[ANNOUNCE] QEMU 4.0.1 Stable released

[Michael Roth]

Hi everyone,

I am pleased to announce that the QEMU v4.0.1 stable release is now
available:

You can grab the tarball from our download page here:

  https://www.qemu.org/download/#source

v4.0.1 is now tagged in the official qemu.git repository,
and the stable-4.0 branch has been updated accordingly:

  https://git.qemu.org/?p=qemu.git;a=shortlog;h=refs/heads/stable-4.0

This update contains security fixes for CVE-2019-12068 (LSI SCSI emulation)
and CVE-2019-14378/CVE-2019-15890 (slirp), as well as a broad range of
general fixes for various subsystems and machine types.

Also note that this update introduces a new default machine type for Q35
guests, pc-q35-4.0.1, which should be used in favor of pc-q35-4.0 for
any configurations involving VFIO passthrough. See commit 92fa1b1a28 for
more details.

Please see the changelog for additional details and update accordingly.

Thank you to everyone involved!

CHANGELOG:

23967e5b2a: Update version for 4.0.1 release (Michael Roth)
a678cd4d30: xen-bus: check whether the frontend is active during device 
reset... (Paul Durrant)
6341bef468: virtio-blk: Cancel the pending BH when the dataplane is reset 
(Philippe Mathieu-Daudé)
35d6458d6a: migration: Fix use-after-free during process exit (Yury Kotov)
306ecc0d24: hw/nvram/fw_cfg: Store 'reboot-timeout' as little endian (Li Qiang)
1e821a0abc: hw/display/xlnx_dp: Avoid crash when reading empty RX FIFO 
(Philippe Mathieu-Daudé)
96389e9061: hw/ssi/mss-spi: Avoid crash when reading empty RX FIFO (Philippe 
Mathieu-Daudé)
535b8d00c1: nvme: Set number of queues later in nvme_init() (Michal Privoznik)
a81a7fc22e: pc-dimm: fix crash when invalid slot number is used (Igor Mammedov)
b65e78320b: scsi: lsi: exit infinite loop while executing script 
(CVE-2019-12068) (Paolo Bonzini)
4f1c6cb2f9: hw/core/loader: Fix possible crash in rom_copy() (Thomas Huth)
a8f24b6bdf: s390: PCI: fix IOMMU region init (Matthew Rosato)
b27192be13: slirp: ip_reass: Fix use after free (Michael Roth)
c2e03e2aa4: slirp: Fix heap overflow in ip_reass on big packet input (Michael 
Roth)
4e5fe75422: curl: Check curl_multi_add_handle()'s return code (Max Reitz)
6739c97bde: curl: Handle success in multi_check_completion (Max Reitz)
deea66dc61: curl: Report only ready sockets (Max Reitz)
076796fd39: curl: Pass CURLSocket to curl_multi_do() (Max Reitz)
2aba40a2c8: curl: Check completion in curl_multi_do() (Max Reitz)
06b178eb61: curl: Keep *socket until the end of curl_sock_cb() (Max Reitz)
c4134c9c46: curl: Keep pointer to the CURLState in CURLSocket (Max Reitz)
b9405afb09: blockjob: update nodes head while removing all bdrv (Sergio Lopez)
6cb3e9e4f1: block/nfs: tear down aio before nfs_close (Peter Lieven)
c24d971c13: block/create: Do not abort if a block driver is not available 
(Philippe Mathieu-Daudé)
ce9c8f6767: libvhost-user: fix SLAVE_SEND_FD handling (Johannes Berg)
e40124c487: iotests: Test blockdev-create for vpc (Max Reitz)
491bf15671: iotests: Restrict nbd Python tests to nbd (Max Reitz)
