QemuInputEvent now stores Linux key codes for key events. Use those
codes directly instead of translating between internal key code
representations.
Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20260520-input-v3-7-7c9e4c7abe34@rsg.ci.i.u-tokyo.ac.jp>
Add a text console helper that accepts Linux input key codes and use it
as the common implementation for qemu_text_console_put_qcode(). This lets
callers that already use Linux key codes avoid converting them back to
QKeyCode.
Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20260520-input-v3-6-7c9e4c7abe34@rsg.ci.i.u-tokyo.ac.jp>
xenfb and virtio-input no longer need key mapping because they operate
on Linux key codes, but removing the key mapping code loses the ability
to filter out KEY_RESERVED. Drop KEY_RESERVED at the common input event
entry point so the logic is shared by both devices and no downstream
input handler receives KEY_RESERVED accidentally.
Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20260520-input-v3-5-7c9e4c7abe34@rsg.ci.i.u-tokyo.ac.jp>
Linux input key codes are a better internal representation than
QKeyCode:
- With Linux input key codes as the internal representation, keys
previously lost solely because the middle layer between event sources
and sinks used QKeyCode will be preserved, since Linux key codes
cover all keys that those sources and sinks use. For example,
KEY_KPJPCOMMA cannot be represented with QKeyCode, but it is widely
supported by event sources and sinks since it is included in linux,
atset1, atset2, usb, x11, osx, qnum (derived from atset1),
xorgxquartz, and xorgevdev (derived from linux).
- They make it possible to pass through Linux host key codes to Linux
guests to preserve all key inputs.
- They simplify consumers by avoiding QKeyCode aliases, namely
asterisk/kp_multiply and sysrq/print.
This matches the approach used by virtio and Xen.
Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20260520-input-v3-4-7c9e4c7abe34@rsg.ci.i.u-tokyo.ac.jp>
Since commit af07e5ff02 ("ui: convert key events to QKeyCodes
immediately"), all internal key events are expected to be represented as
QKeyCode. Replace KeyValue in QemuInputKeyEvent with QKeyCode to enforce
that and simplify key code retrieval.
Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20260520-input-v3-3-7c9e4c7abe34@rsg.ci.i.u-tokyo.ac.jp>
QAPI represents union members with wrapper structs and pointer
indirections. They are useful at the QMP boundary, but unnecessary for
QEMU's internal input events and make handlers more verbose.
Define QemuInputEvent as a plain internal tagged union and convert input
handlers, queues, and replay code to access payloads directly.
Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20260520-input-v3-2-7c9e4c7abe34@rsg.ci.i.u-tokyo.ac.jp>
Add QemuInputEvent as the input subsystem's name for InputEvent and use
it in input handler, queue, and replay interfaces.
This prepares for decoupling QEMU's internal input event representation
from the QAPI InputEvent type.
Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20260520-input-v3-1-7c9e4c7abe34@rsg.ci.i.u-tokyo.ac.jp>
QEMU's VNC extended clipboard handler inflates a client-controlled
compressed clipboard payload. The code checks the declared text size
against the total inflated buffer size:
if (tsize < size)
but then copies from:
tbuf = buf + 4;
qemu_clipboard_set_data(..., tsize, tbuf, true);
The correct bound is the remaining data length after the 4-byte length
field, not the total inflated buffer length.
As a result, a VNC client can make QEMU copy up to 3 bytes past the end
of the inflated heap buffer. With a second VNC client, those copied
bytes are observable through the normal VNC extended clipboard PROVIDE
path.
Fixes: CVE-2026-8343
Reported-by: Heechan Kang <gganji11@naver.com>
Reported-by: Feifan Qian <bea1e@proton.me>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Heechan Kang <gganji11@naver.com>
[DB: added #include and 'return' statements]
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20260512095543.459949-1-berrange@redhat.com>
Incorrect loop bounds in vnc_update_freq result in iterating past the
last row and past the last column in the VNC stats array. With suitably
chosen dimensions this could be a OOB read that accesses memory beyond
the VncDisplay struct that the stats array is embedded in.
Should this hit a guard page, it could trigger a guest crash. If it
does not, then the VNC frequency stats will be updated with garbage.
Fixes: CVE-2026-48003
Reported-by: boy juju <agx1657748706@gmail.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20260521103353.1645561-5-berrange@redhat.com>
Incorrect calculation of the boundary condition when tracking lossy
rectangles in the worker thread will result in an OOB write which
can corrupt further worker state, and/or trigger any guard pages
that may lie beyond the VncWorker struct. This can be triggered
through careful choice of the display resolution in the guest
OS by an unprivileged user.
