable provenance attestations to work around CI bug
+ - hw/nvme: fix leak on copy ranges
+ - hw/nvme: cancel inflight requests on controller reset
+ https://gitlab.com/qemu-project/qemu/-/work_items/3398
+ https://gitlab.com/qemu-project/qemu/-/work_items/3883
+ https://gitlab.com/qemu-project/qemu/-/work_items/4068
+ https://gitlab.com/qemu-project/qemu/-/work_items/4072
+ - hw/nvme: factor out nvme_sq_cancel_inflight()
+ - hw/nvme: drop AER requests without aiocb in nvme_del_sq()
+ - hw/display/virtio-gpu: Unmap DMA regions on reset
+ https://gitlab.com/qemu-project/qemu/-/work_items/3467
+ - hw/display/virtio-gpu: Always reject invalid scanout bounds
+ - virtio-gpu: reject requests with short/truncated control headers
+ Closes: CVE-2026-18054
+ - hw/display/virtio-gpu: fix offset wraparound in scanout_blob_to_fb
+ - vhost-user-gpu: fix integer overflow in buffer allocation
+ Closes: CVE-2026-15264
+ - hw/display/vga: fix panning_buf OOB after text/graphics switch
+ https://gitlab.com/qemu-project/qemu/-/work_items/4085
+ Closes: CVE-2026-17516
+ - hw/display/virtio-gpu: validate blob iov size
+ https://gitlab.com/qemu-project/qemu/-/work_items/3945
+ Closes: CVE-2026-66021
+ - coroutine: fix lost wakeup in qemu_co_sleep_wake()
+ - iotests: run the test pool with the 'fork' start method
+ - qcow2: do not try to clear the dirty bit on a read-only node
+ - dmg: reject inconsistent UDRW chunk sector count and length
+ https://gitlab.com/qemu-project/qemu/-/work_items/3846
+ Closes: CVE-2026-65928
+ - dmg: refuse to open files with no chunks
+ https://gitlab.com/qemu-project/qemu/-/work_items/4021
+ - dmg: fix out-of-bounds load in search_chunk()
+ https://gitlab.com/qemu-project/qemu/-/work_items/3844
+ Closes: CVE-2026-65929
+ - tests/unit: add reproducer for BlockAcctStats histogram locking race
+ - block/qapi: take stats->lock when reading BlockAcctStats
+ for query-blockstats
+ - block/accounting: take stats->lock in latency histogram setters
+ - block: Fix crash after setting latency historygram with single bin
+ - block/cloop: fix integer overflow in total_sectors calculation
+ - linux-user: fix incorrect msg_l[sr]pid members of target_msqid_ds
+ - linux-user: Fix msqid_ds struct wrt 32-bit big endian architectures
+ - hw/nvme: fix assertion failure on subregion removal
+ - hw/nvme: fix unintentional integer overflow in shift
+ - hw/nvme: fix cross-namespace copy dif buffer overflow
+ - virtio-mmio: fix QUEUE_NUM_MAX
+ https://gitlab.com/qemu-project/qemu/-/work_items/3882
+ Closes: CVE-2026-50626
+ - hw/display/exynos4210_fimd: Clamp windows to screen size
+ https://gitlab.com/qemu-project/qemu/-/work_items/3795
+ - hw/display/exynos4210_fimd: Pass width to draw_line functions
+ - hw/display/exynos4210_fimd: Factor out finding screen width/height
+ - hw/i2c/bcm2835_i2c: Correct CLKT register offset
+ - linux-user/sh4: allow full 32-bit address space
+ - target/sparc: set reg window data structures currently
+ after vmstate load
+ - hw/net/igb: recalculate rx_desc_len on migration load
+ - hw/net/e1000e: recalculate rx_desc_len on migration load
+ - linux-user: fix guards for the fsmount(2) syscall series
+ - hw/net/xilinx_axienet: Don't write checksums off end of packet
+ - linux-user: Guard local FUTEX_CMD_MASK definition
+ - virtio: avoid packed vring virtio_queue_empty() infinite loops
+ https://gitlab.com/qemu-project/qemu/-/work_items/3968
+ Closes: CVE-2026-16457
+ - backends/rng: cap request size to avoid oversized allocation
+ https://gitlab.com/qemu-project/qemu/-/work_items/3983
+ - hw/virtio-rng: Fix host use-after-free
+ https://gitlab.com/qemu-project/qemu/-/work_items/3917
+ Closes: CVE-2026-50624
+ - hw/net/virtio-net: Protect from DMA re-entrancy bugs
+ https://gitlab.com/qemu-project/qemu/-/work_items/4073
+ Closes: CVE-2026-66022 (again)
+ - intel_iommu: Check address mask before using it in
+ pasid-based iotlb invalidation
+ https://gitlab.com/qemu-project/qemu/-/work_items/3619
+ - hw/cxl: fix OOB access in cxl_doe_cdat_rsp via entry_handle
+ - hw/virtio/vdpa-dev: pass set_config buffer to vhost backend
+ - hw/pci-host/q35.c: Avoid early return in mch_write_config()
+ - hw/pci-host/q35.c: Factor out creation of SMRAM MRs
+ - hw/pci-host/q35.c: Always initialize smram-region even if SMM disabled
+ - virtio-iommu: fix OOM due to unbounded call_rcu
+ - libvduse: validate vq size
