[v2] target/i386 and misc changes for 2026-09-28

[PULL v2 00/32] target/i386 and misc changes for 2026-09-28

Posted by Paolo Bonzini 3 weeks ago

The following changes since commit 9c88811b81a935a172c5c873b2ada2d9b38a5f74:

  Merge tag 'pull-target-arm-20260929' of https://gitlab.com/pm215/qemu into staging (2026-09-30 06:25:37 +0100)

are available in the Git repository at:

  https://gitlab.com/bonzini/qemu.git tags/for-upstream

for you to fetch changes up to 7b596a6918055eee8e17a78c84127b934ae4531e:

  agents: Add a skill for finding your way around QEMU (2026-10-02 11:11:37 +0200)

v1->v2: move validate_vex() before all operand decoding (patches 6-8)

----------------------------------------------------------------
* target/i386/tcg: fix EFLAGS reads in TCG plugin callbacks
* target/i386/tcg: raise #GP(0) on null SS load with RPL != CPL
* target/i386/tcg: Don't clear C1 for FCOMI/FCOMIP/FUCOMI/FUCOMIP
* target/i386/tcg: implement APX
* target/i386: Migrate error code only with an exception
* agents: Add a skill for finding your way around QEMU
* tdx: fix buffer overflow in tdx_parse_panic_message
* accel/kvm: fixes

----------------------------------------------------------------
Artemii Mashanov (1):
      target/i386: fix EFLAGS reads in TCG plugin callbacks

Jakub Lipový (1):
      target/i386/tcg: raise #GP(0) on null SS load with RPL != CPL

Maxim Levitsky (3):
      system: fix buffer overflow in tdx_parse_panic_message
      accel/kvm: protect kvm_resample_fd_list with a mutex
      accel/kvm: coalesced mmio: check lenght of the MMIO write entry

Paolo Bonzini (25):
      target/i386/tcg: compute C of CC_OP_ADOX without going through helper
      target/i386/tcg: extract validate_cr0_exceptions()
      target/i386/tcg: move validate_vex() before all operand decoding
      target/i386/tcg: clarify return value of decode_insn
      target/i386/tcg: ignore VEX.L for unary scalar instructions
      target/i386/tcg: JO/JNO can use flags directly if it is in CC_SRC
      target/i386/tcg: generalize zero- and sign-extension
      target/i386/tcg: use standard operand order for BSF and BSR
      target/i386/tcg: use zextT1 for CMPXCHG
      target/i386/tcg: unify MOVBE and BSWAP generators
      target/i386/tcg: add APX support to XSAVE/XRSTOR
      target/i386/tcg: add definition for REX2 prefix
      target/i386/tcg: mark XSAVE* as not allowing REX2
      target/i386/tcg: treat 0x0F as a prefix
      target/i386/tcg: decode REX2 prefix
      target/i386/tcg: implement JMPABS instruction
      target/i386/tcg: extend VEX.vvvv parsing for APX
      target/i386/tcg: decode EVEX prefix
      target/i386/tcg: add decode functionality for APX
      target/i386/tcg: implement CCMP/CTEST
      target/i386/tcg: decode APX instructions
      target/i386/tcg: optimize CCMP
      target/i386: extract computation of no-autoenable features
      target/i386/tcg: mark APX as supported
      agents: Add a skill for finding your way around QEMU

Simon Scherer (1):
      target/i386: Don't clear C1 for FCOMI/FCOMIP/FUCOMI/FUCOMIP

