[Qemu-commits] [qemu/qemu] dcebbb: target/i386/kvm: Free xsave_buf when destroying vCPU

[Peter Maydell]

  Branch: refs/heads/staging
  Home:   https://github.com/qemu/qemu
  Commit: dcebbb65b8a423a4e933ac803cd27ec8dc03ce7c
      
https://github.com/qemu/qemu/commit/dcebbb65b8a423a4e933ac803cd27ec8dc03ce7c
  Author: Philippe Mathieu-Daudé <f4bug@amsat.org>
  Date:   2022-03-23 (Wed, 23 Mar 2022)

  Changed paths:
    M target/i386/kvm/kvm.c

  Log Message:
  -----------
  target/i386/kvm: Free xsave_buf when destroying vCPU

Fix vCPU hot-unplug related leak reported by Valgrind:

  ==132362== 4,096 bytes in 1 blocks are definitely lost in loss record 8,440 
of 8,549
  ==132362==    at 0x4C3B15F: memalign (vg_replace_malloc.c:1265)
  ==132362==    by 0x4C3B288: posix_memalign (vg_replace_malloc.c:1429)
  ==132362==    by 0xB41195: qemu_try_memalign (memalign.c:53)
  ==132362==    by 0xB41204: qemu_memalign (memalign.c:73)
  ==132362==    by 0x7131CB: kvm_init_xsave (kvm.c:1601)
  ==132362==    by 0x7148ED: kvm_arch_init_vcpu (kvm.c:2031)
  ==132362==    by 0x91D224: kvm_init_vcpu (kvm-all.c:516)
  ==132362==    by 0x9242C9: kvm_vcpu_thread_fn (kvm-accel-ops.c:40)
  ==132362==    by 0xB2EB26: qemu_thread_start (qemu-thread-posix.c:556)
  ==132362==    by 0x7EB2159: start_thread (in /usr/lib64/libpthread-2.28.so)
  ==132362==    by 0x9D45DD2: clone (in /usr/lib64/libc-2.28.so)

Reported-by: Mark Kanda <mark.kanda@oracle.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Mark Kanda <mark.kanda@oracle.com>
Message-Id: <20220322120522.26200-1-philippe.mathieu.daude@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: cb48748af7dfd7654323eb839d1f853ffa873652
      
https://github.com/qemu/qemu/commit/cb48748af7dfd7654323eb839d1f853ffa873652
  Author: luofei <luofei@unicloud.com>
  Date:   2022-03-23 (Wed, 23 Mar 2022)

  Changed paths:
    M target/i386/kvm/kvm.c

  Log Message:
  -----------
  i386: Set MCG_STATUS_RIPV bit for mce SRAR error

In the physical machine environment, when a SRAR error occurs,
the IA32_MCG_STATUS RIPV bit is set, but qemu does not set this
bit. When qemu injects an SRAR error into virtual machine, the
virtual machine kernel just call do_machine_check() to kill the
current task, but not call memory_failure() to isolate the faulty
page, which will cause the faulty page to be allocated and used
repeatedly. If used by the virtual machine kernel, it will cause
the virtual machine to crash

Signed-off-by: luofei <luofei@unicloud.com>
Message-Id: <20220120084634.131450-1-luofei@unicloud.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: 58f7db26f21c690cf9a669c314cfd7371506084a
      
https://github.com/qemu/qemu/commit/58f7db26f21c690cf9a669c314cfd7371506084a
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   2022-03-23 (Wed, 23 Mar 2022)

  Changed paths:
    M target/i386/cpu.c
    M target/i386/cpu.h
    M target/i386/kvm/kvm-cpu.c

  Log Message:
  -----------
  KVM: x86: workaround invalid CPUID[0xD,9] info on some AMD processors

Some AMD processors expose the PKRU extended save state even if they do not have
the related PKU feature in CPUID.  Worse, when they do they report a size of
64, whereas the expected size of the PKRU extended save state is 8, therefore
the esa->size == eax assertion does not hold.

The state is already ignored by KVM_GET_SUPPORTED_CPUID because it
was not enabled in the host XCR0.  However, QEMU kvm_cpu_xsave_init()
runs before QEMU invokes arch_prctl() to enable dynamically-enabled
save states such as XTILEDATA, and KVM_GET_SUPPORTED_CPUID hides save
states that have yet to be enabled.  Therefore, kvm_cpu_xsave_init()
needs to consult the host CPUID instead of KVM_GET_SUPPORTED_CPUID,
and dies with an assertion failure.

When setting up the ExtSaveArea array to match the host, ignore features that
KVM does not report as supported.  This will cause QEMU to skip the incorrect
CPUID leaf instead of tripping the assertion.

