qemu-commits
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Qemu-commits] [qemu/qemu] eca6eb: gitlab-ci: Avoid to re-run "configure


From: Christian Schoenebeck
Subject: [Qemu-commits] [qemu/qemu] eca6eb: gitlab-ci: Avoid to re-run "configure" in the devi...
Date: Fri, 09 Jun 2023 04:33:38 -0700

  Branch: refs/heads/staging-8.0
  Home:   https://github.com/qemu/qemu
  Commit: eca6ebee52b22f758f5995ff600d00d576715632
      
https://github.com/qemu/qemu/commit/eca6ebee52b22f758f5995ff600d00d576715632
  Author: Thomas Huth <thuth@redhat.com>
  Date:   2023-05-31 (Wed, 31 May 2023)

  Changed paths:
    M .gitlab-ci.d/buildtest.yml

  Log Message:
  -----------
  gitlab-ci: Avoid to re-run "configure" in the device-crash-test jobs

After "make check-venv" had been added to these jobs, they started
to re-run "configure" each time since our logic in the makefile
thinks that some files are out of date here. Avoid it with the same
trick that we are using in buildtest-template.yml already by disabling
the up-to-date check via NINJA=":".

Fixes: 1d8cf47e5b ("tests: run 'device-crash-test' from tests/venv")
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20230414145845.456145-2-thuth@redhat.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230424092249.58552-5-alex.bennee@linaro.org>
(cherry picked from commit 4d3bd91b26a69b39a178744d3d6e5f23050afb23)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 25b846c85e4c9fb911673e31d474208b28dfd01a
      
https://github.com/qemu/qemu/commit/25b846c85e4c9fb911673e31d474208b28dfd01a
  Author: Thomas Huth <thuth@redhat.com>
  Date:   2023-05-31 (Wed, 31 May 2023)

  Changed paths:
    M .gitlab-ci.d/buildtest.yml
    M scripts/device-crash-test

  Log Message:
  -----------
  scripts/device-crash-test: Add a parameter to run with TCG only

We're currently facing the problem that the device-crash-test script
runs twice as long in the CI when a runner supports KVM - which sometimes
results in a timeout of the CI job. To get a more deterministic runtime
here, add an option to the script that allows to run it with TCG only.

Reported-by: Eldon Stegall <eldon-qemu@eldondev.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230414145845.456145-3-thuth@redhat.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230424092249.58552-6-alex.bennee@linaro.org>
(cherry picked from commit 8b869aa59109d238fd684e1ade204b6942202120)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 864ce70c1c747898063cc2df854920d354b1b78f
      
https://github.com/qemu/qemu/commit/864ce70c1c747898063cc2df854920d354b1b78f
  Author: Richard Purdie <richard.purdie@linuxfoundation.org>
  Date:   2023-05-31 (Wed, 31 May 2023)

  Changed paths:
    M target/ppc/insn32.decode
    M target/ppc/translate/fp-impl.c.inc

  Log Message:
  -----------
  target/ppc: Fix fallback to MFSS for MFFS* instructions on pre 3.0 ISAs

The following commits changed the code such that the fallback to MFSS for 
MFFSCRN,
MFFSCRNI, MFFSCE and MFFSL on pre 3.0 ISAs was removed and became an illegal 
instruction:

  bf8adfd88b547680aa857c46098f3a1e94373160 - target/ppc: Move mffscrn[i] to 
decodetree
  394c2e2fda70da722f20fb60412d6c0ca4bfaa03 - target/ppc: Move mffsce to 
decodetree
  3e5bce70efe6bd1f684efbb21fd2a316cbf0657e - target/ppc: Move mffsl to 
decodetree

The hardware will handle them as a MFFS instruction as the code did previously.
This means applications that were segfaulting under qemu when encountering these
instructions which is used in glibc libm functions for example.

The fallback for MFFSCDRN and MFFSCDRNI added in a later patch was also missing.

This patch restores the fallback to MFSS for these instructions on pre 3.0s ISAs
as the hardware decoder would, fixing the segfaulting libm code. It doesn't have
the fallback for 3.0 onwards to match hardware behaviour.

