[Qemu-commits] [qemu/qemu] 509c44: gitlab-ci: Avoid to re-run "configure" in the devi...

[Christian Schoenebeck]

  Branch: refs/heads/staging-7.2
  Home:   https://github.com/qemu/qemu
  Commit: 509c444bacd0f3588891f6cd5c9a0b626f026a76
      
https://github.com/qemu/qemu/commit/509c444bacd0f3588891f6cd5c9a0b626f026a76
  Author: Thomas Huth <thuth@redhat.com>
  Date:   2023-05-31 (Wed, 31 May 2023)

  Changed paths:
    M .gitlab-ci.d/buildtest.yml

  Log Message:
  -----------
  gitlab-ci: Avoid to re-run "configure" in the device-crash-test jobs

After "make check-venv" had been added to these jobs, they started
to re-run "configure" each time since our logic in the makefile
thinks that some files are out of date here. Avoid it with the same
trick that we are using in buildtest-template.yml already by disabling
the up-to-date check via NINJA=":".

Fixes: 1d8cf47e5b ("tests: run 'device-crash-test' from tests/venv")
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20230414145845.456145-2-thuth@redhat.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230424092249.58552-5-alex.bennee@linaro.org>
(cherry picked from commit 4d3bd91b26a69b39a178744d3d6e5f23050afb23)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 369e2c4e2d0771c3df598646340bbfbb1a0cb7db
      
https://github.com/qemu/qemu/commit/369e2c4e2d0771c3df598646340bbfbb1a0cb7db
  Author: Thomas Huth <thuth@redhat.com>
  Date:   2023-05-31 (Wed, 31 May 2023)

  Changed paths:
    M .gitlab-ci.d/buildtest.yml
    M scripts/device-crash-test

  Log Message:
  -----------
  scripts/device-crash-test: Add a parameter to run with TCG only

We're currently facing the problem that the device-crash-test script
runs twice as long in the CI when a runner supports KVM - which sometimes
results in a timeout of the CI job. To get a more deterministic runtime
here, add an option to the script that allows to run it with TCG only.

Reported-by: Eldon Stegall <eldon-qemu@eldondev.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230414145845.456145-3-thuth@redhat.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230424092249.58552-6-alex.bennee@linaro.org>
(cherry picked from commit 8b869aa59109d238fd684e1ade204b6942202120)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 834fc12721b90c8542304a8be6463974562f8916
      
https://github.com/qemu/qemu/commit/834fc12721b90c8542304a8be6463974562f8916
  Author: Bernhard Beschow <shentey@gmail.com>
  Date:   2023-05-31 (Wed, 31 May 2023)

  Changed paths:
    M hw/ppc/prep.c

  Log Message:
  -----------
  hw/ppc/prep: Fix wiring of PIC -> CPU interrupt

Commit cef2e7148e32 ("hw/isa/i82378: Remove intermediate IRQ forwarder")
passes s->cpu_intr to i8259_init() in i82378_realize() directly. However, s-
>cpu_intr isn't initialized yet since that happens after the south bridge's
pci_realize_and_unref() in board code. Fix this by initializing s->cpu_intr
before realizing the south bridge.

Fixes: cef2e7148e32 ("hw/isa/i82378: Remove intermediate IRQ forwarder")
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Message-Id: <20230304114043.121024-4-shentey@gmail.com>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
(cherry picked from commit 2237af5e60ada06d90bf714e85523deafd936b9b)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: b201fb8c5aca78400d4f364632fb1e19827da942
      
https://github.com/qemu/qemu/commit/b201fb8c5aca78400d4f364632fb1e19827da942
  Author: Erico Nunes <ernunes@redhat.com>
  Date:   2023-05-31 (Wed, 31 May 2023)

  Changed paths:
    M ui/gtk-egl.c
    M ui/gtk-gl-area.c

  Log Message:
  -----------
  ui/gtk: fix passing y0_top parameter to scanout

The dmabuf->y0_top flag is passed to .dpy_gl_scanout_dmabuf(), however
in the gtk ui both implementations dropped it when doing the next
scanout_texture call.

