diff --git a/block-blkio-Make-s-mem_region_alignment-be-64-bits.patch b/block-blkio-Make-s-mem_region_alignment-be-64-bits.patch new file mode 100644 index 0000000000000000000000000000000000000000..3b95eea9958acf0599c701844ffa1dc9e7c82f0d --- /dev/null +++ b/block-blkio-Make-s-mem_region_alignment-be-64-bits.patch @@ -0,0 +1,48 @@ +From ede25e9b7c5cc8ce1c668f306bfbe5c90564570b Mon Sep 17 00:00:00 2001 +From: gubin +Date: Wed, 25 Jun 2025 17:13:10 +0800 +Subject: [PATCH] block/blkio: Make s->mem_region_alignment be 64 bits +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +cherry-pick from 615eaeab3d318ba239d54141a4251746782f65c1 + +With GCC 14 the code failed to compile on i686 (and was wrong for any +version of GCC): + +../block/blkio.c: In function ‘blkio_file_open’: +../block/blkio.c:857:28: error: passing argument 3 of ‘blkio_get_uint64’ from incompatible pointer type [-Wincompatible-pointer-types] + 857 | &s->mem_region_alignment); + | ^~~~~~~~~~~~~~~~~~~~~~~~ + | | + | size_t * {aka unsigned int *} +In file included from ../block/blkio.c:12: +/usr/include/blkio.h:49:67: note: expected ‘uint64_t *’ {aka ‘long long unsigned int *’} but argument is of type ‘size_t *’ {aka ‘unsigned int *’} + 49 | int blkio_get_uint64(struct blkio *b, const char *name, uint64_t *value); + | ~~~~~~~~~~^~~~~ + +Signed-off-by: Richard W.M. Jones +Message-id: 20240130122006.2977938-1-rjones@redhat.com +Signed-off-by: Stefan Hajnoczi +Signed-off-by: gubin +--- + block/blkio.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/block/blkio.c b/block/blkio.c +index 027c16ceb6..52ac94527f 100644 +--- a/block/blkio.c ++++ b/block/blkio.c +@@ -68,7 +68,7 @@ typedef struct { + CoQueue bounce_available; + + /* The value of the "mem-region-alignment" property */ +- size_t mem_region_alignment; ++ uint64_t mem_region_alignment; + + /* Can we skip adding/deleting blkio_mem_regions? */ + bool needs_mem_regions; +-- +2.33.0 + diff --git a/block-io-accept-NULL-qiov-in-bdrv_pad_request.patch b/block-io-accept-NULL-qiov-in-bdrv_pad_request.patch new file mode 100644 index 0000000000000000000000000000000000000000..0235d649316cc93a5c17cfb0d561df6709e3d4be --- /dev/null +++ b/block-io-accept-NULL-qiov-in-bdrv_pad_request.patch @@ -0,0 +1,80 @@ +From a01e9f722d8e187493cda6acf645012793bc95fe Mon Sep 17 00:00:00 2001 +From: gubin +Date: Wed, 25 Jun 2025 17:18:04 +0800 +Subject: [PATCH] block/io: accept NULL qiov in bdrv_pad_request + +cherry-pick from 3f934817c82c2f1bf1c238f8d1065a3be10a3c9e + +Some operations, e.g. block-stream, perform reads while discarding the +results (only copy-on-read matters). In this case, they will pass NULL +as the target QEMUIOVector, which will however trip bdrv_pad_request, +since it wants to extend its passed vector. In particular, this is the +case for the blk_co_preadv() call in stream_populate(). + +If there is no qiov, no operation can be done with it, but the bytes +and offset still need to be updated, so the subsequent aligned read +will actually be aligned and not run into an assertion failure. + +Originally-by: Stefan Reiter +Signed-off-by: Thomas Lamprecht +Signed-off-by: Fiona Ebner +Message-ID: <20240322095009.346989-2-f.ebner@proxmox.com> +Reviewed-by: Kevin Wolf +Reviewed-by: Stefan Hajnoczi +Signed-off-by: Kevin Wolf +Signed-off-by: gubin +Signed-off-by: gubin +--- + block/io.c | 33 ++++++++++++++++++++------------- + 1 file changed, 20 insertions(+), 13 deletions(-) + +diff --git a/block/io.c b/block/io.c +index a280a5a4c9..27d6a1a04b 100644 +--- a/block/io.c ++++ b/block/io.c +@@ -1756,22 +1756,29 @@ static int bdrv_pad_request(BlockDriverState *bs, + return 0; + } + +- sliced_iov = qemu_iovec_slice(*qiov, *qiov_offset, *bytes, +- &sliced_head, &sliced_tail, +- &sliced_niov); +- +- /* Guaranteed by bdrv_check_request32() */ +- assert(*bytes <= SIZE_MAX); +- ret = bdrv_create_padded_qiov(bs, pad, sliced_iov, sliced_niov, +- sliced_head, *bytes); +- if (ret < 0) { +- bdrv_padding_finalize(pad); +- return ret; ++ /* ++ * For prefetching in stream_populate(), no qiov is passed along, because ++ * only copy-on-read matters. ++ */ ++ if (qiov && *qiov) { ++ sliced_iov = qemu_iovec_slice(*qiov, *qiov_offset, *bytes, ++ &sliced_head, &sliced_tail, ++ &sliced_niov); ++ ++ /* Guaranteed by bdrv_check_request32() */ ++ assert(*bytes <= SIZE_MAX); ++ ret = bdrv_create_padded_qiov(bs, pad, sliced_iov, sliced_niov, ++ sliced_head, *bytes); ++ if (ret < 0) { ++ bdrv_padding_finalize(pad); ++ return ret; ++ } ++ *qiov = &pad->local_qiov; ++ *qiov_offset = 0; + } ++ + *bytes += pad->head + pad->tail; + *offset -= pad->head; +- *qiov = &pad->local_qiov; +- *qiov_offset = 0; + if (padded) { + *padded = true; + } +-- +2.33.0 + diff --git a/hw-audio-cs4231a-fix-assertion-error-in-isa_bus_get_.patch b/hw-audio-cs4231a-fix-assertion-error-in-isa_bus_get_.patch new file mode 100644 index 0000000000000000000000000000000000000000..3bb243fa0424755ccd70ab2ace9e4bd907e93363 --- /dev/null +++ b/hw-audio-cs4231a-fix-assertion-error-in-isa_bus_get_.patch @@ -0,0 +1,37 @@ +From 3e4513fcbbb00aff1d8147cee3b93c2bbf3a68fb Mon Sep 17 00:00:00 2001 +From: dinglimin +Date: Sat, 14 Jun 2025 17:09:25 +0800 +Subject: [PATCH] hw/audio/cs4231a: fix assertion error in isa_bus_get_irq + + This patch fixes an assertion error in isa_bus_get_irq() in + /hw/isa/isa-bus.c by adding a constraint to the irq property. + Patch v1 misused ISA_NUM_IRQS, pls ignore that. + + Signed-off-by: Zheng Huang + Link: https://lore.kernel.org/r/6d228069-e38f-4c46-813f-edcccc5c47e4@gmail.com + Signed-off-by: Paolo Bonzini + +Signed-off-by: dinglimin +--- + hw/audio/cs4231a.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/hw/audio/cs4231a.c b/hw/audio/cs4231a.c +index 3aa105748d..88dfd0bb7f 100644 +--- a/hw/audio/cs4231a.c ++++ b/hw/audio/cs4231a.c +@@ -682,6 +682,11 @@ static void cs4231a_realizefn (DeviceState *dev, Error **errp) + return; + } + ++ if (s->irq >= ISA_NUM_IRQS) { ++ error_setg(errp, "Invalid IRQ %d (max %d)", s->irq, ISA_NUM_IRQS - 1); ++ return; ++ } ++ + s->pic = isa_bus_get_irq(bus, s->irq); + k = ISADMA_GET_CLASS(s->isa_dma); + k->register_channel(s->isa_dma, s->dma, cs_dma_read, s); +-- +2.33.0 + diff --git a/qemu.spec b/qemu.spec index 2976027d73b5a155a67c40a89744348414b14631..9a7eff15fb01647a0201eaffce4c4ee426346e24 100644 --- a/qemu.spec +++ b/qemu.spec @@ -3,7 +3,7 @@ Name: qemu Version: 8.2.0 -Release: 38 +Release: 39 Epoch: 11 Summary: QEMU is a generic and open source machine emulator and virtualizer License: GPLv2 and BSD and MIT and CC-BY-SA-4.0 @@ -947,8 +947,12 @@ Patch0930: qemu-options-enable-smbios-option-on-RISC-V.patch Patch0931: qemu-options.hx-correct-formatting-smbios-type-4.patch Patch0932: tests-unit-test-char-Avoid-using-g_alloca.patch Patch0933: virtio-processes-indirect-descriptors-even-if-the-re.patch - - +Patch0934: hw-audio-cs4231a-fix-assertion-error-in-isa_bus_get_.patch +Patch0935: block-blkio-Make-s-mem_region_alignment-be-64-bits.patch +Patch0936: target-arm-Adjust-and-validate-mtedesc-sizem1.patch +Patch0937: block-io-accept-NULL-qiov-in-bdrv_pad_request.patch +Patch0938: target-arm-fix-qemu-arm-target-build-error.patch +Patch0939: target-i386-Add-new-Hygon-Chengdu-CPU-model.patch BuildRequires: flex BuildRequires: gcc @@ -1551,6 +1555,14 @@ getent passwd qemu >/dev/null || \ %endif %changelog +* Fri Jul 25 2025 Pengrui Zhang - 11:8.2.0-39 +- hw/audio/cs4231a: fix assertion error in isa_bus_get_irq +- block/blkio: Make s->mem_region_alignment be 64 bits +- target/arm: Adjust and validate mtedesc sizem1 +- block/io: accept NULL qiov in bdrv_pad_request +- target-arm: fix qemu-arm target build error +- target/i386: Add new Hygon 'Chengdu' CPU model + * Fri Jul 18 2025 Pengrui Zhang - 11:8.2.0-38 - sync header file from upstream - backends/tpm: Avoid using g_alloca() diff --git a/target-arm-Adjust-and-validate-mtedesc-sizem1.patch b/target-arm-Adjust-and-validate-mtedesc-sizem1.patch new file mode 100644 index 0000000000000000000000000000000000000000..c2248de01584af6ace6b58bb70c58dd0763801e3 --- /dev/null +++ b/target-arm-Adjust-and-validate-mtedesc-sizem1.patch @@ -0,0 +1,66 @@ +From 19ef3764888b212a63603ac46e88b4cfd99dd7b2 Mon Sep 17 00:00:00 2001 +From: gubin +Date: Wed, 25 Jun 2025 17:24:49 +0800 +Subject: [PATCH] target/arm: Adjust and validate mtedesc sizem1 + +cherry-pick from b12a7671b6099a26ce5d5ab09701f151e21c112c + +When we added SVE_MTEDESC_SHIFT, we effectively limited the +maximum size of MTEDESC. Adjust SIZEM1 to consume the remaining +bits (32 - 10 - 5 - 12 == 5). Assert that the data to be stored +fits within the field (expecting 8 * 4 - 1 == 31, exact fit). + +Cc: qemu-stable@nongnu.org +Reviewed-by: Peter Maydell +Signed-off-by: Richard Henderson +Tested-by: Gustavo Romero +Message-id: 20240207025210.8837-4-richard.henderson@linaro.org +Signed-off-by: Peter Maydell +Signed-off-by: gubin +--- + target/arm/internals.h | 2 +- + target/arm/tcg/translate-sve.c | 7 ++++--- + 2 files changed, 5 insertions(+), 4 deletions(-) + +diff --git a/target/arm/internals.h b/target/arm/internals.h +index 20b9c1da38..ed9bfb29c8 100644 +--- a/target/arm/internals.h ++++ b/target/arm/internals.h +@@ -1265,7 +1265,7 @@ FIELD(MTEDESC, TBI, 4, 2) + FIELD(MTEDESC, TCMA, 6, 2) + FIELD(MTEDESC, WRITE, 8, 1) + FIELD(MTEDESC, ALIGN, 9, 3) +-FIELD(MTEDESC, SIZEM1, 12, SIMD_DATA_BITS - 12) /* size - 1 */ ++FIELD(MTEDESC, SIZEM1, 12, SIMD_DATA_BITS - SVE_MTEDESC_SHIFT - 12) /* size - 1 */ + + bool mte_probe(CPUARMState *env, uint32_t desc, uint64_t ptr); + uint64_t mte_check(CPUARMState *env, uint32_t desc, uint64_t ptr, uintptr_t