[Qemu-commits] [qemu/qemu] bb47b5: acpi: pcihp: allow repeating hot-unpl

qemu-commits
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-commits] [qemu/qemu] bb47b5: acpi: pcihp: allow repeating hot-unpl

From:	Richard Henderson
Subject:	[Qemu-commits] [qemu/qemu] bb47b5: acpi: pcihp: allow repeating hot-unplug requests
Date:	Tue, 16 May 2023 23:58:31 -0700
  Branch: refs/heads/staging-8.0
  Home:   https://github.com/qemu/qemu
  Commit: bb47b5bc2e7a1e7e12c542b8e6510fa37c23b659
      
https://github.com/qemu/qemu/commit/bb47b5bc2e7a1e7e12c542b8e6510fa37c23b659
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   2023-05-10 (Wed, 10 May 2023)

  Changed paths:
    M hw/acpi/pcihp.c

  Log Message:
  -----------
  acpi: pcihp: allow repeating hot-unplug requests

with Q35 using ACPI PCI hotplug by default, user's request to unplug
device is ignored when it's issued before guest OS has been booted.
And any additional attempt to request device hot-unplug afterwards
results in following error:

  "Device XYZ is already in the process of unplug"

arguably it can be considered as a regression introduced by [2],
before which it was possible to issue unplug request multiple
times.

Accept new uplug requests after timeout (1ms). This brings ACPI PCI
hotplug on par with native PCIe unplug behavior [1] and allows user
to repeat unplug requests at propper times.
Set expire timeout to arbitrary 1msec so user won't be able to
flood guest with SCI interrupts by calling device_del in tight loop.

PS:
ACPI spec doesn't mandate what OSPM can do with GPEx.status
bits set before it's booted => it's impl. depended.
Status bits may be retained (I tested with one Windows version)
or cleared (Linux since 2.6 kernel times) during guest's ACPI
subsystem initialization.
Clearing status bits (though not wrong per se) hides the unplug
event from guest, and it's upto user to repeat device_del later
when guest is able to handle unplug requests.

1) 18416c62e3 ("pcie: expire pending delete")
2)
Fixes: cce8944cc9ef ("qdev-monitor: Forbid repeated device_del")
Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
CC: mst@redhat.com
CC: anisinha@redhat.com
CC: jusual@redhat.com
CC: kraxel@redhat.com
Message-Id: <20230418090449.2155757-1-imammedo@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Ani Sinha <anisinha@redhat.com>
(cherry picked from commit 0f689cf5ada4d5df5ab95c7f7aa9fc221afa855d)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: f528cfc3fa91dacc0f5e0bf494164f7d4548e35f
      
https://github.com/qemu/qemu/commit/f528cfc3fa91dacc0f5e0bf494164f7d4548e35f
  Author: Wang Liang <wangliangzz@inspur.com>
  Date:   2023-05-10 (Wed, 10 May 2023)

  Changed paths:
    M block/monitor/block-hmp-cmds.c

  Log Message:
  -----------
  block/monitor: Fix crash when executing HMP commit

hmp_commit() calls blk_is_available() from a non-coroutine context (and
in the main loop). blk_is_available() is a co_wrapper_mixed_bdrv_rdlock
function, and in the non-coroutine context it calls AIO_WAIT_WHILE(),
which crashes if the aio_context lock is not taken before.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1615
Signed-off-by: Wang Liang <wangliangzz@inspur.com>
Message-Id: <20230424103902.45265-1-wangliangzz@126.com>
Reviewed-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
(cherry picked from commit 8c1e8fb2e7fc2cbeb57703e143965a4cd3ad301a)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 8c3cf36260b428087cce801166c0bd1a7f967dc0
      
https://github.com/qemu/qemu/commit/8c3cf36260b428087cce801166c0bd1a7f967dc0
  Author: Alex Bennée <alex.bennee@linaro.org>
  Date:   2023-05-10 (Wed, 10 May 2023)

  Changed paths:
    M qemu-options.hx

  Log Message:
  -----------
  qemu-options: finesse the recommendations around -blockdev

We are a bit premature in recommending -blockdev/-device as the best
way to configure block devices. It seems there are times the more
human friendly -drive still makes sense especially when -snapshot is
involved.

Improve the language to hopefully make things clearer.

Suggested-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Cc: Markus Armbruster <armbru@redhat.com>
Cc: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20230424092249.58552-7-alex.bennee@linaro.org>
(cherry picked from commit c1654c3e37c31fb638597efedcd07d071837b78b)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 9448a0fa112e1e7b1cd11e3bf7b2b1711a89a90d
      
https://github.com/qemu/qemu/commit/9448a0fa112e1e7b1cd11e3bf7b2b1711a89a90d
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2023-05-10 (Wed, 10 May 2023)

  Changed paths:
    M docs/about/deprecated.rst

  Log Message:
  -----------
  docs/about/deprecated.rst: Add "since 7.1" tag to dtb-kaslr-seed deprecation

In commit 5242876f37ca we deprecated the dtb-kaslr-seed property of
the virt board, but forgot the "since n.n" tag in the documentation
of this in deprecated.rst.

