[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-commits] [qemu/qemu] db0a21: target/i386: fix size of EBP writebac
From: |
Alex Bennée |
Subject: |
[Qemu-commits] [qemu/qemu] db0a21: target/i386: fix size of EBP writeback in gen_enter() |
Date: |
Mon, 15 Jul 2024 23:21:24 -0700 |
Branch: refs/heads/stable-9.0
Home: https://github.com/qemu/qemu
Commit: db0a21257e58ef65fef75eb15a3673777a3c59f8
https://github.com/qemu/qemu/commit/db0a21257e58ef65fef75eb15a3673777a3c59f8
Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Date: 2024-06-11 (Tue, 11 Jun 2024)
Changed paths:
M target/i386/tcg/translate.c
Log Message:
-----------
target/i386: fix size of EBP writeback in gen_enter()
The calculation of FrameTemp is done using the size indicated by mo_pushpop()
before being written back to EBP, but the final writeback to EBP is done using
the size indicated by mo_stacksize().
In the case where mo_pushpop() is MO_32 and mo_stacksize() is MO_16 then the
final writeback to EBP is done using MO_16 which can leave junk in the top
16-bits of EBP after executing ENTER.
Change the writeback of EBP to use the same size indicated by mo_pushpop() to
ensure that the full value is written back.
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2198
Message-ID: <20240606095319.229650-5-mark.cave-ayland@ilande.co.uk>
Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 3973615e7fbaeef1deeaa067577e373781ced70a)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: 09f36a1f3fb3ebf0f14c9fd6d29611d339028280
https://github.com/qemu/qemu/commit/09f36a1f3fb3ebf0f14c9fd6d29611d339028280
Author: Alexey Dobriyan <adobriyan@yandex-team.ru>
Date: 2024-06-11 (Tue, 11 Jun 2024)
Changed paths:
M hw/net/virtio-net.c
Log Message:
-----------
virtio-net: drop too short packets early
Reproducer from https://gitlab.com/qemu-project/qemu/-/issues/1451
creates small packet (1 segment, len = 10 == n->guest_hdr_len),
then destroys queue.
"if (n->host_hdr_len != n->guest_hdr_len)" is triggered, if body creates
zero length/zero segment packet as there is nothing after guest header.
qemu_sendv_packet_async() tries to send it.
slirp discards it because it is smaller than Ethernet header,
but returns 0 because tx hooks are supposed to return total length of data.
0 is propagated upwards and is interpreted as "packet has been sent"
which is terrible because queue is being destroyed, nobody is waiting for TX
to complete and assert it triggered.
Fix is discard such empty packets instead of sending them.
Length 1 packets will go via different codepath:
virtqueue_push(q->tx_vq, elem, 0);
virtio_notify(vdev, q->tx_vq);
g_free(elem);
and aren't problematic.
Signed-off-by: Alexey Dobriyan <adobriyan@yandex-team.ru>
Signed-off-by: Jason Wang <jasowang@redhat.com>
(cherry picked from commit 2c3e4e2de699cd4d9f6c71f30a22d8f125cd6164)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: 0d90c36d9c1eda2a7c39839475df4bf3f4758920
https://github.com/qemu/qemu/commit/0d90c36d9c1eda2a7c39839475df4bf3f4758920
Author: Dongwon Kim <dongwon.kim@intel.com>
Date: 2024-06-11 (Tue, 11 Jun 2024)
Changed paths:
M ui/gtk-egl.c
M ui/gtk-gl-area.c
Log Message:
-----------
ui/gtk: Draw guest frame at refresh cycle
Draw routine needs to be manually invoked in the next refresh
if there is a scanout blob from the guest. This is to prevent
a situation where there is a scheduled draw event but it won't
happen bacause the window is currently in inactive state
(minimized or tabified). If draw is not done for a long time,
gl_block timeout and/or fence timeout (on the guest) will happen
eventually.
