Series comparison

The following changes since commit 3e4abe2c92964aadd35344a635b0f32cb487fd5c:

Merge tag 'pull-block-2022-07-27' of https://gitlab.com/vsementsov/qemu into staging (2022-07-27 20:10:15 -0700)

are available in the Git repository at:

https://gitlab.com/danielhb/qemu.git pull-ppc-20220728

for you to fetch changes up to 0c9717ff35d2fe46fa9cb91566fe2afbed9f4f2a:

target/ppc: Implement new wait variants (2022-07-28 13:30:41 -0300)

----------------------------------------------------------------
ppc patch queue for 2022-07-28:

Short queue with 2 Coverity fixes and one fix of the
'wait' insns that is causing hangs if the guest kernel uses
the most up to date wait opcode.

- target/ppc:
  - implement new wait variants to fix guest hang when using the new opcode
- ppc440_uc: initialize length passed to cpu_physical_memory_map()
- spapr_nvdimm: check if spapr_drc_index() returns NULL

----------------------------------------------------------------
Daniel Henrique Barboza (1):
      hw/ppc: check if spapr_drc_index() returns NULL in spapr_nvdimm.c

Nicholas Piggin (1):
      target/ppc: Implement new wait variants

Peter Maydell (1):
      hw/ppc/ppc440_uc: Initialize length passed to cpu_physical_memory_map()

hw/ppc/ppc440_uc.c     |  5 ++-
 hw/ppc/spapr_nvdimm.c  | 18 +++++++---
 target/ppc/internal.h  |  3 ++
 target/ppc/translate.c | 96 +++++++++++++++++++++++++++++++++++++++++++++-----
 4 files changed, 109 insertions(+), 13 deletions(-)

spapr_nvdimm_flush_completion_cb() and flush_worker_cb() are using the
DRC object returned by spapr_drc_index() without checking it for NULL.
In this case we would be dereferencing a NULL pointer when doing
SPAPR_NVDIMM(drc->dev) and PC_DIMM(drc->dev).

This can happen if, during a scm_flush(), the DRC object is wrongly
freed/released (e.g. a bug in another part of the code).
spapr_drc_index() would then return NULL in the callbacks.

Fixes: Coverity CID 1487108, 1487178
Reviewed-by: Greg Kurz <groug@kaod.org>
Message-Id: <20220409200856.283076-2-danielhb413@gmail.com>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/ppc/spapr_nvdimm.c | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/hw/ppc/spapr_nvdimm.c b/hw/ppc/spapr_nvdimm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ppc/spapr_nvdimm.c
+++ b/hw/ppc/spapr_nvdimm.c
@@ -XXX,XX +XXX,XX @@ static int flush_worker_cb(void *opaque)
 {
     SpaprNVDIMMDeviceFlushState *state = opaque;
     SpaprDrc *drc = spapr_drc_by_index(state->drcidx);
-    PCDIMMDevice *dimm = PC_DIMM(drc->dev);
-    HostMemoryBackend *backend = MEMORY_BACKEND(dimm->hostmem);
-    int backend_fd = memory_region_get_fd(&backend->mr);
+    PCDIMMDevice *dimm;
+    HostMemoryBackend *backend;
+    int backend_fd;
+
+    g_assert(drc != NULL);
+
+    dimm = PC_DIMM(drc->dev);
+    backend = MEMORY_BACKEND(dimm->hostmem);
+    backend_fd = memory_region_get_fd(&backend->mr);
 
     if (object_property_get_bool(OBJECT(backend), "pmem", NULL)) {
         MemoryRegion *mr = host_memory_backend_get_memory(dimm->hostmem);
@@ -XXX,XX +XXX,XX @@ static void spapr_nvdimm_flush_completion_cb(void *opaque, int hcall_ret)
 {
     SpaprNVDIMMDeviceFlushState *state = opaque;
     SpaprDrc *drc = spapr_drc_by_index(state->drcidx);
-    SpaprNVDIMMDevice *s_nvdimm = SPAPR_NVDIMM(drc->dev);
+    SpaprNVDIMMDevice *s_nvdimm;
+
+    g_assert(drc != NULL);
+
+    s_nvdimm = SPAPR_NVDIMM(drc->dev);
 
     state->hcall_ret = hcall_ret;
     QLIST_REMOVE(state, node);
-- 
2.36.1

From: Peter Maydell <peter.maydell@linaro.org>

In dcr_write_dma(), there is code that uses cpu_physical_memory_map()
to implement a DMA transfer.  That function takes a 'plen' argument,
which points to a hwaddr which is used for both input and output: the
caller must set it to the size of the range it wants to map, and on
return it is updated to the actual length mapped. The dcr_write_dma()
code fails to initialize rlen and wlen, so will end up mapping an
unpredictable amount of memory.

