[Qemu-commits] [qemu/qemu] d645e1: kvm: i386: halt poll control MSR support

[Peter Maydell]

  Branch: refs/heads/master
  Home:   https://github.com/qemu/qemu
  Commit: d645e1328726b38b3c79525eb57842ce29c1df7c
      
https://github.com/qemu/qemu/commit/d645e1328726b38b3c79525eb57842ce29c1df7c
  Author: Marcelo Tosatti <address@hidden>
  Date:   2019-08-20 (Tue, 20 Aug 2019)

  Changed paths:
    M include/standard-headers/asm-x86/kvm_para.h
    M target/i386/cpu.c
    M target/i386/cpu.h
    M target/i386/kvm.c
    M target/i386/machine.c

  Log Message:
  -----------
  kvm: i386: halt poll control MSR support

Add support for halt poll control MSR: save/restore, migration
and new feature name.

The purpose of this MSR is to allow the guest to disable
host halt poll.

Signed-off-by: Marcelo Tosatti <address@hidden>
Message-Id: <address@hidden>
[Do not enable by default, as pointed out by Mark Kanda. - Paolo]
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: b896c4b50da107bf0d40e6215d4ee20daf64723b
      
https://github.com/qemu/qemu/commit/b896c4b50da107bf0d40e6215d4ee20daf64723b
  Author: Wanpeng Li <address@hidden>
  Date:   2019-08-20 (Tue, 20 Aug 2019)

  Changed paths:
    M target/i386/cpu.c

  Log Message:
  -----------
  target-i386: adds PV_SCHED_YIELD CPUID feature bit

Adds PV_SCHED_YIELD CPUID feature bit.

Cc: Eduardo Habkost <address@hidden>
Cc: Paolo Bonzini <address@hidden>
Cc: Radim Krčmář <address@hidden>
Signed-off-by: Wanpeng Li <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: fef28891aa401e8f9d048c65f32067f51d695f4e
      
https://github.com/qemu/qemu/commit/fef28891aa401e8f9d048c65f32067f51d695f4e
  Author: Stefano Garzarella <address@hidden>
  Date:   2019-08-20 (Tue, 20 Aug 2019)

  Changed paths:
    M hw/core/loader.c
    M include/hw/elf_ops.h
    M include/hw/loader.h

  Log Message:
  -----------
  loader: Handle memory-mapped ELFs

This patch allows handling an ELF memory-mapped, taking care
the reference count of the GMappedFile* passed through
rom_add_elf_program().
In this case, the 'data' pointer is not heap-allocated, so
we cannot free it.

Suggested-by: Paolo Bonzini <address@hidden>
Signed-off-by: Stefano Garzarella <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 816b9fe450220e19acb91a0ce4a8ade7000648d1
      
https://github.com/qemu/qemu/commit/816b9fe450220e19acb91a0ce4a8ade7000648d1
  Author: Stefano Garzarella <address@hidden>
  Date:   2019-08-20 (Tue, 20 Aug 2019)

  Changed paths:
    M include/hw/elf_ops.h

  Log Message:
  -----------
  elf-ops.h: Map into memory the ELF to load

In order to reduce the memory footprint we map into memory
the ELF to load using g_mapped_file_new_from_fd() instead of
reading each sections. In this way we can share the ELF pages
between multiple instances of QEMU.

Suggested-by: Dr. David Alan Gilbert <address@hidden>
Suggested-by: Paolo Bonzini <address@hidden>
Signed-off-by: Stefano Garzarella <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: e502fe96ac4343a3f4a3c13f28eea03ae7b11c3f
      
https://github.com/qemu/qemu/commit/e502fe96ac4343a3f4a3c13f28eea03ae7b11c3f
  Author: Stefano Garzarella <address@hidden>
  Date:   2019-08-20 (Tue, 20 Aug 2019)

  Changed paths:
    M hw/i386/pc.c
    M include/hw/i386/pc.h

  Log Message:
  -----------
  hw/i386/pc: Map into memory the initrd

In order to reduce the memory footprint we map into memory
the initrd using g_mapped_file_new() instead of reading it.
In this way we can share the initrd pages between multiple
instances of QEMU.