v2: Use gd_gl_area_draw(vc) in gtk-gl-area.c
Suggested-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
Cc: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Dongwon Kim <dongwon.kim@intel.com>
Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20240426225059.3871283-1-dongwon.kim@intel.com>
(cherry picked from commit 77bf310084dad38b3a2badf01766c659056f1cf2)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: 35e5ce5bd6f446c8a8df04cfeda1edc23e5f19da
https://github.com/qemu/qemu/commit/35e5ce5bd6f446c8a8df04cfeda1edc23e5f19da
Author: Stefan Hajnoczi <stefanha@redhat.com>
Date: 2024-06-14 (Fri, 14 Jun 2024)
Changed paths:
M qapi/qmp-dispatch.c
Log Message:
-----------
Revert "monitor: use aio_co_reschedule_self()"
Commit 1f25c172f837 ("monitor: use aio_co_reschedule_self()") was a code
cleanup that uses aio_co_reschedule_self() instead of open coding
coroutine rescheduling.
Bug RHEL-34618 was reported and Kevin Wolf <kwolf@redhat.com> identified
the root cause. I missed that aio_co_reschedule_self() ->
qemu_get_current_aio_context() only knows about
qemu_aio_context/IOThread AioContexts and not about iohandler_ctx. It
does not function correctly when going back from the iohandler_ctx to
qemu_aio_context.
Go back to open coding the AioContext transitions to avoid this bug.
This reverts commit 1f25c172f83704e350c0829438d832384084a74d.
Cc: qemu-stable@nongnu.org
Buglink: https://issues.redhat.com/browse/RHEL-34618
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20240506190622.56095-2-stefanha@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
(cherry picked from commit 719c6819ed9a9838520fa732f9861918dc693bda)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: 1608a7f81f0e220cba16b351349f6af0f8957b15
https://github.com/qemu/qemu/commit/1608a7f81f0e220cba16b351349f6af0f8957b15
Author: Philippe Mathieu-Daudé <philmd@linaro.org>
Date: 2024-06-20 (Thu, 20 Jun 2024)
Changed paths:
M hw/audio/virtio-snd.c
Log Message:
-----------
hw/audio/virtio-snd: Always use little endian audio format
The VIRTIO Sound Device conforms with the Virtio spec v1.2,
thus only use little endianness.
Remove the suspicious target_words_bigendian() noticed during
code review.
Cc: qemu-stable@nongnu.org
Fixes: eb9ad377bb ("virtio-sound: handle control messages and streams")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20240422211830.25606-1-philmd@linaro.org>
(cherry picked from commit a276ec8e2632c9015d0f9b4e47194e4e91dfa8bb)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: 37f037cb69d0e4232669bca55f56e05213ac2326
https://github.com/qemu/qemu/commit/37f037cb69d0e4232669bca55f56e05213ac2326
Author: Gerd Hoffmann <kraxel@redhat.com>
Date: 2024-06-20 (Thu, 20 Jun 2024)
Changed paths:
M hw/display/vga.c
Log Message:
-----------
stdvga: fix screen blanking
In case the display surface uses a shared buffer (i.e. uses vga vram
directly instead of a shadow) go unshare the buffer before clearing it.
This avoids vga memory corruption, which in turn fixes unblanking not
working properly with X11.
Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2067
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20240605131444.797896-2-kraxel@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
(cherry picked from commit b1cf266c82cb1211ee2785f1813a6a3f3e693390)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: 7ee955223ede77900d1f96a3ad2b4ed783163537
https://github.com/qemu/qemu/commit/7ee955223ede77900d1f96a3ad2b4ed783163537
Author: Anton Johansson <anjo@rev.ng>
Date: 2024-06-20 (Thu, 20 Jun 2024)
Changed paths:
M accel/tcg/tb-maint.c
Log Message:
-----------
accel/tcg: Fix typo causing tb->page_addr[1] to not be recorded
For TBs crossing page boundaries, the 2nd page will never be
recorded/removed, as the index of the 2nd page is computed from the
address of the 1st page. This is due to a typo, fix it.
Cc: qemu-stable@nongnu.org
Fixes: deba78709a ("accel/tcg: Always lock pages before translation")
Signed-off-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20240612133031.15298-1-anjo@rev.ng>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
(cherry picked from commit 3b279f73fa37bec8d3ba04a15f5153d6491cffaf)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: 0556f5fc1356374b652dda5cd9deb85dfb08bd33
https://github.com/qemu/qemu/commit/0556f5fc1356374b652dda5cd9deb85dfb08bd33
Author: Ilya Leoshkevich <iii@linux.ibm.com>
Date: 2024-06-20 (Thu, 20 Jun 2024)
Changed paths:
M linux-user/syscall.c
Log Message:
-----------
linux-user: Make TARGET_NR_setgroups affect only the current thread
Like TARGET_NR_setuid, TARGET_NR_setgroups should affect only the
calling thread, and not the entire process. Therefore, implement it
using a syscall, and not a libc call.
