Branch: refs/heads/stable-8.2
Home: https://github.com/qemu/qemu
Commit: b4b23b11af796c5e3740d34a17e94eeca4ca9a75
https://github.com/qemu/qemu/commit/b4b23b11af796c5e3740d34a17e94eeca4ca9a75
Author: Khem Raj <[email protected]>
Date: 2025-02-11 (Tue, 11 Feb 2025)
Changed paths:
M linux-user/syscall.c
Log Message:
-----------
linux-user: Do not define struct sched_attr if libc headers do
glibc 2.41+ has added [1] definitions for sched_setattr and
sched_getattr functions and struct sched_attr. Therefore, it needs
to be checked for here as well before defining sched_attr, to avoid
a compilation failure.
Define sched_attr conditionally only when SCHED_ATTR_SIZE_VER0 is
not defined.
[1]
https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=21571ca0d70302909cf72707b2a7736cf12190a0;hp=298bc488fdc047da37482f4003023cb9adef78f8
Signed-off-by: Khem Raj <[email protected]>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2799
Cc: [email protected]
Reviewed-by: Peter Maydell <[email protected]>
Signed-off-by: Peter Maydell <[email protected]>
(cherry picked from commit 27a8d899c7a100fd5aa040a8b993bb257687c393)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: 42c54ea716faa442108b01b1b381af9299dbe3bf
https://github.com/qemu/qemu/commit/42c54ea716faa442108b01b1b381af9299dbe3bf
Author: Laurent Vivier <[email protected]>
Date: 2025-02-11 (Tue, 11 Feb 2025)
Changed paths:
M hw/virtio/virtio-qmp.c
Log Message:
-----------
qmp: update vhost-user protocol feature maps
Add VHOST_USER_PROTOCOL_F_SHARED_OBJECT and
VHOST_USER_PROTOCOL_F_DEVICE_STATE protocol feature maps to
the virtio introspection.
Cc: [email protected]
Fixes: 160947666276 ("vhost-user: add shared_object msg")
Cc: [email protected]
Fixes: cda83adc62b6 ("vhost-user: Interface for migration state transfer")
Cc: [email protected]
Signed-off-by: Laurent Vivier <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>
(cherry picked from commit 1e3d4d9a1a32ac6835f0d295a5117851c421fb5d)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: 1961d0db30c571b0a36ccc3fe75416dd2e7abcf1
https://github.com/qemu/qemu/commit/1961d0db30c571b0a36ccc3fe75416dd2e7abcf1
Author: Thomas Huth <[email protected]>
Date: 2025-02-12 (Wed, 12 Feb 2025)
Changed paths:
M .gitlab-ci.d/cirrus.yml
Log Message:
-----------
gitlab-ci.d/cirrus: Update the FreeBSD job to v14.2
The FreeBSD job started to fail since the 14-1 image disappeared
from the cloud. Update the job to v14.2 to fix it.
Message-ID: <[email protected]>
Reviewed-by: Daniel P. Berrangé <[email protected]>
Signed-off-by: Thomas Huth <[email protected]>
(cherry picked from commit 66a1b4991c32e370a4e0ddabf496aa1563aff286)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: 0c34f9feee0d188d2573e3bb08d5926d8003550b
https://github.com/qemu/qemu/commit/0c34f9feee0d188d2573e3bb08d5926d8003550b
Author: Volker Rümelin <[email protected]>
Date: 2025-02-16 (Sun, 16 Feb 2025)
Changed paths:
M ui/meson.build
M ui/sdl2.c
Log Message:
-----------
ui/sdl2: reenable the SDL2 Windows keyboard hook procedure
Windows only:
The libSDL2 Windows message loop needs the libSDL2 Windows low
level keyboard hook procedure to grab the left and right Windows
keys correctly. Reenable the SDL2 Windows keyboard hook procedure.
Since SDL2 2.30.4 the SDL2 keyboard hook procedure also filters
out the special left Control key event for every Alt Gr key event
on keyboards with an international layout. This means the QEMU low
level keyboard hook procedure is no longer needed. Remove the QEMU
Windows keyboard hook procedure.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2139
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2323
Signed-off-by: Volker Rümelin <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Paolo Bonzini <[email protected]>
(cherry picked from commit 4dafba778aa3e5f5fd3b2c6333afd7650dcf54e2)
Signed-off-by: Michael Tokarev <[email protected]>
(Mjt: context fix in ui/sdl2.c and adaptation in ui/meson.build)
Commit: 5af648acff28171d34a68aec4cf0f52e6401284c
https://github.com/qemu/qemu/commit/5af648acff28171d34a68aec4cf0f52e6401284c
Author: Mikael Szreder <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M target/sparc/gdbstub.c
Log Message:
-----------
target/sparc: Fix gdbstub incorrectly handling registers f32-f62
The gdbstub implementation for the Sparc architecture would
incorrectly calculate the the floating point register offset.
This resulted in, for example, registers f32 and f34 to point to
the same value.
The issue was caused by the confusion between even register numbers
and even register indexes. For example, the register index of f32 is 64
and f34 is 65.
Cc: [email protected]
Fixes: 30038fd81808 ("target-sparc: Change fpr representation to doubles.")
Signed-off-by: Mikael Szreder <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>
Message-ID: <[email protected]>
(cherry picked from commit 7a74e468089a58756b438d31a2a9a97f183780d7)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: e75026f07a92ed1b7ee1481fa496b92a75ad0332
https://github.com/qemu/qemu/commit/e75026f07a92ed1b7ee1481fa496b92a75ad0332
Author: Richard Henderson <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M linux-user/elfload.c
Log Message:
-----------
linux-user: Honor elf alignment when placing images
Most binaries don't actually depend on more than page alignment,
but any binary can request it. Not honoring this was a bug.
This became obvious when gdb reported
Failed to read a valid object file image from memory
when examining some vdso which are marked as needing more
than page alignment.
Signed-off-by: Richard Henderson <[email protected]>
(cherry picked from commit c81d1fafa6233448bcc2d8fcd2ba63a4ae834f3a)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: 2c837358c2f3b30524754ffebedb6c5d60ae3552
https://github.com/qemu/qemu/commit/2c837358c2f3b30524754ffebedb6c5d60ae3552
Author: Fabiano Rosas <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M linux-user/elfload.c
Log Message:
-----------
elfload: Fix alignment when unmapping excess reservation
When complying with the alignment requested in the ELF and unmapping
the excess reservation, having align_end not aligned to the guest page
causes the unmap to be rejected by the alignment check at
target_munmap and later brk adjustments hit an EEXIST.
Fix by aligning the start of region to be unmapped.
Fixes: c81d1fafa6 ("linux-user: Honor elf alignment when placing images")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1913
Signed-off-by: Fabiano Rosas <[email protected]>
[rth: Align load_end as well.]
Signed-off-by: Richard Henderson <[email protected]>
Message-ID: <[email protected]>
(cherry picked from commit 4b7b20a3b72c5000ea71bef505c16e6e628268b6)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: f1a5a49d727f06ae0a7f6685ab1ffa709346763d
https://github.com/qemu/qemu/commit/f1a5a49d727f06ae0a7f6685ab1ffa709346763d
Author: Peter Maydell <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M target/arm/helper.c
Log Message:
-----------
target/arm: Report correct syndrome for UNDEFINED CNTPS_*_EL1 from EL2 and NS
EL1
The access pseudocode for the CNTPS_TVAL_EL1, CNTPS_CTL_EL1 and
CNTPS_CVAL_EL1 secure timer registers says that they are UNDEFINED
from EL2 or NS EL1. We incorrectly return CP_ACCESS_TRAP from the
access function in these cases, which means that we report the wrong
syndrome value to the target EL.
Use CP_ACCESS_TRAP_UNCATEGORIZED, which reports the correct syndrome
value for an UNDEFINED instruction.