This deprecation note first appeared in the 7.1 release, so
retrospectively add the correct "since 7.1" annotation to it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20230420122256.1023709-1-peter.maydell@linaro.org
(cherry picked from commit ac64ebbecf80f6bc764d120f85fe9fa28fbd9e85)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: f0c5a780292bd405bbce818b63757313cafcf262
      
https://github.com/qemu/qemu/commit/f0c5a780292bd405bbce818b63757313cafcf262
  Author: Akihiko Odaki <akihiko.odaki@daynix.com>
  Date:   2023-05-10 (Wed, 10 May 2023)

  Changed paths:
    M target/arm/kvm.c
    M target/arm/kvm64.c
    M target/arm/kvm_arm.h

  Log Message:
  -----------
  target/arm: Initialize debug capabilities only once

kvm_arm_init_debug() used to be called several times on a SMP system as
kvm_arch_init_vcpu() calls it. Move the call to kvm_arch_init() to make
sure it will be called only once; otherwise it will overwrite pointers
to memory allocated with the previous call and leak it.

Fixes: e4482ab7e3 ("target-arm: kvm - add support for HW assisted debug")
Suggested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Message-id: 20230405153644.25300-1-akihiko.odaki@daynix.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
(cherry picked from commit ad5c6ddea327758daa9f0e6edd916be39dce7dca)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 61ef0506390dad5210cac236d834450997b79de3
      
https://github.com/qemu/qemu/commit/61ef0506390dad5210cac236d834450997b79de3
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2023-05-10 (Wed, 10 May 2023)

  Changed paths:
    M hw/net/msf2-emac.c

  Log Message:
  -----------
  hw/net/msf2-emac: Don't modify descriptor in-place in emac_store_desc()

The msf2-emac ethernet controller has functions emac_load_desc() and
emac_store_desc() which read and write the in-memory descriptor
blocks and handle conversion between guest and host endianness.

As currently written, emac_store_desc() does the endianness
conversion in-place; this means that it effectively consumes the
input EmacDesc struct, because on a big-endian host the fields will
be overwritten with the little-endian versions of their values.
Unfortunately, in all the callsites the code continues to access
fields in the EmacDesc struct after it has called emac_store_desc()
-- specifically, it looks at the d.next field.

The effect of this is that on a big-endian host networking doesn't
work because the address of the next descriptor is corrupted.

We could fix this by making the callsite avoid using the struct; but
it's more robust to have emac_store_desc() leave its input alone.

(emac_load_desc() also does an in-place conversion, but here this is
fine, because the function is supposed to be initializing the
struct.)

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20230424151919.1333299-1-peter.maydell@linaro.org
(cherry picked from commit d565f58b38424e9a390a7ea33ff7477bab693fda)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 168f193c5be54fc9a6d725dbb9974c0d2815792a
      
https://github.com/qemu/qemu/commit/168f193c5be54fc9a6d725dbb9974c0d2815792a
  Author: Cédric Le Goater <clg@kaod.org>
  Date:   2023-05-10 (Wed, 10 May 2023)

  Changed paths:
    M hw/arm/boot.c
    M include/hw/arm/boot.h

  Log Message:
  -----------
  hw/arm/boot: Make write_bootloader() public as arm_write_bootloader()

The arm boot.c code includes a utility function write_bootloader()
which assists in writing a boot-code fragment into guest memory,
including handling endianness and fixing it up with entry point
addresses and similar things.  This is useful not just for the boot.c
code but also in board model code, so rename it to
arm_write_bootloader() and make it globally visible.

Since we are making it public, make its API a little neater: move the
AddressSpace* argument to be next to the hwaddr argument, and allow
the fixupcontext array to be const, since we never modify it in this
function.

Cc: qemu-stable@nongnu.org
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Tested-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20230424152717.1333930-2-peter.maydell@linaro.org
[PMM: Split out from another patch by Cédric, added doc comment]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
(cherry picked from commit 0fe43f0abf19bbe24df3dbf0613bb47ed55f1482)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 5477a21350355d557c7dc729782f90c6c71ba9a9
      
https://github.com/qemu/qemu/commit/5477a21350355d557c7dc729782f90c6c71ba9a9
  Author: Cédric Le Goater <clg@kaod.org>
  Date:   2023-05-10 (Wed, 10 May 2023)

  Changed paths:
    M hw/arm/aspeed.c

  Log Message:
  -----------
  hw/arm/aspeed: Use arm_write_bootloader() to write the bootloader

When writing the secondary-CPU stub boot loader code to the guest,
use arm_write_bootloader() instead of directly calling
rom_add_blob_fixed().  This fixes a bug on big-endian hosts, because
arm_write_bootloader() will correctly byte-swap the host-byte-order
array values into the guest-byte-order to write into the guest
memory.

