[PATCH v2] virtio-gpu: Correct virgl_renderer_resource_get_info() error check

2024-01-28 Thread Dmitry Osipenko
virgl_renderer_resource_get_info() returns errno and not -1 on error. Correct the return-value check. Reviewed-by: Marc-André Lureau Signed-off-by: Dmitry Osipenko --- v2: - Fixed similar incorrect error-checking in vhost-user-gpu - Added r-b from Marc contrib/vhost-user-gpu/virgl.c | 6 +

Re: [PATCH 0/5] migration/multifd: Prerequisite cleanups for ongoing work

2024-01-28 Thread Peter Xu
On Mon, Jan 29, 2024 at 01:41:01AM +, Liu, Yuan1 wrote: > Because this change has an impact on the previous live migration > With IAA Patch, does the submission of the next version needs > to be submitted based on this change? I'd say hold off a little while until we're more certain on the p

Re: [PATCH v1] virtio-gpu: Correct virgl_renderer_resource_get_info() error check

2024-01-28 Thread Marc-André Lureau
On Sun, Jan 28, 2024 at 2:10 AM Dmitry Osipenko wrote: > > virgl_renderer_resource_get_info() returns errno and not -1 on error. > Correct the return-value check. > > Signed-off-by: Dmitry Osipenko Reviewed-by: Marc-André Lureau Can you also correct the code in vhost-user-gpu ? > --- > hw/di

Re: [PATCH 1/5] migration/multifd: Separate compression ops from non-compression

2024-01-28 Thread Peter Xu
On Fri, Jan 26, 2024 at 07:19:39PM -0300, Fabiano Rosas wrote: > +static MultiFDMethods multifd_socket_ops = { > +.send_setup = multifd_socket_send_setup, > +.send_cleanup = multifd_socket_send_cleanup, > +.send_prepare = multifd_socket_send_prepare, Here it's named with "socket", howe

Re: [PATCH] hw/scsi/lsi53c895a: add missing decrement of reentrancy counter

2024-01-28 Thread Michael Tokarev
28.01.2024 23:22, Sven Schnelle : When the maximum count of SCRIPTS instructions is reached, the code stops execution and returns, but fails to decrement the reentrancy counter. This effectively renders the SCSI controller unusable because on next entry the reentrancy counter is still above the l

Re: [PATCH 2/2] hw/smbios: Fix port connector option validation

2024-01-28 Thread Michael Tokarev
28.01.2024 10:15, Akihiko Odaki: qemu_smbios_type8_opts did not the list terminator and that resulted in out-of-bound memory access. qemu_smbios_type8_opts also needs to have an element for the type option. With the same description fix as in 1/1, Reviewed-by: Michael Tokarev /mjt

Re: [PATCH] hw/scsi/lsi53c895a: add missing decrement of reentrancy counter

2024-01-28 Thread Sven Schnelle
Thomas Huth writes: > On 28/01/2024 21.22, Sven Schnelle wrote: >> When the maximum count of SCRIPTS instructions is reached, the code >> stops execution and returns, but fails to decrement the reentrancy >> counter. This effectively renders the SCSI controller unusable >> because on next entry t

Re: [PATCH 1/2] hw/smbios: Fix OEM strings table option validation

2024-01-28 Thread Michael Tokarev
28.01.2024 10:15, Akihiko Odaki: qemu_smbios_type11_opts did not the list terminator and that resulted in ..did not *have* the list terminator.., here and in 2/2. out-of-bound memory access. qemu_smbios_type11_opts also needs to have an element for the type option. Fixes: 2d6dcbf93fb0 ("smbi

Re: [PATCH 0/8] tests/unit/test-smp-parse.c: Add more CPU topology test cases

2024-01-28 Thread Song, Xiaoling
I tested the unit test cases with "make check" and result looks good. Tested-by: Xiaoling Song Regards, Xiaoling On 1/18/2024 10:48 PM, Zhao Liu wrote: From: Zhao Liu Hi list, Currently, test-smp-parse lacks the following cases: * The case to cover drawer and book parameters parsing in -sm

[PATCH] pci-host: designware: Limit value range of iATU viewport register

2024-01-28 Thread Guenter Roeck
The latest version of qemu (v8.2.0-869-g7a1dc45af5) crashes when booting the mcimx7d-sabre emulation with Linux v5.11 and later. qemu-system-arm: ../system/memory.c:2750: memory_region_set_alias_offset: Assertion `mr->alias' failed. Problem is that the Designware PCIe emulation accepts the full

Re: [PATCH v2] hw/arm: add PCIe to Freescale i.MX6

2024-01-28 Thread Guenter Roeck
On Sat, Jan 27, 2024 at 11:11:58AM -0800, Guenter Roeck wrote: > Hi, > > On Mon, Jan 08, 2024 at 02:03:25PM +, Nikita Ostrenkov wrote: > > Signed-off-by: Nikita Ostrenkov > > --- > > This patch, with the "sabrelite" emulation and the Linux upstream kernel > (v6.8-rc1, using imx_v6_v7_defconf

Re: [RESEND v2 1/2] hw/arm/virt-acpi-build.c: Migrate SPCR creation to common location

2024-01-28 Thread Sunil V L
Hi Jee Heng, On Sun, Jan 28, 2024 at 06:14:39PM -0800, Sia Jee Heng wrote: > RISC-V should also generate the SPCR in a manner similar to ARM. > Therefore, instead of replicating the code, relocate this function > to the common AML build. > > Signed-off-by: Sia Jee Heng > --- > hw/acpi/aml-build

