-
Mon Jun 17 2024 Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-13.el8
- vfio/migration: Enhance VFIO migration state tracing (Avihai Horon)
- vfio/migration: Don't emit STOP_COPY VFIO migration QAPI event twice (Avihai Horon)
- vfio/migration: Emit VFIO migration QAPI event (Avihai Horon)
- qapi/vfio: Add VFIO migration QAPI event (Avihai Horon)
- migration/multifd: solve zero page causing multiple page faults (Yuan Liu) [Orabug: 36727051]
- multifd: Add the ramblock to MultiFDRecvParams (Lukas Straub) [Orabug: 36727051]
- migration: Fix qmp_query_migrate mbps value (Fabiano Rosas) [Orabug: 36727104]
- migration: Allow user to specify available switchover bandwidth (Peter Xu) [Orabug: 35636284]
- migration/dirtyrate: Fix precision losses and g_usleep overshoot (Andrei Gudkov) [Orabug: 36727091]
- Use new created qemu_target_pages_to_MiB() (Juan Quintela) [Orabug: 36727091]
- softmmu: Create qemu_target_pages_to_MiB() (Juan Quintela) [Orabug: 36727091]
- migration/calc-dirty-rate: replaced CRC32 with xxHash (Andrei Gudkov) [Orabug: 36727063]
- migration/multifd: Enable multifd zero page checking by default. (Hao Xiang) [Orabug: 34131170]
- migration/multifd: Implement ram_save_target_page_multifd to handle multifd version of MigrationOps::ram_save_target_page. (Hao Xiang) [Orabug: 34131170]
- migration/multifd: Implement zero page transmission on the multifd thread. (Hao Xiang) [Orabug: 34131170]
- migration/multifd: Add new migration option zero-page-detection. (Hao Xiang) [Orabug: 34131170]
- migration: Make ram_save_target_page() a pointer (Juan Quintela) [Orabug: 34131170]
- migration: Yield bitmap_mutex properly when sending/sleeping (Peter Xu) [Orabug: 34131170]
- migration/multifd: Add a synchronization point for channel creation (Fabiano Rosas) [Orabug: 34131170]
- migration/multifd: Unify multifd and TLS connection paths (Fabiano Rosas) [Orabug: 34131170]
- migration/multifd: Move multifd_send_setup into migration thread (Fabiano Rosas) [Orabug: 34131170]
- migration/multifd: Move multifd_send_setup error handling in to the function (Fabiano Rosas) [Orabug: 34131170]
- migration/multifd: Remove p->running (Fabiano Rosas) [Orabug: 34131170]
- migration/multifd: Optimize sender side to be lockless (Peter Xu) [Orabug: 34131170]
- migration/multifd: Join the TLS thread (Fabiano Rosas) [Orabug: 34131170]
- migration/multifd: Fix MultiFDSendParams.packet_num race (Peter Xu) [Orabug: 34131170]
- migration/multifd: Stick with send/recv on function names (Peter Xu) [Orabug: 34131170]
- migration/multifd: Cleanup multifd_load_cleanup() (Peter Xu) [Orabug: 34131170]
- migration/multifd: Cleanup multifd_save_cleanup() (Peter Xu) [Orabug: 34131170]
- migration/multifd: Rewrite multifd_queue_page() (Peter Xu) [Orabug: 34131170]
- migration/multifd: Change retval of multifd_send_pages() (Peter Xu) [Orabug: 34131170]
- migration/multifd: Change retval of multifd_queue_page() (Peter Xu) [Orabug: 34131170]
- migration/multifd: Split multifd_send_terminate_threads() (Peter Xu) [Orabug: 34131170]
- migration/multifd: Forbid spurious wakeups (Peter Xu) [Orabug: 34131170]
- migration/multifd: Move header prepare/fill into send_prepare() (Peter Xu) [Orabug: 34131170]
- migration/multifd: multifd_send_prepare_header() (Peter Xu) [Orabug: 34131170]
- migration/multifd: Move trace_multifd_send|recv() (Peter Xu) [Orabug: 34131170]
- migration/multifd: Move total_normal_pages accounting (Peter Xu) [Orabug: 34131170]
- migration/multifd: Rename p->num_packets and clean it up (Peter Xu) [Orabug: 34131170]
- migration/multifd: Drop pages->num check in sender thread (Peter Xu) [Orabug: 34131170]
- migration/multifd: Simplify locking in sender thread (Peter Xu) [Orabug: 34131170]
- migration/multifd: Separate SYNC request with normal jobs (Peter Xu) [Orabug: 34131170]
- migration/multifd: Drop MultiFDSendParams.normal[] array (Peter Xu) [Orabug: 34131170]
- migration/multifd: Postpone reset of MultiFDPages_t (Peter Xu) [Orabug: 34131170]
- migration/multifd: Remove MultiFDPages_t::packet_num (Fabiano Rosas) [Orabug: 34131170]
- migration/multifd: Drop MultiFDSendParams.quit, cleanup error paths (Peter Xu) [Orabug: 34131170]
- migration/multifd: multifd_send_kick_main() (Peter Xu) [Orabug: 34131170]
- migration/multifd: Fix leaking of Error in TLS error flow (Avihai Horon) [Orabug: 34131170]
- migration/ram: Merge save_zero_page functions (Fabiano Rosas) [Orabug: 34131170]