Cc: qemu-stable@nongnu.org
Fixes: 19b84f3c35d7 ("added setgroups and getgroups syscalls")
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20240614154710.1078766-1-iii@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
(cherry picked from commit 54b27921026df384f67df86f04c39539df375c60)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: c8fdbb5babf0cb201c88d55e7e543352352f26e7
https://github.com/qemu/qemu/commit/c8fdbb5babf0cb201c88d55e7e543352352f26e7
Author: Clément Chigot <chigot@adacore.com>
Date: 2024-06-20 (Thu, 20 Jun 2024)
Changed paths:
M target/sparc/helper.c
Log Message:
-----------
target/sparc: use signed denominator in sdiv helper
The result has to be done with the signed denominator (b32) instead of
the unsigned value passed in argument (b).
Cc: qemu-stable@nongnu.org
Fixes: 1326010322d6 ("target/sparc: Remove CC_OP_DIV")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2319
Signed-off-by: Clément Chigot <chigot@adacore.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20240606144331.698361-1-chigot@adacore.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
(cherry picked from commit 6b4965373e561b77f91cfbdf41353635c9661358)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: 658fb89bdcbc59217d83c16140446f279c15eaec
https://github.com/qemu/qemu/commit/658fb89bdcbc59217d83c16140446f279c15eaec
Author: Richard Henderson <richard.henderson@linaro.org>
Date: 2024-06-20 (Thu, 20 Jun 2024)
Changed paths:
M tcg/loongarch64/tcg-target.c.inc
Log Message:
-----------
tcg/loongarch64: Fix tcg_out_movi vs some pcrel pointers
Simplify the logic for two-part, 32-bit pc-relative addresses.
Rather than assume all such fit in int32_t, do some arithmetic
and assert a result, do some arithmetic first and then check
to see if the pieces are in range.
Cc: qemu-stable@nongnu.org
Fixes: dacc51720db ("tcg/loongarch64: Implement tcg_out_mov and tcg_out_movi")
Reviewed-by: Song Gao <gaosong@loongson.cn>
Reported-by: Song Gao <gaosong@loongson.cn>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
(cherry picked from commit 521d7fb3ebdf88112ed13556a93e3037742b9eb8)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: d7a4a38a03936a04a27042a7b397ccb4f1b4ff06
https://github.com/qemu/qemu/commit/d7a4a38a03936a04a27042a7b397ccb4f1b4ff06
Author: Fabiano Rosas <farosas@suse.de>
Date: 2024-06-22 (Sat, 22 Jun 2024)
Changed paths:
M migration/file.c
Log Message:
-----------
migration: Fix file migration with fdset
When the "file:" migration support was added we missed the special
case in the qemu_open_old implementation that allows for a particular
file name format to be used to refer to a set of file descriptors that
have been previously provided to QEMU via the add-fd QMP command.
When using this fdset feature, we should not truncate the migration
file because being given an fd means that the management layer is in
control of the file and will likely already have some data written to
it. This is further indicated by the presence of the 'offset'
argument, which indicates the start of the region where QEMU is
allowed to write.
Fix the issue by replacing the O_TRUNC flag on open by an ftruncate
call, which will take the offset into consideration.
Fixes: 385f510df5 ("migration: file URI offset")
Suggested-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Prasad Pandit <pjp@fedoraproject.org>
Reviewed-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
(cherry picked from commit 6d3279655ac49b806265f08415165f471d33e032)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: bbbbc048a50549008ffb2583bb5312f854072338
https://github.com/qemu/qemu/commit/bbbbc048a50549008ffb2583bb5312f854072338
Author: Thomas Huth <thuth@redhat.com>
Date: 2024-06-30 (Sun, 30 Jun 2024)
Changed paths:
M .gitlab-ci.d/buildtest.yml
M .gitlab-ci.d/container-core.yml
R tests/docker/dockerfiles/centos8.docker
A tests/docker/dockerfiles/centos9.docker
M tests/lcitool/mappings.yml
M tests/lcitool/refresh
M tests/vm/centos
Log Message:
-----------
tests: Update our CI to use CentOS Stream 9 instead of 8
RHEL 9 (and thus also the derivatives) have been available since two
years now, so according to QEMU's support policy, we can drop the active
support for the previous major version 8 now.