Re: [PATCH v2 4/4] tests/avocado: excercise scripts/replay-dump.py in replay tests

2024-01-28 Thread Pavel Dovgalyuk
Reviewed-by: Pavel Dovgalyuk On 25.01.2024 19:08, Nicholas Piggin wrote: This runs replay-dump.py after recording a trace, and fails the test if the script fails. replay-dump.py is modified to exit with non-zero if an error is encountered while parsing, to support this. Signed-off-by: Nichola

Re: [PATCH v2 1/4] replay: allow runstate shutdown->running when replaying trace

2024-01-28 Thread Pavel Dovgalyuk
Reviewed-by: Pavel Dovgalyuk On 25.01.2024 19:08, Nicholas Piggin wrote: When replaying a trace, it is possible to go from shutdown to running with a reverse-debugging step. This can be useful if the problem being debugged triggers a reset or shutdown. Signed-off-by: Nicholas Piggin --- inc

Re: [PATCH v2 19/23] target/s390x: Prefer fast cpu_env() over slower CPU QOM cast macro

2024-01-28 Thread Thomas Huth
On 26/01/2024 23.04, Philippe Mathieu-Daudé wrote: Mechanical patch produced running the command documented in scripts/coccinelle/cpu_env.cocci_template header. Signed-off-by: Philippe Mathieu-Daudé --- target/s390x/cpu-dump.c| 3 +-- target/s390x/gdbstub.c | 6 ++ tar

Re: [PATCH v2 11/23] target/m68k: Prefer fast cpu_env() over slower CPU QOM cast macro

2024-01-28 Thread Thomas Huth
On 26/01/2024 23.03, Philippe Mathieu-Daudé wrote: Mechanical patch produced running the command documented in scripts/coccinelle/cpu_env.cocci_template header. Signed-off-by: Philippe Mathieu-Daudé --- target/m68k/cpu.c | 30 ++ target/m68k/gdbstub.c | 6

Re: [PATCH 04/17] migration/multifd: Set p->running = true in the right place

2024-01-28 Thread Peter Xu
On Sun, Jan 28, 2024 at 05:43:52PM +0200, Avihai Horon wrote: > > On 25/01/2024 22:57, Fabiano Rosas wrote: > > External email: Use caution opening links or attachments > > > > > > Avihai Horon writes: > > > > > The commit in the fixes line moved multifd thread creation to a > > > different lo

Re: [PATCH] hw/scsi/lsi53c895a: add missing decrement of reentrancy counter

2024-01-28 Thread Thomas Huth
On 28/01/2024 21.22, Sven Schnelle wrote: When the maximum count of SCRIPTS instructions is reached, the code stops execution and returns, but fails to decrement the reentrancy counter. This effectively renders the SCSI controller unusable because on next entry the reentrancy counter is still abo

Re: spapr watchdog vs watchdog_perform_action() / QMP watchdog-set-action

2024-01-28 Thread David Gibson
On Sat, Jan 27, 2024 at 01:08:02PM +, Peter Maydell wrote: > On Fri, 26 Jan 2024 at 20:49, Markus Armbruster wrote: > > > > Peter Maydell writes: > > > > > Hi; one of the "bitesized tasks" we have listed is to convert > > > watchdog timers which directly call qemu_system_reset_request() on >

Re: [PATCH v4 15/45] Add BCM2838 PCIE host

2024-01-28 Thread Sergei Kambalin
I'm not super familiar with how QEMU models PCI controllers, but I'm not sure this handling of the root port config registers is right. On other controllers it looks like the root config reads and writes are handled by setting the PCIDeviceClass::config_read and PCIDevice::config_write methods.

[PULL 06/14] ci: Add a migration compatibility test job

2024-01-28 Thread peterx
From: Fabiano Rosas The migration tests have support for being passed two QEMU binaries to test migration compatibility. Add a CI job that builds the lastest release of QEMU and another job that uses that version plus an already present build of the current version and run the migration tests wi

[PULL 04/14] migration: Drop unnecessary check in ram's pending_exact()

2024-01-28 Thread peterx
From: Peter Xu When the migration frameworks fetches the exact pending sizes, it means this check: remaining_size < s->threshold_size Must have been done already, actually at migration_iteration_run(): if (must_precopy <= s->threshold_size) { qemu_savevm_state_pending_exact(&must

[PULL 05/14] analyze-migration.py: Remove trick on parsing ramblocks

2024-01-28 Thread peterx
From: Peter Xu RAM_SAVE_FLAG_MEM_SIZE contains the total length of ramblock idstr to know whether scanning of ramblocks is complete. Drop the trick. Reviewed-by: Fabiano Rosas Link: https://lore.kernel.org/r/20240117075848.139045-4-pet...@redhat.com Signed-off-by: Peter Xu --- scripts/analyz

[PULL 01/14] userfaultfd: use 1ULL to build ioctl masks

2024-01-28 Thread peterx
From: Paolo Bonzini There is no need to use the Linux-internal __u64 type, 1ULL is guaranteed to be wide enough. Signed-off-by: Paolo Bonzini Reviewed-by: Philippe Mathieu-Daudé Link: https://lore.kernel.org/r/20240117160313.175609-1-pbonz...@redhat.com Signed-off-by: Peter Xu --- migration/

[PULL 09/14] migration: Fix use-after-free of migration state object

2024-01-28 Thread peterx
From: Fabiano Rosas We're currently allowing the process_incoming_migration_bh bottom-half to run without holding a reference to the 'current_migration' object, which leads to a segmentation fault if the BH is still live after migration_shutdown() has dropped the last reference to current_migrati