Initialize the length values correctly, and check that we managed to
map the entire range before using the fast-path memmove().

This was spotted by Coverity, which points out that we never
initialized the variables before using them.

Fixes: Coverity CID 1487137, 1487150
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220726182341.1888115-2-peter.maydell@linaro.org>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/ppc/ppc440_uc.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/hw/ppc/ppc440_uc.c b/hw/ppc/ppc440_uc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ppc/ppc440_uc.c
+++ b/hw/ppc/ppc440_uc.c
@@ -XXX,XX +XXX,XX @@ static void dcr_write_dma(void *opaque, int dcrn, uint32_t val)
                     int width, i, sidx, didx;
                     uint8_t *rptr, *wptr;
                     hwaddr rlen, wlen;
+                    hwaddr xferlen;
 
                     sidx = didx = 0;
                     width = 1 << ((val & DMA0_CR_PW) >> 25);
+                    xferlen = count * width;
+                    wlen = rlen = xferlen;
                     rptr = cpu_physical_memory_map(dma->ch[chnl].sa, &rlen,
                                                    false);
                     wptr = cpu_physical_memory_map(dma->ch[chnl].da, &wlen,
                                                    true);
-                    if (rptr && wptr) {
+                    if (rptr && rlen == xferlen && wptr && wlen == xferlen) {
                         if (!(val & DMA0_CR_DEC) &&
                             val & DMA0_CR_SAI && val & DMA0_CR_DAI) {
                             /* optimise common case */
-- 
2.36.1

From: Nicholas Piggin <npiggin@gmail.com>

ISA v2.06 adds new variations of wait, specified by the WC field. These
are not all compatible with the prior wait implementation, because they
add additional conditions that cause the processor to resume, which can
cause software to hang or run very slowly.

At this moment, with the current wait implementation and a pseries guest
using mainline kernel with new wait upcodes [1], QEMU hangs during boot if
more than one CPU is present:

qemu-system-ppc64 -M pseries,x-vof=on -cpu POWER10 -smp 2 -nographic
-kernel zImage.pseries -no-reboot

QEMU will exit (as there's no filesystem) if the test "passes", or hang
during boot if it hits the bug.

ISA v3.0 changed the wait opcode and removed the new variants (retaining
the WC field but making non-zero values reserved).

ISA v3.1 added new WC values to the new wait opcode, and added a PL
field.

This patch implements the new wait encoding and supports WC variants
with no-op implementations, which provides basic correctness as
explained in comments.

[1] https://lore.kernel.org/all/20220720132132.903462-1-npiggin@gmail.com/

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Víctor Colombo <victor.colombo@eldorado.org.br>
Tested-by: Joel Stanley <joel@jms.id.au>
Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Message-Id: <20220720133352.904263-1-npiggin@gmail.com>
[danielhb: added information about the bug being fixed]
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 target/ppc/internal.h  |  3 ++
 target/ppc/translate.c | 96 ++++++++++++++++++++++++++++++++++++++----
 2 files changed, 91 insertions(+), 8 deletions(-)

diff --git a/target/ppc/internal.h b/target/ppc/internal.h
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/internal.h
+++ b/target/ppc/internal.h
@@ -XXX,XX +XXX,XX @@ EXTRACT_HELPER_SPLIT_3(DX, 10, 6, 6, 5, 16, 1, 1, 0, 0)
 /* darn */
 EXTRACT_HELPER(L, 16, 2);
 #endif
+/* wait */
+EXTRACT_HELPER(WC, 21, 2);
+EXTRACT_HELPER(PL, 16, 2);
 
