From nobody Sat Nov 15 14:49:49 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass header.i=@intel.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1751006325; cv=none; d=zohomail.com; s=zohoarc; b=HcUXW89Ebbur7JYoVSwN/F04QL3zr8dOJPEmBdpFDeszD8ulmmpRVxkG0lFUKTgBf+u5UOuWgdC2kTik3qF7DUV6KL+c53y9QUGpRKbaNHvguWKQiGZ0J6LUTz5Ho28tOsIPmQQji0QAmo9zMkXGQH86tTVV86EJ7IetyDj26C4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1751006325; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=0Lo45MTiu+5iKWsVd/g6y9rJZ/Dowi5PDaX6yISfwFc=; b=f8FbuVea3//aevLxbZawIab9FnbA6WJnM+FmRjnrOezcj+RWr6bZdUHHju8V+XnjgXIuDKNPxIaNSbhG/zm2W34oiwssdgRVNwOdKbr5n2s+hDdSBfer20QRdF4oOtVZlfdYsiPQFuwiR/yfN02kelAA0Pddip91YE3pvz0rtZk= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass header.i=@intel.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1751006325958208.28408040993304; Thu, 26 Jun 2025 23:38:45 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1uV2iS-0003zy-7A; Fri, 27 Jun 2025 02:37:40 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uV2iO-0003zi-IS for qemu-devel@nongnu.org; Fri, 27 Jun 2025 02:37:36 -0400 Received: from mgamail.intel.com ([192.198.163.16]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uV2iL-0004JQ-Pf for qemu-devel@nongnu.org; Fri, 27 Jun 2025 02:37:36 -0400 Received: from fmviesa010.fm.intel.com ([10.60.135.150]) by fmvoesa110.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 26 Jun 2025 23:37:28 -0700 Received: from spr-s2600bt.bj.intel.com ([10.240.192.127]) by fmviesa010-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 26 Jun 2025 23:37:26 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1751006254; x=1782542254; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=HiBSo6MbVN1I5cxIGDOO4hgPnPzUGXHZ/UZ2bB0sRu4=; b=En/YdiFmiodLmYuPc53DqlqJvx7XiHLtyCn1FnQbVKlqCzT5a3KEPvLx LFVfUXBnc/TBXs1vlAqYKYpte3B9MahdZr7g5CLmHhPdJgGbL8SN8eZoe b7xy8HdcRjRROmo5aONtYaQBS4AWyfOkTVFLcWbqGAql5Uy8V+VVJH6Dc Jp/UzsG+5Uh9MHCu7wQywdrQznhchU1HG8wey9BkobPo7Q1QCDDT7zVa4 53SZHWMHB9RIU2JcMHzug4a8qDms9EFkLxTcaUpTKpS+8IrgQznGSO6h4 GKews/5hqO2+xv8nYA1w+xtarc7AIiXkXHj0T12WM34tlNXVnJ7JYVqPH w==; X-CSE-ConnectionGUID: 1rXkFwPQTISaISTbQGAXXQ== X-CSE-MsgGUID: 6gUOomE3TJilxzo+gdQDRw== X-IronPort-AV: E=McAfee;i="6800,10657,11476"; a="40931460" X-IronPort-AV: E=Sophos;i="6.16,269,1744095600"; d="scan'208";a="40931460" X-CSE-ConnectionGUID: +ZQQsXCFSUWjJZNb04u5KA== X-CSE-MsgGUID: DQmbOECoSTuCkFQLFMIVeQ== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.16,269,1744095600"; d="scan'208";a="153438106" From: Zhenzhong Duan To: qemu-devel@nongnu.org Cc: alex.williamson@redhat.com, clg@redhat.com, eric.auger@redhat.com, steven.sistare@oracle.com, chao.p.peng@intel.com, Zhenzhong Duan Subject: [PATCH v2 1/2] vfio/container: Fix potential SIGSEGV when recover from unmap-all-vaddr failure Date: Fri, 27 Jun 2025 14:33:31 +0800 Message-Id: <20250627063332.5173-2-zhenzhong.duan@intel.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250627063332.5173-1-zhenzhong.duan@intel.com> References: <20250627063332.5173-1-zhenzhong.duan@intel.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=192.198.163.16; envelope-from=zhenzhong.duan@intel.com; helo=mgamail.intel.com X-Spam_score_int: -43 X-Spam_score: -4.4 X-Spam_bar: ---- X-Spam_report: (-4.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @intel.com) X-ZM-MESSAGEID: 1751006327369116600 Content-Type: text/plain; charset="utf-8" CPR overrides then restores dma_map in both outgoing and incoming QEMU, for different reasons. But it only sets saved_dma_map in the target. Fix it by always setting saved_dma_map. Fixes: eba1f657cbb1 ("vfio/container: recover from unmap-all-vaddr failure") Suggested-by: Steven Sistare Signed-off-by: Zhenzhong Duan Reviewed-by: Steve Sistare --- hw/vfio/cpr-legacy.