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Reviewed-by: Matheus Ferst <matheus.ferst@eldorado.org.br>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230510111913.1718734-1-richard.purdie@linuxfoundation.org>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
(cherry picked from commit 5260ecffd24e36c029849f379c8b9cc3d099c879)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 880f7d12bedfc8c5c76d72088cf3e088c32c96b0
      
https://github.com/qemu/qemu/commit/880f7d12bedfc8c5c76d72088cf3e088c32c96b0
  Author: Bernhard Beschow <shentey@gmail.com>
  Date:   2023-05-31 (Wed, 31 May 2023)

  Changed paths:
    M hw/ppc/prep.c

  Log Message:
  -----------
  hw/ppc/prep: Fix wiring of PIC -> CPU interrupt

Commit cef2e7148e32 ("hw/isa/i82378: Remove intermediate IRQ forwarder")
passes s->cpu_intr to i8259_init() in i82378_realize() directly. However, s-
>cpu_intr isn't initialized yet since that happens after the south bridge's
pci_realize_and_unref() in board code. Fix this by initializing s->cpu_intr
before realizing the south bridge.

Fixes: cef2e7148e32 ("hw/isa/i82378: Remove intermediate IRQ forwarder")
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Message-Id: <20230304114043.121024-4-shentey@gmail.com>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
(cherry picked from commit 2237af5e60ada06d90bf714e85523deafd936b9b)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 76b7002ec724b5f8dc2cf3fbb6ffb458baadd836
      
https://github.com/qemu/qemu/commit/76b7002ec724b5f8dc2cf3fbb6ffb458baadd836
  Author: Erico Nunes <ernunes@redhat.com>
  Date:   2023-05-31 (Wed, 31 May 2023)

  Changed paths:
    M ui/gtk-egl.c
    M ui/gtk-gl-area.c

  Log Message:
  -----------
  ui/gtk: fix passing y0_top parameter to scanout

The dmabuf->y0_top flag is passed to .dpy_gl_scanout_dmabuf(), however
in the gtk ui both implementations dropped it when doing the next
scanout_texture call.

Fixes flipped linux console using vhost-user-gpu with the gtk ui
display.

Signed-off-by: Erico Nunes <ernunes@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20230220175605.43759-1-ernunes@redhat.com>
(cherry picked from commit 94400fa53f81c9f58ad88cf3f3e7ea89ec423d39)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 7fd387715b501d2a0c1b6032ea526c20bde0fdb5
      
https://github.com/qemu/qemu/commit/7fd387715b501d2a0c1b6032ea526c20bde0fdb5
  Author: Erico Nunes <ernunes@redhat.com>
  Date:   2023-05-31 (Wed, 31 May 2023)

  Changed paths:
    M ui/gtk.c

  Log Message:
  -----------
  ui/gtk: use widget size for cursor motion event

The gd_motion_event size has some calculations for the cursor position,
which also take into account things like different size of the
framebuffer compared to the window size.
The use of window size makes things more difficult though, as at least
in the case of Wayland includes the size of ui elements like a menu bar
at the top of the window. This leads to a wrong position calculation by
a few pixels.
Fix it by using the size of the widget, which already returns the size
of the actual space to render the framebuffer.

Signed-off-by: Erico Nunes <ernunes@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Acked-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
Message-Id: <20230320160856.364319-1-ernunes@redhat.com>
(cherry picked from commit 2f31663ed4b5631b5e1c79f5cdd6463e55410eb8)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: eef92fac912f5494e4b2c048d02fbd105b471666
      
https://github.com/qemu/qemu/commit/eef92fac912f5494e4b2c048d02fbd105b471666
  Author: Erico Nunes <ernunes@redhat.com>
  Date:   2023-05-31 (Wed, 31 May 2023)

  Changed paths:
    M ui/gtk-egl.c

  Log Message:
  -----------
  ui/gtk-egl: fix scaling for cursor position in scanout mode

vc->gfx.w and vc->gfx.h are not updated appropriately in this code path,
which leads to a different scaling factor for rendering the cursor on
some edge cases (e.g. the focus has left and re-entered the gtk window).
This can be reproduced using vhost-user-gpu with the gtk ui on the x11
backend.
Use the surface dimensions which are already updated accordingly.