+ https://gitlab.com/qemu-project/qemu/-/work_items/3652
+ Closes: CVE-2026-61402
+ - libvhost-user: fix heap overflow in vu_check_queue_inflights
+ https://gitlab.com/qemu-project/qemu/-/work_items/3974
+ Closes: CVE-2026-63110
+ - libvhost-user: validate last_batch_head in vu_check_queue_inflights
+ https://gitlab.com/qemu-project/qemu/-/work_items/3974
+ - virtio-pmem: wait for flush requests on unrealize
+ https://gitlab.com/qemu-project/qemu/-/work_items/3938
+ Closes: CVE-2026-63323
+ - vhost-user: assert nregions within limit
+ https://gitlab.com/qemu-project/qemu/-/work_items/3910
+ - virtio: fail early on bad config_len in migration
+ https://gitlab.com/qemu-project/qemu/-/work_items/3891
+ - virtio-scsi: fix SCSIRequest leak on a bad request
+ https://gitlab.com/qemu-project/qemu/-/work_items/3875
+ Closes: CVE-2026-61476
+ - vhost: do not crash on ring map failure
+ https://gitlab.com/qemu-project/qemu/-/work_items/3783
+ - hw/virtio: reject zero-length packed indirect descriptor table
+ https://gitlab.com/qemu-project/qemu/-/work_items/3984
+ - libvhost-user: protect against OOB vring queue access
+ https://gitlab.com/qemu-project/qemu/-/work_items/3741
+ - libvhost-user: protect against OOB writes in vu_set_inflight_fd
+ https://gitlab.com/qemu-project/qemu/-/work_items/3740
+ - virtio-net: fix short frame OOB read in receive_filter()
+ https://gitlab.com/qemu-project/qemu/-/work_items/3626
+ Closes: CVE-2026-63320
+ - virtio-net: fix OOB read in RSC receive path
+ https://gitlab.com/qemu-project/qemu/-/work_items/3623
+ Closes: CVE-2026-63321
+ - hw/display/virtio-gpu: Block Rutabaga migration
+ - rutabaga: improve error handling, fix potential crash during init
+ - hw/display/virtio-gpu: Initialize blob mapping for ATTACH_BACKING
+ - hw/display/virtio-gpu: Fix empty blob discrimination
+ - virtio-gpu: fix NULL deref in rutabaga set_scanout
+ https://gitlab.com/qemu-project/qemu/-/work_items/3897
+ - target/i386/sev: fix MemoryRegion reference leaks in gpa2hva callers
+ - net/colo: fix g_hash_table_destroy assertion on uninitialized filter
+ - hw/display/qxl: unregister vm_change_state handler and BHs
+ https://gitlab.com/qemu-project/qemu/-/work_items/3607
+ Closes: CVE-2026-63322
+ - ui/vnc: remove redundant rows computation
+ - hw/display/vhost-user-gpu: validate message payload sizes
+ https://gitlab.com/qemu-project/qemu/-/work_items/3866
+ - hw/display/virtio-gpu: Remove the bytes_pp field
+ - hw/display/virtio-gpu: reject strides exceeding INT_MAX
+ - hw/display/virtio-gpu: validate stride against width on scanout
+ https://gitlab.com/qemu-project/qemu/-/work_items/3989
+ Closes: CVE-2026-63109
+ - hw/usb/hcd-xhci: Check return value of xhci_xfer_create_sgl()
+ for errors
+ https://gitlab.com/qemu-project/qemu/-/work_items/3786
+ - hw/usb/core: Avoid possible assert() in do_parameter() -->
+ usb_packet_copy()
+ https://gitlab.com/qemu-project/qemu/-/work_items/3746
+ - hw/ide/core: Fix possible crash via NULL pointer
+ in ide_cancel_dma_sync()
+ https://gitlab.com/qemu-project/qemu/-/work_items/905
+ https://gitlab.com/qemu-project/qemu/-/work_items/4052
+ - hw/usb/dev-uas: Fix guest-triggerable heap OOB access
+ https://gitlab.com/qemu-project/qemu/-/work_items/3612
+ https://gitlab.com/qemu-project/qemu/-/work_items/3986
+ - hw/9pfs/xen: drain in-flight PDUs before xen-9p disconnect
+ - hw/9pfs/virtio: drain in-flight PDUs before virtio-9p unrealize
+ https://gitlab.com/qemu-project/qemu/-/work_items/3937
+ - hw/9pfs: fix O_TRUNC bypass on read-only export
+ https://gitlab.com/qemu-project/qemu/-/work_items/4000
+ Closes: CVE-2026-63318
+ - hw/display/vmware_vga: Don't allow guest to trigger
+ long running loop in host
+ https://gitlab.com/qemu-project/qemu/-/work_items/3782
+ https://gitlab.com/qemu-project/qemu/-/work_items/4026
+ https://gitlab.com/qemu-project/qemu/-/work_items/4076
+ - hw/ide: replace assert with proper error handling
+ https://gitlab.com/qemu-project/qemu/-/work_items/2777
+ - scsi-disk: fix off by one in assertion
+ - scsi-disk: protect against guest sending truncated data
+ for MODE SELECT commands
+ https://gitlab.com/qemu-project/qemu/-/work_items/4051
+ - target/i386: helper_sysret(): Check that RCX contains
+ a canonical address when emulating an Intel CPU
+ https://gitlab.com/qemu-project/qemu/-/work_items/3223
+ - vfio/pci: reject invalid PCI_INTERRUPT_PIN values
