From nobody Sun May 5 03:19:35 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=redhat.com Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1531905890939573.2156018506204; Wed, 18 Jul 2018 02:24:50 -0700 (PDT) Received: from localhost ([::1]:35543 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ffihQ-0008IM-A2 for importer@patchew.org; Wed, 18 Jul 2018 05:24:44 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:46537) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ffigM-0007tf-Cl for qemu-devel@nongnu.org; Wed, 18 Jul 2018 05:23:39 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ffigH-000871-Ff for qemu-devel@nongnu.org; Wed, 18 Jul 2018 05:23:38 -0400 Received: from mx3-rdu2.redhat.com ([66.187.233.73]:37292 helo=mx1.redhat.com) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1ffigH-00086o-AX; Wed, 18 Jul 2018 05:23:33 -0400 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.rdu2.redhat.com [10.11.54.4]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 8B3428315E; Wed, 18 Jul 2018 09:23:32 +0000 (UTC) Received: from t460s.redhat.com (ovpn-117-49.ams2.redhat.com [10.36.117.49]) by smtp.corp.redhat.com (Postfix) with ESMTP id D35B32026D69; Wed, 18 Jul 2018 09:23:30 +0000 (UTC) From: David Hildenbrand To: qemu-s390x@nongnu.org Date: Wed, 18 Jul 2018 11:23:30 +0200 Message-Id: <20180718092330.19465-1-david@redhat.com> X-Scanned-By: MIMEDefang 2.78 on 10.11.54.4 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.1]); Wed, 18 Jul 2018 09:23:32 +0000 (UTC) X-Greylist: inspected by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.1]); Wed, 18 Jul 2018 09:23:32 +0000 (UTC) for IP:'10.11.54.4' DOMAIN:'int-mx04.intmail.prod.int.rdu2.redhat.com' HELO:'smtp.corp.redhat.com' FROM:'david@redhat.com' RCPT:'' X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 66.187.233.73 Subject: [Qemu-devel] [PATCH v2] s390x/cpumodel: fix segmentation fault when baselining models X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Thomas Huth , Chris Venteicher , David Hildenbrand , Cornelia Huck , Alexander Graf , qemu-devel@nongnu.org, Christian Borntraeger , Collin Walling , Richard Henderson Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Usually, when baselining two CPU models, whereby one of them has base CPU features disabled (e.g. z14-base,msa=3Doff), we fallback to an older model that did not have these features in the base model. We always try to create a "sane" CPU model (as far as possible), and one part of it is that removing base features is no good and to be avoided. Now, if we disable base features that were part of a z900, we're out of luck. We won't find a CPU model and QEMU will segfault. This is a scenario that should never happen in real life, but it can be used to crash QEMU. So let's properly report an error if we baseline e.g.: { "execute": "query-cpu-model-baseline", "arguments" : { "modela": { "name": "z14-base", "props": {"esan3" : false= }}, "modelb": { "name": "z14"}} } Instead of segfaulting. Signed-off-by: David Hildenbrand Acked-by: Christian Borntraeger --- target/s390x/cpu_models.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c index cfdbccf46d..604898a882 100644 --- a/target/s390x/cpu_models.c +++ b/target/s390x/cpu_models.c @@ -716,6 +716,14 @@ CpuModelBaselineInfo *arch_query_cpu_model_baseline(Cp= uModelInfo *infoa, =20 model.def =3D s390_find_cpu_def(cpu_type, max_gen, max_gen_ga, model.features); + + /* models without early base features (esan3) are bad */ + if (!model.def) { + error_setg(errp, "No compatible CPU model could be created as" + " important base features are disabled"); + return NULL; + } + /* strip off features not part of the max model */ bitmap_and(model.features, model.features, model.def->full_feat, S390_FEAT_MAX); --=20 2.17.1