Another reason for doing this is that Centos Stream 8 will go EOL soon:
https://blog.centos.org/2023/04/end-dates-are-coming-for-centos-stream-8-and-centos-linux-7/
"After May 31, 2024, CentOS Stream 8 will be archived
and no further updates will be provided."
Thus upgrade our CentOS Stream container to major version 9 now.
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20240418101056.302103-5-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
(cherry picked from commit 641b1efe01b2dd6e7ac92f23d392dcee73508746)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: 50a8a6b4d6bdd423140d37b47779fc006c101e4c
https://github.com/qemu/qemu/commit/50a8a6b4d6bdd423140d37b47779fc006c101e4c
Author: Chuang Xu <xuchuangxclwt@bytedance.com>
Date: 2024-07-01 (Mon, 01 Jul 2024)
Changed paths:
M target/i386/cpu.c
Log Message:
-----------
i386/cpu: fixup number of addressable IDs for processor cores in the physical
package
When QEMU is started with:
-cpu host,host-cache-info=on,l3-cache=off \
-smp 2,sockets=1,dies=1,cores=1,threads=2
Guest can't acquire maximum number of addressable IDs for processor cores in
the physical package from CPUID[04H].
When creating a CPU topology of 1 core per package, host-cache-info only
uses the Host's addressable core IDs field (CPUID.04H.EAX[bits 31-26]),
resulting in a conflict (on the multicore Host) between the Guest core
topology information in this field and the Guest's actual cores number.
Fix it by removing the unnecessary condition to cover 1 core per package
case. This is safe because cores_per_pkg will not be 0 and will be at
least 1.
Fixes: d7caf13b5fcf ("x86: cpu: fixup number of addressable IDs for logical
processors sharing cache")
Signed-off-by: Guixiong Wei <weiguixiong@bytedance.com>
Signed-off-by: Yipeng Yin <yinyipeng@bytedance.com>
Signed-off-by: Chuang Xu <xuchuangxclwt@bytedance.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-ID: <20240611032314.64076-1-xuchuangxclwt@bytedance.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 903916f0a017fe4b7789f1c6c6982333a5a71876)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
(Mjt: fixup for 9.0 due to other changes in this area past 9.0)
Commit: 10b9e0c546de7e73f6cfe9594cbdaf36384e6888
https://github.com/qemu/qemu/commit/10b9e0c546de7e73f6cfe9594cbdaf36384e6888
Author: Richard Henderson <richard.henderson@linaro.org>
Date: 2024-07-02 (Tue, 02 Jul 2024)
Changed paths:
M target/arm/tcg/vec_helper.c
Log Message:
-----------
target/arm: Fix VCMLA Dd, Dn, Dm[idx]
The inner loop, bounded by eltspersegment, must not be
larger than the outer loop, bounded by elements.
Cc: qemu-stable@nongnu.org
Fixes: 18fc2405781 ("target/arm: Implement SVE fp complex multiply add
(indexed)")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2376
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240625183536.1672454-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
(cherry picked from commit 76bccf3cb9d9383da0128bbc6d1300cddbe3ae8f)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: 10f230bd6177cc892677bf76dba3387262123af2
https://github.com/qemu/qemu/commit/10f230bd6177cc892677bf76dba3387262123af2
Author: Richard Henderson <richard.henderson@linaro.org>
Date: 2024-07-02 (Tue, 02 Jul 2024)
Changed paths:
M target/arm/vfp_helper.c
M tests/tcg/aarch64/Makefile.target
A tests/tcg/aarch64/test-2375.c
Log Message:
-----------
target/arm: Fix FJCVTZS vs flush-to-zero
Input denormals cause the Javascript inexact bit
(output to Z) to be set.