Yanfei Xu (1):
      target/i386: Migrate error code only with an exception

 configs/targets/x86_64-bsd-user.mak      |   2 +-
 configs/targets/x86_64-linux-user.mak    |   2 +-
 target/i386/cpu.h                        |  10 +-
 target/i386/helper.h                     |   1 +
 target/i386/tcg/decode-new.h             |  38 +-
 target/i386/tcg/tcg-cpu.h                |  18 +-
 target/i386/tcg/cc_helper_template.h.inc |  11 +
 accel/kvm/kvm-all.c                      |  26 +-
 hw/i386/pc.c                             |   1 -
 system/runstate.c                        |  36 +-
 target/i386/cpu.c                        |  46 +-
 target/i386/gdbstub.c                    |   3 +
 target/i386/helper.c                     |  11 +
 target/i386/machine.c                    |   2 +-
 target/i386/tcg/cc_helper.c              |  14 +
 target/i386/tcg/excp_helper.c            |   5 +
 target/i386/tcg/fpu_helper.c             |  63 ++-
 target/i386/tcg/seg_helper.c             |   4 +-
 target/i386/tcg/tcg-cpu.c                |   7 +-
 target/i386/tcg/translate.c              | 120 ++++-
 target/i386/tcg/decode-new.c.inc         | 898 +++++++++++++++++++++++++------
 target/i386/tcg/emit.c.inc               | 303 ++++++++++-
 .agents/skills/qemu-codebase/SKILL.md    |  59 ++
 .claude/skills                           |   1 +
 .gemini/skills                           |   1 +
 25 files changed, 1418 insertions(+), 264 deletions(-)
 create mode 100644 .agents/skills/qemu-codebase/SKILL.md
 create mode 120000 .claude/skills
 create mode 120000 .gemini/skills
-- 
2.55.0

Re: [PULL v2 00/32] target/i386 and misc changes for 2026-09-28

Posted by Richard Henderson 2 weeks, 6 days ago

On 10/2/26 11:15, Paolo Bonzini wrote:
> The following changes since commit 9c88811b81a935a172c5c873b2ada2d9b38a5f74:
> 
>    Merge tag 'pull-target-arm-20260929' of https://gitlab.com/pm215/qemu into staging (2026-09-30 06:25:37 +0100)
> 
> are available in the Git repository at:
> 
>    https://gitlab.com/bonzini/qemu.git tags/for-upstream
> 
> for you to fetch changes up to 7b596a6918055eee8e17a78c84127b934ae4531e:
> 
>    agents: Add a skill for finding your way around QEMU (2026-10-02 11:11:37 +0200)
> 
> v1->v2: move validate_vex() before all operand decoding (patches 6-8)
> 
> ----------------------------------------------------------------
> * target/i386/tcg: fix EFLAGS reads in TCG plugin callbacks
> * target/i386/tcg: raise #GP(0) on null SS load with RPL != CPL
> * target/i386/tcg: Don't clear C1 for FCOMI/FCOMIP/FUCOMI/FUCOMIP
> * target/i386/tcg: implement APX
> * target/i386: Migrate error code only with an exception
> * agents: Add a skill for finding your way around QEMU
> * tdx: fix buffer overflow in tdx_parse_panic_message
> * accel/kvm: fixes

This has a number of failures:

https://gitlab.com/qemu-project/qemu/-/jobs/16911681150#L902

I tried bisecting the issue to make sure, but the patch set isn't 
bisectable.  At

commit a6d1cac8651b2a2d5eb56abbe1cea698e72e4e3f (HEAD)
Author: Paolo Bonzini <pbonzini@redhat.com>
Date:   Wed Sep 23 14:33:32 2026 +0200

     target/i386/tcg: use zextT1 for CMPXCHG

I get

In file included from ../publish/target/i386/tcg/translate.c:3339:
../publish/target/i386/tcg/decode-new.c.inc:2765:10: error: use of 
undeclared identifier 'X86_EVEX_APX'; did you mean 'X86_VEX_LIG'?
  2765 |     case X86_EVEX_APX:
       |          ^~~~~~~~~~~~
       |          X86_VEX_LIG
../publish/target/i386/tcg/decode-new.h:273:5: note: 'X86_VEX_LIG' 
declared here
   273 |     X86_VEX_LIG,
       |     ^
In file included from ../publish/target/i386/tcg/translate.c:3339:
../publish/target/i386/tcg/decode-new.c.inc:2766:10: error: use of 
undeclared identifier 'X86_EVEX_APX_cmp'
  2766 |     case X86_EVEX_APX_cmp:
       |          ^~~~~~~~~~~~~~~~
../publish/target/i386/tcg/decode-new.c.inc:2767:10: error: use of 
undeclared identifier 'X86_EVEX_APX_pp2'
  2767 |     case X86_EVEX_APX_pp2:
       |          ^~~~~~~~~~~~~~~~
../publish/target/i386/tcg/decode-new.c.inc:2768:10: error: use of 
undeclared identifier 'X86_EVEX_APX_zu'
  2768 |     case X86_EVEX_APX_zu:
       |          ^~~~~~~~~~~~~~~
4 errors generated.


