Branch: refs/heads/staging-9.1 Home: https://github.com/qemu/qemu Commit: ae2dc2a27acf7115b886c9e1b7138ed4ef025160 https://github.com/qemu/qemu/commit/ae2dc2a27acf7115b886c9e1b7138ed4ef025160 Author: Tiago Pasqualini <tiago.pasqual...@canonical.com> Date: 2024-09-25 (Wed, 25 Sep 2024)
Changed paths: M crypto/pbkdf.c Log Message: ----------- crypto: run qcrypto_pbkdf2_count_iters in a new thread CPU time accounting in the kernel has been demonstrated to have a sawtooth pattern[1][2]. This can cause the getrusage system call to not be as accurate as we are expecting, which can cause this calculation to stall. The kernel discussions shows that this inaccuracy happens when CPU time gets big enough, so this patch changes qcrypto_pbkdf2_count_iters to run in a fresh thread to avoid this inaccuracy. It also adds a sanity check to fail the process if CPU time is not accounted. [1] https://lore.kernel.org/lkml/159231011694.16989.16351419333851309713.tip-bot2@tip-bot2/ [2] https://lore.kernel.org/lkml/20221226031010.4079885-1-maxing....@bytedance.com/t/#m1c7f2fdc0ea742776a70fd1aa2a2e414c437f534 Resolves: #2398 Signed-off-by: Tiago Pasqualini <tiago.pasqual...@canonical.com> Signed-off-by: Daniel P. Berrangé <berra...@redhat.com> (cherry picked from commit c72cab5ad9f849bbcfcf4be7952b8b8946cc626e) Signed-off-by: Michael Tokarev <m...@tls.msk.ru> Commit: 0e8f3eb43ff4fa7d2ef7a79c943e412b812987f9 https://github.com/qemu/qemu/commit/0e8f3eb43ff4fa7d2ef7a79c943e412b812987f9 Author: Daniel P. Berrangé <berra...@redhat.com> Date: 2024-09-25 (Wed, 25 Sep 2024) Changed paths: M crypto/pbkdf-gcrypt.c M crypto/pbkdf-gnutls.c Log Message: ----------- crypto: check gnutls & gcrypt support the requested pbkdf hash Both gnutls and gcrypt can be configured to exclude support for certain algorithms via a runtime check against system crypto policies. Thus it is not sufficient to have a compile time test for hash support in their pbkdf implementations. Reviewed-by: Philippe Mathieu-Daudé <phi...@linaro.org> Signed-off-by: Daniel P. Berrangé <berra...@redhat.com> (cherry picked from commit e6c09ea4f9e5f8af92a6453642b84b9efd52892f) Signed-off-by: Michael Tokarev <m...@tls.msk.ru> Commit: 3148a16b306485c5b6fb30c06f369b4bba476030 https://github.com/qemu/qemu/commit/3148a16b306485c5b6fb30c06f369b4bba476030 Author: Daniel P. Berrangé <berra...@redhat.com> Date: 2024-09-25 (Wed, 25 Sep 2024) Changed paths: M crypto/cipher-nettle.c.inc Log Message: ----------- crypto: avoid leak of ctx when bad cipher mode is given Fixes: Coverity CID 1546884 Reviewed-by: Peter Maydell <peter.mayd...@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <phi...@linaro.org> Signed-off-by: Daniel P. Berrangé <berra...@redhat.com> (cherry picked from commit 586ac2c67d707c2588766c5195d94fa553cc25af) Signed-off-by: Michael Tokarev <m...@tls.msk.ru> Commit: a160fa0fc3bad5c7fca4b8a332a799b5b9222a8c https://github.com/qemu/qemu/commit/a160fa0fc3bad5c7fca4b8a332a799b5b9222a8c Author: Alex Bennée <alex.ben...@linaro.org> Date: 2024-09-25 (Wed, 25 Sep 2024) Changed paths: M .gitlab-ci.d/container-cross.yml M .gitlab-ci.d/crossbuilds.yml R tests/docker/dockerfiles/debian-armel-cross.docker M tests/lcitool/refresh Log Message: ----------- tests/docker: remove debian-armel-cross As debian-11 transitions to LTS we are starting to have problems building the image. While we could update to a later Debian building a 32 bit QEMU without modern floating point is niche host amongst the few remaining 32 bit hosts we regularly build for. For now we still have armhf-debian-cross-container which is currently built from the more recent debian-12. Reviewed-by: Pierrick Bouvier <pierrick.bouv...@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <phi...@linaro.org> Reviewed-by: Richard Henderson <richard.hender...@linaro.org> Signed-off-by: Alex Bennée <alex.ben...@linaro.org> Message-Id: <20240910173900.4154726-2-alex.ben...@linaro.org> (cherry picked from commit d0068b746a0a8cd4bb148527a0d199b130cd5288) Signed-off-by: Michael Tokarev <m...@tls.msk.ru> Commit: 27a15a2a32a1ce3aec30d6ed181d0de7a0e271c2 https://github.com/qemu/qemu/commit/27a15a2a32a1ce3aec30d6ed181d0de7a0e271c2 Author: Alex Bennée <alex.ben...@linaro.org> Date: 2024-09-25 (Wed, 25 Sep 2024) Changed paths: M tests/docker/dockerfiles/debian-i686-cross.docker M tests/docker/dockerfiles/debian-mipsel-cross.docker M tests/lcitool/refresh Log Message: ----------- tests/docker: update debian i686 and mipsel images to bookworm Whatever issues there were which stopped these being updates when the rest were have now been resolved. However mips64el continues to be broken so don't update it here. Reviewed-by: Pierrick Bouvier <pierrick.bouv...@linaro.org> Reviewed-by: Richard Henderson <richard.hender...@linaro.org> Signed-off-by: Alex Bennée <alex.ben...@linaro.org> Message-Id: <20240910173900.4154726-3-alex.ben...@linaro.org> (cherry picked from commit 19d2111059c87d3f58349f27b9be9dee81fc1681) Signed-off-by: Michael Tokarev <m...@tls.msk.ru> Commit: cd320c8a82773b8219e58d5e949db419f51b00f3 https://github.com/qemu/qemu/commit/cd320c8a82773b8219e58d5e949db419f51b00f3 Author: Thomas Huth <th...