[Qemu-commits] [qemu/qemu] 6332f3: target/i386: introduce function to query MMU indices

[Alex Bennée]

  Branch: refs/heads/staging-7.2
  Home:   https://github.com/qemu/qemu
  Commit: 6332f3c12f7fc6c01fae1eaa59d661fef280f499
      
https://github.com/qemu/qemu/commit/6332f3c12f7fc6c01fae1eaa59d661fef280f499
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   2024-03-21 (Thu, 21 Mar 2024)

  Changed paths:
    M target/i386/cpu.h
    M target/i386/tcg/sysemu/excp_helper.c

  Log Message:
  -----------
  target/i386: introduce function to query MMU indices

Remove knowledge of specific MMU indexes (other than MMU_NESTED_IDX and
MMU_PHYS_IDX) from mmu_translate().  This will make it possible to split
32-bit and 64-bit MMU indexes.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 5f97afe2543f09160a8d123ab6e2e8c6d98fa9ce)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
(Mjt: context fixup in target/i386/cpu.h due to other changes in that area)


  Commit: ad003650d539b9ad28a3c4f7580b2a7f1dacf8e5
      
https://github.com/qemu/qemu/commit/ad003650d539b9ad28a3c4f7580b2a7f1dacf8e5
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   2024-04-09 (Tue, 09 Apr 2024)

  Changed paths:
    M target/i386/cpu-param.h
    M target/i386/cpu.h
    M target/i386/tcg/sysemu/excp_helper.c

  Log Message:
  -----------
  target/i386: use separate MMU indexes for 32-bit accesses

Accesses from a 32-bit environment (32-bit code segment for instruction
accesses, EFER.LMA==0 for processor accesses) have to mask away the
upper 32 bits of the address.  While a bit wasteful, the easiest way
to do so is to use separate MMU indexes.  These days, QEMU anyway is
compiled with a fixed value for NB_MMU_MODES.  Split MMU_USER_IDX,
MMU_KSMAP_IDX and MMU_KNOSMAP_IDX in two.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 90f641531c782c873a05895f411c05fbbbef3c49)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
(Mjt: move changes for x86_cpu_mmu_index() to cpu_mmu_index() due to missing
 v8.2.0-1030-gace0c5fe5950 "target/i386: Populate CPUClass.mmu_index"
 Increase NB_MMU_MODES from 5 to 8 in target/i386/cpu-param.h due to missing
 v7.2.0-2640-gffd824f3f32d "include/exec: Set default NB_MMU_MODES to 16"
 v7.2.0-2647-g6787318a5d86 "target/i386: Remove NB_MMU_MODES define"
 which relaxed upper limit of MMU index for i386, since this commit starts
 using MMU_NESTED_IDX=7.
 Thanks Zhao Liu and Paolo Bonzini for the analisys and suggestions.
)


  Commit: a6fc9a234b53be19de827ee15d1f3f8854f61a67
      
https://github.com/qemu/qemu/commit/a6fc9a234b53be19de827ee15d1f3f8854f61a67
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   2024-04-09 (Tue, 09 Apr 2024)

  Changed paths:
    M target/i386/cpu.h

  Log Message:
  -----------
  target/i386: fix direction of "32-bit MMU" test

The low bit of MMU indices for x86 TCG indicates whether the processor is
in 32-bit mode and therefore linear addresses have to be masked to 32 bits.
However, the index was computed incorrectly, leading to possible conflicts
in the TLB for any address above 4G.

Analyzed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Fixes: b1661801c18 ("target/i386: Fix physical address truncation", 2024-02-28)
Fixes: 1c15f97b4f1 ("target/i386: Fix physical address truncation" in 
stable-7.2)
Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2206
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 2cc68629a6fc198f4a972698bdd6477f883aedfb)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
(Mjt: move changes for x86_cpu_mmu_index() to cpu_mmu_index() due to missing
 v8.2.0-1030-gace0c5fe59 "target/i386: Populate CPUClass.mmu_index")


  Commit: e9e41446c267da5a2db20ade5748ce92602ff307
      
https://github.com/qemu/qemu/commit/e9e41446c267da5a2db20ade5748ce92602ff307
  Author: Tao Su <tao1.su@linux.intel.com>
  Date:   2024-04-09 (Tue, 09 Apr 2024)

  Changed paths:
    M target/i386/helper.c

  Log Message:
  -----------
  target/i386: Revert monitor_puts() in do_inject_x86_mce()

monitor_puts() doesn't check the monitor pointer, but do_inject_x86_mce()
may have a parameter with NULL monitor pointer. Revert monitor_puts() in
do_inject_x86_mce() to fix, then the fact that we send the same message to
monitor and log is again more obvious.