Cc: qemu-stable@nongnu.org
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Tested-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20230424152717.1333930-3-peter.maydell@linaro.org
[PMM: Moved the "make arm_write_bootloader() function public" part
 to its own patch; updated commit message to note that this fixes
 an actual bug; adjust to the API changes noted in previous commit]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
(cherry picked from commit 902bba549fc386b4b9805320ed1a2e5b68478bdd)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 975f12aa528d6cab5cc41efebaf05d7eb7296d94
      
https://github.com/qemu/qemu/commit/975f12aa528d6cab5cc41efebaf05d7eb7296d94
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2023-05-10 (Wed, 10 May 2023)

  Changed paths:
    M hw/arm/raspi.c

  Log Message:
  -----------
  hw/arm/raspi: Use arm_write_bootloader() to write boot code

When writing the secondary-CPU stub boot loader code to the guest,
use arm_write_bootloader() instead of directly calling
rom_add_blob_fixed().  This fixes a bug on big-endian hosts, because
arm_write_bootloader() will correctly byte-swap the host-byte-order
array values into the guest-byte-order to write into the guest
memory.

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Tested-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20230424152717.1333930-4-peter.maydell@linaro.org
(cherry picked from commit 0acbdb4c4ab6b0a09f159bae4899b0737cf64242)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: af08c70ef5204fedb2b974fbecaf65e1b6cc0a2f
      
https://github.com/qemu/qemu/commit/af08c70ef5204fedb2b974fbecaf65e1b6cc0a2f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2023-05-10 (Wed, 10 May 2023)

  Changed paths:
    M hw/intc/allwinner-a10-pic.c

  Log Message:
  -----------
  hw/intc/allwinner-a10-pic: Don't use set_bit()/clear_bit()

The Allwinner PIC model uses set_bit() and clear_bit() to update the
values in its irq_pending[] array when an interrupt arrives.  However
it is using these functions wrongly: they work on an array of type
'long', and it is passing an array of type 'uint32_t'.  Because the
code manually figures out the right array element, this works on
little-endian hosts and on 32-bit big-endian hosts, where bits 0..31
in a 'long' are in the same place as they are in a 'uint32_t'.
However it breaks on 64-bit big-endian hosts.

Remove the use of set_bit() and clear_bit() in favour of using
deposit32() on the array element.  This fixes a bug where on
big-endian 64-bit hosts the guest kernel would hang early on in
bootup.

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20230424152833.1334136-1-peter.maydell@linaro.org
(cherry picked from commit 2c5fa0778c3b4307f9f3af7f27886c46d129c62f)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 6944823a6f56ee4e4db557ce77a6d44d5d78ffaf
      
https://github.com/qemu/qemu/commit/6944823a6f56ee4e4db557ce77a6d44d5d78ffaf
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2023-05-10 (Wed, 10 May 2023)

  Changed paths:
    M target/arm/tcg/translate.c
    M target/arm/translate-a32.h

  Log Message:
  -----------
  target/arm: Define and use new load_cpu_field_low32()

In several places in the 32-bit Arm translate.c, we try to use
load_cpu_field() to load from a CPUARMState field into a TCGv_i32
where the field is actually 64-bit. This works on little-endian
hosts, but gives the wrong half of the register on big-endian.

Add a new load_cpu_field_low32() which loads the low 32 bits
of a 64-bit field into a TCGv_i32. The new macro includes a
compile-time check against accidentally using it on a field
of the wrong size. Use it to fix the two places in the code
where we were using load_cpu_field() on a 64-bit field.

This fixes a bug where on big-endian hosts the guest would
crash after executing an ERET instruction, and a more corner
case one where some UNDEFs for attempted accesses to MSR
banked registers from Secure EL1 might go to the wrong EL.

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230424153909.1419369-2-peter.maydell@linaro.org
(cherry picked from commit 7f3a3d3dc433dc06c0adb480729af80f9c8e3739)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 2daa9e4d7e5797dfe191f5e1edc52fe3c1d9ca44
      
https://github.com/qemu/qemu/commit/2daa9e4d7e5797dfe191f5e1edc52fe3c1d9ca44
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2023-05-10 (Wed, 10 May 2023)

  Changed paths:
    M hw/sd/allwinner-sdhost.c

  Log Message:
  -----------
  hw/sd/allwinner-sdhost: Correctly byteswap descriptor fields

In allwinner_sdhost_process_desc() we just read directly from
guest memory into a host TransferDescriptor struct and back.
This only works on little-endian hosts. Abstract the reading
and writing of descriptors into functions that handle the
byte-swapping so that TransferDescriptor structs as seen by
the rest of the code are always in host-order.

This fixes a failure of one of the avocado tests on s390.

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20230424165053.1428857-2-peter.maydell@linaro.org
(cherry picked from commit 3e20d90824c262de6887aa1bc52af94db69e4310)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: f6227dd60d75f8a709e70263478677ae4f3f1172
      
https://github.com/qemu/qemu/commit/f6227dd60d75f8a709e70263478677ae4f3f1172
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2023-05-10 (Wed, 10 May 2023)

  Changed paths:
    M hw/net/allwinner-sun8i-emac.c

  Log Message:
  -----------
  hw/net/allwinner-sun8i-emac: Correctly byteswap descriptor fields

In allwinner-sun8i-emac we just read directly from guest memory into
a host FrameDescriptor struct and back.  This only works on
little-endian hosts.  Reading and writing of descriptors is already
abstracted into functions; make those functions also handle the
byte-swapping so that TransferDescriptor structs as seen by the rest
of the code are always in host-order, and fix two places that were
doing ad-hoc descriptor reading without using the functions.

