From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263704; cv=none; d=zohomail.com; s=zohoarc; b=QZruTuZf+1/Vo8yVaJK88d7k7Mm4xkTAaCp7az1/uCUgt1lusQmYNXfAujGPW4/ZYrgJgGlE7vFhsLsCVFsvLNY3uOHTJsP5TH2SfWwoOr5FdIpP7bqsyfhQdtYH13mb/HUnSJiEWsCcVbkQPqGN/k3l3iUp5wJrjDM7tUOcmCs= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263704; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=ASs08iADK6Y+Gj9w3qq2TJwRQdndwk5kbJriS/ud7wo=; b=PJe4Rxj/xMFp3I/S5ZOqWTOsVSjbnpmbUgVjwwailr9WQIC5vpCrAganU55X57azVevo9LNo2gUayB/9u34PMGQFrQGYZjcTZg8m0kMWZOeYOy+QO7k4miA+r7iRHIMn0Xrfzv4YPUvm+7xAYhzQVgYgR8Dii3D6qtI1cYdRLek= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263704171876.502670531968; Sat, 17 Oct 2026 12:01:44 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9Zv-0008IP-U3; Sat, 17 Oct 2026 14:56:24 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9ZZ-0008Aw-1A; Sat, 17 Oct 2026 14:56:07 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9ZX-0003ai-Ey; Sat, 17 Oct 2026 14:56:00 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 561781DE6A1; Sat, 17 Oct 2026 21:55:54 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 2DB2444336C; Sat, 17 Oct 2026 21:55:53 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263354; bh=fxET2QOjN+fT/CwIwNfkH5QJ6w6E85MB8X/jd0TrUkY=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Xkxcm9J4uOjFnfj92oQYkd0Y7JZhtFNhilK9eYASRta68tgYc5tEUNDk/8LNCGXFs SvLakBwtyEqPTXBFBIT2QOMpJ3K39Y0eDDm72Xs4yxtIj/bXGmpaSnTXuZANpnctR0 VcRDs+Q29/+Fl3hPyn+mn+Nf9altwK7hQdyYR7aC/fW/hNvX8pZmg+g1MHqZ5mjrKn u5G8minV80+dMyAcea4s4ULKoeelSQ5J1HwJz7vc2CESzEGxHKFAiSP23/1QVhOybi vvKLidvT++JruZxTM+tEt6u1aPpExYNXNCOrBP/PulQ7rMOwYpVvcnIf53mYQI2YsN sKxDQAO8fM1Ag== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Jean-Francois Bortolotti , Peter Maydell , Michael Tokarev Subject: [Stable-10.0.15 01/63] target/arm: Fix PMSAv8 shareability decode for R-profile MPU regions Date: Sat, 17 Oct 2026 21:54:17 +0300 Message-ID: <20261017185528.722197-1-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263704761158500 Content-Type: text/plain; charset="utf-8" From: Jean-Francois Bortolotti In Armv8-R AArch32 the shareability field of an MPU region lives in PRBAR, not PRLAR: PRBAR: [31:6] BASE [5] RES0 [4:3] SH [2:1] AP [0] XN PRLAR: [31:6] LIMIT [5:4] RES0 [3:1] AttrIndx [0] EN (Arm Cortex-R52 TRM 100026_0103_00_en: Tables 3-80 and 3-83 for HPRBAR/HPRLAR, Tables 3-124 and 3-127 for PRBAR/PRLAR.) Without this fix, address translation instructions like ATS1HR will return wrong value for PAR.SH. Cc: qemu-stable@nongnu.org Fixes: fca45e3467f7 ("target/arm: Add PMSAv8r functionality") Signed-off-by: Jean-Francois Bortolotti Message-id: 20260925234136.1182108-1-jeff@borto.fr Reviewed-by: Peter Maydell Signed-off-by: Peter Maydell (cherry picked from commit 653b0c06c83d761667474b29ebfb8a312f317c3a) (Mjt: context fixup for 10.0.x) Signed-off-by: Michael Tokarev diff --git a/target/arm/ptw.c b/target/arm/ptw.c index 92d6bd9d40..fa6973adf1 100644 --- a/target/arm/ptw.c +++ b/target/arm/ptw.c @@ -2720,7 +2720,7 @@ bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t add= ress, if (!arm_feature(env, ARM_FEATURE_M)) { uint8_t attrindx =3D extract32(matched_rlar, 1, 3); uint64_t mair =3D env->cp15.mair_el[regime_el(env, mmu_idx)]; - uint8_t sh =3D extract32(matched_rlar, 3, 2); + uint8_t sh =3D extract32(matched_rbar, 3, 2); =20 if (regime_sctlr(env, mmu_idx) & SCTLR_WXN && result->f.prot & PAGE_WRITE && mmu_idx !