Suggested-by: Paolo Bonzini <address@hidden>
Signed-off-by: Stefano Garzarella <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 03c7140c1a0336af3d4fca768de791b9c0e2b128
      
https://github.com/qemu/qemu/commit/03c7140c1a0336af3d4fca768de791b9c0e2b128
  Author: Yan Zhao <address@hidden>
  Date:   2019-08-20 (Tue, 20 Aug 2019)

  Changed paths:
    M memory.c

  Log Message:
  -----------
  memory: assert on out of scope notification

It is wrong for an entry to have parts out of scope of notifier's range.
assert this condition.

Out of scope mapping/unmapping would cause problem, as in below case:

1. initially there are two notifiers with ranges
0-0xfedfffff, 0xfef00000-0xffffffffffffffff,
IOVAs from 0x3c000000 - 0x3c1fffff is in shadow page table.

2. in vfio, memory_region_register_iommu_notifier() is followed by
memory_region_iommu_replay(), which will first call address space
unmap,
and walk and add back all entries in vtd shadow page table. e.g.
(1) for notifier 0-0xfedfffff,
    IOVAs from 0 - 0xffffffff get unmapped,
    and IOVAs from 0x3c000000 - 0x3c1fffff get mapped
(2) for notifier 0xfef00000-0xffffffffffffffff
    IOVAs from 0 - 0x7fffffffff get unmapped,
    but IOVAs from 0x3c000000 - 0x3c1fffff cannot get mapped back.

Cc: Eric Auger <address@hidden>
Signed-off-by: Yan Zhao <address@hidden>

Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 52bf9771fdfce98e98cea36a17a18915be6f6b7f
      
https://github.com/qemu/qemu/commit/52bf9771fdfce98e98cea36a17a18915be6f6b7f
  Author: address@hidden <address@hidden>
  Date:   2019-08-20 (Tue, 20 Aug 2019)

  Changed paths:
    M configure
    M include/exec/poison.h
    M include/qom/cpu.h
    M target/alpha/cpu.h
    M target/hppa/cpu.h
    M target/mips/cpu.h
    M target/sh4/cpu.h
    M target/sparc/cpu.h
    M target/xtensa/cpu.h
    M tcg/tcg.c
    M tcg/tcg.h

  Log Message:
  -----------
  configure: Define target access alignment in configure

This patch moves the define of target access alignment earlier from
target/foo/cpu.h to configure.

Suggested in Richard Henderson's reply to "[PATCH 1/4] tcg: TCGMemOp is now
accelerator independent MemOp"

Signed-off-by: Tony Nguyen <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
Signed-off-by: address@hidden <address@hidden>


  Commit: 98387d58024e3fb1b88d5a57912e4514d7f39c7c
      
https://github.com/qemu/qemu/commit/98387d58024e3fb1b88d5a57912e4514d7f39c7c
  Author: Paolo Bonzini <address@hidden>
  Date:   2019-08-20 (Tue, 20 Aug 2019)

  Changed paths:
    M Kconfig.host
    M fsdev/Makefile.objs
    M hw/9pfs/Kconfig

  Log Message:
  -----------
  9p: simplify source file selection

Express the complex conditions in Kconfig rather than Makefiles, since Kconfig
is better suited at expressing dependencies and detecting contradictions.

Cc: Marc-André Lureau <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: de428cead63a958137ee63efcc3cceaf75f6c125
      
https://github.com/qemu/qemu/commit/de428cead63a958137ee63efcc3cceaf75f6c125
  Author: Li Qiang <address@hidden>
  Date:   2019-08-20 (Tue, 20 Aug 2019)

  Changed paths:
    M target/i386/kvm.c

  Log Message:
  -----------
  target-i386: kvm: 'kvm_get_supported_msrs' cleanup

Function 'kvm_get_supported_msrs' is only called once
now, get rid of the static variable 'kvm_supported_msrs'.

Signed-off-by: Li Qiang <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: ef0aa6af47da16f5367f545deb599a14ea408bee
      
https://github.com/qemu/qemu/commit/ef0aa6af47da16f5367f545deb599a14ea408bee
  Author: Andrey Shinkevich <address@hidden>
  Date:   2019-08-20 (Tue, 20 Aug 2019)

  Changed paths:
    M tests/test-throttle.c

  Log Message:
  -----------
  test-throttle: Fix uninitialized use of burst_length

ThrottleState::cfg of the static variable 'ts' is reassigned with the
local one in the do_test_accounting() and then is passed to the
throttle_account() with uninitialized member LeakyBucket::burst_length.