Signed-off-by: Erico Nunes <ernunes@redhat.com>
Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20230320160856.364319-2-ernunes@redhat.com>
(cherry picked from commit f8a951bb951140a585341c700ebeec58d83f7bbc)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: e0baf24b4aa87f70b6bf08a1d578a31ad94ee0cb
      
https://github.com/qemu/qemu/commit/e0baf24b4aa87f70b6bf08a1d578a31ad94ee0cb
  Author: Marc-André Lureau <marcandre.lureau@redhat.com>
  Date:   2023-05-31 (Wed, 31 May 2023)

  Changed paths:
    M ui/sdl2-gl.c

  Log Message:
  -----------
  ui/sdl2: fix surface_gl_update_texture: Assertion 'gls' failed

Before sdl2_gl_update() is called, sdl2_gl_switch() may decide to
destroy the console window and its associated shaders.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1644
Fixes: c84ab0a500a8 ("ui/console: optionally update after gfx switch")

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Tested-by: Bin Meng <bin.meng@windriver.com>
Message-Id: <20230511074217.4171842-1-marcandre.lureau@redhat.com>
(cherry picked from commit b3a654d82ecf276b59a67b2fd688e11a0d8a0064)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 9e36edcf03f8fe236a92ca20e44048d6cc8f8cba
      
https://github.com/qemu/qemu/commit/9e36edcf03f8fe236a92ca20e44048d6cc8f8cba
  Author: Marc-André Lureau <marcandre.lureau@redhat.com>
  Date:   2023-05-31 (Wed, 31 May 2023)

  Changed paths:
    M ui/dbus-listener.c

  Log Message:
  -----------
  ui/dbus: fix compilation when GBM && !OPENGL

commit 4814d3cbf ("ui/dbus: restrict opengl to gbm-enabled config")
assumes that whenever GBM is available, OpenGL is. This is not always
the case, let's further restrict opengl-related paths and fix some
compilation issues.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20230515132348.1024663-1-marcandre.lureau@redhat.com>
(cherry picked from commit 0b31e48d62c8f3a282d1bffbcc0e90200df9f9f0)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 772a83c6db2b48297398b64fbab66c275fd613b7
      
https://github.com/qemu/qemu/commit/772a83c6db2b48297398b64fbab66c275fd613b7
  Author: Bernhard Beschow <shentey@gmail.com>
  Date:   2023-05-31 (Wed, 31 May 2023)

  Changed paths:
    M ui/sdl2.c

  Log Message:
  -----------
  ui/sdl2: Grab Alt+Tab also in fullscreen mode

By default, SDL grabs Alt+Tab only in non-fullscreen mode. This causes Alt+Tab
to switch tasks on the host rather than in the VM in fullscreen mode while it
switches tasks in non-fullscreen mode in the VM. Fix this confusing behavior
by grabbing Alt+Tab in fullscreen mode, always causing tasks to be switched in
the VM.

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Volker Rümelin <vr_qemu@t-online.de>
Message-Id: <20230417192139.43263-2-shentey@gmail.com>
(cherry picked from commit efc00a37090eced53bff8b42d26991252aaacc44)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: e0968d21e27ef9c406f709180a39a076e786efbe
      
https://github.com/qemu/qemu/commit/e0968d21e27ef9c406f709180a39a076e786efbe
  Author: Bernhard Beschow <shentey@gmail.com>
  Date:   2023-05-31 (Wed, 31 May 2023)

  Changed paths:
    M ui/sdl2.c

  Log Message:
  -----------
  ui/sdl2: Grab Alt+F4 also under Windows

SDL doesn't grab Alt+F4 under Windows by default. Pressing Alt+F4 thus closes
the VM immediately without confirmation, possibly leading to data loss. Fix
this by always grabbing Alt+F4 on Windows hosts, too.

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Volker Rümelin <vr_qemu@t-online.de>
Message-Id: <20230417192139.43263-3-shentey@gmail.com>
(cherry picked from commit 083db9db44c89d7ea7f81844302194d708bcff2b)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: bc8e883065f36581e4f2352c31a1dfa5f65a82f2
      
https://github.com/qemu/qemu/commit/bc8e883065f36581e4f2352c31a1dfa5f65a82f2
  Author: Volker Rümelin <vr_qemu@t-online.de>
  Date:   2023-05-31 (Wed, 31 May 2023)

  Changed paths:
    M ui/sdl2.c

  Log Message:
  -----------
  ui/sdl2: disable SDL_HINT_GRAB_KEYBOARD on Windows

Windows sends an extra left control key up/down input event for
every right alt key up/down input event for keyboards with
international layout. Since commit 830473455f ("ui/sdl2: fix
handling of AltGr key on Windows") QEMU uses a Windows low level
keyboard hook procedure to reliably filter out the special left
control key and to grab the keyboard on Windows.

The SDL2 version 2.0.16 introduced its own Windows low level
keyboard hook procedure to grab the keyboard. Windows calls this
callback before the QEMU keyboard hook procedure. This disables
the special left control key filter when the keyboard is grabbed.

To fix the problem, disable the SDL2 Windows low level keyboard
hook procedure.

