[Stable-9.0.2 00/27] Patch Round-up for stable 9.0.2, frozen on 2024-07-14

[Stable-9.0.2 00/27] Patch Round-up for stable 9.0.2, frozen on 2024-07-14

[Michael Tokarev]

The following patches are queued for QEMU stable v9.0.2:

  https://gitlab.com/qemu-project/qemu/-/commits/staging-9.0

Patch freeze is 2024-07-14 (frozen), and the release is planned for 2024-07-16:

  https://wiki.qemu.org/Planning/9.0

Please respond here or CC qemu-stable@nongnu.org on any additional patches
you think should (or shouldn't) be included in the release.

The changes which are staging for inclusion, with the original commit hash
from master branch, are given below the bottom line.

Thanks!

/mjt

--------------------------------------
01* 3973615e7fba Mark Cave-Ayland:
   target/i386: fix size of EBP writeback in gen_enter()
02* 2c3e4e2de699 Alexey Dobriyan:
   virtio-net: drop too short packets early
03* 77bf310084da Dongwon Kim:
   ui/gtk: Draw guest frame at refresh cycle
04* 719c6819ed9a Stefan Hajnoczi:
   Revert "monitor: use aio_co_reschedule_self()"
05* a276ec8e2632 Philippe Mathieu-Daudé:
   hw/audio/virtio-snd: Always use little endian audio format
06* b1cf266c82cb Gerd Hoffmann:
   stdvga: fix screen blanking
07* 3b279f73fa37 Anton Johansson:
   accel/tcg: Fix typo causing tb->page_addr[1] to not be recorded
08* 54b27921026d Ilya Leoshkevich:
   linux-user: Make TARGET_NR_setgroups affect only the current thread
09* 6b4965373e56 Clément Chigot:
   target/sparc: use signed denominator in sdiv helper
10* 521d7fb3ebdf Richard Henderson:
   tcg/loongarch64: Fix tcg_out_movi vs some pcrel pointers
11* 6d3279655ac4 Fabiano Rosas:
   migration: Fix file migration with fdset
12* 641b1efe01b2 Thomas Huth:
   tests: Update our CI to use CentOS Stream 9 instead of 8
13* 903916f0a017 Chuang Xu:
   i386/cpu: fixup number of addressable IDs for processor cores in the 
   physical package
14* 76bccf3cb9d9 Richard Henderson:
   target/arm: Fix VCMLA Dd, Dn, Dm[idx]
15* 7619129f0d4a Richard Henderson:
   target/arm: Fix FJCVTZS vs flush-to-zero
16* 9d7950edb0cd Daniel P. Berrangé:
   hw/core: allow parameter=1 for SMP topology on any machine
17* e68dcbb07923 Daniel P. Berrangé:
   tests: add testing of parameter=1 for SMP topology
18* bd385a5298d7 Kevin Wolf:
   qcow2: Don't open data_file with BDRV_O_NO_IO
19* 2eb42a728d27 Kevin Wolf:
   iotests/244: Don't store data-file with protocol in image
20* 7e1110664ecb Kevin Wolf:
   iotests/270: Don't store data-file with json: prefix in image
21* 7ead94699861 Kevin Wolf:
   block: Parse filenames only when explicitly requested
22* a71d9dfbf63d Richard Henderson:
   tcg/optimize: Fix TCG_COND_TST* simplification of setcond2
23 a113d041e8d0 Cindy Lu:
   virtio-pci: Fix the failure process in kvm_virtio_pci_vector_use_one()
24 7aa6492401e9 Stefano Garzarella:
   virtio: remove virtio_tswap16s() call in vring_packed_event_read()
25 a0124e333e21 Maxim Mikityanskiy:
   char-stdio: Restore blocking mode of stdout on exit
26 e389929d19a5 Markus Armbruster:
   sphinx/qapidoc: Fix to generate doc for explicit, unboxed arguments
27 3936bbdf9a2e Vincent Fu:
   hw/nvme: fix number of PIDs for FDP RUH update

(commit(s) marked with * were in previous series and are not resent)

[Stable-9.0.2 23/27] virtio-pci: Fix the failure process in kvm_virtio_pci_vector_use_one()

[Michael Tokarev]

From: Cindy Lu <lulu@redhat.com>

In function kvm_virtio_pci_vector_use_one(), the function will only use
the irqfd/vector for itself. Therefore, in the undo label, the failing
process is incorrect.
To fix this, we can just remove this label.