Signed-off-by: Andrey Shinkevich <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: f673174e3f62096f45b874fbe1cd469127d9c21c
      
https://github.com/qemu/qemu/commit/f673174e3f62096f45b874fbe1cd469127d9c21c
  Author: Andrey Shinkevich <address@hidden>
  Date:   2019-08-20 (Tue, 20 Aug 2019)

  Changed paths:
    M tests/test-string-input-visitor.c

  Log Message:
  -----------
  tests: Fix uninitialized byte in test_visitor_in_fuzz

One byte in the local buffer stays uninitialized, at least with the
first iteration, because of the double decrement in the
test_visitor_in_fuzz(). This is what Valgrind does not like and not
critical for the test itself. So, reduce the number of the memory
issues reports.

Signed-off-by: Andrey Shinkevich <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 1f670a95b370651bcf3721aa0941d57e185478cf
      
https://github.com/qemu/qemu/commit/1f670a95b370651bcf3721aa0941d57e185478cf
  Author: Andrey Shinkevich <address@hidden>
  Date:   2019-08-20 (Tue, 20 Aug 2019)

  Changed paths:
    M target/i386/kvm.c

  Log Message:
  -----------
  i386/kvm: initialize struct at full before ioctl call

Not the whole structure is initialized before passing it to the KVM.
Reduce the number of Valgrind reports.

Signed-off-by: Andrey Shinkevich <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 1e8a98b53867f61da9ca09f411288e2085d323c4
      
https://github.com/qemu/qemu/commit/1e8a98b53867f61da9ca09f411288e2085d323c4
  Author: Peter Maydell <address@hidden>
  Date:   2019-08-20 (Tue, 20 Aug 2019)

  Changed paths:
    M target/i386/ops_sse.h

  Log Message:
  -----------
  target/i386: Return 'indefinite integer value' for invalid SSE fp->int 
conversions

The x86 architecture requires that all conversions from floating
point to integer which raise the 'invalid' exception (infinities of
both signs, NaN, and all values which don't fit in the destination
integer) return what the x86 spec calls the "indefinite integer
value", which is 0x8000_0000 for 32-bits or 0x8000_0000_0000_0000 for
64-bits.  The softfloat functions return the more usual behaviour of
positive overflows returning the maximum value that fits in the
destination integer format and negative overflows returning the
minimum value that fits.

Wrap the softfloat functions in x86-specific versions which
detect the 'invalid' condition and return the indefinite integer.

Note that we don't use these wrappers for the 3DNow! pf2id and pf2iw
instructions, which do return the minimum value that fits in
an int32 if the input float is a large negative number.

Fixes: https://bugs.launchpad.net/qemu/+bug/1815423
Signed-off-by: Peter Maydell <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 9458a9a1df1a4c719e24512394d548c1fc7abd22
      
https://github.com/qemu/qemu/commit/9458a9a1df1a4c719e24512394d548c1fc7abd22
  Author: Paolo Bonzini <address@hidden>
  Date:   2019-08-20 (Tue, 20 Aug 2019)

  Changed paths:
    M exec.c
    M include/exec/memory.h
    M memory.c
    M migration/ram.c

  Log Message:
  -----------
  memory: fix race between TCG and accesses to dirty bitmap

There is a race between TCG and accesses to the dirty log:

      vCPU thread                  reader thread
      -----------------------      -----------------------
      TLB check -> slow path
        notdirty_mem_write
          write to RAM
          set dirty flag
                                   clear dirty flag
      TLB check -> fast path
                                   read memory
        write to RAM

Fortunately, in order to fix it, no change is required to the
vCPU thread.  However, the reader thread must delay the read after
the vCPU thread has finished the write.  This can be approximated
conservatively by run_on_cpu, which waits for the end of the current
translation block.

A similar technique is used by KVM, which has to do a synchronous TLB
flush after doing a test-and-clear of the dirty-page flags.

Reported-by: Dr. David Alan Gilbert <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 8ff72af557dcae1e1d441983f9057f8c99cad26f
      
https://github.com/qemu/qemu/commit/8ff72af557dcae1e1d441983f9057f8c99cad26f
  Author: Dr. David Alan Gilbert <address@hidden>
  Date:   2019-08-20 (Tue, 20 Aug 2019)

  Changed paths:
    M hw/timer/mc146818rtc.c

  Log Message:
  -----------
  mc146818rtc: Remove reset notifiers

The reset notifiers are unreliable and recalculating the offsets
after boot causes problems with migration in cases where explicit
base times are set on the destination.