Reported-by: Bernhard Beschow <shentey@gmail.com>
Signed-off-by: Volker Rümelin <vr_qemu@t-online.de>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Tested-by: Bernhard Beschow <shentey@gmail.com>
Message-Id: <20230418062823.5683-1-vr_qemu@t-online.de>
(cherry picked from commit 1dfea3f212e43bfd59d1e1f40b9776db440b211f)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: cdda1ce15847045972c3ec7d84b7f51fb84ecc5f
      
https://github.com/qemu/qemu/commit/cdda1ce15847045972c3ec7d84b7f51fb84ecc5f
  Author: Tommy Wu <tommy.wu@sifive.com>
  Date:   2023-05-31 (Wed, 31 May 2023)

  Changed paths:
    M hw/dma/xilinx_axidma.c

  Log Message:
  -----------
  hw/dma/xilinx_axidma: Check DMASR.HALTED to prevent infinite loop.

When we receive a packet from the xilinx_axienet and then try to s2mem
through the xilinx_axidma, if the descriptor ring buffer is full in the
xilinx axidma driver, we’ll assert the DMASR.HALTED in the
function : stream_process_s2mem and return 0. In the end, we’ll be stuck in
an infinite loop in axienet_eth_rx_notify.

This patch checks the DMASR.HALTED state when we try to push data
from xilinx axi-enet to xilinx axi-dma. When the DMASR.HALTED is asserted,
we will not keep pushing the data and then prevent the infinte loop.

Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
Reviewed-by: Edgar E. Iglesias <edgar@zeroasic.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Message-id: 20230519062137.1251741-1-tommy.wu@sifive.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
(cherry picked from commit 31afe04586efeccb80cc36ffafcd0e32a3245ffb)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 505f0c68c9bd571353ee6ef4679e2192aa3f712f
      
https://github.com/qemu/qemu/commit/505f0c68c9bd571353ee6ef4679e2192aa3f712f
  Author: Clément Chigot <chigot@adacore.com>
  Date:   2023-05-31 (Wed, 31 May 2023)

  Changed paths:
    M hw/arm/xlnx-zynqmp.c

  Log Message:
  -----------
  hw/arm/xlnx-zynqmp: fix unsigned error when checking the RPUs number

When passing --smp with a number lower than XLNX_ZYNQMP_NUM_APU_CPUS,
the expression (ms->smp.cpus - XLNX_ZYNQMP_NUM_APU_CPUS) will result
in a positive number as ms->smp.cpus is a unsigned int.
This will raise the following error afterwards, as Qemu will try to
instantiate some additional RPUs.
  | $ qemu-system-aarch64 --smp 1 -M xlnx-zcu102
  | **
  | ERROR:../src/tcg/tcg.c:777:tcg_register_thread:
  |   assertion failed: (n < tcg_max_ctxs)

Signed-off-by: Clément Chigot <chigot@adacore.com>
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Tested-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Message-id: 20230524143714.565792-1-chigot@adacore.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
(cherry picked from commit c9ba1c9f02cfede5329f504cdda6fd3a256e0434)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: f81a5d68636b15cab544e3ad52790d51803bba86
      
https://github.com/qemu/qemu/commit/f81a5d68636b15cab544e3ad52790d51803bba86
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2023-05-31 (Wed, 31 May 2023)

  Changed paths:
    M target/arm/tcg/tlb_helper.c

  Log Message:
  -----------
  target/arm: Explicitly select short-format FSR for M-profile

For M-profile, there is no guest-facing A-profile format FSR, but we
still use the env->exception.fsr field to pass fault information from
the point where a fault is raised to the code in
arm_v7m_cpu_do_interrupt() which interprets it and sets the M-profile
specific fault status registers.  So it doesn't matter whether we
fill in env->exception.fsr in the short format or the LPAE format, as
long as both sides agree.  As it happens arm_v7m_cpu_do_interrupt()
assumes short-form.

