- hw/arm/fsl-imx: Do not ignore Error argument
- hw/net/cadence_gem.c: spelling fixes: Octects
- tests/qtest: check the return value
- libvhost-user: Fix VHOST_USER_GET_MAX_MEM_SLOTS reply mainline inclusion commit 69a5daec06f423843ce1bb9be5fb049314996f78 category: bugfix
- io_uring: fix short read slow path mainline inclusion commit c06fc7ce147e57ab493bad9263f1601b8298484b category: bugfix
- libvhost-user: Fix VHOST_USER_ADD_MEM_REG reply mainline inclusion commit 7f27d20ded2f480f3e66d03f90ea71507b834276 category: bugfix
- qsd: Unlink absolute PID file path mainline inclusion commit 9d8f8233b9fa525a7e37350fbc18877051128c5d category: bugfix
- net: Fix a misleading error message
- vdpa: stop all svq on device deletion
- vhost: release virtqueue objects in error path
- vhost: fix the fd leak
- virtio: i2c: Check notifier helpers for VIRTIO_CONFIG_IRQ_IDX
- hw/virtio: fix typo in VIRTIO_CONFIG_IRQ_IDX comments
- virtio-net: clear guest_announce feature if no cvq backend
- vdpa: fix VHOST_BACKEND_F_IOTLB_ASID flag check
- vdpa: do not block migration if device has cvq and x-svq=on
- vdpa net: block migration if the device has CVQ
- vdpa: Return -EIO if device ack is VIRTIO_NET_ERR in _load_mq()
- vdpa: Return -EIO if device ack is VIRTIO_NET_ERR in _load_mac()
- vdpa: fix not using CVQ buffer in case of error
- vdpa: Fix possible use-after-free for VirtQueueElement
- hw/virtio: fix vhost_user_read tracepoint
- vhost: Fix false positive out-of-bounds
- vhost: fix possible wrap in SVQ descriptor ring
- vhost: move iova_tree set to vhost_svq_start
- vhost: Always store new kick fd on vhost_svq_set_svq_kick_fd
- virtio-crypto: verify src&dst buffer length for sym request
- vdpa: commit all host notifier MRs in a single MR transaction
- vdpa: harden the error path if get_iova_range failed
- vdpa-dev: get iova range explicitly
- virtio-pci: add support for configure interrupt
- virtio-mmio: add support for configure interrupt
- virtio-net: add support for configure interrupt
- vhost: add support for configure interrupt
- virtio: add support for configure interrupt
- vhost-vdpa: add support for config interrupt
- vhost: introduce new VhostOps vhost_set_config_call
- virtio-pci: decouple the single vector from the interrupt process
- virtio-pci: decouple notifier from interrupt process
- virtio: introduce macro VIRTIO_CONFIG_IRQ_IDX
- vdpa: do not handle VIRTIO_NET_F_GUEST_ANNOUNCE in vhost-vdpa
- vdpa: handle VIRTIO_NET_CTRL_ANNOUNCE in vhost_vdpa_net_handle_ctrl_avail
- vhost: fix vq dirty bitmap syncing when vIOMMU is enabled
- hw/virtio: gracefully handle unset vhost_dev vdev
- hw/virtio/vhost: Fix typo in comment.