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20230424165053.1428857-3-peter.maydell@linaro.org
(cherry picked from commit a4ae17e5ec512862bf73e40dfbb1e7db71f2c1e7)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: a458252c16b26a783aef22767c2a35872b72885d
      
https://github.com/qemu/qemu/commit/a458252c16b26a783aef22767c2a35872b72885d
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   2023-05-10 (Wed, 10 May 2023)

  Changed paths:
    M block/export/export.c
    M block/export/vduse-blk.c

  Log Message:
  -----------
  block/export: call blk_set_dev_ops(blk, NULL, NULL)

Most export types install BlockDeviceOps pointers. It is easy to forget
to remove them because that happens automatically via the "drive" qdev
property in hw/ but not block/export/.

Put blk_set_dev_ops(blk, NULL, NULL) calls in the core export.c code so
the export types don't need to remember.

This fixes the nbd and vhost-user-blk export types.

Fixes: fd6afc501a01 ("nbd/server: Use drained block ops to quiesce the server")
Fixes: ca858a5fe94c ("vhost-user-blk-server: notify client about disk resize")
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-Id: <20230502211119.720647-1-stefanha@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
(cherry picked from commit de79b52604e43fdeba6cee4f5af600b62169f2d2)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 4dc5df865c482c6e8894964c7f300fa556c3b78e
      
https://github.com/qemu/qemu/commit/4dc5df865c482c6e8894964c7f300fa556c3b78e
  Author: Shivaprasad G Bhat <sbhat@linux.ibm.com>
  Date:   2023-05-10 (Wed, 10 May 2023)

  Changed paths:
    M fpu/softfloat.c

  Log Message:
  -----------
  softfloat: Fix the incorrect computation in float32_exp2

The float32_exp2 function is computing wrong exponent of 2.

For example, with the following set of values {0.1, 2.0, 2.0, -1.0},
the expected output would be {1.071773, 4.000000, 4.000000, 0.500000}.
Instead, the function is computing {1.119102, 3.382044, 3.382044, -0.191022}

Looking at the code, the float32_exp2() attempts to do this

                  2     3     4     5           n
  x        x     x     x     x     x           x
 e  = 1 + --- + --- + --- + --- + --- + ... + --- + ...
           1!    2!    3!    4!    5!          n!

But because of the typo it ends up doing

  x        x     x     x     x     x           x
 e  = 1 + --- + --- + --- + --- + --- + ... + --- + ...
           1!    2!    3!    4!    5!          n!

This is because instead of the xnp which holds the numerator, parts_muladd
is using the xp which is just 'x'.  Commit '572c4d862ff2' refactored this
function, and mistakenly used xp instead of xnp.

Cc: qemu-stable@nongnu.org
Fixes: 572c4d862ff2 "softfloat: Convert float32_exp2 to FloatParts"
Partially-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1623
Reported-By: Luca Barbato (https://gitlab.com/lu-zero)
Signed-off-by: Shivaprasad G Bhat <sbhat@linux.ibm.com>
Signed-off-by: Vaibhav Jain <vaibhav@linux.ibm.com>
Message-Id: 
<168304110865.537992.13059030916325018670.stgit@localhost.localdomain>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
(cherry picked from commit 1098cc3fcf952763fc9fd72c1c8fda30a18cc8ea)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 8322e5300fb5fa7fbbe27b1882263159f24c5ae9
      
https://github.com/qemu/qemu/commit/8322e5300fb5fa7fbbe27b1882263159f24c5ae9
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   2023-05-10 (Wed, 10 May 2023)

  Changed paths:
    M meson.build

  Log Message:
  -----------
  meson: leave unnecessary modules out of the build

meson.build files choose whether to build modules based on foo.found()
expressions.  If a feature is enabled (e.g. --enable-gtk), these expressions
are true even if the code is not used by any emulator, and this results
in an unexpected difference between modular and non-modular builds.

For non-modular builds, the files are not included in any binary, and
therefore the source files are never processed.  For modular builds,
however, all .so files are unconditionally built by default, and therefore
a normal "make" tries to build them.  However, the corresponding trace-*.h
files are absent due to this conditional:

if have_system
  trace_events_subdirs += [
    ...
    'ui',
    ...
  ]
endif

which was added to avoid wasting time running tracetool on unused trace-events
files.  This causes a compilation failure; fix it by skipping module builds
entirely if (depending on the module directory) have_block or have_system
are false.