- migration/ram: Move xbzrle zero page handling into save_zero_page (Fabiano Rosas) [Orabug: 34131170]
- migration/multifd: Stop setting p->ioc before connecting (Fabiano Rosas) [Orabug: 34131170]
- migration: Centralize BH creation and dispatch (Fabiano Rosas) [Orabug: 34131170]
- migration: Add a wrapper to qemu_bh_schedule (Fabiano Rosas) [Orabug: 34131170]
- migration: Remove transferred atomic counter (Juan Quintela) [Orabug: 35636284]
- migration: Use migration_transferred_bytes() (Juan Quintela) [Orabug: 35636284]
- migration: migration_rate_limit_reset() don't need the QEMUFile (Juan Quintela) [Orabug: 35636284]
- migration: migration_transferred_bytes() don't need the QEMUFile (Juan Quintela) [Orabug: 35636284]
- multifd: reset next_packet_len after sending pages (Elena Ufimtseva) [Orabug: 35636284]
- multifd: fix counters in multifd_send_thread (Elena Ufimtseva) [Orabug: 35636284]
- migration/multifd: Compute transferred bytes correctly (Juan Quintela) [Orabug: 35636284]
- migration: check for rate_limit_max for RATE_LIMIT_DISABLED (Elena Ufimtseva) [Orabug: 35636284]
- migration: Use the number of transferred bytes directly (Juan Quintela) [Orabug: 35636284]
- qemu_file: Use a stat64 for qemu_file_transferred (Juan Quintela) [Orabug: 35636284]
- migration: set file error on subsection loading (Marc-André Lureau) [Orabug: 35636284]
- migration: Receiving a zero page non zero is an error (Juan Quintela) [Orabug: 35636284]
- migration/multifd: Stop checking p->quit in multifd_send_thread (Fabiano Rosas) [Orabug: 35636284]
- migration/multifd: Clarify Error usage in multifd_channel_connect (Fabiano Rosas) [Orabug: 35636284]
- multifd: cleanup the function multifd_channel_connect (Li Zhang) [Orabug: 35636284]
- migration/multifd: Unify multifd_send_thread error paths (Fabiano Rosas) [Orabug: 35636284]
- migration: Non multifd migration don't care about multifd flushes (Juan Quintela) [Orabug: 35636284]
- migration: fix RAMBlock add NULL check (Dmitry Frolov) [Orabug: 35829153]
- migration: We don't need the field rate_limit_used anymore (Juan Quintela) [Orabug: 35636284]
- migration: Use migration_transferred_bytes() to calculate rate_limit (Juan Quintela) [Orabug: 35636284]
- migration: Add a trace for migration_transferred_bytes (Juan Quintela) [Orabug: 35636284]
- migration: Move migration_total_bytes() to migration-stats.c (Juan Quintela) [Orabug: 35636284]
- qemu-file: Remove total from qemu_file_total_transferred_*() (Juan Quintela) [Orabug: 35636284]
- migration: Move rate_limit_max and rate_limit_used to migration_stats (Juan Quintela) [Orabug: 35636284]
- qemu-file: Account for rate_limit usage on qemu_fflush() (Juan Quintela) [Orabug: 35636284]
- migration: Don't use INT64_MAX for unlimited rate (Juan Quintela) [Orabug: 35636284]
- qemu-file: Make rate_limit_used an uint64_t (Juan Quintela) [Orabug: 35636284]
- qemu-file: make qemu_file_[sg]et_rate_limit() use an uint64_t (Juan Quintela) [Orabug: 35636284]
- migration: We set the rate_limit by a second (Juan Quintela) [Orabug: 35829153]
- migration: A rate limit value of 0 is valid (Juan Quintela) [Orabug: 35636284]
- qemu-file: Make ram_control_save_page() use accessors for rate_limit (Juan Quintela) [Orabug: 35636284]
- qemu-file: Make total_transferred an uint64_t (Juan Quintela) [Orabug: 35636284]
- qemu-file: No need to check for shutdown in qemu_file_rate_limit (Juan Quintela) [Orabug: 35636284]
- migration: Document all migration_stats (Juan Quintela) [Orabug: 35636284]
- multifd: We already account for this packet on the multifd thread (Juan Quintela) [Orabug: 35636284]
- migration: Make dirty_bytes_last_sync atomic (Juan Quintela) [Orabug: 35636284]
- migration: Make dirty_pages_rate atomic (Juan Quintela) [Orabug: 35636284]
- stat64: Add stat64_set() operation (Paolo Bonzini) [Orabug: 35636284]
- multifd: Only flush once each full round of memory (Juan Quintela) [Orabug: 35636284]
- migration: Make find_dirty_block() return a single parameter (Juan Quintela) [Orabug: 35636284]
- migration: Simplify ram_find_and_save_block() (Juan Quintela) [Orabug: 35636284]
- multifd: Protect multifd_send_sync_main() calls (Juan Quintela) [Orabug: 35636284]
- multifd: Create property multifd-flush-after-each-section (Juan Quintela) [Orabug: 35636284]
- multifd: Fix the number of channels ready (Juan Quintela) [Orabug: 35636284]