 /***                            Jump target decoding                       ***/
 /* Immediate address */
diff --git a/target/ppc/translate.c b/target/ppc/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/translate.c
+++ b/target/ppc/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_sync(DisasContext *ctx)
 /* wait */
 static void gen_wait(DisasContext *ctx)
 {
-    TCGv_i32 t0 = tcg_const_i32(1);
-    tcg_gen_st_i32(t0, cpu_env,
-                   -offsetof(PowerPCCPU, env) + offsetof(CPUState, halted));
-    tcg_temp_free_i32(t0);
-    /* Stop translation, as the CPU is supposed to sleep from now */
-    gen_exception_nip(ctx, EXCP_HLT, ctx->base.pc_next);
+    uint32_t wc;
+
+    if (ctx->insns_flags & PPC_WAIT) {
+        /* v2.03-v2.07 define an older incompatible 'wait' encoding. */
+
+        if (ctx->insns_flags2 & PPC2_PM_ISA206) {
+            /* v2.06 introduced the WC field. WC > 0 may be treated as no-op. */
+            wc = WC(ctx->opcode);
+        } else {
+            wc = 0;
+        }
+
+    } else if (ctx->insns_flags2 & PPC2_ISA300) {
+        /* v3.0 defines a new 'wait' encoding. */
+        wc = WC(ctx->opcode);
+        if (ctx->insns_flags2 & PPC2_ISA310) {
+            uint32_t pl = PL(ctx->opcode);
+
+            /* WC 1,2 may be treated as no-op. WC 3 is reserved. */
+            if (wc == 3) {
+                gen_invalid(ctx);
+                return;
+            }
+
+            /* PL 1-3 are reserved. If WC=2 then the insn is treated as noop. */
+            if (pl > 0 && wc != 2) {
+                gen_invalid(ctx);
+                return;
+            }
+
+        } else { /* ISA300 */
+            /* WC 1-3 are reserved */
+            if (wc > 0) {
+                gen_invalid(ctx);
+                return;
+            }
+        }
+
+    } else {
+        warn_report("wait instruction decoded with wrong ISA flags.");
+        gen_invalid(ctx);
+        return;
+    }
+
+    /*
+     * wait without WC field or with WC=0 waits for an exception / interrupt
+     * to occur.
+     */
+    if (wc == 0) {
+        TCGv_i32 t0 = tcg_const_i32(1);
+        tcg_gen_st_i32(t0, cpu_env,
+                       -offsetof(PowerPCCPU, env) + offsetof(CPUState, halted));
+        tcg_temp_free_i32(t0);
+        /* Stop translation, as the CPU is supposed to sleep from now */
+        gen_exception_nip(ctx, EXCP_HLT, ctx->base.pc_next);
+    }
+
+    /*
+     * Other wait types must not just wait until an exception occurs because
+     * ignoring their other wake-up conditions could cause a hang.
+     *
+     * For v2.06 and 2.07, wc=1,2,3 are architected but may be implemented as
+     * no-ops.
+     *
+     * wc=1 and wc=3 explicitly allow the instruction to be treated as a no-op.
+     *
+     * wc=2 waits for an implementation-specific condition, such could be
+     * always true, so it can be implemented as a no-op.
+     *
+     * For v3.1, wc=1,2 are architected but may be implemented as no-ops.
+     *
+     * wc=1 (waitrsv) waits for an exception or a reservation to be lost.
+     * Reservation-loss may have implementation-specific conditions, so it
+     * can be implemented as a no-op.
+     *
+     * wc=2 waits for an exception or an amount of time to pass. This
+     * amount is implementation-specific so it can be implemented as a
+     * no-op.
+     *
+     * ISA v3.1 allows for execution to resume "in the rare case of
+     * an implementation-dependent event", so in any case software must
+     * not depend on the architected resumption condition to become
+     * true, so no-op implementations should be architecturally correct
+     * (if suboptimal).
+     */
 }
 
 #if defined(TARGET_PPC64)
@@ -XXX,XX +XXX,XX @@ GEN_HANDLER2(stdcx_, "stdcx.", 0x1F, 0x16, 0x06, 0x00000000, PPC_64B),
 GEN_HANDLER_E(stqcx_, 0x1F, 0x16, 0x05, 0, PPC_NONE, PPC2_LSQ_ISA207),
 #endif
 GEN_HANDLER(sync, 0x1F, 0x16, 0x12, 0x039FF801, PPC_MEM_SYNC),
-GEN_HANDLER(wait, 0x1F, 0x1E, 0x01, 0x03FFF801, PPC_WAIT),
-GEN_HANDLER_E(wait, 0x1F, 0x1E, 0x00, 0x039FF801, PPC_NONE, PPC2_ISA300),
+/* ISA v3.0 changed the extended opcode from 62 to 30 */
+GEN_HANDLER(wait, 0x1F, 0x1E, 0x01, 0x039FF801, PPC_WAIT),
+GEN_HANDLER_E(wait, 0x1F, 0x1E, 0x00, 0x039CF801, PPC_NONE, PPC2_ISA300),
 GEN_HANDLER(b, 0x12, 0xFF, 0xFF, 0x00000000, PPC_FLOW),
 GEN_HANDLER(bc, 0x10, 0xFF, 0xFF, 0x00000000, PPC_FLOW),
 GEN_HANDLER(bcctr, 0x13, 0x10, 0x10, 0x00000000, PPC_FLOW),
-- 
2.36.1