[PULL 07/14] ci: Disable migration compatibility tests for aarch64

2024-01-28 Thread peterx
From: Fabiano Rosas Until 9.0 is out, we need to keep the aarch64 job disabled because the tests always use the n-1 version of migration-test. That happens to be broken for aarch64 in 8.2. Once 9.0 is out, it will become the n-1 version and it will bring the fixed tests. We can revert this patch

[PULL 14/14] Make 'uri' optional for migrate QAPI

2024-01-28 Thread peterx
From: Het Gala 'uri' argument should be optional, as 'uri' and 'channels' arguments are mutally exclusive in nature. Fixes: 074dbce5fcce (migration: New migrate and migrate-incoming argument 'channels') Signed-off-by: Het Gala Link: https://lore.kernel.org/r/20240123064219.40514-1-het.g...@nut

[PULL 10/14] migration: Take reference to migration state around bg_migration_vm_start_bh

2024-01-28 Thread peterx
From: Fabiano Rosas We need to hold a reference to the current_migration object around async calls to avoid it been freed while still in use. Signed-off-by: Fabiano Rosas Link: https://lore.kernel.org/r/20240119233922.32588-3-faro...@suse.de Signed-off-by: Peter Xu --- migration/migration.c |

[PULL 11/14] migration: Reference migration state around loadvm_postcopy_handle_run_bh

2024-01-28 Thread peterx
From: Fabiano Rosas We need to hold a reference to the current_migration object around async calls to avoid it been freed while still in use. Even on this load-side function, we might still use the MigrationState, e.g to check for capabilities. Signed-off-by: Fabiano Rosas Link: https://lore.ke

[PULL 08/14] migration/yank: Use channel features

2024-01-28 Thread peterx
From: Fabiano Rosas Stop using outside knowledge about the io channels when registering yank functions. Query for features instead. The yank method for all channels used with migration code currently is to call the qio_channel_shutdown() function, so query for QIO_CHANNEL_FEATURE_SHUTDOWN. We co

[PULL 12/14] migration: Add a wrapper to qemu_bh_schedule

2024-01-28 Thread peterx
From: Fabiano Rosas Wrap qemu_bh_schedule() to ensure we always hold a reference to the current_migration object. Signed-off-by: Fabiano Rosas Link: https://lore.kernel.org/r/20240119233922.32588-5-faro...@suse.de Signed-off-by: Peter Xu --- migration/migration.c | 31 ++--

[PULL 03/14] migration: Make threshold_size an uint64_t

2024-01-28 Thread peterx
From: Peter Xu It's always used to compare against another uint64_t. Make it always clear that it's never a negative. Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Fabiano Rosas Link: https://lore.kernel.org/r/20240117075848.139045-2-pet...@redhat.com Signed-off-by: Peter Xu --- migratio

[PULL 02/14] migration: Plug memory leak on HMP migrate error path

2024-01-28 Thread peterx
From: Markus Armbruster hmp_migrate() leaks @caps when qmp_migrate() fails. Plug the leak with g_autoptr(). Fixes: 967f2de5c9ec (migration: Implement MigrateChannelList to hmp migration flow.) v8.2.0-rc0 Fixes: CID 1533125 Signed-off-by: Markus Armbruster Link: https://lore.kernel.org/r/20240

[PULL 13/14] migration: Centralize BH creation and dispatch

2024-01-28 Thread peterx
From: Fabiano Rosas Now that the migration state reference counting is correct, further wrap the bottom half dispatch process to avoid future issues. Move BH creation and scheduling together and wrap the dispatch with an intermediary function that will ensure we always keep the ref/unref balance

[PULL 00/14] Migration 20240126 patches

2024-01-28 Thread peterx
From: Peter Xu The following changes since commit 7a1dc45af581d2b643cdbf33c01fd96271616fbd: Merge tag 'pull-target-arm-20240126' of https://git.linaro.org/people/pmaydell/qemu-arm into staging (2024-01-26 18:16:35 +) are available in the Git repository at: https://gitlab.com/peterx/q

Re: [PULL 06/15] tests/qtest/migration: Don't use -cpu max for aarch64

2024-01-28 Thread Peter Xu
On Fri, Jan 26, 2024 at 11:54:32AM -0300, Fabiano Rosas wrote: > Peter Maydell writes: > > > On Fri, 26 Jan 2024 at 14:36, Fabiano Rosas wrote: > >> > >> pet...@redhat.com writes: > >> > >> > From: Fabiano Rosas > >> > > >> > The 'max' cpu is not expected to be stable in terms of features acros

Re: [PATCH v4 02/66] RAMBlock: Add support of KVM private guest memfd

2024-01-28 Thread Xiaoyao Li
On 1/26/2024 9:57 PM, David Hildenbrand wrote:   uint8_t memory_region_get_dirty_log_mask(MemoryRegion *mr)   {   uint8_t mask = mr->dirty_log_mask; diff --git a/system/physmem.c b/system/physmem.c index c1b22bac77c2..4735b0462ed9 100644 --- a/system/physmem.c +++ b/system/physmem.c @@ -1841,

Re: [PATCH v4 33/66] i386/tdx: Make memory type private by default

2024-01-28 Thread Xiaoyao Li
On 1/26/2024 10:58 PM, David Hildenbrand wrote: On 25.01.24 04:22, Xiaoyao Li wrote: By default (due to the recent UPM change), restricted memory attribute is shared.  Convert the memory region from shared to private at the memory slot creation time. add kvm region registering function to check

[RESEND v2 2/2] hw/riscv/virt-acpi-build.c: Generate SPCR table

2024-01-28 Thread Sia Jee Heng
Generate Serial Port Console Redirection Table (SPCR) for RISC-V virtual machine. Signed-off-by: Sia Jee Heng Reviewed-by: Daniel Henrique Barboza --- hw/riscv/virt-acpi-build.c | 39 ++ 1 file changed, 39 insertions(+) diff --git a/hw/riscv/virt-acpi-build.