- migration: Rename normal to normal_pages (Juan Quintela) [Orabug: 35636284]
- migration: Rename duplicate to zero_pages (Juan Quintela) [Orabug: 35636284]
- migration: Make dirty_sync_count atomic (Juan Quintela) [Orabug: 35636284]
- migration: Make downtime_bytes atomic (Juan Quintela) [Orabug: 35636284]
- migration: Make precopy_bytes atomic (Juan Quintela) [Orabug: 35636284]
- migration: Make dirty_sync_missed_zero_copy atomic (Juan Quintela) [Orabug: 35636284]
- migration: Make multifd_bytes atomic (Juan Quintela) [Orabug: 35636284]
- migration: Update atomic stats out of the mutex (Juan Quintela) [Orabug: 35636284]
- migration: Merge ram_counters and ram_atomic_counters (Juan Quintela) [Orabug: 35636284]
- migration/multifd: correct multifd_send_thread to trace the flags (Wei Wang) [Orabug: 35636284]
- ram: Document migration ram flags (Juan Quintela) [Orabug: 35636284]
- migration: Calculate ram size once (Juan Quintela) [Orabug: 35636284]
- multifd: Fix a race on reading MultiFDPages_t.block (Zhenzhong Duan) [Orabug: 35636284]
- migration: Use atomic ops properly for page accountings (Peter Xu) [Orabug: 35636284]
- migration: Export ram_release_page() (Juan Quintela) [Orabug: 35636284]
- migration: Export ram_transferred_ram() (Juan Quintela) [Orabug: 35636284]
- multifd: Create page_count fields into both MultiFD{Recv,Send}Params (Juan Quintela) [Orabug: 35636284]
- multifd: Create page_size fields into both MultiFD{Recv,Send}Params (Juan Quintela) [Orabug: 35636284]
- migration: Fix migration_channel_read_peek() error path () (Avihai Horon) [Orabug: 36726827]
- migration/multifd: Remove error_setg() in migration_ioc_process_incoming() (Avihai Horon) [Orabug: 36726827]
- migration: Refactor migration_incoming_setup() (Avihai Horon) [Orabug: 36726827]
- migration: check magic value for deciding the mapping of channels (manish.mishra) [Orabug: 36726827]
- io: Add support for MSG_PEEK for socket channel (manish.mishra) [Orabug: 36726827]
- hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (hilippe Mathieu-Daudé) [Orabug: 36575206] {CVE-2024-3447}
- block: lock AioContext in bdrv_replace_child_noperm() when in non-coroutine context (Mark Kanda) [Orabug: 36514180]
- hw/scsi/scsi-generic: Fix io_timeout property not applying (Lorenz Brun) [Orabug: 36637684]
- target/i386/monitor: synchronize cpu state for lapic info (Dongli Zhang) [Orabug: 36607747]
- qemu_init: increase NOFILE soft limit on POSIX (Fiona Ebner) [Orabug: 36416389]
-
Thu Mar 07 2024 Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-11.el8
- vfio/migration: Add a note about migration rate limiting (Avihai Horon) [Orabug: 36329758]
- vfio/migration: Refactor vfio_save_state() return value (Avihai Horon) [Orabug: 36329758]
- migration: Don't serialize devices in qemu_savevm_state_iterate() (Avihai Horon) [Orabug: 36329758]
- ui/clipboard: add asserts for update and request (Fiona Ebner) [Orabug: 36323175] {CVE-2023-6683}
- ui/clipboard: mark type as not available when there is no data (Fiona Ebner) [Orabug: 36323175] {CVE-2023-6683}
- virtio-net: correctly copy vnet header when flushing TX (Jason Wang) [Orabug: 36154459] {CVE-2023-6693}
- esp: restrict non-DMA transfer length to that of available data (Mark Cave-Ayland) [Orabug: 36322141] {CVE-2024-24474}
- vhost: Perform memory section dirty scans once per iteration (Si-Wei Liu)
- vhost: dirty log should be per backend type (Si-Wei Liu)
- net: Update MemReentrancyGuard for NIC (Akihiko Odaki) [Orabug: 35644197] {CVE-2023-3019}
- net: Provide MemReentrancyGuard * to qemu_new_nic() (Akihiko Odaki) [Orabug: 35644197] {CVE-2023-3019}
- lsi53c895a: disable reentrancy detection for MMIO region, too (Thomas Huth) [Orabug: 33774027] {CVE-2021-3750}
- memory: stricter checks prior to unsetting engaged_in_io (Alexander Bulekov) [Orabug: 33774027] {CVE-2021-3750}
- async: avoid use-after-free on re-entrancy guard (Alexander Bulekov) [Orabug: 33774027] {CVE-2021-3750}
- apic: disable reentrancy detection for apic-msi (Alexander Bulekov) [Orabug: 33774027] {CVE-2021-3750}
- raven: disable reentrancy detection for iomem (Alexander Bulekov) [Orabug: 33774027] {CVE-2021-3750}
- bcm2835_property: disable reentrancy detection for iomem (Alexander Bulekov) [Orabug: 33774027] {CVE-2021-3750}
- lsi53c895a: disable reentrancy detection for script RAM (Alexander Bulekov) [Orabug: 33774027] {CVE-2021-3750}
- hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (Alexander Bulekov) [Orabug: 33774027] {CVE-2021-3750}
- checkpatch: add qemu_bh_new/aio_bh_new checks (Alexander Bulekov) [Orabug: 33774027] {CVE-2021-3750}
- async: Add an optional reentrancy guard to the BH API (Alexander Bulekov) [Orabug: 33774027] {CVE-2021-3750}
- memory: prevent dma-reentracy issues (Alexander Bulekov) [Orabug: 33774027] {CVE-2021-3750}
- hw/acpi: propagate vcpu hotplug after switch to modern interface (Aaron Young)
- migration: Fix use-after-free of migration state object (Fabiano Rosas) [Orabug: 36242218]
- kvm: Fix crash due to access uninitialized kvm_state (Gavin Shan) [Orabug: 36269244]
- migration: Avoid usage of static variable inside tracepoint (Joao Martins)
- migration: Add tracepoints for downtime checkpoints (Peter Xu)
- migration: migration_stop_vm() helper (Peter Xu)
- migration: Add per vmstate downtime tracepoints (Peter Xu)
- migration: Add migration_downtime_start|end() helpers (Peter Xu)
- migration: Set downtime_start even for postcopy (Peter Xu)
- hv-balloon: implement pre-Glib 2.68 compatibility (Maciej S. Szmigiero)
- hw/i386/pc: Support hv-balloon (Maciej S. Szmigiero)
- qapi: Add HV_BALLOON_STATUS_REPORT event and its QMP query command (Maciej S. Szmigiero)
- qapi: Add query-memory-devices support to hv-balloon (Maciej S. Szmigiero)
- Add Hyper-V Dynamic Memory Protocol driver (hv-balloon) hot-add support (Maciej S. Szmigiero)
- Add Hyper-V Dynamic Memory Protocol driver (hv-balloon) base (Maciej S. Szmigiero)
- Add Hyper-V Dynamic Memory Protocol definitions (Maciej S. Szmigiero)
- memory-device: Drop size alignment check (David Hildenbrand)
- memory-device: Support empty memory devices (David Hildenbrand)
- memory,vhost: Allow for marking memory device memory regions unmergeable (David Hildenbrand)
- memory: Clarify mapping requirements for RamDiscardManager (David Hildenbrand)
- memory-device,vhost: Support automatic decision on the number of memslots (David Hildenbrand)
- vhost: Add vhost_get_max_memslots() (David Hildenbrand)
- kvm: Add stub for kvm_get_max_memslots() (David Hildenbrand)
- memory-device,vhost: Support memory devices that dynamically consume memslots (David Hildenbrand)
- memory-device: Track required and actually used memslots in DeviceMemoryState (David Hildenbrand)
- stubs: Rename qmp_memory_device.c to memory_device.c (David Hildenbrand)
- memory-device: Support memory devices with multiple memslots (David Hildenbrand)
- vhost: Return number of free memslots (David Hildenbrand)
- kvm: Return number of free memslots (David Hildenbrand)
- vhost: Remove vhost_backend_can_merge() callback (David Hildenbrand)
- vhost: Rework memslot filtering and fix "used_memslot" tracking (David Hildenbrand)
- virtio-md-pci: New parent type for virtio-mem-pci and virtio-pmem-pci (David Hildenbrand)
- migration/ram: Expose ramblock_is_ignored() as migrate_ram_is_ignored() (David Hildenbrand)
- virtio-mem: Skip most of virtio_mem_unplug_all() without plugged memory (David Hildenbrand)
- softmmu/physmem: Warn with ram_block_discard_range() on MAP_PRIVATE file mapping (David Hildenbrand)
- memory-device: Track used region size in DeviceMemoryState (David Hildenbrand)
- memory-device: Refactor memory_device_pre_plug() (David Hildenbrand)
- hw/i386/pc: Remove PC_MACHINE_DEVMEM_REGION_SIZE (David Hildenbrand)
- hw/i386/acpi-build: Rely on machine->device_memory when building SRAT (David Hildenbrand)
- hw/i386/pc: Use machine_memory_devices_init() (David Hildenbrand)
- hw/loongarch/virt: Use machine_memory_devices_init() (David Hildenbrand)
- hw/ppc/spapr: Use machine_memory_devices_init() (David Hildenbrand)
- hw/arm/virt: Use machine_memory_devices_init() (David Hildenbrand)
- memory-device: Introduce machine_memory_devices_init() (David Hildenbrand)
- memory-device: Unify enabled vs. supported error messages (David Hildenbrand)
- hw/scsi/scsi-disk: Disallow block sizes smaller than 512 [CVE-2023-42467] (Thomas Huth) [Orabug: 35808564] {CVE-2023-42467}
- tests/qtest: ahci-test: add test exposing reset issue with pending callback (Fiona Ebner) [Orabug: 35977245] {CVE-2023-5088}
- hw/ide: reset: cancel async DMA operation before resetting state (Fiona Ebner) [Orabug: 35977245] {CVE-2023-5088}
-
Thu Dec 07 2023 Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-7.el8
- vfio/common: Probe type1 iommu dirty tracking support (Joao Martins) [Orabug: 36024839]