=3D ARMMMUIdx_Stag= e2) { --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263531; cv=none; d=zohomail.com; s=zohoarc; b=GcV9ADFBFLfraI8rGZxMO2pGqTz9xfmLShqFCOCjo/xl+QA+s0Y/PpibuwQH8iHxVdFU7yeoYVbTbTknIe5k/JGAfO+1pT8Eu1LXgsdUUvL/+AX6NA1eOTZtGZhd1UgwgYfU5iKfuDFclMHZFX6XUjFeLjusZ00PeTjLIM1KiuI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263531; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=eopyINroQPWZVI5L6A2+6hmKrBVlrcD5H2GHyab71IE=; b=cE9kqmay7mswX57o0YEKIfp06tM82WoExYJZbnX0qAuT7QsrVmYiTSEsjaByiZtzqm7YQ2XFR2Wp2VImwvs2Stmc+fS/YeYlpLJFkHBD2nu7uQvI2ZpX2/Hi5uCUjC5RyCz7K64KgITqvRvrc1LB2n1rbQU29IF0YzeNwplZYGg= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263531849729.3030867635892; Sat, 17 Oct 2026 11:58:51 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9Zt-0008FL-0t; Sat, 17 Oct 2026 14:56:21 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9Za-0008B3-AZ; Sat, 17 Oct 2026 14:56:05 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9ZX-0003ap-PC; Sat, 17 Oct 2026 14:56:02 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 910261DE6A2; Sat, 17 Oct 2026 21:55:55 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 9D59544336D; Sat, 17 Oct 2026 21:55:54 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263355; bh=wFkHxyhR169SE3chauQHfiLVvhY1OZkz35c0gV/+EMc=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=EHmp6NbrsnHvPuwu8QaSG5kbiII6biG0lcP7MZuhuAXj32lwMrDDjTNxEyFAzszck mzDTagxN4ITrHM85zalhICy5+N475OaZHp7+IPKcbYo26vnnqmf7YsJgOvSgAKhxcD cVI4avlxc62rKeNKxk9CUoGMwuHBv6Lw5w5kxMItKmlYmPb2RUokLaHKjsVV+w96qn PYm1OYRTcwjx47vNVYBSWnq656uEc9l2OnN4JFVOz3m3VrkGYPTZTWzPC1rrZbs/pJ 5H039RE6peM2ltmyo6izOtKVHHKw89sG8g7Mlcjm15rqaqezdaGEpdH+1VUPo4CYTM GaJb0aSJHaXuw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Fuad Tabba , Peter Maydell , Michael Tokarev Subject: [Stable-10.0.15 02/63] target/arm: Fix next timer tick when the offset puts the count ahead Date: Sat, 17 Oct 2026 21:54:18 +0300 Message-ID: <20261017185528.722197-2-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263533435158500 Content-Type: text/plain; charset="utf-8" From: Fuad Tabba gt_recalc_timer() arms the timer for the ISTATUS 0->1 transition at count =3D=3D cval + offset, treating an overflow of that sum as "beyond the counter's wrap" and arming at INT64_MAX. That reading is valid only when offset <=3D count. When offset > count (a CNTVOFF_EL2 or CNTPOFF_EL2 that puts the timer's counter ahead of the physical count), the sum overflows for every cval still in the future and the wrapped value is the correct next tick, which is what the code used before commit 8d37a1425b99. The timer then never fires on its own. A KVM guest whose counter is set ahead of the host's, as the arch_timer_edge_cases