Reported-by: Michael Tokarev <mjt@tls.msk.ru>
Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit ef709860ea12ec59c4cd7373bd2fd7a4e50143ee)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 2197a94cb461c3bfff9d183ae79d4c99964163c4
      
https://github.com/qemu/qemu/commit/2197a94cb461c3bfff9d183ae79d4c99964163c4
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   2023-05-10 (Wed, 10 May 2023)

  Changed paths:
    M blockdev.c

  Log Message:
  -----------
  block: Fix use after free in blockdev_mark_auto_del()

job_cancel_locked() drops the job list lock temporarily and it may call
aio_poll(). We must assume that the list has changed after this call.
Also, with unlucky timing, it can end up freeing the job during
job_completed_txn_abort_locked(), making the job pointer invalid, too.

For both reasons, we can't just continue at block_job_next_locked(job).
Instead, start at the head of the list again after job_cancel_locked()
and skip those jobs that we already cancelled (or that are completing
anyway).

Cc: qemu-stable@nongnu.org
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20230503140142.474404-1-kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
(cherry picked from commit e2626874a32602d4e52971c786ef5ffb4430629d)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 38a598aee3c7d716524f1f7c75e9299a879fcc65
      
https://github.com/qemu/qemu/commit/38a598aee3c7d716524f1f7c75e9299a879fcc65
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   2023-05-10 (Wed, 10 May 2023)

  Changed paths:
    M block/block-backend.c
    M include/block/block-global-state.h

  Log Message:
  -----------
  block: Consistently call bdrv_activate() outside coroutine

Migration code can call bdrv_activate() in coroutine context, whereas
other callers call it outside of coroutines. As it calls other code that
is not supposed to run in coroutines, standardise on running outside of
coroutines.

This adds a no_co_wrapper to switch to the main loop before calling
bdrv_activate().

Cc: qemu-stable@nongnu.org
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20230504115750.54437-3-kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
(cherry picked from commit da4afaff074e56b0fa0d25abf865784148018895)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: e0deae4f49c4b4f0e3f74d716d4bbe0f81390e05
      
https://github.com/qemu/qemu/commit/e0deae4f49c4b4f0e3f74d716d4bbe0f81390e05
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   2023-05-10 (Wed, 10 May 2023)

  Changed paths:
    M block.c
    M block/crypto.c
    M block/parallels.c
    M block/qcow.c
    M block/qcow2.c
    M block/qed.c
    M block/vdi.c
    M block/vhdx.c
    M block/vmdk.c
    M block/vpc.c
    M include/block/block-global-state.h
    M include/sysemu/block-backend-global-state.h

  Log Message:
  -----------
  block: bdrv/blk_co_unref() for calls in coroutine context

These functions must not be called in coroutine context, because they
need write access to the graph.

Cc: qemu-stable@nongnu.org
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20230504115750.54437-4-kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
(cherry picked from commit b2ab5f545fa1eaaf2955dd617bee19a8b3279786)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 3b02d0db4a7424324afbec51e810b837e28b55f8
      
https://github.com/qemu/qemu/commit/3b02d0db4a7424324afbec51e810b837e28b55f8
  Author: Kevin Wolf <kwolf@redhat.com>
  Date:   2023-05-10 (Wed, 10 May 2023)

  Changed paths:
    M blockdev.c

  Log Message:
  -----------
  block: Don't call no_coroutine_fns in qmp_block_resize()

This QMP handler runs in a coroutine, so it must use the corresponding
no_co_wrappers instead.

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2185688
Cc: qemu-stable@nongnu.org
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20230504115750.54437-5-kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
(cherry picked from commit 0c7d204f50c382c6baac8c94bd57af4a022b3888)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: f5301431e811fbc45c6c0e8ab8c2965f8134cfd7
      
https://github.com/qemu/qemu/commit/f5301431e811fbc45c6c0e8ab8c2965f8134cfd7
  Author: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
  Date:   2023-05-10 (Wed, 10 May 2023)

  Changed paths:
    M target/riscv/insn_trans/trans_privileged.c.inc

  Log Message:
  -----------
  target/riscv: Fix itrigger when icount is used

When I boot a ubuntu image, QEMU output a "Bad icount read" message and exit.
The reason is that when execute helper_mret or helper_sret, it will
cause a call to icount_get_raw_locked (), which needs set can_do_io flag
on cpustate.

Thus we setting this flag when execute these two instructions.

Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230324064011.976-1-zhiwei_liu@linux.alibaba.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
(cherry picked from commit df3ac6da476e346a17bad5bc843de1135a269229)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: f91d0db71ed850d0125b8ed3ba8bbe0759a62767
      
https://github.com/qemu/qemu/commit/f91d0db71ed850d0125b8ed3ba8bbe0759a62767
  Author: Bin Meng <bmeng@tinylab.org>
  Date:   2023-05-10 (Wed, 10 May 2023)

  Changed paths:
    M target/riscv/csr.c

  Log Message:
  -----------
  target/riscv: Restore the predicate() NULL check behavior

When reading a non-existent CSR QEMU should raise illegal instruction
exception, but currently it just exits due to the g_assert() check.

This actually reverts commit 0ee342256af9205e7388efdf193a6d8f1ba1a617.
Some comments are also added to indicate that predicate() must be
provided for an implemented CSR.