Signed-off-by: Dr. David Alan Gilbert <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 4ea9a0e3db39a3ef07f8a97c005733d127485891
      
https://github.com/qemu/qemu/commit/4ea9a0e3db39a3ef07f8a97c005733d127485891
  Author: Dr. David Alan Gilbert <address@hidden>
  Date:   2019-08-20 (Tue, 20 Aug 2019)

  Changed paths:
    M include/qemu/timer.h
    M util/qemu-timer.c

  Log Message:
  -----------
  timer: Remove reset notifiers

Remove the reset notifer from the core qemu-timer code.
The only user was mc146818 and we've just remove it's use.

Signed-off-by: Dr. David Alan Gilbert <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: a02fe2ca70ca2e05345587b2b947d64a446bcbd3
      
https://github.com/qemu/qemu/commit/a02fe2ca70ca2e05345587b2b947d64a446bcbd3
  Author: Dr. David Alan Gilbert <address@hidden>
  Date:   2019-08-20 (Tue, 20 Aug 2019)

  Changed paths:
    M replay/replay-snapshot.c

  Log Message:
  -----------
  replay: Remove host_clock_last

Now we're not using the 'last' field in the timer, remove it from
replay.

Bump the version number of the replay structure since we've
removed the field.

Signed-off-by: Dr. David Alan Gilbert <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 3c2d4c8aa6a98366c9fe2f36305f12199257a7d5
      
https://github.com/qemu/qemu/commit/3c2d4c8aa6a98366c9fe2f36305f12199257a7d5
  Author: Dr. David Alan Gilbert <address@hidden>
  Date:   2019-08-20 (Tue, 20 Aug 2019)

  Changed paths:
    M include/qemu/timer.h
    M util/qemu-timer.c

  Log Message:
  -----------
  timer: last, remove last bits of last

The reset notifiers kept a 'last' counter to notice jumps;
now that we've remove the notifier we don't need to keep 'last'.

Signed-off-by: Dr. David Alan Gilbert <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 245429e4a0e036471ba46e2393b6f33b78b9615e
      
https://github.com/qemu/qemu/commit/245429e4a0e036471ba46e2393b6f33b78b9615e
  Author: Pavel Dovgalyuk <address@hidden>
  Date:   2019-08-20 (Tue, 20 Aug 2019)

  Changed paths:
    M replay/replay-internal.c

  Log Message:
  -----------
  replay: add missing fix for internal function

This is a fix which was missed by patch
74c0b816adfc6aa1b01b4426fdf385e32e35cbac, which added current_step
parameter to the replay_advance_current_step function.

Signed-off-by: Pavel Dovgalyuk <address@hidden>
Message-Id: 
<156404425561.18669.13015037579222450241.stgit@pasha-Precision-3630-Tower>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 978ae0e99c1760c228eef2d320386daab3bf5b10
      
https://github.com/qemu/qemu/commit/978ae0e99c1760c228eef2d320386daab3bf5b10
  Author: Pavel Dovgalyuk <address@hidden>
  Date:   2019-08-20 (Tue, 20 Aug 2019)

  Changed paths:
    A docs/devel/replay.txt

  Log Message:
  -----------
  replay: document development rules

This patch introduces docs/devel/replay.txt which describes the rules
that should be followed to make virtual devices usable in record/replay mode.

Signed-off-by: Pavel Dovgalyuk <address@hidden>

--

v9: fixed external virtual clock description (reported by Artem Pisarenko)
Message-Id: 
<156404426119.18669.6707258931552832854.stgit@pasha-Precision-3630-Tower>
Signed-off-by: Paolo Bonzini <address@hidden>
Signed-off-by: Pavel Dovgalyuk <address@hidden>


  Commit: dcb1578069dd072f9aec74e3024cadb9ed0f3aae
      
https://github.com/qemu/qemu/commit/dcb1578069dd072f9aec74e3024cadb9ed0f3aae
  Author: Pavel Dovgalyuk <address@hidden>
  Date:   2019-08-20 (Tue, 20 Aug 2019)

  Changed paths:
    M cpus.c
    M include/qemu/timer.h
    M qtest.c
    M tests/ptimer-test-stubs.c
    M tests/ptimer-test.c
    M util/qemu-timer.c

  Log Message:
  -----------
  util/qemu-timer: refactor deadline calculation for external timers

icount-based record/replay uses qemu_clock_deadline_ns_all to measure
the period until vCPU may be interrupted.
This function takes in account the virtual timers, because they belong
to the virtual devices that may generate interrupt request or affect
the virtual machine state.
However, there are a subset of virtual timers, that are marked with
'external' flag. These do not change the virtual machine state and
only based on virtual clock. Calculating the deadling using the external
timers breaks the determinism, because they do not belong to the replayed
part of the virtual machine.
This patch fixes the deadline calculation for this case by adding
new parameter for skipping the external timers when it is needed.

