qemu-commits
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Qemu-commits] [qemu/qemu] f68a36: target/mips: Fix MSA BZ/BNZ opcodes d


From: Marc-Andre Lureau
Subject: [Qemu-commits] [qemu/qemu] f68a36: target/mips: Fix MSA BZ/BNZ opcodes displacement
Date: Sun, 19 Nov 2023 10:19:48 -0800

  Branch: refs/heads/staging-8.1
  Home:   https://github.com/qemu/qemu
  Commit: f68a36b7c44097e82b5bd47bfe3a70d61031654b
      
https://github.com/qemu/qemu/commit/f68a36b7c44097e82b5bd47bfe3a70d61031654b
  Author: Philippe Mathieu-Daudé <philmd@linaro.org>
  Date:   2023-11-19 (Sun, 19 Nov 2023)

  Changed paths:
    M target/mips/tcg/msa.decode

  Log Message:
  -----------
  target/mips: Fix MSA BZ/BNZ opcodes displacement

The PC offset is *signed*.

Cc: qemu-stable@nongnu.org
Reported-by: Sergey Evlashev <vectorchiefrocks@gmail.com>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1624
Fixes: c7a9ef7517 ("target/mips: Introduce decode tree bindings for MSA ASE")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230914085807.12241-1-philmd@linaro.org>
(cherry picked from commit 04591b3ddd9a96b9298a1dd437a6464ab55e62ee)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: f15258b1963816d8a51538007abd172ae2a1f4bf
      
https://github.com/qemu/qemu/commit/f15258b1963816d8a51538007abd172ae2a1f4bf
  Author: Philippe Mathieu-Daudé <philmd@linaro.org>
  Date:   2023-11-19 (Sun, 19 Nov 2023)

  Changed paths:
    M target/mips/tcg/tx79.decode

  Log Message:
  -----------
  target/mips: Fix TX79 LQ/SQ opcodes

The base register address offset is *signed*.

Cc: qemu-stable@nongnu.org
Fixes: aaaa82a9f9 ("target/mips/tx79: Introduce LQ opcode (Load Quadword)")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230914090447.12557-1-philmd@linaro.org>
(cherry picked from commit 18f86aecd6a1bea0f78af14587a684ad966d8d3a)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 60f7b60429da8b3a53cac46f4d7ff1cc21f186d8
      
https://github.com/qemu/qemu/commit/60f7b60429da8b3a53cac46f4d7ff1cc21f186d8
  Author: Fiona Ebner <f.ebner@proxmox.com>
  Date:   2023-11-19 (Sun, 19 Nov 2023)

  Changed paths:
    M hw/ide/core.c

  Log Message:
  -----------
  hw/ide: reset: cancel async DMA operation before resetting state

If there is a pending DMA operation during ide_bus_reset(), the fact
that the IDEState is already reset before the operation is canceled
can be problematic. In particular, ide_dma_cb() might be called and
then use the reset IDEState which contains the signature after the
reset. When used to construct the IO operation this leads to
ide_get_sector() returning 0 and nsector being 1. This is particularly
bad, because a write command will thus destroy the first sector which
often contains a partition table or similar.

Traces showing the unsolicited write happening with IDEState
0x5595af6949d0 being used after reset:

> ahci_port_write ahci(0x5595af6923f0)[0]: port write [reg:PxSCTL] @ 0x2c: 
> 0x00000300
> ahci_reset_port ahci(0x5595af6923f0)[0]: reset port
> ide_reset IDEstate 0x5595af6949d0
> ide_reset IDEstate 0x5595af694da8
> ide_bus_reset_aio aio_cancel
> dma_aio_cancel dbs=0x7f64600089a0
> dma_blk_cb dbs=0x7f64600089a0 ret=0
> dma_complete dbs=0x7f64600089a0 ret=0 cb=0x5595acd40b30
> ahci_populate_sglist ahci(0x5595af6923f0)[0]
> ahci_dma_prepare_buf ahci(0x5595af6923f0)[0]: prepare buf limit=512 
> prepared=512
> ide_dma_cb IDEState 0x5595af6949d0; sector_num=0 n=1 cmd=DMA WRITE
> dma_blk_io dbs=0x7f6420802010 bs=0x5595ae2c6c30 offset=0 to_dev=1
> dma_blk_cb dbs=0x7f6420802010 ret=0