@redhat.com> Date: 2024-09-25 (Wed, 25 Sep 2024) Changed paths: M .gitlab-ci.d/buildtest.yml M contrib/plugins/Makefile Log Message: ----------- contrib/plugins/Makefile: Add a 'distclean' target Running "make distclean" in the build tree currently fails since this tries to run the "distclean" target in the contrib/plugins/ folder, too, but the Makefile there is missing this target. Thus add 'distclean' there to fix this issue. And to avoid regressions with "make distclean", add this command to one of the build jobs, too. Message-ID: <20240902154749.73876-1-th...@redhat.com> Reviewed-by: Pierrick Bouvier <pierrick.bouv...@linaro.org> Signed-off-by: Thomas Huth <th...@redhat.com> (cherry picked from commit 1231bc7d12c373e445171dda9e7e5146eee7da55) Signed-off-by: Michael Tokarev <m...@tls.msk.ru> Commit: df9aa3dd8c05e1ee58cf38ecf3e2bd5994dbc9ea https://github.com/qemu/qemu/commit/df9aa3dd8c05e1ee58cf38ecf3e2bd5994dbc9ea Author: Volker Rümelin <vr_q...@t-online.de> Date: 2024-09-25 (Wed, 25 Sep 2024) Changed paths: M hw/audio/trace-events M hw/audio/virtio-snd.c Log Message: ----------- hw/audio/virtio-sound: fix heap buffer overflow Currently, the guest may write to the device configuration space, whereas the virtio sound device specification in chapter 5.14.4 clearly states that the fields in the device configuration space are driver-read-only. Remove the set_config function from the virtio_snd class. This also prevents a heap buffer overflow. See QEMU issue #2296. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2296 Signed-off-by: Volker Rümelin <vr_q...@t-online.de> Message-Id: <20240901130112.8242-1-vr_q...@t-online.de> Reviewed-by: Michael S. Tsirkin <m...@redhat.com> Signed-off-by: Michael S. Tsirkin <m...@redhat.com> (cherry picked from commit 7fc6611cad3e9627b23ce83e550b668abba6c886) Signed-off-by: Michael Tokarev <m...@tls.msk.ru> Commit: bec9a96934539cf4d808cc328aa9c6fa9d36274d https://github.com/qemu/qemu/commit/bec9a96934539cf4d808cc328aa9c6fa9d36274d Author: Jan Klötzke <jan.kloet...@kernkonzept.com> Date: 2024-09-25 (Wed, 25 Sep 2024) Changed paths: M hw/intc/arm_gic.c Log Message: ----------- hw/intc/arm_gic: fix spurious level triggered interrupts On GICv2 and later, level triggered interrupts are pending when either the interrupt line is asserted or the interrupt was made pending by a GICD_ISPENDRn write. Making a level triggered interrupt pending by software persists until either the interrupt is acknowledged or cleared by writing GICD_ICPENDRn. As long as the interrupt line is asserted, the interrupt is pending in any case. This logic is transparently implemented in gic_test_pending() for GICv1 and GICv2. The function combines the "pending" irq_state flag (used for edge triggered interrupts and software requests) and the line status (tracked in the "level" field). However, we also incorrectly set the pending flag on a guest write to GICD_ISENABLERn if the line of a level triggered interrupt was asserted. This keeps the interrupt pending even if the line is de-asserted after some time. This incorrect logic is a leftover of the initial 11MPCore GIC implementation. That handles things slightly differently to the architected GICv1 and GICv2. The 11MPCore TRM does not give a lot of detail on the corner cases of its GIC's behaviour, and historically we have not wanted to investigate exactly what it does in reality, so QEMU's GIC model takes the approach of "retain our existing behaviour for 11MPCore, and implement the architectural standard for later GIC revisions". On that basis, commit 8d999995e45c10 in 2013 is where we added the "level-triggered interrupt with the line asserted" handling to gic_test_pending(), and we deliberately kept the old behaviour of gic_test_pending() for REV_11MPCORE. That commit should have added the "only if 11MPCore" condition to the setting of the pending bit on writes to GICD_ISENABLERn, but forgot it. Add the missing "if REV_11MPCORE" condition, so that our behaviour on GICv1 and GICv2 matches the GIC architecture requirements. Cc: qemu-sta...@nongnu.org Fixes: 8d999995e45c10 ("arm_gic: Fix GIC pending behavior") Signed-off-by: Jan Klötzke <jan.kloet...@kernkonzept.com> Message-id: 20240911114826.3558302-1-jan.kloet...@kernkonzept.com Reviewed-by: Peter Maydell <peter.mayd...@linaro.org> [PMM: expanded comment a little and converted to coding-style form; expanded commit message with the historical backstory] Signed-off-by: Peter Maydell <peter.mayd...@linaro.org> (cherry picked from commit 110684c9a69a02cbabfbddcd3afa921826ad565c) Signed-off-by: Michael Tokarev <m...@tls.msk.ru> Commit: b95002f47a4da76f98f62e7dcc8e5eed9a83436a https://github.com/qemu/qemu/commit/b95002f47a4da76f98f62e7dcc8e5eed9a83436a Author: Gert Wollny <gert.wol...@collabora.com> Date: 2024-09-25 (Wed, 25 Sep 2024) Changed paths: M ui/sdl2.c Log Message: ----------- ui/sdl2: set swap interval explicitly when OpenGL is enabled Before 176e3783f2ab (ui/sdl2: OpenGL window context) SDL_CreateRenderer was called unconditionally setting the swap interval to 0. Since SDL_CreateRenderer is now no longer called when OpenGL is enabled, the swap interval is no longer set explicitly and vsync handling depends on the environment settings which may lead to a performance regression with virgl as reported in https://gitlab.com/qemu-project/qemu/-/issues/2565 Restore the old vsync handling by explicitly calling SDL_GL_SetSwapInterval if OpenGL is enabled. Fixes: 176e3783f2ab (ui/sdl2: OpenGL window context) Closes: https://gitlab.com/qemu-project/qemu/-/issues/2565 Signed-off-by: Gert Wollny <gert.wol...@collabora.com> Acked-by: Marc-André Lureau <marcandre.lur...@redhat.com> Message-ID: <01020191e05ce6df-84da6386-62c2-4ce8-840e-ad216ac253dd-000...@eu-west-1.amazonses.com> Signed-off-by: Philippe Mathieu-Daudé <phi...@linaro.org> (cherry picked from commit ae23cd00170baaa2777eb1ee87b70f472dbb3c44) Signed-off-by: Michael Tokarev <m...@tls.msk.ru> Commit: 02833b07b6718e0c7c10e8cd600d917a866da5aa https://github.com/qemu/qemu/commit/02833b07b6718e0c7c10e8cd600d917a866da5aa Author: Daniel P. Berrangé <berra...@redhat.com> Date: 2024-09-25 (Wed, 25 Sep 2024) Changed paths: M .gitlab-ci.d/base.yml Log Message: ----------- gitlab: fix logic for changing docker tag on stable branches This fixes: commit e28112d00703abd136e2411d23931f4f891c9244 Author: Daniel P. Berrangé <berra...@redhat.com> Date: Thu Jun 8 17:40:16 2023 +0100 gitlab: stable staging branches publish containers in a separate tag Due to a copy+paste mistake, that commit included "QEMU_JOB_SKIPPED" in the final rule that was meant to be a 'catch all' for staging branches. As a result stable branches are still splattering dockers from the primary development branch. Signed-off-by: Daniel P. Berrangé <berra...@redhat.com> Reviewed-by: Michael Tokarev <m...@tls.msk.ru> Tested-by: Michael Tokarev <m...@tls.msk.ru> Message-ID: <20240906140958.84755-1-berra...@redhat.com> Signed-off-by: Thomas Huth <th...@redhat.com> (cherry picked from commit 8d5ab746b1e6668ffb0378820b25665b385c8573) Signed-off-by: Michael Tokarev <m...@tls.msk.ru> Commit: 0d889c5c86d0c5acbcd218c3dc5130c170f74361 https://github.com/qemu/qemu/commit/0d889c5c86d0c5acbcd218c3dc5130c170f74361 Author: Mattias Nissler <mniss...@rivosinc.com> Date: 2024-09-25 (Wed, 25 Sep 2024) Changed paths: M hw/pci/pci.c M include/exec/memory.h M include/hw/pci/pci_device.h M system/memory.c M system/physmem.c Log Message: ----------- softmmu: Support concurrent bounce buffers When DMA memory can't be directly accessed, as is the case when running the device model in a separate process without shareable DMA file descriptors, bounce buffering is used. It is not uncommon for device models to request mapping of several DMA regions at the same time. Examples include: * net devices, e.g. when transmitting a packet that is split across several TX descriptors (observed with igb) * USB host controllers, when handling a packet with multiple data TRBs (observed with xhci) Previously, qemu only provided a single bounce buffer per AddressSpace and would fail DMA map requests while the buffer was already in use. In turn, this would cause DMA failures that ultimately manifest as hardware errors from the guest perspective. This change allocates DMA bounce buffers dynamically instead of supporting only a single buffer. Thus, multiple DMA mappings work correctly also when RAM can't be mmap()-ed. The total bounce buffer allocation size is limited individually for each AddressSpace. The default limit is 4096 bytes, matching the previous maximum buffer size. A new x-max-bounce-buffer-size parameter is provided to configure the limit for PCI devices. Signed-off-by: Mattias Nissler <mniss...@rivosinc.com> Reviewed-by: Philippe Mathieu-Daudé <phi...@linaro.org> Acked-by: Peter Xu <pet...@redhat.com> Link: https://lore.kernel.org/r/20240819135455.2957406-1-mniss...@rivosinc.com Signed-off-by: Peter Xu <pet...@redhat.com> (cherry picked from commit 637b0aa139565cb82a7b9269e62214f87082635c) Signed-off-by: Michael Tokarev <m...@tls.msk.ru> Commit: 659eeb16b35839a0ea683a82a3896e7344d12319 https://github.com/qemu/qemu/commit/659eeb16b35839a0ea683a82a3896e7344d12319 Author: David Hildenbrand <da...@redhat.com> Date: 2024-09-25 (Wed, 25 Sep 2024) Changed paths: M include/exec/ramlist.h M system/physmem.c Log Message: ----------- softmmu/physmem: fix memory leak in dirty_memory_extend() As reported by Peter, we might be leaking memory when removing the highest RAMBlock (in the weird ram_addr_t space), and adding a new one. We will fail to realize that we already allocated bitmaps for more dirty memory blocks, and effectively discard the pointers to them. Fix it by getting rid of last_ram_page() and by remembering the number of dirty memory blocks that have been allocated already. While at it, let's use "unsigned int" for the number of blocks, which should be sufficient until we reach ~32 exabytes. Looks like this leak was introduced as we switched from using a single bitmap_zero_extend() to allocating multiple bitmaps: bitmap_zero_extend() relies on g_renew() which should have taken care of this. Resolves: https://lkml.kernel.org/r/CAFEAcA-k7a+VObGAfCFNygQNfCKL=AfX6A4kScq=vssk0pe...@mail.gmail.com Reported-by: Peter Maydell <peter.mayd...@linaro.org> Fixes: 5b82b703b69a ("memory: RCU ram_list.dirty_memory[] for safe RAM hotplug") Reviewed-by: Stefan Hajnoczi <stefa...@redhat.com> Reviewed-by: Peter Xu <pet...@redhat.com> Tested-by: Peter Maydell <peter.mayd...