Rather than waiting for the completion of migration on the source side,
wait for it on the destination QEMU side to avoid accessing the TPM TIS
memory mapped registers before QEMU could restore their state. This
error condition could be triggered on busy systems where the destination
QEMU did not have enough time to restore the TIS state while the test case
was already reading its registers. The test case was for example reading
the STS register and received an unexpected value (0xffffffff), which
lead to a segmentation fault later on due to trying to read 0xffff bytes
from the TIS into a buffer.

Cc: qemu-stable@nongnu.org
Reported-by: Fabiano Rosas <farosas@suse.de>
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
---
 tests/qtest/tpm-tests.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/qtest/tpm-tests.c b/tests/qtest/tpm-tests.c
index fb94496bbd..197714f8d9 100644
--- a/tests/qtest/tpm-tests.c
+++ b/tests/qtest/tpm-tests.c
@@ -114,7 +114,7 @@ void tpm_test_swtpm_migration_test(const char *src_tpm_path,
                      sizeof(tpm_pcrread_resp));
 
     tpm_util_migrate(src_qemu, uri);
-    tpm_util_wait_for_migration_complete(src_qemu);
+    tpm_util_wait_for_migration_complete(dst_qemu);
 
     tpm_util_pcrread(dst_qemu, tx, tpm_pcrread_resp,
                      sizeof(tpm_pcrread_resp));
-- 
2.47.0

16.10.2024 18:21, Stefan Berger wrote:
> Rather than waiting for the completion of migration on the source side,
> wait for it on the destination QEMU side to avoid accessing the TPM TIS
> memory mapped registers before QEMU could restore their state. This
> error condition could be triggered on busy systems where the destination
> QEMU did not have enough time to restore the TIS state while the test case
> was already reading its registers. The test case was for example reading
> the STS register and received an unexpected value (0xffffffff), which
> lead to a segmentation fault later on due to trying to read 0xffff bytes
> from the TIS into a buffer.
> 
> Cc: qemu-stable@nongnu.org
> Reported-by: Fabiano Rosas <farosas@suse.de>
> Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>

Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>

Queued for qemu-stable, though this one might better be applied through
the test tree.

Thanks,

/mjt

On 10/18/24 12:23 PM, Michael Tokarev wrote:
> 16.10.2024 18:21, Stefan Berger wrote:
>> Rather than waiting for the completion of migration on the source side,
>> wait for it on the destination QEMU side to avoid accessing the TPM TIS
>> memory mapped registers before QEMU could restore their state. This
>> error condition could be triggered on busy systems where the destination
>> QEMU did not have enough time to restore the TIS state while the test 
>> case
>> was already reading its registers. The test case was for example reading
>> the STS register and received an unexpected value (0xffffffff), which
>> lead to a segmentation fault later on due to trying to read 0xffff bytes
>> from the TIS into a buffer.
>>
>> Cc: qemu-stable@nongnu.org
>> Reported-by: Fabiano Rosas <farosas@suse.de>
>> Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
> 
> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
> 
> Queued for qemu-stable, though this one might better be applied through
> the test tree.

Thanks.  I actually already sent it as part of my PR today...

> 
> Thanks,
> 
> /mjt

On Wed, Oct 16, 2024 at 11:21:59AM -0400, Stefan Berger wrote:
> Rather than waiting for the completion of migration on the source side,
> wait for it on the destination QEMU side to avoid accessing the TPM TIS
> memory mapped registers before QEMU could restore their state. This
> error condition could be triggered on busy systems where the destination
> QEMU did not have enough time to restore the TIS state while the test case
> was already reading its registers. The test case was for example reading
> the STS register and received an unexpected value (0xffffffff), which
> lead to a segmentation fault later on due to trying to read 0xffff bytes
> from the TIS into a buffer.
> 
> Cc: qemu-stable@nongnu.org
> Reported-by: Fabiano Rosas <farosas@suse.de>
> Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
> ---
>  tests/qtest/tpm-tests.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>


With regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|