Fixes flipped linux console using vhost-user-gpu with the gtk ui
display.

Signed-off-by: Erico Nunes <ernunes@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20230220175605.43759-1-ernunes@redhat.com>
(cherry picked from commit 94400fa53f81c9f58ad88cf3f3e7ea89ec423d39)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 95c9059e66526bc0f728c45516cb0366ecaeefc7
      
https://github.com/qemu/qemu/commit/95c9059e66526bc0f728c45516cb0366ecaeefc7
  Author: Erico Nunes <ernunes@redhat.com>
  Date:   2023-05-31 (Wed, 31 May 2023)

  Changed paths:
    M ui/gtk.c

  Log Message:
  -----------
  ui/gtk: use widget size for cursor motion event

The gd_motion_event size has some calculations for the cursor position,
which also take into account things like different size of the
framebuffer compared to the window size.
The use of window size makes things more difficult though, as at least
in the case of Wayland includes the size of ui elements like a menu bar
at the top of the window. This leads to a wrong position calculation by
a few pixels.
Fix it by using the size of the widget, which already returns the size
of the actual space to render the framebuffer.

Signed-off-by: Erico Nunes <ernunes@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Acked-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
Message-Id: <20230320160856.364319-1-ernunes@redhat.com>
(cherry picked from commit 2f31663ed4b5631b5e1c79f5cdd6463e55410eb8)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: b15e44adebc21d968c7f7f57b55636ee04150ad5
      
https://github.com/qemu/qemu/commit/b15e44adebc21d968c7f7f57b55636ee04150ad5
  Author: Erico Nunes <ernunes@redhat.com>
  Date:   2023-05-31 (Wed, 31 May 2023)

  Changed paths:
    M ui/gtk-egl.c

  Log Message:
  -----------
  ui/gtk-egl: fix scaling for cursor position in scanout mode

vc->gfx.w and vc->gfx.h are not updated appropriately in this code path,
which leads to a different scaling factor for rendering the cursor on
some edge cases (e.g. the focus has left and re-entered the gtk window).
This can be reproduced using vhost-user-gpu with the gtk ui on the x11
backend.
Use the surface dimensions which are already updated accordingly.

Signed-off-by: Erico Nunes <ernunes@redhat.com>
Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20230320160856.364319-2-ernunes@redhat.com>
(cherry picked from commit f8a951bb951140a585341c700ebeec58d83f7bbc)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: d4d91ae902199d991572c4cf3f4ede28e82cc0fd
      
https://github.com/qemu/qemu/commit/d4d91ae902199d991572c4cf3f4ede28e82cc0fd
  Author: Marc-André Lureau <marcandre.lureau@redhat.com>
  Date:   2023-05-31 (Wed, 31 May 2023)

  Changed paths:
    M ui/sdl2-gl.c

  Log Message:
  -----------
  ui/sdl2: fix surface_gl_update_texture: Assertion 'gls' failed

Before sdl2_gl_update() is called, sdl2_gl_switch() may decide to
destroy the console window and its associated shaders.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1644
Fixes: c84ab0a500a8 ("ui/console: optionally update after gfx switch")

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Tested-by: Bin Meng <bin.meng@windriver.com>
Message-Id: <20230511074217.4171842-1-marcandre.lureau@redhat.com>
(cherry picked from commit b3a654d82ecf276b59a67b2fd688e11a0d8a0064)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 6520bf66f4998b027c9d8f9dfb1ee34a958ade42
      
https://github.com/qemu/qemu/commit/6520bf66f4998b027c9d8f9dfb1ee34a958ade42
  Author: Bernhard Beschow <shentey@gmail.com>
  Date:   2023-05-31 (Wed, 31 May 2023)

  Changed paths:
    M ui/sdl2.c

  Log Message:
  -----------
  ui/sdl2: Grab Alt+Tab also in fullscreen mode

By default, SDL grabs Alt+Tab only in non-fullscreen mode. This causes Alt+Tab
to switch tasks on the host rather than in the VM in fullscreen mode while it
switches tasks in non-fullscreen mode in the VM. Fix this confusing behavior
by grabbing Alt+Tab in fullscreen mode, always causing tasks to be switched in
the VM.