Fixes: f9a09ca3ea ("vhost: add support for configure interrupt")
Cc: qemu-stable@nongnu.org
Signed-off-by: Cindy Lu <lulu@redhat.com>
Message-Id: <20240528084840.194538-1-lulu@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
(cherry picked from commit a113d041e8d0b152d72a7c2bf47dd09aabf9ade2)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index cb159fd078..e04218a9fb 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -892,7 +892,7 @@ static int kvm_virtio_pci_vector_use_one(VirtIOPCIProxy *proxy, int queue_no)
     }
     ret = kvm_virtio_pci_vq_vector_use(proxy, vector);
     if (ret < 0) {
-        goto undo;
+        return ret;
     }
     /*
      * If guest supports masking, set up irqfd now.
@@ -902,25 +902,11 @@ static int kvm_virtio_pci_vector_use_one(VirtIOPCIProxy *proxy, int queue_no)
         ret = kvm_virtio_pci_irqfd_use(proxy, n, vector);
         if (ret < 0) {
             kvm_virtio_pci_vq_vector_release(proxy, vector);
-            goto undo;
+            return ret;
         }
     }
 
     return 0;
-undo:
-
-    vector = virtio_queue_vector(vdev, queue_no);
-    if (vector >= msix_nr_vectors_allocated(dev)) {
-        return ret;
-    }
-    if (vdev->use_guest_notifier_mask && k->guest_notifier_mask) {
-        ret = virtio_pci_get_notifier(proxy, queue_no, &n, &vector);
-        if (ret < 0) {
-            return ret;
-        }
-        kvm_virtio_pci_irqfd_release(proxy, n, vector);
-    }
-    return ret;
 }
 static int kvm_virtio_pci_vector_vq_use(VirtIOPCIProxy *proxy, int nvqs)
 {
-- 
2.39.2

[Stable-9.0.2 24/27] virtio: remove virtio_tswap16s() call in vring_packed_event_read()

[Michael Tokarev]

From: Stefano Garzarella <sgarzare@redhat.com>

Commit d152cdd6f6 ("virtio: use virtio accessor to access packed event")
switched using of address_space_read_cached() to virito_lduw_phys_cached()
to access packed descriptor event.

When we used address_space_read_cached(), we needed to call
virtio_tswap16s() to handle the endianess of the field, but
virito_lduw_phys_cached() already handles it internally, so we no longer
need to call virtio_tswap16s() (as the commit had done for `off_wrap`,
but forgot for `flags`).

Fixes: d152cdd6f6 ("virtio: use virtio accessor to access packed event")
Cc: jasowang@redhat.com
Cc: qemu-stable@nongnu.org
Reported-by: Xoykie <xoykie@gmail.com>
Link: https://lore.kernel.org/qemu-devel/CAFU8RB_pjr77zMLsM0Unf9xPNxfr_--Tjr49F_eX32ZBc5o2zQ@mail.gmail.com
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Message-Id: <20240701075208.19634-1-sgarzare@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Eugenio Pérez <eperezma@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
(cherry picked from commit 7aa6492401e95fb296dec7cda81e67d91f6037d7)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index 871674f9be..fd2dfe3a6b 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -322,7 +322,6 @@ static void vring_packed_event_read(VirtIODevice *vdev,
     /* Make sure flags is seen before off_wrap */
     smp_rmb();
     e->off_wrap = virtio_lduw_phys_cached(vdev, cache, off_off);
-    virtio_tswap16s(vdev, &e->flags);
 }
 
 static void vring_packed_off_wrap_write(VirtIODevice *vdev,
-- 
2.39.2

[Stable-9.0.2 25/27] char-stdio: Restore blocking mode of stdout on exit

[Michael Tokarev]

From: Maxim Mikityanskiy <maxtram95@gmail.com>

qemu_chr_open_fd() sets stdout into non-blocking mode. Restore the old
fd flags on exit to avoid breaking unsuspecting applications that run on
the same terminal after qemu and don't expect to get EAGAIN.