In compute_fsr_fsc() we weren't explicitly choosing short-form for
M-profile, but instead relied on it falling out in the wash because
arm_s1_regime_using_lpae_format() would be false.  This was broken in
commit 452c67a4 when we added v8R support, because we said "PMSAv8 is
always LPAE format" (as it is for v8R), forgetting that we were
implicitly using this code path on M-profile. At that point we would
hit a g_assert_not_reached():
 ERROR:../../target/arm/internals.h:549:arm_fi_to_lfsc: code should not be 
reached

#7  0x0000555555e055f7 in arm_fi_to_lfsc (fi=0x7fffecff9a90) at 
../../target/arm/internals.h:549
#8  0x0000555555e05a27 in compute_fsr_fsc (env=0x555557356670, 
fi=0x7fffecff9a90, target_el=1, mmu_idx=1, ret_fsc=0x7fffecff9a1c)
    at ../../target/arm/tlb_helper.c:95
#9  0x0000555555e05b62 in arm_deliver_fault (cpu=0x555557354800, 
addr=268961344, access_type=MMU_INST_FETCH, mmu_idx=1, fi=0x7fffecff9a90)
    at ../../target/arm/tlb_helper.c:132
#10 0x0000555555e06095 in arm_cpu_tlb_fill (cs=0x555557354800, 
address=268961344, size=1, access_type=MMU_INST_FETCH, mmu_idx=1, probe=false, 
retaddr=0)
    at ../../target/arm/tlb_helper.c:260

The specific assertion changed when commit fcc7404eff24b4c added
"assert not M-profile" to arm_is_secure_below_el3(), because the
conditions being checked in compute_fsr_fsc() include
arm_el_is_aa64(), which will end up calling arm_is_secure_below_el3()
and asserting before we try to call arm_fi_to_lfsc():

#7  0x0000555555efaf43 in arm_is_secure_below_el3 (env=0x5555574665a0) at 
../../target/arm/cpu.h:2396
#8  0x0000555555efb103 in arm_is_el2_enabled (env=0x5555574665a0) at 
../../target/arm/cpu.h:2448
#9  0x0000555555efb204 in arm_el_is_aa64 (env=0x5555574665a0, el=1) at 
../../target/arm/cpu.h:2509
#10 0x0000555555efbdfd in compute_fsr_fsc (env=0x5555574665a0, 
fi=0x7fffecff99e0, target_el=1, mmu_idx=1, ret_fsc=0x7fffecff996c)

Avoid the assertion and the incorrect FSR format selection by
explicitly making M-profile use the short-format in this function.

Fixes: 452c67a42704 ("target/arm: Enable TTBCR_EAE for ARMv8-R AArch32")a
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1658
Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230523131726.866635-1-peter.maydell@linaro.org
(cherry picked from commit d7fe699be54b2cbb8e4ee37b63588b3458a49da7)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 6a9f9e6499e805941bf46e5036dd829ff3326bc2
      
https://github.com/qemu/qemu/commit/6a9f9e6499e805941bf46e5036dd829ff3326bc2
  Author: Ilya Leoshkevich <iii@linux.ibm.com>
  Date:   2023-06-07 (Wed, 07 Jun 2023)

  Changed paths:
    M tests/tcg/s390x/Makefile.target
    A tests/tcg/s390x/ex-branch.c

  Log Message:
  -----------
  tests/tcg/s390x: Test EXECUTE of relative branches

Add a small test to prevent regressions.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230426235813.198183-3-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
(cherry picked from commit bfa72590df14e4c94c03d2464f3abe18bf2e5dac)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
(Mjt: forgotten testcase for commit b858c53ef632b80f3269773a18b17639b1eec62c)


  Commit: 76d4eb3a5e24cd7f0e47ae5f0b0d01c3243f1bec
      
https://github.com/qemu/qemu/commit/76d4eb3a5e24cd7f0e47ae5f0b0d01c3243f1bec
  Author: Ilya Leoshkevich <iii@linux.ibm.com>
  Date:   2023-06-07 (Wed, 07 Jun 2023)

  Changed paths:
    M target/s390x/tcg/insn-data.h.inc

  Log Message:
  -----------
  target/s390x: Fix LCBB overwriting the top 32 bits

LCBB is supposed to overwrite only the bottom 32 bits, but QEMU
erroneously overwrites the entire register.

Fixes: 6d9303322ed9 ("s390x/tcg: Implement LOAD COUNT TO BLOCK BOUNDARY")
Cc: qemu-stable@nongnu.org
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230526181240.1425579-2-iii@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
(cherry picked from commit 079181b9bc60389e106009a1530d3cc42256f567)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 8776c6cf6a58841c8e96ba2bf7d11f48861934d4
      
https://github.com/qemu/qemu/commit/8776c6cf6a58841c8e96ba2bf7d11f48861934d4
  Author: Ilya Leoshkevich <iii@linux.ibm.com>
  Date:   2023-06-07 (Wed, 07 Jun 2023)

  Changed paths:
    M tests/tcg/s390x/Makefile.target
    A tests/tcg/s390x/lcbb.c

  Log Message:
  -----------
  tests/tcg/s390x: Test LCBB

Add a test to prevent regressions.