The following changes since commit 76b56fdfc9fa43ec6e5986aee33f108c6c6a511e:

Merge tag 'block-pull-request' of https://gitlab.com/stefanha/qemu into staging (2021-12-14 12:46:18 -0800)

are available in the Git repository at:

https://github.com/legoater/qemu/ tags/pull-ppc-20211217

for you to fetch changes up to 0e6232bc3cb96bdf6fac1b5d7659aa9887afe657:

ppc/pnv: Use QOM hierarchy to scan PEC PHB4 devices (2021-12-17 17:57:19 +0100)

Changes in v3:

- Fixed patch "docs: Introducing pseries documentation" with a newline
   and checked documentation generation with :

make docker-test-build@ubuntu1804 TARGET_LIST=i386-softmmu

Changes in v2:

- Fixed patch "docs: rSTify ppc-spapr-hcalls.txt" with a newline
 - dropped patch "target/ppc: do not silence SNaN in xscvspdpn" which
   still had some comments pending.

----------------------------------------------------------------
ppc 7.0 queue:

* General cleanup for Mac machines (Peter)
* Fixes for FPU exceptions (Lucas)
* Support for new ISA31 instructions (Matheus)
* Fixes for ivshmem (Daniel)
* Cleanups for PowerNV PHB (Christophe and Cedric)
* Updates of PowerNV and pSeries documentation (Leonardo and Daniel)
* Fixes for PowerNV (Daniel)
* Large cleanup of FPU implementation (Richard)
* Removal of SoftTLBs support for PPC74x CPUs (Fabiano)
* Fixes for exception models in MPCx and 60x CPUs (Fabiano)
* Removal of 401/403 CPUs (Cedric)
* Deprecation of taihu machine (Thomas)
* Large rework of PPC405 machine (Cedric)
* Fixes for VSX instructions (Victor and Matheus)
* Fix for e6500 CPU (Fabiano)
* Initial support for PMU (Daniel)

----------------------------------------------------------------
Alexey Kardashevskiy (1):
      pseries: Update SLOF firmware image

Christophe Lombard (1):
      pci-host: Allow extended config space access for PowerNV PHB4 model

Cédric Le Goater (28):
      Merge tag 'qemu-slof-20211112' of github.com:aik/qemu into ppc-next
      target/ppc: remove 401/403 CPUs
      ppc/ppc405: Change kernel load address
      ppc: Add trace-events for DCR accesses
      ppc/ppc405: Convert printfs to trace-events
      ppc/ppc405: Drop flag parameter in ppc405_set_bootinfo()
      ppc/ppc405: Change ppc405ep_init() return value
      ppc/ppc405: Add some address space definitions
      ppc/ppc405: Remove flash support
      ppc/ppc405: Rework FW load
      ppc/ppc405: Introduce ppc405_set_default_bootinfo()
      ppc/ppc405: Fix boot from kernel
      ppc/ppc405: Change default PLL values at reset
      ppc/ppc405: Fix bi_pci_enetaddr2 field in U-Boot board information
      ppc/ppc405: Add update of bi_procfreq field
      ppc/pnv: Introduce a "chip" property under PHB3
      ppc/pnv: Use the chip class to check the index of PHB3 devices
      ppc/pnv: Drop the "num-phbs" property
      ppc/pnv: Move mapping of the PHB3 CQ regions under pnv_pbcq_realize()
      ppc/pnv: Use QOM hierarchy to scan PHB3 devices
      ppc/pnv: Introduce a num_pecs class attribute for PHB4 PEC devices
      ppc/pnv: Introduce version and device_id class atributes for PHB4 devices
      ppc/pnv: Introduce a "chip" property under the PHB4 model
      ppc/pnv: Introduce a num_stack class attribute
      ppc/pnv: Compute the PHB index from the PHB4 PEC model
      ppc/pnv: Remove "system-memory" property from PHB4 PEC
      ppc/pnv: Move realize of PEC stacks under the PEC model
      ppc/pnv: Use QOM hierarchy to scan PEC PHB4 devices

