Merge ~paelzer/ubuntu/+source/qemu:lp-1894942-fix-vfio-ccw-notifications into ubuntu/+source/qemu:ubuntu/groovy-devel

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

PPA: https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/4257/+packages

[Andreas Hasenack (ahasenack)]

LGTM, +1

review: Approve

[Christian Ehrhardt  (paelzer)]

Thanks, uploading ...

* [new tag] upload/1%5.0-5ubuntu7 -> upload/1%5.0-5ubuntu7

Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading qemu_5.0-5ubuntu7.dsc: done.
  Uploading qemu_5.0-5ubuntu7.debian.tar.xz: done.
  Uploading qemu_5.0-5ubuntu7_source.buildinfo: done.
  Uploading qemu_5.0-5ubuntu7_source.changes: done.
Successfully uploaded packages.

diff --git a/debian/changelog b/debian/changelog
index 46216b9..f62401c 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,9 @@
+qemu (1:5.0-5ubuntu7) groovy; urgency=medium
+
+  * d/p/u/lp-1894942-*: fix virtio-ccw host/guest notification (LP: #1894942)
+
+ -- Christian Ehrhardt <[e-mail]>  Wed, 09 Sep 2020 08:47:12 +0200
+
 qemu (1:5.0-5ubuntu6) groovy; urgency=medium
 