Signed-off-by: Pavel Dovgalyuk <address@hidden>

--

v2 changes:
 - added new parameter for timer attribute mask
Message-Id: 
<156404426682.18669.17014100602930969222.stgit@pasha-Precision-3630-Tower>

Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: e957ad8aefa2a426c607683d4cac24bcee09ede4
      
https://github.com/qemu/qemu/commit/e957ad8aefa2a426c607683d4cac24bcee09ede4
  Author: Pavel Dovgalyuk <address@hidden>
  Date:   2019-08-20 (Tue, 20 Aug 2019)

  Changed paths:
    M replay/replay.c

  Log Message:
  -----------
  replay: fix replay shutdown

This patch fixes shutdown of the replay process, which is terminated with
the assert when shutdown event is read from the log.
replay_finish_event reads new data_kind and therefore the value of data_kind
should be preserved to be valid at qemu_system_shutdown_request call.

Signed-off-by: Pavel Dovgalyuk <address@hidden>
Message-Id: 
<156404427238.18669.12378772823692338069.stgit@pasha-Precision-3630-Tower>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 82f49156531b3345fe03a74ca449147db5828238
      
https://github.com/qemu/qemu/commit/82f49156531b3345fe03a74ca449147db5828238
  Author: Pavel Dovgalyuk <address@hidden>
  Date:   2019-08-20 (Tue, 20 Aug 2019)

  Changed paths:
    M replay/replay-time.c

  Log Message:
  -----------
  replay: refine replay-time module

This patch removes refactoring artifacts from the replay/replay-time.c

Signed-off-by: Pavel Dovgalyuk <address@hidden>
Message-Id: 
<156404427799.18669.8072341590511911277.stgit@pasha-Precision-3630-Tower>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 13f267133f349f8a322b5385a58688f0dcdf9ed2
      
https://github.com/qemu/qemu/commit/13f267133f349f8a322b5385a58688f0dcdf9ed2
  Author: Pavel Dovgalyuk <address@hidden>
  Date:   2019-08-20 (Tue, 20 Aug 2019)

  Changed paths:
    M include/sysemu/replay.h
    M replay/replay-events.c
    M replay/replay-internal.c
    M replay/replay-internal.h
    M replay/replay-snapshot.c
    M replay/replay-time.c
    M replay/replay.c

  Log Message:
  -----------
  replay: rename step-related variables and functions

This patch renames replay_get_current_step() and related variables
to make these names consistent with existing 'icount' command line
option and future record/replay hmp/qmp commands.

Signed-off-by: Pavel Dovgalyuk <address@hidden>
Message-Id: 
<156404428377.18669.15476429889039912070.stgit@pasha-Precision-3630-Tower>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: ba3e7926691ed33e1164fafbd4fb2e8e50e7c4cd
      
https://github.com/qemu/qemu/commit/ba3e7926691ed33e1164fafbd4fb2e8e50e7c4cd
  Author: Pavel Dovgalyuk <address@hidden>
  Date:   2019-08-20 (Tue, 20 Aug 2019)

  Changed paths:
    M accel/tcg/cpu-exec.c
    M include/exec/gen-icount.h

  Log Message:
  -----------
  icount: clean up cpu_can_io at the entry to the block

Most of IO instructions can be executed only at the end of the block in
icount mode. Therefore translator can set cpu_can_io flag when translating
the last instruction.
But when the blocks are chained, then this flag is not reset and may
remain set at the beginning of the next block.
This patch resets the flag at the entry of any translation block,
making I/O operations impossible by default.