Cc: [email protected]
Fixes: b4d3978c2fd ("target-arm: Add the AArch64 view of the Secure physical
timer")
Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Alex Bennée <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-id: [email protected]
(cherry picked from commit b819fd6994243aee6f9613edbbacedce4f511c32)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: 6616f3f85219d5b580edc384c8bf263556cd80b6
https://github.com/qemu/qemu/commit/6616f3f85219d5b580edc384c8bf263556cd80b6
Author: Peter Maydell <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M target/arm/helper.c
Log Message:
-----------
target/arm: Report correct syndrome for UNDEFINED AT ops with wrong NSE, NS
R_NYXTL says that these AT insns should be UNDEFINED if they
would operate on an EL lower than EL3 and SCR_EL3.{NSE,NS} is
set to the Reserved {1, 0}. We were incorrectly reporting
them with the wrong syndrome; use CP_ACCESS_TRAP_UNCATEGORIZED
so they are reported as UNDEFINED.
Cc: [email protected]
Fixes: 1acd00ef1410 ("target/arm/helper: Check SCR_EL3.{NSE, NS} encoding for
AT instructions")
Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-id: [email protected]
(cherry picked from commit 1960d9701ef7ed8d24e98def767bbf05d63e6992)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: 7522dd2a0c3182a446458cce03ca7b11c5068551
https://github.com/qemu/qemu/commit/7522dd2a0c3182a446458cce03ca7b11c5068551
Author: Peter Maydell <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M target/arm/helper.c
Log Message:
-----------
target/arm: Report correct syndrome for UNDEFINED S1E2 AT ops at EL3
The pseudocode for AT S1E2R and AT S1E2W says that they should be
UNDEFINED if executed at EL3 when EL2 is not enabled. We were
incorrectly using CP_ACCESS_TRAP and reporting the wrong exception
syndrome as a result. Use CP_ACCESS_TRAP_UNCATEGORIZED.
Cc: [email protected]
Fixes: 2a47df953202e1 ("target-arm: Wire up AArch64 EL2 and EL3 address
translation ops")
Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-id: [email protected]
(cherry picked from commit ccda792945d650bce4609c8dbce8814a220df1bb)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: d66b584cb10c67361ba8a5c5af4898375358fe5a
https://github.com/qemu/qemu/commit/d66b584cb10c67361ba8a5c5af4898375358fe5a
Author: Peter Maydell <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M target/arm/helper.c
Log Message:
-----------
target/arm: Report correct syndrome for UNDEFINED LOR sysregs when NS=0
The pseudocode for the accessors for the LOR sysregs says they
are UNDEFINED if SCR_EL3.NS is 0. We were reporting the wrong
syndrome value here; use CP_ACCESS_TRAP_UNCATEGORIZED.
Cc: [email protected]
Fixes: 2d7137c10faf ("target/arm: Implement the ARMv8.1-LOR extension")
Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Alex Bennée <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-id: [email protected]
(cherry picked from commit 707d478ed8f2da6f2327e5af780890c1fd9c371a)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: 213878f1c93175f079f80714811c850d72243595
https://github.com/qemu/qemu/commit/213878f1c93175f079f80714811c850d72243595
Author: Peter Maydell <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M target/arm/cpu.h
M target/arm/helper.c
M target/arm/tcg/op_helper.c
Log Message:
-----------
target/arm: Make CP_ACCESS_TRAPs to AArch32 EL3 be Monitor traps
In system register access pseudocode the common pattern for
AArch32 registers with access traps to EL3 is:
at EL1 and EL2:
if HaveEL(EL3) && !ELUsingAArch32(EL3) && (SCR_EL3.TERR == 1) then
AArch64.AArch32SystemAccessTrap(EL3, 0x03);
elsif HaveEL(EL3) && ELUsingAArch32(EL3) && (SCR.TERR == 1) then
AArch32.TakeMonitorTrapException();
at EL3:
if (PSTATE.M != M32_Monitor) && (SCR.TERR == 1) then
AArch32.TakeMonitorTrapException();
(taking as an example the ERRIDR access pseudocode).
This implements the behaviour of (in this case) SCR.TERR that
"Accesses to the specified registers from modes other than Monitor
mode generate a Monitor Trap exception" and of SCR_EL3.TERR that
"Accesses of the specified Error Record registers at EL2 and EL1
are trapped to EL3, unless the instruction generates a higher
priority exception".
In QEMU we don't implement this pattern correctly in two ways:
* in access_check_cp_reg() we turn the CP_ACCESS_TRAP_EL3 into
an UNDEF, not a trap to Monitor mode
* in the access functions, we check trap bits like SCR.TERR
only when arm_current_el(env) < 3 -- this is correct for
AArch64 EL3, but misses the "trap non-Monitor-mode execution
at EL3 into Monitor mode" case for AArch32 EL3
In this commit we fix the first of these two issues, by
making access_check_cp_reg() handle CP_ACCESS_TRAP_EL3
as a Monitor trap. This is a kind of exception that we haven't
yet implemented(!), so we need a new EXCP_MON_TRAP for it.
This diverges from the pseudocode approach, where every access check
function explicitly checks for "if EL3 is AArch32" and takes a
monitor trap; if we wanted to be closer to the pseudocode we could
add a new CP_ACCESS_TRAP_MONITOR and make all the accessfns use it
when appropriate. But because there are no non-standard cases in the
pseudocode (i.e. where either it raises a Monitor trap that doesn't
correspond to an AArch64 SystemAccessTrap or where it raises a
SystemAccessTrap that doesn't correspond to a Monitor trap), handling
this all in one place seems less likely to result in future bugs
where we forgot again about this special case when writing an
accessor.
(The cc of stable here is because "hw/intc/arm_gicv3_cpuif: Don't
downgrade monitor traps for AArch32 EL3" which is also cc:stable
will implicitly use the new EXCP_MON_TRAP code path.)
Cc: [email protected]
Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Alex Bennée <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-id: [email protected]
(cherry picked from commit 4cf4948651615181c5bc3d0e4a9f5c46be576bb2)
(Mjt: context fix due to missing
v9.0.0-151-gb36a32ead159 "target/arm: Add support for Non-maskable Interrupt")
Signed-off-by: Michael Tokarev <[email protected]>
Commit: 9e6be19c144720a1e00b34799c66a9fcdf4ac10a
https://github.com/qemu/qemu/commit/9e6be19c144720a1e00b34799c66a9fcdf4ac10a
Author: Peter Maydell <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M hw/intc/arm_gicv3_cpuif.c
Log Message:
-----------
hw/intc/arm_gicv3_cpuif: Don't downgrade monitor traps for AArch32 EL3
In the gicv3_{irq,fiq,irqfiq}_access() functions, there is a check
which downgrades a CP_ACCESS_TRAP_EL3 to CP_ACCESS_TRAP if EL3 is not
AArch64. This has been there since the GIC was first implemented,
but it isn't right: if we are trapping because of SCR.IRQ or SCR.FIQ
then we definitely want to be going to EL3 (doing
AArch32.TakeMonitorTrapException() in pseudocode terms). We might
want to not take a trap at all, but we don't ever want to go to the
default target EL, because that would mean, for instance, taking a
trap to Hyp mode if the trapped access was made from Hyp mode.
(This might have been an attempt to work around our failure to
properly implement Monitor Traps.)
Remove the bogus check.
Cc: [email protected]
Fixes: 359fbe65e01e ("hw/intc/arm_gicv3: Implement GICv3 CPU interface
registers")
Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Alex Bennée <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-id: [email protected]
(cherry picked from commit d04c6c3c000ab3e588a2b91641310aeea89408f7)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: 3b39dd05039cac3abbec9d7475017ab4769a7f9d
https://github.com/qemu/qemu/commit/3b39dd05039cac3abbec9d7475017ab4769a7f9d
Author: Peter Maydell <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M target/arm/cpu.h
M target/arm/debug_helper.c
M target/arm/helper.c
Log Message:
-----------
target/arm: Honour SDCR.TDCC and SCR.TERR in AArch32 EL3 non-Monitor modes
There are not many traps in AArch32 which should trap to Monitor
mode, but these trap bits should trap not just lower ELs to Monitor
mode but also the non-Monitor modes running at EL3 (i.e. Secure
System, Secure Undef, etc).