+ - vfio/pci: don't narrow a failed config read to a plausible value
+ - vfio/igd: Clear saved BDSM in legacy VBIOS ROM at load time
+ https://gitlab.com/qemu-project/qemu/-/work_items/3093
+ - vfio/pci: Initialize rom_read_failed in vfio_pci_load_rom()
+ - hw/uefi: make SetupMode read-only
+ https://gitlab.com/qemu-project/qemu/-/work_items/4039
+ Closes: CVE-2026-16288
+ - hw/uefi: add post_load checks
+ https://gitlab.com/qemu-project/qemu/-/work_items/3837
+ https://gitlab.com/qemu-project/qemu/-/work_items/3838
+ https://gitlab.com/qemu-project/qemu/-/work_items/3839
+ https://gitlab.com/qemu-project/qemu/-/work_items/3885
+ Closes: CVE-2026-61404
+ - hw/uefi: account variable policy entries against storage size
+ https://gitlab.com/qemu-project/qemu/-/work_items/3890
+ Closes: CVE-2026-61405
+ - hw/uefi: check lower limit for signature list size
+ https://gitlab.com/qemu-project/qemu/-/work_items/3899
+ Closes: CVE-2026-61406
+ - hw/uefi: remove debug function
+ https://gitlab.com/qemu-project/qemu/-/work_items/3615
+ Closes: CVE-2026-58582
+ - hw/uefi: add sanity check
+ https://gitlab.com/qemu-project/qemu/-/work_items/3614
+ Closes: CVE-2026-58581
+
+ -- Michael Tokarev <mjt@tls.msk.ru> Sat, 29 Aug 2026 20:55:40 +0300
+
qemu (1:10.0.12+ds-0+deb13u1) trixie; urgency=medium
* new upstream stable/bugfix release:
diff -Nru qemu-10.0.12+ds/debian/control.mk qemu-10.0.13+ds/debian/control.mk
--- qemu-10.0.12+ds/debian/control.mk 2026-07-25 09:35:02.000000000 +0300
+++ qemu-10.0.13+ds/debian/control.mk 2026-08-29 20:55:40.000000000 +0300
@@ -9,7 +9,7 @@
# since some files and/or lists differ from version to version,
# ensure we have the expected qemu version, or else scream loudly
-checked-version := 10.0.12+ds
+checked-version := 10.0.13+ds
# version of last vdso change for d/control Depends field:
vdso-version := 1:9.2.0~rc3+ds-1~
diff -Nru qemu-10.0.12+ds/.gitlab-ci.d/container-template.yml qemu-10.0.13+ds/.gitlab-ci.d/container-template.yml
--- qemu-10.0.12+ds/.gitlab-ci.d/container-template.yml 2026-07-25 01:10:12.000000000 +0300
+++ qemu-10.0.13+ds/.gitlab-ci.d/container-template.yml 2026-08-26 22:31:25.000000000 +0300
@@ -14,7 +14,7 @@
- echo "TAG:$TAG"
- echo "COMMON_TAG:$COMMON_TAG"
- docker build --tag "$TAG" --cache-from "$TAG" --cache-from "$COMMON_TAG"
- --build-arg BUILDKIT_INLINE_CACHE=1
+ --build-arg BUILDKIT_INLINE_CACHE=1 --provenance=false
-f "tests/docker/dockerfiles/$NAME.docker" "."
- docker push "$TAG"
after_script:
diff -Nru qemu-10.0.12+ds/VERSION qemu-10.0.13+ds/VERSION
--- qemu-10.0.12+ds/VERSION 2026-07-25 01:10:12.000000000 +0300
+++ qemu-10.0.13+ds/VERSION 2026-08-26 22:31:25.000000000 +0300
@@ -1 +1 @@
-10.0.12
+10.0.13
diff -Nru qemu-10.0.12+ds/backends/rng.c qemu-10.0.13+ds/backends/rng.c
--- qemu-10.0.12+ds/backends/rng.c 2026-07-25 01:10:13.000000000 +0300
+++ qemu-10.0.13+ds/backends/rng.c 2026-08-26 22:31:25.000000000 +0300
@@ -11,11 +11,14 @@
*/
#include "qemu/osdep.h"
+#include "qemu/units.h"
#include "system/rng.h"
#include "qapi/error.h"
#include "qemu/module.h"
#include "qom/object_interfaces.h"
+#define RNG_MAX_REQUEST_SIZE (64 * KiB)
+
void rng_backend_request_entropy(RngBackend *s, size_t size,
EntropyReceiveFunc *receive_entropy,
void *opaque)
@@ -27,7 +30,7 @@
req = g_malloc(sizeof(*req));
req->offset = 0;
- req->size = size;
+ req->size = MIN(size, RNG_MAX_REQUEST_SIZE);
req->receive_entropy = receive_entropy;
req->opaque = opaque;
req->data = g_malloc(req->size);
@@ -68,6 +71,22 @@
g_free(req);
}
+void rng_backend_cancel_requests(RngBackend *s,
+ EntropyReceiveFunc *receive_entropy,
+ const void *opaque)
+{
+ RngRequest *req, *next;
+
+ QSIMPLEQ_FOREACH_SAFE(req, &s->requests, next, next) {
+ if (req->receive_entropy != receive_entropy ||
+ req->opaque != opaque) {
+ continue;
+ }
+ QSIMPLEQ_REMOVE(&s->requests, req, RngRequest, next);
+ rng_backend_free_request(req);
+ }
+}
+
static void rng_backend_free_requests(RngBackend *s)
{
RngRequest *req, *next;
diff -Nru qemu-10.0.12+ds/block/accounting.c qemu-10.0.13+ds/block/accounting.c
--- qemu-10.0.12+ds/block/accounting.c 2026-07-25 01:10:13.000000000 +0300
+++ qemu-10.0.13+ds/block/accounting.c 2026-08-26 22:31:25.000000000 +0300
@@ -173,6 +173,17 @@
prev = entry->value;
}
+ /*
+ * block_latency_histogram_account() assumes that it can always access
+ * hist->boundaries[0], so require at least one boundary. A histogram with
+ * a single bin is useless anyway.