Signed-off-by: Pavel Dovgalyuk <address@hidden>

--

v2 changes:
 - reset can_do_io at the start of every TB (suggested by Paolo Bonzini)
Message-Id: 
<156404428943.18669.15747009371169578935.stgit@pasha-Precision-3630-Tower>

Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 9e9b10c6491153b60ccfd021328f1f88e1669550
      
https://github.com/qemu/qemu/commit/9e9b10c6491153b60ccfd021328f1f88e1669550
  Author: Pavel Dovgalyuk <address@hidden>
  Date:   2019-08-20 (Tue, 20 Aug 2019)

  Changed paths:
    M accel/tcg/translator.c
    M include/exec/gen-icount.h
    M target/alpha/translate.c
    M target/arm/translate-a64.c
    M target/arm/translate.c
    M target/cris/translate.c
    M target/hppa/translate.c
    M target/i386/translate.c
    M target/lm32/translate.c
    M target/microblaze/translate.c
    M target/mips/translate.c
    M target/nios2/translate.c
    M target/ppc/translate.c
    M target/ppc/translate_init.inc.c
    M target/riscv/insn_trans/trans_rvi.inc.c
    M target/sparc/translate.c
    M target/unicore32/translate.c
    M target/xtensa/translate.c

  Log Message:
  -----------
  icount: remove unnecessary gen_io_end calls

Prior patch resets can_do_io flag at the TB entry. Therefore there is no
need in resetting this flag at the end of the block.
This patch removes redundant gen_io_end calls.

Signed-off-by: Pavel Dovgalyuk <address@hidden>
Message-Id: 
<156404429499.18669.13404064982854123855.stgit@pasha-Precision-3630-Tower>
Signed-off-by: Paolo Bonzini <address@hidden>
Signed-off-by: Pavel Dovgalyuk <address@hidden>


  Commit: e533f45d7dd85d6514de3f7a433f7dc4313e8f62
      
https://github.com/qemu/qemu/commit/e533f45d7dd85d6514de3f7a433f7dc4313e8f62
  Author: Roman Kagan <address@hidden>
  Date:   2019-08-20 (Tue, 20 Aug 2019)

  Changed paths:
    M cpus-common.c

  Log Message:
  -----------
  cpus-common: nuke finish_safe_work

It was introduced in commit ab129972c8b41e15b0521895a46fd9c752b68a5e,
with the following motivation:

  Because start_exclusive uses CPU_FOREACH, merge exclusive_lock with
  qemu_cpu_list_lock: together with a call to exclusive_idle (via
  cpu_exec_start/end) in cpu_list_add, this protects exclusive work
  against concurrent CPU addition and removal.

However, it seems to be redundant, because the cpu-exclusive
infrastructure provides suffificent protection against the newly added
CPU starting execution while the cpu-exclusive work is running, and the
aforementioned traversing of the cpu list is protected by
qemu_cpu_list_lock.

Besides, this appears to be the only place where the cpu-exclusive
section is entered with the BQL taken, which has been found to trigger
AB-BA deadlock as follows:

    vCPU thread                             main thread
    -----------                             -----------
async_safe_run_on_cpu(self,
                      async_synic_update)
...                                         [cpu hot-add]
process_queued_cpu_work()
  qemu_mutex_unlock_iothread()
                                            [grab BQL]
  start_exclusive()                         cpu_list_add()
  async_synic_update()                        finish_safe_work()
    qemu_mutex_lock_iothread()                  cpu_exec_start()

So remove it.  This paves the way to establishing a strict nesting rule
of never entering the exclusive section with the BQL taken.

Signed-off-by: Roman Kagan <address@hidden>
Message-Id: <address@hidden>


  Commit: fc7d2b451ea5d5fe1e787ed7e80c7082fe1cb83d
      
https://github.com/qemu/qemu/commit/fc7d2b451ea5d5fe1e787ed7e80c7082fe1cb83d
  Author: Jan Kiszka <address@hidden>
  Date:   2019-08-20 (Tue, 20 Aug 2019)

  Changed paths:
    M scripts/kvm/vmxcap

  Log Message:
  -----------
  kvm: vmxcap: Enhance with latest features

Based on SDM from May 2019.

Signed-off-by: Jan Kiszka <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: b87c8cdb3e838f282c878a8ddb4c598e0d0ec559
      
https://github.com/qemu/qemu/commit/b87c8cdb3e838f282c878a8ddb4c598e0d0ec559
  Author: Eduardo Habkost <address@hidden>
  Date:   2019-08-20 (Tue, 20 Aug 2019)

  Changed paths:
    M HACKING

  Log Message:
  -----------
  HACKING: Document 'struct' keyword usage

Sometimes we use the 'struct' keyword in headers to help us
reduce dependencies between header files.  Document that
practice.