We get this wrong because the relevant access functions implement the
AArch64-style logic of
if (el < 3 && trap_bit_set) {
return CP_ACCESS_TRAP_EL3;
}
which won't trap the non-Monitor modes at EL3.
Correct this error by using arm_is_el3_or_mon() instead, which
returns true when the CPU is at AArch64 EL3 or AArch32 Monitor mode.
(Since the new callsites are compiled also for the linux-user mode,
we need to provide a dummy implementation for CONFIG_USER_ONLY.)
This affects only:
* trapping of ERRIDR via SCR.TERR
* trapping of the debug channel registers via SDCR.TDCC
* trapping of GICv3 registers via SCR.IRQ and SCR.FIQ
(which we already used arm_is_el3_or_mon() for)
This patch changes the handling of SCR.TERR and SDCR.TDCC. This
patch only changes guest-visible behaviour for "-cpu max" on
the qemu-system-arm binary, because SCR.TERR
and SDCR.TDCC (and indeed the entire SDCR register) only arrived
in Armv8, and the only guest CPU we support which has any v8
features and also starts in AArch32 EL3 is the 32-bit 'max'.
Other uses of CP_ACCESS_TRAP_EL3 don't need changing:
* uses in code paths that can't happen when EL3 is AArch32:
access_trap_aa32s_el1, cpacr_access, cptr_access, nsacr_access
* uses which are in accessfns for AArch64-only registers:
gt_stimer_access, gt_cntpoff_access, access_hxen, access_tpidr2,
access_smpri, access_smprimap, access_lor_ns, access_pauth,
access_mte, access_tfsr_el2, access_scxtnum, access_fgt
* trap bits which exist only in the AArch64 version of the
trap register, not the AArch32 one:
access_tpm, pmreg_access, access_dbgvcr32, access_tdra,
access_tda, access_tdosa (TPM, TDA and TDOSA exist only in
MDCR_EL3, not in SDCR, and we enforce this in sdcr_write())
Cc: [email protected]
Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Alex Bennée <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-id: [email protected]
(cherry picked from commit 4d436fb05c2a1fff7befc815ebcbb04a14977448)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: 0bc0ccb4d6f33867f1ace47f84b4855c4ffe5e0b
https://github.com/qemu/qemu/commit/0bc0ccb4d6f33867f1ace47f84b4855c4ffe5e0b
Author: Bernhard Beschow <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M hw/arm/Kconfig
M hw/usb/Kconfig
M hw/usb/meson.build
Log Message:
-----------
Kconfig: Extract CONFIG_USB_CHIPIDEA from CONFIG_IMX
TYPE_CHIPIDEA models an IP block which is also used in TYPE_ZYNQ_MACHINE which
itself is not an IMX device. CONFIG_ZYNQ selects CONFIG_USB_EHCI_SYSBUS while
TYPE_CHIPIDEA is a separate compilation unit, so only works by accident if
CONFIG_IMX is given. Fix that by extracting CONFIG_USB_CHIPIDEA from CONFIG_IMX.
cc: [email protected]
Fixes: 616ec12d0fcc "hw/arm/xilinx_zynq: Fix USB port instantiation"
Signed-off-by: Bernhard Beschow <[email protected]>
Message-id: [email protected]
Reviewed-by: Peter Maydell <[email protected]>
Signed-off-by: Peter Maydell <[email protected]>
(cherry picked from commit 464ce71a963b3dfc290cd59c3d1bfedf11c004df)
(Mjt: context fixup due to missing
v9.1.0-609-ge02491903d50 "hw/usb: Remove tusb6010 USB controller",
v9.2.0-1303-g1b326f278d05 "hw/pci-host/designware: Expose MSI IRQ")
Signed-off-by: Michael Tokarev <[email protected]>
Commit: 3bed1a6a46f143e2b83d61be631f4e355ee38f5a
https://github.com/qemu/qemu/commit/3bed1a6a46f143e2b83d61be631f4e355ee38f5a
Author: Sairaj Kodilkar <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M hw/i386/amd_iommu.c
Log Message:
-----------
amd_iommu: Use correct DTE field for interrupt passthrough
Interrupt passthrough is determine by the bits 191,190,187-184.
These bits are part of the 3rd quad word (i.e. index 2) in DTE. Hence
replace dte[3] by dte[2].
Fixes: b44159fe0 ("x86_iommu/amd: Add interrupt remap support when VAPIC is not
enabled")
Signed-off-by: Sairaj Kodilkar <[email protected]>
Reviewed-by: Vasant Hegde <[email protected]>
Message-Id: <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
(cherry picked from commit 63dc0b8647391b372f3bb38ff1066f6b4a5e6ea1)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: 5af94d255df78bc64169e2b8610abc951065be88
https://github.com/qemu/qemu/commit/5af94d255df78bc64169e2b8610abc951065be88
Author: Sairaj Kodilkar <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M hw/i386/amd_iommu.c
M hw/i386/amd_iommu.h
Log Message:
-----------
amd_iommu: Use correct bitmask to set capability BAR
AMD IOMMU provides the base address of control registers through
IVRS table and PCI capability. Since this base address is of 64 bit,
use 32 bits mask (instead of 16 bits) to set BAR low and high.
Fixes: d29a09ca68 ("hw/i386: Introduce AMD IOMMU")
Signed-off-by: Sairaj Kodilkar <[email protected]>
Reviewed-by: Vasant Hegde <[email protected]>
Message-Id: <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
(cherry picked from commit 3684717b7407cc395dc9bf522e193dbc85293dee)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: 869c4f7cb21c27185129a0be21589539cf44c218
https://github.com/qemu/qemu/commit/869c4f7cb21c27185129a0be21589539cf44c218
Author: Stefano Garzarella <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M backends/cryptodev-vhost.c
Log Message:
-----------
cryptodev/vhost: allocate CryptoDevBackendVhost using g_mem0()
The function `vhost_dev_init()` expects the `struct vhost_dev`
(passed as a parameter) to be fully initialized. This is important
because some parts of the code check whether `vhost_dev->config_ops`
is NULL to determine if it has been set (e.g. later via
`vhost_dev_set_config_notifier`).
To ensure this initialization, it’s better to allocate the entire
`CryptoDevBackendVhost` structure (which includes `vhost_dev`) using
`g_mem0()`, following the same approach used for other vhost devices,
such as in `vhost_net_init()`.
Fixes: 042cea274c ("cryptodev: add vhost-user as a new cryptodev backend")
Cc: [email protected]
Reported-by: [email protected]
Signed-off-by: Stefano Garzarella <[email protected]>
Message-Id: <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
(cherry picked from commit 83cb18ac4500f3a14067b19408705068647cb0c5)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: 026af9a07bcf17abe98ddf774e376f2263074991
https://github.com/qemu/qemu/commit/026af9a07bcf17abe98ddf774e376f2263074991
Author: Bibo Mao <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M target/loongarch/gdbstub.c
Log Message:
-----------
target/loongarch/gdbstub: Fix gdbstub incorrectly handling some registers
Write operation with R32 (orig_a0) and R34 (CSR_BADV) is discarded on
gdbstub implementation for LoongArch system. And return value should
be register size rather than 0, since it is used to calculate offset of
next register such as R33 (PC) in function handle_write_all_regs().
Cc: [email protected]
Fixes: ca61e75071c6 ("target/loongarch: Add gdb support.")
Signed-off-by: Bibo Mao <[email protected]>
Reviewed-by: Bibo Mao <[email protected]>
(cherry picked from commit 7bd4eaa847fcdbc4505d9ab95dafa21791d8302a)
(Mjt: context fix due to missing v9.1.0-913-g2a99b2af2c
"target/loongarch: Use explicit little-endian LD/ST API")
Signed-off-by: Michael Tokarev <[email protected]>
Commit: 951eedcca1629f2daf132f60e7b7b0f6823b0ede
https://github.com/qemu/qemu/commit/951eedcca1629f2daf132f60e7b7b0f6823b0ede
Author: Joelle van Dyne <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M target/arm/hvf/hvf.c
Log Message:
-----------
target/arm/hvf: sign extend the data for a load operation when SSE=1
In the syndrome value for a data abort, bit 21 is SSE, which is
set to indicate that the abort was on a sign-extending load. When
we handle the data abort from the guest via address_space_read(),
we forgot to handle this and so would return the wrong value if
the guest did a sign-extending load to an MMIO region. Add the
sign-extension of the returned data.