selftest does via KVM_REG_ARM_TIMER_CNT, gets its timer interrupt only when the vCPU is next loaded and KVM rewrites the timer registers, so a guest polling for the interrupt hangs. Reproduced with VHE, nVHE and pKVM hosts on QEMU 11.0.0. The test passes on hardware. Test count + (cval - (count - offset)) for overflow instead, so only a physical count past 2^64 is "never", and add a vtimer test case with an offset that puts the count ahead. Fixes: 8d37a1425b99 ("target/arm: Handle overflow in calculation of next ti= mer tick") Cc: qemu-stable@nongnu.org Signed-off-by: Fuad Tabba Message-id: 20260921074451.3158645-2-fuad.tabba@linux.dev Reviewed-by: Peter Maydell Signed-off-by: Peter Maydell (cherry picked from commit 66d4ea65a064421057f10c4a26d727beedbd1971) Signed-off-by: Michael Tokarev diff --git a/target/arm/helper.c b/target/arm/helper.c index e607f4a458..b2b5faa550 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -2607,11 +2607,12 @@ static void gt_recalc_timer(ARMCPU *cpu, int timeri= dx) } else { /* * Next transition is when (count - offset) =3D=3D cval, i.e. - * when count =3D=3D (cval + offset). - * If that would overflow, then again we set up the next inter= rupt - * for "as far in the future as possible" for the code below. + * cval - (count - offset) ticks from now. If count plus that + * overflows, set up "as far in the future as possible" below. */ - if (uadd64_overflow(gt->cval, offset, &nexttick)) { + uint64_t remaining =3D gt->cval - (count - offset); + + if (uadd64_overflow(count, remaining, &nexttick)) { nexttick =3D UINT64_MAX; } } diff --git a/tests/tcg/aarch64/system/vtimer.c b/tests/tcg/aarch64/system/v= timer.c index 7d725eced3..e1cfad36be 100644 --- a/tests/tcg/aarch64/system/vtimer.c +++ b/tests/tcg/aarch64/system/vtimer.c @@ -27,6 +27,7 @@ =20 int main(void) { + uint64_t freq, now; int i; =20 ml_printf("VTimer Test\n"); @@ -44,5 +45,32 @@ int main(void) ml_printf("%d: cntv_cval_el0=3D%lx\n", i, read_sysreg(cntv_cval_el= 0)); } =20 + /* + * An offset that puts the virtual count ahead of the physical one, + * so cval + cntvoff wraps for every future cval. The timer must + * still fire. ISTATUS is set by the expiry, so poll it with a bound. + */ + write_sysreg(cntv_ctl_el0, 0); + write_sysreg(cntvoff_el2, -(1ULL << 60)); + asm volatile("isb"); + + freq =3D read_sysreg(cntfrq_el0); + now =3D read_sysreg(cntvct_el0); + write_sysreg(cntv_cval_el0, now + freq / 100); + write_sysreg(cntv_ctl_el0, 1); + + ml_printf("cntvoff_el2=3D%lx\n", read_sysreg(cntvoff_el2)); + ml_printf("cntvct_el0=3D%lx\n", now); + ml_printf("cntv_cval_el0=3D%lx\n", read_sysreg(cntv_cval_el0)); + + while (!