Signed-off-by: Paolo Bonzini <address@hidden>
Signed-off-by: Eduardo Habkost <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 355477f8c73e9c6b60704c57472c71393ff39bca
      
https://github.com/qemu/qemu/commit/355477f8c73e9c6b60704c57472c71393ff39bca
  Author: Catherine Ho <address@hidden>
  Date:   2019-08-20 (Tue, 20 Aug 2019)

  Changed paths:
    M hw/core/loader.c

  Log Message:
  -----------
  migration: do not rom_reset() during incoming migration

Commit 18269069c310 ("migration: Introduce ignore-shared capability")
addes ignore-shared capability to bypass the shared ramblock (e,g,
membackend + numa node). It does good to live migration.

As told by Yury,this commit expectes that QEMU doesn't write to guest RAM
until VM starts, but it does on aarch64 qemu:
Backtrace:
1  0x000055f4a296dd84 in address_space_write_rom_internal () at
exec.c:3458
2  0x000055f4a296de3a in address_space_write_rom () at exec.c:3479
3  0x000055f4a2d519ff in rom_reset () at hw/core/loader.c:1101
4  0x000055f4a2d475ec in qemu_devices_reset () at hw/core/reset.c:69
5  0x000055f4a2c90a28 in qemu_system_reset () at vl.c:1675
6  0x000055f4a2c9851d in main () at vl.c:4552

Actually, on arm64 virt marchine, ramblock "dtb" will be filled into ram
druing rom_reset. In ignore-shared incoming case, this rom filling
is not required since all the data has been stored in memory backend
file.

Further more, as suggested by Peter Xu, if we do rom_reset() now with
these ROMs then the RAM data should be re-filled again too with the
migration stream coming in.

Fixes: commit 18269069c310 ("migration: Introduce ignore-shared
capability")
Suggested-by: Yury Kotov <address@hidden>
Suggested-by: Peter Xu <address@hidden>
Signed-off-by: Catherine Ho <address@hidden>
Acked-by: Peter Xu <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: a060297822ea6b4194bf36654e58c802448a3eea
      
https://github.com/qemu/qemu/commit/a060297822ea6b4194bf36654e58c802448a3eea
  Author: Wei Yang <address@hidden>
  Date:   2019-08-20 (Tue, 20 Aug 2019)

  Changed paths:
    M tests/test-bitmap.c

  Log Message:
  -----------
  test-bitmap: test set 1 bit case for bitmap_set

All current bitmap_set test cases set range across word, while the
handle of a range within one word is different from that.

Add case to set 1 bit as a represent for set range within one word.

Signed-off-by: Wei Yang <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: de594e47659029316bbf9391efb79da0a1a08e08
      
https://github.com/qemu/qemu/commit/de594e47659029316bbf9391efb79da0a1a08e08
  Author: Paolo Bonzini <address@hidden>
  Date:   2019-08-20 (Tue, 20 Aug 2019)

  Changed paths:
    M hw/scsi/lsi53c895a.c

  Log Message:
  -----------
  scsi: lsi: exit infinite loop while executing script (CVE-2019-12068)

When executing script in lsi_execute_script(), the LSI scsi adapter
emulator advances 's->dsp' index to read next opcode. This can lead
to an infinite loop if the next opcode is empty. Move the existing
loop exit after 10k iterations so that it covers no-op opcodes as
well.

Reported-by: Bugs SysSec <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
Signed-off-by: Prasad J Pandit <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 80db491da4ce8b199e0e8d1e23943b20aab82f69
      
https://github.com/qemu/qemu/commit/80db491da4ce8b199e0e8d1e23943b20aab82f69
  Author: Jing Liu <address@hidden>
  Date:   2019-08-20 (Tue, 20 Aug 2019)

  Changed paths:
    M target/i386/cpu.c
    M target/i386/cpu.h
    M target/i386/kvm.c

  Log Message:
  -----------
  x86: Intel AVX512_BF16 feature enabling

Intel CooperLake cpu adds AVX512_BF16 instruction, defining as
CPUID.(EAX=7,ECX=1):EAX[bit 05].

The patch adds a property for setting the subleaf of CPUID leaf 7 in
case that people would like to specify it.