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Volker Rümelin <vr_qemu@t-online.de>
Message-Id: <20230417192139.43263-2-shentey@gmail.com>
(cherry picked from commit efc00a37090eced53bff8b42d26991252aaacc44)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 70237e21590005e11b1e4508491eb42f7dee5aa8
      
https://github.com/qemu/qemu/commit/70237e21590005e11b1e4508491eb42f7dee5aa8
  Author: Bernhard Beschow <shentey@gmail.com>
  Date:   2023-05-31 (Wed, 31 May 2023)

  Changed paths:
    M ui/sdl2.c

  Log Message:
  -----------
  ui/sdl2: Grab Alt+F4 also under Windows

SDL doesn't grab Alt+F4 under Windows by default. Pressing Alt+F4 thus closes
the VM immediately without confirmation, possibly leading to data loss. Fix
this by always grabbing Alt+F4 on Windows hosts, too.

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Volker Rümelin <vr_qemu@t-online.de>
Message-Id: <20230417192139.43263-3-shentey@gmail.com>
(cherry picked from commit 083db9db44c89d7ea7f81844302194d708bcff2b)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 22048b1bff428ceb131754b85da0603c29b3b130
      
https://github.com/qemu/qemu/commit/22048b1bff428ceb131754b85da0603c29b3b130
  Author: Volker Rümelin <vr_qemu@t-online.de>
  Date:   2023-05-31 (Wed, 31 May 2023)

  Changed paths:
    M ui/sdl2.c

  Log Message:
  -----------
  ui/sdl2: disable SDL_HINT_GRAB_KEYBOARD on Windows

Windows sends an extra left control key up/down input event for
every right alt key up/down input event for keyboards with
international layout. Since commit 830473455f ("ui/sdl2: fix
handling of AltGr key on Windows") QEMU uses a Windows low level
keyboard hook procedure to reliably filter out the special left
control key and to grab the keyboard on Windows.

The SDL2 version 2.0.16 introduced its own Windows low level
keyboard hook procedure to grab the keyboard. Windows calls this
callback before the QEMU keyboard hook procedure. This disables
the special left control key filter when the keyboard is grabbed.

To fix the problem, disable the SDL2 Windows low level keyboard
hook procedure.

Reported-by: Bernhard Beschow <shentey@gmail.com>
Signed-off-by: Volker Rümelin <vr_qemu@t-online.de>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Tested-by: Bernhard Beschow <shentey@gmail.com>
Message-Id: <20230418062823.5683-1-vr_qemu@t-online.de>
(cherry picked from commit 1dfea3f212e43bfd59d1e1f40b9776db440b211f)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: fee86f6c5ba0096b89463270c0231b6dcc03611a
      
https://github.com/qemu/qemu/commit/fee86f6c5ba0096b89463270c0231b6dcc03611a
  Author: Tommy Wu <tommy.wu@sifive.com>
  Date:   2023-05-31 (Wed, 31 May 2023)

  Changed paths:
    M hw/dma/xilinx_axidma.c

  Log Message:
  -----------
  hw/dma/xilinx_axidma: Check DMASR.HALTED to prevent infinite loop.

When we receive a packet from the xilinx_axienet and then try to s2mem
through the xilinx_axidma, if the descriptor ring buffer is full in the
xilinx axidma driver, we’ll assert the DMASR.HALTED in the
function : stream_process_s2mem and return 0. In the end, we’ll be stuck in
an infinite loop in axienet_eth_rx_notify.