Reported-by: Fei Wu <fei2.wu@intel.com>
Signed-off-by: Bin Meng <bmeng@tinylab.org>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Message-Id: <20230417043054.3125614-1-bmeng@tinylab.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
(cherry picked from commit eae04c4c131a8d95087c8568eb2cac1988262f25)
(mjt: context edit after ce3af0bbbcdfa "target/riscv: add support for Zcmt 
extension")
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 488ad8b302e58add463e5f1f5619f3b7a2f98f23
      
https://github.com/qemu/qemu/commit/488ad8b302e58add463e5f1f5619f3b7a2f98f23
  Author: Jonathan Cameron <Jonathan.Cameron@huawei.com>
  Date:   2023-05-10 (Wed, 10 May 2023)

  Changed paths:
    M hw/pci-bridge/pci_expander_bridge.c

  Log Message:
  -----------
  hw/pci-bridge: pci_expander_bridge fix type in pxb_cxl_dev_reset()

Reproduce issue with

configure --enable-qom-cast-debug ...

qemu-system-x86_64 -display none -machine q35,cxl=on -device pxb-cxl,bus=pcie.0

  hw/pci-bridge/pci_expander_bridge.c:54:PXB_DEV: Object 0x5570e0b1ada0 is not 
an instance of type pxb
  Aborted

The type conversion results in the right state structure, but PXB_DEV is
not a parent of PXB_CXL_DEV hence the error. Rather than directly
cleaning up the inheritance, this is the minimal fix which will be
followed by the cleanup.

Fixes: 154070eaf6 ("hw/pxb-cxl: Support passthrough HDM Decoders unless 
overridden")
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20230420142750.6950-2-Jonathan.Cameron@huawei.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Cc: qemu-stable@nongnu.org
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
(cherry picked from commit 9136f661c7277777a2f85a7e98438f4fe6472fdc)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 4b59b5bd14861817c2d965316da9c180ec8d1364
      
https://github.com/qemu/qemu/commit/4b59b5bd14861817c2d965316da9c180ec8d1364
  Author: Richard Henderson <richard.henderson@linaro.org>
  Date:   2023-05-11 (Thu, 11 May 2023)

  Changed paths:
    M accel/tcg/cputlb.c

  Log Message:
  -----------
  accel/tcg: Fix atomic_mmu_lookup for reads

A copy-paste bug had us looking at the victim cache for writes.

Cc: qemu-stable@nongnu.org
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Fixes: 08dff435e2 ("tcg: Probe the proper permissions for atomic ops")
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20230505204049.352469-1-richard.henderson@linaro.org>
(cherry picked from commit 8c313254e61ed47a1bf4a2db714b25cdd94fbcce)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 3148fe1ac86f3755addc2ace56750641f1bbfa34
      
https://github.com/qemu/qemu/commit/3148fe1ac86f3755addc2ace56750641f1bbfa34
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2023-05-14 (Sun, 14 May 2023)

  Changed paths:
    M target/arm/ptw.c

  Log Message:
  -----------
  target/arm: Fix handling of SW and NSW bits for stage 2 walks

We currently don't correctly handle the VSTCR_EL2.SW and VTCR_EL2.NSW
configuration bits.  These allow configuration of whether the stage 2
page table walks for Secure IPA and NonSecure IPA should do their
descriptor reads from Secure or NonSecure physical addresses. (This
is separate from how the translation table base address and other
parameters are set: an NS IPA always uses VTTBR_EL2 and VTCR_EL2
for its base address and walk parameters, regardless of the NSW bit,
and similarly for Secure.)

Provide a new function ptw_idx_for_stage_2() which returns the
MMU index to use for descriptor reads, and use it to set up
the .in_ptw_idx wherever we call get_phys_addr_lpae().

For a stage 2 walk, wherever we call get_phys_addr_lpae():
 * .in_ptw_idx should be ptw_idx_for_stage_2() of the .in_mmu_idx
 * .in_secure should be true if .in_mmu_idx is Stage2_S

This allows us to correct S1_ptw_translate() so that it consistently
always sets its (out_secure, out_phys) to the result it gets from the
S2 walk (either by calling get_phys_addr_lpae() or by TLB lookup).
This makes better conceptual sense because the S2 walk should return
us an (address space, address) tuple, not an address that we then
randomly assign to S or NS.

Our previous handling of SW and NSW was broken, so guest code
trying to use these bits to put the s2 page tables in the "other"
address space wouldn't work correctly.

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1600
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230504135425.2748672-3-peter.maydell@linaro.org
(cherry picked from commit fcc0b0418fff655f20fd0cf86a1bbdc41fd2e7c6)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 80a2c1b5feb86c747dbfd580cda059a7b8107983
      
https://github.com/qemu/qemu/commit/80a2c1b5feb86c747dbfd580cda059a7b8107983
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2023-05-14 (Sun, 14 May 2023)

  Changed paths:
    M ui/console.c

  Log Message:
  -----------
  ui: Fix pixel colour channel order for PNG screenshots

When we take a PNG screenshot the ordering of the colour channels in
the data is not correct, resulting in the image having weird
colouring compared to the actual display.  (Specifically, on a
little-endian host the blue and red channels are swapped; on
big-endian everything is wrong.)