While at at, also ensure term_exit is called once (at the moment it's
called both from char_stdio_finalize() and as the atexit() hook.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2423
Signed-off-by: Maxim Mikityanskiy <maxtram95@gmail.com>
Link: https://lore.kernel.org/r/20240703190812.3459514-1-maxtram95@gmail.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit a0124e333e2176640f233e5ea57a2f413985d9b5)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

diff --git a/chardev/char-stdio.c b/chardev/char-stdio.c
index 3c648678ab..b960ddd4e4 100644
--- a/chardev/char-stdio.c
+++ b/chardev/char-stdio.c
@@ -41,6 +41,7 @@
 /* init terminal so that we can grab keys */
 static struct termios oldtty;
 static int old_fd0_flags;
+static int old_fd1_flags;
 static bool stdio_in_use;
 static bool stdio_allow_signal;
 static bool stdio_echo_state;
@@ -50,6 +51,8 @@ static void term_exit(void)
     if (stdio_in_use) {
         tcsetattr(0, TCSANOW, &oldtty);
         fcntl(0, F_SETFL, old_fd0_flags);
+        fcntl(1, F_SETFL, old_fd1_flags);
+        stdio_in_use = false;
     }
 }
 
@@ -102,6 +105,7 @@ static void qemu_chr_open_stdio(Chardev *chr,
 
     stdio_in_use = true;
     old_fd0_flags = fcntl(0, F_GETFL);
+    old_fd1_flags = fcntl(1, F_GETFL);
     tcgetattr(0, &oldtty);
     if (!g_unix_set_fd_nonblocking(0, true, NULL)) {
         error_setg_errno(errp, errno, "Failed to set FD nonblocking");
-- 
2.39.2

[Stable-9.0.2 26/27] sphinx/qapidoc: Fix to generate doc for explicit, unboxed arguments

[Michael Tokarev]

From: Markus Armbruster <armbru@redhat.com>

When a command's arguments are specified as an explicit type T,
generated documentation points to the members of T.

Example:

    ##
    # @announce-self:
    #
    # Trigger generation of broadcast RARP frames to update network
    [...]
    ##
    { 'command': 'announce-self', 'boxed': true,
      'data' : 'AnnounceParameters'}

generates

    "announce-self" (Command)
    -------------------------

    Trigger generation of broadcast RARP frames to update network
    [...]

    Arguments
    ~~~~~~~~~

    The members of "AnnounceParameters"

Except when the command takes its arguments unboxed , i.e. it doesn't
have 'boxed': true, we generate *nothing*.  A few commands have a
reference in their doc comment to compensate, but most don't.

Example:

    ##
    # @blockdev-snapshot-sync:
    #
    # Takes a synchronous snapshot of a block device.
    #
    # For the arguments, see the documentation of BlockdevSnapshotSync.
    [...]
    ##
    { 'command': 'blockdev-snapshot-sync',
      'data': 'BlockdevSnapshotSync',
      'allow-preconfig': true }

generates

    "blockdev-snapshot-sync" (Command)
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    Takes a synchronous snapshot of a block device.

    For the arguments, see the documentation of BlockdevSnapshotSync.
    [...]

Same for event data.

Fix qapidoc.py to generate the reference regardless of boxing.  Delete
now redundant references in the doc comments.

Fixes: 4078ee5469e5 (docs/sphinx: Add new qapi-doc Sphinx extension)
Cc: qemu-stable@nongnu.org
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20240628112756.794237-1-armbru@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
(cherry picked from commit e389929d19a543ea5b34d02553b355f9f1c03162)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

diff --git a/docs/sphinx/qapidoc.py b/docs/sphinx/qapidoc.py
index 8d428c64b0..8d3518e887 100644
--- a/docs/sphinx/qapidoc.py
+++ b/docs/sphinx/qapidoc.py
@@ -219,15 +219,15 @@ def _nodes_for_enum_values(self, doc):
         section += dlnode
         return [section]
 
