Merge ~paelzer/ubuntu/+source/qemu:lp-1894942-s390x-set_ind_atomic-BIONIC into ubuntu/+source/qemu:ubuntu/bionic-devel

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

PPA: https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/4270/+packages

[Lucas Kanashiro (lucaskanashiro)]

* Changelog:
  - [-] old content and logical tag match as expected
  - [√] changelog entry correct version and targeted codename
  - [√] changelog entries correct
  - [√] update-maintainer has been run

* Actual changes:
  - [√] no upstream changes to consider
  - [√] no further upstream version to consider
  - [√] debian changes look safe

* Old Delta:
  - [-] dropped changes are ok to be dropped
  - [√] nothing else to drop
  - [√] changes forwarded upstream/debian (if appropriate)

* New Delta:
  - [-] no new patches added
  - [√] patches match what was proposed upstream
  - [√] patches correctly included in debian/patches/series
  - [√] patches have correct DEP3 metadata

* Build/Test:
  - [√] build is ok
  - [√] verified PPA package installs/uninstalls
  - [-] autopkgtest against the PPA package passes
  - [√] sanity checks test fine

LGTM, +1. I think you did not trigger the autopkgtest run in bileto, right? I have not tried to run autopkgtest myself. Apart from that the changes are good to go.

review: Approve

[Christian Ehrhardt  (paelzer)]

qemu has no tests and no related packages worth pre-testing.
That is why I run the non-autopkgtest regression test suite (to be actually able to use KVM well).
That was fine.

Thanks for the review.

[Christian Ehrhardt  (paelzer)]

To ssh://git.launchpad.net/~usd-import-team/ubuntu/+source/qemu
 * [new tag] upload/1%2.11+dfsg-1ubuntu7.33 -> upload/1%2.11+dfsg-1ubuntu7.33

Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading qemu_2.11+dfsg-1ubuntu7.33.dsc: done.
  Uploading qemu_2.11+dfsg-1ubuntu7.33.debian.tar.xz: done.
  Uploading qemu_2.11+dfsg-1ubuntu7.33_source.buildinfo: done.
  Uploading qemu_2.11+dfsg-1ubuntu7.33_source.changes: done.
Successfully uploaded packages.

diff --git a/debian/changelog b/debian/changelog
index f1b8606..3dce226 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,9 @@
+qemu (1:2.11+dfsg-1ubuntu7.33) bionic; urgency=medium
+
+  * d/p/u/lp-1894942-*: fix virtio-ccw host/guest notification (LP: #1894942)
+
+ -- Christian Ehrhardt <[e-mail]>  Mon, 21 Sep 2020 15:39:32 +0200
+
 qemu (1:2.11+dfsg-1ubuntu7.32) bionic-security; urgency=medium
 
