Commit 643a171f56 ("tests: Replace ncat with socat in migration test
and drop ncat from containers") replaced ncat with socat, but missed to
skip related test cases if socat is not available, which will cause test
errors on the system without socat.
Fix this by checking socat instead of the original ncat.
Fixes: 643a171f56 ("tests: Replace ncat with socat in migration test and drop ncat from containers")
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Message-ID: <20260330053300.2721608-1-zhao1.liu@intel.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Commit 7aa563630b ("pc: Start with modern CPU hotplug interface
by default") removed the .needed callback (vmstate_test_use_cpuhp)
from vmstate_cpuhp_state in both piix4.c and ich9.c.
However, PIIX4 is also used by non-PC boards - MIPS Malta, which does
not select CONFIG_ACPI_CPU_HOTPLUG. For MIPS Malta, the linker resolves
vmstate_cpu_hotplug to the stub one in acpi-cpu-hotplug-stub.c, which is
a zero-initialized VMStateDescription with .fields == NULL.
Before commit 7aa563630b, .needed() of PIIX4's vmstate_cpuhp_state
returned false for MIPS Malta since PIIX4PMState always initialized the
field cpu_hotplug_legacy as true. Malta implicitly relies on this
initial value to bypass vmstate_cpuhp_state. However, this is unstable
because Malta itself does not support CPU hotplugging, whether via the
legacy way or the modern way.
Commit 7aa563630b removed .needed() check for vmstate_cpuhp_state,
this broke the existing dependency that Malta had relied on, forcing
Malta to save and load vmstate_cpuhp_state during the save/load process,
which in turn caused a segmentation fault due to NULL fields in the
stub-compiled code.
Fix this by bringing back the .needed = cpuhp_needed callback for
vmstate_cpuhp_state of PIIX4, that checks
MachineClass::has_hotpluggable_cpus. Boards that do not support CPU
hotplug (only MIPS Malta) will skip this subsection entirely, which
is both correct and consistent with the previous behavior.
At the same time, add a similar .needed() check to ICH9. Although no
boards with ICH9 are affected by this issue, this helps avoid potential
issues in the future.
Reproducer (MIPS Malta):
$ qemu-img create -f qcow2 dummy.qcow2 32M
$ qemu-system-mipsel -nographic \
-drive if=none,format=qcow2,file=dummy.qcow2
[Type "C-a c" to get the "(qemu)" monitor prompt)]
(qemu) savevm foo # segfault
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Fixes: 7aa563630b ("pc: Start with modern CPU hotplug interface by default")
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3360
Tested-by: Peter Maydell <peter.maydell@linaro.org>
Link: https://lore.kernel.org/r/20260330053008.2721532-1-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reentrant MMIO can cause the SCSIRequest to be completed, at which
point lsi_request_orphan would drop the last reference. Anything
that happens afterwards would access freed data. Keep a reference
to the SCSIRequest and, through req->hba_private, to the lsi_request*
for as long as DMA runs.
Reported-by: Jihe Wang <wangjihe.mail@gmail.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
To protect against using the lsi_request after SCSIRequest has been freed,
keep the HBA-private data alive until the last reference to the SCSIRequest
is gone. Because req->hba_private was used (even if just for an assertion)
to check that the request was still either current or queued, add a boolean
field that is set when the SCSIRequest is cancelled or completed, which
is when the lsi_request would have been unqueued.
Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Protect against changes from reentrant device MMIO during DMA, by always
operating on the same request.
Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
If the device is reset, anything that is done before will not really
be visible. So do the reset and exit immediately if that is one
of the requests in the value written to ISTAT0.
Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
When a VncJob is freed, its associated VncRectEntry list must also be
freed. Previously, vnc_job_push() and the disconnected path in
vnc_worker_thread_loop() called g_free(job) directly, leaking all
VncRectEntry allocations.
Introduce vnc_job_free() which iterates and frees the rectangle entries
before freeing the job itself, and use it in both paths.
Also add QLIST_REMOVE() in the worker loop before g_free(entry), so
that entries processed during normal operation are properly unlinked.
Without this, vnc_job_free() would iterate dangling pointers to
already-freed entries, causing use-after-free.
Fixes: bd023f953e ("vnc: threaded VNC server")
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
The clipboard D-Bus teardown path currently runs when the peer
disappears, but not when DBusDisplay itself is finalized.
That leaves pending clipboard requests and signal handlers associated
with the clipboard proxy active past display teardown.