Cc: qemu-stable@nongnu.org
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230526181240.1425579-3-iii@linux.ibm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
(cherry picked from commit 05d000fb4dcac4bc02ffa08fcf14b51683b878f6)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 0d4bced3747c6e07d79dca571e18fb2f12f8622c
      
https://github.com/qemu/qemu/commit/0d4bced3747c6e07d79dca571e18fb2f12f8622c
  Author: Ilya Leoshkevich <iii@linux.ibm.com>
  Date:   2023-06-07 (Wed, 07 Jun 2023)

  Changed paths:
    M target/s390x/tcg/insn-data.h.inc

  Log Message:
  -----------
  target/s390x: Fix LOCFHR taking the wrong half of R2

LOCFHR should write top-to-top, but QEMU erroneously writes
bottom-to-top.

Fixes: 45aa9aa3b773 ("target/s390x: Implement load-on-condition-2 insns")
Cc: qemu-stable@nongnu.org
Reported-by: Mikhail Mitskevich <mitskevichmn@gmail.com>
Closes: https://gitlab.com/qemu-project/qemu/-/issues/1668
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230526181240.1425579-4-iii@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
(cherry picked from commit 3180b173621021c365c256cedf2f5845bd4780d0)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 0a3a9ae1f22fd0adc3f37cef6ce0207c8233ede6
      
https://github.com/qemu/qemu/commit/0a3a9ae1f22fd0adc3f37cef6ce0207c8233ede6
  Author: Ilya Leoshkevich <iii@linux.ibm.com>
  Date:   2023-06-07 (Wed, 07 Jun 2023)

  Changed paths:
    M tests/tcg/s390x/Makefile.target
    A tests/tcg/s390x/locfhr.c

  Log Message:
  -----------
  tests/tcg/s390x: Test LOCFHR

Add a small test to prevent regressions.

Cc: qemu-stable@nongnu.org
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230526181240.1425579-5-iii@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
(cherry picked from commit 230976232f4fcdc205d6ec53ec9f3804b28dc1e7)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 9b7c1e431eb7707b4e96a98001d87917dcad26f1
      
https://github.com/qemu/qemu/commit/9b7c1e431eb7707b4e96a98001d87917dcad26f1
  Author: Ilya Leoshkevich <iii@linux.ibm.com>
  Date:   2023-06-07 (Wed, 07 Jun 2023)

  Changed paths:
    M linux-user/s390x/cpu_loop.c

  Log Message:
  -----------
  linux-user/s390x: Fix single-stepping SVC

Currently single-stepping SVC executes two instructions. The reason is
that EXCP_DEBUG for the SVC instruction itself is masked by EXCP_SVC.
Fix by re-raising EXCP_DEBUG.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230510230213.330134-2-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
(cherry picked from commit 01b9990a3fb84bb9a14017255ab1a4fa86588215)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 373cc0f3b51a798dffd321e8931c8758d700eb5e
      
https://github.com/qemu/qemu/commit/373cc0f3b51a798dffd321e8931c8758d700eb5e
  Author: Ilya Leoshkevich <iii@linux.ibm.com>
  Date:   2023-06-07 (Wed, 07 Jun 2023)

  Changed paths:
    M tests/tcg/s390x/Makefile.target
    A tests/tcg/s390x/gdbstub/test-svc.py
    A tests/tcg/s390x/hello-s390x-asm.S

  Log Message:
  -----------
  tests/tcg/s390x: Test single-stepping SVC

Add a small test to prevent regressions.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Acked-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230510230213.330134-3-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
(cherry picked from commit be4a4cb429617a8b6893733b37b6203e4b7bf35b)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 1b4417178e4023a8f6a512dc44a7b2542eee9d54
      
https://github.com/qemu/qemu/commit/1b4417178e4023a8f6a512dc44a7b2542eee9d54
  Author: Ilya Leoshkevich <iii@linux.ibm.com>
  Date:   2023-06-07 (Wed, 07 Jun 2023)

  Changed paths:
    M target/s390x/helper.h
    M target/s390x/tcg/fpu_helper.c
    M target/s390x/tcg/insn-data.h.inc
    M target/s390x/tcg/translate.c

  Log Message:
  -----------
  target/s390x: Fix MXDB and MXDBR

These instructions multiply 64 bits by 64 bits, not 128 bits by 64 bits.