+ */
+ if (new_nbins <= 1) {
+ return -EINVAL;
+ }
+
+ qemu_mutex_lock(&stats->lock);
+
hist->nbins = new_nbins;
g_free(hist->boundaries);
hist->boundaries = g_new(uint64_t, hist->nbins - 1);
@@ -185,6 +196,8 @@
g_free(hist->bins);
hist->bins = g_new0(uint64_t, hist->nbins);
+ qemu_mutex_unlock(&stats->lock);
+
return 0;
}
@@ -192,12 +205,16 @@
{
int i;
+ qemu_mutex_lock(&stats->lock);
+
for (i = 0; i < BLOCK_MAX_IOTYPE; i++) {
BlockLatencyHistogram *hist = &stats->latency_histogram[i];
g_free(hist->bins);
g_free(hist->boundaries);
memset(hist, 0, sizeof(*hist));
}
+
+ qemu_mutex_unlock(&stats->lock);
}
static void block_account_one_io(BlockAcctStats *stats, BlockAcctCookie *cookie,
@@ -289,10 +306,9 @@
uint64_t sum, elapsed;
assert(type < BLOCK_MAX_IOTYPE);
+ assert(qemu_mutex_trylock(&stats->stats->lock) == -EBUSY);
- qemu_mutex_lock(&stats->stats->lock);
sum = timed_average_sum(&stats->latency[type], &elapsed);
- qemu_mutex_unlock(&stats->stats->lock);
return (double) sum / elapsed;
}
diff -Nru qemu-10.0.12+ds/block/cloop.c qemu-10.0.13+ds/block/cloop.c
--- qemu-10.0.12+ds/block/cloop.c 2026-07-25 01:10:13.000000000 +0300
+++ qemu-10.0.13+ds/block/cloop.c 2026-08-26 22:31:25.000000000 +0300
@@ -202,7 +202,8 @@
s->current_block = s->n_blocks;
s->sectors_per_block = s->block_size/512;
- bs->total_sectors = s->n_blocks * s->sectors_per_block;
+ /* Cast to uint64_t to prevent uint32_t overflow */
+ bs->total_sectors = (uint64_t)s->n_blocks * s->sectors_per_block;
qemu_co_mutex_init(&s->lock);
return 0;
diff -Nru qemu-10.0.12+ds/block/dmg.c qemu-10.0.13+ds/block/dmg.c
--- qemu-10.0.12+ds/block/dmg.c 2026-07-25 01:10:13.000000000 +0300
+++ qemu-10.0.13+ds/block/dmg.c 2026-08-26 22:31:25.000000000 +0300
@@ -312,6 +312,21 @@
goto fail;
}
+ /*
+ * Uncompressed chunk length must match sector count. Compressed chunks
+ * are validated during dmg_read_chunk() since the uncompressed size is
+ * not known ahead of time.
+ */
+ if (s->types[i] == UDRW) {
+ if (s->sectorcounts[i] != DIV_ROUND_UP(s->lengths[i], 512)) {
+ error_report("length %" PRIu64 " for chunk %" PRIu32
+ " is inconsistent with sector count %" PRIu64,
+ s->lengths[i], i, s->sectorcounts[i]);
+ ret = -EINVAL;
+ goto fail;
+ }
+ }
+
update_max_chunk_size(s, i, &ds->max_compressed_size,
&ds->max_sectors_per_chunk);
offset += 40;
@@ -559,6 +574,12 @@
goto fail;
}
+ /* There must be at least one chunk */
+ if (s->n_chunks == 0) {
+ ret = -EINVAL;
+ goto fail;
+ }
+
/* initialize zlib engine */
s->compressed_chunk = qemu_try_blockalign(bs->file->bs,
ds.max_compressed_size + 1);
@@ -609,7 +630,10 @@
static inline uint32_t search_chunk(BDRVDMGState *s, uint64_t sector_num)
{
/* binary search */
- uint32_t chunk1 = 0, chunk2 = s->n_chunks, chunk3;
+ uint32_t chunk1 = 0, chunk2 = s->n_chunks - 1, chunk3;
+ if (s->n_chunks == 0) {
+ goto err; /* should never happen */
+ }
while (chunk1 <= chunk2) {
chunk3 = (chunk1 + chunk2) / 2;
if (s->sectors[chunk3] > sector_num) {
@@ -713,6 +737,16 @@
if (ret < 0) {
return -1;
}
+
+ /*
+ * Zero the unread part of the last sector when chunk length is
+ * unaligned to avoid exposing uninitialized memory. Valid image
+ * files may never hit this case, but cover it to be safe.