Add an explicit clipboard fini hook and invoke it from
dbus_display_finalize() so the clipboard teardown also runs during
display destruction.
bixes: ff1a5810f6 ("ui/dbus: add clipboard interface")
Signed-off-by: GuoHan Zhao <zhaoguohan@kylinos.cn>
Message-ID: <20260330091310.42868-1-zhaoguohan@kylinos.cn>
[ Marc-André - Move clipobard finalization to the function]
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Commit 99997823bb ("ui/dbus: add p2p=on/off option")
introduced an asynchronous D-Bus client setup path, with the completion
handler reaching back into the global dbus_display state.
This makes the callback effectively operate on whatever request is
current when it runs, rather than the one that created it. A completion
from an older request can therefore clear a newer
add_client_cancellable or install its connection after a replacement
request has already been issued. It also relies on the DBusDisplay
instance remaining alive until completion.
Fix this by passing the DBusDisplay and GCancellable as callback data,
taking references while the async setup is in flight, and only acting
on completion if it still matches the current request. Also drop the
previous cancellable before creating a new request.
Fixes: 99997823bb ("ui/dbus: add p2p=on/off option")
Signed-off-by: GuoHan Zhao <zhaoguohan@kylinos.cn>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20260326065111.626236-1-zhaoguohan@kylinos.cn>
Commit 42061a1435 ("audio/mixeng: replace redundant pcm_info fields
with AudioFormat") accidentally changed the conv/clip function selection
in audio_pcm_sw_init_ to use hw->info.af (the hardware voice format)
instead of sw->info.af (the software voice format). This causes audio
distortion when the software and hardware voices use different formats,
as the wrong conversion functions are applied to the audio data.
Fix by using sw->info.af, restoring the original behavior.
Fixes: 42061a1435 ("audio/mixeng: replace redundant pcm_info fields with AudioFormat")
Reported-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Reviewed-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Each timer block occupies 32 bytes, but they only start at
offset 256 of the 1024-byte MMIO register space. Therefore
the correct limit for HPET_MAX_TIMERS is 24, not 32.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Fix an off-by-one issue in QEMU's HPET read and write MMIO handlers.
Both handlers check timer_id > s->num_timers instead of timer_id >=
s->num_timers, allowing a guest to access one timer beyond the valid
range.
The affected slot is initialized properly in hpet_realize, which goes
through all HPET_MAX_TIMERS elements of the array, so even though
it is not reset in hpet_reset() the bug does not cause any use of
uninitialized host memory. Because of this, and also because (even
though HPET_MAX_TIMERS is 32) the HPET only has room for 24 timers in
its MMIO region, the bug has no security implications.
Commit 869b0afa4f ("rust/hpet: Drop BqlCell wrapper for num_timers",
2025-06-06) silently fixed the same bug in rust/hw/timer/hpet/src/device.rs.
Reported-by: Yuma Kurogome, Ricerca Security, Inc. <yumak@ricsec.co.jp>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Commit 7e82393ed0 ("hw/i2c/aspeed: fix lost interrupts on
back-to-back commands") introduced pending_intr_sts to preserve
interrupt bits that collide with already pending status bits.
That deferred interrupt state is consumed later when the guest clears
INTR_STS, but it is not reset in aspeed_i2c_bus_reset() and it is not
part of the bus migration state. A reset can therefore leave stale
deferred bits behind, and migration can silently drop them.
Clear pending_intr_sts on reset and include it in VMState while keeping
compatibility with older migration streams.
Fixes: 7e82393ed0 ("hw/i2c/aspeed: fix lost interrupts on back-to-back commands")
Signed-off-by: GuoHan Zhao <zhaoguohan@kylinos.cn>
Link: https://lore.kernel.org/qemu-devel/20260325085450.126595-1-zhaoguohan@kylinos.cn
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Jithu Joseph <jithu.joseph@oss.qualcomm.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
The corresponding source was removed in
commit 88641f4df3
Author: Philippe Mathieu-Daudé <philmd@linaro.org>
Date: Thu Jan 8 11:30:39 2026 +0800
hw/i386: Remove linuxboot.bin
We must also remove the pre-built blob to avoid a GPL violation
from lack of complete & corresponding source.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20260324122025.892666-1-berrange@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
In the long run, we would like to get rid of the code that allows to
register migration state globally, so set global_vmstate to false when
using the isa-cirrus-vga device with new machines, and only enable it
for older machines to avoid breaking the migration there.