Closes: https://gitlab.com/qemu-project/qemu/-/issues/916
Reported-by: Daniel P. Berrangé <berrange@redhat.com>
Analyzed-by: Yang Zhong <yang.zhong@intel.com>
Reported-by: Peter Krempa <pkrempa@redhat.com>
Tested-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: 98a02bc4492c7e00a703ad42f1ff9d2f3521a138
      
https://github.com/qemu/qemu/commit/98a02bc4492c7e00a703ad42f1ff9d2f3521a138
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   2022-03-23 (Wed, 23 Mar 2022)

  Changed paths:
    M configure

  Log Message:
  -----------
  configure: remove dead int128 test

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: de65b39a517c9977769c612af716dc418ce2ea0b
      
https://github.com/qemu/qemu/commit/de65b39a517c9977769c612af716dc418ce2ea0b
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   2022-03-24 (Thu, 24 Mar 2022)

  Changed paths:
    M target/i386/tcg/translate.c

  Log Message:
  -----------
  target/i386: tcg: high bits SSE cmp operation must be ignored

High bits in the immediate operand of SSE comparisons are ignored, they
do not result in an undefined opcode exception.  This is mentioned
explicitly in the Intel documentation.

Reported-by: sonicadvance1@gmail.com
Closes: https://gitlab.com/qemu-project/qemu/-/issues/184
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: 5286c3662294119dc2dd1e9296757337211451f6
      
https://github.com/qemu/qemu/commit/5286c3662294119dc2dd1e9296757337211451f6
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   2022-03-24 (Thu, 24 Mar 2022)

  Changed paths:
    M target/i386/cpu.c
    M target/i386/cpu.h

  Log Message:
  -----------
  target/i386: properly reset TSC on reset

Some versions of Windows hang on reboot if their TSC value is greater
than 2^54.  The calibration of the Hyper-V reference time overflows
and fails; as a result the processors' clock sources are out of sync.

The issue is that the TSC _should_ be reset to 0 on CPU reset and
QEMU tries to do that.  However, KVM special cases writing 0 to the
TSC and thinks that QEMU is trying to hot-plug a CPU, which is
correct the first time through but not later.  Thwart this valiant
effort and reset the TSC to 1 instead, but only if the CPU has been
run once.

For this to work, env->tsc has to be moved to the part of CPUArchState
that is not zeroed at the beginning of x86_cpu_reset.

Reported-by: Vadim Rozenfeld <vrozenfe@redhat.com>
Supersedes: <20220324082346.72180-1-pbonzini@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: 9584d3d00a454f47b0341465142bcf0735d734ae
      
https://github.com/qemu/qemu/commit/9584d3d00a454f47b0341465142bcf0735d734ae
  Author: Christian Ehrhardt <christian.ehrhardt@canonical.com>
  Date:   2022-03-24 (Thu, 24 Mar 2022)

  Changed paths:
    M pc-bios/optionrom/Makefile

  Log Message:
  -----------
  build: disable fcf-protection on -march=486 -m16

Some of the roms build with -march=i486 -m16 which is incompatible
with -fcf-protection. That in turn is can be set by default, for
example in Ubuntu [1].
That causes:
 cc1: error: ‘-fcf-protection’ is not compatible with this target

This won't work on -march=i486 -m16 and no matter if set or not we can
override it to "none" if the option is known to the compiler to be
able to build reliably.

Fixes: https://gitlab.com/qemu-project/qemu/-/issues/889

[1]: https://wiki.ubuntu.com/ToolChain/CompilerFlags#A-fcf-protection

Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20220323090713.1002588-1-christian.ehrhardt@canonical.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: f345abe36527a8b575482bb5a0616f43952bf1f4
      
https://github.com/qemu/qemu/commit/f345abe36527a8b575482bb5a0616f43952bf1f4
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2022-03-25 (Fri, 25 Mar 2022)

  Changed paths:
    M configure
    M pc-bios/optionrom/Makefile
    M target/i386/cpu.c
    M target/i386/cpu.h
    M target/i386/kvm/kvm-cpu.c
    M target/i386/kvm/kvm.c
    M target/i386/tcg/translate.c

  Log Message:
  -----------
  Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging

Bugfixes.

# gpg: Signature made Thu 24 Mar 2022 17:44:49 GMT
# gpg:                using RSA key F13338574B662389866C7682BFFBD25F78C7AE83
# gpg:                issuer "pbonzini@redhat.com"
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full]
# gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>" [full]
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
#      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

* tag 'for-upstream' of https://gitlab.com/bonzini/qemu:
  build: disable fcf-protection on -march=486 -m16
  target/i386: properly reset TSC on reset
  target/i386: tcg: high bits SSE cmp operation must be ignored
  configure: remove dead int128 test
  KVM: x86: workaround invalid CPUID[0xD,9] info on some AMD processors
  i386: Set MCG_STATUS_RIPV bit for mce SRAR error
  target/i386/kvm: Free xsave_buf when destroying vCPU

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


Compare: https://github.com/qemu/qemu/compare/10c473246b17...f345abe36527