Cc: [email protected]
Signed-off-by: Joelle van Dyne <[email protected]>
Message-id: [email protected]
[PMM: Drop an unnecessary check on 'len'; expand commit message]
Reviewed-by: Peter Maydell <[email protected]>
Signed-off-by: Peter Maydell <[email protected]>
(cherry picked from commit 12c365315ab25d364cff24dfeea8d7ff1e752b9f)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: b37f3329373dcc46fe6e9728988e8c77c219c571
https://github.com/qemu/qemu/commit/b37f3329373dcc46fe6e9728988e8c77c219c571
Author: Max Chou <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M target/riscv/vector_helper.c
Log Message:
-----------
target/riscv: rvv: Fix unexpected behavior of vector reduction instructions
when vl is 0
According to the Vector Reduction Operations section in the RISC-V "V"
Vector Extension spec,
"If vl=0, no operation is performed and the destination register is not
updated."
The vd should be updated when vl is larger than 0.
Fixes: fe5c9ab1fc ("target/riscv: vector single-width integer reduction
instructions")
Fixes: f714361ed7 ("target/riscv: rvv-1.0: implement vstart CSR")
Signed-off-by: Max Chou <[email protected]>
Reviewed-by: Daniel Henrique Barboza <[email protected]>
Message-ID: <[email protected]>
Signed-off-by: Alistair Francis <[email protected]>
(cherry picked from commit ffd455963f230c7dc04965609d6675da687a5a78)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: 7da5f58703cc1d2d017d5f97fb05a610630f35b8
https://github.com/qemu/qemu/commit/7da5f58703cc1d2d017d5f97fb05a610630f35b8
Author: Daniel Henrique Barboza <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M target/riscv/debug.c
Log Message:
-----------
target/riscv/debug.c: use wp size = 4 for 32-bit CPUs
The mcontrol select bit (19) is always zero, meaning our triggers will
always match virtual addresses. In this condition, if the user does not
specify a size for the trigger, the access size defaults to XLEN.
At this moment we're using def_size = 8 regardless of CPU XLEN. Use
def_size = 4 in case we're running 32 bits.
Fixes: 95799e36c1 ("target/riscv: Add initial support for the Sdtrig extension")
Signed-off-by: Daniel Henrique Barboza <[email protected]>
Reviewed-by: Alistair Francis <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Message-ID: <[email protected]>
Signed-off-by: Alistair Francis <[email protected]>
(cherry picked from commit 3fba76e61caa46329afc399b3ecaaba70c8b0a4e)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: 0260dbf0ac2174aa8178b97ad0ef4975009a4eaf
https://github.com/qemu/qemu/commit/0260dbf0ac2174aa8178b97ad0ef4975009a4eaf
Author: Daniel Henrique Barboza <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M target/riscv/cpu_helper.c
Log Message:
-----------
target/riscv: throw debug exception before page fault
In the RISC-V privileged ISA section 3.1.15 table 15, it is determined
that a debug exception that is triggered from a load/store has a higher
priority than a possible fault that this access might trigger.
This is not the case ATM as shown in [1]. Adding a breakpoint in an
address that deliberately will fault is causing a load page fault
instead of a debug exception. The reason is that we're throwing in the
page fault as soon as the fault occurs (end of riscv_cpu_tlb_fill(),
raise_mmu_exception()), not allowing the installed watchpoints to
trigger.
Call cpu_check_watchpoint() in the page fault path to search and execute
any watchpoints that might exist for the address, never returning back
to the fault path. If no watchpoints are found cpu_check_watchpoint()
will return and we'll fall-through the regular path to
raise_mmu_exception().
[1] https://gitlab.com/qemu-project/qemu/-/issues/2627
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2627
Signed-off-by: Daniel Henrique Barboza <[email protected]>
Reviewed-by: Alistair Francis <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-ID: <[email protected]>
Signed-off-by: Alistair Francis <[email protected]>
(cherry picked from commit c86edc547692d812d1dcc04220c38310be2c00c3)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: 57bc5203dd64070db5ff010d4ae05def9d7d7103
https://github.com/qemu/qemu/commit/57bc5203dd64070db5ff010d4ae05def9d7d7103
Author: Rodrigo Dias Correa <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M hw/rtc/goldfish_rtc.c
Log Message:
-----------
goldfish_rtc: Fix tick_offset migration
Instead of migrating the raw tick_offset, goldfish_rtc migrates a
recalculated value based on QEMU_CLOCK_VIRTUAL. As QEMU_CLOCK_VIRTUAL
stands still across a save-and-restore cycle, the guest RTC becomes out
of sync with the host RTC when the VM is restored.
As described in the bug description, it looks like this calculation was
copied from pl031 RTC, which had its tick_offset migration fixed by
Commit 032cfe6a79c8 ("pl031: Correctly migrate state when using -rtc
clock=host").
Migrate the tick_offset directly, adding it as a version-dependent field
to VMState. Keep the old behavior when migrating from previous versions.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2033
Signed-off-by: Rodrigo Dias Correa <[email protected]>
Reviewed-by: Alistair Francis <[email protected]>
Message-ID: <[email protected]>
Signed-off-by: Alistair Francis <[email protected]>
(cherry picked from commit 3521f9cadc29c7d68b73b325ddb46a7acebf6212)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: 9f1e501fb1cb83b46f49df8bb2fb0950ea5fa5a5
https://github.com/qemu/qemu/commit/9f1e501fb1cb83b46f49df8bb2fb0950ea5fa5a5
Author: Denis Rastyogin <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M block/qed.c
Log Message:
-----------
block/qed: fix use-after-free by nullifying timer pointer after free
This error was discovered by fuzzing qemu-img.
In the QED block driver, the need_check_timer timer is freed in
bdrv_qed_detach_aio_context, but the pointer to the timer is not
set to NULL. This can lead to a use-after-free scenario
in bdrv_qed_drain_begin().
The need_check_timer pointer is set to NULL after freeing the timer.
Which helps catch this condition when checking in bdrv_qed_drain_begin().
Closes: https://gitlab.com/qemu-project/qemu/-/issues/2852
Signed-off-by: Denis Rastyogin <[email protected]>
Message-ID: <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>
(cherry picked from commit 2ad638a3d160923ef3dbf87c73944e6e44bdc724)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: b3c2759c982384227077dfe25d3303e5ca6bf8f4
https://github.com/qemu/qemu/commit/b3c2759c982384227077dfe25d3303e5ca6bf8f4
Author: Markus Armbruster <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M docs/about/build-platforms.rst
Log Message:
-----------
docs/about/build-platforms: Correct minimum supported Python version
Fixes: ca056f4499c2 (Python: Drop support for Python 3.7)
Signed-off-by: Markus Armbruster <[email protected]>
Message-ID: <[email protected]>
Reviewed-by: Daniel P. Berrangé <[email protected]>
(cherry picked from commit 87c8b4fc3c1c89ec52540bfb74f9b0518f247323)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: 27e3d81ffd81bb57b02816fc9cfe24f621d64c59
https://github.com/qemu/qemu/commit/27e3d81ffd81bb57b02816fc9cfe24f621d64c59
Author: Patrick Venture <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M hw/gpio/npcm7xx_gpio.c
Log Message:
-----------
hw/gpio: npcm7xx: fixup out-of-bounds access
The reg isn't validated to be a possible register before
it's dereferenced for one case. The mmio space registered
for the gpio device is 4KiB but there aren't that many
registers in the struct.