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/vfio/cpr-legacy.c b/hw/vfio/cpr-legacy.c index a84c3247b7..0a5d1bd480 100644 --- a/hw/vfio/cpr-legacy.c +++ b/hw/vfio/cpr-legacy.c @@ -180,9 +180,9 @@ bool vfio_legacy_cpr_register_container(VFIOContainer *= container, Error **errp) vmstate_register(NULL, -1, &vfio_container_vmstate, container); =20 /* During incoming CPR, divert calls to dma_map. */ + VFIOIOMMUClass *vioc =3D VFIO_IOMMU_GET_CLASS(bcontainer); + container->cpr.saved_dma_map =3D vioc->dma_map; if (cpr_is_incoming()) { - VFIOIOMMUClass *vioc =3D VFIO_IOMMU_GET_CLASS(bcontainer); - container->cpr.saved_dma_map =3D vioc->dma_map; vioc->dma_map =3D vfio_legacy_cpr_dma_map; } =20 --=20 2.34.1 From nobody Sat Nov 15 14:49:49 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass header.i=@intel.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1751006326; cv=none; d=zohomail.com; s=zohoarc; b=YzokxC8snYWlNAhhFcxaTHZubVKoLAmyJMPsCUfWs7BpvcJ62UfDAW9uajQhLK4mquR+D9FLatrFrinU2oZTCgylWL2uiEDPxLj3gl4NdtO9RXBNiUwygsNxrZX7Q+hE7qhV0bUcklmu1zE0eY20hvOiHX8yxQirNQZqzlMdSz4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1751006326; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=c0MH3u4E0r+XW2oqJMde8G2dO4iE9i37Z0LxXykqDm8=; b=Gar2FYNzYeja77M380U5eLmeFYl/P03fP3E7tIFnFmAwre4cPLU0LUKsOz+pQLjNYkEWgWNS92p7JiWxSx6yxFGT2HJcPAMe7ClBRVVouXcyRwNEkfIptW56KgYIfGGZBpbYx4KITlrAioDWOpg9Fnc5jIupDLaYXfDarq3zTwA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass header.i=@intel.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 175100632610477.90812729063066; Thu, 26 Jun 2025 23:38:46 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1uV2ie-00043v-4a; Fri, 27 Jun 2025 02:37:53 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uV2ib-00042w-CV for qemu-devel@nongnu.org; Fri, 27 Jun 2025 02:37:49 -0400 Received: from mgamail.intel.com ([192.198.163.16]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1uV2iR-0004JQ-0O for qemu-devel@nongnu.org; Fri, 27 Jun 2025 02:37:48 -0400 Received: from fmviesa010.fm.intel.com ([10.60.135.150]) by fmvoesa110.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 26 Jun 2025 23:37:30 -0700 Received: from spr-s2600bt.bj.intel.com ([10.240.192.127]) by fmviesa010-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 26 Jun 2025 23:37:28 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1751006259; x=1782542259; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=QWajAxQ6WbFSjERRP9f7w3D56c8UOqrg4mCWRJ3bApE=; b=XbWarh54S1o8TzGx+IM7K9likqC6Ts9IrYOBpzGK+O3G5UDzJ5ly/Twp 9aUJJ5vyTogTwGTJDSNbdljK6z1FC4CSSuMLmu6/7UNwey4v9Ty6Kcxje V1NKYnR/tKpw85BFEV2VZFKV+STws3TiN4ALcriFSBB2SfMF8wBq/AR4H J0ZaG+8fTd0q8T0iyrzZjLvDVbqdFkHFX+s0tzvM7SV5o7GbEcL63qUlb sLw4XytRUEAPTAA0eGmH4MUUEA+GJh5q0/3tAdjemr6DkmB1moS0GitZr uiRZsv+lL0J4pDPHCiztvDxGo+9XOM4ETYkN/QI8OQIS9LaTNRPm6FkeP w==; X-CSE-ConnectionGUID: FKMrKHPaRPCxWgv1Sb4Suw== X-CSE-MsgGUID: 1YnYmMGtSpq6GDq6JB1NQw== X-IronPort-AV: E=McAfee;i="6800,10657,11476"; a="40931463" X-IronPort-AV: E=Sophos;i="6.16,269,1744095600"; d="scan'208";a="40931463" X-CSE-ConnectionGUID: j4eZSO8DTkOf00NxTN+mXw== X-CSE-MsgGUID: UsjDql2MR9eSs6r2d/a0oQ== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.16,269,1744095600"; d="scan'208";a="153438113" From: Zhenzhong Duan To: qemu-devel@nongnu.org Cc: alex.williamson@redhat.com, clg@redhat.com, eric.auger@redhat.com, steven.sistare@oracle.com, chao.p.peng@intel.com, Zhenzhong Duan Subject: [PATCH v2 2/2] vfio/container: Fix vfio_container_post_load() Date: Fri, 27 Jun 2025 14:33:32 +0800 Message-Id: <20250627063332.5173-3-zhenzhong.duan@intel.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250627063332.5173-1-zhenzhong.duan@intel.com> References: <20250627063332.5173-1-zhenzhong.duan@intel.