+ */
+ if (s->lengths[chunk] & 511) {
+ size_t trailing_bytes = 512 - (s->lengths[chunk] & 511);
+ memset(s->uncompressed_chunk + s->lengths[chunk], 0, trailing_bytes);
+ }
break;
case UDZE: /* zeros */
case UDIG: /* ignore */
diff -Nru qemu-10.0.12+ds/block/qapi.c qemu-10.0.13+ds/block/qapi.c
--- qemu-10.0.12+ds/block/qapi.c 2026-07-25 01:10:13.000000000 +0300
+++ qemu-10.0.13+ds/block/qapi.c 2026-08-26 22:31:25.000000000 +0300
@@ -498,6 +498,8 @@
BlockAcctTimedStats *ts = NULL;
BlockLatencyHistogram *hgram;
+ qemu_mutex_lock(&stats->lock);
+
ds->rd_bytes = stats->nr_bytes[BLOCK_ACCT_READ];
ds->wr_bytes = stats->nr_bytes[BLOCK_ACCT_WRITE];
ds->zone_append_bytes = stats->nr_bytes[BLOCK_ACCT_ZONE_APPEND];
@@ -587,6 +589,7 @@
= bdrv_latency_histogram_stats(&hgram[BLOCK_ACCT_ZONE_APPEND]);
ds->flush_latency_histogram
= bdrv_latency_histogram_stats(&hgram[BLOCK_ACCT_FLUSH]);
+ qemu_mutex_unlock(&stats->lock);
}
static BlockStats * GRAPH_RDLOCK
diff -Nru qemu-10.0.12+ds/block/qcow2.c qemu-10.0.13+ds/block/qcow2.c
--- qemu-10.0.12+ds/block/qcow2.c 2026-07-25 01:10:13.000000000 +0300
+++ qemu-10.0.13+ds/block/qcow2.c 2026-08-26 22:31:25.000000000 +0300
@@ -2784,7 +2784,11 @@
strerror(-ret));
}
- if (result == 0) {
+ /*
+ * A read-only node cannot resolve an inherited dirty bit here;
+ * leave it dirty, same as plain read access already does.
+ */
+ if (result == 0 && !bdrv_is_read_only(bs)) {
qcow2_mark_clean(bs);
}
diff -Nru qemu-10.0.12+ds/contrib/vhost-user-gpu/vhost-user-gpu.c qemu-10.0.13+ds/contrib/vhost-user-gpu/vhost-user-gpu.c
--- qemu-10.0.12+ds/contrib/vhost-user-gpu/vhost-user-gpu.c 2026-07-25 01:10:13.000000000 +0300
+++ qemu-10.0.13+ds/contrib/vhost-user-gpu/vhost-user-gpu.c 2026-08-26 22:31:25.000000000 +0300
@@ -388,7 +388,13 @@
cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
return;
}
- vugbm_buffer_create(&res->buffer, &g->gdev, c2d.width, c2d.height);
+ if (!vugbm_buffer_create(&res->buffer, &g->gdev, c2d.width, c2d.height)) {
+ g_critical("%s: buffer creation failed %d %d %d",
+ __func__, c2d.resource_id, c2d.width, c2d.height);
+ g_free(res);
+ cmd->error = VIRTIO_GPU_RESP_ERR_OUT_OF_MEMORY;
+ return;
+ }
res->image = pixman_image_create_bits(pformat,
c2d.width,
c2d.height,
@@ -924,16 +930,19 @@
if (len != sizeof(cmd->cmd_hdr)) {
g_warning("%s: command size incorrect %zu vs %zu\n",
__func__, len, sizeof(cmd->cmd_hdr));
- }
-
- virtio_gpu_ctrl_hdr_bswap(&cmd->cmd_hdr);
- g_debug("%d %s\n", cmd->cmd_hdr.type,
- vg_cmd_to_string(cmd->cmd_hdr.type));
-
- if (vg->virgl) {
- vg_virgl_process_cmd(vg, cmd);
+ memset(&cmd->cmd_hdr, 0, sizeof(cmd->cmd_hdr));
+ vg_ctrl_response_nodata(
+ vg, cmd, VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER);
} else {
- vg_process_cmd(vg, cmd);
+ virtio_gpu_ctrl_hdr_bswap(&cmd->cmd_hdr);
+ g_debug("%d %s\n", cmd->cmd_hdr.type,
+ vg_cmd_to_string(cmd->cmd_hdr.type));
+
+ if (vg->virgl) {
+ vg_virgl_process_cmd(vg, cmd);
+ } else {
+ vg_process_cmd(vg, cmd);
+ }
}
if (cmd->state != VG_CMD_STATE_FINISHED) {
diff -Nru qemu-10.0.12+ds/contrib/vhost-user-gpu/vugbm.c qemu-10.0.13+ds/contrib/vhost-user-gpu/vugbm.c
--- qemu-10.0.12+ds/contrib/vhost-user-gpu/vugbm.c 2026-07-25 01:10:13.000000000 +0300