Cc: [email protected]
Fixes: 526dbbe0874 ("hw/gpio: Add GPIO model for Nuvoton NPCM7xx")
Signed-off-by: Patrick Venture <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Message-id: [email protected]
Signed-off-by: Peter Maydell <[email protected]>
(cherry picked from commit 3b2e22c0bbe2ce07123d93961d52f17644562cd7)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: eed5a30b0b779096136be8e5f8f36eb0743fc0c6
https://github.com/qemu/qemu/commit/eed5a30b0b779096136be8e5f8f36eb0743fc0c6
Author: Peter Maydell <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M target/arm/tcg/translate.c
Log Message:
-----------
target/arm: Correct LDRD atomicity and fault behaviour
Our LDRD implementation is wrong in two respects:
* if the address is 4-aligned and the load crosses a page boundary
and the second load faults and the first load was to the
base register (as in cases like "ldrd r2, r3, [r2]", then we
must not update the base register before taking the fault
* if the address is 8-aligned the access must be a 64-bit
single-copy atomic access, not two 32-bit accesses
Rewrite the handling of the loads in LDRD to use a single
tcg_gen_qemu_ld_i64() and split the result into the destination
registers. This allows us to get the atomicity requirements
right, and also implicitly means that we won't update the
base register too early for the page-crossing case.
Note that because we no longer increment 'addr' by 4 in the course of
performing the LDRD we must change the adjustment value we pass to
op_addr_ri_post() and op_addr_rr_post(): it no longer needs to
subtract 4 to get the correct value to use if doing base register
writeback.
STRD has the same problem with not getting the atomicity right;
we will deal with that in the following commit.
Cc: [email protected]
Reported-by: Stu Grossman <[email protected]>
Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-id: [email protected]
(cherry picked from commit cde3247651dc998da5dc1005148302a90d72f21f)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: f5a001d41e511b32f74869f3c1de510965a3eae8
https://github.com/qemu/qemu/commit/f5a001d41e511b32f74869f3c1de510965a3eae8
Author: Peter Maydell <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M target/arm/tcg/translate.c
Log Message:
-----------
target/arm: Correct STRD atomicity
Our STRD implementation doesn't correctly implement the requirement:
* if the address is 8-aligned the access must be a 64-bit
single-copy atomic access, not two 32-bit accesses
Rewrite the handling of STRD to use a single tcg_gen_qemu_st_i64()
of a value produced by concatenating the two 32 bit source registers.
This allows us to get the atomicity right.
As with the LDRD change, now that we don't update 'addr' in the
course of performing the store we need to adjust the offset
we pass to op_addr_ri_post() and op_addr_rr_post().
Cc: [email protected]
Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-id: [email protected]
(cherry picked from commit ee786ca115045a2b7e86ac3073b0761cb99e0d49)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: 93c0898ffa0de301d1b6cc788c2c7d15e6b05e7b
https://github.com/qemu/qemu/commit/93c0898ffa0de301d1b6cc788c2c7d15e6b05e7b
Author: Peter Maydell <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M util/qemu-timer.c
Log Message:
-----------
util/qemu-timer.c: Don't warp timer from timerlist_rearm()
Currently we call icount_start_warp_timer() from timerlist_rearm().
This produces incorrect behaviour, because timerlist_rearm() is
called, for instance, when a timer callback modifies its timer. We
cannot decide here to warp the timer forwards to the next timer
deadline merely because all_cpu_threads_idle() is true, because the
timer callback we were called from (or some other callback later in
the list of callbacks being invoked) may be about to raise a CPU
interrupt and move a CPU from idle to ready.
The only valid place to choose to warp the timer forward is from the
main loop, when we know we have no outstanding IO or timer callbacks
that might be about to wake up a CPU.
For Arm guests, this bug was mostly latent until the refactoring
commit f6fc36deef6abc ("target/arm/helper: Implement
CNTHCTL_EL2.CNT[VP]MASK"), which exposed it because it refactored a
timer callback so that it happened to call timer_mod() first and
raise the interrupt second, when it had previously raised the
interrupt first and called timer_mod() afterwards.
This call seems to have originally derived from the
pre-record-and-replay icount code, which (as of e.g. commit
db1a49726c3c in 2010) in this location did a call to
qemu_notify_event(), necessary to get the icount code in the vCPU
round-robin thread to stop and recalculate the icount deadline when a
timer was reprogrammed from the IO thread. In current QEMU,
everything is done on the vCPU thread when we are in icount mode, so
there's no need to try to notify another thread here.
I suspect that the other reason why this call was doing icount timer
warping is that it pre-dates commit efab87cf79077a from 2015, which
added a call to icount_start_warp_timer() to main_loop_wait(). Once
the call in timerlist_rearm() has been removed, if the timer
callbacks don't cause any CPU to be woken up then we will end up
calling icount_start_warp_timer() from main_loop_wait() when the rr
main loop code calls rr_wait_io_event().
Remove the incorrect call from timerlist_rearm().
Cc: [email protected]
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2703
Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Reviewed-by: Alex Bennée <[email protected]>
Tested-by: Alex Bennée <[email protected]>
Message-id: [email protected]
(cherry picked from commit 02ae315467cee589d02dfb89e13a2a6a8de09fc5)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: f2ec34094217d543d1a30db4ace983ce3cb99184
https://github.com/qemu/qemu/commit/f2ec34094217d543d1a30db4ace983ce3cb99184
Author: Eugenio Pérez <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M net/net.c
Log Message:
-----------
net: parameterize the removing client from nc list
This change is used in later commits so we can avoid the removal of the
netclient if it is delayed.
No functional change intended.
Reviewed-by: Si-Wei Liu <[email protected]>
Acked-by: Jason Wang <[email protected]>
Signed-off-by: Eugenio Pérez <[email protected]>
Signed-off-by: Jason Wang <[email protected]>
(cherry picked from commit db0d4017f9b9e87f962b35dd19a4912bbfcd3cbc)
(Mjt: pick this one up for the following change,
"net: move backend cleanup to NIC cleanup")
Signed-off-by: Michael Tokarev <[email protected]>
Commit: 8778ae6a048067b3be2e25c3aa1fcbc8daeababd
https://github.com/qemu/qemu/commit/8778ae6a048067b3be2e25c3aa1fcbc8daeababd
Author: Eugenio Pérez <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M net/net.c
M net/vhost-vdpa.c
Log Message:
-----------
net: move backend cleanup to NIC cleanup
Commit a0d7215e33 ("vhost-vdpa: do not cleanup the vdpa/vhost-net
structures if peer nic is present") effectively delayed the backend
cleanup, allowing the frontend or the guest to access it resources as
long as the frontend is still visible to the guest.
However it does not clean up the resources until the qemu process is
over. This causes an effective leak if the device is deleted with
device_del, as there is no way to close the vdpa device. This makes
impossible to re-add that device to this or other QEMU instances until
the first instance of QEMU is finished.
Move the cleanup from qemu_cleanup to the NIC deletion and to
net_cleanup.
Fixes: a0d7215e33 ("vhost-vdpa: do not cleanup the vdpa/vhost-net structures if
peer nic is present")
Reported-by: Lei Yang <[email protected]>
Signed-off-by: Eugenio Pérez <[email protected]>
Signed-off-by: Jonah Palmer <[email protected]>
Signed-off-by: Jason Wang <[email protected]>
(cherry picked from commit e7891c575fb294618b172119a91c892b8f4384a2)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: a545ecd4de8d160133da03fb3616589fbe11aa0d
https://github.com/qemu/qemu/commit/a545ecd4de8d160133da03fb3616589fbe11aa0d
Author: Nicholas Piggin <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M hw/ppc/pnv_occ.c
Log Message:
-----------
ppc/pnv/occ: Fix common area sensor offsets
The commit to fix the OCC common area sensor mappings didn't update the
register offsets to match.
Before this change, skiboot reports:
[ 0.347100086,3] OCC: Chip 0 sensor data invalid
Afterward, there is no error and the sensor_groups directory appears
under /sys/firmware/opal/.
The SLW_IMAGE_BASE address looks like a workaround to intercept firmware
memory accesses, but that does not seem to be required now (and would
have been broken by the OCC common area region mapping change anyway).