   * d/p/ubuntu/lp-1887935-vfio-ccw-allow-non-prefetch-ORBs.patch: fix boot
diff --git a/debian/patches/series b/debian/patches/series
index e9e2ae1..b392cae 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -81,3 +81,5 @@ ubuntu/lp1890881-linux-user-deal-with-address-wrap-for-ARM_COMMPAGE-o.patch
 ubuntu/lp1890881-linux-user-elfload-use-MAP_FIXED_NOREPLACE-in-pgb_re.patch
 ubuntu/lp1890881-linux-user-don-t-use-MAP_FIXED-in-pgd_find_hole_fall.patch
 ubuntu/lp-1887935-vfio-ccw-allow-non-prefetch-ORBs.patch
+ubuntu/lp-1894942-virtio-ccw-fix-virtio_set_ind_atomic.patch
+ubuntu/lp-1894942-s390x-pci-fix-set_ind_atomic.patch
diff --git a/debian/patches/ubuntu/lp-1894942-s390x-pci-fix-set_ind_atomic.patch b/debian/patches/ubuntu/lp-1894942-s390x-pci-fix-set_ind_atomic.patch
new file mode 100644
index 0000000..4211f67
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1894942-s390x-pci-fix-set_ind_atomic.patch
@@ -0,0 +1,72 @@
+From 45175361f1bfc2d3ccdcb4b22570c2352f3de754 Mon Sep 17 00:00:00 2001
+From: Halil Pasic <[e-mail]>
+Date: Tue, 16 Jun 2020 06:50:35 +0200
+Subject: [PATCH] s390x/pci: fix set_ind_atomic
+
+The atomic_cmpxchg() loop is broken because we occasionally end up with
+old and _old having different values (a legit compiler can generate code
+that accessed *ind_addr again to pick up a value for _old instead of
+using the value of old that was already fetched according to the
+rules of the abstract machine). This means the underlying CS instruction
+may use a different old (_old) than the one we intended to use if
+atomic_cmpxchg() performed the xchg part.
+
+Let us use volatile to force the rules of the abstract machine for
+accesses to *ind_addr. Let us also rewrite the loop so, we that the
+new old is used to compute the new desired value if the xchg part
+is not performed.
+
+Fixes: 8cba80c3a0 ("s390: Add PCI bus support")
+Reported-by: Christian Borntraeger <[e-mail]>
+Signed-off-by: Halil Pasic <[e-mail]>
+Reviewed-by: Christian Borntraeger <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: Cornelia Huck <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=45175361f1
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1894942
+Last-Update: 2020-09-09
+
+---
+ hw/s390x/s390-pci-bus.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/hw/s390x/s390-pci-bus.c b/hw/s390x/s390-pci-bus.c
+index 142e52a8ff..736965c928 100644
+--- a/hw/s390x/s390-pci-bus.c
++++ b/hw/s390x/s390-pci-bus.c
+@@ -637,22 +637,24 @@ static AddressSpace *s390_pci_dma_iommu(PCIBus *bus, void *opaque, int devfn)
+ 
+ static uint8_t set_ind_atomic(uint64_t ind_loc, uint8_t to_be_set)
+ {
+-    uint8_t ind_old, ind_new;
++    uint8_t expected, actual;
+     hwaddr len = 1;
+-    uint8_t *ind_addr;
++    /* avoid  multiple fetches */
++    uint8_t volatile *ind_addr;
+ 
+     ind_addr = cpu_physical_memory_map(ind_loc, &len, true);
+     if (!ind_addr) {
+         s390_pci_generate_error_event(ERR_EVENT_AIRERR, 0, 0, 0, 0);
+         return -1;
+     }
++    actual = *ind_addr;
+     do {
+-        ind_old = *ind_addr;
+-        ind_new = ind_old | to_be_set;
+-    } while (atomic_cmpxchg(ind_addr, ind_old, ind_new) != ind_old);
+-    cpu_physical_memory_unmap(ind_addr, len, 1, len);
++        expected = actual;
++        actual = atomic_cmpxchg(ind_addr, expected, expected | to_be_set);
++    } while (actual != expected);
++    cpu_physical_memory_unmap((void *)ind_addr, len, 1, len);
+ 
+-    return ind_old;
++    return actual;
+ }
+ 
+ static void s390_msi_ctrl_write(void *opaque, hwaddr addr, uint64_t data,
+-- 
+2.28.0
+
diff --git a/debian/patches/ubuntu/lp-1894942-virtio-ccw-fix-virtio_set_ind_atomic.patch b/debian/patches/ubuntu/lp-1894942-virtio-ccw-fix-virtio_set_ind_atomic.patch
new file mode 100644
index 0000000..0a3a568
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1894942-virtio-ccw-fix-virtio_set_ind_atomic.patch
@@ -0,0 +1,75 @@
+From 1a8242f7c3f53341dd66253b142ecd06ce1d2a97 Mon Sep 17 00:00:00 2001
+From: Halil Pasic <[e-mail]>
+Date: Tue, 16 Jun 2020 06:50:34 +0200
+Subject: [PATCH] virtio-ccw: fix virtio_set_ind_atomic
+
+The atomic_cmpxchg() loop is broken because we occasionally end up with
+old and _old having different values (a legit compiler can generate code
+that accessed *ind_addr again to pick up a value for _old instead of
+using the value of old that was already fetched according to the
+rules of the abstract machine). This means the underlying CS instruction
+may use a different old (_old) than the one we intended to use if
+atomic_cmpxchg() performed the xchg part.
+
+Let us use volatile to force the rules of the abstract machine for
+accesses to *ind_addr. Let us also rewrite the loop so, we that the
+new old is used to compute the new desired value if the xchg part
+is not performed.
+
+Fixes: 7e7494627f ("s390x/virtio-ccw: Adapter interrupt support.")
+Reported-by: Andre Wild <[e-mail]>
+Signed-off-by: Halil Pasic <[e-mail]>
+Reviewed-by: Christian Borntraeger <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: Cornelia Huck <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=1a8242f7c3
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1894942
+Last-Update: 2020-09-09
+
+---
+ hw/s390x/virtio-ccw.c | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c
+index c1f4bb1d33..3c988a000b 100644
+--- a/hw/s390x/virtio-ccw.c
++++ b/hw/s390x/virtio-ccw.c
+@@ -786,9 +786,10 @@ static inline VirtioCcwDevice *to_virtio_ccw_dev_fast(DeviceState *d)
+ static uint8_t virtio_set_ind_atomic(SubchDev *sch, uint64_t ind_loc,
+                                      uint8_t to_be_set)
+ {
+-    uint8_t ind_old, ind_new;
++    uint8_t expected, actual;
+     hwaddr len = 1;
+-    uint8_t *ind_addr;
++    /* avoid  multiple fetches */
++    uint8_t volatile *ind_addr;
+ 
+     ind_addr = cpu_physical_memory_map(ind_loc, &len, true);
+     if (!ind_addr) {
+@@ -796,14 +797,15 @@ static uint8_t virtio_set_ind_atomic(SubchDev *sch, uint64_t ind_loc,
+                      __func__, sch->cssid, sch->ssid, sch->schid);
+         return -1;
+     }
++    actual = *ind_addr;
+     do {
+-        ind_old = *ind_addr;
+-        ind_new = ind_old | to_be_set;
+-    } while (atomic_cmpxchg(ind_addr, ind_old, ind_new) != ind_old);
+-    trace_virtio_ccw_set_ind(ind_loc, ind_old, ind_new);
+-    cpu_physical_memory_unmap(ind_addr, len, 1, len);
++        expected = actual;
++        actual = atomic_cmpxchg(ind_addr, expected, expected | to_be_set);
++    } while (actual != expected);
++    trace_virtio_ccw_set_ind(ind_loc, actual, actual | to_be_set);
++    cpu_physical_memory_unmap((void *)ind_addr, len, 1, len);
+ 
+-    return ind_old;
++    return actual;
+ }
+ 
+ static void virtio_ccw_notify(DeviceState *d, uint16_t vector)
+-- 
+2.28.0
+