This happens because the pixman idea of the pixel data and the libpng
idea differ.  PIXMAN_a8r8g8b8 defines that pixels are 32-bit values,
with A in bits 24-31, R in bits 16-23, G in bits 8-15 and B in bits
0-7.  This means that on little-endian systems the bytes in memory
are
   B G R A
and on big-endian systems they are
   A R G B

libpng, on the other hand, thinks of pixels as being a series of
values for each channel, so its format PNG_COLOR_TYPE_RGB_ALPHA
always wants bytes in the order
   R G B A

This isn't the same as the pixman order for either big or little
endian hosts.

The alpha channel is also unnecessary bulk in the output PNG file,
because there is no alpha information in a screenshot.

To handle the endianness issue, we already define in ui/qemu-pixman.h
various PIXMAN_BE_* and PIXMAN_LE_* values that give consistent
byte-order pixel channel formats.  So we can use PIXMAN_BE_r8g8b8 and
PNG_COLOR_TYPE_RGB, which both have an in-memory byte order of
    R G B
and 3 bytes per pixel.

(PPM format screenshots get this right; they already use the
PIXMAN_BE_r8g8b8 format.)

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1622
Fixes: 9a0a119a382867 ("Added parameter to take screenshot with screendump as 
PNG")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id: 20230502135548.2451309-1-peter.maydell@linaro.org
(cherry picked from commit cd22a0f520f471e3bd33bc19cf3b2fa772cdb2a8)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: e09f912550ef9a8519869005c7e71f1eae869475
      
https://github.com/qemu/qemu/commit/e09f912550ef9a8519869005c7e71f1eae869475
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2023-05-14 (Sun, 14 May 2023)

  Changed paths:
    M target/arm/gdbstub64.c
    M target/arm/helper.c
    M target/arm/internals.h
    M target/arm/ptw.c
    M target/arm/tcg/pauth_helper.c

  Log Message:
  -----------
  target/arm: Correct AArch64.S2MinTxSZ 32-bit EL1 input size check

In check_s2_mmu_setup() we have a check that is attempting to
implement the part of AArch64.S2MinTxSZ that is specific to when EL1
is AArch32:

    if !s1aarch64 then
        // EL1 is AArch32
        min_txsz = Min(min_txsz, 24);

Unfortunately we got this wrong in two ways:

(1) The minimum txsz corresponds to a maximum inputsize, but we got
the sense of the comparison wrong and were faulting for all
inputsizes less than 40 bits

(2) We try to implement this as an extra check that happens after
we've done the same txsz checks we would do for an AArch64 EL1, but
in fact the pseudocode is *loosening* the requirements, so that txsz
values that would fault for an AArch64 EL1 do not fault for AArch32
EL1, because it does Min(old_min, 24), not Max(old_min, 24).

You can see this also in the text of the Arm ARM in table D8-8, which
shows that where the implemented PA size is less than 40 bits an
AArch32 EL1 is still OK with a configured stage2 T0SZ for a 40 bit
IPA, whereas if EL1 is AArch64 then the T0SZ must be big enough to
constrain the IPA to the implemented PA size.

Because of part (2), we can't do this as a separate check, but
have to integrate it into aa64_va_parameters(). Add a new argument
to that function to indicate that EL1 is 32-bit. All the existing
callsites except the one in get_phys_addr_lpae() can pass 'false',
because they are either doing a lookup for a stage 1 regime or
else they don't care about the tsz/tsz_oob fields.

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1627
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230509092059.3176487-1-peter.maydell@linaro.org
(cherry picked from commit 478dccbb99db0bf8f00537dd0b4d0de88d5cb537)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 950882af6769428df019b578579250634a755e09
      
https://github.com/qemu/qemu/commit/950882af6769428df019b578579250634a755e09
  Author: Cédric Le Goater <clg@redhat.com>
  Date:   2023-05-15 (Mon, 15 May 2023)

  Changed paths:
    M util/async.c

  Log Message:
  -----------
  async: Suppress GCC13 false positive in aio_bh_poll()

GCC13 reports an error :

../util/async.c: In function ‘aio_bh_poll’:
include/qemu/queue.h:303:22: error: storing the address of local variable 
‘slice’ in ‘*ctx.bh_slice_list.sqh_last’ [-Werror=dangling-pointer=]
  303 |     (head)->sqh_last = &(elm)->field.sqe_next;                          
\
      |     ~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~
../util/async.c:169:5: note: in expansion of macro ‘QSIMPLEQ_INSERT_TAIL’
  169 |     QSIMPLEQ_INSERT_TAIL(&ctx->bh_slice_list, &slice, next);
      |     ^~~~~~~~~~~~~~~~~~~~
../util/async.c:161:17: note: ‘slice’ declared here
  161 |     BHListSlice slice;
      |                 ^~~~~
../util/async.c:161:17: note: ‘ctx’ declared here

But the local variable 'slice' is removed from the global context list
in following loop of the same routine. Add a pragma to silent GCC.