[RESEND v2 1/2] hw/arm/virt-acpi-build.c: Migrate SPCR creation to common location

2024-01-28 Thread Sia Jee Heng
RISC-V should also generate the SPCR in a manner similar to ARM. Therefore, instead of replicating the code, relocate this function to the common AML build. Signed-off-by: Sia Jee Heng --- hw/acpi/aml-build.c | 51 hw/arm/virt-acpi-build.c| 68 +++

[RESEND v2 0/2] RISC-V: ACPI: Enable SPCR

2024-01-28 Thread Sia Jee Heng
This series focuses on enabling the Serial Port Console Redirection (SPCR) table for the RISC-V virt platform. Considering that ARM utilizes the same function, the initial patch involves migrating the build_spcr function to common code. This consolidation ensures that RISC-V avoids duplicating the

RE: [PATCH 0/5] migration/multifd: Prerequisite cleanups for ongoing work

2024-01-28 Thread Liu, Yuan1
> -Original Message- > From: Fabiano Rosas > Sent: Saturday, January 27, 2024 6:20 AM > To: qemu-devel@nongnu.org > Cc: Peter Xu ; Hao Xiang ; > Liu, Yuan1 ; Bryan Zhang > Subject: [PATCH 0/5] migration/multifd: Prerequisite cleanups for ongoing > work > > Hi, > > Here are two cleanups

[PATCH] hw/scsi/lsi53c895a: add missing decrement of reentrancy counter

2024-01-28 Thread Sven Schnelle
When the maximum count of SCRIPTS instructions is reached, the code stops execution and returns, but fails to decrement the reentrancy counter. This effectively renders the SCSI controller unusable because on next entry the reentrancy counter is still above the limit. This bug was seen on HP-UX 10

[Stable-8.2.1 64/71] block/blklogwrites: Fix a bug when logging "write zeroes" operations.

2024-01-28 Thread Michael Tokarev
From: Ari Sundholm There is a bug in the blklogwrites driver pertaining to logging "write zeroes" operations, causing log corruption. This can be easily observed by setting detect-zeroes to something other than "off" for the driver. The issue is caused by a concurrency bug pertaining to the fact

[Stable-8.2.1 69/71] target/xtensa: fix OOB TLB entry access

2024-01-28 Thread Michael Tokarev
From: Max Filippov r[id]tlb[01], [iw][id]tlb opcodes use TLB way index passed in a register by the guest. The host uses 3 bits of the index for ITLB indexing and 4 bits for DTLB, but there's only 7 entries in the ITLB array and 10 in the DTLB array, so a malicious guest may trigger out-of-bound a

[Stable-8.1.5 35/36] target/xtensa: fix OOB TLB entry access

2024-01-28 Thread Michael Tokarev
From: Max Filippov r[id]tlb[01], [iw][id]tlb opcodes use TLB way index passed in a register by the guest. The host uses 3 bits of the index for ITLB indexing and 4 bits for DTLB, but there's only 7 entries in the ITLB array and 10 in the DTLB array, so a malicious guest may trigger out-of-bound a

[Stable-8.2.1 70/71] target/arm: Fix A64 scalar SQSHRN and SQRSHRN

2024-01-28 Thread Michael Tokarev
From: Peter Maydell In commit 1b7bc9b5c8bf374dd we changed handle_vec_simd_sqshrn() so that instead of starting with a 0 value and depositing in each new element from the narrowing operation, it instead started with the raw result of the narrowing operation of the first element. This is fine in

[Stable-8.2.1 58/71] coroutine-ucontext: Save fake stack for pooled coroutine

2024-01-28 Thread Michael Tokarev
From: Akihiko Odaki Coroutine may be pooled even after COROUTINE_TERMINATE if CONFIG_COROUTINE_POOL is enabled and fake stack should be saved in such a case to keep AddressSanitizerUseAfterReturn working. Even worse, I'm seeing stack corruption without fake stack being saved. Signed-off-by: Akih

[Stable-7.2.9 23/30] block/io: clear BDRV_BLOCK_RECURSE flag after recursing in bdrv_co_block_status

2024-01-28 Thread Michael Tokarev
From: Fiona Ebner Using fleecing backup like in [0] on a qcow2 image (with metadata preallocation) can lead to the following assertion failure: > bdrv_co_do_block_status: Assertion `!(ret & BDRV_BLOCK_ZERO)' failed. In the reproducer [0], it happens because the BDRV_BLOCK_RECURSE flag will be s

[Stable-8.1.5 30/36] block/blklogwrites: Fix a bug when logging "write zeroes" operations.