- vfio/common: Allow disabling device dirty page tracking (Joao Martins) [Orabug: 36024839]
-
Wed Oct 18 2023 Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-6.el8
- hw/smbios: Fix core count in type4 (Zhao Liu) [Orabug: 35869694]
- hw/smbios: Fix thread count in type4 (Zhao Liu) [Orabug: 35869694]
- hw/smbios: Fix smbios_smp_sockets caculation (Zhao Liu) [Orabug: 35869694]
- machine: Add helpers to get cores/threads per socket (Zhao Liu) [Orabug: 35869694]
- migration/multifd: Move load_cleanup inside incoming_state_destroy (Leonardo Bras) [Orabug: 35829153]
- migration/multifd: Join all multifd threads in order to avoid leaks (Leonardo Bras) [Orabug: 35829153]
- migration/multifd: Remove unnecessary assignment on multifd_load_cleanup() (Leonardo Bras) [Orabug: 35829153]
- migration/multifd: Change multifd_load_cleanup() signature and usage (Leonardo Bras) [Orabug: 35829153]
- vfio/migration: Block VFIO migration with background snapshot (Avihai Horon)
- vfio/migration: Block VFIO migration with postcopy migration (Avihai Horon)
- migration: Add .save_prepare() handler to struct SaveVMHandlers (Avihai Horon)
- migration: Move more initializations to migrate_init() (Avihai Horon)
- vfio/migration: Fail adding device with enable-migration=on and existing blocker (Avihai Horon)
- migration: Add migration prefix to functions in target.c (Avihai Horon)
- vfio/migration: Allow migration of multiple P2P supporting devices (Avihai Horon)
- vfio/migration: Add P2P support for VFIO migration (Avihai Horon)
- vfio/migration: Refactor PRE_COPY and RUNNING state checks (Joao Martins)
- qdev: Add qdev_add_vm_change_state_handler_full() (Avihai Horon)
- sysemu: Add prepare callback to struct VMChangeStateEntry (Avihai Horon)
- vfio/migration: Move from STOP_COPY to STOP in vfio_save_cleanup() (Avihai Horon)
- hw/vfio: Add number of dirty pages to vfio_get_dirty_bitmap tracepoint (Joao Martins)
- exec/ram_addr: Return number of dirty pages in cpu_physical_memory_set_dirty_lebitmap() (Joao Martins)
- migration: fix populate_vfio_info (Steve Sistare)
- vfio/migration: Revert out of tree P2P support (Joao Martins)
- async: clarify usage of barriers in the polling case (Paolo Bonzini) [Orabug: 35871058]
- async: update documentation of the memory barriers (Paolo Bonzini) [Orabug: 35871058]
- physmem: add missing memory barrier (Paolo Bonzini) [Orabug: 35871058]
- qemu-coroutine-lock: add smp_mb__after_rmw() (Paolo Bonzini) [Orabug: 35871058]
- aio-wait: switch to smp_mb__after_rmw() (Paolo Bonzini) [Orabug: 35871058]
- edu: add smp_mb__after_rmw() (Paolo Bonzini) [Orabug: 35871058]
- qemu-thread-win32: cleanup, fix, document QemuEvent (Paolo Bonzini) [Orabug: 35871058]
- qemu-thread-posix: cleanup, fix, document QemuEvent (Paolo Bonzini) [Orabug: 35871058]
- qatomic: add smp_mb__before/after_rmw() (Paolo Bonzini) [Orabug: 35871058]
- dump: kdump-zlib data pages not dumped with pvtime/aarch64 (Dongli Zhang) [Orabug: 35777876]
- hw/smbios: fix field corruption in type 4 table (Julia Suvorova) [Orabug: 35756216]
- kvm: Atomic memslot updates (David Hildenbrand) [Orabug: 35728782]
- KVM: keep track of running ioctls (Emanuele Giuseppe Esposito) [Orabug: 35728782]
- accel: introduce accelerator blocker API (Emanuele Giuseppe Esposito) [Orabug: 35728782]
-
Fri Aug 18 2023 Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-5.el8
- virtio-crypto: verify src&dst buffer length for sym request (zhenwei pi) [Orabug: 35683774] {CVE-2023-3180}
- io: remove io watch if TLS channel is closed during handshake (Daniel P. Berrangé) [Orabug: 35683826] {CVE-2023-3354}
- ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) (Mauro Matteo Cascella) [Orabug: 35683770] {CVE-2023-3255}
- hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) (Thomas Huth) [Orabug: 35683817] {CVE-2023-0330}
- vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (Ani Sinha) [Orabug: 35649138] {CVE-2023-3301}
- qmp-regdump: use QMP command 'query-cpus-fast' (Mark Kanda)
-
Thu Jul 13 2023 Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-4.el8
- vfio/migration: Allow migration of multiple P2P supporting devices (Avihai Horon)
- vfio/migration: Add P2P support for VFIO migration (Avihai Horon)
- sysemu: Add pre VM state change callback (Avihai Horon)
- vfio/migration: Refactor PRE_COPY and RUNNING state checks (Joao Martins)