+++ qemu-10.0.13+ds/contrib/vhost-user-gpu/vugbm.c 2026-08-26 22:31:25.000000000 +0300
@@ -13,7 +13,7 @@
static bool
mem_alloc_bo(struct vugbm_buffer *buf)
{
- buf->mmap = g_malloc(buf->width * buf->height * 4);
+ buf->mmap = g_malloc((uint64_t)buf->width * buf->height * 4);
buf->stride = buf->width * 4;
return true;
}
@@ -53,7 +53,8 @@
static size_t
udmabuf_get_size(struct vugbm_buffer *buf)
{
- return ROUND_UP(buf->width * buf->height * 4, qemu_real_host_page_size());
+ return ROUND_UP((uint64_t)buf->width * buf->height * 4,
+ qemu_real_host_page_size());
}
static bool
@@ -293,6 +294,12 @@
vugbm_buffer_create(struct vugbm_buffer *buffer, struct vugbm_device *dev,
uint32_t width, uint32_t height)
{
+ uint64_t size = (uint64_t)width * height * 4;
+ if (size > UINT32_MAX) {
+ g_warning("buffer dimensions too large: %ux%u", width, height);
+ return false;
+ }
+
buffer->dev = dev;
buffer->width = width;
buffer->height = height;
diff -Nru qemu-10.0.12+ds/contrib/vhost-user-gpu/vugpu.h qemu-10.0.13+ds/contrib/vhost-user-gpu/vugpu.h
--- qemu-10.0.12+ds/contrib/vhost-user-gpu/vugpu.h 2026-07-25 01:10:13.000000000 +0300
+++ qemu-10.0.13+ds/contrib/vhost-user-gpu/vugpu.h 2026-08-26 22:31:25.000000000 +0300
@@ -179,6 +179,7 @@
if (vugpufillcmd_s_ != sizeof(out)) { \
g_critical("%s: command size incorrect %zu vs %zu", \
__func__, vugpufillcmd_s_, sizeof(out)); \
+ cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER; \
return; \
} \
} while (0)
diff -Nru qemu-10.0.12+ds/disas/riscv-xthead.c qemu-10.0.13+ds/disas/riscv-xthead.c
--- qemu-10.0.12+ds/disas/riscv-xthead.c 2026-07-25 01:10:13.000000000 +0300
+++ qemu-10.0.13+ds/disas/riscv-xthead.c 2026-08-26 22:31:25.000000000 +0300
@@ -189,7 +189,7 @@
{ "th.mulsh", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
/* XTheadMemIdx */
{ "th.lbia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
- { "th.lbib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml, NULL, 0, 0, 0 },
+ { "th.lbib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
{ "th.lbuia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
{ "th.lbuib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
{ "th.lhia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
@@ -315,8 +315,10 @@
op = rv_op_th_revw;
}
break;
- case 0b0000100:
- case 0b0000101: op = rv_op_th_srri; break;
+ case 0b0001000:
+ case 0b0001001:
+ op = rv_op_th_srri;
+ break;
}
break;
case 2: op = rv_op_th_ext; break;
diff -Nru qemu-10.0.12+ds/disas/riscv.c qemu-10.0.13+ds/disas/riscv.c
--- qemu-10.0.12+ds/disas/riscv.c 2026-07-25 01:10:13.000000000 +0300
+++ qemu-10.0.13+ds/disas/riscv.c 2026-08-26 22:31:25.000000000 +0300
@@ -1801,19 +1801,19 @@
{ "vxor.vi", rv_codec_v_i, rv_fmt_vd_vs2_imm_vm, NULL, 0, 0, 0 },
{ "vsll.vv", rv_codec_v_r, rv_fmt_vd_vs2_vs1_vm, NULL, 0, 0, 0 },
{ "vsll.vx", rv_codec_v_r, rv_fmt_vd_vs2_rs1_vm, NULL, 0, 0, 0 },
- { "vsll.vi", rv_codec_v_i, rv_fmt_vd_vs2_uimm_vm, NULL, 0, 0, 0 },
+ { "vsll.vi", rv_codec_v_i_u, rv_fmt_vd_vs2_uimm_vm, NULL, 0, 0, 0 },
{ "vsrl.vv", rv_codec_v_r, rv_fmt_vd_vs2_vs1_vm, NULL, 0, 0, 0 },
{ "vsrl.vx", rv_codec_v_r, rv_fmt_vd_vs2_rs1_vm, NULL, 0, 0, 0 },
- { "vsrl.vi", rv_codec_v_i, rv_fmt_vd_vs2_uimm_vm, NULL, 0, 0, 0 },