2024-01-28 Thread Michael Tokarev
From: Ari Sundholm There is a bug in the blklogwrites driver pertaining to logging "write zeroes" operations, causing log corruption. This can be easily observed by setting detect-zeroes to something other than "off" for the driver. The issue is caused by a concurrency bug pertaining to the fact

[Stable-8.2.1 65/71] iotests: add filter_qmp_generated_node_ids()

2024-01-28 Thread Michael Tokarev
From: Stefan Hajnoczi Add a filter function for QMP responses that contain QEMU's automatically generated node ids. The ids change between runs and must be masked in the reference output. The next commit will use this new function. Signed-off-by: Stefan Hajnoczi Message-ID: <20240118144823.149

[Stable-8.1.5 28/36] tcg/arm: Fix SIGILL in tcg_out_qemu_st_direct

2024-01-28 Thread Michael Tokarev
From: Joseph Burt When tcg_out_qemu_st_{index,direct} were merged, the direct case for MO_64 was omitted, causing qemu_st_i64 to be encoded as 0x due to underflow when adding h.base and h.index. Fixes: 1df6d611bdc2 ("tcg/arm: Introduce HostAddress") Signed-off-by: Joseph Burt Message-Id

[Stable-8.2.1 56/71] accel/tcg: Revert mapping of PCREL translation block to multiple virtual addresses

2024-01-28 Thread Michael Tokarev
From: Paolo Bonzini This is causing regressions that have not been analyzed yet. Revert the change on stable branches. Cc: qemu-sta...@nongnu.org Cc: Michael Tokarev Related: https://gitlab.com/qemu-project/qemu/-/issues/2092 Signed-off-by: Paolo Bonzini Signed-off-by: Michael Tokarev diff

[Stable-8.2.1 67/71] monitor: only run coroutine commands in qemu_aio_context

2024-01-28 Thread Michael Tokarev
From: Stefan Hajnoczi monitor_qmp_dispatcher_co() runs in the iohandler AioContext that is not polled during nested event loops. The coroutine currently reschedules itself in the main loop's qemu_aio_context AioContext, which is polled during nested event loops. One known problem is that QMP devi

[Stable-8.2.1 71/71] target/arm: Fix incorrect aa64_tidcp1 feature check

2024-01-28 Thread Michael Tokarev
From: Peter Maydell A typo in the implementation of isar_feature_aa64_tidcp1() means we were checking the field in the wrong ID register, so we might have provided the feature on CPUs that don't have it and not provided it on CPUs that should have it. Correct this bug. Cc: qemu-sta...@nongnu.org

[Stable-8.2.1 62/71] tcg/arm: Fix SIGILL in tcg_out_qemu_st_direct

2024-01-28 Thread Michael Tokarev
From: Joseph Burt When tcg_out_qemu_st_{index,direct} were merged, the direct case for MO_64 was omitted, causing qemu_st_i64 to be encoded as 0x due to underflow when adding h.base and h.index. Fixes: 1df6d611bdc2 ("tcg/arm: Introduce HostAddress") Signed-off-by: Joseph Burt Message-Id

[Stable-8.2.1 68/71] qtest: bump aspeed_smc-test timeout to 6 minutes

2024-01-28 Thread Michael Tokarev
From: Daniel P. Berrangé On a loaded system with --enable-debug, this test can take longer than 5 minutes. Raising the timeout to 6 minutes gives greater headroom for such situations. Signed-off-by: Daniel P. Berrangé [thuth: Increase the timeout to 6 minutes for very loaded systems] Signed-off

[Stable-8.1.5 36/36] target/arm: Fix A64 scalar SQSHRN and SQRSHRN

2024-01-28 Thread Michael Tokarev
From: Peter Maydell In commit 1b7bc9b5c8bf374dd we changed handle_vec_simd_sqshrn() so that instead of starting with a 0 value and depositing in each new element from the narrowing operation, it instead started with the raw result of the narrowing operation of the first element. This is fine in

[Stable-8.1.5 34/36] qtest: bump aspeed_smc-test timeout to 6 minutes

2024-01-28 Thread Michael Tokarev
From: Daniel P. Berrangé On a loaded system with --enable-debug, this test can take longer than 5 minutes. Raising the timeout to 6 minutes gives greater headroom for such situations. Signed-off-by: Daniel P. Berrangé [thuth: Increase the timeout to 6 minutes for very loaded systems] Signed-off

[Stable-8.2.1 60/71] linux-user: Fixed cpu restore with pc 0 on SIGBUS

2024-01-28 Thread Michael Tokarev
From: Robbin Ehn Commit f4e1168198 (linux-user: Split out host_sig{segv,bus}_handler) introduced a bug, when returning from host_sigbus_handler the PC is never set. Thus cpu_loop_exit_restore is called with a zero PC and we immediate get a SIGSEGV. Signed-off-by: Robbin Ehn Fixes: f4e1168198 ("

[Stable-8.2.1 63/71] virtio-net: correctly copy vnet header when flushing TX

2024-01-28 Thread Michael Tokarev
From: Jason Wang When HASH_REPORT is negotiated, the guest_hdr_len might be larger than the size of the mergeable rx buffer header. Using virtio_net_hdr_mrg_rxbuf during the header swap might lead a stack overflow in this case. Fixing this by using virtio_net_hdr_v1_hash instead. Reported-by: Xi

[Stable-8.2.1 59/71] block/io: clear BDRV_BLOCK_RECURSE flag after recursing in bdrv_co_block_status

2024-01-28 Thread Michael Tokarev
From: Fiona Ebner Using fleecing backup like in [0] on a qcow2 image (with metadata preallocation) can lead to the following assertion failure: > bdrv_co_do_block_status: Assertion `!(ret & BDRV_BLOCK_ZERO)' failed. In the reproducer [0], it happens because the BDRV_BLOCK_RECURSE flag will be s

[Stable-8.2.1 00/71] Patch Round-up for stable 8.2.1, frozen on 2024-01-27

2024-01-28 Thread Michael Tokarev
The following patches are queued for QEMU stable v8.2.1: https://gitlab.com/qemu-project/qemu/-/commits/staging-8.2 Patch freeze is 2024-01-27 (frozen), and the release is planned for 2024-01-29: https://wiki.qemu.org/Planning/8.2 This series includes the edk2 changes (moving edk2 binaries