- vfio/common: Add an option to relax vIOMMU usage (Joao Martins)
- virtio-rng-pci: fix transitional migration compat for vectors (David Alan Gilbert) [Orabug: 35595177]
- virtio-rng-pci: fix migration compat for vectors (David Alan Gilbert) [Orabug: 35595177]
- vfio: Fix null pointer dereference bug in vfio_bars_finalize() (Avihai Horon)
- vfio/migration: Return bool type for vfio_migration_realize() (Zhenzhong Duan)
- vfio/migration: Remove print of "Migration disabled" (Zhenzhong Duan)
- vfio/migration: Free resources when vfio_migration_realize fails (Zhenzhong Duan)
- vfio/migration: Change vIOMMU blocker from global to per device (Zhenzhong Duan)
- vfio/pci: Disable INTx in vfio_realize error path (Zhenzhong Duan)
- vfio/pci: Free leaked timer in vfio_realize error path (Zhenzhong Duan)
- vfio/pci: Fix a segfault in vfio_realize (Zhenzhong Duan)
- vfio/migration: Make VFIO migration non-experimental (Avihai Horon)
- vfio/migration: Reset bytes_transferred properly (Avihai Horon)
- vfio/pci: Call vfio_prepare_kvm_msi_virq_batch() in MSI retry path (Shameer Kolothum)
- vfio/migration: Add support for switchover ack capability (Avihai Horon)
- vfio/migration: Add VFIO migration pre-copy support (Avihai Horon)
- vfio/migration: Store VFIO migration flags in VFIOMigration (Avihai Horon)
- vfio/migration: Refactor vfio_save_block() to return saved data size (Avihai Horon)
- tests: Add migration switchover ack capability test (Avihai Horon)
- migration: Enable switchover ack capability (Avihai Horon)
- migration: Implement switchover ack logic (Avihai Horon)
- migration: Add switchover ack capability (Avihai Horon)
- target/i386: Add EPYC-Genoa model to support Zen 4 processor series (Babu Moger) [Orabug: 35555649]
- target/i386: Add VNMI and automatic IBRS feature bits (Babu Moger) [Orabug: 35555649]
- target/i386: Add missing feature bits in EPYC-Milan model (Babu Moger) [Orabug: 35555649]
- target/i386: Add feature bits for CPUID_Fn80000021_EAX (Babu Moger) [Orabug: 35555649]
- target/i386: Add a couple of feature bits in 8000_0008_EBX (Babu Moger) [Orabug: 35555649]
- target/i386: Add new EPYC CPU versions with updated cache_info (Michael Roth) [Orabug: 35555649]
- target/i386: allow versioned CPUs to specify new cache_info (Michael Roth) [Orabug: 35555649]
- target/i386/kvm: get and put AMD pmu registers (Dongli Zhang) [Orabug: 35562155]
- Makefile: qemu-bundle is a directory (Juan Quintela)
- 9pfs: prevent opening special files (CVE-2023-2861) (Christian Schoenebeck) [Orabug: 35570017] {CVE-2023-2861}
- pcie: Do not update hotplugged device power in RUN_STATE_INMIGRATE state (Annie Li) [Orabug: 33642532]
- pcie: Do not set power state for some hot-plugged devices (Annie Li) [Orabug: 33642532]
- pc: q35: Bump max_cpus to 1024 (Suravee Suthikulpanit) [Orabug: 35425619]
-
Mon May 15 2023 Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-3.el8
- vfio/migration: Skip log_sync during migration SETUP state (Avihai Horon)
- migration: fix ram_state_pending_exact() (Juan Quintela)
- spec: allow have_tools 0 (Steve Sistare)
- spec: allow no block device modules (Steve Sistare)
- qemu-kvm.spec: fix Linux io_uring support (Mark Kanda)
- hw/intc/ioapic: Update KVM routes before redelivering IRQ, on RTE update (David Woodhouse)
- oslib-posix: fix uninitialized var in wait_mem_prealloc() (Mark Kanda)
- vfio/migration: Rename entry points (Alex Williamson)
- docs/devel: Document VFIO device dirty page tracking (Avihai Horon)
- vfio/migration: Query device dirty page tracking support (Joao Martins)
- vfio/migration: Block migration with vIOMMU (Joao Martins)
- vfio/common: Add device dirty page bitmap sync (Joao Martins)
- vfio/common: Extract code from vfio_get_dirty_bitmap() to new function (Avihai Horon)
- vfio/common: Add device dirty page tracking start/stop (Joao Martins)
- vfio/common: Record DMA mapped IOVA ranges (Joao Martins)
- vfio/common: Add helper to consolidate iova/end calculation (Joao Martins)
- vfio/common: Consolidate skip/invalid section into helper (Joao Martins)
- vfio/common: Use a single tracepoint for skipped sections (Joao Martins)
- vfio/common: Add helper to validate iova/end against hostwin (Joao Martins)
- vfio/common: Add VFIOBitmap and alloc function (Avihai Horon)
- vfio/common: Abort migration if dirty log start/stop/sync fails (Avihai Horon)
- vfio/common: Fix wrong %m usages (Avihai Horon)