Reported-by: Tulio Magno Quites Machado Filho <tuliom@redhat.com>
Fixes: 2b91240f95fd ("target/s390x: Use Int128 for passing float128")
Cc: qemu-stable@nongnu.org
Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2211472
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230601223027.795501-2-iii@linux.ibm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
(cherry picked from commit a7f4add7931ef91285fc3d89e6b3842115e09048)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 5cd229064af827e4ac8f178107352efab5715dab
      
https://github.com/qemu/qemu/commit/5cd229064af827e4ac8f178107352efab5715dab
  Author: Ilya Leoshkevich <iii@linux.ibm.com>
  Date:   2023-06-07 (Wed, 07 Jun 2023)

  Changed paths:
    M tests/tcg/s390x/Makefile.target
    A tests/tcg/s390x/mxdb.c

  Log Message:
  -----------
  tests/tcg/s390x: Test MXDB and MXDBR

Add a small test to prevent regressions.

Cc: qemu-stable@nongnu.org
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230601223027.795501-3-iii@linux.ibm.com>
Acked-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
(cherry picked from commit 2b956244a9d1b18b9653bf7453870c2d10df2427)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 454d4e438022161c6488753a7b90e4f42dc7abbc
      
https://github.com/qemu/qemu/commit/454d4e438022161c6488753a7b90e4f42dc7abbc
  Author: Ilya Leoshkevich <iii@linux.ibm.com>
  Date:   2023-06-07 (Wed, 07 Jun 2023)

  Changed paths:
    M target/s390x/cpu_models.c
    M target/s390x/cpu_models.h

  Log Message:
  -----------
  s390x/tcg: Fix CPU address returned by STIDP

In qemu-user-s390x, /proc/cpuinfo contains:

        processor 0: version = 00,  identification = 000000,  machine = 8561
        processor 1: version = 00,  identification = 400000,  machine = 8561

The highest nibble is supposed to contain the CPU address, but it's off
by 2 bits. Fix the shift value and provide a symbolic constant for it.

With the fix we get:

        processor 0: version = 00,  identification = 000000,  machine = 8561
        processor 1: version = 00,  identification = 100000,  machine = 8561

Fixes: 076d4d39b65f ("s390x/cpumodel: wire up cpu type + id for TCG")
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230605113950.1169228-2-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
(cherry picked from commit 71b11cbe1c34411238703abe24bfaf2e9712c30d)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 903c71251bdae24aca55a5191ee438b85f936ce6
      
https://github.com/qemu/qemu/commit/903c71251bdae24aca55a5191ee438b85f936ce6
  Author: Thomas Huth <thuth@redhat.com>
  Date:   2023-06-07 (Wed, 07 Jun 2023)

  Changed paths:
    M hw/mips/malta.c

  Log Message:
  -----------
  hw/mips/malta: Fix the malta machine on big endian hosts

Booting a Linux kernel with the malta machine is currently broken
on big endian hosts. The cpu_to_gt32 macro wants to byteswap a value
for little endian targets only, but uses the wrong way to do this:
cpu_to_[lb]e32 works the other way round on big endian hosts! Fix
it by using the same ways on both, big and little endian hosts.

Fixes: 0c8427baf0 ("hw/mips/malta: Use bootloader helper to set BAR registers")
Cc: qemu-stable@nongnu.org
Message-Id: <20230330152613.232082-1-thuth@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
(cherry picked from commit dc96009afd8cf2372fa1bbced0bcbcbb2c5d6f1b)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 1797de7f825fb42118eaee55b874c2230b89e412
      
https://github.com/qemu/qemu/commit/1797de7f825fb42118eaee55b874c2230b89e412
  Author: David Woodhouse <dwmw@amazon.co.uk>
  Date:   2023-06-07 (Wed, 07 Jun 2023)

  Changed paths:
    M hw/xen/xen-operations.c

  Log Message:
  -----------
  hw/xen: Fix memory leak in libxenstore_open() for Xen

There was a superfluous allocation of the XS handle, leading to it
being leaked on both the error path and the success path (where it gets
allocated again).

Spotted by Coverity (CID 1508098).