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260326154850.301609-1-thuth@redhat.com>
QEMU currently crashes when migrating a guest that uses the
isa-vga device as display. This happens because vga_isa_class_initfn()
registers a vmsd for vmstate_vga_common that operates on VGACommonState.
But the isa-vga device is derived from ISADevice, not from VGACommonState,
so the migration code tries to fill in the data for VGACommonState to
the memory that is a ISADevice instead, which is of cause causing trouble.
We need an indirection here as it's also e.g. done in vga-pci.c, so
that the migration data gets filled into the right location.
While we're at it, also drop the "global_vmstate = true" here. Since
migration was broken for this device during the last 15 years (!) anyway,
we don't have to worry about maintaining backward compatibility with this
switch for older versions of QEMU anymore.
Fixes: 7435b791ca ("vga-isa: convert to qdev")
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260326113457.159065-1-thuth@redhat.com>
Pylint complains here:
config.py:1:0: C0114: Missing module docstring (missing-module-docstring)
config.py:28:4: W0719: Raising too general exception: Exception (broad-exception-raised)
Add a module description and replace the general Exception to fix this.
And while we're at it, and since we've got a proper module description
string now, also replace the copy-n-pasted comment at the top of the file
with a proper SPDX identifier.
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260324163543.55503-5-thuth@redhat.com>
The fetch() function has become really huge and pylint complains about
that. Extract the internal retry-three-times-download loop into a
separate function to make it a little bit more readable and to make
pylint happy about this file again.
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260324163543.55503-4-thuth@redhat.com>
Pylint currently complains:
asset.py:1:0: C0114: Missing module docstring (missing-module-docstring)
asset.py:21:0: C0115: Missing class docstring (missing-class-docstring)
asset.py:28:15: C0209: Formatting a regular string which could be an f-string (consider-using-f-string)
asset.py:34:0: C0115: Missing class docstring (missing-class-docstring)
asset.py:49:15: C0209: Formatting a regular string which could be an f-string (consider-using-f-string)
asset.py:73:4: C0116: Missing function or method docstring (missing-function-docstring)
asset.py:80:4: C0116: Missing function or method docstring (missing-function-docstring)
asset.py:83:4: C0116: Missing function or method docstring (missing-function-docstring)
asset.py:125:4: C0116: Missing function or method docstring (missing-function-docstring)
asset.py:181:43: C0209: Formatting a regular string which could be an f-string (consider-using-f-string)
asset.py:190:39: C0209: Formatting a regular string which could be an f-string (consider-using-f-string)
asset.py:201:39: C0209: Formatting a regular string which could be an f-string (consider-using-f-string)
asset.py:213:15: W0718: Catching too general exception Exception (broad-exception-caught)
asset.py:218:35: C0209: Formatting a regular string which could be an f-string (consider-using-f-string)
asset.py:125:4: R0912: Too many branches (16/12) (too-many-branches)
asset.py:125:4: R0915: Too many statements (64/50) (too-many-statements)
asset.py:228:4: C0116: Missing function or method docstring (missing-function-docstring)
asset.py:249:4: C0116: Missing function or method docstring (missing-function-docstring)
asset.py:257:4: C0116: Missing function or method docstring (missing-function-docstring)
Fix all the warnings except for the R0912 and R0915 which will be tackled
in a later commit.
And while we're at it, also add a proper SPDX license identifier.