- vfio/common: Fix error reporting in vfio_get_dirty_bitmap() (Avihai Horon)
- docs/devel: Align VFIO migration docs to v2 protocol (Avihai Horon)
- vfio: Alphabetize migration section of VFIO trace-events file (Avihai Horon)
- vfio/migration: Remove VFIO migration protocol v1 (Avihai Horon)
- vfio/migration: Implement VFIO migration protocol v2 (Avihai Horon)
- vfio/migration: Rename functions/structs related to v1 protocol (Avihai Horon)
- vfio/migration: Move migration v1 logic to vfio_migration_init() (Avihai Horon)
- vfio/migration: Block multiple devices migration (Avihai Horon)
- vfio/common: Change vfio_devices_all_running_and_saving() logic to equivalent one (Avihai Horon)
- vfio/migration: Allow migration without VFIO IOMMU dirty tracking support (Avihai Horon)
- vfio/migration: Fix NULL pointer dereference bug (Avihai Horon)
- linux-headers: Update to v6.2-rc8 (Avihai Horon)
- migration/qemu-file: Add qemu_file_get_to_fd() (Avihai Horon)
- migration: Rename res_{postcopy,precopy}_only (Juan Quintela)
- migration: Remove unused res_compatible (Juan Quintela)
- migration: In case of postcopy, the memory ends in res_postcopy_only (Juan Quintela)
- migration: I messed state_pending_exact/estimate (Juan Quintela)
- linux-headers: Update to v6.1 (Peter Xu)
- migration: simplify migration_iteration_run() (Juan Quintela)
- migration: Remove unused threshold_size parameter (Juan Quintela)
- migration: Split save_live_pending() into state_pending_* (Juan Quintela)
- migration: No save_live_pending() method uses the QEMUFile parameter (Juan Quintela)
- Revert "virtio-scsi: Send "REPORTED LUNS CHANGED" sense data upon disk hotplug events" (Karl Heubaum) [Orabug: 35161059]
- oslib-posix: initialize backend memory objects in parallel (Mark Kanda) [Orabug: 32555402]
- oslib-posix: refactor memory prealloc threads (Mark Kanda) [Orabug: 32555402]
- qemu-kvm.spec: vhost-user is conditional (Steve Sistare)
- qemu-kvm.spec: libseccomp is conditional (Steve Sistare)
-
Mon Jan 30 2023 Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-1.el8
- vl: Add an -action option to override MCE handling (Mark Kanda)
- hw/arm/virt: build SMBIOS 19 table (Mihai Carabas)
- virtio-net-pci: Don't use "efi-virtio.rom" on AArch64 (Mark Kanda)
- migration: increase listening socket backlog (Elena Ufimtseva)
- virtio: Set PCI subsystem vendor ID to Oracle (Karl Heubaum)
- Update to QEMU 7.2.0 (Karl Heubaum)
-
Tue Sep 13 2022 Karl Heubaum <karl.heubaum@oracle.com> - 6.1.1-4.el8
- display/qxl-render: fix race condition in qxl_cursor (CVE-2021-4207) (Mauro Matteo Cascella) [Orabug: 34591445] {CVE-2021-4207}
- ui/cursor: fix integer overflow in cursor_alloc (CVE-2021-4206) (Mauro Matteo Cascella) [Orabug: 34591281] {CVE-2021-4206}
- scsi/lsi53c895a: really fix use-after-free in lsi_do_msgout (CVE-2022-0216) (Mauro Matteo Cascella) [Orabug: 34590706] {CVE-2022-0216}
- scsi/lsi53c895a: fix use-after-free in lsi_do_msgout (CVE-2022-0216) (Mauro Matteo Cascella) [Orabug: 34590706] {CVE-2022-0216}
- tests/qtest: Add fuzz-lsi53c895a-test (Philippe Mathieu-Daude) [Orabug: 34590706] {CVE-2022-0216}
- hw/scsi/lsi53c895a: Do not abort when DMA requested and no data queued (Philippe Mathieu-Daude) [Orabug: 34590706] {CVE-2022-0216}
- virtio-net: fix map leaking on error during receive (Jason Wang) [Orabug: 34538375] {CVE-2022-26353}
- vfio: defer to commit kvm irq routing when enable msi/msix (Mike Longpeng) [Orabug: 34528963]
- Revert "vfio: Avoid disabling and enabling vectors repeatedly in VFIO migration" (Mike Longpeng) [Orabug: 34528963]
- vfio: simplify the failure path in vfio_msi_enable (Mike Longpeng) [Orabug: 34528963]
- vfio: move re-enabling INTX out of the common helper (Mike Longpeng) [Orabug: 34528963]
- vfio: simplify the conditional statements in vfio_msi_enable (Mike Longpeng) [Orabug: 34528963]
- kvm/msi: do explicit commit when adding msi routes (Mike Longpeng) [Orabug: 34528963]
- kvm-irqchip: introduce new API to support route change (Mike Longpeng) [Orabug: 34528963]
- event_notifier: handle initialization failure better (Maxim Levitsky) [Orabug: 34528963]
- virtio-net: don't handle mq request in userspace handler for vhost-vdpa (Si-Wei Liu)
- vhost-vdpa: change name and polarity for vhost_vdpa_one_time_request() (Si-Wei Liu)
- vhost-vdpa: backend feature should set only once (Si-Wei Liu)
- vhost-net: fix improper cleanup in vhost_net_start (Si-Wei Liu)