r~

Re: [PULL v2 00/32] target/i386 and misc changes for 2026-09-28

Posted by Yonggang Luo 2 weeks, 5 days ago

Found the cause, the mutex is not always initialized, we need to check
if it's available.
Maybe a better way is to get the mutex to have no need to initialize.
Like pthread_mutex_t

On Sat, Oct 3, 2026 at 8:17 PM Richard Henderson
<richard.henderson@linaro.org> wrote:
>
> On 10/2/26 11:15, Paolo Bonzini wrote:
> > The following changes since commit 9c88811b81a935a172c5c873b2ada2d9b38a5f74:
> >
> >    Merge tag 'pull-target-arm-20260929' of https://gitlab.com/pm215/qemu into staging (2026-09-30 06:25:37 +0100)
> >
> > are available in the Git repository at:
> >
> >    https://gitlab.com/bonzini/qemu.git tags/for-upstream
> >
> > for you to fetch changes up to 7b596a6918055eee8e17a78c84127b934ae4531e:
> >
> >    agents: Add a skill for finding your way around QEMU (2026-10-02 11:11:37 +0200)
> >
> > v1->v2: move validate_vex() before all operand decoding (patches 6-8)
> >
> > ----------------------------------------------------------------
> > * target/i386/tcg: fix EFLAGS reads in TCG plugin callbacks
> > * target/i386/tcg: raise #GP(0) on null SS load with RPL != CPL
> > * target/i386/tcg: Don't clear C1 for FCOMI/FCOMIP/FUCOMI/FUCOMIP
> > * target/i386/tcg: implement APX
> > * target/i386: Migrate error code only with an exception
> > * agents: Add a skill for finding your way around QEMU
> > * tdx: fix buffer overflow in tdx_parse_panic_message
> > * accel/kvm: fixes
>
> This has a number of failures:
>
> https://gitlab.com/qemu-project/qemu/-/jobs/16911681150#L902
>
> I tried bisecting the issue to make sure, but the patch set isn't
> bisectable.  At
>
> commit a6d1cac8651b2a2d5eb56abbe1cea698e72e4e3f (HEAD)
> Author: Paolo Bonzini <pbonzini@redhat.com>
> Date:   Wed Sep 23 14:33:32 2026 +0200
>
>      target/i386/tcg: use zextT1 for CMPXCHG
>
> I get
>
> In file included from ../publish/target/i386/tcg/translate.c:3339:
> ../publish/target/i386/tcg/decode-new.c.inc:2765:10: error: use of
> undeclared identifier 'X86_EVEX_APX'; did you mean 'X86_VEX_LIG'?
>   2765 |     case X86_EVEX_APX:
>        |          ^~~~~~~~~~~~
>        |          X86_VEX_LIG
> ../publish/target/i386/tcg/decode-new.h:273:5: note: 'X86_VEX_LIG'
> declared here
>    273 |     X86_VEX_LIG,
>        |     ^
> In file included from ../publish/target/i386/tcg/translate.c:3339:
> ../publish/target/i386/tcg/decode-new.c.inc:2766:10: error: use of
> undeclared identifier 'X86_EVEX_APX_cmp'
>   2766 |     case X86_EVEX_APX_cmp:
>        |          ^~~~~~~~~~~~~~~~
> ../publish/target/i386/tcg/decode-new.c.inc:2767:10: error: use of
> undeclared identifier 'X86_EVEX_APX_pp2'
>   2767 |     case X86_EVEX_APX_pp2:
>        |          ^~~~~~~~~~~~~~~~
> ../publish/target/i386/tcg/decode-new.c.inc:2768:10: error: use of
> undeclared identifier 'X86_EVEX_APX_zu'
>   2768 |     case X86_EVEX_APX_zu:
>        |          ^~~~~~~~~~~~~~~
> 4 errors generated.
>
>
> r~
>


-- 
         此致
礼
罗勇刚
Yours
    sincerely,
Yonggang Luo
From cd4f6c4c1f5008af5e211327d32f30fa1453cf55 Mon Sep 17 00:00:00 2001
From: Maxim Levitsky <mlevitsk@redhat.com>
Date: Tue, 22 Sep 2026 20:46:51 -0400
Subject: [PATCH] accel/kvm: protect kvm_resample_fd_list with a mutex

Legacy PCI INTx interrupts are level triggered and can, in theory, be shared.