- vdpa: always start CVQ in SVQ mode if possible
- vdpa: add shadow_data to vhost_vdpa
- vdpa: store x-svq parameter in VhostVDPAState
- vdpa: add asid parameter to vhost_vdpa_dma_map/unmap
- vdpa: allocate SVQ array unconditionally
- vdpa: move SVQ vring features check to net/
- vdpa: request iova_range only once
- vdpa: add vhost_vdpa_net_valid_svq_features
- vhost: allocate SVQ device file descriptors at device start
- vhost: set SVQ device call handler at SVQ start
- vdpa: use v->shadow_vqs_enabled in vhost_vdpa_svqs_start & stop
- vhost: enable vrings in vhost_dev_start() for vhost-user devices
- vhost-vdpa: fix assert !virtio_net_get_subqueue(nc)->async_tx.elem in virtio_net_reset
- net/vhost-vdpa.c: Fix clang compilation failure
- vhost-vdpa: allow passing opened vhostfd to vhost-vdpa
- vdpa: Remove shadow CVQ command check
- vdpa: Delete duplicated vdpa_feature_bits entry
- hw/virtio: add some vhost-user trace events
- vdpa: Allow MQ feature in SVQ
- virtio-net: Update virtio-net curr_queue_pairs in vdpa backends
- vdpa: validate MQ CVQ commands
- vdpa: Add vhost_vdpa_net_load_mq
- vdpa: extract vhost_vdpa_net_load_mac from vhost_vdpa_net_load
- vdpa: Make VhostVDPAState cvq_cmd_in_buffer control ack type
- vdpa: Delete CVQ migration blocker
- vdpa: Add virtio-net mac address via CVQ at start
- vhost_net: add NetClientState->load() callback
- vdpa: extract vhost_vdpa_net_cvq_add from vhost_vdpa_net_handle_ctrl_avail
- vdpa: Move command buffers map to start of net device
- vdpa: add net_vhost_vdpa_cvq_info NetClientInfo
- vhost_net: Add NetClientInfo stop callback
- vhost_net: Add NetClientInfo start callback
- vdpa: Use ring hwaddr at vhost_vdpa_svq_unmap_ring
- vdpa: Make SVQ vring unmapping return void
- vdpa: Remove SVQ vring from iova_tree at shutdown
- util: accept iova_tree_remove_parameter by value
- vdpa: do not save failed dma maps in SVQ iova tree
- vdpa: Skip the maps not in the iova tree
- vdpa: Fix file descriptor leak on get features error
- vdpa: Fix memory listener deletions of iova tree
- vhost: Get vring base from vq, not svq
- vdpa: Add x-svq to NetdevVhostVDPAOptions
- vdpa: Add device migration blocker
- vdpa: Extract get features part from vhost_vdpa_get_max_queue_pairs
- vdpa: Buffer CVQ support on shadow virtqueue
- vdpa: manual forward CVQ buffers
- vdpa: Export vhost_vdpa_dma_map and unmap calls
- vhost: Add svq avail_handler callback
- vhost: add vhost_svq_poll
- vhost: Expose vhost_svq_add
- vhost: add vhost_svq_push_elem
- vhost: Track number of descs in SVQDescState
- vhost: Add SVQDescState
- vhost: Decouple vhost_svq_add from VirtQueueElement
- vhost: Check for queue full at vhost_svq_add
- vhost: Move vhost_svq_kick call to vhost_svq_add
- vhost: Reorder vhost_svq_kick
- vdpa: Avoid compiler to squash reads to used idx
- virtio-net: Expose ctrl virtqueue logic
- virtio-net: Expose MAC_TABLE_ENTRIES
- vhost: move descriptor translation to vhost_svq_vring_write_descs
- util: Return void on iova_tree_remove
- virtio-net: don't handle mq request in userspace handler for vhost-vdpa
- vhost-vdpa: change name and polarity for vhost_vdpa_one_time_request()
- vhost-vdpa: backend feature should set only once
- vhost-vdpa: fix improper cleanup in net_init_vhost_vdpa
- virtio-net: align ctrl_vq index for non-mq guest for vhost_vdpa
- virtio: add vhost support for virtio devices
- include/hw: start documenting the vhost API
- hw/virtio: add vhost_user_[read|write] trace points
- vhost: Fix element in vhost_svq_add failure
- vdpa: Fix index calculus at vhost_vdpa_svqs_start
- vdpa: Fix bad index calculus at vhost_vdpa_get_vring_base
- vhost: Fix device's used descriptor dequeue
- vhost: Track descriptor chain in private at SVQ
- vdpa: Add missing tracing to batch mapping functions
- vhost-vdpa: fix typo in a comment
- virtio: fix --enable-vhost-user build on non-Linux
- vdpa: Expose VHOST_F_LOG_ALL on SVQ
- vdpa: Never set log_base addr if SVQ is enabled
- vdpa: Adapt vhost_vdpa_get_vring_base to SVQ
- vdpa: Add custom IOTLB translations to SVQ
- vhost: Add VhostIOVATree
- util: add iova_tree_find_iova
- util: Add iova_tree_alloc_map
- vhost: Shadow virtqueue buffers forwarding
- vdpa: adapt vhost_ops callbacks to svq
