Merge tag 'for-upstream' of https://gitlab.com/kmwolf/qemu into staging

Block layer patches

- ide: Fix potential assertion failure on VM stop for PIO read error
- scsi: Don't consider LOGICAL UNIT NOT SUPPORTED guest recoverable
- vhost-user-blk-server: fix opt_io_size=1 causing severe Windows I/O degradation
- monitor: Fix deadlock in monitor_cleanup
- Fix filename references in comments

# -----BEGIN PGP SIGNATURE-----
#
# iQJFBAABCgAvFiEE3D3rFZqa+V09dFb+fwmycsiPL9YFAmnL4dURHGt3b2xmQHJl
# ZGhhdC5jb20ACgkQfwmycsiPL9aG/BAAiZ1XYu46Ct9+IdopoPYhEK+T7m7PuEUR
# KJPvdp0J6mVwVBehUjacmKvCtBQUbUF8x7PD6NMF3Q+7qkVqhmngbb4s5ks/zUQi
# MxZTJF1Yps9EZ6mI3bA6caV9PzegQSOA4p+RhOXaDt7lhXhBFt6lCVFVB5eCma+a
# 1dOxAbKD6geftaMvB1uQu5qYAtclATw1Gl4YSkdaO+UKGizce6YdKYOvFwU53EvO
# 4cRrrVzk7i5act61HcwT6xNSFJ+Fgmwcn+EiD0Uw/hOFzf8nXNS0DME7QJKjr6Ug
# Adv/439sUk5J1A//S3liSQ8D9SZBdi2yS7quMy4ggbwz9CqQvUi3ejenpOJtn8yG
# ylyhHmd4dnr8QC1Zf/3SbZ1hbLWn69y+rmV+e2uJF59bpWRMvqxeJX+D4DPe5LZp
# E8pckNmqkqkBfsPuM0nzW5qdPmkioZ+i2pEgAQ99tkUlcfFLvrlEaCr9AVKgDcZn
# B2HjaZPLrZtXEKMtKM4RXt7h8F33Zxnvy8chSdqW6J0BaWvPtFO7bJn2elAgibum
# ZBigvhfwkw9xxzlGmudTbNMz8Fnpc/KBue8bhzDkOe4AybcVwuefG3VIyI8tLkG9
# IoHxbeQM6+yHXjrvn3OLWLJ7HQ0EyBsRE9cpZN4p/3rSS5G7RWfNdAIuzwLamZQ3
# lmzdXf9++1E=
# =JiFt
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue Mar 31 16:01:41 2026 BST
# gpg:                using RSA key DC3DEB159A9AF95D3D7456FE7F09B272C88F2FD6
# gpg:                issuer "kwolf@redhat.com"
# gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" [full]
# Primary key fingerprint: DC3D EB15 9A9A F95D 3D74  56FE 7F09 B272 C88F 2FD6

* tag 'for-upstream' of https://gitlab.com/kmwolf/qemu:
  block: Fix crash after setting latency historygram with single bin
  vhost-user-blk-server: fix opt_io_size=1 causing severe Windows I/O degradation
  monitor: Fix deadlock in monitor_cleanup
  block: Fix references in bdrv_bsc_*() function comments
  scsi: Don't consider LOGICAL UNIT NOT SUPPORTED guest recoverable
  ide: Fix potential assertion failure on VM stop for PIO read error

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

block.c

@@ -8477,7 +8477,7 @@ static bool bdrv_bsc_range_overlaps_locked(BlockDriverState *bs,
 }
 
 /**
- * See block_int.h for this function's documentation.
+ * See block_int-io.h for this function's documentation.
  */
 bool bdrv_bsc_is_data(BlockDriverState *bs, int64_t offset, int64_t *pnum)
 {
@@ -8487,7 +8487,7 @@ bool bdrv_bsc_is_data(BlockDriverState *bs, int64_t offset, int64_t *pnum)
 }
 
 /**
- * See block_int.h for this function's documentation.
+ * See block_int-io.h for this function's documentation.
  */
 void bdrv_bsc_invalidate_range(BlockDriverState *bs,
                                int64_t offset, int64_t bytes)
@@ -8501,7 +8501,7 @@ void bdrv_bsc_invalidate_range(BlockDriverState *bs,
 }
 
 /**
- * See block_int.h for this function's documentation.
+ * See block_int-io.h for this function's documentation.
  */
 void bdrv_bsc_fill(BlockDriverState *bs, int64_t offset, int64_t bytes)
 {

block/accounting.c

@@ -185,6 +185,15 @@ int block_latency_histogram_set(BlockAcctStats *stats, enum BlockAcctType type,
         prev = entry->value;
     }
 
+    /*
+     * block_latency_histogram_account() assumes that it can always access
+     * hist->boundaries[0], so require at least one boundary. A histogram with
+     * a single bin is useless anyway.
+     */
+    if (new_nbins <= 1) {
+        return -EINVAL;
+    }
+
     hist->nbins = new_nbins;
     g_free(hist->boundaries);
     hist->boundaries = g_new(uint64_t, hist->nbins - 1);

block/export/vhost-user-blk-server.c

@@ -242,8 +242,8 @@ vu_blk_initialize_config(BlockDriverState *bs,
     config->blk_size = cpu_to_le32(blk_size);
     config->size_max = cpu_to_le32(0);
     config->seg_max = cpu_to_le32(128 - 2);
-    config->min_io_size = cpu_to_le16(1);
-    config->opt_io_size = cpu_to_le32(1);
+    config->min_io_size = cpu_to_le16(0);
+    config->opt_io_size = cpu_to_le32(0);
     config->num_queues = cpu_to_le16(num_queues);
     config->max_discard_sectors =
         cpu_to_le32(VIRTIO_BLK_MAX_DISCARD_SECTORS);

hw/ide/core.c

@@ -799,6 +799,7 @@ static void ide_sector_read(IDEState *s)
     s->error = 0; /* not needed by IDE spec, but needed by Windows */
     sector_num = ide_get_sector(s);
     n = s->nsector;
+    ide_set_retry(s);
 
     if (n == 0) {
         ide_transfer_stop(s);

qapi/qmp-dispatch.c

@@ -128,6 +128,16 @@ static void do_qmp_dispatch_bh(void *opaque)
     data->cmd->fn(data->args, data->ret, data->errp);
     monitor_set_cur(qemu_coroutine_self(), NULL);
     aio_co_wake(data->co);
+
+    /*
+     * If the QMP dispatcher coroutine is waiting to be scheduled
+     * in iohandler_ctx, we must kick the main loop. This ensures
+     * that AIO_WAIT_WHILE_UNLOCKED() in monitor_cleanup() doesn't
+     * block indefinitely waiting for an event in qemu_aio_context,
+     * but actually gets the chance to poll iohandler_ctx and resume
+     * the coroutine.
+     */
+    aio_wait_kick();
 }
 
 /*

scsi/utils.c

@@ -373,7 +373,6 @@ static bool scsi_sense_is_guest_recoverable(int key, int asc, int ascq)
     case 0x1a00: /* PARAMETER LIST LENGTH ERROR */
     case 0x2000: /* INVALID OPERATION CODE */
     case 0x2400: /* INVALID FIELD IN CDB */
-    case 0x2500: /* LOGICAL UNIT NOT SUPPORTED */
     case 0x2600: /* INVALID FIELD IN PARAMETER LIST */
 
     case 0x2104: /* UNALIGNED WRITE COMMAND */