+ { "vsrl.vi", rv_codec_v_i_u, rv_fmt_vd_vs2_uimm_vm, NULL, 0, 0, 0 },
{ "vsra.vv", rv_codec_v_r, rv_fmt_vd_vs2_vs1_vm, NULL, 0, 0, 0 },
{ "vsra.vx", rv_codec_v_r, rv_fmt_vd_vs2_rs1_vm, NULL, 0, 0, 0 },
- { "vsra.vi", rv_codec_v_i, rv_fmt_vd_vs2_uimm_vm, NULL, 0, 0, 0 },
+ { "vsra.vi", rv_codec_v_i_u, rv_fmt_vd_vs2_uimm_vm, NULL, 0, 0, 0 },
{ "vnsrl.wv", rv_codec_v_r, rv_fmt_vd_vs2_vs1_vm, NULL, 0, 0, 0 },
{ "vnsrl.wx", rv_codec_v_r, rv_fmt_vd_vs2_rs1_vm, NULL, 0, 0, 0 },
- { "vnsrl.wi", rv_codec_v_i, rv_fmt_vd_vs2_uimm_vm, NULL, 0, 0, 0 },
+ { "vnsrl.wi", rv_codec_v_i_u, rv_fmt_vd_vs2_uimm_vm, NULL, 0, 0, 0 },
{ "vnsra.wv", rv_codec_v_r, rv_fmt_vd_vs2_vs1_vm, NULL, 0, 0, 0 },
{ "vnsra.wx", rv_codec_v_r, rv_fmt_vd_vs2_rs1_vm, NULL, 0, 0, 0 },
- { "vnsra.wi", rv_codec_v_i, rv_fmt_vd_vs2_uimm_vm, NULL, 0, 0, 0 },
+ { "vnsra.wi", rv_codec_v_i_u, rv_fmt_vd_vs2_uimm_vm, NULL, 0, 0, 0 },
{ "vmseq.vv", rv_codec_v_r, rv_fmt_vd_vs2_vs1_vm, NULL, 0, 0, 0 },
{ "vmseq.vx", rv_codec_v_r, rv_fmt_vd_vs2_rs1_vm, NULL, 0, 0, 0 },
{ "vmseq.vi", rv_codec_v_i, rv_fmt_vd_vs2_imm_vm, NULL, 0, 0, 0 },
@@ -1907,16 +1907,16 @@
{ "vsmul.vx", rv_codec_v_r, rv_fmt_vd_vs2_rs1_vm, NULL, 0, 0, 0 },
{ "vssrl.vv", rv_codec_v_r, rv_fmt_vd_vs2_vs1_vm, NULL, 0, 0, 0 },
{ "vssrl.vx", rv_codec_v_r, rv_fmt_vd_vs2_rs1_vm, NULL, 0, 0, 0 },
- { "vssrl.vi", rv_codec_v_i, rv_fmt_vd_vs2_uimm_vm, NULL, 0, 0, 0 },
+ { "vssrl.vi", rv_codec_v_i_u, rv_fmt_vd_vs2_uimm_vm, NULL, 0, 0, 0 },
{ "vssra.vv", rv_codec_v_r, rv_fmt_vd_vs2_vs1_vm, NULL, 0, 0, 0 },
{ "vssra.vx", rv_codec_v_r, rv_fmt_vd_vs2_rs1_vm, NULL, 0, 0, 0 },
- { "vssra.vi", rv_codec_v_i, rv_fmt_vd_vs2_uimm_vm, NULL, 0, 0, 0 },
+ { "vssra.vi", rv_codec_v_i_u, rv_fmt_vd_vs2_uimm_vm, NULL, 0, 0, 0 },
{ "vnclipu.wv", rv_codec_v_r, rv_fmt_vd_vs2_vs1_vm, NULL, 0, 0, 0 },
{ "vnclipu.wx", rv_codec_v_r, rv_fmt_vd_vs2_rs1_vm, NULL, 0, 0, 0 },
- { "vnclipu.wi", rv_codec_v_i, rv_fmt_vd_vs2_uimm_vm, NULL, 0, 0, 0 },
+ { "vnclipu.wi", rv_codec_v_i_u, rv_fmt_vd_vs2_uimm_vm, NULL, 0, 0, 0 },
{ "vnclip.wv", rv_codec_v_r, rv_fmt_vd_vs2_vs1_vm, NULL, 0, 0, 0 },
{ "vnclip.wx", rv_codec_v_r, rv_fmt_vd_vs2_rs1_vm, NULL, 0, 0, 0 },
- { "vnclip.wi", rv_codec_v_i, rv_fmt_vd_vs2_uimm_vm, NULL, 0, 0, 0 },
+ { "vnclip.wi", rv_codec_v_i_u, rv_fmt_vd_vs2_uimm_vm, NULL, 0, 0, 0 },
{ "vfadd.vv", rv_codec_v_r, rv_fmt_vd_vs2_vs1_vm, NULL, 0, 0, 0 },
{ "vfadd.vf", rv_codec_v_r, rv_fmt_vd_vs2_fs1_vm, NULL, 0, 0, 0 },
{ "vfsub.vv", rv_codec_v_r, rv_fmt_vd_vs2_vs1_vm, NULL, 0, 0, 0 },
@@ -2046,15 +2046,15 @@
{ "vfmv.f.s", rv_codec_v_r, rv_fmt_fd_vs2, NULL, 0, 0, 0 },
{ "vfmv.s.f", rv_codec_v_r, rv_fmt_vd_fs1, NULL, 0, 0, 0 },
{ "vslideup.vx", rv_codec_v_r, rv_fmt_vd_vs2_rs1_vm, NULL, 0, 0, 0 },
- { "vslideup.vi", rv_codec_v_i, rv_fmt_vd_vs2_uimm_vm, NULL, 0, 0, 0 },
+ { "vslideup.vi", rv_codec_v_i_u, rv_fmt_vd_vs2_uimm_vm, NULL, 0, 0, 0 },
{ "vslide1up.vx", rv_codec_v_r, rv_fmt_vd_vs2_rs1_vm, NULL, 0, 0, 0 },
{ "vslidedown.vx", rv_codec_v_r, rv_fmt_vd_vs2_rs1_vm, NULL, 0, 0, 0 },
- { "vslidedown.vi", rv_codec_v_i, rv_fmt_vd_vs2_uimm_vm, NULL, 0, 0, 0 },
+ { "vslidedown.vi", rv_codec_v_i_u, rv_fmt_vd_vs2_uimm_vm, NULL, 0, 0, 0 },
{ "vslide1down.vx", rv_codec_v_r, rv_fmt_vd_vs2_rs1_vm, NULL, 0, 0, 0 },