Cc: qemu-stable@nongnu.org
Fixes: 6c1f6f2733a ("target/arm: Implement ARMv8.3-JSConv")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2375
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240625183536.1672454-4-richard.henderson@linaro.org
[PMM: fixed hardcoded tab in test case]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
(cherry picked from commit 7619129f0d4a14d918227c5c47ad7433662e9ccc)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: a4fd014e33b8e9a762985aeb24b35d0f262f84b1
https://github.com/qemu/qemu/commit/a4fd014e33b8e9a762985aeb24b35d0f262f84b1
Author: Daniel P. Berrangé <berrange@redhat.com>
Date: 2024-07-03 (Wed, 03 Jul 2024)
Changed paths:
M hw/core/machine-smp.c
M tests/unit/test-smp-parse.c
Log Message:
-----------
hw/core: allow parameter=1 for SMP topology on any machine
This effectively reverts
commit 54c4ea8f3ae614054079395842128a856a73dbf9
Author: Zhao Liu <zhao1.liu@intel.com>
Date: Sat Mar 9 00:01:37 2024 +0800
hw/core/machine-smp: Deprecate unsupported "parameter=1" SMP configurations
but is not done as a 'git revert' since the part of the changes to the
file hw/core/machine-smp.c which add 'has_XXX' checks remain desirable.
Furthermore, we have to tweak the subsequently added unit test to
account for differing warning message.
The rationale for the original deprecation was:
"Currently, it was allowed for users to specify the unsupported
topology parameter as "1". For example, x86 PC machine doesn't
support drawer/book/cluster topology levels, but user could specify
"-smp drawers=1,books=1,clusters=1".
This is meaningless and confusing, so that the support for this kind
of configurations is marked deprecated since 9.0."
There are varying POVs on the topic of 'unsupported' topology levels.
It is common to say that on a system without hyperthreading, that there
is always 1 thread. Likewise when new CPUs introduced a concept of
multiple "dies', it was reasonable to say that all historical CPUs
before that implicitly had 1 'die'. Likewise for the more recently
introduced 'modules' and 'clusters' parameter'. From this POV, it is
valid to set 'parameter=1' on the -smp command line for any machine,
only a value > 1 is strictly an error condition.
It doesn't cause any functional difficulty for QEMU, because internally
the QEMU code is itself assuming that all "unsupported" parameters
implicitly have a value of '1'.
At the libvirt level, we've allowed applications to set 'parameter=1'
when configuring a guest, and pass that through to QEMU.
Deprecating this creates extra difficulty for because there's no info
exposed from QEMU about which machine types "support" which parameters.
Thus, libvirt can't know whether it is valid to pass 'parameter=1' for
a given machine type, or whether it will trigger deprecation messages.
Since there's no apparent functional benefit to deleting this deprecated
behaviour from QEMU, and it creates problems for consumers of QEMU,
remove this deprecation.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Message-ID: <20240513123358.612355-2-berrange@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
(cherry picked from commit 9d7950edb0cdf8f4e5746e220e6e8a9e713bad16)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
(Mjt: remove hunk about modules in hw/core/machine-smp.c introduced in
v9.0.0-155-g8ec0a4634798 "hw/core/machine: Support modules in -smp")
Commit: 68473fdd221f5dcd5747c6147625f5138af46cbc
https://github.com/qemu/qemu/commit/68473fdd221f5dcd5747c6147625f5138af46cbc
Author: Daniel P. Berrangé <berrange@redhat.com>
Date: 2024-07-03 (Wed, 03 Jul 2024)
Changed paths:
M tests/unit/test-smp-parse.c
Log Message:
-----------
tests: add testing of parameter=1 for SMP topology
Validate that it is possible to pass 'parameter=1' for any SMP topology
parameter, since unsupported parameters are implicitly considered to
always have a value of 1.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Message-ID: <20240513123358.612355-3-berrange@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
(cherry picked from commit e68dcbb07923df0886802727edc3b21a10b0d342)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: 312ca4065b236b1c6eea649a3138d6ea79149794
https://github.com/qemu/qemu/commit/312ca4065b236b1c6eea649a3138d6ea79149794
Author: Kevin Wolf <kwolf@redhat.com>
Date: 2024-07-03 (Wed, 03 Jul 2024)
Changed paths:
M block/qcow2.c
M tests/qemu-iotests/061
M tests/qemu-iotests/061.out
Log Message:
-----------
qcow2: Don't open data_file with BDRV_O_NO_IO
One use case for 'qemu-img info' is verifying that untrusted images
don't reference an unwanted external file, be it as a backing file or an
external data file. To make sure that calling 'qemu-img info' can't
already have undesired side effects with a malicious image, just don't
open the data file at all with BDRV_O_NO_IO. If nothing ever tries to do
I/O, we don't need to have it open.