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=192.198.163.16; envelope-from=zhenzhong.duan@intel.com; helo=mgamail.intel.com X-Spam_score_int: -43 X-Spam_score: -4.4 X-Spam_bar: ---- X-Spam_report: (-4.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @intel.com) X-ZM-MESSAGEID: 1751006332488116600 Content-Type: text/plain; charset="utf-8" When there are multiple VFIO containers, vioc->dma_map is restored multiple times, this made only first container work and remaining containers using vioc->dma_map restored by first container. Fix it by save and restore vioc->dma_map locally. saved_dma_map in VFIOContainerCPR becomes useless and is removed. Fixes: 7e9f21411302 ("vfio/container: restore DMA vaddr") Signed-off-by: Zhenzhong Duan Reviewed-by: Steve Sistare --- include/hw/vfio/vfio-cpr.h | 7 ++++--- hw/vfio/cpr-legacy.c | 23 +++++++++-------------- 2 files changed, 13 insertions(+), 17 deletions(-) diff --git a/include/hw/vfio/vfio-cpr.h b/include/hw/vfio/vfio-cpr.h index 8bf85b9f4e..dbb2a16b7a 100644 --- a/include/hw/vfio/vfio-cpr.h +++ b/include/hw/vfio/vfio-cpr.h @@ -16,14 +16,15 @@ struct VFIOContainer; struct VFIOContainerBase; struct VFIOGroup; =20 +typedef int (*dma_map_fn)(const struct VFIOContainerBase *bcontainer, + hwaddr iova, ram_addr_t size, void *vaddr, + bool readonly, MemoryRegion *mr); + typedef struct VFIOContainerCPR { Error *blocker; bool vaddr_unmapped; NotifierWithReturn transfer_notifier; MemoryListener remap_listener; - int (*saved_dma_map)(const struct VFIOContainerBase *bcontainer, - hwaddr iova, ram_addr_t size, - void *vaddr, bool readonly, MemoryRegion *mr); } VFIOContainerCPR; =20 typedef struct VFIODeviceCPR { diff --git a/hw/vfio/cpr-legacy.c b/hw/vfio/cpr-legacy.c index 0a5d1bd480..1216717546 100644 --- a/hw/vfio/cpr-legacy.c +++ b/hw/vfio/cpr-legacy.c @@ -99,20 +99,21 @@ static int vfio_container_post_load(void *opaque, int v= ersion_id) { VFIOContainer *container =3D opaque; VFIOContainerBase *bcontainer =3D &container->bcontainer; - VFIOGroup *group; + VFIOIOMMUClass *vioc =3D VFIO_IOMMU_GET_CLASS(bcontainer); + dma_map_fn saved_dma_map =3D vioc->dma_map; Error *local_err =3D NULL; =20 + /* During incoming CPR, divert calls to dma_map. */ + vioc->dma_map =3D vfio_legacy_cpr_dma_map; + if (!vfio_listener_register(bcontainer, &local_err)) { error_report_err(local_err); return -1; } =20 - QLIST_FOREACH(group, &container->group_list, container_next) { - VFIOIOMMUClass *vioc =3D VFIO_IOMMU_GET_CLASS(bcontainer); + /* Restore original dma_map function */ + vioc->dma_map =3D saved_dma_map; =20 - /* Restore original dma_map function */ - vioc->dma_map =3D container->cpr.saved_dma_map; - } return 0; } =20 @@ -148,6 +149,7 @@ static int vfio_cpr_fail_notifier(NotifierWithReturn *n= otifier, */ =20 VFIOIOMMUClass *vioc =3D VFIO_IOMMU_GET_CLASS(bcontainer); + dma_map_fn saved_dma_map =3D vioc->dma_map; vioc->dma_map =3D vfio_legacy_cpr_dma_map; =20 container->cpr.remap_listener =3D (MemoryListener) { @@ -158,7 +160,7 @@ static int vfio_cpr_fail_notifier(NotifierWithReturn *n= otifier, bcontainer->space->as); memory_listener_unregister(&container->cpr.remap_listener); container->cpr.vaddr_unmapped =3D false; - vioc->dma_map =3D container->cpr.saved_dma_map; + vioc->dma_map =3D saved_dma_map; } return 0; } @@ -179,13 +181,6 @@ bool vfio_legacy_cpr_register_container(VFIOContainer = *container, Error **errp) =20 vmstate_register(NULL, -1, &vfio_container_vmstate, container); =20 - /* During incoming CPR, divert calls to dma_map. */ - VFIOIOMMUClass *vioc =3D VFIO_IOMMU_GET_CLASS(bcontainer); - container->cpr.saved_dma_map =3D vioc->dma_map; - if (cpr_is_incoming()) { - vioc->dma_map =3D vfio_legacy_cpr_dma_map; - } - migration_add_notifier_mode(&container->cpr.transfer_notifier, vfio_cpr_fail_notifier, MIG_MODE_CPR_TRANSFER); --=20 2.34.1