@linaro.org> Cc: qemu-sta...@nongnu.org Cc: Stefan Hajnoczi <stefa...@redhat.com> Cc: Paolo Bonzini <pbonz...@redhat.com> Cc: Peter Xu <pet...@redhat.com> Cc: Philippe Mathieu-Daudé <phi...@linaro.org> Signed-off-by: David Hildenbrand <da...@redhat.com> Link: https://lore.kernel.org/r/20240828090743.128647-1-da...@redhat.com Signed-off-by: Peter Xu <pet...@redhat.com> (cherry picked from commit b84f06c2bee727b3870b4eeccbe3a45c5aea14c1) Signed-off-by: Michael Tokarev <m...@tls.msk.ru> Commit: 97fa3d7fccb1975a33caf011dfd83aba437608d9 https://github.com/qemu/qemu/commit/97fa3d7fccb1975a33caf011dfd83aba437608d9 Author: Fea.Wang <fea.w...@sifive.com> Date: 2024-09-25 (Wed, 25 Sep 2024) Changed paths: M system/physmem.c Log Message: ----------- softmmu/physmem.c: Keep transaction attribute in address_space_map() The follow-up transactions may use the data in the attribution, so keep the value of attribution from the function parameter just as flatview_translate() above. Signed-off-by: Fea.Wang <fea.w...@sifive.com> Cc: qemu-sta...@nongnu.org Fixes: f26404fbee ("Make address_space_map() take a MemTxAttrs argument") Reviewed-by: Philippe Mathieu-Daudé <phi...@linaro.org> Link: https://lore.kernel.org/r/20240912070404.2993976-2-fea.w...@sifive.com Signed-off-by: Peter Xu <pet...@redhat.com> (cherry picked from commit d8d5ca40048b04750de5a0ae0b2b9f153a391951) Signed-off-by: Michael Tokarev <m...@tls.msk.ru> Commit: 73f5d5bfb7b1f53c830bdd41cc20aefe12ab4827 https://github.com/qemu/qemu/commit/73f5d5bfb7b1f53c830bdd41cc20aefe12ab4827 Author: Mattias Nissler <mniss...@rivosinc.com> Date: 2024-09-25 (Wed, 25 Sep 2024) Changed paths: M hw/ide/macio.c M include/hw/ppc/mac_dbdma.h Log Message: ----------- mac_dbdma: Remove leftover `dma_memory_unmap` calls These were passing a NULL buffer pointer unconditionally, which happens to behave in a mostly benign way (except for the chance of an excess memory region unref and a bounce buffer leak). Per the function comment, this was never meant to be accepted though, and triggers an assertion with the "softmmu: Support concurrent bounce buffers" change. Given that the code in question never sets up any mappings, just remove the unnecessary dma_memory_unmap calls along with the DBDMA_io struct fields that are now entirely unused. Signed-off-by: Mattias Nissler <mniss...@rivosinc.com> Message-Id: <20240916175708.1829059-1-mniss...@rivosinc.com> Fixes: be1e343995 ("macio: switch over to new byte-aligned DMA helpers") Reviewed-by: Mark Cave-Ayland <mark.cave-ayl...@ilande.co.uk> Tested-by: Mark Cave-Ayland <mark.cave-ayl...@ilande.co.uk> Signed-off-by: Mark Cave-Ayland <mark.cave-ayl...@ilande.co.uk> (cherry picked from commit 2d0a071e625d7234e8c5623b7e7bf445e1bef72c) Signed-off-by: Michael Tokarev <m...@tls.msk.ru> Commit: 9b42e33bda413faa9d649643548b72a68f203f53 https://github.com/qemu/qemu/commit/9b42e33bda413faa9d649643548b72a68f203f53 Author: Fabiano Rosas <faro...@suse.de> Date: 2024-09-25 (Wed, 25 Sep 2024) Changed paths: M migration/migration.c M migration/savevm.c Log Message: ----------- migration/multifd: Fix rb->receivedmap cleanup race Fix a segmentation fault in multifd when rb->receivedmap is cleared too early. After commit 5ef7e26bdb ("migration/multifd: solve zero page causing multiple page faults"), multifd started using the rb->receivedmap bitmap, which belongs to ram.c and is initialized and *freed* from the ram SaveVMHandlers. Multifd threads are live until migration_incoming_state_destroy(), which is called after qemu_loadvm_state_cleanup(), leading to a crash when accessing rb->receivedmap. process_incoming_migration_co() ... qemu_loadvm_state() multifd_nocomp_recv() qemu_loadvm_state_cleanup() ramblock_recv_bitmap_set_offset() rb->receivedmap = NULL set_bit_atomic(..., rb->receivedmap) ... migration_incoming_state_destroy() multifd_recv_cleanup() multifd_recv_terminate_threads(NULL) Move the loadvm cleanup into migration_incoming_state_destroy(), after multifd_recv_cleanup() to ensure multifd threads have already exited when rb->receivedmap is cleared. Adjust the postcopy listen thread comment to indicate that we still want to skip the cpu synchronization. CC: qemu-sta...@nongnu.org Fixes: 5ef7e26bdb ("migration/multifd: solve zero page causing multiple page faults") Signed-off-by: Fabiano Rosas <faro...@suse.de> Link: https://lore.kernel.org/r/20240917185802.15619-3-faro...@suse.de [peterx: added comment in migration_incoming_state_destroy()] Signed-off-by: Peter Xu <pet...@redhat.com> (cherry picked from commit 4ce56229087860805877075ddb29dd44578365a9) Signed-off-by: Michael Tokarev <m...@tls.msk.ru> Commit: 1faa437db9b5e9217648f1e8db8a03ef93e5aed1 https://github.com/qemu/qemu/commit/1faa437db9b5e9217648f1e8db8a03ef93e5aed1 Author: Jacob Abrams <satur9n...@gmail.com> Date: 2024-09-25 (Wed, 25 Sep 2024) Changed paths: M hw/char/stm32l4x5_usart.c M tests/qtest/stm32l4x5_usart-test.c Log Message: ----------- hw/char/stm32l4x5_usart.c: Enable USART ACK bit response SW modifying USART_CR1 TE bit should cuase HW to respond by altering USART_ISR TEACK bit, and likewise for RE and REACK bit. This resolves some but not all issues necessary for the official STM USART HAL driver to function as is. Fixes: 87b77e6e01ca ("hw/char/stm32l4x5_usart: Enable serial read and write") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2540 Signed-off-by: Jacob Abrams <satur9n...