Fixes: bf0c50d4aa85 (monitor: expose monitor_puts to rest of code)
Reviwed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Tao Su <tao1.su@linux.intel.com>
Message-ID: <20240320083640.523287-1-tao1.su@linux.intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 7fd226b04746f0be0b636de5097f1b42338951a0)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 610db167da14a3a4d464b1aed5c42891da46b1d8
      
https://github.com/qemu/qemu/commit/610db167da14a3a4d464b1aed5c42891da46b1d8
  Author: Song Gao <gaosong@loongson.cn>
  Date:   2024-04-09 (Tue, 09 Apr 2024)

  Changed paths:
    M target/loongarch/cpu.c

  Log Message:
  -----------
  target/loongarch: Fix qemu-system-loongarch64 assert failed with the option 
'-d int'

qemu-system-loongarch64 assert failed with the option '-d int',
the helper_idle() raise an exception EXCP_HLT, but the exception name is 
undefined.

Signed-off-by: Song Gao <gaosong@loongson.cn>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20240321123606.1704900-1-gaosong@loongson.cn>
(cherry picked from commit 1590154ee4376819a8c6ee61e849ebf4a4e7cd02)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
(Mjt: fixup for lack of 2 commits adding new entries into excp_names[]:
 v8.0.0-514-ga3f3db5cda "target/loongarch: Add CHECK_SXE maccro for check LSX 
enable" and
 v8.1.0-801-gb8f1bdf3d1 "target/loongarch: check_vec support check LASX 
instructions")


  Commit: 2e1645ac6ae5039f96e2313a7cec9a0a21dd8b01
      
https://github.com/qemu/qemu/commit/2e1645ac6ae5039f96e2313a7cec9a0a21dd8b01
  Author: Lorenz Brun <lorenz@brun.one>
  Date:   2024-04-09 (Tue, 09 Apr 2024)

  Changed paths:
    M hw/scsi/scsi-generic.c

  Log Message:
  -----------
  hw/scsi/scsi-generic: Fix io_timeout property not applying

The io_timeout property, introduced in c9b6609 (part of 6.0) is
silently overwritten by the hardcoded default value of 30 seconds
(DEFAULT_IO_TIMEOUT) in scsi_generic_realize because that function is
being called after the properties have already been applied.

The property definition already has a default value which is applied
correctly when no value is explicitly set, so we can just remove the
code which overrides the io_timeout completely.

This has been tested by stracing SG_IO operations with the io_timeout
property set and unset and now sets the timeout field in the ioctl
request to the proper value.

Fixes: c9b6609b69facad ("scsi: make io_timeout configurable")
Signed-off-by: Lorenz Brun <lorenz@brun.one>
Message-ID: <20240315145831.2531695-1-lorenz@brun.one>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
(cherry picked from commit 7c7a9f578e4fb1adff7ac8d9acaaaedb87474e76)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 70b0e142e6dc717f512a107e5d052acd50d2c2e1
      
https://github.com/qemu/qemu/commit/70b0e142e6dc717f512a107e5d052acd50d2c2e1
  Author: Yao Xingtao <yaoxt.fnst@fujitsu.com>
  Date:   2024-04-09 (Tue, 09 Apr 2024)

  Changed paths:
    M monitor/misc.c

  Log Message:
  -----------
  monitor/hmp-cmds-target: Append a space in error message in gpa2hva()

In qemu monitor mode, when we use gpa2hva command to print the host
virtual address corresponding to a guest physical address, if the gpa is
not in RAM, the error message is below:

  (qemu) gpa2hva 0x750000000
  Memory at address 0x750000000is not RAM

A space is missed between '0x750000000' and 'is'.