Fixes: CVE-2026-48002
Reported-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20260521103353.1645561-4-berrange@redhat.com>
[Marc-André - added assert() suggest by philmd@linaro.org]
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
The VncSurface struct maintains update statistics in an array:
VncRectStat stats[VNC_STAT_ROWS][VNC_STAT_COLS];
where the dimensions are defined as:
#define VNC_STAT_RECT 64
#define VNC_STAT_COLS (VNC_MAX_WIDTH / VNC_STAT_RECT)
#define VNC_STAT_ROWS (VNC_MAX_HEIGHT / VNC_STAT_RECT)
If VNC_MAX_WIDTH / VNC_MAX_HEIGHT are not an exact multiple of
VNC_STAT_REC, the COLS/ROWS will be undersized by 1.
Unfortunately:
#define VNC_MAX_HEIGHT 2160
is not a multiple of 64, so there is potential for OOB reads and
writes in the 'stats' array, if the guest surface is over 2112
pixels in height. An array overflow occurs when vnc_update_stats()
records new statistics, either scribbling over data later in the
VncDisplay struct that 'stats' is embedded in, or performing an
OOB write on the allocated struct memory.
Fixes: CVE-2026-48002
Reported-by: boy juju <agx1657748706@gmail.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20260521103353.1645561-3-berrange@redhat.com>
When reading the SASL mechname array off the VNC connection, if
malicious, the received data may contain embedded NULs. If this
happens the memory buffer returned by g_strndup may be shorter
than the original data. Unfortunately the code continued to
index into this buffer with an offset equal to the original
length. This is a potential OOB read of the array.
Fixes: 5847d9e1 (ui/vnc: simplify and avoid strncpy)
Reported-by: boy juju <agx1657748706@gmail.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20260521103353.1645561-2-berrange@redhat.com>
vt100_fini() is called unconditonally from qemu_text_console_finalize(),
but it may not have been vt100_init()/opened: fix the crash in that case.
Fixes: 8fa294482e ("ui/console-vc: move VT100 state machine ...")
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
The bh_utf8_decode() UTF8 decoder takes its next byte as a "uint32_t
byte" parameter, but it assumes it to be in bounds as it immediately
indexes into its array with it.
Use "uint8_t" as the argument type instead. This moves us away from
the upstream implementation slightly, but it is the same type as
we use in the one callsite, and it makes it clear that we can't
be indexing off the end of the array with this guest-derived data.
This probably helps make Coverity a bit happier (CID 1659590).
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20260512104210.3330835-3-peter.maydell@linaro.org>
The vt100 code is rather confused about how it handles bytes of data
to be sent to the terminal:
* vt100_input() takes a buffer of uint8_t
* each byte is passed to vt100_putchar(), which takes "int ch"
* that calls vt100_put_one(), which also takes "int ch"
* vt100_put_one() sets TextCell::ch, which is uint8_t again
* various places pass the TextCell:ch value to vt100_putcharxy(),
which takes "int ch" again, but uses it unchecked as an
index into a 256-entry array
This confuses Coverity (e.g. CID 1659590) and the reader, who may be
unsure whether the "int" variable really does hold only valid byte
values 0..255 and whether we need to bounds-check before doing array
dereferences.
Standardize on keeping known-byte data in uint8_t all the way
through.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20260512104210.3330835-2-peter.maydell@linaro.org>
RISC-V PR for 11.1.