This changes the output of iotests case 061, which used 'qemu-img info'
to show that opening an image with an invalid data file fails. After
this patch, it succeeds. Replace this part of the test with a qemu-io
call, but keep the final 'qemu-img info' to show that the invalid data
file is correctly displayed in the output.
Fixes: CVE-2024-4467
Cc: qemu-stable@nongnu.org
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Hanna Czenczek <hreitz@redhat.com>
(cherry picked from commit bd385a5298d7062668e804d73944d52aec9549f1)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: 0bbe8f9b12cfe130494ea4abbc70ac5114325a30
https://github.com/qemu/qemu/commit/0bbe8f9b12cfe130494ea4abbc70ac5114325a30
Author: Kevin Wolf <kwolf@redhat.com>
Date: 2024-07-03 (Wed, 03 Jul 2024)
Changed paths:
M tests/qemu-iotests/244
Log Message:
-----------
iotests/244: Don't store data-file with protocol in image
We want to disable filename parsing for data files because it's too easy
to abuse in malicious image files. Make the test ready for the change by
passing the data file explicitly in command line options.
Cc: qemu-stable@nongnu.org
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Hanna Czenczek <hreitz@redhat.com>
(cherry picked from commit 2eb42a728d27a43fdcad5f37d3f65706ce6deba5)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: 8c022d8af637aa4d253dc3308c79f4d72b67f015
https://github.com/qemu/qemu/commit/8c022d8af637aa4d253dc3308c79f4d72b67f015
Author: Kevin Wolf <kwolf@redhat.com>
Date: 2024-07-03 (Wed, 03 Jul 2024)
Changed paths:
M tests/qemu-iotests/270
Log Message:
-----------
iotests/270: Don't store data-file with json: prefix in image
We want to disable filename parsing for data files because it's too easy
to abuse in malicious image files. Make the test ready for the change by
passing the data file explicitly in command line options.
Cc: qemu-stable@nongnu.org
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Hanna Czenczek <hreitz@redhat.com>
(cherry picked from commit 7e1110664ecbc4826f3c978ccb06b6c1bce823e6)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: 5be2bb40e33091f40b9e0f44f4557b85bc655888
https://github.com/qemu/qemu/commit/5be2bb40e33091f40b9e0f44f4557b85bc655888
Author: Kevin Wolf <kwolf@redhat.com>
Date: 2024-07-03 (Wed, 03 Jul 2024)
Changed paths:
M block.c
Log Message:
-----------
block: Parse filenames only when explicitly requested
When handling image filenames from legacy options such as -drive or from
tools, these filenames are parsed for protocol prefixes, including for
the json:{} pseudo-protocol.
This behaviour is intended for filenames that come directly from the
command line and for backing files, which may come from the image file
itself. Higher level management tools generally take care to verify that
untrusted images don't contain a bad (or any) backing file reference;
'qemu-img info' is a suitable tool for this.
However, for other files that can be referenced in images, such as
qcow2 data files or VMDK extents, the string from the image file is
usually not verified by management tools - and 'qemu-img info' wouldn't
be suitable because in contrast to backing files, it already opens these
other referenced files. So here the string should be interpreted as a
literal local filename. More complex configurations need to be specified
explicitly on the command line or in QMP.
This patch changes bdrv_open_inherit() so that it only parses filenames
if a new parameter parse_filename is true. It is set for the top level
in bdrv_open(), for the file child and for the backing file child. All
other callers pass false and disable filename parsing this way.