Signed-off-by: Yao Xingtao <yaoxt.fnst@fujitsu.com>
Fixes: e9628441df ("hmp: gpa2hva and gpa2hpa hostaddr command")
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Dr. David Alan Gilbert <dave@treblig.org>
Message-ID: <20240319021610.2423844-1-ruansy.fnst@fujitsu.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
(cherry picked from commit a158c63b3ba120f1656e4dd815d186c623fb5ef6)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
(Mjt: in 7.2. it is in monitor/misc.c, not in monitor/hmp-cmds-target.c)


  Commit: 493b1cc785a13a4e3f7ed7911a07eb4d496c1a09
      
https://github.com/qemu/qemu/commit/493b1cc785a13a4e3f7ed7911a07eb4d496c1a09
  Author: Akihiko Odaki <akihiko.odaki@daynix.com>
  Date:   2024-04-09 (Tue, 09 Apr 2024)

  Changed paths:
    M hw/net/virtio-net.c

  Log Message:
  -----------
  virtio-net: Fix vhost virtqueue notifiers for RSS

virtio_net_guest_notifier_pending() and virtio_net_guest_notifier_mask()
checked VIRTIO_NET_F_MQ to know there are multiple queues, but
VIRTIO_NET_F_RSS also enables multiple queues. Refer to n->multiqueue,
which is set to true either of VIRTIO_NET_F_MQ or VIRTIO_NET_F_RSS is
enabled.

Fixes: 68b0a6395f36 ("virtio-net: align ctrl_vq index for non-mq guest for 
vhost_vdpa")
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
(cherry picked from commit 1c188fc8cbffc5f05cc616cab4e1372fb6e6f11f)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 162c54b7c1982d3a4b53c51d016c8adb941494fc
      
https://github.com/qemu/qemu/commit/162c54b7c1982d3a4b53c51d016c8adb941494fc
  Author: Richard Henderson <richard.henderson@linaro.org>
  Date:   2024-04-09 (Tue, 09 Apr 2024)

  Changed paths:
    M tcg/optimize.c
    M tests/tcg/aarch64/Makefile.target
    A tests/tcg/aarch64/test-2248.c

  Log Message:
  -----------
  tcg/optimize: Fix sign_mask for logical right-shift

The 'sign' computation is attempting to locate the sign bit that has
been repeated, so that we can test if that bit is known zero.  That
computation can be zero if there are no known sign repetitions.

Cc: qemu-stable@nongnu.org
Fixes: 93a967fbb57 ("tcg/optimize: Propagate sign info for shifting")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2248
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
(cherry picked from commit 2911e9b95f3bb03783ae5ca3e2494dc3b44a9161)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
(Mjt: trivial context fixup in tests/tcg/aarch64/Makefile.target)


  Commit: 6fca92c9d14865e2e6b2be9e1a8facabca4b64be
      
https://github.com/qemu/qemu/commit/6fca92c9d14865e2e6b2be9e1a8facabca4b64be
  Author: Richard Henderson <richard.henderson@linaro.org>
  Date:   2024-04-09 (Tue, 09 Apr 2024)

  Changed paths:
    M target/hppa/translate.c

  Log Message:
  -----------
  target/hppa: Clear psw_n for BE on use_nullify_skip path

Along this path we have already skipped the insn to be
nullified, so the subsequent insn should be executed.

Cc: qemu-stable@nongnu.org
Reported-by: Sven Schnelle <svens@stackframe.org>
Tested-by: Sven Schnelle <svens@stackframe.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
(cherry picked from commit 4a3aa11e1fb25c28c24a43fd2835c429b00a463d)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: eebb7fb506d5049bc9ba76a85616635247392b1f
      
https://github.com/qemu/qemu/commit/eebb7fb506d5049bc9ba76a85616635247392b1f
  Author: Michael Tokarev <mjt@tls.msk.ru>
  Date:   2024-04-09 (Tue, 09 Apr 2024)

  Changed paths:
    M .gitlab-ci.d/cirrus.yml

  Log Message:
  -----------
  gitlab-ci/cirrus: switch from 'master' to 'latest'