Fixes: ba2a92db1ff6 ("hw/xen: Add xenstore operations to allow redirection to 
internal emulation")
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Paul Durrant <paul@xen.org>
Message-Id: <20230412185102.441523-3-dwmw2@infradead.org>
Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
(cherry picked from commit 8442232eba1b041b379ca5845df8252c1e905e43)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 6a69a58b1cc7caac0e0dd9bfa09f274fb35e8d46
      
https://github.com/qemu/qemu/commit/6a69a58b1cc7caac0e0dd9bfa09f274fb35e8d46
  Author: David Woodhouse <dwmw@amazon.co.uk>
  Date:   2023-06-07 (Wed, 07 Jun 2023)

  Changed paths:
    M hw/i386/kvm/xen_xenstore.c

  Log Message:
  -----------
  hw/xen: Fix broken check for invalid state in xs_be_open()

Coverity points out that if (!s && !s->impl) isn't really what we intended
to do here. CID 1508131.

Fixes: 032475127225 ("hw/xen: Add emulated implementation of XenStore 
operations")
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Reviewed-by: Paul Durrant <paul@xen.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20230412185102.441523-6-dwmw2@infradead.org>
Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
(cherry picked from commit c9bdfe8d587c1a6a8fc2e0ff97343745a9f5f247)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: fe8863544945c71c7ad9eca56d84d7750eafed8a
      
https://github.com/qemu/qemu/commit/fe8863544945c71c7ad9eca56d84d7750eafed8a
  Author: Jagannathan Raman <jag.raman@oracle.com>
  Date:   2023-06-07 (Wed, 07 Jun 2023)

  Changed paths:
    M docs/system/multi-process.rst

  Log Message:
  -----------
  docs: fix multi-process QEMU documentation

Fix a typo in the system documentation for multi-process QEMU.

Signed-off-by: Jagannathan Raman <jag.raman@oracle.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit 7771e8b86335968ee46538d1afd44246e7a062bc)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 828af6b31fb75b95d3e7dd516f3a14fbcb0ecacd
      
https://github.com/qemu/qemu/commit/828af6b31fb75b95d3e7dd516f3a14fbcb0ecacd
  Author: Mark Somerville <mark@qpok.net>
  Date:   2023-06-08 (Thu, 08 Jun 2023)

  Changed paths:
    M qga/commands-posix.c

  Log Message:
  -----------
  qga: Fix suspend on Linux guests without systemd

Allow the Linux guest agent to attempt each of the suspend methods
(systemctl, pm-* and writing to /sys) in turn.

Prior to this guests without systemd failed to suspend due to
`guest_suspend` returning early regardless of the return value of
`systemd_supports_mode`.

Signed-off-by: Mark Somerville <mark@qpok.net>
Reviewed-by: Konstantin Kostiuk <kkostiuk@redhat.com>
Signed-off-by: Konstantin Kostiuk <kkostiuk@redhat.com>
(cherry picked from commit 86dcb6ab9b603450eb6d896cdc95286de2c7d561)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: b9d2887be4e616cdaeedd0b7456bfaa71ee798af
      
https://github.com/qemu/qemu/commit/b9d2887be4e616cdaeedd0b7456bfaa71ee798af
  Author: Christian Schoenebeck <qemu_oss@crudebyte.com>
  Date:   2023-06-08 (Thu, 08 Jun 2023)

  Changed paths:
    M fsdev/virtfs-proxy-helper.c
    M hw/9pfs/9p-util.h

  Log Message:
  -----------
  9pfs: prevent opening special files (CVE-2023-2861)

The 9p protocol does not specifically define how server shall behave when
client tries to open a special file, however from security POV it does
make sense for 9p server to prohibit opening any special file on host side
in general. A sane Linux 9p client for instance would never attempt to
open a special file on host side, it would always handle those exclusively
on its guest side. A malicious client however could potentially escape
from the exported 9p tree by creating and opening a device file on host
side.

With QEMU this could only be exploited in the following unsafe setups:

  - Running QEMU binary as root AND 9p 'local' fs driver AND 'passthrough'
    security model.

or

  - Using 9p 'proxy' fs driver (which is running its helper daemon as
    root).

These setups were already discouraged for safety reasons before,
however for obvious reasons we are now tightening behaviour on this.

Fixes: CVE-2023-2861
Reported-by: Yanwu Shen <ywsPlz@gmail.com>
Reported-by: Jietao Xiao <shawtao1125@gmail.com>
Reported-by: Jinku Li <jkli@xidian.edu.cn>
Reported-by: Wenbo Shen <shenwenbo@zju.edu.cn>
Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Message-Id: <E1q6w7r-0000Q0-NM@lizzy.crudebyte.com>
(cherry picked from commit f6b0de53fb87ddefed348a39284c8e2f28dc4eda)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


Compare: https://github.com/qemu/qemu/compare/f7f686b61cf7...b9d2887be4e6



reply via email to

[Prev in Thread] Current Thread [Next in Thread]