Branch: refs/heads/staging-7.2
Home: https://github.com/qemu/qemu
Commit: 217ab2b86c57113c4add063370dea3b63a997031
https://github.com/qemu/qemu/commit/217ab2b86c57113c4add063370dea3b63a997031
Author: Kevin Wolf <[email protected]>
Date: 2023-09-13 (Wed, 13 Sep 2023)
Changed paths:
M hw/virtio/virtio.c
Log Message:
-----------
virtio: Drop out of coroutine context in virtio_load()
virtio_load() as a whole should run in coroutine context because it
reads from the migration stream and we don't want this to block.
However, it calls virtio_set_features_nocheck() and devices don't
expect their .set_features callback to run in a coroutine and therefore
call functions that may not be called in coroutine context. To fix this,
drop out of coroutine context for calling virtio_set_features_nocheck().
Without this fix, the following crash was reported:
#0 __pthread_kill_implementation (threadid=<optimized out>,
signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44
#1 0x00007efc738c05d3 in __pthread_kill_internal (signo=6,
threadid=<optimized out>) at pthread_kill.c:78
#2 0x00007efc73873d26 in __GI_raise (sig=sig@entry=6) at
../sysdeps/posix/raise.c:26
#3 0x00007efc738477f3 in __GI_abort () at abort.c:79
#4 0x00007efc7384771b in __assert_fail_base (fmt=0x7efc739dbcb8 "",
assertion=assertion@entry=0x560aebfbf5cf "!qemu_in_coroutine()",
file=file@entry=0x560aebfcd2d4 "../block/graph-lock.c",
line=line@entry=275, function=function@entry=0x560aebfcd34d "void
bdrv_graph_rdlock_main_loop(void)") at assert.c:92
#5 0x00007efc7386ccc6 in __assert_fail (assertion=0x560aebfbf5cf
"!qemu_in_coroutine()", file=0x560aebfcd2d4 "../block/graph-lock.c", line=275,
function=0x560aebfcd34d "void bdrv_graph_rdlock_main_loop(void)") at
assert.c:101
#6 0x0000560aebcd8dd6 in bdrv_register_buf ()
#7 0x0000560aeb97ed97 in ram_block_added.llvm ()
#8 0x0000560aebb8303f in ram_block_add.llvm ()
#9 0x0000560aebb834fa in qemu_ram_alloc_internal.llvm ()
#10 0x0000560aebb2ac98 in vfio_region_mmap ()
#11 0x0000560aebb3ea0f in vfio_bars_register ()
#12 0x0000560aebb3c628 in vfio_realize ()
#13 0x0000560aeb90f0c2 in pci_qdev_realize ()
#14 0x0000560aebc40305 in device_set_realized ()
#15 0x0000560aebc48e07 in property_set_bool.llvm ()
#16 0x0000560aebc46582 in object_property_set ()
#17 0x0000560aebc4cd58 in object_property_set_qobject ()
#18 0x0000560aebc46ba7 in object_property_set_bool ()
#19 0x0000560aeb98b3ca in qdev_device_add_from_qdict ()
#20 0x0000560aebb1fbaf in virtio_net_set_features ()
#21 0x0000560aebb46b51 in virtio_set_features_nocheck ()
#22 0x0000560aebb47107 in virtio_load ()
#23 0x0000560aeb9ae7ce in vmstate_load_state ()
#24 0x0000560aeb9d2ee9 in qemu_loadvm_state_main ()
#25 0x0000560aeb9d45e1 in qemu_loadvm_state ()
#26 0x0000560aeb9bc32c in process_incoming_migration_co.llvm ()
#27 0x0000560aebeace56 in coroutine_trampoline.llvm ()
Cc: [email protected]
Buglink: https://issues.redhat.com/browse/RHEL-832
Signed-off-by: Kevin Wolf <[email protected]>
Message-ID: <[email protected]>
Reviewed-by: Stefan Hajnoczi <[email protected]>
Signed-off-by: Kevin Wolf <[email protected]>
(cherry picked from commit 92e2e6a867334a990f8d29f07ca34e3162fdd6ec)
Signed-off-by: Michael Tokarev <[email protected]>
(Mjt: remove coroutine_mixed_fn markings introduced in v7.2.0-909-g0f3de970fe)
Commit: c04c0123bd3938331265e0b91727e8d084e20dea
https://github.com/qemu/qemu/commit/c04c0123bd3938331265e0b91727e8d084e20dea
Author: Colton Lewis <[email protected]>
Date: 2023-09-13 (Wed, 13 Sep 2023)
Changed paths:
M target/arm/kvm64.c
Log Message:
-----------
arm64: Restore trapless ptimer access
Due to recent KVM changes, QEMU is setting a ptimer offset resulting
in unintended trap and emulate access and a consequent performance
hit. Filter out the PTIMER_CNT register to restore trapless ptimer
access.