This patch checks the DMASR.HALTED state when we try to push data
from xilinx axi-enet to xilinx axi-dma. When the DMASR.HALTED is asserted,
we will not keep pushing the data and then prevent the infinte loop.

Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
Reviewed-by: Edgar E. Iglesias <edgar@zeroasic.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Message-id: 20230519062137.1251741-1-tommy.wu@sifive.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
(cherry picked from commit 31afe04586efeccb80cc36ffafcd0e32a3245ffb)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: f82dcd73e85b586bcfe31d99d4bdc8d33727f2ef
      
https://github.com/qemu/qemu/commit/f82dcd73e85b586bcfe31d99d4bdc8d33727f2ef
  Author: Clément Chigot <chigot@adacore.com>
  Date:   2023-05-31 (Wed, 31 May 2023)

  Changed paths:
    M hw/arm/xlnx-zynqmp.c

  Log Message:
  -----------
  hw/arm/xlnx-zynqmp: fix unsigned error when checking the RPUs number

When passing --smp with a number lower than XLNX_ZYNQMP_NUM_APU_CPUS,
the expression (ms->smp.cpus - XLNX_ZYNQMP_NUM_APU_CPUS) will result
in a positive number as ms->smp.cpus is a unsigned int.
This will raise the following error afterwards, as Qemu will try to
instantiate some additional RPUs.
  | $ qemu-system-aarch64 --smp 1 -M xlnx-zcu102
  | **
  | ERROR:../src/tcg/tcg.c:777:tcg_register_thread:
  |   assertion failed: (n < tcg_max_ctxs)

Signed-off-by: Clément Chigot <chigot@adacore.com>
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Tested-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Message-id: 20230524143714.565792-1-chigot@adacore.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
(cherry picked from commit c9ba1c9f02cfede5329f504cdda6fd3a256e0434)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 7cba3a05b57e7e62b03e57c88a8416fd84635d16
      
https://github.com/qemu/qemu/commit/7cba3a05b57e7e62b03e57c88a8416fd84635d16
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2023-05-31 (Wed, 31 May 2023)

  Changed paths:
    M target/arm/tlb_helper.c

  Log Message:
  -----------
  target/arm: Explicitly select short-format FSR for M-profile

For M-profile, there is no guest-facing A-profile format FSR, but we
still use the env->exception.fsr field to pass fault information from
the point where a fault is raised to the code in
arm_v7m_cpu_do_interrupt() which interprets it and sets the M-profile
specific fault status registers.  So it doesn't matter whether we
fill in env->exception.fsr in the short format or the LPAE format, as
long as both sides agree.  As it happens arm_v7m_cpu_do_interrupt()
assumes short-form.

In compute_fsr_fsc() we weren't explicitly choosing short-form for
M-profile, but instead relied on it falling out in the wash because
arm_s1_regime_using_lpae_format() would be false.  This was broken in
commit 452c67a4 when we added v8R support, because we said "PMSAv8 is
always LPAE format" (as it is for v8R), forgetting that we were
implicitly using this code path on M-profile. At that point we would
hit a g_assert_not_reached():
 ERROR:../../target/arm/internals.h:549:arm_fi_to_lfsc: code should not be 
reached

#7  0x0000555555e055f7 in arm_fi_to_lfsc (fi=0x7fffecff9a90) at 
../../target/arm/internals.h:549
#8  0x0000555555e05a27 in compute_fsr_fsc (env=0x555557356670, 
fi=0x7fffecff9a90, target_el=1, mmu_idx=1, ret_fsc=0x7fffecff9a1c)
    at ../../target/arm/tlb_helper.c:95
#9  0x0000555555e05b62 in arm_deliver_fault (cpu=0x555557354800, 
addr=268961344, access_type=MMU_INST_FETCH, mmu_idx=1, fi=0x7fffecff9a90)
    at ../../target/arm/tlb_helper.c:132
#10 0x0000555555e06095 in arm_cpu_tlb_fill (cs=0x555557354800, 
address=268961344, size=1, access_type=MMU_INST_FETCH, mmu_idx=1, probe=false, 
retaddr=0)
    at ../../target/arm/tlb_helper.c:260

