qemu/qemu.git, branch stable-8.2

Update version for 8.2.10 release

2025-03-26T09:13:28+00:00

Signed-off-by: Michael Tokarev

hw/misc/aspeed_hace: Fix buffer overflow in has_padding function

2025-03-24T20:49:58+00:00

The maximum padding size is either 64 or 128 bytes and should always be smaller than "req_len". If "padding_size" exceeds "req_len", then "req_len - padding_size" underflows due to "uint32_t" data type, leading to a large incorrect value (e.g., `0xFFXXXXXX`). This causes an out-of-bounds memory access, potentially leading to a buffer overflow. Added a check to ensure "padding_size" does not exceed "req_len" before computing "pad_offset". This prevents "req_len - padding_size" from underflowing and avoids accessing invalid memory. Signed-off-by: Jamin Lin Reviewed-by: Cédric Le Goater Fixes: 5cd7d8564a8b563da724b9e6264c967f0a091afa ("aspeed/hace: Support AST2600 HACE ") Link: https://lore.kernel.org/qemu-devel/20250321092623.2097234-3-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater (cherry picked from commit 78877b2e06464f49f777e086845e094ea7bc82ef) Signed-off-by: Michael Tokarev

target/ppc: Fix e200 duplicate SPRs

2025-03-24T05:01:16+00:00

DSRR0/1 registers are in the BookE ISA not e200 specific, so remove the duplicate e200 register definitions. Cc: Roman Kapl Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2768 Fixes: 0e3bf4890906 ("ppc: add DBCR based debugging") Signed-off-by: Nicholas Piggin (cherry picked from commit 73c0c904fc99e2ceecbbded84ec76d40d3f2daae) (Mjt: context fix for v9.0.0-935-g581eea5d656b "target/ppc: Split off common embedded TLB init") Signed-off-by: Michael Tokarev

linux-user/riscv: Fix handling of cpu mask in riscv_hwprobe syscall

2025-03-24T04:49:26+00:00

The third argument of the syscall contains the size of the cpu mask in bytes, not bits. Nor is the size rounded up to a multiple of sizeof(abi_ulong). Cc: qemu-stable@nongnu.org Reported-by: Andreas Schwab Fixes: 9e1c7d982d7 ("linux-user/riscv: Add syscall riscv_hwprobe") Signed-off-by: Richard Henderson Reviewed-by: Alistair Francis Message-ID: <20250308225902.1208237-3-richard.henderson@linaro.org> Signed-off-by: Alistair Francis (cherry picked from commit 1a010d22b7adecf0fb1c069e1e535af1aa51e9cf) Signed-off-by: Michael Tokarev

docs/about/emulation: Fix broken link

2025-03-24T04:44:59+00:00

semihosting link to risc-v changed Signed-off-by: Santiago Monserrat Campanello Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2717 Reviewed-by: Alistair Francis Reviewed-by: Thomas Huth Message-ID: <20250305102632.91376-1-santimonserr@gmail.com> Signed-off-by: Alistair Francis (cherry picked from commit 672cb29d1e811180bf1aeefbcb0936ecd5bd3853) Signed-off-by: Michael Tokarev

vdpa: Allow vDPA to work on big-endian machine

2025-03-22T07:52:51+00:00

Add .set_vnet_le() function that always returns success, assuming that vDPA h/w always implements LE data format. Otherwise, QEMU disables vDPA and outputs the message: "backend does not support LE vnet headers; falling back on userspace virtio" Reviewed-by: Michael S. Tsirkin Acked-by: Eugenio Pérez Signed-off-by: Konstantin Shkolnyy Signed-off-by: Jason Wang (cherry picked from commit b027f55a994af885a7a498a40373a2dcc2d8b15e) Signed-off-by: Michael Tokarev

vdpa: Fix endian bugs in shadow virtqueue

2025-03-22T07:52:51+00:00

VDPA didn't work on a big-endian machine due to missing/incorrect CPU<->LE data format conversions. Signed-off-by: Konstantin Shkolnyy Message-Id: <20250212164923.1971538-1-kshk@linux.ibm.com> Fixes: 10857ec0ad ("vhost: Add VhostShadowVirtqueue") Acked-by: Eugenio Pérez Tested-by: Lei Yang Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin (cherry picked from commit 50e9754149066dc91f58405d3378b589098cb408) Signed-off-by: Michael Tokarev

target/loongarch: Fix vldi inst

2025-03-22T07:52:51+00:00

Refer to the link below for a description of the vldi instructions: https://jia.je/unofficial-loongarch-intrinsics-guide/lsx/misc/#synopsis_88 Fixed errors in vldi instruction implementation. Signed-off-by: Guo Hongyu Tested-by: Xianglai Li Signed-off-by: Xianglai Li Reviewed-by: Bibo Mao Signed-off-by: Bibo Mao (cherry picked from commit 02ce6cea71be4f6774351f5e658d50044c5b53b2) Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2865 Signed-off-by: Michael Tokarev

target/arm: Simplify pstate_sm check in sve_access_check

2025-03-22T07:52:51+00:00

In StreamingMode, fp_access_checked is handled already. We cannot fall through to fp_access_check lest we fall foul of the double-check assertion. Cc: qemu-stable@nongnu.org Fixes: 285b1d5fcef ("target/arm: Handle SME in sve_access_check") Signed-off-by: Richard Henderson Message-id: 20250307190415.982049-3-richard.henderson@linaro.org Reviewed-by: Peter Maydell [PMM: move declaration of 'ret' to top of block] Signed-off-by: Peter Maydell (cherry picked from commit cc7abc35dfa790ba6c20473c03745428c1c626b6) Signed-off-by: Michael Tokarev

target/arm: Make DisasContext.{fp, sve}_access_checked tristate

2025-03-22T07:52:51+00:00

The check for fp_excp_el in assert_fp_access_checked is incorrect. For SME, with StreamingMode enabled, the access is really against the streaming mode vectors, and access to the normal fp registers is allowed to be disabled. C.f. sme_enabled_check. Convert sve_access_checked to match, even though we don't currently check the exception state. Cc: qemu-stable@nongnu.org Fixes: 3d74825f4d6 ("target/arm: Add SME enablement checks") Signed-off-by: Richard Henderson Message-id: 20250307190415.982049-2-richard.henderson@linaro.org Reviewed-by: Peter Maydell Signed-off-by: Peter Maydell (cherry picked from commit 298a04998fa4a6dc977abe9234d98dfcdab98423) Signed-off-by: Michael Tokarev