Quoting Andrew Jones:
Simply reading the CNT register and writing back the same value is
enough to set an offset, since the timer will have certainly moved
past whatever value was read by the time it's written. QEMU
frequently saves and restores all registers in the get-reg-list array,
unless they've been explicitly filtered out (with Linux commit
680232a94c12, KVM_REG_ARM_PTIMER_CNT is now in the array). So, to
restore trapless ptimer accesses, we need a QEMU patch to filter out
the register.
See
https://lore.kernel.org/kvmarm/[email protected]/T/#m0770023762a821db2a3f0dd0a7dc6aa54e0d0da9
for additional context.
Cc: [email protected]
Signed-off-by: Andrew Jones <[email protected]>
Signed-off-by: Colton Lewis <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Tested-by: Colton Lewis <[email protected]>
Message-id: [email protected]
Signed-off-by: Peter Maydell <[email protected]>
(cherry picked from commit 682814e2a3c883b27f24b9e7cab47313c49acbd4)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: ec0afe3c0b0fd27db95928ff0a13f5c6597db70d
https://github.com/qemu/qemu/commit/ec0afe3c0b0fd27db95928ff0a13f5c6597db70d
Author: Thomas Huth <[email protected]>
Date: 2023-09-13 (Wed, 13 Sep 2023)
Changed paths:
M hw/char/riscv_htif.c
Log Message:
-----------
hw/char/riscv_htif: Fix printing of console characters on big endian hosts
The character that should be printed is stored in the 64 bit "payload"
variable. The code currently tries to print it by taking the address
of the variable and passing this pointer to qemu_chr_fe_write(). However,
this only works on little endian hosts where the least significant bits
are stored on the lowest address. To do this in a portable way, we have
to store the value in an uint8_t variable instead.
Fixes: 5033606780 ("RISC-V HTIF Console")
Signed-off-by: Thomas Huth <[email protected]>
Reviewed-by: Alistair Francis <[email protected]>
Reviewed-by: Bin Meng <[email protected]>
Reviewed-by: Daniel Henrique Barboza <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Message-Id: <[email protected]>
Signed-off-by: Alistair Francis <[email protected]>
(cherry picked from commit c255946e3df4d9660e4f468a456633c24393d468)
Signed-off-by: Michael Tokarev <[email protected]>
(Mjt: edit to compensate for v7.2.0-805-g753ae97abc and v7.2.0-808-gdadee9e3ce)
Commit: 6097d3cbba1e015b3d899971b32c8ea248396bc6
https://github.com/qemu/qemu/commit/6097d3cbba1e015b3d899971b32c8ea248396bc6
Author: Jason Chien <[email protected]>
Date: 2023-09-13 (Wed, 13 Sep 2023)
Changed paths:
M hw/intc/riscv_aclint.c
Log Message:
-----------
hw/intc: Fix upper/lower mtime write calculation
When writing the upper mtime, we should keep the original lower mtime
whose value is given by cpu_riscv_read_rtc() instead of
cpu_riscv_read_rtc_raw(). The same logic applies to writes to lower mtime.
Signed-off-by: Jason Chien <[email protected]>
Reviewed-by: Alistair Francis <[email protected]>
Message-ID: <[email protected]>
Signed-off-by: Alistair Francis <[email protected]>
(cherry picked from commit e0922b73baf00c4c19d4ad30d09bb94f7ffea0f4)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: d4a34641097c0939022e3a6b9aa71e4ab36aea25
https://github.com/qemu/qemu/commit/d4a34641097c0939022e3a6b9aa71e4ab36aea25
Author: Jason Chien <[email protected]>
Date: 2023-09-13 (Wed, 13 Sep 2023)
Changed paths:
M hw/intc/riscv_aclint.c
Log Message:
-----------
hw/intc: Make rtc variable names consistent
The variables whose values are given by cpu_riscv_read_rtc() should be named
"rtc". The variables whose value are given by cpu_riscv_read_rtc_raw()
should be named "rtc_r".