-    def _nodes_for_arguments(self, doc, boxed_arg_type):
+    def _nodes_for_arguments(self, doc, arg_type):
         """Return list of doctree nodes for the arguments section"""
-        if boxed_arg_type:
+        if arg_type and not arg_type.is_implicit():
             assert not doc.args
             section = self._make_section('Arguments')
             dlnode = nodes.definition_list()
             dlnode += self._make_dlitem(
                 [nodes.Text('The members of '),
-                 nodes.literal('', boxed_arg_type.name)],
+                 nodes.literal('', arg_type.name)],
                 None)
             section += dlnode
             return [section]
@@ -331,8 +331,7 @@ def visit_command(self, name, info, ifcond, features, arg_type,
                       allow_preconfig, coroutine):
         doc = self._cur_doc
         self._add_doc('Command',
-                      self._nodes_for_arguments(doc,
-                                                arg_type if boxed else None)
+                      self._nodes_for_arguments(doc, arg_type)
                       + self._nodes_for_features(doc)
                       + self._nodes_for_sections(doc)
                       + self._nodes_for_if_section(ifcond))
@@ -340,8 +339,7 @@ def visit_command(self, name, info, ifcond, features, arg_type,
     def visit_event(self, name, info, ifcond, features, arg_type, boxed):
         doc = self._cur_doc
         self._add_doc('Event',
-                      self._nodes_for_arguments(doc,
-                                                arg_type if boxed else None)
+                      self._nodes_for_arguments(doc, arg_type)
                       + self._nodes_for_features(doc)
                       + self._nodes_for_sections(doc)
                       + self._nodes_for_if_section(ifcond))
diff --git a/qapi/block-core.json b/qapi/block-core.json
index 746d1694c2..4b18e01b85 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -1671,8 +1671,6 @@
 #
 # Takes a synchronous snapshot of a block device.
 #
-# For the arguments, see the documentation of BlockdevSnapshotSync.
-#
 # Errors:
 #     - If @device is not a valid block device, DeviceNotFound
 #
@@ -1701,8 +1699,6 @@
 # device, the block device changes to using 'overlay' as its new
 # active image.
 #
-# For the arguments, see the documentation of BlockdevSnapshot.
-#
 # Features:
 #
 # @allow-write-only-overlay: If present, the check whether this
@@ -6061,9 +6057,6 @@
 # string, or a snapshot with name already exists, the operation will
 # fail.
 #
-# For the arguments, see the documentation of
-# BlockdevSnapshotInternal.
-#
 # Errors:
 #     - If @device is not a valid block device, GenericError
 #     - If any snapshot matching @name exists, or @name is empty,
-- 
2.39.2

[Stable-9.0.2 27/27] hw/nvme: fix number of PIDs for FDP RUH update

[Michael Tokarev]

From: Vincent Fu <vincentfu@gmail.com>

The number of PIDs is in the upper 16 bits of cdw10. So we need to
right-shift by 16 bits instead of only a single bit.

Fixes: 73064edfb864 ("hw/nvme: flexible data placement emulation")
Cc: qemu-stable@nongnu.org
Signed-off-by: Vincent Fu <vincent.fu@samsung.com>
Reviewed-by: Klaus Jensen <k.jensen@samsung.com>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
(cherry picked from commit 3936bbdf9a2e9233875f850c7576c79d06add261)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
index 127c3d2383..e89f9f7808 100644
--- a/hw/nvme/ctrl.c
+++ b/hw/nvme/ctrl.c
@@ -4352,7 +4352,7 @@ static uint16_t nvme_io_mgmt_send_ruh_update(NvmeCtrl *n, NvmeRequest *req)
     NvmeNamespace *ns = req->ns;
     uint32_t cdw10 = le32_to_cpu(cmd->cdw10);
     uint16_t ret = NVME_SUCCESS;
-    uint32_t npid = (cdw10 >> 1) + 1;
+    uint32_t npid = (cdw10 >> 16) + 1;
     unsigned int i = 0;
     g_autofree uint16_t *pids = NULL;
     uint32_t maxnpid;
-- 
2.39.2

Re: [Stable-9.0.2 26/27] sphinx/qapidoc: Fix to generate doc for explicit, unboxed arguments

[John Snow]

[-- Attachment #1: Type: text/plain, Size: 5791 bytes --]

On Mon, Jul 15, 2024, 5:34 AM Michael Tokarev <mjt@tls.msk.ru> wrote:

> From: Markus Armbruster <armbru@redhat.com>
>
> When a command's arguments are specified as an explicit type T,
> generated documentation points to the members of T.
>
> Example:
>
>     ##
>     # @announce-self:
>     #
>     # Trigger generation of broadcast RARP frames to update network
>     [...]
>     ##
>     { 'command': 'announce-self', 'boxed': true,
>       'data' : 'AnnounceParameters'}
>
> generates
>
>     "announce-self" (Command)
>     -------------------------
>
>     Trigger generation of broadcast RARP frames to update network
>     [...]
>
>     Arguments
>     ~~~~~~~~~
>
>     The members of "AnnounceParameters"
>
> Except when the command takes its arguments unboxed , i.e. it doesn't
> have 'boxed': true, we generate *nothing*.  A few commands have a
> reference in their doc comment to compensate, but most don't.
>
> Example:
>
>     ##
>     # @blockdev-snapshot-sync:
>     #
>     # Takes a synchronous snapshot of a block device.
>     #
>     # For the arguments, see the documentation of BlockdevSnapshotSync.
>     [...]
>     ##
>     { 'command': 'blockdev-snapshot-sync',
>       'data': 'BlockdevSnapshotSync',
>       'allow-preconfig': true }
>
> generates
>
>     "blockdev-snapshot-sync" (Command)
>     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
>     Takes a synchronous snapshot of a block device.
>
>     For the arguments, see the documentation of BlockdevSnapshotSync.
>     [...]
>
> Same for event data.
>
> Fix qapidoc.py to generate the reference regardless of boxing.  Delete
> now redundant references in the doc comments.
>
> Fixes: 4078ee5469e5 (docs/sphinx: Add new qapi-doc Sphinx extension)
> Cc: qemu-stable@nongnu.org
> Signed-off-by: Markus Armbruster <armbru@redhat.com>
> Message-ID: <20240628112756.794237-1-armbru@redhat.com>
> Reviewed-by: John Snow <jsnow@redhat.com>
> (cherry picked from commit e389929d19a543ea5b34d02553b355f9f1c03162)
> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
>