@gmail.com> Message-id: 20240911043255.51966-1-satur9n...@gmail.com Reviewed-by: Peter Maydell <peter.mayd...@linaro.org> Signed-off-by: Peter Maydell <peter.mayd...@linaro.org> (cherry picked from commit 6cce0dcc6f7aaaeb7f17577776da510b04f67c99) Signed-off-by: Michael Tokarev <m...@tls.msk.ru> Commit: 03ee5e0c532d24a689b59495a36111a960420723 https://github.com/qemu/qemu/commit/03ee5e0c532d24a689b59495a36111a960420723 Author: Peter Maydell <peter.mayd...@linaro.org> Date: 2024-09-25 (Wed, 25 Sep 2024) Changed paths: M target/arm/tcg/cpu64.c Log Message: ----------- target/arm: Correct ID_AA64ISAR1_EL1 value for neoverse-v1 The Neoverse-V1 TRM is a bit confused about the layout of the ID_AA64ISAR1_EL1 register, and so its table 3-6 has the wrong value for this ID register. Trust instead section 3.2.74's list of which fields are set. This means that we stop incorrectly reporting FEAT_XS as present, and now report the presence of FEAT_BF16. Cc: qemu-sta...@nongnu.org Reported-by: Marcin Juszkiewicz <marcin.juszkiew...@linaro.org> Signed-off-by: Peter Maydell <peter.mayd...@linaro.org> Reviewed-by: Richard Henderson <richard.hender...@linaro.org> Message-id: 20240917161337.3012188-1-peter.mayd...@linaro.org (cherry picked from commit 8676007eff04bb4e454bcdf92fab3f855bcc59b3) Signed-off-by: Michael Tokarev <m...@tls.msk.ru> Commit: eb40b14740b9507c60805fccb723c3bd8903ab66 https://github.com/qemu/qemu/commit/eb40b14740b9507c60805fccb723c3bd8903ab66 Author: Helge Deller <del...@gmx.de> Date: 2024-09-25 (Wed, 25 Sep 2024) Changed paths: M target/hppa/cpu.h Log Message: ----------- target/hppa: Fix random 32-bit linux-user crashes The linux-user hppa target crashes randomly for me since commit 081a0ed188d8 ("target/hppa: Do not mask in copy_iaoq_entry"). That commit dropped the masking of the IAOQ addresses while copying them from other registers and instead keeps them with all 64 bits up until the full gva is formed with the help of hppa_form_gva_psw(). So, when running in linux-user mode on an emulated 64-bit CPU, we need to mask to a 32-bit address space at the very end in hppa_form_gva_psw() if the PSW-W flag isn't set (which is the case for linux-user on hppa). Fixes: 081a0ed188d8 ("target/hppa: Do not mask in copy_iaoq_entry") Cc: qemu-sta...@nongnu.org # v9.1+ Signed-off-by: Helge Deller <del...@gmx.de> Reviewed-by: Richard Henderson <richard.hender...@linaro.org> (cherry picked from commit d33d3adb573794903380e03e767e06470514cefe) Signed-off-by: Michael Tokarev <m...@tls.msk.ru> Commit: f84b79a8fcf46d73bc2345cf14ca863fa8e05ea6 https://github.com/qemu/qemu/commit/f84b79a8fcf46d73bc2345cf14ca863fa8e05ea6 Author: Arman Nabiev <nabiev.arma...@gmail.com> Date: 2024-09-25 (Wed, 25 Sep 2024) Changed paths: M target/ppc/machine.c Log Message: ----------- target/ppc: Fix migration of CPUs with TLB_EMB TLB type In vmstate_tlbemb a cut-and-paste error meant we gave this vmstate subsection the same "cpu/tlb6xx" name as the vmstate_tlb6xx subsection. This breaks migration load for any CPU using the TLB_EMB CPU type, because when we see the "tlb6xx" name in the incoming data we try to interpret it as a vmstate_tlb6xx subsection, which it isn't the right format for: $ qemu-system-ppc -drive if=none,format=qcow2,file=/home/petmay01/test-images/virt/dummy.qcow2 -monitor stdio -M bamboo QEMU 9.0.92 monitor - type 'help' for more information (qemu) savevm foo (qemu) loadvm foo Missing section footer for cpu Error: Error -22 while loading VM state Correct the incorrect vmstate section name. Since migration for these CPU types was completely broken before, we don't need to care that this is a migration compatibility break. This affects the PPC 405, 440, 460 and e200 CPU families. Cc: qemu-sta...@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2522 Reviewed-by: Peter Maydell <peter.mayd...@linaro.org> Signed-off-by: Arman Nabiev <nabiev.arma...@gmail.com> Signed-off-by: Fabiano Rosas <faro...@suse.de> (cherry picked from commit 203beb6f047467a4abfc8267c234393cea3f471c) Signed-off-by: Michael Tokarev <m...@tls.msk.ru> Commit: 9cd1fd4b5025df866eb0bd8a86230e83ae049882 https://github.com/qemu/qemu/commit/9cd1fd4b5025df866eb0bd8a86230e83ae049882 Author: Fabiano Rosas <faro...@suse.de> Date: 2024-09-25 (Wed, 25 Sep 2024) Changed paths: M migration/multifd-uadk.c Log Message: ----------- migration/multifd: Fix p->iov leak in multifd-uadk.c The send_cleanup() hook should free the p->iov that was allocated at send_setup(). This was missed because the UADK code is conditional on the presence of the accelerator, so it's not tested by default. Fixes: 819dd20636 ("migration/multifd: Add UADK initialization") Reported-by: Peter Xu <pet...@redhat.com> Reviewed-by: Peter Xu <pet...@redhat.com> Signed-off-by: Fabiano Rosas <faro...@suse.de> (cherry picked from commit 405e352d28c24991cacfdebccf67d56c4795cf6e) Signed-off-by: Michael Tokarev <m...@tls.msk.ru> Commit: 51c943931d75959b787ea72e2cf8e79369ac1cd0 https://github.com/qemu/qemu/commit/51c943931d75959b787ea72e2cf8e79369ac1cd0 Author: Bibo Mao <maob...