[Stable-8.2.1 55/71] acpi/tests/avocado/bits: wait for 200 seconds for SHUTDOWN event from bits VM

2024-01-28 Thread Michael Tokarev
From: Ani Sinha By default, the timeout to receive any specified event from the QEMU VM is 60 seconds set by the python avocado test framework. Please see event_wait() and events_wait() in python/qemu/machine/machine.py. If the matching event is not triggered within that interval, an asyncio.Time

[Stable-8.2.1 66/71] iotests: port 141 to Python for reliable QMP testing

2024-01-28 Thread Michael Tokarev
From: Stefan Hajnoczi The common.qemu bash functions allow tests to interact with the QMP monitor of a QEMU process. I spent two days trying to update 141 when the order of the test output changed, but found it would still fail occassionally because printf() and QMP events race with synchronous Q

[Stable-8.2.1 61/71] linux-user/riscv: Adjust vdso signal frame cfa offsets

2024-01-28 Thread Michael Tokarev
From: Richard Henderson A typo in sizeof_reg put the registers at the wrong offset. Simplify the expressions to use positive addresses from the start of uc_mcontext instead of negative addresses from the end of uc_mcontext. Reported-by: Vineet Gupta Reviewed-by: Philippe Mathieu-Daudé Reviewe

[Stable-8.2.1 57/71] tcg/s390x: Fix encoding of VRIc, VRSa, VRSc insns

2024-01-28 Thread Michael Tokarev
From: Richard Henderson While the format names the second vector register 'v3', it is still in the second position (bits 12-15) and the argument to RXB must match. Example error: - e7 00 00 10 2a 33 verllf %v16,%v0,16 + e7 00 00 10 2c 33 verllf %v16,%v16,16 Cc: qemu-sta...@n

[Stable-8.1.5 29/36] virtio-net: correctly copy vnet header when flushing TX

2024-01-28 Thread Michael Tokarev
From: Jason Wang When HASH_REPORT is negotiated, the guest_hdr_len might be larger than the size of the mergeable rx buffer header. Using virtio_net_hdr_mrg_rxbuf during the header swap might lead a stack overflow in this case. Fixing this by using virtio_net_hdr_v1_hash instead. Reported-by: Xi

[Stable-8.1.5 31/36] iotests: add filter_qmp_generated_node_ids()

2024-01-28 Thread Michael Tokarev
From: Stefan Hajnoczi Add a filter function for QMP responses that contain QEMU's automatically generated node ids. The ids change between runs and must be masked in the reference output. The next commit will use this new function. Signed-off-by: Stefan Hajnoczi Message-ID: <20240118144823.149

[Stable-7.2.9 27/30] iotests: port 141 to Python for reliable QMP testing

2024-01-28 Thread Michael Tokarev
From: Stefan Hajnoczi The common.qemu bash functions allow tests to interact with the QMP monitor of a QEMU process. I spent two days trying to update 141 when the order of the test output changed, but found it would still fail occassionally because printf() and QMP events race with synchronous Q

[Stable-8.1.5 25/36] readthodocs: fully specify a build environment

2024-01-28 Thread Michael Tokarev
From: Alex Bennée This is now expected by rtd so I've expanded using their example as 22.04 is one of our supported platforms. I tried to work out if there was an easy way to re-generate a requirements.txt from our pythondeps.toml but in the end went for the easier solution. Cc: Signed-off-by:

[Stable-8.1.5 33/36] monitor: only run coroutine commands in qemu_aio_context

2024-01-28 Thread Michael Tokarev
From: Stefan Hajnoczi monitor_qmp_dispatcher_co() runs in the iohandler AioContext that is not polled during nested event loops. The coroutine currently reschedules itself in the main loop's qemu_aio_context AioContext, which is polled during nested event loops. One known problem is that QMP devi

[Stable-7.2.9 29/30] qtest: bump aspeed_smc-test timeout to 6 minutes

2024-01-28 Thread Michael Tokarev
From: Daniel P. Berrangé On a loaded system with --enable-debug, this test can take longer than 5 minutes. Raising the timeout to 6 minutes gives greater headroom for such situations. Signed-off-by: Daniel P. Berrangé [thuth: Increase the timeout to 6 minutes for very loaded systems] Signed-off

[Stable-8.1.5 32/36] iotests: port 141 to Python for reliable QMP testing

2024-01-28 Thread Michael Tokarev
From: Stefan Hajnoczi The common.qemu bash functions allow tests to interact with the QMP monitor of a QEMU process. I spent two days trying to update 141 when the order of the test output changed, but found it would still fail occassionally because printf() and QMP events race with synchronous Q

[Stable-8.1.5 v3 00/36] Patch Round-up for stable 8.1.5, frozen on 2024-01-27

2024-01-28 Thread Michael Tokarev
The following patches are queued for QEMU stable v8.1.5: https://gitlab.com/qemu-project/qemu/-/commits/staging-8.1 Patch freeze is 2024-01-27 (frozen), and the release is planned for 2024-01-29: https://wiki.qemu.org/Planning/8.1 Please respond here or CC qemu-sta...@nongnu.org on any addi

[Stable-7.2.9 24/30] virtio-net: correctly copy vnet header when flushing TX

2024-01-28 Thread Michael Tokarev
From: Jason Wang When HASH_REPORT is negotiated, the guest_hdr_len might be larger than the size of the mergeable rx buffer header. Using virtio_net_hdr_mrg_rxbuf during the header swap might lead a stack overflow in this case. Fixing this by using virtio_net_hdr_v1_hash instead. Reported-by: Xi