Cc: Stefan Hajnoczi <stefanha@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Tested-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Message-Id: <20230420202939.1982044-1-clg@kaod.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit d66ba6dc1cce914673bd8a89fca30a7715ea70d1)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
(Mjt: cherry-picked to stable-8.0 to eliminate CI failures on win*)


  Commit: 7ceebe3f90476d8a40b1172364bbdb393eb2ae68
      
https://github.com/qemu/qemu/commit/7ceebe3f90476d8a40b1172364bbdb393eb2ae68
  Author: Shivaprasad G Bhat <sbhat@linux.ibm.com>
  Date:   2023-05-15 (Mon, 15 May 2023)

  Changed paths:
    M target/ppc/translate/vmx-impl.c.inc

  Log Message:
  -----------
  tcg: ppc64: Fix mask generation for vextractdm

In function do_extractm() the mask is calculated as
dup_const(1 << (element_width - 1)). '1' being signed int
works fine for MO_8,16,32. For MO_64, on PPC64 host
this ends up becoming 0 on compilation. The vextractdm
uses MO_64, and it ends up having mask as 0.

Explicitly use 1ULL instead of signed int 1 like its
used everywhere else.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1536
Signed-off-by: Shivaprasad G Bhat <sbhat@linux.ibm.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Lucas Mateus Castro <lucas.araujo@eldorado.org.br>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Message-Id: 
<168319292809.1159309.5817546227121323288.stgit@ltc-boston1.aus.stglabs.ibm.com>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
(cherry picked from commit 6a5d81b17201ab8a95539bad94c8a6c08a42e076)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: b858c53ef632b80f3269773a18b17639b1eec62c
      
https://github.com/qemu/qemu/commit/b858c53ef632b80f3269773a18b17639b1eec62c
  Author: Ilya Leoshkevich <iii@linux.ibm.com>
  Date:   2023-05-16 (Tue, 16 May 2023)

  Changed paths:
    M target/s390x/tcg/translate.c

  Log Message:
  -----------
  target/s390x: Fix EXECUTE of relative branches

Fix a problem similar to the one fixed by commit 703d03a4aaf3
("target/s390x: Fix EXECUTE of relative long instructions"), but now
for relative branches.

Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230426235813.198183-2-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
(cherry picked from commit e8ecdfeb30f087574191cde523e846e023911c8d)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 857f30a327775ab24989c9e20ee015724f3a16d4
      
https://github.com/qemu/qemu/commit/857f30a327775ab24989c9e20ee015724f3a16d4
  Author: Jason Andryuk <jandryuk@gmail.com>
  Date:   2023-05-16 (Tue, 16 May 2023)

  Changed paths:
    M hw/9pfs/trace-events
    M hw/9pfs/xen-9p-backend.c

  Log Message:
  -----------
  9pfs/xen: Fix segfault on shutdown

xen_9pfs_free can't use gnttabdev since it is already closed and NULL-ed
out when free is called.  Do the teardown in _disconnect().  This
matches the setup done in _connect().

trace-events are also added for the XenDevOps functions.

Signed-off-by: Jason Andryuk <jandryuk@gmail.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Message-Id: <20230502143722.15613-1-jandryuk@gmail.com>
[C.S.: - Remove redundant return in xen_9pfs_free().
       - Add comment to trace-events. ]
Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
(cherry picked from commit 92e667f6fd5806a6a705a2a43e572bd9ec6819da)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 8c7966df7b0e1477acfbc2ca3365c4c6abe55203
      
https://github.com/qemu/qemu/commit/8c7966df7b0e1477acfbc2ca3365c4c6abe55203
  Author: Richard Henderson <richard.henderson@linaro.org>
  Date:   2023-05-17 (Wed, 17 May 2023)

  Changed paths:
    M tcg/i386/tcg-target.c.inc

  Log Message:
  -----------
  tcg/i386: Set P_REXW in tcg_out_addi_ptr

The REXW bit must be set to produce a 64-bit pointer result; the
bit is disabled in 32-bit mode, so we can do this unconditionally.

Fixes: 7d9e1ee424b0 ("tcg/i386: Adjust assert in tcg_out_addi_ptr")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1592
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1642
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
(cherry picked from commit 988998503bc6d8c03fbea001a0513e8372fddf28)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


Compare: https://github.com/qemu/qemu/compare/bb47b5bc2e7a%5E...8c7966df7b0e
[Prev in Thread]
Current Thread
[Next in Thread]
[Qemu-commits] [qemu/qemu] bb47b5: acpi: pcihp: allow repeating hot-unplug requests, Richard Henderson <=
Prev by Date: [Qemu-commits] [qemu/qemu] 988998: tcg/i386: Set P_REXW in tcg_out_addi_ptr
Next by Date: [Qemu-commits] [qemu/qemu] acf607: async: Suppress GCC13 false positive in aio_bh_poll()
Previous by thread: [Qemu-commits] [qemu/qemu] d5920b: tcg: Remove TCGv from tcg_gen_qemu_{ld, st}_*
Next by thread: [Qemu-commits] [qemu/qemu] acf607: async: Suppress GCC13 false positive in aio_bh_poll()
Index(es):
- Date
- Thread