(read_sysreg(cntv_ctl_el0) & 4)) { + if (read_sysreg(cntvct_el0) - now > freq) { + ml_printf("FAIL: ISTATUS not set within 1s: cntv_ctl_el0=3D%lx= \n", + read_sysreg(cntv_ctl_el0)); + return 1; + } + } + ml_printf("ISTATUS set at cntvct_el0=3D%lx\n", read_sysreg(cntvct_el0)= ); + return 0; } --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263923; cv=none; d=zohomail.com; s=zohoarc; b=iMqOwXLX0QLXEPZdqC+MNiIGLk2LogO2sYxLR6nBRGeJo51mnniDhO0hu5lrv/AmvQWmkIEo3Db0cXEp9HHI9etcs3QXPlzuWHaoKt4+A10Q5mGAwTsDFbKKBvbZrWv8HvPYEdTJHhxbdnJKEHn+rHkH7Rbd5IBgjR7VGxEuORI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263923; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=EEZpXd5SjAL++myNtnSqZCV7EXdU/ELnQMe+GXQ5+TI=; b=OH1WTQbTmjWhl1nJfXyNZz4M6HXAvUqn6OCJJp05TT0CUGL9mp1lXQrKHEDwtn6dBKLP08QlmzGDkeQw7nXYlLvdGU2J9yyX6v5sliLbN8K6ArhkNxgYnyxSdXdFPkTWVc7VIS28XoBkroAeOXqUti341ahohtloP/Ww+05do4Q= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263923736930.2608328945197; Sat, 17 Oct 2026 12:05:23 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9Zu-0008Gr-3R; Sat, 17 Oct 2026 14:56:22 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9Zc-0008BO-Oe; Sat, 17 Oct 2026 14:56:11 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9Za-0003b4-Mc; Sat, 17 Oct 2026 14:56:04 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 921B01DE6A3; Sat, 17 Oct 2026 21:55:56 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id C5F4944336E; Sat, 17 Oct 2026 21:55:55 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263356; bh=Rea77sm9LOjvCrivzmGKTdp3U3FCwPWR+lZbQtLTwU4=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Fd8kQiy3+d/7xsrmQA34CejLSLePpElpdsh1MhYvLw5atLaY8rr+LFx1IMsjbXOG3 jGuBB5cwDwY1kjvHPF/Sl5ydRRqpnfOHDV3YAr+PlKlxWO3L9eEJpQX+forffFj6A1 GkCh6clHq+HOc1u9eO3gPismhakFEax48MHXaB2OmkWFqlQE8kGCtJQq9tSKQBDceO bLW87v/O7ktk0Z/dCCtdnX7Wnsskf1//x2omdIq0LlSkF1bTlkkz+TBgHGmyN+iO4F IJQyioBnng/3bcy9i1o4Py+bGZ4UvVr3OxdGRKV7dt3Xq9IetvB8Um6+hWqkE0ce0+ Zv/JMOqtMWjuA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Fuad Tabba , Peter Maydell , Michael Tokarev Subject: [Stable-10.0.15 03/63] target/arm: Fix WFxT timeouts when the offset puts the count ahead Date: Sat, 17 Oct 2026 21:54:19 +0300 Message-ID: <20261017185528.722197-3-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263925201158500 Content-Type: text/plain; charset="utf-8" From: Fuad Tabba The WFIT and WFET helpers arm the wakeup timer at count =3D=3D timeout + offset, treating an overflow of that sum as "beyond the counter's wrap" and arming at INT64_MAX. As in gt_recalc_timer(), that reading is valid only when offset <=3D count: with a CNTVOFF_EL2 that puts the virtual count ahead of the physical count, the sum overflows for every timeout still in the future and the wrapped value was the correct wakeup. The CPU then waits until an interrupt or event instead of waking at its timeout. A Linux guest uses WFIT and WFET in __delay() when FEAT_WFxT is present, which -cpu max advertises. Arm cntval + (timeout - cntvct) instead, so only a physical count past 2^64 is "never", and add a tcg system test that issues WFIT and WFET with such an offset, with a timer interrupt 1s out so a broken WFxT still returns: before this change both wake at the interrupt, after it at their timeout. Fixes: a96edb687e76 ("target/arm: Implement FEAT WFxT and enable for '-cpu = max'") Fixes: da9b86c35fa8 ("target/arm: implement WFET") Cc: qemu-stable@nongnu.org Signed-off-by: Fuad Tabba Message-id: 20260921074451.3158645-3-fuad.tabba@linux.dev Reviewed-by: Peter Maydell Signed-off-by: Peter Maydell (cherry picked from commit 998b6db69e3ec58fd52ddc7a06ece6cf286f3c77) (Mjt: back-port the test across v11.1.0-1104-g602f9163b359 "tests/tcg/aarch64: system tests" make->meson tests conversion) (Mjt: pick up only half of the change, since 10.0.x does not have da9b86c35fa8 "target/arm: implement WFET") Signed-off-by: Michael Tokarev diff --git a/target/arm/tcg/op_helper.c b/target/arm/tcg/op_helper.c index 4e87b37a64..2f2a0d56b1 100644 --- a/target/arm/tcg/op_helper.c +++ b/target/arm/tcg/op_helper.c @@ -450,7 +450,8 @@ void HELPER(wfit)(CPUARMState *env, uint64_t timeout) raise_exception(env, excp, syn_wfx(1, 0xe, 2, false), target_el); } =20 - if (uadd64_overflow(timeout, offset, &nexttick)) { + /* Physical count at the timeout. Only an overflow of it is "never". */ + if (uadd64_overflow(cntval, timeout - cntvct, &nexttick)) { nexttick =3D UINT64_MAX; } if (nexttick > INT64_MAX / gt_cntfrq_period_ns(cpu)) { diff --git a/tests/tcg/aarch64/Makefile.softmmu-target b/tests/tcg/aarch64/= Makefile.softmmu-target index 9c52475b7a..46713d49b9 100644 --- a/tests/tcg/aarch64/Makefile.softmmu-target +++ b/tests/tcg/aarch64/Makefile.softmmu-target @@ -70,6 +70,8 @@ run-plugin-semiconsole-with-%: semiconsole QEMU_EL2_MACHINE=3D-machine virt,virtualization=3Don,gic-version=3D2 -cpu = cortex-a57 -smp 4 run-vtimer: QEMU_OPTS=3D$(QEMU_EL2_MACHINE) $(QEMU_BASE_ARGS) -kernel =20 +run-wfxt: QEMU_OPTS=3D-M virt,virtualization=3Don,gic-version=3D2 -cpu max= -smp 1 -semihosting-config enable=3Don,arg=3D2 -kernel + # Simple Record/Replay Test .PHONY: memory-record run-memory-record: memory-record memory diff --git a/tests/tcg/aarch64/system/wfxt.c b/tests/tcg/aarch64/system/wfx= t.c new file mode 100644 index 0000000000..be35833a33 --- /dev/null +++ b/tests/tcg/aarch64/system/wfxt.c @@ -0,0 +1,122 @@ +/* + * WFIT/WFET timeout test + * + * Copyright (c) 2026 Google LLC + * Author: Fuad Tabba + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#include +#include + +/* from Linux's include/linux/stringify.h */ +#define __stringify_1(x...) #x +#define __stringify(x...) __stringify_1(x) + +#define read_sysreg(r) ({ \ + uint64_t __val; \ + asm volatile("mrs %0, " __stringify(r) : "=3Dr" (__val)); \ + __val; \ +}) + +#define write_sysreg(r, v) do { \ + uint64_t __val =3D (uint64_t)(v); \ + asm volatile("msr " __stringify(r) ", %x0" \ + : : "rZ" (__val)); \ +} while (0) + +/* .inst forms of WFIT x0 and WFET x0, for assemblers without FEAT_WFxT */ +static inline void wfit(uint64_t timeout) +{ + register uint64_t x0 asm("x0") =3D timeout; + + asm volatile(".inst 0xd5031020" : : "r" (x0) : "memory"); +} + +#if 0 /* 10.0.x does not support wfet */ +static inline void wfet(uint64_t timeout) +{ + register uint64_t x0 asm("x0") =3D timeout; + + asm volatile(".inst 0xd5031000" : : "r" (x0) : "memory"); +} +#endif + +/* virt machine, GICv2 */ +#define GICD_BASE 0x08000000UL +#define GICC_BASE 0x08010000UL +#define GICD_CTLR 0x000 +#define GICD_ISENABLER0 0x100 +#define GICC_CTLR 0x000 +#define GICC_PMR 0x004 +#define VTIMER_PPI 27 + +static