Just do me a favor and test build the html docs in the stable branch and
verify that they appear to render correctly with a quick visual glance --
we've been poking around a lot in that area.

I don't see any obvious point of conflict in this patch, but I have a
nagging doubt.

As long as they build and they look alright, I'm confident it's fine.


> diff --git a/docs/sphinx/qapidoc.py b/docs/sphinx/qapidoc.py
> index 8d428c64b0..8d3518e887 100644
> --- a/docs/sphinx/qapidoc.py
> +++ b/docs/sphinx/qapidoc.py
> @@ -219,15 +219,15 @@ def _nodes_for_enum_values(self, doc):
>          section += dlnode
>          return [section]
>
> -    def _nodes_for_arguments(self, doc, boxed_arg_type):
> +    def _nodes_for_arguments(self, doc, arg_type):
>          """Return list of doctree nodes for the arguments section"""
> -        if boxed_arg_type:
> +        if arg_type and not arg_type.is_implicit():
>              assert not doc.args
>              section = self._make_section('Arguments')
>              dlnode = nodes.definition_list()
>              dlnode += self._make_dlitem(
>                  [nodes.Text('The members of '),
> -                 nodes.literal('', boxed_arg_type.name)],
> +                 nodes.literal('', arg_type.name)],
>                  None)
>              section += dlnode
>              return [section]
> @@ -331,8 +331,7 @@ def visit_command(self, name, info, ifcond, features,
> arg_type,
>                        allow_preconfig, coroutine):
>          doc = self._cur_doc
>          self._add_doc('Command',
> -                      self._nodes_for_arguments(doc,
> -                                                arg_type if boxed else
> None)
> +                      self._nodes_for_arguments(doc, arg_type)
>                        + self._nodes_for_features(doc)
>                        + self._nodes_for_sections(doc)
>                        + self._nodes_for_if_section(ifcond))
> @@ -340,8 +339,7 @@ def visit_command(self, name, info, ifcond, features,
> arg_type,
>      def visit_event(self, name, info, ifcond, features, arg_type, boxed):
>          doc = self._cur_doc
>          self._add_doc('Event',
> -                      self._nodes_for_arguments(doc,
> -                                                arg_type if boxed else
> None)
> +                      self._nodes_for_arguments(doc, arg_type)
>                        + self._nodes_for_features(doc)
>                        + self._nodes_for_sections(doc)
>                        + self._nodes_for_if_section(ifcond))
> diff --git a/qapi/block-core.json b/qapi/block-core.json
> index 746d1694c2..4b18e01b85 100644
> --- a/qapi/block-core.json
> +++ b/qapi/block-core.json
> @@ -1671,8 +1671,6 @@
>  #
>  # Takes a synchronous snapshot of a block device.
>  #
> -# For the arguments, see the documentation of BlockdevSnapshotSync.
> -#
>  # Errors:
>  #     - If @device is not a valid block device, DeviceNotFound
>  #
> @@ -1701,8 +1699,6 @@
>  # device, the block device changes to using 'overlay' as its new
>  # active image.
>  #
> -# For the arguments, see the documentation of BlockdevSnapshot.
> -#
>  # Features:
>  #
>  # @allow-write-only-overlay: If present, the check whether this
> @@ -6061,9 +6057,6 @@
>  # string, or a snapshot with name already exists, the operation will
>  # fail.
>  #
> -# For the arguments, see the documentation of
> -# BlockdevSnapshotInternal.
> -#
>  # Errors:
>  #     - If @device is not a valid block device, GenericError
>  #     - If any snapshot matching @name exists, or @name is empty,
> --
> 2.39.2
>
>

[-- Attachment #2: Type: text/html, Size: 7965 bytes --]