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260324163543.55503-3-thuth@redhat.com>
Changes:
- [PATCH] docs and tests: assets moved after GitHub account renaming (Pierrick Bouvier <pierrick.bouvier@linaro.org>)
Link: https://lore.kernel.org/qemu-devel/20260326214436.256215-1-pierrick.bouvier@linaro.org
# -----BEGIN PGP SIGNATURE-----
#
# iQGzBAABCgAdFiEEZrmU7KFPfy5auggff5BUDQoc0A8FAmnGy6AACgkQf5BUDQoc
# 0A+Etgv9HpSzNWwdQ4kdKjlTH37zJzkIQ5iz4e1KefOkRGwolGc2ODF3ibiUP6hP
# 3OTBNHvOI6kkM0aYRqYlMTvyDxIXkEb8TCOfLHdO1vC8sYt9/0GqWoNrrCVPZy/a
# QH9dsNtRzHp7kKcSOPP4spe900mmGXnbEQ4mDhHp22an14MPXnnDIE1lrIBVRei6
# 06TFrhj1kVWhOqpSbMPT7YOZyDewqq+HNORnyuF7Z8w5aKZnGpmnb51x4tcwavjH
# vR+SRW6bXl0RuX9CA5XbA58OS9EINnDjCYA7Prj2fNwYZpt2dX+MRRW+SMTtbGxV
# jGWYmdygDLaj7EUSK8AJuguCS4Me3yOGyGad8PNFp0b900do/QHM/xaGxYmdIjyO
# 2IXe9bcuPa4S3WoV72VXnMtc7qEl9dPfBhLv9KExQA4MtQhF+cycf8+kTNnEaUck
# wX0oYuS4Lr/Q0b8mcMyhvr21ujc2HA6R/m/KRo0BgQ3BnzjxMR9TLMtxV6SqpVkC
# RnaBCozz
# =TSoR
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri Mar 27 18:25:36 2026 GMT
# gpg: using RSA key 66B994ECA14F7F2E5ABA081F7F90540D0A1CD00F
# gpg: Good signature from "Pierrick Bouvier <pierrick.bouvier@linaro.org>" [undefined]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 66B9 94EC A14F 7F2E 5ABA 081F 7F90 540D 0A1C D00F
* tag 'pr-gh_rename-20260327' of https://gitlab.com/pbo-linaro/qemu:
docs and tests: assets moved after GitHub account renaming
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
In the fsfreeze script we attempt to implement "log to a file if we
can, and fall back to syslog if we cannot". We do this with:
[ ! -w "$LOGFILE" ] && USE_SYSLOG=1
touch "$LOGFILE" >/dev/null 2>&1 || USE_SYSLOG=1
This has a weird behaviour if it is run in a setup where we have
permissions that would allow us to write to $LOGFILE but it does not
currently exist. On the first execution, the '-w' fails and so we
set USE_SYSLOG=1. But since we also do the "touch $LOGFILE" step we
create an empty logfile. Then on the second time the script is
executed, we see a writeable logfile and will use it. The effect is
"log to syslog once, then to the logfile thereafter", which is not
likely to be what anybody wants.
Update the condition of the first check to only pick syslog if
the logfile exists but is not writable. This means that:
* if the logfile doesn't exist but we are able to create it,
we will create it and use it
* if the logfile already exists and we can write to it,
we will use it
* if the logfile already exists but we can't write to it,
we will fall back to syslog
* if the logfile doesn't exist and we can't create it,
we will fall back to syslog
Cc: qemu-stable@nongnu.org
Fixes: 85978dfb6b ("qemu-ga: Optimize freeze-hook script logic of logging error")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Kostiantyn Kostiuk <kkostiuk@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20260317094806.1944053-4-peter.maydell@linaro.org
Signed-off-by: Kostiantyn Kostiuk <kkostiuk@redhat.com>
The fsfreeze-hook script starts with #!/bin/sh, but it uses
several bash-specific constructs, resulting in misbehaviour
on guest systems where /bin/sh is some other POSIX shell.
Fix the simple ones reported by shellcheck:
In scripts/qemu-guest-agent/fsfreeze-hook line 27:
touch "$LOGFILE" &>/dev/null || USE_SYSLOG=1
^---------^ SC3020 (warning): In POSIX sh, &> is undefined.
In scripts/qemu-guest-agent/fsfreeze-hook line 31:
local message="$1"
^-----------^ SC3043 (warning): In POSIX sh, 'local' is undefined.
In scripts/qemu-guest-agent/fsfreeze-hook line 46:
log_message "Executing $file $@"
^-- SC2145 (error): Argument mixes string and array. Use * or separate argument.
In scripts/qemu-guest-agent/fsfreeze-hook line 55:
if [ $STATUS -ne 0 ]; then
^-----^ SC2086 (info): Double quote to prevent globbing and word splitting.
There is also a use of PIPESTATUS that is more complex to fix;
that will be dealt with in a separate commit.