- virtio: Add vhost_svq_get_vring_addr
- vhost: Add vhost_svq_valid_features to shadow vq
- vhost: Add Shadow VirtQueue call forwarding capabilities
- vhost: Add Shadow VirtQueue kick forwarding capabilities
- vhost: Add VhostShadowVirtqueue
- vdpa: Make ncs autofree
- Revert "virtio: introduce macro IRTIO_CONFIG_IRQ_IDX"
- Revert "virtio-pci: decouple notifier from interrupt process"
- Revert "virtio-pci: decouple the single vector from the interrupt process"
- Revert "vhost-vdpa: add support for config interrupt"
- Revert "virtio: add support for configure interrupt"
- Revert "vhost: add support for configure interrupt"
- Revert "virtio-net: add support for configure interrupt"
- Revert "virtio-mmio: add support for configure interrupt"
- Revert "virtio-pci: add support for configure interrupt"
- Revert "vhost: introduce new VhostOps vhost_set_config_call"
- virtio: signal after wrapping packed used_idx
- target/i386: Adjust feature level according to FEAT_7_1_EDX
- target/i386: Add new CPU model GraniteRapids
- target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration
- target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration
- target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration
- target/i386: Add support for AVX-IFMA in CPUID enumeration
- target/i386: Add support for AMX-FP16 in CPUID enumeration
- target/i386: Add support for CMPCCXADD in CPUID enumeration
- tracetool: avoid invalid escape in Python string
- hw/pvrdma: Protect against buggy or malicious guest driver
- vga: avoid crash if no default vga card mainline inclusion commit 6985d8ede92494f3b791de01e8ee9306eb6d5e4a category: bugfix
- qom/object: Remove circular include dependency mainline inclusion commit 5bba9bcfbb42e7c016626420e148a1bf1b080835 category: bugfix
- artist: set memory region owners for buffers to the artist device mainline inclusion commit 39fbaeca096a9bf6cbe2af88572c1cb2aa62aa8c category: bugfix
- virtio-iommu: Fix the partial copy of probe request mainline inclusion commit 45461aace83d961e933b27519b81d17b4c690514 category: bugfix
- e1000: set RX descriptor status in a separate operation mainline inclusion commit 034d00d4858161e1d4cff82d8d230bce874a04d3 category: bugfix
- vhost: introduce new VhostOps vhost_set_config_call
- vhost: stick to -errno error return convention
- vhost-user: stick to -errno error return convention
- vhost-vdpa: stick to -errno error return convention
- virtio-pci: add support for configure interrupt
- virtio-mmio: add support for configure interrupt
- virtio-net: add support for configure interrupt
- vhost: add support for configure interrupt
- virtio: add support for configure interrupt
- vhost-vdpa: add support for config interrupt
- virtio-pci: decouple the single vector from the interrupt process
- virtio-pci: decouple notifier from interrupt process
- virtio: introduce macro IRTIO_CONFIG_IRQ_IDX
- pci: Fix the update of interrupt disable bit in PCI_COMMAND register
- hw/timer/npcm7xx_timer: Prevent timer from counting down past zero
- tpm_crb: mark command buffer as dirty on request completion mainline inclusion commit e37a0ef4605e5d2041785ff3fc89ca6021faf7a0 category: bugfix
- pci: fix overflow in snprintf string formatting mainline inclusion commit 36f18c6989a3d1ff1d7a0e50b0868ef3958299b4 category: bugfix
- hw/usb/hcd-ehci: fix writeback order mainline inclusion commit f471e8b060798f26a7fc339c6152f82f22a7b33d category: bugfix
- qemu-timer: Skip empty timer lists before locking in qemu_clock_deadline_ns_all mainline inclusion commit 3f42906c9ab2c777a895b48b87b8107167e4a275 category: bugfix
- semihosting/config: Merge --semihosting-config option groups mainline inclusion commit 90c072e063737e9e8f431489bbd334452f89056e category: bugfix
- semihosting: fix memleak at semihosting_arg_fallback
- target/i386: Export GDS_NO bit to guests
Signed-off-by: Jiabo Feng <fengjiabo1@huawei.com>
- hw/virtio/virtio-pmem: Replace impossible check by assertion
- tests: Fix printf format string in acpi-utils.c
- softmmu/dirtylimit: Add parameter check for hmp "set_vcpu_dirty_limit"
- disas/riscv: Fix the typo of inverted order of pmpaddr13 and pmpaddr14
- qga: Fix memory leak when output stream is unused
- ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255)
- target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model
- target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES
- target/i386: Allow MCDT_NO if host supports
- target/i386: Add support for MCDT_NO in CPUID enumeration
- target/i386: Export MSR_ARCH_CAPABILITIES bits to guests
- target/i386: add support for FB_CLEAR feature
- target/i386: add support for FLUSH_L1D feature
- crypto: remove shadowed 'ret' variable
- hw/i2c/pmbus_device: Fix modifying QOM class internals from instance
- hw/arm/xlnx-zynqmp: fix unsigned error when checking the RPUs number
Signed-off-by: Jiabo Feng <fengjiabo1@huawei.com>
- thread-pool: optimize scheduling of completion bottom half
- migration/rdma: zore out head.repeat to make the error more clear
- vhost-user-fs: Back up vqs before cleaning up vhost_dev
- hw/vfio/pci-quirks: Sanitize capability pointer
- hw/vfio/pci-quirks: Support alternate offset for GPUDirect Cliques
- replay: fix event queue flush for qemu shutdown
- hw/net: Fix read of uninitialized memory in ftgmac100
- target/ppc: Fix tlbie
- target/i386: fix INVD vmexit
- qtest/npcm7xx_pwm-test: Fix memory leak in mft_qom_set
- aio-posix: zero out io_uring sqe user_data
Signed-off-by: Jiabo Feng <fengjiabo1@huawei.com>
- hw/nvme: Avoid dynamic stack allocation
- ppc/vof: Fix missed fields in VOF cleanup
- ui: fix crash when there are no active_console
- tests/qtest/pflash: Clean up local variable shadowing
- target/ppc: Fix the order of kvm_enable judgment about kvmppc_set_interrupt()
- tulip: Assign default MAC address if not specified
- hw/char: fix qcode array bounds check in ESCC impl
Signed-off-by: Jiabo Feng <fengjiabo1@huawei.com>
- io: remove io watch if TLS channel is closed during handshake
- hw/ssi: Fix Linux driver init issue with xilinx_spi
- chardev: report the handshake error
- vhost: Drop unused eventfd_add|del hooks
- virtio-iommu: use-after-free fix
- hw/arm/virt: Check for attempt to use TrustZone with KVM or HVF
- hw/rx: rx-gdbsim DTB load address aligned of 16byte
- vhost-user: Use correct macro name TARGET_PPC64
- accel/kvm: Make kvm_dirty_ring_reaper_init() void
- accel/kvm: Free as when an error occurred
Signed-off-by: Jiabo Feng <fengjiabo1@huawei.com>
- sw_64: Added sw64 architecture related updates
- virtio-crypto: verify src&dst buffer length for sym request
- vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present
- qga: Fix suspend on Linux guests without systemd
- tests: vhost-user-test: release mutex on protocol violation
- qapi: support updating expected test output via make
- block: Fix misleading hexadecimal format
- block/rbd: fix write zeroes with growing images
- block/nbd.c: Fixed IO request coroutine not being wakeup when kill NBD server
- block/nfs: Fix 32-bit Windows build
- qapi/qdev: Tidy up device_add documentation
- hw/xen/xen_pt: fix uninitialized variable
- migration/ram: Fix error handling in ram_write_tracking_start()
- docs/about/build-platforms: Refine the distro support policy
- xen-block: Avoid leaks on new error path
- QGA VSS: Add wrapper to send log to debugger and stderr
- chardev/char-socket: set s->listener = NULL in char_socket_finalize
- qapi/block: Tidy up block-latency-histogram-set documentation
- disas/riscv Fix ctzw disassemble
- vfio: Fix vfio_get_dev_region() trace event
- migration/ram: Fix populate_read_range()
- Check and report for incomplete 'global' option format
Signed-off-by: Jiabo Feng <fengjiabo1@huawei.com>
- Add lbt support for kvm.
- Fix smp.cores value and Fix divide 0 error
- hw/nvme: Change alignment in dma functions for nvme_blk_*
- virtio: fix reachable assertion due to stale value of cached region size
- hw/nvme: fix missing DNR on compare failure
Signed-off-by: Jiabo Feng <fengjiabo1@huawei.com>
Files man8/qemu-ga.8* are packaged in qemu-help package.
Delete it from qemu-guest-agent package.
Signed-off-by: liuxiangdong <liuxiangdong5@huawei.com>
"%exclude" only means not packaging these three files but they
are still existing in buildroot directory. "ERROR: No build ID
not found in XXXXX" will be reported when generating debug package.
Delete them directly in buildroot directory.