f949655dd3: iotests: Restrict file Python tests to file (Max Reitz)
89e4faa9ca: iotests: Add supported protocols to execute_test() (Max Reitz)
43143d5d91: vpc: Return 0 from vpc_co_create() on success (Max Reitz)
88a2ea5a48: iotests: add testing shim for script-style python tests (John Snow)
83f9b84c8b: pr-manager: Fix invalid g_free() crash bug (Markus Armbruster)
434a15214f: xen-bus: Fix backend state transition on device reset (Anthony 
PERARD)
0570d468b7: target/arm: Don't abort on M-profile exception return in linux-user 
mode (Peter Maydell)
53c641048e: dma-helpers: ensure AIO callback is invoked after cancellation 
(Paolo Bonzini)
cb7630af20: qcow2: Fix the calculation of the maximum L2 cache size (Alberto 
Garcia)
107018c4fd: Revert "ide/ahci: Check for -ECANCELED in aio callbacks" (John Snow)
7d4b467790: block/backup: disable copy_range for compressed backup (Vladimir 
Sementsov-Ogievskiy)
5a35dbf228: iotests: Test unaligned blocking mirror write (Max Reitz)
d65d02614b: mirror: Only mirror granularity-aligned chunks (Max Reitz)
f69d8f2347: iotests: Test incremental backup after truncation (Max Reitz)
fc5c701636: util/hbitmap: update orig_size on truncate (Vladimir 
Sementsov-Ogievskiy)
c430d7684e: iotests: Test backup job with two guest writes (Max Reitz)
70353442db: backup: Copy only dirty areas (Max Reitz)
872b7b8ef9: block/backup: refactor: split out backup_calculate_cluster_size 
(Vladimir Sementsov-Ogievskiy)
54d45c8251: block/backup: unify different modes code path (Vladimir 
Sementsov-Ogievskiy)
87851171b4: block/backup: refactor and tolerate unallocated cluster skipping 
(Vladimir Sementsov-Ogievskiy)
3f6c00eb61: block/backup: move to copy_bitmap with granularity (Vladimir 
Sementsov-Ogievskiy)
0b55b27908: block/backup: simplify backup_incremental_init_copy_bitmap 
(Vladimir Sementsov-Ogievskiy)
6210ff6aa2: tpm_emulator: Translate TPM error codes to strings (Stefan Berger)
0647727e47: tpm: Exit in reset when backend indicates failure (Stefan Berger)
d7e9b19f0b: i386/acpi: fix gint overflow in crs_range_compare (Evgeny Yakovlev)
c4ac494578: virtio-balloon: free pbp more aggressively (Michael S. Tsirkin)
f18bce29e1: virtio-balloon: don't track subpages for the PBP (David Hildenbrand)
8e20acad63: virtio-balloon: Use temporary PBP only (David Hildenbrand)
d0444b1ee3: virtio-balloon: Rework pbp tracking data (David Hildenbrand)
b50aab6b83: virtio-balloon: Better names for offset variables in 
inflate/deflate code (David Hildenbrand)
2c743c8522: virtio-balloon: Simplify deflate with pbp (David Hildenbrand)
04e35fe3c4: virtio-balloon: Fix QEMU crashes on pagesize > BALLOON_PAGE_SIZE 
(David Hildenbrand)
912440beb5: virtio-balloon: Fix wrong sign extension of PFNs (David Hildenbrand)
eeb25956e7: i386/acpi: show PCI Express bus on pxb-pcie expanders (Evgeny 
Yakovlev)
d25b37247d: ioapic: kvm: Skip route updates for masked pins (Jan Kiszka)
5ad70231d3: hw/ssi/xilinx_spips: Avoid out-of-bound access to lqspi_buf[] 
(Philippe Mathieu-Daudé)
804a0ae6c0: hw/ssi/xilinx_spips: Avoid AXI writes to the LQSPI linear memory 