Cc: qemu-stable@nongnu.org
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Hanna Czenczek <hreitz@redhat.com>
(cherry picked from commit 7ead946998610657d38d1a505d5f25300d4ca613)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: b4efc4ce2c4a30d113af78c8ccfa580c95b0aa11
https://github.com/qemu/qemu/commit/b4efc4ce2c4a30d113af78c8ccfa580c95b0aa11
Author: Richard Henderson <richard.henderson@linaro.org>
Date: 2024-07-04 (Thu, 04 Jul 2024)
Changed paths:
M tcg/optimize.c
M tests/tcg/x86_64/Makefile.target
A tests/tcg/x86_64/test-2413.c
Log Message:
-----------
tcg/optimize: Fix TCG_COND_TST* simplification of setcond2
Argument ordering for setcond2 is:
output, a_low, a_high, b_low, b_high, cond
The test is supposed to be against b_low, not a_high.
Cc: qemu-stable@nongnu.org
Fixes: ceb9ee06b71 ("tcg/optimize: Handle TCG_COND_TST{EQ,NE}")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2413
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20240701024623.1265028-1-richard.henderson@linaro.org>
(cherry picked from commit a71d9dfbf63db42d6e6ae87fc112d1f5502183bd)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: c13615f78fe926f94f322dc411f831bbcec5d331
https://github.com/qemu/qemu/commit/c13615f78fe926f94f322dc411f831bbcec5d331
Author: Cindy Lu <lulu@redhat.com>
Date: 2024-07-05 (Fri, 05 Jul 2024)
Changed paths:
M hw/virtio/virtio-pci.c
Log Message:
-----------
virtio-pci: Fix the failure process in kvm_virtio_pci_vector_use_one()
In function kvm_virtio_pci_vector_use_one(), the function will only use
the irqfd/vector for itself. Therefore, in the undo label, the failing
process is incorrect.
To fix this, we can just remove this label.
Fixes: f9a09ca3ea ("vhost: add support for configure interrupt")
Cc: qemu-stable@nongnu.org
Signed-off-by: Cindy Lu <lulu@redhat.com>
Message-Id: <20240528084840.194538-1-lulu@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
(cherry picked from commit a113d041e8d0b152d72a7c2bf47dd09aabf9ade2)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: 8c86d8aa6c219a762e7d230b3d6b42d17ca538bf
https://github.com/qemu/qemu/commit/8c86d8aa6c219a762e7d230b3d6b42d17ca538bf
Author: Stefano Garzarella <sgarzare@redhat.com>
Date: 2024-07-05 (Fri, 05 Jul 2024)
Changed paths:
M hw/virtio/virtio.c
Log Message:
-----------
virtio: remove virtio_tswap16s() call in vring_packed_event_read()
Commit d152cdd6f6 ("virtio: use virtio accessor to access packed event")
switched using of address_space_read_cached() to virito_lduw_phys_cached()
to access packed descriptor event.
When we used address_space_read_cached(), we needed to call
virtio_tswap16s() to handle the endianess of the field, but
virito_lduw_phys_cached() already handles it internally, so we no longer
need to call virtio_tswap16s() (as the commit had done for `off_wrap`,
but forgot for `flags`).
Fixes: d152cdd6f6 ("virtio: use virtio accessor to access packed event")
Cc: jasowang@redhat.com
Cc: qemu-stable@nongnu.org
Reported-by: Xoykie <xoykie@gmail.com>
Link:
https://lore.kernel.org/qemu-devel/CAFU8RB_pjr77zMLsM0Unf9xPNxfr_--Tjr49F_eX32ZBc5o2zQ@mail.gmail.com
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Message-Id: <20240701075208.19634-1-sgarzare@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Eugenio Pérez <eperezma@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
(cherry picked from commit 7aa6492401e95fb296dec7cda81e67d91f6037d7)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: 837864aa6c2e632c446e3e891c5b5f93adaf02c2
https://github.com/qemu/qemu/commit/837864aa6c2e632c446e3e891c5b5f93adaf02c2
Author: Maxim Mikityanskiy <maxtram95@gmail.com>
Date: 2024-07-05 (Fri, 05 Jul 2024)
Changed paths:
M chardev/char-stdio.c
Log Message:
-----------
char-stdio: Restore blocking mode of stdout on exit
qemu_chr_open_fd() sets stdout into non-blocking mode. Restore the old
fd flags on exit to avoid breaking unsuspecting applications that run on
the same terminal after qemu and don't expect to get EAGAIN.