ra); +diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c +index 1d8e0d29bf..1b722ae75d 100644 +--- a/target/arm/tcg/translate-sve.c ++++ b/target/arm/tcg/translate-sve.c +@@ -4457,17 +4457,18 @@ static void do_mem_zpa(DisasContext *s, int zt, int pg, TCGv_i64 addr, + { + unsigned vsz = vec_full_reg_size(s); + TCGv_ptr t_pg; ++ uint32_t sizem1; + int desc = 0; + + assert(mte_n >= 1 && mte_n <= 4); ++ sizem1 = (mte_n << dtype_msz(dtype)) - 1; ++ assert(sizem1 <= R_MTEDESC_SIZEM1_MASK >> R_MTEDESC_SIZEM1_SHIFT); + if (s->mte_active[0]) { +- int msz = dtype_msz(dtype); +- + desc = FIELD_DP32(desc, MTEDESC, MIDX, get_mem_index(s)); + desc = FIELD_DP32(desc, MTEDESC, TBI, s->tbid); + desc = FIELD_DP32(desc, MTEDESC, TCMA, s->tcma); + desc = FIELD_DP32(desc, MTEDESC, WRITE, is_write); +- desc = FIELD_DP32(desc, MTEDESC, SIZEM1, (mte_n << msz) - 1); ++ desc = FIELD_DP32(desc, MTEDESC, SIZEM1, sizem1); + desc <<= SVE_MTEDESC_SHIFT; + } else { + addr = clean_data_tbi(s, addr); +-- +2.33.0 + diff --git a/target-arm-fix-qemu-arm-target-build-error.patch b/target-arm-fix-qemu-arm-target-build-error.patch new file mode 100644 index 0000000000000000000000000000000000000000..fc848b701d4b8479db68a14700adfad076d9e4b6 --- /dev/null +++ b/target-arm-fix-qemu-arm-target-build-error.patch @@ -0,0 +1,41 @@ +From d9940c5d6b3b7ad1173a16c58246196a03b3d317 Mon Sep 17 00:00:00 2001 +From: huangyan +Date: Fri, 4 Jul 2025 00:31:45 +0800 +Subject: [PATCH] target-arm: fix qemu-arm target build error * handle PSCI + calls in qemu-arm + +this change the same as upstream: +98128601ac8ff23df8a4c48acff00f9614613463: +* target-arm: add emulation of PSCI calls for system emulation + +Ported-by: huangyan huangyan@cdjrlc.com +Original-author: wangziliang wangziliang@kylinos.cn +--- + target/arm/internals.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/target/arm/internals.h b/target/arm/internals.h +index 20b9c1da38..a02a98d72a 100644 +--- a/target/arm/internals.h ++++ b/target/arm/internals.h +@@ -314,10 +314,17 @@ vaddr arm_adjust_watchpoint_address(CPUState *cs, vaddr addr, int len); + /* Callback function for when a watchpoint or breakpoint triggers. */ + void arm_debug_excp_handler(CPUState *cs); + ++#ifdef CONFIG_USER_ONLY ++static inline bool arm_is_psci_call(ARMCPU *cpu, int excp_type) ++{ ++ return false; ++} ++#else + /* Return true if the r0/x0 value indicates that this SMC/HVC is a PSCI call. */ + bool arm_is_psci_call(ARMCPU *cpu, int excp_type); + /* Actually handle a PSCI call */ + void arm_handle_psci_call(ARMCPU *cpu); ++#endif + + /** + * arm_clear_exclusive: clear the exclusive monitor +-- +2.33.0 + diff --git a/target-i386-Add-new-Hygon-Chengdu-CPU-model.patch b/target-i386-Add-new-Hygon-Chengdu-CPU-model.patch new file mode 100644 index 0000000000000000000000000000000000000000..829b46d4c5c98c1355d3794499c28ff52cd76761 --- /dev/null +++ b/target-i386-Add-new-Hygon-Chengdu-CPU-model.patch @@ -0,0 +1,89 @@ +From 198d98579a2ccb26423b644b29f53323c9bcb1e8 Mon Sep 17 00:00:00 2001 +From: Yanjing Zhou +Date: Mon, 19 May 2025 08:14:54 +0000 +Subject: [PATCH] target/i386: Add new Hygon 'Chengdu' CPU model + +Add the following feature bits compare to Dhyana CPU model: +avx512f, avx512dq, avx512ifma, clwb, avx512cd, avx512bw, gfni, +avx512vl, avx512_bf16, wbnoinvd, avx512vbmi, avx512_vbmi2, +vaes, vpclmulqdq, avx512_vnni, avx512_bitalg,avx512_vpopcntdq + +Signed-off-by: Yanjing Zhou +--- + target/i386/cpu.c | 60 +++++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 60 insertions(+) + +diff --git a/target/i386/cpu.c b/target/i386/cpu.c +index f79d0c9abf..8360ea3d61 100644 +--- a/target/i386/cpu.c ++++ b/target/i386/cpu.c +@@ -5324,6 +5324,66 @@ static const X86CPUDefinition builtin_x86_defs[] = { + .model_id = "Hygon Dharma Processor", + .cache_info = &dharma_cache_info, + }, ++ { ++ .name = "Chengdu", ++ .level = 0xd, ++ .vendor = CPUID_VENDOR_HYGON, ++ .family = 24, ++ .model = 7, ++ .stepping = 0, ++ .features[FEAT_1_EDX] = ++ CPUID_SSE2 | CPUID_SSE | CPUID_FXSR | CPUID_MMX | CPUID_CLFLUSH | ++ CPUID_PSE36 | CPUID_PAT | CPUID_CMOV | CPUID_MCA | CPUID_PGE | ++ CPUID_MTRR | CPUID_SEP | CPUID_APIC | CPUID_CX8 | CPUID_MCE | ++ CPUID_PAE | CPUID_MSR | CPUID_TSC | CPUID_PSE | CPUID_DE | ++ CPUID_VME | CPUID_FP87, ++ .features[FEAT_1_ECX] = ++ CPUID_EXT_RDRAND | CPUID_EXT_F16C | CPUID_EXT_AVX | ++ CPUID_EXT_XSAVE | CPUID_EXT_AES | CPUID_EXT_POPCNT | ++ CPUID_EXT_MOVBE | CPUID_EXT_SSE42 | CPUID_EXT_SSE41 | ++ CPUID_EXT_CX16 | CPUID_EXT_FMA | CPUID_EXT_SSSE3 | ++ CPUID_EXT_MONITOR | CPUID_EXT_PCLMULQDQ | CPUID_EXT_SSE3, ++ .features[FEAT_8000_0001_EDX] = ++ CPUID_EXT2_LM | CPUID_EXT2_RDTSCP | CPUID_EXT2_PDPE1GB | ++ CPUID_EXT2_FFXSR | CPUID_EXT2_MMXEXT | CPUID_EXT2_NX | ++ CPUID_EXT2_SYSCALL, ++ .features[FEAT_8000_0001_ECX] = ++ CPUID_EXT3_OSVW | CPUID_EXT3_3DNOWPREFETCH | ++ CPUID_EXT3_MISALIGNSSE | CPUID_EXT3_SSE4A | CPUID_EXT3_ABM | ++ CPUID_EXT3_CR8LEG | CPUID_EXT3_SVM | CPUID_EXT3_LAHF_LM | ++ CPUID_EXT3_TOPOEXT | CPUID_EXT3_PERFCORE, ++ .features[FEAT_8000_0008_EBX] = ++ CPUID_8000_0008_EBX_CLZERO | CPUID_8000_0008_EBX_XSAVEERPTR | ++ CPUID_8000_0008_EBX_WBNOINVD | CPUID_8000_0008_EBX_IBPB | ++ CPUID_8000_0008_EBX_IBRS | CPUID_8000_0008_EBX_STIBP | ++ CPUID_8000_0008_EBX_AMD_SSBD, ++ .features[FEAT_7_0_EBX] = ++ CPUID_7_0_EBX_FSGSBASE | CPUID_7_0_EBX_BMI1 | CPUID_7_0_EBX_AVX2 | ++ CPUID_7_0_EBX_SMEP | CPUID_7_0_EBX_BMI2 | CPUID_7_0_EBX_AVX512F | ++ CPUID_7_0_EBX_AVX512DQ | CPUID_7_0_EBX_RDSEED | ++ CPUID_7_0_EBX_ADX | CPUID_7_0_EBX_SMAP | CPUID_7_0_EBX_AVX512IFMA | ++ CPUID_7_0_EBX_CLFLUSHOPT | CPUID_7_0_EBX_CLWB | ++ CPUID_7_0_EBX_AVX512CD | CPUID_7_0_EBX_SHA_NI | ++ CPUID_7_0_EBX_AVX512BW | CPUID_7_0_EBX_AVX512VL, ++ .features[FEAT_7_0_ECX] = ++ CPUID_7_0_ECX_AVX512_VBMI | CPUID_7_0_ECX_UMIP | ++ CPUID_7_0_ECX_AVX512_VBMI2 | CPUID_7_0_ECX_GFNI | ++ CPUID_7_0_ECX_VAES | CPUID_7_0_ECX_VPCLMULQDQ | ++ CPUID_7_0_ECX_AVX512VNNI | CPUID_7_0_ECX_AVX512BITALG | ++ CPUID_7_0_ECX_AVX512_VPOPCNTDQ, ++ .features[FEAT_7_1_EAX] = ++ CPUID_7_1_EAX_AVX512_BF16, ++ .features[FEAT_XSAVE] = ++ CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC | ++ CPUID_XSAVE_XGETBV1, ++ .features[FEAT_6_EAX] = ++ CPUID_6_EAX_ARAT, ++ .features[FEAT_SVM] = ++ CPUID_SVM_NPT | CPUID_SVM_NRIPSAVE, ++ .xlevel = 0x80000020, ++ .model_id = "Hygon Chengdu Processor", ++ .cache_info = &dharma_cache_info, ++ }, + }; + + /* +-- +2.33.0 +