* Remove spike as default machine
* Deprecate the shakti_c machine
* Set MISA.[C|X] based on the selected extensions
* Update Maintainers for OpenSBI Firmware
* Update OpenSBI to v1.8.1
* Avoid RISCVCPU copy in PMU FDT setup
* A collection of specification compliance improvements
* Fix Svnapot 64KB pages
* Handle source overlap of vector widening reduction instructions
* Check interrupt in SiFive UART after txctrl register is written
* Fix medeleg[11] read-only zero bit for M-mode ECALL
* Fix tail handling for vmv.s.x and vfmv.s.f
* Update the local AIA interrupt mask
* Add KVM support for Zicbop and BFloat16 extensions
* Fix the IOMMU FSC SV32 capability check
* Avoid caching PCI device IDs in the IOMMU
* Implement Microchip mpfs ioscb PLLs and sysreg clock dividers
* Remove the internal CPU riscv_cpu_* arrays
* Fix IOCOUNTINH.CY toggle detection
* Fix the read of pmpaddr(0-63) CSRs
* Make hpmcounterh return the upper 32-bits
* Minor fixes and enhancements of RISC-V AIA devices
* Re-process IOMMU command queue after clearing CMD_ILL
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEaukCtqfKh31tZZKWr3yVEwxTgBMFAmoPnQkACgkQr3yVEwxT
# gBMudxAAvN8XD1zauMzk62tkXCmVA5fjqtTqu4Ytp8Pe3P7ZX9FZP6Alcw+G+zEd
# QQdIeHTzxzs77LO5VLKlLS807W5by9eMQDPOWvCRk2rQWJfgbxYq//dJNOPpJfR1
# ptDsvnxonfn8lh34Bm7nI+UaznRVSr3mSts8LN5R9GANLHRPYbJbtSRb2qSGBPzP
# ynNvuD0tmt9gXf+j9O9qr5DkoRoiZdoRTGdQ9a/eWlxP/eNvPzq0c74ToPpz3Obv
# 6z/ICImKZGL36W8B73FbGy30EySihdPTcLSQHqsUZ+mYtj+6WGtIbIoZkaugnfml
# M8DuukT6sO8GdZy7cFnxhThsnZ+HEylzpjHHWYJlvY9uUniM0wrCavCc0lvUm71A
# Mi0yASlmv6kXotxtmz+UZF6/h7vTJHXvEo/g9cwshSVjxYDhHf8GtIYVegLTTeoP
# z1UfpdepH6fe9E8cf6DUSwr1syODSf0qjiKVMVMxb/OMEk3qEB0uwbG+X1Ecs9s1
# SQo6cp5TdiSjzP87MyMDeTeaS6FQrkVEkXXgcpFf1W/R0zRuj/JW89sGCJvS7Tqk
# +bH4pNnzXTBNxuGrb3zZSC0yWdroSiqyT+9g/JlQMY9tBvnoY8p7Ck7g07nLhVSf
# Cj4C0SXRMSj8eHn2+pDqjZn1RUfG2mRAD+8yYWqZ2GvU2X/yhx8=
# =SSwl
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 21 May 2026 20:02:17 EDT
# gpg: using RSA key 6AE902B6A7CA877D6D659296AF7C95130C538013
# gpg: Good signature from "Alistair Francis <alistair@alistair23.me>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 6AE9 02B6 A7CA 877D 6D65 9296 AF7C 9513 0C53 8013
* tag 'pull-riscv-to-apply-20260522' of https://github.com/alistair23/qemu: (48 commits)
hw/riscv: riscv-iommu: Re-process command queue after clearing CMD_ILL
hw/intc: riscv_aplic: add trace events of APLIC read/write function
hw/intc: riscv_imsic: Add reset API to IMSIC
hw/intc: riscv_aplic: Add reset API to APLIC
hw/intc: riscv_aplic: Fix level trigger IRQ in direct delivery mode
target/riscv: Make hpmcounterh return the upper 32-bits
hw/riscv/virt-acpi-build: Fix off-by-one error in RIMT ID mapping
target/riscv/csr.c: fix read of pmpaddr(0-63) CSRs
hw/riscv/riscv-iommu: Fix IOCOUNTINH.CY toggle detection
target/riscv/cpu: remove riscv_cpu_* arrays
target/riscv/tcg: use isa_edata_arr[] to create user props
target/riscv: do not set defaults in cpu prop callback
target/riscv/tcg: use cfg_offset as cpu_set_multi_ext cb opaque
target/riscv/tcg: use isa_edata_arr[] to enable max exts
target/riscv/kvm: use isa_edata_arr[] for unavailable props
target/riscv/tcg: use isa_edata_arr[] in riscv_cpu_update_misa_x()
target/riscv: remove riscv_cpu_named_features[]
target/riscv/cpu.c: remove riscv_cpu_enable_named_feat()
target/riscv/tcg: use only isa_edata_arr[] in cpu_cfg_ext_get_name()
target/riscv/tcg: treat all exts equally in cpu_disable_priv_spec_isa_exts
...