While at at, also ensure term_exit is called once (at the moment it's
called both from char_stdio_finalize() and as the atexit() hook.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2423
Signed-off-by: Maxim Mikityanskiy <maxtram95@gmail.com>
Link: https://lore.kernel.org/r/20240703190812.3459514-1-maxtram95@gmail.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit a0124e333e2176640f233e5ea57a2f413985d9b5)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: e4a9b44f7aa8872a67a54a71da474626cdbb830a
https://github.com/qemu/qemu/commit/e4a9b44f7aa8872a67a54a71da474626cdbb830a
Author: Markus Armbruster <armbru@redhat.com>
Date: 2024-07-08 (Mon, 08 Jul 2024)
Changed paths:
M docs/sphinx/qapidoc.py
M qapi/block-core.json
Log Message:
-----------
sphinx/qapidoc: Fix to generate doc for explicit, unboxed arguments
When a command's arguments are specified as an explicit type T,
generated documentation points to the members of T.
Example:
##
# @announce-self:
#
# Trigger generation of broadcast RARP frames to update network
[...]
##
{ 'command': 'announce-self', 'boxed': true,
'data' : 'AnnounceParameters'}
generates
"announce-self" (Command)
-------------------------
Trigger generation of broadcast RARP frames to update network
[...]
Arguments
~~~~~~~~~
The members of "AnnounceParameters"
Except when the command takes its arguments unboxed , i.e. it doesn't
have 'boxed': true, we generate *nothing*. A few commands have a
reference in their doc comment to compensate, but most don't.
Example:
##
# @blockdev-snapshot-sync:
#
# Takes a synchronous snapshot of a block device.
#
# For the arguments, see the documentation of BlockdevSnapshotSync.
[...]
##
{ 'command': 'blockdev-snapshot-sync',
'data': 'BlockdevSnapshotSync',
'allow-preconfig': true }
generates
"blockdev-snapshot-sync" (Command)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Takes a synchronous snapshot of a block device.
For the arguments, see the documentation of BlockdevSnapshotSync.
[...]
Same for event data.
Fix qapidoc.py to generate the reference regardless of boxing. Delete
now redundant references in the doc comments.
Fixes: 4078ee5469e5 (docs/sphinx: Add new qapi-doc Sphinx extension)
Cc: qemu-stable@nongnu.org
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20240628112756.794237-1-armbru@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
(cherry picked from commit e389929d19a543ea5b34d02553b355f9f1c03162)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: e0d660aeeab08c1566d192cf624f59023386d951
https://github.com/qemu/qemu/commit/e0d660aeeab08c1566d192cf624f59023386d951
Author: Vincent Fu <vincentfu@gmail.com>
Date: 2024-07-12 (Fri, 12 Jul 2024)
Changed paths:
M hw/nvme/ctrl.c
Log Message:
-----------
hw/nvme: fix number of PIDs for FDP RUH update
The number of PIDs is in the upper 16 bits of cdw10. So we need to
right-shift by 16 bits instead of only a single bit.
Fixes: 73064edfb864 ("hw/nvme: flexible data placement emulation")
Cc: qemu-stable@nongnu.org
Signed-off-by: Vincent Fu <vincent.fu@samsung.com>
Reviewed-by: Klaus Jensen <k.jensen@samsung.com>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
(cherry picked from commit 3936bbdf9a2e9233875f850c7576c79d06add261)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: 5ebde3b5c00e15f560f73055fac4ab31c0cac6d2
https://github.com/qemu/qemu/commit/5ebde3b5c00e15f560f73055fac4ab31c0cac6d2
Author: Michael Tokarev <mjt@tls.msk.ru>
Date: 2024-07-16 (Tue, 16 Jul 2024)
Changed paths:
M VERSION
Log Message:
-----------
Update version for 9.0.2 release
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Compare: https://github.com/qemu/qemu/compare/60b4f3aff4e3...5ebde3b5c00e
To unsubscribe from these emails, change your notification settings at
https://github.com/qemu/qemu/settings/notifications
[Prev in Thread] |
Current Thread |
[Next in Thread] |
- [Qemu-commits] [qemu/qemu] db0a21: target/i386: fix size of EBP writeback in gen_enter(),
Alex Bennée <=