Commit ab72522797 "gitlab: switch from 'stable' to
'latest' docker container tags" switched most tags
to 'latest' but missed cirrus image.  Fix this now.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2256
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Message-id: 20240401051633.2780456-1-mjt@tls.msk.ru
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
(cherry picked from commit 1d2f2b35bc86b7a13dc3009a3c5031220aa0b7de)


  Commit: 393b7ab067b956e453eebbd194e6fa4bbd7d0b33
      
https://github.com/qemu/qemu/commit/393b7ab067b956e453eebbd194e6fa4bbd7d0b33
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2024-04-09 (Tue, 09 Apr 2024)

  Changed paths:
    M hw/intc/arm_gicv3_cpuif.c

  Log Message:
  -----------
  hw/intc/arm_gicv3: ICC_HPPIR* return SPURIOUS if int group is disabled

If the group of the highest priority pending interrupt is disabled
via ICC_IGRPEN*, the ICC_HPPIR* registers should return
INTID_SPURIOUS, not the interrupt ID.  (See the GIC architecture
specification pseudocode functions ICC_HPPIR1_EL1[] and
HighestPriorityPendingInterrupt().)

Make HPPIR reads honour the group disable, the way we already do
when determining whether to preempt in icc_hppi_can_preempt().

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240328153333.2522667-1-peter.maydell@linaro.org
(cherry picked from commit 44e25fbc1900c99c91a44e532c5bd680bc403459)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 227d9450b557bc5c0487fd365c44de89c5d54fc6
      
https://github.com/qemu/qemu/commit/227d9450b557bc5c0487fd365c44de89c5d54fc6
  Author: Yajun Wu <yajunw@nvidia.com>
  Date:   2024-04-09 (Tue, 09 Apr 2024)

  Changed paths:
    M hw/net/virtio-net.c

  Log Message:
  -----------
  hw/net/virtio-net: fix qemu set used ring flag even vhost started

When vhost-user or vhost-kernel is handling virtio net datapath,
QEMU should not touch used ring.

But with vhost-user socket reconnect scenario, in a very rare case
(has pending kick event). VRING_USED_F_NO_NOTIFY is set by QEMU in
following code path:

        #0  virtio_queue_split_set_notification (vq=0x7ff5f4c920a8, enable=0) 
at ../hw/virtio/virtio.c:511
        #1  0x0000559d6dbf033b in virtio_queue_set_notification 
(vq=0x7ff5f4c920a8, enable=0) at ../hw/virtio/virtio.c:576
        #2  0x0000559d6dbbbdbc in virtio_net_handle_tx_bh (vdev=0x559d703a6aa0, 
vq=0x7ff5f4c920a8) at ../hw/net/virtio-net.c:2801
        #3  0x0000559d6dbf4791 in virtio_queue_notify_vq (vq=0x7ff5f4c920a8) at 
../hw/virtio/virtio.c:2248
        #4  0x0000559d6dbf79da in virtio_queue_host_notifier_read 
(n=0x7ff5f4c9211c) at ../hw/virtio/virtio.c:3525
        #5  0x0000559d6d9a5814 in virtio_bus_cleanup_host_notifier 
(bus=0x559d703a6a20, n=1) at ../hw/virtio/virtio-bus.c:321
        #6  0x0000559d6dbf83c9 in virtio_device_stop_ioeventfd_impl 
(vdev=0x559d703a6aa0) at ../hw/virtio/virtio.c:3774
        #7  0x0000559d6d9a55c8 in virtio_bus_stop_ioeventfd 
(bus=0x559d703a6a20) at ../hw/virtio/virtio-bus.c:259
        #8  0x0000559d6d9a53e8 in virtio_bus_grab_ioeventfd 
(bus=0x559d703a6a20) at ../hw/virtio/virtio-bus.c:199
        #9  0x0000559d6dbf841c in virtio_device_grab_ioeventfd 
(vdev=0x559d703a6aa0) at ../hw/virtio/virtio.c:3783
        #10 0x0000559d6d9bde18 in vhost_dev_enable_notifiers 
(hdev=0x559d707edd70, vdev=0x559d703a6aa0) at ../hw/virtio/vhost.c:1592
        #11 0x0000559d6d89a0b8 in vhost_net_start_one (net=0x559d707edd70, 
dev=0x559d703a6aa0) at ../hw/net/vhost_net.c:266
        #12 0x0000559d6d89a6df in vhost_net_start (dev=0x559d703a6aa0, 
ncs=0x559d7048d890, data_queue_pairs=31, cvq=0) at ../hw/net/vhost_net.c:412
        #13 0x0000559d6dbb5b89 in virtio_net_vhost_status (n=0x559d703a6aa0, 
status=15 '\017') at ../hw/net/virtio-net.c:311
        #14 0x0000559d6dbb5e34 in virtio_net_set_status (vdev=0x559d703a6aa0, 
status=15 '\017') at ../hw/net/virtio-net.c:392
        #15 0x0000559d6dbb60d8 in virtio_net_set_link_status 
(nc=0x559d7048d890) at ../hw/net/virtio-net.c:455
        #16 0x0000559d6da64863 in qmp_set_link (name=0x559d6f0b83d0 "hostnet1", 
up=true, errp=0x7ffdd76569f0) at ../net/net.c:1459
        #17 0x0000559d6da7226e in net_vhost_user_event (opaque=0x559d6f0b83d0, 
event=CHR_EVENT_OPENED) at ../net/vhost-user.c:301
        #18 0x0000559d6ddc7f63 in chr_be_event (s=0x559d6f2ffea0, 
event=CHR_EVENT_OPENED) at ../chardev/char.c:62
        #19 0x0000559d6ddc7fdc in qemu_chr_be_event (s=0x559d6f2ffea0, 
event=CHR_EVENT_OPENED) at ../chardev/char.c:82