Signed-off-by: liuxiangdong <liuxiangdong5@huawei.com>
- migration/xbzrle: fix out-of-bounds write with axv512
- migration/xbzrle: use ctz64 to avoid undefined result
- Update bench-code for addressing CI problem
- AVX512 support for xbzrle_encode_buffer
- configure, meson: move AVX tests to meson
- target/i386: KVM: allow fast string operations if host supports them
- target/i386: add FSRM to TCG
- hw/nvme: fix memory leak in nvme_dsm
- aio-posix: fix race between epoll upgrade and aio_set_fd_handler()
- target/i386: Add SGX aex-notify and EDECCSSA support
- hw/usb/imx: Fix out of bounds access in imx_usbphy_read()
- target/i386: Set maximum APIC ID to KVM prior to vCPU creation
- target/i386: Fix sanity check on max APIC ID / X2APIC enablement
Signed-off-by: Fei Xu <xufei30@huawei.com>
-vhost-user-blk: fix the resize crash
-plugins: make qemu_plugin_user_exit's locking order consistent with fork_start's
-linux-user: fix strace build w/out munlockall
-ui: fix crash on serial reset, during init
-qga/win/vss: requester_freeze changes
-migration: fix populate_vfio_info
-block/rbd: workaround for ceph issue #53784
-target/i386: add FZRM, FSRS, FSRC
-i386: Add new CPU model SapphireRapids
-core/cpu-common: Fix the wrong '#ifdef __aarch64__'
Signed-off-by: Fei Xu <xufei30@huawei.com>
-bugfix: fix qmp command migrate-set-parameters
-some bugfixs about ARM hot-plugged CPUs
-hw/core/machine:Fix the missing consideration of cluster-id
-test/tcg:Fix target-specific Makefile variable path for user-mode
-tests:add (riscv virt) machine mapping to testenv
-Make a litte improvement in curl and hw/riscv
-qemu support for loongarch
-hw/pvrdma: Protect against buggy or malious guest driver
-hw/audio/intel-hda:fix stream reset
-dsoundaudio:fix crackling audio recordings
-add notify-vm-exit support for i386
-blok-backend: prevent dangling BDS pointers across aio_poll()
-net:Fix uninitialized data usage
-net/eth:Don't consider ESP to be an IPv6 option header
-hw/net/vmxnet3:Log guest-triggerable errors using LOG_GUEST_ERROR
Signed-off-by: FeiXu <xufei30@huawei.com>
- linux-user: Add strace output for timer_settime64() syscall
- fix qemu-core when vhost-user-net config with server mode
Signed-off-by: yezengruan <yezengruan@huawei.com>
It is more clear about conditonal build.
Signed-off-by: Qiang Wei <qiang.wei@suse.com>
(cherry picked from commit c00bd7dc70f700b90db24c324d2e2333282130b9)
- sync some bugfix patches from upstream
- fix the virtio features negotiation flaw
- fix CVE-2022-4144
Signed-off-by: yezengruan <yezengruan@huawei.com>
- arm/virt: Fix vcpu hotplug idx_from_topo_ids
- Revert patches related to the vSVA
- sync some bugfix patches from upstream
- add generic vDPA device support
Signed-off-by: yezengruan <yezengruan@huawei.com>
(cherry picked from commit b99dbfd9847104300672fb4f559f1c2abba8aa33)
The download url is dead and needs to be updated.
Signed-off-by: yezengruan <yezengruan@huawei.com>
(cherry picked from commit 60ac7eb978859584cfa877bade4168a7ae60968c)
net-tulip-Restrict-DMA-engine-to-memories.patch was named with CVE-XX
surfixes, the spec remains that old name, change the name there.
Signed-off-by: Zhang Bo <oscar.zhangbo@huawei.com>
fix CVE-2022-2962.
The DMA engine is started by I/O access and then itself accesses the
I/O registers, triggering a teentrancy bug.
Fix this bug by restricting the DMA engine to memories regions.
Signed-off-by: Zhang Bo <oscar.zhangbo@huawei.com>
hw/scsi/lsi53c895a: Do not abort when DMA requested and no data queued
tests/qtest: Add fuzz-lsi53c895a-test
scsi/lsi53c895a: fix use-after-free in lsi_do_msgout (CVE-2022-0216)
scsi/lsi53c895a: really fix use-after-free in lsi_do_msgout (CVE-2022-0216)
Signed-off-by: yezengruan <yezengruan@huawei.com>
block-nbd was refacted during release 6.2.0, but we didn't induced
all the needed patches within the 6.2.0 baseline, which leads to
vm crash during migration.
the reasons are as below:
when iothread is configured, the coroutines should get back to
the exact iothread that was out of. But within the 6.2.0 baseline,
patches were missing, nbd related coroutine didn't have its related
aio_context. It in fact get to the mainline aio_context, the mistaken
context leads to vm crash.