@loongson.cn> Date: 2024-09-26 (Thu, 26 Sep 2024) Changed paths: M hw/loongarch/virt.c Log Message: ----------- hw/loongarch/virt: Add description for virt machine type The description about virt machine type is removed by mistake, add new description here. Here is output result with command "./qemu-system-loongarch64 -M help" Supported machines are: none empty machine virt QEMU LoongArch Virtual Machine (default) x-remote Experimental remote machine Without the patch, it shows as follows: Supported machines are: none empty machine virt (null) (default) x-remote Experimental remote machine Fixes: ef2f11454c(hw/loongarch/virt: Replace Loongson IPI with LoongArch IPI) Signed-off-by: Bibo Mao <maob...@loongson.cn> Reviewed-by: Thomas Huth <th...@redhat.com> Reviewed-by: Michael Tokarev <m...@tls.msk.ru> Signed-off-by: Michael Tokarev <m...@tls.msk.ru> (cherry picked from commit 4265b4f358436252ef36164566f316458f1df671) Signed-off-by: Michael Tokarev <m...@tls.msk.ru> Commit: 4c7c0d2442fbfcbe128198aa5f3613f387f291ac https://github.com/qemu/qemu/commit/4c7c0d2442fbfcbe128198aa5f3613f387f291ac Author: TANG Tiancheng <tangtiancheng....@alibaba-inc.com> Date: 2024-09-28 (Sat, 28 Sep 2024) Changed paths: M tcg/tcg-op-gvec.c Log Message: ----------- tcg: Fix iteration step in 32-bit gvec operation The loop in the 32-bit case of the vector compare operation was incorrectly incrementing by 8 bytes per iteration instead of 4 bytes. This caused the function to process only half of the intended elements. Cc: qemu-sta...@nongnu.org Fixes: 9622c697d1 (tcg: Add gvec compare with immediate and scalar operand) Signed-off-by: TANG Tiancheng <tangtiancheng....@alibaba-inc.com> Reviewed-by: Liu Zhiwei <zhiwei_...@linux.alibaba.com> Reviewed-by: Richard Henderson <richard.hender...@linaro.org> Message-ID: <20240904142739.854-2-zhiwei_...@linux.alibaba.com> Signed-off-by: Richard Henderson <richard.hender...@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <phi...@linaro.org> (cherry picked from commit 9d8d5a5b9078a16b4c0862fe54248c5cc8435648) Signed-off-by: Michael Tokarev <m...@tls.msk.ru> Commit: f8244f3b8c87bd7483c4cc48f86947993bcf32fa https://github.com/qemu/qemu/commit/f8244f3b8c87bd7483c4cc48f86947993bcf32fa Author: Fabiano Rosas <faro...@suse.de> Date: 2024-09-28 (Sat, 28 Sep 2024) Changed paths: M target/ppc/translate/vsx-impl.c.inc Log Message: ----------- target/ppc: Fix lxvx/stxvx facility check The XT check for the lxvx/stxvx instructions is currently inverted. This was introduced during the move to decodetree. >From the ISA: Chapter 7. Vector-Scalar Extension Facility Load VSX Vector Indexed X-form lxvx XT,RA,RB if TX=0 & MSR.VSX=0 then VSX_Unavailable() if TX=1 & MSR.VEC=0 then Vector_Unavailable() ... Let XT be the value 32×TX + T. The code currently does the opposite: if (paired || a->rt >= 32) { REQUIRE_VSX(ctx); } else { REQUIRE_VECTOR(ctx); } This was already fixed for lxv/stxv at commit "2cc0e449d1 (target/ppc: Fix lxv/stxv MSR facility check)", but the indexed forms were missed. Cc: qemu-sta...@nongnu.org Fixes: 70426b5bb7 ("target/ppc: moved stxvx and lxvx from legacy to decodtree") Signed-off-by: Fabiano Rosas <faro...@suse.de> Reviewed-by: Claudio Fontana <cfont...@suse.de> Acked-by: Ilya Leoshkevich <i...@linux.ibm.com> Reviewed-by: Fabiano Rosas <faro...@suse.de> Message-ID: <20240911141651.6914-1-faro...@suse.de> Signed-off-by: Richard Henderson <richard.hender...@linaro.org> (cherry picked from commit 8bded2e73e80823a67f730140788a3c5e60bf4b5) Signed-off-by: Michael Tokarev <m...@tls.msk.ru> Commit: 8fc8dd2efdedec96082777dc3065a389a9ecf5d9 https://github.com/qemu/qemu/commit/8fc8dd2efdedec96082777dc3065a389a9ecf5d9 Author: Mark Cave-Ayland <mark.cave-ayl...@ilande.co.uk> Date: 2024-09-28 (Sat, 28 Sep 2024) Changed paths: M hw/mips/jazz.c Log Message: ----------- hw/mips/jazz: fix typo in in-built NIC alias Commit e104edbb9d ("hw/mips/jazz: use qemu_find_nic_info()") contained a typo in the NIC alias which caused initialisation of the in-built dp83932 NIC to fail when using the normal -nic user,model=dp83932 command line. Fixes: e104edbb9d ("hw/mips/jazz: use qemu_find_nic_info()") Signed-off-by: Mark Cave-Ayland <mark.cave-ayl...@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <phi...@linaro.org> Reviewed-by: David Woodhouse <d...@amazon.co.uk> Reviewed-by: Michael Tokarev <m...@tls.msk.ru> Signed-off-by: Michael Tokarev <m...@tls.msk.ru> (cherry picked from commit 2e4fdf566062c03456230fd8136b88c5c1e5c4bf) Signed-off-by: Michael Tokarev <m...@tls.msk.ru> Commit: bb630d92516cb39ee830566b5e0335a4e14b1cc6 https://github.com/qemu/qemu/commit/bb630d92516cb39ee830566b5e0335a4e14b1cc6 Author: Alex Bennée <alex.ben...@linaro.org> Date: 2024-09-30 (Mon, 30 Sep 2024) Changed paths: M util/qemu-timer.c Log Message: ----------- util/timer: avoid deadlock when shutting down When we shut down a guest we disable the timers. However this can cause deadlock if the guest has queued some async work that is trying to advance system time and spins forever trying to wind time forward. Pay attention to the return code and bail early if we can't wind time forward. Reported-by: Elisha Hollander <just4now666...@gmail.com> Signed-off-by: Alex Bennée <alex.ben...