(Philippe Mathieu-Daudé)
255325da13: hw/ssi/xilinx_spips: Convert lqspi_read() to read_with_attrs 
(Philippe Mathieu-Daudé)
e11cd43f24: docs/bitmaps: use QMP lexer instead of json (John Snow)
22a03c48e7: sphinx: add qmp_lexer (John Snow)
e653d5ed18: docs/interop/bitmaps.rst: Fix typos (John Snow)
a6fe4a3aa8: virtio-balloon: fix QEMU 4.0 config size migration incompatibility 
(Stefan Hajnoczi)
e86e620656: usbredir: fix buffer-overflow on vmload (Marc-André Lureau)
32e8ac8a28: virtio-pci: fix missing device properties (Marc-André Lureau)
8da804f4f9: docs: recommend use of md-clear feature on all Intel CPUs (Daniel 
P. Berrangé)
7427060f98: target/i386: define md-clear bit (Paolo Bonzini)
41e1564fb5: target/i386: add MDS-NO feature (Paolo Bonzini)
8e29c657ca: vl: Fix -drive / -blockdev persistent reservation management 
(Markus Armbruster)
92fa1b1a28: q35: Revert to kernel irqchip (Alex Williamson)
75f83e7c4a: target/ppc: Fix lxvw4x, lxvh8x and lxvb16x (Anton Blanchard)
b6159fc9a6: target/ppc: Fix vsum2sws (Anton Blanchard)
da3bd13802: target/ppc: Fix xxbrq, xxbrw (Anton Blanchard)
fd72de9047: target/ppc: Fix xvxsigdp (Anton Blanchard)
14c9bbab09: target/ppc: Fix xvabs[sd]p, xvnabs[sd]p, xvneg[sd]p, xvcpsgn[sd]p 
(Anton Blanchard)
1cf90f8a97: vhost: fix vhost_log size overflow during migration (Li Hangjing)
3a87d07722: migration/dirty-bitmaps: change bitmap enumeration method (John 
Snow)
07cc0a207f: iotests: add iotest 256 for testing blockdev-backup across iothread 
contexts (John Snow)
32097f14fc: iotests.py: rewrite run_job to be pickier (John Snow)
2ab69df8db: iotests.py: Fix VM.run_job (Max Reitz)
c7b4a73541: QEMUMachine: add events_wait method (John Snow)
94a14e6f2a: iotests.py: do not use infinite waits (John Snow)
7415a83e9b: iotests: Test commit job start with concurrent I/O (Kevin Wolf)
627fadfa1c: block: Drain source node in bdrv_replace_node() (Kevin Wolf)
2429dc4eea: blockdev-backup: don't check aio_context too early (John Snow)
f8d98e2b6d: s390x/cpumodel: ignore csske for expansion (Christian Borntraeger)
d8328a3ca5: iotests: Test unaligned raw images with O_DIRECT (Max Reitz)
241d89b760: block/file-posix: Unaligned O_DIRECT block-status (Max Reitz)
665218cc08: usb-tablet: fix serial compat property (Gerd Hoffmann)
a68ab7c88f: kbd-state: fix autorepeat handling (Gerd Hoffmann)
ffabb55ec2: spapr/xive: fix EQ page addresses above 64GB (Cédric Le Goater)
2974d63658: docs/interop/bitmaps: rewrite and modernize doc (John Snow)
da436b77d8: Makefile: add nit-picky mode to sphinx-build (John Snow)
48025d942e: cutils: Fix size_to_str() on 32-bit platforms (Eric Blake)
626a95f4aa: block: Fix AioContext switch for bs->drv == NULL (Kevin Wolf)
774f013111: qcow2: Fix qcow2_make_empty() with external data file (Kevin Wolf)
173e30de4c: megasas: fix mapped frame size (Peter Lieven)
4382e8da22: qcow2: Fix full preallocation with external data file (Kevin Wolf)
e628c14be4: qcow2: Add errp to preallocate_co() (Kevin Wolf)
5669ef1e6c: qcow2: Avoid COW during metadata preallocation (Kevin Wolf)