> (gdb) p *qiov
> $11 = {iov = 0x7f647c76d840, niov = 1, {{nalloc = 1, local_iov = {iov_base = 
> 0x0,
>       iov_len = 512}}, {__pad = 
> "\001\000\000\000\000\000\000\000\000\000\000",
>       size = 512}}}
> (gdb) bt
> #0  blk_aio_pwritev (blk=0x5595ae2c6c30, offset=0, qiov=0x7f6420802070, 
> flags=0,
>     cb=0x5595ace6f0b0 <dma_blk_cb>, opaque=0x7f6420802010)
>     at ../block/block-backend.c:1682
> #1  0x00005595ace6f185 in dma_blk_cb (opaque=0x7f6420802010, ret=<optimized 
> out>)
>     at ../softmmu/dma-helpers.c:179
> #2  0x00005595ace6f778 in dma_blk_io (ctx=0x5595ae0609f0,
>     sg=sg@entry=0x5595af694d00, offset=offset@entry=0, align=align@entry=512,
>     io_func=io_func@entry=0x5595ace6ee30 <dma_blk_write_io_func>,
>     io_func_opaque=io_func_opaque@entry=0x5595ae2c6c30,
>     cb=0x5595acd40b30 <ide_dma_cb>, opaque=0x5595af6949d0,
>     dir=DMA_DIRECTION_TO_DEVICE) at ../softmmu/dma-helpers.c:244
> #3  0x00005595ace6f90a in dma_blk_write (blk=0x5595ae2c6c30,
>     sg=sg@entry=0x5595af694d00, offset=offset@entry=0, align=align@entry=512,
>     cb=cb@entry=0x5595acd40b30 <ide_dma_cb>, 
> opaque=opaque@entry=0x5595af6949d0)
>     at ../softmmu/dma-helpers.c:280
> #4  0x00005595acd40e18 in ide_dma_cb (opaque=0x5595af6949d0, ret=<optimized 
> out>)
>     at ../hw/ide/core.c:953
> #5  0x00005595ace6f319 in dma_complete (ret=0, dbs=0x7f64600089a0)
>     at ../softmmu/dma-helpers.c:107
> #6  dma_blk_cb (opaque=0x7f64600089a0, ret=0) at ../softmmu/dma-helpers.c:127
> #7  0x00005595ad12227d in blk_aio_complete (acb=0x7f6460005b10)
>     at ../block/block-backend.c:1527
> #8  blk_aio_complete (acb=0x7f6460005b10) at ../block/block-backend.c:1524
> #9  blk_aio_write_entry (opaque=0x7f6460005b10) at 
> ../block/block-backend.c:1594
> #10 0x00005595ad258cfb in coroutine_trampoline (i0=<optimized out>,
>     i1=<optimized out>) at ../util/coroutine-ucontext.c:177

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: simon.rowe@nutanix.com
Message-ID: <20230906130922.142845-1-f.ebner@proxmox.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
(cherry picked from commit 7d7512019fc40c577e2bdd61f114f31a9eb84a8e)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 07c2a9c0fa1cff5fe9da15977bb0118ffc1b2aae
      
https://github.com/qemu/qemu/commit/07c2a9c0fa1cff5fe9da15977bb0118ffc1b2aae
  Author: Fiona Ebner <f.ebner@proxmox.com>
  Date:   2023-11-19 (Sun, 19 Nov 2023)

  Changed paths:
    M tests/qtest/ahci-test.c

  Log Message:
  -----------
  tests/qtest: ahci-test: add test exposing reset issue with pending callback

Before commit "hw/ide: reset: cancel async DMA operation before
resetting state", this test would fail, because a reset with a
pending write operation would lead to an unsolicited write to the
first sector of the disk.

The test writes a pattern to the beginning of the disk and verifies
that it is still intact after a reset with a pending operation. It
also checks that the pending operation actually completes correctly.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20230906130922.142845-2-f.ebner@proxmox.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
(cherry picked from commit cc610857bbd3551f4b86ae2299336b5d9aa0db2b)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 88b778e4c2ef66d5faa1cc607dc6cbb996ca23e0
      
https://github.com/qemu/qemu/commit/88b778e4c2ef66d5faa1cc607dc6cbb996ca23e0
  Author: Ilya Leoshkevich <iii@linux.ibm.com>
  Date:   2023-11-19 (Sun, 19 Nov 2023)

  Changed paths:
    M target/s390x/tcg/translate.c

  Log Message:
  -----------
  target/s390x: Fix CLC corrupting cc_src

CLC updates cc_src before accessing the second operand; if the latter
is inaccessible, the former ends up containing a bogus value.

Fix by reading cc_src into a temporary first.