Daniel Henrique Barboza (13):
      ivshmem.c: change endianness to LITTLE_ENDIAN
      ivshmem-test.c: enable test_ivshmem_server for ppc64 arch
      ppc/pnv.c: add a friendly warning when accel=kvm is used
      docs/system/ppc/powernv.rst: document KVM support status
      ppc/pnv.c: fix "system-id" FDT when -uuid is set
      target/ppc: introduce PMUEventType and PMU overflow timers
      target/ppc: PMU basic cycle count for pseries TCG
      target/ppc: PMU: update counters on PMCs r/w
      target/ppc: PMU: update counters on MMCR1 write
      target/ppc: enable PMU counter overflow with cycle events
      target/ppc: enable PMU instruction count
      target/ppc/power8-pmu.c: add PM_RUN_INST_CMPL (0xFA) event
      PPC64/TCG: Implement 'rfebb' instruction

Fabiano Rosas (8):
      target/ppc: Disable software TLB for the 7450 family
      target/ppc: Disable unused facilities in the e600 CPU
      target/ppc: Remove the software TLB model of 7450 CPUs
      target/ppc: Fix MPCxxx FPU interrupt address
      target/ppc: Remove 603e exception model
      target/ppc: Set 601v exception model id
      target/ppc: Fix e6500 boot
      Revert "target/ppc: Move SPR_DSISR setting to powerpc_excp"

Leonardo Garcia (5):
      docs: Minor updates on the powernv documentation.
      docs: Introducing pseries documentation.
      docs: rSTify ppc-spapr-hcalls.txt
      docs: Rename ppc-spapr-hcalls.txt to ppc-spapr-hcalls.rst.
      Link new ppc-spapr-hcalls.rst file to pseries.rst.

Lucas Mateus Castro (alqotel) (3):
      target/ppc: Fixed call to deferred exception
      test/tcg/ppc64le: test mtfsf
      target/ppc: ppc_store_fpscr doesn't update bits 0 to 28 and 52

Matheus Ferst (5):
      target/ppc: Implement Vector Expand Mask
      target/ppc: Implement Vector Extract Mask
      target/ppc: Implement Vector Mask Move insns
      target/ppc: fix xscvqpdp register access
      target/ppc: move xscvqpdp to decodetree

Peter Maydell (1):
      hw/ppc/mac.h: Remove MAX_CPUS macro

Richard Henderson (34):
      softfloat: Extend float_exception_flags to 16 bits
      softfloat: Add flag specific to Inf - Inf
      softfloat: Add flag specific to Inf * 0
      softfloat: Add flags specific to Inf / Inf and 0 / 0
      softfloat: Add flag specific to sqrt(-x)
      softfloat: Add flag specific to convert non-nan to int
      softfloat: Add flag specific to signaling nans
      target/ppc: Update float_invalid_op_addsub for new flags
      target/ppc: Update float_invalid_op_mul for new flags
      target/ppc: Update float_invalid_op_div for new flags
      target/ppc: Move float_check_status from FPU_FCTI to translate
      target/ppc: Update float_invalid_cvt for new flags
      target/ppc: Fix VXCVI return value
      target/ppc: Remove inline from do_fri
      target/ppc: Use FloatRoundMode in do_fri
      target/ppc: Tidy inexact handling in do_fri
      target/ppc: Clean up do_fri
      target/ppc: Update fmadd for new flags
      target/ppc: Split out do_fmadd
      target/ppc: Do not call do_float_check_status from do_fmadd
      target/ppc: Split out do_frsp
      target/ppc: Update do_frsp for new flags
      target/ppc: Use helper_todouble in do_frsp
      target/ppc: Update sqrt for new flags
      target/ppc: Update xsrqpi and xsrqpxp to new flags
      target/ppc: Update fre to new flags
      softfloat: Add float64r32 arithmetic routines
      target/ppc: Add helpers for fmadds et al
      target/ppc: Add helper for fsqrts
      target/ppc: Add helpers for fadds, fsubs, fdivs
      target/ppc: Add helper for fmuls
      target/ppc: Add helper for frsqrtes
      target/ppc: Update fres to new flags and float64r32
      target/ppc: Use helper_todouble/tosingle in helper_xststdcsp

Thomas Huth (1):
      ppc: Mark the 'taihu' machine as deprecated

Victor Colombo (2):
      target/ppc: Fix xs{max, min}[cj]dp to use VSX registers
      target/ppc: Move xs{max,min}[cj]dp to decodetree