The specific assertion changed when commit fcc7404eff24b4c added
"assert not M-profile" to arm_is_secure_below_el3(), because the
conditions being checked in compute_fsr_fsc() include
arm_el_is_aa64(), which will end up calling arm_is_secure_below_el3()
and asserting before we try to call arm_fi_to_lfsc():

#7  0x0000555555efaf43 in arm_is_secure_below_el3 (env=0x5555574665a0) at 
../../target/arm/cpu.h:2396
#8  0x0000555555efb103 in arm_is_el2_enabled (env=0x5555574665a0) at 
../../target/arm/cpu.h:2448
#9  0x0000555555efb204 in arm_el_is_aa64 (env=0x5555574665a0, el=1) at 
../../target/arm/cpu.h:2509
#10 0x0000555555efbdfd in compute_fsr_fsc (env=0x5555574665a0, 
fi=0x7fffecff99e0, target_el=1, mmu_idx=1, ret_fsc=0x7fffecff996c)

Avoid the assertion and the incorrect FSR format selection by
explicitly making M-profile use the short-format in this function.

Fixes: 452c67a42704 ("target/arm: Enable TTBCR_EAE for ARMv8-R AArch32")a
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1658
Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230523131726.866635-1-peter.maydell@linaro.org
(cherry picked from commit d7fe699be54b2cbb8e4ee37b63588b3458a49da7)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 347714a28cc5316aab31e2a0f3758ec870cea86f
      
https://github.com/qemu/qemu/commit/347714a28cc5316aab31e2a0f3758ec870cea86f
  Author: Ilya Leoshkevich <iii@linux.ibm.com>
  Date:   2023-06-07 (Wed, 07 Jun 2023)

  Changed paths:
    M target/s390x/tcg/insn-data.h.inc

  Log Message:
  -----------
  target/s390x: Fix LCBB overwriting the top 32 bits

LCBB is supposed to overwrite only the bottom 32 bits, but QEMU
erroneously overwrites the entire register.

Fixes: 6d9303322ed9 ("s390x/tcg: Implement LOAD COUNT TO BLOCK BOUNDARY")
Cc: qemu-stable@nongnu.org
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230526181240.1425579-2-iii@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
(cherry picked from commit 079181b9bc60389e106009a1530d3cc42256f567)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 242efaca9e12d2dbc4dbfae6a0718e978dfa15b1
      
https://github.com/qemu/qemu/commit/242efaca9e12d2dbc4dbfae6a0718e978dfa15b1
  Author: Ilya Leoshkevich <iii@linux.ibm.com>
  Date:   2023-06-07 (Wed, 07 Jun 2023)

  Changed paths:
    M tests/tcg/s390x/Makefile.target
    A tests/tcg/s390x/lcbb.c

  Log Message:
  -----------
  tests/tcg/s390x: Test LCBB

Add a test to prevent regressions.

Cc: qemu-stable@nongnu.org
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230526181240.1425579-3-iii@linux.ibm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
(cherry picked from commit 05d000fb4dcac4bc02ffa08fcf14b51683b878f6)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: cc271aa410e6179fb2a4db2f3e1e01dc69b8f7c8
      
https://github.com/qemu/qemu/commit/cc271aa410e6179fb2a4db2f3e1e01dc69b8f7c8
  Author: Ilya Leoshkevich <iii@linux.ibm.com>
  Date:   2023-06-07 (Wed, 07 Jun 2023)

  Changed paths:
    M target/s390x/tcg/insn-data.h.inc

  Log Message:
  -----------
  target/s390x: Fix LOCFHR taking the wrong half of R2

LOCFHR should write top-to-top, but QEMU erroneously writes
bottom-to-top.