Fixes: 4f7403d52b1c ("target-s390: Convert CLC")
Closes: https://gitlab.com/qemu-project/qemu/-/issues/1865
Cc: qemu-stable@nongnu.org
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Message-ID: <20231106093605.1349201-2-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
(cherry picked from commit aba2ec341c6d20c8dc3e6ecf87fa7c1a71e30c1e)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 255422dc75db9b3502434f791abfdc32e6d886bb
      
https://github.com/qemu/qemu/commit/255422dc75db9b3502434f791abfdc32e6d886bb
  Author: Ilya Leoshkevich <iii@linux.ibm.com>
  Date:   2023-11-19 (Sun, 19 Nov 2023)

  Changed paths:
    M tests/tcg/s390x/Makefile.target
    A tests/tcg/s390x/clc.c

  Log Message:
  -----------
  tests/tcg/s390x: Test CLC with inaccessible second operand

Add a small test to prevent regressions.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20231106093605.1349201-3-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
(cherry picked from commit 43fecbe7a53fe8e5a6aff0d6471b1cc624e26b51)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: a16eec9fb22444ef0aa2054d33fabbf8165ee78c
      
https://github.com/qemu/qemu/commit/a16eec9fb22444ef0aa2054d33fabbf8165ee78c
  Author: Ilya Leoshkevich <iii@linux.ibm.com>
  Date:   2023-11-19 (Sun, 19 Nov 2023)

  Changed paths:
    M target/s390x/tcg/insn-data.h.inc
    M target/s390x/tcg/translate.c

  Log Message:
  -----------
  target/s390x: Fix LAALG not updating cc_src

LAALG uses op_laa() and wout_addu64(). The latter expects cc_src to be
set, but the former does not do it. This can lead to assertion failures
if something sets cc_src to neither 0 nor 1 before.

Fix by introducing op_laa_addu64(), which sets cc_src, and using it for
LAALG.

Fixes: 4dba4d6fef61 ("target/s390x: Use atomic operations for LOAD AND OP")
Cc: qemu-stable@nongnu.org
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20231106093605.1349201-4-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
(cherry picked from commit bea402482a8c94389638cbd3d7fe3963fb317f4c)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 097c347136d18fc2d472ffa31326d883a2d9c196
      
https://github.com/qemu/qemu/commit/097c347136d18fc2d472ffa31326d883a2d9c196
  Author: Ilya Leoshkevich <iii@linux.ibm.com>
  Date:   2023-11-19 (Sun, 19 Nov 2023)

  Changed paths:
    M tests/tcg/s390x/Makefile.target
    A tests/tcg/s390x/laalg.c

  Log Message:
  -----------
  tests/tcg/s390x: Test LAALG with negative cc_src

Add a small test to prevent regressions.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20231106093605.1349201-5-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
(cherry picked from commit ebc14107f1f3ac1db13132cd28cf94adcd38e5d7)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 100feda604fbe389353bbce306fb3b28de70dbad
      
https://github.com/qemu/qemu/commit/100feda604fbe389353bbce306fb3b28de70dbad
  Author: Marc-André Lureau <marcandre.lureau@redhat.com>
  Date:   2023-11-19 (Sun, 19 Nov 2023)

  Changed paths:
    M scripts/tracetool/__init__.py

  Log Message:
  -----------
  tracetool: avoid invalid escape in Python string

This is an error in Python 3.12; fix it by using a raw string literal.

Cc:  <qemu-stable@nongnu.org>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20231108105649.60453-1-marcandre.lureau@redhat.com>
(cherry picked from commit 4d96307c5b4fac40c6ca25f38318b4b65d315de0)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 221c0e142608a8567e7d3d82500dea84639587a7
      
https://github.com/qemu/qemu/commit/221c0e142608a8567e7d3d82500dea84639587a7
  Author: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
  Date:   2023-11-19 (Sun, 19 Nov 2023)

  Changed paths:
    M target/riscv/kvm.c

  Log Message:
  -----------
  target/riscv/kvm: improve 'init_multiext_cfg' error msg

Our error message is returning the value of 'ret', which will be always
-1 in case of error, and will not be that useful:

qemu-system-riscv64: Unable to read ISA_EXT KVM register ssaia, error -1

Improve the error message by outputting 'errno' instead of 'ret'. Use
strerrorname_np() to output the error name instead of the error code.
This will give us what we need to know right away:

qemu-system-riscv64: Unable to read ISA_EXT KVM register ssaia, error code: 
ENOENT