[Stable-8.1.5 26/36] accel/tcg: Revert mapping of PCREL translation block to multiple virtual addresses

2024-01-28 Thread Michael Tokarev
From: Paolo Bonzini This is causing regressions that have not been analyzed yet. Revert the change on stable branches. Cc: qemu-sta...@nongnu.org Cc: Michael Tokarev Related: https://gitlab.com/qemu-project/qemu/-/issues/2092 Signed-off-by: Paolo Bonzini Signed-off-by: Michael Tokarev diff

[Stable-8.1.5 27/36] block/io: clear BDRV_BLOCK_RECURSE flag after recursing in bdrv_co_block_status

2024-01-28 Thread Michael Tokarev
From: Fiona Ebner Using fleecing backup like in [0] on a qcow2 image (with metadata preallocation) can lead to the following assertion failure: > bdrv_co_do_block_status: Assertion `!(ret & BDRV_BLOCK_ZERO)' failed. In the reproducer [0], it happens because the BDRV_BLOCK_RECURSE flag will be s

[Stable-7.2.9 v3 00/30] Patch Round-up for stable 7.2.9, frozen on 2024-01-27

2024-01-28 Thread Michael Tokarev
The following patches are queued for QEMU stable v7.2.9: https://gitlab.com/qemu-project/qemu/-/commits/staging-7.2 Patch freeze is 2024-01-27 (frozen), and the release is planned for 2024-01-29: https://wiki.qemu.org/Planning/7.2 Please respond here or CC qemu-sta...@nongnu.org on any addi

[Stable-7.2.9 30/30] target/xtensa: fix OOB TLB entry access

2024-01-28 Thread Michael Tokarev
From: Max Filippov r[id]tlb[01], [iw][id]tlb opcodes use TLB way index passed in a register by the guest. The host uses 3 bits of the index for ITLB indexing and 4 bits for DTLB, but there's only 7 entries in the ITLB array and 10 in the DTLB array, so a malicious guest may trigger out-of-bound a

[Stable-7.2.9 28/30] monitor: only run coroutine commands in qemu_aio_context

2024-01-28 Thread Michael Tokarev
From: Stefan Hajnoczi monitor_qmp_dispatcher_co() runs in the iohandler AioContext that is not polled during nested event loops. The coroutine currently reschedules itself in the main loop's qemu_aio_context AioContext, which is polled during nested event loops. One known problem is that QMP devi

[Stable-7.2.9 22/30] accel/tcg: Revert mapping of PCREL translation block to multiple virtual addresses

2024-01-28 Thread Michael Tokarev
From: Paolo Bonzini This is causing regressions that have not been analyzed yet. Revert the change on stable branches. Cc: qemu-sta...@nongnu.org Cc: Michael Tokarev Related: https://gitlab.com/qemu-project/qemu/-/issues/2092 Signed-off-by: Paolo Bonzini Signed-off-by: Michael Tokarev diff

[Stable-7.2.9 25/30] block/blklogwrites: Fix a bug when logging "write zeroes" operations.

2024-01-28 Thread Michael Tokarev
From: Ari Sundholm There is a bug in the blklogwrites driver pertaining to logging "write zeroes" operations, causing log corruption. This can be easily observed by setting detect-zeroes to something other than "off" for the driver. The issue is caused by a concurrency bug pertaining to the fact

[Stable-7.2.9 26/30] iotests: add filter_qmp_generated_node_ids()

2024-01-28 Thread Michael Tokarev
From: Stefan Hajnoczi Add a filter function for QMP responses that contain QEMU's automatically generated node ids. The ids change between runs and must be masked in the reference output. The next commit will use this new function. Signed-off-by: Stefan Hajnoczi Message-ID: <20240118144823.149

[Stable-7.2.9 21/30] readthodocs: fully specify a build environment

2024-01-28 Thread Michael Tokarev
From: Alex Bennée This is now expected by rtd so I've expanded using their example as 22.04 is one of our supported platforms. I tried to work out if there was an easy way to re-generate a requirements.txt from our pythondeps.toml but in the end went for the easier solution. Cc: Signed-off-by:

Re: [PATCH 07/33] target: Uninline cpu_mmu_index()

2024-01-28 Thread Philippe Mathieu-Daudé
On 28/1/24 17:41, Philippe Mathieu-Daudé wrote: On 28/1/24 05:41, Richard Henderson wrote: From: Anton Johansson Uninlines the target-defined cpu_mmu_index() function by moving its definition to target/*/cpu.c.  This allows for compiling memory access functions in accel/tcg/cputlb.c without ha

Re: [PATCH 07/33] target: Uninline cpu_mmu_index()

2024-01-28 Thread Philippe Mathieu-Daudé
On 28/1/24 05:41, Richard Henderson wrote: From: Anton Johansson Uninlines the target-defined cpu_mmu_index() function by moving its definition to target/*/cpu.c. This allows for compiling memory access functions in accel/tcg/cputlb.c without having to know target specifics. Signed-off-by: An

Re: [PATCH 00/33] tcg patch queue, pre-pull

2024-01-28 Thread Philippe Mathieu-Daudé
On 28/1/24 05:41, Richard Henderson wrote: Collect some patch sets, cherry-pick from others, with a few changes of my own. Patches that lack review: 26-include-qemu-Add-TCGCPUOps-typedef-to-typedefs.h.patch 27-target-loongarch-Constify-loongarch_tcg_ops.patch 28-accel-tcg-Use-CPUState.