Upon receiving such an interrupt, VFIO kernel driver masks it in a generic way,
using INTX_DISABLE bit in the PCI config space.

It then waits for the guest to signal completion (EOI) of the interrupt,
upon which VFIO re-enables the interrupt.

The completion is signaled with another eventfd.

For split irqchip mode, KVM doesn't have a notion of EOI on IOAPIC level.
Instead it signals EOI with a userspace VM exit, KVM_EXIT_IOAPIC_EOI.

Upon receiving this VM exit, Qemu manually signals the above-mentioned eventfd.

The problem that this patch resolves is that QEMU keeps these eventfds in
a linked list without any locking to prevent the list from being corrupted by
concurrent access.

Such use is possible and guest triggerable if the guest rapidly toggles
INTX mode of a VFIO device and at the same time signals EOI with an arbitrary
vector.

Fix this by protecting this list (kvm_resample_fd_list) with a mutex.

This patch was only compile tested.

Reported-by: "Vulnerability Report" <vr@darknavy.com>
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3942
Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
Link: https://lore.kernel.org/r/20260923004651.101197-1-mlevitsk@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/kvm/kvm-all.c | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index 134c71f33a..3c92b0b9ad 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -147,6 +147,7 @@ typedef struct KVMResampleFd KVMResampleFd;
 static QLIST_HEAD(, KVMResampleFd) kvm_resample_fd_list =
     QLIST_HEAD_INITIALIZER(kvm_resample_fd_list);
 
+static QemuMutex kvm_resample_fd_list_lock;
 static QemuMutex kml_slots_lock;
 
 #define kvm_slots_lock()    qemu_mutex_lock(&kml_slots_lock)
@@ -158,6 +159,8 @@ static inline void kvm_resample_fd_remove(int gsi)
 {
     KVMResampleFd *rfd;
 
+    qemu_mutex_lock(&kvm_resample_fd_list_lock);
+
     QLIST_FOREACH(rfd, &kvm_resample_fd_list, node) {
         if (rfd->gsi == gsi) {
             QLIST_REMOVE(rfd, node);
@@ -165,6 +168,8 @@ static inline void kvm_resample_fd_remove(int gsi)
             break;
         }
     }
+
+    qemu_mutex_unlock(&kvm_resample_fd_list_lock);
 }
 
 static inline void kvm_resample_fd_insert(int gsi, EventNotifier *event)
@@ -174,20 +179,30 @@ static inline void kvm_resample_fd_insert(int gsi, EventNotifier *event)
     rfd->gsi = gsi;
     rfd->resample_event = event;
 
+    qemu_mutex_lock(&kvm_resample_fd_list_lock);
     QLIST_INSERT_HEAD(&kvm_resample_fd_list, rfd, node);
+    qemu_mutex_unlock(&kvm_resample_fd_list_lock);
 }
 
 void kvm_resample_fd_notify(int gsi)
 {
     KVMResampleFd *rfd;
 
+    if (!kvm_enabled() || !kvm_irqchip_is_split()) {
+        return;
+    }
+
+    qemu_mutex_lock(&kvm_resample_fd_list_lock);
+
     QLIST_FOREACH(rfd, &kvm_resample_fd_list, node) {
         if (rfd->gsi == gsi) {
             event_notifier_set(rfd->resample_event);
             trace_kvm_resample_fd_notify(gsi);
-            return;
+            break;
         }
     }
+
+    qemu_mutex_unlock(&kvm_resample_fd_list_lock);
 }
 
 /**
@@ -2916,6 +2931,7 @@ static int kvm_init(AccelState *as, MachineState *ms)
     int type;
 
     qemu_mutex_init(&kml_slots_lock);
+    qemu_mutex_init(&kvm_resample_fd_list_lock);
 
     /*
      * On systems where the kernel can support different base page
-- 
2.55.0.windows.3