This issue causes guest kernel stop kicking device and traffic stop.

Add vhost_started check in virtio_net_handle_tx_bh to fix this wrong
VRING_USED_F_NO_NOTIFY set.

Signed-off-by: Yajun Wu <yajunw@nvidia.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20240402045109.97729-1-yajunw@nvidia.com>
[PMD: Use unlikely()]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
(cherry picked from commit 4c54f5bc8e1d38f15cc35b6a6932d8fbe219c692)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: fd01f5a847b4ffbe1b606f7efe0137b25c106a23
      
https://github.com/qemu/qemu/commit/fd01f5a847b4ffbe1b606f7efe0137b25c106a23
  Author: Wafer <wafer@jaguarmicro.com>
  Date:   2024-04-09 (Tue, 09 Apr 2024)

  Changed paths:
    M hw/virtio/virtio.c

  Log Message:
  -----------
  hw/virtio: Fix packed virtqueue flush used_idx

In the event of writing many chains of descriptors, the device must
write just the id of the last buffer in the descriptor chain, skip
forward the number of descriptors in the chain, and then repeat the
operations for the rest of chains.

Current QEMU code writes all the buffer ids consecutively, and then
skips all the buffers altogether. This is a bug, and can be reproduced
with a VirtIONet device with _F_MRG_RXBUB and without
_F_INDIRECT_DESC:

If a virtio-net device has the VIRTIO_NET_F_MRG_RXBUF feature
but not the VIRTIO_RING_F_INDIRECT_DESC feature,
'VirtIONetQueue->rx_vq' will use the merge feature
to store data in multiple 'elems'.
The 'num_buffers' in the virtio header indicates how many elements are merged.
If the value of 'num_buffers' is greater than 1,
all the merged elements will be filled into the descriptor ring.
The 'idx' of the elements should be the value of 'vq->used_idx' plus 'ndescs'.

Fixes: 86044b24e8 ("virtio: basic packed virtqueue support")
Acked-by: Eugenio Pérez <eperezma@redhat.com>
Signed-off-by: Wafer <wafer@jaguarmicro.com>
Message-Id: <20240407015451.5228-2-wafer@jaguarmicro.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
(cherry picked from commit 2d9a31b3c27311eca1682cb2c076d7a300441960)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


Compare: https://github.com/qemu/qemu/compare/789b1ae5add0...fd01f5a847b4

To unsubscribe from these emails, change your notification settings at 
https://github.com/qemu/qemu/settings/notifications