Fixes: 45aa9aa3b773 ("target/s390x: Implement load-on-condition-2 insns")
Cc: qemu-stable@nongnu.org
Reported-by: Mikhail Mitskevich <mitskevichmn@gmail.com>
Closes: https://gitlab.com/qemu-project/qemu/-/issues/1668
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230526181240.1425579-4-iii@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
(cherry picked from commit 3180b173621021c365c256cedf2f5845bd4780d0)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 82fc148344d0862cfdf5364068d6123a2b777de2
      
https://github.com/qemu/qemu/commit/82fc148344d0862cfdf5364068d6123a2b777de2
  Author: Ilya Leoshkevich <iii@linux.ibm.com>
  Date:   2023-06-07 (Wed, 07 Jun 2023)

  Changed paths:
    M tests/tcg/s390x/Makefile.target
    A tests/tcg/s390x/locfhr.c

  Log Message:
  -----------
  tests/tcg/s390x: Test LOCFHR

Add a small test to prevent regressions.

Cc: qemu-stable@nongnu.org
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230526181240.1425579-5-iii@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
(cherry picked from commit 230976232f4fcdc205d6ec53ec9f3804b28dc1e7)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 5502e5ca3372a1515ba7ba2aceb855b2344e1762
      
https://github.com/qemu/qemu/commit/5502e5ca3372a1515ba7ba2aceb855b2344e1762
  Author: Ilya Leoshkevich <iii@linux.ibm.com>
  Date:   2023-06-07 (Wed, 07 Jun 2023)

  Changed paths:
    M linux-user/s390x/cpu_loop.c

  Log Message:
  -----------
  linux-user/s390x: Fix single-stepping SVC

Currently single-stepping SVC executes two instructions. The reason is
that EXCP_DEBUG for the SVC instruction itself is masked by EXCP_SVC.
Fix by re-raising EXCP_DEBUG.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230510230213.330134-2-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
(cherry picked from commit 01b9990a3fb84bb9a14017255ab1a4fa86588215)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: c06ca3aa33b039c09166334ebc417a89bf2ecfec
      
https://github.com/qemu/qemu/commit/c06ca3aa33b039c09166334ebc417a89bf2ecfec
  Author: Ilya Leoshkevich <iii@linux.ibm.com>
  Date:   2023-06-07 (Wed, 07 Jun 2023)

  Changed paths:
    M tests/tcg/s390x/Makefile.target
    A tests/tcg/s390x/gdbstub/test-svc.py
    A tests/tcg/s390x/hello-s390x-asm.S

  Log Message:
  -----------
  tests/tcg/s390x: Test single-stepping SVC

Add a small test to prevent regressions.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Acked-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230510230213.330134-3-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
(cherry picked from commit be4a4cb429617a8b6893733b37b6203e4b7bf35b)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 03727054dce3131529ca5668ffd653470000064d
      
https://github.com/qemu/qemu/commit/03727054dce3131529ca5668ffd653470000064d
  Author: Ilya Leoshkevich <iii@linux.ibm.com>
  Date:   2023-06-07 (Wed, 07 Jun 2023)

  Changed paths:
    M target/s390x/cpu_models.c
    M target/s390x/cpu_models.h

  Log Message:
  -----------
  s390x/tcg: Fix CPU address returned by STIDP

In qemu-user-s390x, /proc/cpuinfo contains:

        processor 0: version = 00,  identification = 000000,  machine = 8561
        processor 1: version = 00,  identification = 400000,  machine = 8561

The highest nibble is supposed to contain the CPU address, but it's off
by 2 bits. Fix the shift value and provide a symbolic constant for it.