So it can be removed.
Fixes: 3a1b70b66b5cb4 ("ppc/pnv: Fix OCC common area region mapping")
Signed-off-by: Nicholas Piggin <[email protected]>
(cherry picked from commit 29c041ca7f8d6910c894788482efff892789dcd2)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: d69efd72c870a558c0fc0f4c9876baec048c06a3
https://github.com/qemu/qemu/commit/d69efd72c870a558c0fc0f4c9876baec048c06a3
Author: Peter Maydell <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M hw/net/smc91c111.c
Log Message:
-----------
hw/net/smc91c111: Ignore attempt to pop from empty RX fifo
The SMC91C111 includes an MMU Command register which permits
the guest to remove entries from the RX FIFO. The datasheet
does not specify what happens if the guest tries to do this
when the FIFO is already empty; there are no status registers
containing error bits which might be applicable.
Currently we don't guard at all against pop of an empty
RX FIFO, with the result that we allow the guest to drive
the rx_fifo_len index to negative values, which will cause
smc91c111_receive() to write to the rx_fifo[] array out of
bounds when we receive the next packet.
Instead ignore attempts to pop an empty RX FIFO.
Cc: [email protected]
Fixes: 80337b66a8e7 ("NIC emulation for qemu arm-softmmu")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2780
Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Message-ID: <[email protected]>
Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
(cherry picked from commit 937df81af6757638a7f1908747560dd342947213)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: 1507587d30fd1fced747999e839b3e09a5ad6540
https://github.com/qemu/qemu/commit/1507587d30fd1fced747999e839b3e09a5ad6540
Author: Peter Maydell <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M hw/net/smc91c111.c
Log Message:
-----------
hw/net/smc91c111: Sanitize packet numbers
The smc91c111 uses packet numbers as an index into its internal
s->data[][] array. Valid packet numbers are between 0 and 3, but
the code does not generally check this, and there are various
places where the guest can hand us an arbitrary packet number
and cause an out-of-bounds access to the data array.
Add validation of packet numbers. The datasheet is not very
helpful about how guest errors like this should be handled:
it says nothing on the subject, and none of the documented
error conditions are relevant. We choose to log the situation
with LOG_GUEST_ERROR and silently ignore the attempted operation.
In the places where we are about to access the data[][] array
using a packet number and we know the number is valid because
we got it from somewhere that has already validated, we add
an assert() to document that belief.
Cc: [email protected]
Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Message-ID: <[email protected]>
Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
(cherry picked from commit 2fa3a5b9469615d06091cf473d172794148e1248)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: 486405f88648049aec7da72b7f99a11f85dd1556
https://github.com/qemu/qemu/commit/486405f88648049aec7da72b7f99a11f85dd1556
Author: Peter Maydell <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M hw/net/smc91c111.c
Log Message:
-----------
hw/net/smc91c111: Sanitize packet length on tx
When the smc91c111 transmits a packet, it must read a control byte
which is at the end of the data area and CRC. However, we don't
sanitize the length field in the packet buffer, so if the guest sets
the length field to something large we will try to read past the end
of the packet data buffer when we access the control byte.
As usual, the datasheet says nothing about the behaviour of the
hardware if the guest misprograms it in this way. It says only that
the maximum valid length is 2048 bytes. We choose to log the guest
error and silently drop the packet.
This requires us to factor out the "mark the tx packet as complete"
logic, so we can call it for this "drop packet" case as well as at
the end of the loop when we send a valid packet.
Cc: [email protected]
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2742
Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Message-ID: <[email protected]>
[PMD: Update smc91c111_do_tx() as len > MAX_PACKET_SIZE]
Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
(cherry picked from commit aad6f264add3f2be72acb660816588fe09110069)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: 9757290e49f484ea36acec53b8ff11d241f2f8f5
https://github.com/qemu/qemu/commit/9757290e49f484ea36acec53b8ff11d241f2f8f5
Author: Peter Maydell <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M hw/net/smc91c111.c
Log Message:
-----------
hw/net/smc91c111: Don't allow data register access to overrun buffer
For accesses to the 91c111 data register, the address within the
packet's data frame is determined by a combination of the pointer
register and the offset used to access the data register, so that you
can access data at effectively wider than byte width. The pointer
register's pointer field is 11 bits wide, which is exactly the size
to index a 2048-byte data frame.
We weren't quite getting the logic right for ensuring that we end up
with a pointer value to use in the s->data[][] array that isn't out
of bounds:
* we correctly mask when getting the initial pointer value
* for the "autoincrement the pointer register" case, we
correctly mask after adding 1 so that the pointer register
wraps back around at the 2048 byte mark
* but for the non-autoincrement case where we have to add the
low 2 bits of the data register offset, we don't account
for the possibility that the pointer register is 0x7ff
and the addition should wrap
Fix this bug by factoring out the "get the p value to use as an array
index" into a function, making it use FIELD macro names rather than
hard-coded constants, and having a utility function that does "add a
value and wrap it" that we can use both for the "autoincrement" and
"add the offset bits" codepaths.
Cc: [email protected]
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2758
Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Message-ID: <[email protected]>
Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
(cherry picked from commit 700d3d6dd41de3bd3f1153e3cfe00b93f99b1441)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: 8f9843336a6aaef1505dced5c53b83c3fd3e0c2f
https://github.com/qemu/qemu/commit/8f9843336a6aaef1505dced5c53b83c3fd3e0c2f
Author: Philippe Mathieu-Daudé <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M include/hw/xen/arch_hvm.h
Log Message:
-----------
hw/xen/hvm: Fix Aarch64 typo
There is no TARGET_ARM_64 definition. Luckily enough,
when TARGET_AARCH64 is defined, TARGET_ARM also is.
Fixes: 733766cd373 ("hw/arm: introduce xenpvh machine")
Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Pierrick Bouvier <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-Id: <[email protected]>
(cherry picked from commit 3a11b653a63fee0e43f4ab84b93f068b961d8fe7)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: 7d6622fbeb2f443cc596002dae0a1c269ee8ffa7
https://github.com/qemu/qemu/commit/7d6622fbeb2f443cc596002dae0a1c269ee8ffa7
Author: Kevin Wolf <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M block/snapshot.c
Log Message:
-----------
block: Zero block driver state before reopening
Block drivers assume in their .bdrv_open() implementation that their
state in bs->opaque has been zeroed; it is initially allocated with
g_malloc0() in bdrv_open_driver().
bdrv_snapshot_goto() needs to make sure that it is zeroed again before
calling drv->bdrv_open() to avoid that block drivers use stale values.
One symptom of this bug is VMDK running into a double free when the user
tries to apply an internal snapshot like 'qemu-img snapshot -a test
test.vmdk'. This should be a graceful error because VMDK doesn't support
internal snapshots.
==25507== Invalid free() / delete / delete[] / realloc()
==25507== at 0x484B347: realloc (vg_replace_malloc.c:1801)
==25507== by 0x54B592A: g_realloc (gmem.c:171)
==25507== by 0x1B221D: vmdk_add_extent (../block/vmdk.c:570)
==25507== by 0x1B1084: vmdk_open_sparse (../block/vmdk.c:1059)
==25507== by 0x1AF3D8: vmdk_open (../block/vmdk.c:1371)
==25507== by 0x1A2AE0: bdrv_snapshot_goto (../block/snapshot.c:299)
==25507== by 0x205C77: img_snapshot (../qemu-img.c:3500)
==25507== by 0x58FA087: (below main) (libc_start_call_main.h:58)
==25507== Address 0x832f3e0 is 0 bytes inside a block of size 272 free'd
==25507== at 0x4846B83: free (vg_replace_malloc.c:989)
==25507== by 0x54AEAC4: g_free (gmem.c:208)
==25507== by 0x1AF629: vmdk_close (../block/vmdk.c:2889)
==25507== by 0x1A2A9C: bdrv_snapshot_goto (../block/snapshot.c:290)
==25507== by 0x205C77: img_snapshot (../qemu-img.c:3500)
==25507== by 0x58FA087: (below main) (libc_start_call_main.h:58)
This error was discovered by fuzzing qemu-img.
