From nobody Sun Sep 28 15:58:43 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1756308116224287.0168571724039; Wed, 27 Aug 2025 08:21:56 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1urHnW-0006IW-3R; Wed, 27 Aug 2025 11:10:50 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1urHjM-0006oU-QK; Wed, 27 Aug 2025 11:06:35 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1urHjK-0005Ro-Tq; Wed, 27 Aug 2025 11:06:32 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id CFF7914C54C; Wed, 27 Aug 2025 18:02:58 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id BA9E3269854; Wed, 27 Aug 2025 18:03:25 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Qian Wen , Xiaoyao Li , Zhao Liu , Paolo Bonzini , Michael Tokarev Subject: [Stable-10.0.4 36/59] i386/cpu: Fix cpu number overflow in CPUID.01H.EBX[23:16] Date: Wed, 27 Aug 2025 18:02:41 +0300 Message-ID: <20250827150323.2694101-36-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.2 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZM-MESSAGEID: 1756308117032124101 Content-Type: text/plain; charset="utf-8" From: Qian Wen The legacy topology enumerated by CPUID.1.EBX[23:16] is defined in SDM Vol2: Bits 23-16: Maximum number of addressable IDs for logical processors in this physical package. When threads_per_socket > 255, it will 1) overwrite bits[31:24] which is apic_id, 2) bits [23:16] get truncated. Specifically, if launching the VM with -smp 256, the value written to EBX[23:16] is 0 because of data overflow. If the guest only supports legacy topology, without V2 Extended Topology enumerated by CPUID.0x1f or Extended Topology enumerated by CPUID.0x0b to support over 255 CPUs, the return of the kernel invoking cpu_smt_allowed() is false and APs (application processors) will fail to bring up. Then only CPU 0 is online, and others are offline. For example, launch VM via: qemu-system-x86_64 -M q35,accel=3Dkvm,kernel-irqchip=3Dsplit \ -cpu qemu64,cpuid-0xb=3Doff -smp 256 -m 32G \ -drive file=3Dguest.img,if=3Dnone,id=3Dvirtio-disk0,format=3Draw \ -device virtio-blk-pci,drive=3Dvirtio-disk0,bootindex=3D1 --nographic The guest shows: CPU(s): 256 On-line CPU(s) list: 0 Off-line CPU(s) list: 1-255 To avoid this issue caused by overflow, limit the max value written to EBX[23:16] to 255 as the HW does. Cc: qemu-stable@nongnu.org Reviewed-by: Xiaoyao Li Signed-off-by: Qian Wen Signed-off-by: Zhao Liu Link: https://lore.kernel.org/r/20250714080859.1960104-6-zhao1.liu@intel.com Signed-off-by: Paolo Bonzini (cherry picked from commit a62fef58299562aae6667b8d8552247423e886b3) Signed-off-by: Michael Tokarev diff --git a/target/i386/cpu.c b/target/i386/cpu.c index ed262edcc8..56af1857b9 100644 --- a/target/i386/cpu.c +++ b/target/i386/cpu.c @@ -6835,6 +6835,8 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, = uint32_t count, } *edx =3D env->features[FEAT_1_EDX]; if (threads_per_pkg > 1) { + uint32_t num; + /* * For CPUID.01H.EBX[Bits 23-16], AMD requires logical process= or * count, but Intel needs maximum number of addressable IDs for @@ -6842,10 +6844,13 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index= , uint32_t count, */ if (/*10.0: cpu->vendor_cpuid_only_v2*/ false && (IS_INTEL_CPU(env) || IS_ZHAOXIN_CPU(env))) { - *ebx |=3D 1 << apicid_pkg_offset(topo_info) << 16; + num =3D 1 << apicid_pkg_offset(topo_info); } else { - *ebx |=3D threads_per_pkg << 16; + num =3D threads_per_pkg; } + + /* Fixup overflow: max value for bits 23-16 is 255. */ + *ebx |=3D MIN(num, 255) << 16; } break; case 2: --=20 2.47.2