   * SECURITY UPDATE: out-of-bounds read/write in USB emulator
diff --git a/debian/patches/series b/debian/patches/series
index 36bef7e..191b104 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -178,3 +178,5 @@ CVE-2020-12829-5.patch
 CVE-2020-12829-6.patch
 CVE-2020-12829-7.patch
 CVE-2020-14364.patch
+ubuntu/lp-1894942-virtio-ccw-fix-virtio_set_ind_atomic.patch
+ubuntu/lp-1894942-s390x-pci-fix-set_ind_atomic.patch
diff --git a/debian/patches/ubuntu/lp-1894942-s390x-pci-fix-set_ind_atomic.patch b/debian/patches/ubuntu/lp-1894942-s390x-pci-fix-set_ind_atomic.patch
new file mode 100644
index 0000000..90fd589
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1894942-s390x-pci-fix-set_ind_atomic.patch
@@ -0,0 +1,67 @@
+From 45175361f1bfc2d3ccdcb4b22570c2352f3de754 Mon Sep 17 00:00:00 2001
+From: Halil Pasic <[e-mail]>
+Date: Tue, 16 Jun 2020 06:50:35 +0200
+Subject: [PATCH] s390x/pci: fix set_ind_atomic
+
+The atomic_cmpxchg() loop is broken because we occasionally end up with
+old and _old having different values (a legit compiler can generate code
+that accessed *ind_addr again to pick up a value for _old instead of
+using the value of old that was already fetched according to the
+rules of the abstract machine). This means the underlying CS instruction
+may use a different old (_old) than the one we intended to use if
+atomic_cmpxchg() performed the xchg part.
+
+Let us use volatile to force the rules of the abstract machine for
+accesses to *ind_addr. Let us also rewrite the loop so, we that the
+new old is used to compute the new desired value if the xchg part
+is not performed.
+
+Fixes: 8cba80c3a0 ("s390: Add PCI bus support")
+Reported-by: Christian Borntraeger <[e-mail]>
+Signed-off-by: Halil Pasic <[e-mail]>
+Reviewed-by: Christian Borntraeger <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: Cornelia Huck <[e-mail]>
+
+Origin: backport, https://git.qemu.org/?p=qemu.git;a=commit;h=45175361f1
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1894942
+Last-Update: 2020-09-21
+
+---
+ hw/s390x/s390-pci-bus.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+--- a/hw/s390x/s390-pci-bus.c
++++ b/hw/s390x/s390-pci-bus.c
+@@ -637,22 +637,24 @@ static AddressSpace *s390_pci_dma_iommu(
+ 
+ static uint8_t set_ind_atomic(uint64_t ind_loc, uint8_t to_be_set)
+ {
+-    uint8_t ind_old, ind_new;
++    uint8_t expected, actual;
+     hwaddr len = 1;
+-    uint8_t *ind_addr;
++    /* avoid  multiple fetches */
++    uint8_t volatile *ind_addr;
+ 
+     ind_addr = cpu_physical_memory_map(ind_loc, &len, 1);
+     if (!ind_addr) {
+         s390_pci_generate_error_event(ERR_EVENT_AIRERR, 0, 0, 0, 0);
+         return -1;
+     }
++    actual = *ind_addr;
+     do {
+-        ind_old = *ind_addr;
+-        ind_new = ind_old | to_be_set;
+-    } while (atomic_cmpxchg(ind_addr, ind_old, ind_new) != ind_old);
+-    cpu_physical_memory_unmap(ind_addr, len, 1, len);
++        expected = actual;
++        actual = atomic_cmpxchg(ind_addr, expected, expected | to_be_set);
++    } while (actual != expected);
++    cpu_physical_memory_unmap((void *)ind_addr, len, 1, len);
+ 
+-    return ind_old;
++    return actual;
+ }
+ 
+ static void s390_msi_ctrl_write(void *opaque, hwaddr addr, uint64_t data,
diff --git a/debian/patches/ubuntu/lp-1894942-virtio-ccw-fix-virtio_set_ind_atomic.patch b/debian/patches/ubuntu/lp-1894942-virtio-ccw-fix-virtio_set_ind_atomic.patch
new file mode 100644
index 0000000..df9fac2
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1894942-virtio-ccw-fix-virtio_set_ind_atomic.patch
@@ -0,0 +1,70 @@
+From 1a8242f7c3f53341dd66253b142ecd06ce1d2a97 Mon Sep 17 00:00:00 2001
+From: Halil Pasic <[e-mail]>
+Date: Tue, 16 Jun 2020 06:50:34 +0200
+Subject: [PATCH] virtio-ccw: fix virtio_set_ind_atomic
+
+The atomic_cmpxchg() loop is broken because we occasionally end up with
+old and _old having different values (a legit compiler can generate code
+that accessed *ind_addr again to pick up a value for _old instead of
+using the value of old that was already fetched according to the
+rules of the abstract machine). This means the underlying CS instruction
+may use a different old (_old) than the one we intended to use if
+atomic_cmpxchg() performed the xchg part.
+
+Let us use volatile to force the rules of the abstract machine for
+accesses to *ind_addr. Let us also rewrite the loop so, we that the
+new old is used to compute the new desired value if the xchg part
+is not performed.
+
+Fixes: 7e7494627f ("s390x/virtio-ccw: Adapter interrupt support.")
+Reported-by: Andre Wild <[e-mail]>
+Signed-off-by: Halil Pasic <[e-mail]>
+Reviewed-by: Christian Borntraeger <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: Cornelia Huck <[e-mail]>
+
+Origin: backport, https://git.qemu.org/?p=qemu.git;a=commit;h=1a8242f7c3
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1894942
+Last-Update: 2020-09-21
+
+---
+ hw/s390x/virtio-ccw.c | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+--- a/hw/s390x/virtio-ccw.c
++++ b/hw/s390x/virtio-ccw.c
+@@ -786,9 +786,10 @@ static inline VirtioCcwDevice *to_virtio
+ static uint8_t virtio_set_ind_atomic(SubchDev *sch, uint64_t ind_loc,
+                                      uint8_t to_be_set)
+ {
+-    uint8_t ind_old, ind_new;
++    uint8_t expected, actual;
+     hwaddr len = 1;
+-    uint8_t *ind_addr;
++    /* avoid  multiple fetches */
++    uint8_t volatile *ind_addr;
+ 
+     ind_addr = cpu_physical_memory_map(ind_loc, &len, 1);
+     if (!ind_addr) {
+@@ -796,14 +797,15 @@ static uint8_t virtio_set_ind_atomic(Sub
+                      __func__, sch->cssid, sch->ssid, sch->schid);
+         return -1;
+     }
++    actual = *ind_addr;
+     do {
+-        ind_old = *ind_addr;
+-        ind_new = ind_old | to_be_set;
+-    } while (atomic_cmpxchg(ind_addr, ind_old, ind_new) != ind_old);
+-    trace_virtio_ccw_set_ind(ind_loc, ind_old, ind_new);
+-    cpu_physical_memory_unmap(ind_addr, len, 1, len);
++        expected = actual;
++        actual = atomic_cmpxchg(ind_addr, expected, expected | to_be_set);
++    } while (actual != expected);
++    trace_virtio_ccw_set_ind(ind_loc, actual, actual | to_be_set);
++    cpu_physical_memory_unmap((void *)ind_addr, len, 1, len);
+ 
+-    return ind_old;
++    return actual;
+ }
+ 
+ static void virtio_ccw_notify(DeviceState *d, uint16_t vector)