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Misc patches for iotests, qom, crypt & io
* Fix client side anoymous TLS credentials
* Fix return value semantics for qio_channel_flush
* Add ID validation of internal QOM constructor
* Fix ability to create internal QOM objects
without a parent
* Merge user creatable object constructor into
main QOM file
* Print reason for skipping I/O tests
* Remove redundant meson suits for I/O tests
* Add optional suites for many block drivers I/O tests
* Run I/O tests for 10 block drivers in GitLab CI
* Fix sudo check for LUKS I/O test
* Mark I/O test 151, 181, 185, 308 as flaky
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEE2vOm/bJrYpEtDo4/vobrtBUQT98FAmoPDUkACgkQvobrtBUQ
# T9+ZGQ/+PUFHFBgKHqb8kVNpKE1MJ+FDiwgRKHq0oSHdyO+lTzbAUZOM/2B/VSTu
# vJijLHEGalCRjMoZgRcRVtXaJGKoem7tXTe/giX+CiULSAD8cHcZ657imzPmjEPk
# +oEPgTRpbPTWbxgUS6Y5lztYgJz84Tkhs/lTr3Y8mOHUcVPJXYe0OClP+DXQJvu4
# I12EkKUA7+FA1UiwYR0Hkq5ZfED48VygVnCVpb12ggri3BrwAuk9SNaAGbz0EbNm
# uYrmneLVAey/Y3XW9NxJ056KNF10Mpcmj2lhJuUu9lyfw/jNeicwESC6MNEMK0Pq
# ttq9t3J+osotwElrFnrh7tWusGDloJArpcZbL6xNQ5r3vDrlnviUeUJZOfs7wDLZ
# LOFhi0xJLN3Gk9Cms+xcaTmQRf5/1DBZUTxG3vFqqjNzNOzuJOPseviXw5lDau2g
# sTVPX77VpOCV8JJoetZuoloBOxiLB4fbt4uY812t4Ru5vrt2o7F36aeBekgRB9lZ
# SvS+fuj5rLiPjvLoI76HQ8uzEDtJGp7h3LoIDO47pQJRZ7jfc6kbLioZptmxlfSf
# i5LEa/hido+o11QvnEZ8aMfdUoQZAJsHtNLrzPwOl1NnFBYmX/GBk2vO6xrmoqUO
# aykd/gWzH/NhZ3eq+cZlI4iEQSOaLFySzq39jdz77bBAzhI38nI=
# =Onca
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 21 May 2026 09:48:57 EDT
# gpg: using RSA key DAF3A6FDB26B62912D0E8E3FBE86EBB415104FDF
# gpg: Good signature from "Daniel P. Berrange <dan@berrange.com>" [full]
# gpg: aka "Daniel P. Berrange <berrange@redhat.com>" [full]
# Primary key fingerprint: DAF3 A6FD B26B 6291 2D0E 8E3F BE86 EBB4 1510 4FDF
* tag 'misc-next-pull-request' of https://gitlab.com/berrange/qemu: (29 commits)
qom: drop user_creatable_add_type method
qom: allow object_new_with_prop* to trigger module loading
qom: fix ability to create objects without a parent
qom: add object_new_with_props_from_qdict
qom: move object_set_prop_keyval into object.c
qom: have object_set_props_keyval return bool
qom: shorten name of object_set_properties_from_keyval
qom: make errp last param in methods taking va_list
qom: validate ID format when creating objects
hw/vfio-user: use a valid object ID for iothread
qom: add trace events for object/property lifecycle
gitlab: remove I/O tests from build-tcg-disabled job
gitlab: add jobs for thorough block tests
iotests: mark 151, 181, 185 & 308 as flaky tests
iotests: fix check for sudo access in LUKS I/O test
iotests: validate dmsetup result in test 128
iotests: use 'driver' as collective term for either format or protocol
iotests: add nbd and luks to the I/O test suites
docs/devel/testing: expand documentation for 'make check-block'
iotests: add a meson suite / make target per block I/O tests format
...
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Allow target access to routines using the minmax flags.
Make the existing min/max wrappers inline.
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
There is only one NaN fractional encoding for E4M3. Retain the
incoming sign, but force the outgoing fraction to the unique value.
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Introduce a separate control from float_snan_rule
that applies only to the OCP E4M3 format.
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Use bitfields to compress float_status from 18 bytes down to 8 bytes.
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Move get_float_default_nan_pattern to softfloat-specialize.c.inc,
since there are no external users.
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Drop FloatFTZDetection and use #defines, like we do for
tininess_before_rounding. Rename get_float_ftz_detection
to get_ftz_before_rounding and move to softfloat.c, as
there are no external users.
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Rename get_float_detect_tininess to get_tininess_before_rounding
and move to softfloat.c, as there are no external users.
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Unify handling of the two snan parameters, letting the
caller simply extract the msb.
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
We have, in the past, used any of uint8_t, uint16_t or int
to hold the set of exception flags. Use a typedef instead.
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Don't peek into float_status internals.
Fix the helper calls that were missing an argument.
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Avoid exponent overflow as well as checking that we don't lose information with
opposing scaling. Use it in partsN(scalbn) and partsN(round_to_int_normal).
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Now that we've exposed enough infrastructure, this can be
implemented in the backend that needs it.
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Consolidate the tests for zero and anynorm.
Add comments for a few cases.
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
The nan test had been down below because it was unlikely.
But if we have to have one anyway because of denormals,
we might as well take care of them right away.
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