Cc: [email protected]
Closes: https://gitlab.com/qemu-project/qemu/-/issues/2853
Closes: https://gitlab.com/qemu-project/qemu/-/issues/2851
Reported-by: Denis Rastyogin <[email protected]>
Signed-off-by: Kevin Wolf <[email protected]>
Message-ID: <[email protected]>
Signed-off-by: Kevin Wolf <[email protected]>
(cherry picked from commit b75c5f9879166b86ed7c48b772fdcd0693e8a9a3)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: 172514b52cefcac37e44d5feb9ad2661d43a75af
https://github.com/qemu/qemu/commit/172514b52cefcac37e44d5feb9ad2661d43a75af
Author: Greg Kurz <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M docs/devel/build-system.rst
M docs/devel/kconfig.rst
Log Message:
-----------
docs: Rename default-configs to configs
This was missed at the time.
Fixes: 812b31d3f91 ("configs: rename default-configs to configs and reorganise")
Signed-off-by: Greg Kurz <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Message-ID: <[email protected]>
Signed-off-by: Thomas Huth <[email protected]>
(cherry picked from commit 48170c2d865a5937092b1384421b01cd38113042)
(Mjt: context fix in docs/devel/kconfig.rst)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: 86fc38e7fcc11c2ebed8713809685bbdb172530b
https://github.com/qemu/qemu/commit/86fc38e7fcc11c2ebed8713809685bbdb172530b
Author: Philippe Mathieu-Daudé <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M ui/cocoa.m
Log Message:
-----------
ui/cocoa: Temporarily ignore annoying deprecated declaration warnings
These warnings are breaking some build configurations since 2 months
now (https://gitlab.com/qemu-project/qemu/-/issues/2575):
ui/cocoa.m:662:14: error: 'CVDisplayLinkCreateWithCGDisplay' is deprecated:
first deprecated in macOS 15.0 - use NSView.displayLink(target:selector:),
NSWindow.displayLink(target:selector:), or
NSScreen.displayLink(target:selector:) [-Werror,-Wdeprecated-declarations]
662 | if (!CVDisplayLinkCreateWithCGDisplay(display, &displayLink))
{
| ^
/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/System/Library/Frameworks/CoreVideo.framework/Headers/CVDisplayLink.h:89:20:
note: 'CVDisplayLinkCreateWithCGDisplay' has been explicitly marked deprecated
here
89 | CV_EXPORT CVReturn CVDisplayLinkCreateWithCGDisplay(
| ^
ui/cocoa.m:663:29: error: 'CVDisplayLinkGetNominalOutputVideoRefreshPeriod'
is deprecated: first deprecated in macOS 15.0 - use
NSView.displayLink(target:selector:), NSWindow.displayLink(target:selector:),
or NSScreen.displayLink(target:selector:) [-Werror,-Wdeprecated-declarations]
663 | CVTime period =
CVDisplayLinkGetNominalOutputVideoRefreshPeriod(displayLink);
| ^
/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/System/Library/Frameworks/CoreVideo.framework/Headers/CVDisplayLink.h:182:18:
note: 'CVDisplayLinkGetNominalOutputVideoRefreshPeriod' has been explicitly
marked deprecated here
182 | CV_EXPORT CVTime CVDisplayLinkGetNominalOutputVideoRefreshPeriod(
CVDisplayLinkRef CV_NONNULL displayLink );
| ^
ui/cocoa.m:664:13: error: 'CVDisplayLinkRelease' is deprecated: first
deprecated in macOS 15.0 - use NSView.displayLink(target:selector:),
NSWindow.displayLink(target:selector:), or
NSScreen.displayLink(target:selector:) [-Werror,-Wdeprecated-declarations]
664 | CVDisplayLinkRelease(displayLink);
| ^
/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/System/Library/Frameworks/CoreVideo.framework/Headers/CVDisplayLink.h:249:16:
note: 'CVDisplayLinkRelease' has been explicitly marked deprecated here
249 | CV_EXPORT void CVDisplayLinkRelease( CV_RELEASES_ARGUMENT
CVDisplayLinkRef CV_NULLABLE displayLink );
| ^
3 errors generated.
For the next release, ignore the warnings using #pragma directives.
At least until we figure the correct new API usage.
Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Phil Dennis-Jordan <[email protected]>
Tested-by: Phil Dennis-Jordan <[email protected]>
Message-Id: <[email protected]>
(cherry picked from commit 9cf6e41fe293dd56089faac94c36ff5cb3d96726)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: c06e9d5d4c66afc91c6b652c28caf30cbe61a3f4
https://github.com/qemu/qemu/commit/c06e9d5d4c66afc91c6b652c28caf30cbe61a3f4
Author: Joe Komlodi <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M util/cacheflush.c
Log Message:
-----------
util/cacheflush: Make first DSB unconditional on aarch64
On ARM hosts with CTR_EL0.DIC and CTR_EL0.IDC set, this would only cause
an ISB to be executed during cache maintenance, which could lead to QEMU
executing TBs containing garbage instructions.
This seems to be because the ISB finishes executing instructions and
flushes the pipeline, but the ISB doesn't guarantee that writes from the
executed instructions are committed. If a small enough TB is created, it's
possible that the writes setting up the TB aren't committed by the time the
TB is executed.
This function is intended to be a port of the gcc implementation
(https://github.com/gcc-mirror/gcc/blob/85b46d0795ac76bc192cb8f88b646a647acf98c1/libgcc/config/aarch64/sync-cache.c#L67)
which makes the first DSB unconditional, so we can fix the synchronization
issue by doing that as well.
Cc: [email protected]
Fixes: 664a79735e4deb1 ("util: Specialize flush_idcache_range for aarch64")
Signed-off-by: Joe Komlodi <[email protected]>
Message-id: [email protected]
Reviewed-by: Peter Maydell <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: Peter Maydell <[email protected]>
(cherry picked from commit e6c38d2ab55d66c74ceade5699e22cabe9058d22)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: 8691abc96438c1fc8f75ba45cd84a54060b31489
https://github.com/qemu/qemu/commit/8691abc96438c1fc8f75ba45cd84a54060b31489
Author: Richard Henderson <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M target/arm/tcg/translate-a64.c
M target/arm/tcg/translate-a64.h
M target/arm/tcg/translate.h
Log Message:
-----------
target/arm: Make DisasContext.{fp, sve}_access_checked tristate
The check for fp_excp_el in assert_fp_access_checked is
incorrect. For SME, with StreamingMode enabled, the access
is really against the streaming mode vectors, and access
to the normal fp registers is allowed to be disabled.
C.f. sme_enabled_check.
Convert sve_access_checked to match, even though we don't
currently check the exception state.
Cc: [email protected]
Fixes: 3d74825f4d6 ("target/arm: Add SME enablement checks")
Signed-off-by: Richard Henderson <[email protected]>
Message-id: [email protected]
Reviewed-by: Peter Maydell <[email protected]>
Signed-off-by: Peter Maydell <[email protected]>
(cherry picked from commit 298a04998fa4a6dc977abe9234d98dfcdab98423)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: e4246579107450bdc21bf75e1f7196202d41f756
https://github.com/qemu/qemu/commit/e4246579107450bdc21bf75e1f7196202d41f756
Author: Richard Henderson <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M target/arm/tcg/translate-a64.c
Log Message:
-----------
target/arm: Simplify pstate_sm check in sve_access_check
In StreamingMode, fp_access_checked is handled already.
We cannot fall through to fp_access_check lest we fall
foul of the double-check assertion.