- vhost-vdpa: fix improper cleanup in net_init_vhost_vdpa (Si-Wei Liu)
- virtio-net: align ctrl_vq index for non-mq guest for vhost_vdpa (Si-Wei Liu)
- virtio-net: setup vhost_dev and notifiers for cvq only when feature is negotiated (Si-Wei Liu)
- virtio: fix the condition for iommu_platform not supported (Halil Pasic)
- vdpa: Make ncs autofree (Eugenio Perez)
- vhost-vdpa: make notifiers _init()/_uninit() symmetric (Laurent Vivier)
- hw/virtio: vdpa: Fix leak of host-notifier memory-region (Laurent Vivier)
- vhost-vdpa: stick to -errno error return convention (Roman Kagan)
- vdpa: Add dummy receive callback (Eugenio Perez)
- vdpa: Check for existence of opts.vhostdev (Eugenio Perez)
- vdpa: Replace qemu_open_old by qemu_open at (Eugenio Perez)
- vhost: Fix last vq queue index of devices with no cvq (Eugenio Perez)
- vhost: Rename last_index to vq_index_end (Eugenio Perez)
- net/vhost-vdpa: fix memory leak in vhost_vdpa_get_max_queue_pairs() (Stefano Garzarella)
- vhost-vdpa: Set discarding of RAM broken when initializing the backend (David Hildenbrand)
- vhost-vdpa: multiqueue support (Jason Wang)
- virtio-net: vhost control virtqueue support (Jason Wang)
- vhost: record the last virtqueue index for the virtio device (Jason Wang)
- virtio-net: use "queue_pairs" instead of "queues" when possible (Jason Wang)
- vhost-net: control virtqueue support (Jason Wang)
- net: introduce control client (Jason Wang)
- vhost-vdpa: let net_vhost_vdpa_init() returns NetClientState * (Jason Wang)
- vhost-vdpa: prepare for the multiqueue support (Jason Wang)
- vhost-vdpa: classify one time request (Jason Wang)
- vhost-vdpa: open device fd in net_init_vhost_vdpa() (Jason Wang)
- vdpa: Check for iova range at mappings changes (Eugenio Perez)
- vdpa: Add vhost_vdpa_section_end (Eugenio Perez)
- net/vhost-vdpa: Fix device compatibility check (Kevin Wolf)
- net/vhost-user: Fix device compatibility check (Kevin Wolf)
- net: Introduce NetClientInfo.check_peer_type() (Kevin Wolf)
- memory: Name all the memory listeners (Peter Xu)
- vhost-vdpa: remove the unncessary queue_index assignment (Jason Wang)
- vhost-vdpa: fix the wrong assertion in vhost_vdpa_init() (Jason Wang)
- vhost-vdpa: tweak the error label in vhost_vdpa_add() (Jason Wang)
- vhost-vdpa: fix leaking of vhost_net in vhost_vdpa_add() (Jason Wang)
- vhost-vdpa: don't cleanup twice in vhost_vdpa_add() (Jason Wang)
- vhost-vdpa: remove the unnecessary check in vhost_vdpa_add() (Jason Wang)
- vhost_net: do not assume nvqs is always 2 (Jason Wang)
- vhost: use unsigned int for nvqs (Jason Wang)
- vhost_net: remove the meaningless assignment in vhost_net_start_one() (Jason Wang)
- vhost-vdpa: correctly return err in vhost_vdpa_set_backend_cap() (Jason Wang)
- vhost-vdpa: remove unused variable "acked_features" (Jason Wang)
- vhost: correctly detect the enabling IOMMU (Jason Wang)
- virtio-pci: implement iommu_enabled() (Jason Wang)
- virtio-bus: introduce iommu_enabled() (Jason Wang)
- hw/virtio: Fix leak of host-notifier memory-region (Yajun Wu)
- vhost-vdpa: Do not send empty IOTLB update batches (Eugenio Perez)
- target/i386/kvm: Fix disabling MPX on "-cpu host" with MPX-capable host (Maciej S. Szmigiero) [Orabug: 33528615]
-
Fri Apr 08 2022 Karl Heubaum <karl.heubaum@oracle.com> - 6.1.1-3.el8
- acpi: pcihp: pcie: set power on cap on parent slot (Igor Mammedov) [Orabug: 33984018] [Orabug: 33995665]
- pcie: expire pending delete (Gerd Hoffmann) [Orabug: 33984018] [Orabug: 33995665]
- pcie: fast unplug when slot power is off (Gerd Hoffmann) [Orabug: 33984018] [Orabug: 33995665]
- pcie: factor out pcie_cap_slot_unplug() (Gerd Hoffmann) [Orabug: 33984018] [Orabug: 33995665]
- pcie: add power indicator blink check (Gerd Hoffmann) [Orabug: 33984018] [Orabug: 33995665]
- pcie: implement slot power control for pcie root ports (Gerd Hoffmann) [Orabug: 33984018] [Orabug: 33995665]
- pci: implement power state (Gerd Hoffmann) [Orabug: 33984018] [Orabug: 33995665]
- tests: bios-tables-test update expected blobs (Igor Mammedov) [Orabug: 33984018] [Orabug: 33995665]
- hw/i386/acpi-build: Deny control on PCIe Native Hot-plug in _OSC (Julia Suvorova) [Orabug: 33984018] [Orabug: 33995665]
- bios-tables-test: Allow changes in DSDT ACPI tables (Julia Suvorova) [Orabug: 33984018] [Orabug: 33995665]
- hw/acpi/ich9: Add compat prop to keep HPC bit set for 6.1 machine type (Julia Suvorova) [Orabug: 33984018] [Orabug: 33995665]