With the fix we get:

        processor 0: version = 00,  identification = 000000,  machine = 8561
        processor 1: version = 00,  identification = 100000,  machine = 8561

Fixes: 076d4d39b65f ("s390x/cpumodel: wire up cpu type + id for TCG")
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230605113950.1169228-2-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
(cherry picked from commit 71b11cbe1c34411238703abe24bfaf2e9712c30d)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 8e84a20705cae1fc1cd268de06e46eaa17bf6b06
      
https://github.com/qemu/qemu/commit/8e84a20705cae1fc1cd268de06e46eaa17bf6b06
  Author: Jagannathan Raman <jag.raman@oracle.com>
  Date:   2023-06-07 (Wed, 07 Jun 2023)

  Changed paths:
    M docs/system/multi-process.rst

  Log Message:
  -----------
  docs: fix multi-process QEMU documentation

Fix a typo in the system documentation for multi-process QEMU.

Signed-off-by: Jagannathan Raman <jag.raman@oracle.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit 7771e8b86335968ee46538d1afd44246e7a062bc)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 07e7102b8eb822d9c035c329382d8a3d9cf9bfd6
      
https://github.com/qemu/qemu/commit/07e7102b8eb822d9c035c329382d8a3d9cf9bfd6
  Author: Mark Somerville <mark@qpok.net>
  Date:   2023-06-08 (Thu, 08 Jun 2023)

  Changed paths:
    M qga/commands-posix.c

  Log Message:
  -----------
  qga: Fix suspend on Linux guests without systemd

Allow the Linux guest agent to attempt each of the suspend methods
(systemctl, pm-* and writing to /sys) in turn.

Prior to this guests without systemd failed to suspend due to
`guest_suspend` returning early regardless of the return value of
`systemd_supports_mode`.

Signed-off-by: Mark Somerville <mark@qpok.net>
Reviewed-by: Konstantin Kostiuk <kkostiuk@redhat.com>
Signed-off-by: Konstantin Kostiuk <kkostiuk@redhat.com>
(cherry picked from commit 86dcb6ab9b603450eb6d896cdc95286de2c7d561)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 10fad73a2bf1c76c8aa9d6322755e5f877d83ce5
      
https://github.com/qemu/qemu/commit/10fad73a2bf1c76c8aa9d6322755e5f877d83ce5
  Author: Christian Schoenebeck <qemu_oss@crudebyte.com>
  Date:   2023-06-08 (Thu, 08 Jun 2023)

  Changed paths:
    M fsdev/virtfs-proxy-helper.c
    M hw/9pfs/9p-util.h

  Log Message:
  -----------
  9pfs: prevent opening special files (CVE-2023-2861)

The 9p protocol does not specifically define how server shall behave when
client tries to open a special file, however from security POV it does
make sense for 9p server to prohibit opening any special file on host side
in general. A sane Linux 9p client for instance would never attempt to
open a special file on host side, it would always handle those exclusively
on its guest side. A malicious client however could potentially escape
from the exported 9p tree by creating and opening a device file on host
side.

With QEMU this could only be exploited in the following unsafe setups:

  - Running QEMU binary as root AND 9p 'local' fs driver AND 'passthrough'
    security model.

or

  - Using 9p 'proxy' fs driver (which is running its helper daemon as
    root).

These setups were already discouraged for safety reasons before,
however for obvious reasons we are now tightening behaviour on this.

Fixes: CVE-2023-2861
Reported-by: Yanwu Shen <ywsPlz@gmail.com>
Reported-by: Jietao Xiao <shawtao1125@gmail.com>
Reported-by: Jinku Li <jkli@xidian.edu.cn>
Reported-by: Wenbo Shen <shenwenbo@zju.edu.cn>
Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Message-Id: <E1q6w7r-0000Q0-NM@lizzy.crudebyte.com>
(cherry picked from commit f6b0de53fb87ddefed348a39284c8e2f28dc4eda)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
(Mjt: drop adding qemu_fstat wrapper for 7.2 where wrappers aren't used)


Compare: https://github.com/qemu/qemu/compare/a8f7a3504dd3...10fad73a2bf1