Cc: qemu-stable@nongnu.org
Fixes: 85978dfb6b ("qemu-ga: Optimize freeze-hook script logic of logging error")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Kostiantyn Kostiuk <kkostiuk@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20260317094806.1944053-2-peter.maydell@linaro.org
Signed-off-by: Kostiantyn Kostiuk <kkostiuk@redhat.com>
Changes:
- [PATCH 0/3] plugins: fix endianness for qemu_plugin_mem_get_value() (Pierrick Bouvier <pierrick.bouvier@linaro.org>)
Link: https://lore.kernel.org/qemu-devel/20260325024252.3369186-1-pierrick.bouvier@linaro.org
# -----BEGIN PGP SIGNATURE-----
#
# iQGzBAABCgAdFiEEZrmU7KFPfy5auggff5BUDQoc0A8FAmnEWRAACgkQf5BUDQoc
# 0A/bnwv+M7tE/AxJBopnzMcAl2TAzYJXW2ZvipPutnPd83XNu5O/g1IBaQzGr06n
# 21SmDiNy7hUIW13bTPJXljycrykAgx320Fuj6R+E59Pa2D4sk7vJcwN7aJhMTgWy
# S0HhAeasHiNcPoEb8jPq6sGzS+wt4Xh+kmdjBa3CjIeerMMo/0bipUGn92Q01M81
# h+R9gDKmgtDci/fDx66Fvz8hE7P6jFTx6rHL1e1ksFBJ+FqYt9SQXQLqCcDLKzbo
# SW9k8wju1POxaKvf3Dg5vctejoogFzJCtKF7M/Fa4qo0DXzJP6eDMhlHcvzjfedJ
# xeVirOd5x3CO4AZ5KHCAoQWPu++UeGhirGhRCFc4s2MUopTwN8t4FGR0wpZxzGYC
# gNHB7/F3cm+pulMbr2MQZg3xVyy0q9+2ltNGjwo/vyjG4RxUIvNX6dsxu2sZ7Zpw
# lT1NqX0/4AlMsfeQCV3Rnx0V7+4HGarpbBZw5+Pgz2uhbP5g5ik5WBJY9rCzpwM/
# tFY4CTL4
# =NqGd
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed Mar 25 21:52:16 2026 GMT
# gpg: using RSA key 66B994ECA14F7F2E5ABA081F7F90540D0A1CD00F
# gpg: Good signature from "Pierrick Bouvier <pierrick.bouvier@linaro.org>" [undefined]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 66B9 94EC A14F 7F2E 5ABA 081F 7F90 540D 0A1C D00F
* tag 'pr-plugins-20260325' of https://gitlab.com/pbo-linaro/qemu:
tests/tcg/plugins/mem.c: fix endian swap in update_region_info
include/plugins/qemu-plugin.h: add note about endianness of value returned by qemu_plugin_mem_get_value
tcg: Pass host-endian values to plugin_gen_mem_callbacks_*
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
In nvme_abort(), the submission queue pointer is dereferenced from the
guest-controlled sqid before validating it with nvme_check_sqid():
NvmeSQueue *sq = n->sq[sqid];
Since sqid is a 16-bit value (range 0-65535) taken directly from CDW10,
and n->sq[] is typically only max_ioqpairs+1 (65) entries, a malicious
guest can trigger an out-of-bounds heap read by sending an Abort command
with a large sqid.
ASan reports this as heap-buffer-overflow in nvme_abort.
Fix this by moving the array dereference to after the nvme_check_sqid()
bounds validation.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3348
Fixes: 75209c071a ("hw/nvme: actually implement abort")
Cc: qemu-stable@nongnu.org
Signed-off-by: Kaixuan Li <kaixuanli@ntu.edu.sg>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
dlfeat was changed from 0x9 to 0x1 when PI support was added.
It was removed because we can't rely on unmap and have to physically
clear it to get the checksums right but that doesnt mean that we do not
support the bit.
The spec says that if wzds is enabled, then the controller supports
deallocate (DEAC) on write zeroes. But DEAC bit in write zeroes command
is only a hint, the controller might choose to physically write zeroes in
those areas.
As we are sending write zeroes command with BDRV_REQ_MAY_UNMAP to the
underlying block device anyway (if the unmap operation is supported),
change the dlfeat value back to 0x9.
A new flag FALLOC_FL_WRITE_ZEROES has been introduced in linux for
fallocate which will use the wzds bit in dlfeat to quickly zeroout extents
using unmap operation whenever possible[1].
[1] https://lore.kernel.org/linux-fsdevel/20250619111806.3546162-1-yi.zhang@huaweicloud.com/
Fixes: 146f720c55 ("hw/block/nvme: end-to-end data protection")
Suggested-by: Klaus Jensen <k.jensen@samsung.com>
Signed-off-by: Pankaj Raghav <p.raghav@samsung.com>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