@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouv...@linaro.org> Message-Id: <20240916085400.1046925-15-alex.ben...@linaro.org> (cherry picked from commit bc02be4508d8753d1f6071b77d10f4661587df6f) Signed-off-by: Michael Tokarev <m...@tls.msk.ru> Commit: 7eefbf8bb72c1bec0972ca19901207dc6d2acf5a https://github.com/qemu/qemu/commit/7eefbf8bb72c1bec0972ca19901207dc6d2acf5a Author: Fiona Ebner <f.eb...@proxmox.com> Date: 2024-10-01 (Tue, 01 Oct 2024) Changed paths: M block/copy-before-write.c M block/reqlist.c Log Message: ----------- block/reqlist: allow adding overlapping requests Allow overlapping request by removing the assert that made it impossible. There are only two callers: 1. block_copy_task_create() It already asserts the very same condition before calling reqlist_init_req(). 2. cbw_snapshot_read_lock() There is no need to have read requests be non-overlapping in copy-before-write when used for snapshot-access. In fact, there was no protection against two callers of cbw_snapshot_read_lock() calling reqlist_init_req() with overlapping ranges and this could lead to an assertion failure [1]. In particular, with the reproducer script below [0], two cbw_co_snapshot_block_status() callers could race, with the second calling reqlist_init_req() before the first one finishes and removes its conflicting request. [0]: > #!/bin/bash -e > dd if=/dev/urandom of=/tmp/disk.raw bs=1M count=1024 > ./qemu-img create /tmp/fleecing.raw -f raw 1G > ( > ./qemu-system-x86_64 --qmp stdio \ > --blockdev raw,node-name=node0,file.driver=file,file.filename=/tmp/disk.raw \ > --blockdev > raw,node-name=node1,file.driver=file,file.filename=/tmp/fleecing.raw \ > <<EOF > {"execute": "qmp_capabilities"} > {"execute": "blockdev-add", "arguments": { "driver": "copy-before-write", > "file": "node0", "target": "node1", "node-name": "node3" } } > {"execute": "blockdev-add", "arguments": { "driver": "snapshot-access", > "file": "node3", "node-name": "snap0" } } > {"execute": "nbd-server-start", "arguments": {"addr": { "type": "unix", > "data": { "path": "/tmp/nbd.socket" } } } } > {"execute": "block-export-add", "arguments": {"id": "exp0", "node-name": > "snap0", "type": "nbd", "name": "exp0"}} > EOF > ) & > sleep 5 > while true; do > ./qemu-nbd -d /dev/nbd0 > ./qemu-nbd -c /dev/nbd0 nbd:unix:/tmp/nbd.socket:exportname=exp0 -f raw -r > nbdinfo --map 'nbd+unix:///exp0?socket=/tmp/nbd.socket' > done [1]: > #5 0x000071e5f0088eb2 in __GI___assert_fail (...) at ./assert/assert.c:101 > #6 0x0000615285438017 in reqlist_init_req (...) at ../block/reqlist.c:23 > #7 0x00006152853e2d98 in cbw_snapshot_read_lock (...) at > ../block/copy-before-write.c:237 > #8 0x00006152853e3068 in cbw_co_snapshot_block_status (...) at > ../block/copy-before-write.c:304 > #9 0x00006152853f4d22 in bdrv_co_snapshot_block_status (...) at > ../block/io.c:3726 > #10 0x000061528543a63e in snapshot_access_co_block_status (...) at > ../block/snapshot-access.c:48 > #11 0x00006152853f1a0a in bdrv_co_do_block_status (...) at ../block/io.c:2474 > #12 0x00006152853f2016 in bdrv_co_common_block_status_above (...) at > ../block/io.c:2652 > #13 0x00006152853f22cf in bdrv_co_block_status_above (...) at > ../block/io.c:2732 > #14 0x00006152853d9a86 in blk_co_block_status_above (...) at > ../block/block-backend.c:1473 > #15 0x000061528538da6c in blockstatus_to_extents (...) at ../nbd/server.c:2374 > #16 0x000061528538deb1 in nbd_co_send_block_status (...) at > ../nbd/server.c:2481 > #17 0x000061528538f424 in nbd_handle_request (...) at ../nbd/server.c:2978 > #18 0x000061528538f906 in nbd_trip (...) at ../nbd/server.c:3121 > #19 0x00006152855a7caf in coroutine_trampoline (...) at > ../util/coroutine-ucontext.c:175 Cc: qemu-sta...@nongnu.org Suggested-by: Vladimir Sementsov-Ogievskiy <vsement...@yandex-team.ru> Signed-off-by: Fiona Ebner <f.eb...@proxmox.com> Message-Id: <20240712140716.517911-1-f.eb...@proxmox.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsement...@yandex-team.ru> Signed-off-by: Vladimir Sementsov-Ogievskiy <vsement...@yandex-team.ru> (cherry picked from commit 6475155d519209c80fdda53e05130365aa769838) Signed-off-by: Michael Tokarev <m...@tls.msk.ru> Commit: 767e7d8ae1aee94e63f3d94a77dc1515a8a16dab https://github.com/qemu/qemu/commit/767e7d8ae1aee94e63f3d94a77dc1515a8a16dab Author: Ard Biesheuvel <a...@kernel.org> Date: 2024-10-02 (Wed, 02 Oct 2024) Changed paths: M target/arm/internals.h M target/arm/ptw.c Log Message: ----------- target/arm: Avoid target_ulong for physical address lookups target_ulong is typedef'ed as a 32-bit integer when building the qemu-system-arm target, and this is smaller than the size of an intermediate physical address when LPAE is being used. Given that Linux may place leaf level user page tables in high memory when built for LPAE, the kernel will crash with an external abort as soon as it enters user space when running with more than ~3 GiB of system RAM. So replace target_ulong with vaddr in places where it may carry an address value that is not representable in 32 bits. Fixes: f3639a64f602ea ("target/arm: Use softmmu tlbs for page table walking") Cc: qemu-sta...@nongnu.org Reported-by: Arnd Bergmann <a...@arndb.de> Tested-by: Arnd Bergmann <a...