{ "vrgather.vv", rv_codec_v_r, rv_fmt_vd_vs2_vs1_vm, NULL, 0, 0, 0 },
{ "vrgatherei16.vv", rv_codec_v_r, rv_fmt_vd_vs2_vs1_vm, NULL, 0, 0, 0 },
{ "vrgather.vx", rv_codec_v_r, rv_fmt_vd_vs2_rs1_vm, NULL, 0, 0, 0 },
- { "vrgather.vi", rv_codec_v_i, rv_fmt_vd_vs2_uimm_vm, NULL, 0, 0, 0 },
+ { "vrgather.vi", rv_codec_v_i_u, rv_fmt_vd_vs2_uimm_vm, NULL, 0, 0, 0 },
{ "vcompress.vm", rv_codec_v_r, rv_fmt_vd_vs2_vs1, NULL, 0, 0, 0 },
{ "vmv1r.v", rv_codec_v_r, rv_fmt_vd_vs2, NULL, 0, 0, 0 },
{ "vmv2r.v", rv_codec_v_r, rv_fmt_vd_vs2, NULL, 0, 0, 0 },
@@ -2142,8 +2142,8 @@
{ "vaesef.vs", rv_codec_v_r, rv_fmt_vd_vs2, NULL, 0, 0, 0 },
{ "vaesem.vv", rv_codec_v_r, rv_fmt_vd_vs2, NULL, 0, 0, 0 },
{ "vaesem.vs", rv_codec_v_r, rv_fmt_vd_vs2, NULL, 0, 0, 0 },
- { "vaeskf1.vi", rv_codec_v_i, rv_fmt_vd_vs2_uimm, NULL, 0, 0, 0 },
- { "vaeskf2.vi", rv_codec_v_i, rv_fmt_vd_vs2_uimm, NULL, 0, 0, 0 },
+ { "vaeskf1.vi", rv_codec_v_i_u, rv_fmt_vd_vs2_uimm, NULL, 0, 0, 0 },
+ { "vaeskf2.vi", rv_codec_v_i_u, rv_fmt_vd_vs2_uimm, NULL, 0, 0, 0 },
{ "vaesz.vs", rv_codec_v_r, rv_fmt_vd_vs2, NULL, 0, 0, 0 },
{ "vandn.vv", rv_codec_v_r, rv_fmt_vd_vs2_vs1_vm, NULL, 0, 0, 0 },
{ "vandn.vx", rv_codec_v_r, rv_fmt_vd_vs2_rs1_vm, NULL, 0, 0, 0 },
@@ -2167,14 +2167,14 @@
{ "vsha2ch.vv", rv_codec_v_r, rv_fmt_vd_vs2_vs1, NULL, 0, 0, 0 },
{ "vsha2cl.vv", rv_codec_v_r, rv_fmt_vd_vs2_vs1, NULL, 0, 0, 0 },
{ "vsha2ms.vv", rv_codec_v_r, rv_fmt_vd_vs2_vs1, NULL, 0, 0, 0 },
- { "vsm3c.vi", rv_codec_v_i, rv_fmt_vd_vs2_uimm, NULL, 0, 0, 0 },
+ { "vsm3c.vi", rv_codec_v_i_u, rv_fmt_vd_vs2_uimm, NULL, 0, 0, 0 },
{ "vsm3me.vv", rv_codec_v_r, rv_fmt_vd_vs2_vs1, NULL, 0, 0, 0 },
- { "vsm4k.vi", rv_codec_v_i, rv_fmt_vd_vs2_uimm, NULL, 0, 0, 0 },
+ { "vsm4k.vi", rv_codec_v_i_u, rv_fmt_vd_vs2_uimm, NULL, 0, 0, 0 },
{ "vsm4r.vv", rv_codec_v_r, rv_fmt_vd_vs2, NULL, 0, 0, 0 },
{ "vsm4r.vs", rv_codec_v_r, rv_fmt_vd_vs2, NULL, 0, 0, 0 },
{ "vwsll.vv", rv_codec_v_r, rv_fmt_vd_vs2_vs1_vm, NULL, 0, 0, 0 },
{ "vwsll.vx", rv_codec_v_r, rv_fmt_vd_vs2_rs1_vm, NULL, 0, 0, 0 },
- { "vwsll.vi", rv_codec_v_i, rv_fmt_vd_vs2_uimm_vm, NULL, 0, 0, 0 },
+ { "vwsll.vi", rv_codec_v_i_u, rv_fmt_vd_vs2_uimm_vm, NULL, 0, 0, 0 },
{ "amocas.w", rv_codec_r_a, rv_fmt_aqrl_rd_rs2_rs1, NULL, 0, 0, 0 },
{ "amocas.d", rv_codec_r_a, rv_fmt_aqrl_rd_rs2_rs1, NULL, 0, 0, 0 },
{ "amocas.q", rv_codec_r_a, rv_fmt_aqrl_rd_rs2_rs1, NULL, 0, 0, 0 },
@@ -2972,8 +2972,16 @@
case 0b01100: op = rv_op_rori; break;
case 0b01101:
switch ((inst >> 20) & 0b1111111) {
- case 0b0011000: op = rv_op_rev8; break;
- case 0b0111000: op = rv_op_rev8; break;
+ case 0b0011000:
+ if (isa == rv32) {
+ op = rv_op_rev8;
+ }
+ break;
+ case 0b0111000:
+ if (isa == rv64) {
+ op = rv_op_rev8;
+ }
+ break;
case 0b0000111: op = rv_op_brev8; break;
}
break;
@@ -3182,9 +3190,10 @@
case 14: op = rv_op_rem; break;
case 15: op = rv_op_remu; break;
case 36:
- switch ((inst >> 20) & 0b11111) {
- case 0: op = rv_op_zext_h; break;
- default: op = rv_op_pack; break;
+ if (isa == rv32 && !((inst >> 20) & 0b11111)) {
+ op = rv_op_zext_h;
+ } else {
+ op = rv_op_pack;
}
break;
case 39: op = rv_op_packh; break;
@@ -4479,11 +4488,16 @@
((inst << 57) >> 62) << 6;
}