Signed-off-by: Jason Chien <[email protected]>
Reviewed-by: Alistair Francis <[email protected]>
Message-ID: <[email protected]>
Signed-off-by: Alistair Francis <[email protected]>
(cherry picked from commit 9382a9eafccad8dc6a487ea3a8d2bed03dc35db9)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: f44ffdcef9293404cd0b4feffbc39af4712bd60c
https://github.com/qemu/qemu/commit/f44ffdcef9293404cd0b4feffbc39af4712bd60c
Author: LIU Zhiwei <[email protected]>
Date: 2023-09-13 (Wed, 13 Sep 2023)
Changed paths:
M linux-user/riscv/signal.c
Log Message:
-----------
linux-user/riscv: Use abi type for target_ucontext
We should not use types dependend on host arch for target_ucontext.
This bug is found when run rv32 applications.
Signed-off-by: LIU Zhiwei <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Reviewed-by: Daniel Henrique Barboza <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Message-ID: <[email protected]>
Signed-off-by: Alistair Francis <[email protected]>
(cherry picked from commit ae7d4d625cab49657b9fc2be09d895afb9bcdaf0)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: 7601c960b6d7f3dd0e3729c7d858e3ef8513e794
https://github.com/qemu/qemu/commit/7601c960b6d7f3dd0e3729c7d858e3ef8513e794
Author: Conor Dooley <[email protected]>
Date: 2023-09-13 (Wed, 13 Sep 2023)
Changed paths:
M hw/riscv/virt.c
Log Message:
-----------
hw/riscv: virt: Fix riscv,pmu DT node path
On a dtb dumped from the virt machine, dt-validate complains:
soc: pmu: {'riscv,event-to-mhpmcounters': [[1, 1, 524281], [2, 2, 524284],
[65561, 65561, 524280], [65563, 65563, 524280], [65569, 65569, 524280]],
'compatible': ['riscv,pmu']} should not be valid under {'type': 'object'}
from schema $id: http://devicetree.org/schemas/simple-bus.yaml#
That's pretty cryptic, but running the dtb back through dtc produces
something a lot more reasonable:
Warning (simple_bus_reg): /soc/pmu: missing or empty reg/ranges property
Moving the riscv,pmu node out of the soc bus solves the problem.
Signed-off-by: Conor Dooley <[email protected]>
Acked-by: Alistair Francis <[email protected]>
Reviewed-by: Daniel Henrique Barboza <[email protected]>
Message-ID: <20230727-groom-decline-2c57ce42841c@spud>
Signed-off-by: Alistair Francis <[email protected]>
(cherry picked from commit 9ff31406312500053ecb5f92df01dd9ce52e635d)
Signed-off-by: Michael Tokarev <[email protected]>
(Mjt: context adjustment due to 568e0614d09 "hw/riscv/virt.c: rename
MachineState 'mc' pointers to 'ms'")
Commit: b5fad36452586583858ddbbc2d085451cc79490a
https://github.com/qemu/qemu/commit/b5fad36452586583858ddbbc2d085451cc79490a
Author: Leon Schuermann <[email protected]>
Date: 2023-09-13 (Wed, 13 Sep 2023)
Changed paths:
M target/riscv/pmp.c
Log Message:
-----------
target/riscv/pmp.c: respect mseccfg.RLB for pmpaddrX changes
When the rule-lock bypass (RLB) bit is set in the mseccfg CSR, the PMP
configuration lock bits must not apply. While this behavior is
implemented for the pmpcfgX CSRs, this bit is not respected for
changes to the pmpaddrX CSRs. This patch ensures that pmpaddrX CSR
writes work even on locked regions when the global rule-lock bypass is
enabled.
Signed-off-by: Leon Schuermann <[email protected]>
Reviewed-by: Mayuresh Chitale <[email protected]>
Reviewed-by: Alistair Francis <[email protected]>
Message-ID: <[email protected]>
Signed-off-by: Alistair Francis <[email protected]>
(cherry picked from commit 4e3adce1244e1ca30ec05874c3eca14911dc0825)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: 9eda3b687455f23ca77573edb79a4aca8a595b49
https://github.com/qemu/qemu/commit/9eda3b687455f23ca77573edb79a4aca8a595b49
Author: Stefan Berger <[email protected]>
Date: 2023-09-13 (Wed, 13 Sep 2023)
Changed paths:
M hw/tpm/tpm_tis_sysbus.c
Log Message:
-----------
hw/tpm: TIS on sysbus: Remove unsupport ppi command line option
The ppi command line option for the TIS device on sysbus never worked
and caused an immediate segfault. Remove support for it since it also
needs support in the firmware and needs testing inside the VM.