Re: [PATCH 10/33] include/exec: Move cpu_*()/cpu_env() to common header

2024-01-28 Thread Philippe Mathieu-Daudé
On 28/1/24 05:41, Richard Henderson wrote: From: Anton Johansson Functions are target independent. Signed-off-by: Anton Johansson Message-Id: <20240119144024.14289-17-a...@rev.ng> Reviewed-by: Richard Henderson Signed-off-by: Richard Henderson --- include/exec/cpu-all.h| 25 --

Re: [PATCH 16/33] accel/tcg/cpu-exec: Use RCU_READ_LOCK_GUARD

2024-01-28 Thread Philippe Mathieu-Daudé
On 28/1/24 05:41, Richard Henderson wrote: From: Philippe Mathieu-Daudé Replace the manual rcu_read_(un)lock calls in cpu_exec(). Signed-off-by: Philippe Mathieu-Daudé Message-Id: <20240124074201.8239-2-phi...@linaro.org> [rth: Use RCU_READ_LOCK_GUARD not WITH_RCU_READ_LOCK_GUARD] Reviewed-

Re: [PATCH 26/33] include/qemu: Add TCGCPUOps typedef to typedefs.h

2024-01-28 Thread Philippe Mathieu-Daudé
On 28/1/24 05:42, Richard Henderson wrote: QEMU coding style recommends using structure typedefs. Signed-off-by: Richard Henderson --- include/hw/core/cpu.h | 5 + include/qemu/typedefs.h| 1 + bsd-user/signal.c | 4 ++-- linux-user/signal.c| 4 ++-- target/a

Re: [PATCH v2 10/23] target/i386: Prefer fast cpu_env() over slower CPU QOM cast macro

2024-01-28 Thread Philippe Mathieu-Daudé
On 27/1/24 13:21, Zhao Liu wrote: Hi Philippe, On Fri, Jan 26, 2024 at 11:03:52PM +0100, Philippe Mathieu-Daudé wrote: Date: Fri, 26 Jan 2024 23:03:52 +0100 From: Philippe Mathieu-Daudé Subject: [PATCH v2 10/23] target/i386: Prefer fast cpu_env() over slower CPU QOM cast macro X-Mailer: git-

Re: [PATCH 04/17] migration/multifd: Set p->running = true in the right place

2024-01-28 Thread Avihai Horon
On 25/01/2024 22:57, Fabiano Rosas wrote: External email: Use caution opening links or attachments Avihai Horon writes: The commit in the fixes line moved multifd thread creation to a different location, but forgot to move the p->running = true assignment as well. Thus, p->running is set t

Re: [PATCH v3 00/46] Rework matching of network devices to -nic options

2024-01-28 Thread David Woodhouse
On Fri, 2024-01-26 at 17:51 +0100, Thomas Huth wrote: > On 25/01/2024 01.38, Jason Wang wrote: > > On Wed, Jan 24, 2024 at 9:14 PM David Woodhouse wrote: > > > > > > Hi Jason, > > > > > > I think this series probably lives or dies with you. I think it's a > > > worthwhile cleanup, but I no longe

Re: [PATCH v2 2/2] e1000e: fix link state on resume

2024-01-28 Thread Akihiko Odaki
On 2024/01/24 19:40, Laurent Vivier wrote: On resume e1000e_vm_state_change() always calls e1000e_autoneg_resume() that sets link_down to false, and thus activates the link even if we have disabled it. The problem can be reproduced starting qemu in paused state (-S) and then set the link to down

Re: [PATCH v2 1/2] igb: fix link state on resume

2024-01-28 Thread Akihiko Odaki
On 2024/01/24 19:29, Laurent Vivier wrote: On resume igb_vm_state_change() always calls igb_autoneg_resume() that sets link_down to false, and thus activates the link even if we have disabled it. The problem can be reproduced starting qemu in paused state (-S) and then set the link to down. When

Re: [PATCH v2 21/23] target/tricore: Prefer fast cpu_env() over slower CPU QOM cast macro

2024-01-28 Thread Bastian Koppelmann
On Fri, Jan 26, 2024 at 11:04:03PM +0100, Philippe Mathieu-Daudé wrote: > Mechanical patch produced running the command documented > in scripts/coccinelle/cpu_env.cocci_template header. > > Signed-off-by: Philippe Mathieu-Daudé > --- > target/tricore/cpu.c | 20 > targ

[PATCH v10 3/3] target/riscv: Validate misa_mxl_max only once

2024-01-28 Thread Akihiko Odaki
misa_mxl_max is now a class member and initialized only once for each class. This also moves the initialization of gdb_core_xml_file which will be referenced before realization in the future. Signed-off-by: Akihiko Odaki Reviewed-by: Alistair Francis --- target/riscv/cpu.c | 21

[PATCH v10 2/3] target/riscv: Move misa_mxl_max to class

2024-01-28 Thread Akihiko Odaki
misa_mxl_max is common for all instances of a RISC-V CPU class so they are better put into class. Signed-off-by: Akihiko Odaki Reviewed-by: Alistair Francis --- target/riscv/cpu.h | 4 +- hw/riscv/boot.c| 3 +- target/riscv/cpu.c | 162 ---

[PATCH v10 1/3] target/riscv: Remove misa_mxl validation

2024-01-28 Thread Akihiko Odaki
It is initialized with a simple assignment and there is little room for error. In fact, the validation is even more complex. Signed-off-by: Akihiko Odaki Acked-by: LIU Zhiwei Reviewed-by: Daniel Henrique Barboza Acked-by: Alistair Francis --- target/riscv/tcg/tcg-cpu.c | 15 +++ 1

  1   2   >