Given that we're going to exit(1) in this condition instead of
attempting to recover, remove the 'kvm_riscv_destroy_scratch_vcpu()'
call.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20231003132148.797921-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
(cherry picked from commit 082e9e4a58ba80ec056220a2f762a1c6b9a3a96c)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: 150ebd076e4aff712a7e098ff59fc962dc218697
      
https://github.com/qemu/qemu/commit/150ebd076e4aff712a7e098ff59fc962dc218697
  Author: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
  Date:   2023-11-19 (Sun, 19 Nov 2023)

  Changed paths:
    M target/riscv/kvm.c

  Log Message:
  -----------
  target/riscv/kvm: support KVM_GET_REG_LIST

KVM for RISC-V started supporting KVM_GET_REG_LIST in Linux 6.6. It
consists of a KVM ioctl() that retrieves a list of all available regs
for get_one_reg/set_one_reg. Regs that aren't present in the list aren't
supported in the host.

This simplifies our lives when initing the KVM regs since we don't have
to always attempt a KVM_GET_ONE_REG for all regs QEMU knows. We'll only
attempt a get_one_reg() if we're sure the reg is supported, i.e. it was
retrieved by KVM_GET_REG_LIST. Any error in get_one_reg() will then
always considered fatal, instead of having to handle special error codes
that might indicate a non-fatal failure.

Start by moving the current kvm_riscv_init_multiext_cfg() logic into a
new kvm_riscv_read_multiext_legacy() helper. We'll prioritize using
KVM_GET_REG_LIST, so check if we have it available and, in case we
don't, use the legacy() logic.

Otherwise, retrieve the available reg list and use it to check if the
host supports our known KVM regs, doing the usual get_one_reg() for
the supported regs and setting cpu->cfg accordingly.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20231003132148.797921-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
(cherry picked from commit 608bdebb6075b757e5505f6bbc60c45a54a1390b)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
(Mjt: trivial context tweak in target/riscv/kvm.c)


  Commit: 25f55508fc53ed5b0ca90a0b1b158e7d6accb487
      
https://github.com/qemu/qemu/commit/25f55508fc53ed5b0ca90a0b1b158e7d6accb487
  Author: Matthew Rosato <mjrosato@linux.ibm.com>
  Date:   2023-11-19 (Sun, 19 Nov 2023)

  Changed paths:
    M hw/s390x/s390-pci-vfio.c

  Log Message:
  -----------
  s390x/pci: only limit DMA aperture if vfio DMA limit reported

If the host kernel lacks vfio DMA limit reporting, do not attempt
to shrink the guest DMA aperture.

Fixes: df202e3ff3 ("s390x/pci: shrink DMA aperture to be bound by vfio DMA 
limit")
Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
Message-ID: <20231110175108.465851-3-mjrosato@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
(cherry picked from commit 8011b508cf0ddbdbda03820f4fa6cd484a6d9aed)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: b88b9585d8801c967ddfabd8375eba6b88f8632c
      
https://github.com/qemu/qemu/commit/b88b9585d8801c967ddfabd8375eba6b88f8632c
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2023-11-19 (Sun, 19 Nov 2023)

  Changed paths:
    M target/arm/tcg/translate-a64.c

  Log Message:
  -----------
  target/arm: HVC at EL3 should go to EL3, not EL2

AArch64 permits code at EL3 to use the HVC instruction; however the
exception we take should go to EL3, not down to EL2 (see the pseudocode
AArch64.CallHypervisor()). Fix the target EL.

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar@zeroasic.com>
Message-id: 20231109151917.1925107-1-peter.maydell@linaro.org
(cherry picked from commit fc58891d0422607d172a3d6b3158798f2556aef1)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


  Commit: d19b4a4215950468147d9153a0495cd45608ad25
      
https://github.com/qemu/qemu/commit/d19b4a4215950468147d9153a0495cd45608ad25
  Author: Marc-André Lureau <marcandre.lureau@redhat.com>
  Date:   2023-11-19 (Sun, 19 Nov 2023)

  Changed paths:
    M hw/mips/Kconfig

  Log Message:
  -----------
  hw/mips: LOONGSON3V depends on UNIMP device

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Cc: qemu-stable@nongnu.org
Fixes: c76b409fef ("hw/mips: Add Loongson-3 machine support")
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20231107140615.3034763-1-marcandre.lureau@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
(cherry picked from commit 52c773ce893f6321f20c80101aa4ea9489a6f701)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>


Compare: https://github.com/qemu/qemu/compare/1c42c0010891...d19b4a421595



reply via email to

[Prev in Thread] Current Thread [Next in Thread]