The release spec link as follows,
https://software.intel.com/sites/default/files/managed/c5/15/\
architecture-instruction-set-extensions-programming-reference.pdf

Signed-off-by: Jing Liu <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: f2cfa1229e539ee1bb1822912075cf25538ad6b9
      
https://github.com/qemu/qemu/commit/f2cfa1229e539ee1bb1822912075cf25538ad6b9
  Author: Peter Maydell <address@hidden>
  Date:   2019-08-21 (Wed, 21 Aug 2019)

  Changed paths:
    M HACKING
    M Kconfig.host
    M accel/tcg/cpu-exec.c
    M accel/tcg/translator.c
    M configure
    M cpus-common.c
    M cpus.c
    A docs/devel/replay.txt
    M exec.c
    M fsdev/Makefile.objs
    M hw/9pfs/Kconfig
    M hw/core/loader.c
    M hw/i386/pc.c
    M hw/scsi/lsi53c895a.c
    M hw/timer/mc146818rtc.c
    M include/exec/gen-icount.h
    M include/exec/memory.h
    M include/exec/poison.h
    M include/hw/elf_ops.h
    M include/hw/i386/pc.h
    M include/hw/loader.h
    M include/qemu/timer.h
    M include/qom/cpu.h
    M include/standard-headers/asm-x86/kvm_para.h
    M include/sysemu/replay.h
    M memory.c
    M migration/ram.c
    M qtest.c
    M replay/replay-events.c
    M replay/replay-internal.c
    M replay/replay-internal.h
    M replay/replay-snapshot.c
    M replay/replay-time.c
    M replay/replay.c
    M scripts/kvm/vmxcap
    M target/alpha/cpu.h
    M target/alpha/translate.c
    M target/arm/translate-a64.c
    M target/arm/translate.c
    M target/cris/translate.c
    M target/hppa/cpu.h
    M target/hppa/translate.c
    M target/i386/cpu.c
    M target/i386/cpu.h
    M target/i386/kvm.c
    M target/i386/machine.c
    M target/i386/ops_sse.h
    M target/i386/translate.c
    M target/lm32/translate.c
    M target/microblaze/translate.c
    M target/mips/cpu.h
    M target/mips/translate.c
    M target/nios2/translate.c
    M target/ppc/translate.c
    M target/ppc/translate_init.inc.c
    M target/riscv/insn_trans/trans_rvi.inc.c
    M target/sh4/cpu.h
    M target/sparc/cpu.h
    M target/sparc/translate.c
    M target/unicore32/translate.c
    M target/xtensa/cpu.h
    M target/xtensa/translate.c
    M tcg/tcg.c
    M tcg/tcg.h
    M tests/ptimer-test-stubs.c
    M tests/ptimer-test.c
    M tests/test-bitmap.c
    M tests/test-string-input-visitor.c
    M tests/test-throttle.c
    M util/qemu-timer.c

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

* New KVM PV features (Marcelo, Wanpeng)
* valgrind fixes (Andrey)
* Remove clock reset notifiers (David)
* KConfig and Makefile cleanups (Paolo)
* Replay and icount improvements (Pavel)
* x86 FP fixes (Peter M.)
* TCG locking assertions (Roman)
* x86 support for mmap-ed -kernel/-initrd (Stefano)
* Other cleanups (Wei Yang, Yan Zhao, Tony)
* LSI fix for infinite loop (Prasad)
* ARM migration fix (Catherine)
* AVX512_BF16 feature (Jing)

# gpg: Signature made Tue 20 Aug 2019 19:00:54 BST
# gpg:                using RSA key BFFBD25F78C7AE83
# gpg: Good signature from "Paolo Bonzini <address@hidden>" [full]
# gpg:                 aka "Paolo Bonzini <address@hidden>" [full]
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
#      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

* remotes/bonzini/tags/for-upstream: (33 commits)
  x86: Intel AVX512_BF16 feature enabling
  scsi: lsi: exit infinite loop while executing script (CVE-2019-12068)
  test-bitmap: test set 1 bit case for bitmap_set
  migration: do not rom_reset() during incoming migration
  HACKING: Document 'struct' keyword usage
  kvm: vmxcap: Enhance with latest features
  cpus-common: nuke finish_safe_work
  icount: remove unnecessary gen_io_end calls
  icount: clean up cpu_can_io at the entry to the block
  replay: rename step-related variables and functions
  replay: refine replay-time module
  replay: fix replay shutdown
  util/qemu-timer: refactor deadline calculation for external timers
  replay: document development rules
  replay: add missing fix for internal function
  timer: last, remove last bits of last
  replay: Remove host_clock_last
  timer: Remove reset notifiers
  mc146818rtc: Remove reset notifiers
  memory: fix race between TCG and accesses to dirty bitmap
  ...

Signed-off-by: Peter Maydell <address@hidden>


Compare: https://github.com/qemu/qemu/compare/17dc57990320...f2cfa1229e53