Cc: [email protected]
Fixes: 285b1d5fcef ("target/arm: Handle SME in sve_access_check")
Signed-off-by: Richard Henderson <[email protected]>
Message-id: [email protected]
Reviewed-by: Peter Maydell <[email protected]>
[PMM: move declaration of 'ret' to top of block]
Signed-off-by: Peter Maydell <[email protected]>
(cherry picked from commit cc7abc35dfa790ba6c20473c03745428c1c626b6)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: 79600085615561420deddf330680e9914ffa9322
https://github.com/qemu/qemu/commit/79600085615561420deddf330680e9914ffa9322
Author: Guo Hongyu <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M target/loongarch/insn_trans/trans_vec.c.inc
Log Message:
-----------
target/loongarch: Fix vldi inst
Refer to the link below for a description of the vldi instructions:
https://jia.je/unofficial-loongarch-intrinsics-guide/lsx/misc/#synopsis_88
Fixed errors in vldi instruction implementation.
Signed-off-by: Guo Hongyu <[email protected]>
Tested-by: Xianglai Li <[email protected]>
Signed-off-by: Xianglai Li <[email protected]>
Reviewed-by: Bibo Mao <[email protected]>
Signed-off-by: Bibo Mao <[email protected]>
(cherry picked from commit 02ce6cea71be4f6774351f5e658d50044c5b53b2)
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2865
Signed-off-by: Michael Tokarev <[email protected]>
Commit: ca12e95f1329b74c5fdaf0d92f38110129831090
https://github.com/qemu/qemu/commit/ca12e95f1329b74c5fdaf0d92f38110129831090
Author: Konstantin Shkolnyy <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M hw/virtio/vhost-shadow-virtqueue.c
Log Message:
-----------
vdpa: Fix endian bugs in shadow virtqueue
VDPA didn't work on a big-endian machine due to missing/incorrect
CPU<->LE data format conversions.
Signed-off-by: Konstantin Shkolnyy <[email protected]>
Message-Id: <[email protected]>
Fixes: 10857ec0ad ("vhost: Add VhostShadowVirtqueue")
Acked-by: Eugenio Pérez <[email protected]>
Tested-by: Lei Yang <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
(cherry picked from commit 50e9754149066dc91f58405d3378b589098cb408)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: 4d25ad254b1dfbdd02c5dbc8dd4b3c3be417a82c
https://github.com/qemu/qemu/commit/4d25ad254b1dfbdd02c5dbc8dd4b3c3be417a82c
Author: Konstantin Shkolnyy <[email protected]>
Date: 2025-03-22 (Sat, 22 Mar 2025)
Changed paths:
M net/vhost-vdpa.c
Log Message:
-----------
vdpa: Allow vDPA to work on big-endian machine
Add .set_vnet_le() function that always returns success, assuming that
vDPA h/w always implements LE data format. Otherwise, QEMU disables vDPA and
outputs the message:
"backend does not support LE vnet headers; falling back on userspace virtio"
Reviewed-by: Michael S. Tsirkin <[email protected]>
Acked-by: Eugenio Pérez <[email protected]>
Signed-off-by: Konstantin Shkolnyy <[email protected]>
Signed-off-by: Jason Wang <[email protected]>
(cherry picked from commit b027f55a994af885a7a498a40373a2dcc2d8b15e)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: 0a9b500839d19d70d8900a20383502c7fa254fa0
https://github.com/qemu/qemu/commit/0a9b500839d19d70d8900a20383502c7fa254fa0
Author: Santiago Monserrat Campanello <[email protected]>
Date: 2025-03-24 (Mon, 24 Mar 2025)
Changed paths:
M docs/about/emulation.rst
Log Message:
-----------
docs/about/emulation: Fix broken link
semihosting link to risc-v changed
Signed-off-by: Santiago Monserrat Campanello <[email protected]>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2717
Reviewed-by: Alistair Francis <[email protected]>
Reviewed-by: Thomas Huth <[email protected]>
Message-ID: <[email protected]>
Signed-off-by: Alistair Francis <[email protected]>
(cherry picked from commit 672cb29d1e811180bf1aeefbcb0936ecd5bd3853)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: 3011e4e44188604d8e642cb3edeae045bb23b731
https://github.com/qemu/qemu/commit/3011e4e44188604d8e642cb3edeae045bb23b731
Author: Richard Henderson <[email protected]>
Date: 2025-03-24 (Mon, 24 Mar 2025)
Changed paths:
M linux-user/syscall.c
Log Message:
-----------
linux-user/riscv: Fix handling of cpu mask in riscv_hwprobe syscall
The third argument of the syscall contains the size of the
cpu mask in bytes, not bits. Nor is the size rounded up to
a multiple of sizeof(abi_ulong).
Cc: [email protected]
Reported-by: Andreas Schwab <[email protected]>
Fixes: 9e1c7d982d7 ("linux-user/riscv: Add syscall riscv_hwprobe")
Signed-off-by: Richard Henderson <[email protected]>
Reviewed-by: Alistair Francis <[email protected]>
Message-ID: <[email protected]>
Signed-off-by: Alistair Francis <[email protected]>
(cherry picked from commit 1a010d22b7adecf0fb1c069e1e535af1aa51e9cf)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: d63f951f4746f080fbdc11e577f1fba931be8cdc
https://github.com/qemu/qemu/commit/d63f951f4746f080fbdc11e577f1fba931be8cdc
Author: Nicholas Piggin <[email protected]>
Date: 2025-03-24 (Mon, 24 Mar 2025)
Changed paths:
M target/ppc/cpu_init.c
Log Message:
-----------
target/ppc: Fix e200 duplicate SPRs
DSRR0/1 registers are in the BookE ISA not e200 specific, so
remove the duplicate e200 register definitions.
Cc: Roman Kapl <[email protected]>
Cc: [email protected]
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2768
Fixes: 0e3bf4890906 ("ppc: add DBCR based debugging")
Signed-off-by: Nicholas Piggin <[email protected]>
(cherry picked from commit 73c0c904fc99e2ceecbbded84ec76d40d3f2daae)
(Mjt: context fix for
v9.0.0-935-g581eea5d656b "target/ppc: Split off common embedded TLB init")
Signed-off-by: Michael Tokarev <[email protected]>
Commit: a2d22778addb41facaa7553386c4c39dc4c47499
https://github.com/qemu/qemu/commit/a2d22778addb41facaa7553386c4c39dc4c47499
Author: Jamin Lin <[email protected]>
Date: 2025-03-24 (Mon, 24 Mar 2025)
Changed paths:
M hw/misc/aspeed_hace.c
Log Message:
-----------
hw/misc/aspeed_hace: Fix buffer overflow in has_padding function
The maximum padding size is either 64 or 128 bytes and should always be smaller
than "req_len". If "padding_size" exceeds "req_len", then
"req_len - padding_size" underflows due to "uint32_t" data type, leading to a
large incorrect value (e.g., `0xFFXXXXXX`). This causes an out-of-bounds memory
access, potentially leading to a buffer overflow.
Added a check to ensure "padding_size" does not exceed "req_len" before
computing "pad_offset". This prevents "req_len - padding_size" from underflowing
and avoids accessing invalid memory.
Signed-off-by: Jamin Lin <[email protected]>
Reviewed-by: Cédric Le Goater <[email protected]>
Fixes: 5cd7d8564a8b563da724b9e6264c967f0a091afa ("aspeed/hace: Support AST2600
HACE ")
Link:
https://lore.kernel.org/qemu-devel/[email protected]
Signed-off-by: Cédric Le Goater <[email protected]>
(cherry picked from commit 78877b2e06464f49f777e086845e094ea7bc82ef)
Signed-off-by: Michael Tokarev <[email protected]>
Commit: f671ce11d2a15a58ab752d7cf0b2890c9022c7ba
https://github.com/qemu/qemu/commit/f671ce11d2a15a58ab752d7cf0b2890c9022c7ba
Author: Michael Tokarev <[email protected]>
Date: 2025-03-26 (Wed, 26 Mar 2025)
Changed paths:
M VERSION
Log Message:
-----------
Update version for 8.2.10 release
Signed-off-by: Michael Tokarev <[email protected]>
Compare: https://github.com/qemu/qemu/compare/327f76fbb40e...f671ce11d2a1
To unsubscribe from these emails, change your notification settings at
https://github.com/qemu/qemu/settings/notifications