Reproducer with the ppi=on option passed:
qemu-system-aarch64 \
-machine virt,gic-version=3 \
-m 4G \
-nographic -no-acpi \
-chardev socket,id=chrtpm,path=/tmp/mytpm1/swtpm-sock \
-tpmdev emulator,id=tpm0,chardev=chrtpm \
-device tpm-tis-device,tpmdev=tpm0,ppi=on
[...]
Segmentation fault (core dumped)
Signed-off-by: Stefan Berger <[email protected]>
Reviewed-by: Eric Auger <[email protected]>
Message-id: [email protected]
(cherry picked from commit 4c46fe2ed492f35f411632c8b5a8442f322bc3f0)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: d0f8b52fc1ca1c4af189ad69167fdcb69a850717
https://github.com/qemu/qemu/commit/d0f8b52fc1ca1c4af189ad69167fdcb69a850717
Author: Marc-André Lureau <[email protected]>
Date: 2023-09-13 (Wed, 13 Sep 2023)
Changed paths:
M ui/console.c
Log Message:
-----------
ui: fix crash when there are no active_console
Thread 1 "qemu-system-x86" received signal SIGSEGV, Segmentation fault.
0x0000555555888630 in dpy_ui_info_supported (con=0x0) at ../ui/console.c:812
812 return con->hw_ops->ui_info != NULL;
(gdb) bt
#0 0x0000555555888630 in dpy_ui_info_supported (con=0x0) at ../ui/console.c:812
#1 0x00005555558a44b1 in protocol_client_msg (vs=0x5555578c76c0,
data=0x5555581e93f0 <incomplete sequence \373>, len=24) at ../ui/vnc.c:2585
#2 0x00005555558a19ac in vnc_client_read (vs=0x5555578c76c0) at
../ui/vnc.c:1607
#3 0x00005555558a1ac2 in vnc_client_io (ioc=0x5555581eb0e0, condition=G_IO_IN,
opaque=0x5555578c76c0) at ../ui/vnc.c:1635
Fixes:
https://issues.redhat.com/browse/RHEL-2600
Signed-off-by: Marc-André Lureau <[email protected]>
Reviewed-by: Albert Esteve <[email protected]>
(cherry picked from commit 48a35e12faf90a896c5aa4755812201e00d60316)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: 2021c2d539508af3742bcd14b5e52f7a15d802a9
https://github.com/qemu/qemu/commit/2021c2d539508af3742bcd14b5e52f7a15d802a9
Author: Janosch Frank <[email protected]>
Date: 2023-09-13 (Wed, 13 Sep 2023)
Changed paths:
M hw/s390x/s390-virtio-ccw.c
Log Message:
-----------
s390x/ap: fix missing subsystem reset registration
A subsystem reset contains a reset of AP resources which has been
missing. Adding the AP bridge to the list of device types that need
reset fixes this issue.
Reviewed-by: Jason J. Herne <[email protected]>
Reviewed-by: Tony Krowiak <[email protected]>
Signed-off-by: Janosch Frank <[email protected]>
Fixes: a51b3153 ("s390x/ap: base Adjunct Processor (AP) object model")
Message-ID: <[email protected]>
Signed-off-by: Thomas Huth <[email protected]>
(cherry picked from commit 297ec01f0b9864ea8209ca0ddc6643b4c0574bdb)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: feb0d5a932a507f04110a32264075c1a8cc9bbdf
https://github.com/qemu/qemu/commit/feb0d5a932a507f04110a32264075c1a8cc9bbdf
Author: Marc-André Lureau <[email protected]>
Date: 2023-09-13 (Wed, 13 Sep 2023)
Changed paths:
M backends/tpm/tpm_util.c
Log Message:
-----------
tpm: fix crash when FD >= 1024 and unnecessary errors due to EINTR
Replace select() with poll() to fix a crash when QEMU has a large number
of FDs. Also use RETRY_ON_EINTR to avoid unnecessary errors due to EINTR.
Cc: [email protected]
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2020133
Fixes: 56a3c24ffc ("tpm: Probe for connected TPM 1.2 or TPM 2")
Signed-off-by: Marc-André Lureau <[email protected]>
Reviewed-by: Michael Tokarev <[email protected]>
Reviewed-by: Stefan Berger <[email protected]>
Signed-off-by: Stefan Berger <[email protected]>
(cherry picked from commit 8e32ddff69b6b4547cc00592ad816484e160817a)
Signed-off-by: Michael Tokarev <[email protected]>
(Mjt: use TFR() instead of RETRY_ON_EINTR() before v7.2.0-538-g8b6aa69365)
Compare: https://github.com/qemu/qemu/compare/d256f730cd98...feb0d5a932a5