@arndb.de> Reviewed-by: Richard Henderson <richard.hender...@linaro.org> Signed-off-by: Ard Biesheuvel <a...@kernel.org> Message-id: 20240927071051.1444768-1-ardb+...@google.com Signed-off-by: Peter Maydell <peter.mayd...@linaro.org> (cherry picked from commit 67d762e716a7127ecc114e9708254316dd521911) Signed-off-by: Michael Tokarev <m...@tls.msk.ru> Commit: e32ac563b8375ef9dca7b6d02e1cd2feaaab3f58 https://github.com/qemu/qemu/commit/e32ac563b8375ef9dca7b6d02e1cd2feaaab3f58 Author: Jan Luebbe <j...@pengutronix.de> Date: 2024-10-02 (Wed, 02 Oct 2024) Changed paths: M hw/sd/sd.c Log Message: ----------- hw/sd/sdcard: Fix handling of disabled boot partitions The enable bits in the EXT_CSD_PART_CONFIG ext_csd register do *not* specify whether the boot partitions exist, but whether they are enabled for booting. Existence of the boot partitions is specified by a EXT_CSD_BOOT_MULT != 0. Currently, in the case of boot-partition-size=1M and boot-config=0, Linux detects boot partitions of 1M. But as sd_bootpart_offset always returns 0, all reads/writes are mapped to the same offset in the backing file. Fix this bug by calculating the offset independent of which partition is enabled for booting. This bug is unlikely to affect many users with QEMU's current set of boards, because only aspeed sets boot-partition-size, and it also sets boot-config to 8. So to run into this a user would have to manually mark the boot partition non-booting from within the guest. Cc: qemu-sta...@nongnu.org Signed-off-by: Jan Luebbe <j...@pengutronix.de> Message-id: 20240906164834.130257-1-...@pengutronix.de Reviewed-by: Peter Maydell <peter.mayd...@linaro.org> [PMM: added note to commit message about effects of bug] Signed-off-by: Peter Maydell <peter.mayd...@linaro.org> (cherry picked from commit 9601076b3b0bced7ed597d1470e3ff2f4e7177d6) Signed-off-by: Michael Tokarev <m...@tls.msk.ru> Commit: 02ac67c41fbc6c4fe78ccec63dae959f45d13705 https://github.com/qemu/qemu/commit/02ac67c41fbc6c4fe78ccec63dae959f45d13705 Author: Alex Bennée <alex.ben...@linaro.org> Date: 2024-10-03 (Thu, 03 Oct 2024) Changed paths: M tests/docker/dockerfiles/debian-mips64el-cross.docker M tests/lcitool/mappings.yml M tests/lcitool/refresh Log Message: ----------- testing: bump mips64el cross to bookworm and fix package list The mips64el cross setup is very broken for bullseye which has now entered LTS support so is unlikely to be fixed. While we still can't build the container with all packages for bookworm due to a single missing dependency that will hopefully get fixed in due course. For the sake of keeping the CI green we disable the problematic packages via the lcitool's mappings.yml file. See also: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1081535 Signed-off-by: Alex Bennée <alex.ben...@linaro.org> [thuth: Disable the problematic packages via lcitool's mappings.yml] Message-ID: <20241002080333.127172-1-th...@redhat.com> Reviewed-by: Daniel P. Berrangé <berra...@redhat.com> Signed-off-by: Thomas Huth <th...@redhat.com> (cherry picked from commit c60473d29254b79d9437eface8b342e84663ba66) Signed-off-by: Michael Tokarev <m...@tls.msk.ru> Commit: 5762cdaf45b0b75d55d64f3b8f441b140026ccb2 https://github.com/qemu/qemu/commit/5762cdaf45b0b75d55d64f3b8f441b140026ccb2 Author: Marc-André Lureau <marcandre.lur...@redhat.com> Date: 2024-10-04 (Fri, 04 Oct 2024) Changed paths: M ui/vnc.c Log Message: ----------- vnc: fix crash when no console attached Since commit e99441a3793b5 ("ui/curses: Do not use console_select()") qemu_text_console_put_keysym() no longer checks for NULL console argument, which leads to a later crash: Thread 1 "qemu-system-x86" received signal SIGSEGV, Segmentation fault. 0x00005555559ee186 in qemu_text_console_handle_keysym (s=0x0, keysym=31) at ../ui/console-vc.c:332 332 } else if (s->echo && (keysym == '\r' || keysym == '\n')) { (gdb) bt #0 0x00005555559ee186 in qemu_text_console_handle_keysym (s=0x0, keysym=31) at ../ui/console-vc.c:332 #1 0x00005555559e18e5 in qemu_text_console_put_keysym (s=<optimized out>, keysym=<optimized out>) at ../ui/console.c:303 #2 0x00005555559f2e88 in do_key_event (vs=vs@entry=0x5555579045c0, down=down@entry=1, keycode=keycode@entry=60, sym=sym@entry=65471) at ../ui/vnc.c:2034 #3 0x00005555559f845c in ext_key_event (vs=0x5555579045c0, down=1, sym=65471, keycode=<optimized out>) at ../ui/vnc.c:2070 #4 protocol_client_msg (vs=0x5555579045c0, data=<optimized out>, len=<optimized out>) at ../ui/vnc.c:2514 #5 0x00005555559f515c in vnc_client_read (vs=0x5555579045c0) at ../ui/vnc.c:1607 Fixes: e99441a3793b5 ("ui/curses: Do not use console_select()") Fixes: https://issues.redhat.com/browse/RHEL-50529 Cc: qemu-sta...@nongnu.org Signed-off-by: Marc-André Lureau <marcandre.lur...@redhat.com> Reviewed-by: Akihiko Odaki <akihiko.od...@daynix.com> Reviewed-by: Michael Tokarev <m...@tls.msk.ru> Signed-off-by: Michael Tokarev <m...@tls.msk.ru> (cherry picked from commit 0e60fc80938d9ce84274a36ddfaaa640bdef2be8) Signed-off-by: Michael Tokarev <m...@tls.msk.ru> Compare: https://github.com/qemu/qemu/compare/9e4712a8c858...5762cdaf45b0 To unsubscribe from these emails, change your notification settings at https://github.com/qemu/qemu/settings/notifications