inline void mmio_write32(uintptr_t addr, uint32_t val) +{ + /* GIC registers: MMIO, MMU off at EL2 */ + *(volatile uint32_t *)addr =3D val; +} + +static int test_one(const char *name, void (*wait)(uint64_t), uint64_t fre= q) +{ + uint64_t now, timeout, elapsed; + int early =3D 0; + + /* + * The virtual timer interrupt, 1s out, wakes the CPU even with + * interrupts masked. The timeout, 10ms out, must be what wakes it. + */ + now =3D read_sysreg(cntvct_el0); + write_sysreg(cntv_cval_el0, now + freq); + write_sysreg(cntv_ctl_el0, 1); + timeout =3D now + freq / 100; + + do { + wait(timeout); + early++; + } while (read_sysreg(cntvct_el0) < timeout && early < 1000); + + elapsed =3D read_sysreg(cntvct_el0) - now; + write_sysreg(cntv_ctl_el0, 0); + + ml_printf("%s: woke after %ld ticks (%d wakes)\n", name, elapsed, earl= y); + if (early >=3D 1000) { + ml_printf("FAIL: %s kept waking before its timeout\n", name); + return 1; + } + if (elapsed > freq / 2) { + ml_printf("FAIL: %s woke on the timer interrupt, not its timeout\n= ", + name); + return 1; + } + return 0; +} + +int main(void) +{ + uint64_t freq; + int ret; + + ml_printf("WFxT Test\n"); + + mmio_write32(GICD_BASE + GICD_ISENABLER0, 1u << VTIMER_PPI); + mmio_write32(GICD_BASE + GICD_CTLR, 1); + mmio_write32(GICC_BASE + GICC_PMR, 0xff); + mmio_write32(GICC_BASE + GICC_CTLR, 1); + + /* Put the virtual count ahead of the physical count */ + write_sysreg(cntvoff_el2, -(1ULL << 60)); + asm volatile("isb"); + freq =3D read_sysreg(cntfrq_el0); + + ml_printf("cntvoff_el2=3D%lx cntfrq_el0=3D%ld\n", + read_sysreg(cntvoff_el2), freq); + + ret =3D test_one("wfit", wfit, freq); +#if 0 /* 10.0.x does not support wfet */ + ret |=3D test_one("wfet", wfet, freq); +#endif + + return ret; +} --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263417; cv=none; d=zohomail.com; s=zohoarc; b=iQbSA8sLawvchl5M3mzub0RNuRzR+oo9+0DUPerPLRVYzpqr+VGqSJcS2986NSrpCZ5BCgxoE8DVdhVdpcmMQOIgffYDdMUqyKp7xoAM3bxpEH3R49RLju9sSu1+jeO2/KE8ebYmTrXJPtRnpU0mfviWyMBtPa2BjeEMtpREs5U= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263417; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=zOdEWgWfERF/Or2HOpccB8S6vo7gMeSd4vNJl2WSXhE=; b=QTGaEgu/6w40YSbv+QwdM1nslLK0DqksxP1U16F1HY4nKAdyVcJRLVlFnr4ELznk9TeHX3EwWf5aQu2EBNriMNpuwulhgiprlXqArx2NZ98vuteKtkcxwwGMIyIJZy4HtsEtoac/nY7Ecv5MKgHcM3NO5AH3JbBzzzc4FZIxeLE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263413917801.103223665828; Sat, 17 Oct 2026 11:56:53 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9Zq-0008EY-K4; Sat, 17 Oct 2026 14:56:20 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9Ze-0008Bi-6T; Sat, 17 Oct 2026 14:56:11 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9Zc-0003bD-A4; Sat, 17 Oct 2026 14:56:05 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id BBF401DE6A4; Sat, 17 Oct 2026 21:55:57 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id C827344336F; Sat, 17 Oct 2026 21:55:56 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263357; bh=wA+KhyBMs+RKXWJU3ZnVQbYQ2/0rJTuGF9AIcTvrnG0=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=WxBk5MAbn5h25/Z85KSm+LmECCXnlAKldanRUTMmjf9UffRc/60+2aC6+dmmsCUAQ htzipdyYeXLqQ6mnPdpJrekbvMLvfSF5jB8wn7Z7oFTUl7XPBCto8XFmf/HE3OmA/d ly2kFadFygRlGG9TE3FZlAkY3J1nm2l3axgbjvW2sMh4ialr8pwIBq0hvbwuMSs4yr Cf+Q1wxm/tqGN3tAYiLB58aRBT22rIO4vpd0RRIWHcETu/jXNev2DbdEo/P2Gv33/G aIvdC1oPransA1e2IEV9Aaifce51X4QwEnjqGtZjrBCH41R+Cwxxs7NI1nT8VegQ05 lJLHeh3N6Vujw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Thomas Huth , Michael Tokarev Subject: [Stable-10.0.15 04/63] hw/usb/hcd-xhci: Limit DMA transfers to plain memory Date: Sat, 17 Oct 2026 21:54:20 +0300 Message-ID: <20261017185528.722197-4-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263430660158500 Content-Type: text/plain; charset="utf-8" From: Thomas Huth XHCI is a complex controller, involving lots of descriptors that are written and read via DMA transfers. As some recent bugs like https://gitlab.com/qemu-project/qemu/-/work_items/3926 revealed, this can sometimes be exploited from the guest side to crash or stall QEMU. The code currently does DMA writes with the MEMTXATTRS_UNSPECIFIED attribute, i.e. the controller is allowed to write to other MMIO regions, too. However, in normal operation, this should not be necessary, all descriptors should reside in normal memory. So let's decrease the attack surface a little bit and limit the DMA writes to normal memory here. Signed-off-by: Thomas Huth Message-ID: <20260915123242.549150-1-thuth@redhat.com> (cherry picked from commit 89e653b77369ad2d3e579139b1fa2567daa86a79) Signed-off-by: Michael Tokarev diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c index 88937683aa..fd0a88f961 100644 --- a/hw/usb/hcd-xhci.c +++ b/hw/usb/hcd-xhci.c @@ -520,6 +520,7 @@ static inline void xhci_dma_write_u32s(XHCIState *xhci,= dma_addr_t addr, int i; uint32_t tmp[5]; uint32_t n =3D len / sizeof(uint32_t); + const MemTxAttrs memtx_attrs =3D { .memory =3D true }; =20 assert((len % sizeof(uint32_t)) =3D=3D 0); assert(n <=3D ARRAY_SIZE(tmp)); @@ -527,8 +528,7 @@ static inline void xhci_dma_write_u32s(XHCIState *xhci,= dma_addr_t addr, for (i =3D 0; i < n; i++) { tmp[i] =3D cpu_to_le32(buf[i]); } - if (dma_memory_write(xhci->as, addr, tmp, len, - MEMTXATTRS_UNSPECIFIED) !=3D MEMTX_OK) { + if (dma_memory_write(xhci->as, addr, tmp, len, memtx_attrs) !=3D MEMTX= _OK) { qemu_log_mask(LOG_GUEST_ERROR, "%s: DMA memory access failed!\n", __func__); xhci_die(xhci); @@ -615,6 +615,7 @@ static void xhci_write_event(XHCIState *xhci, XHCIEvent= *event, int v) XHCIInterrupter *intr =3D &xhci->intr[v]; XHCITRB ev_trb; dma_addr_t addr; + const MemTxAttrs memtx_attrs =3D { .memory =3D true }; =20 ev_trb.parameter =3D cpu_to_le64(event->ptr); ev_trb.status =3D cpu_to_le32(event->length | (event->ccode << 24)); @@ -631,7 +632,7 @@ static void xhci_write_event(XHCIState *xhci, XHCIEvent= *event, int v) =20 addr =3D intr->er_start + TRB_SIZE*intr->er_ep_idx; if (dma_memory_write(xhci->as, addr, &ev_trb, TRB_SIZE, - MEMTXATTRS_UNSPECIFIED) !=3D MEMTX_OK) { + memtx_attrs) !=3D MEMTX_OK) { qemu_log_mask(LOG_GUEST_ERROR, "%s: DMA memory access failed!\n", __func__); xhci_die(xhci); @@ -2442,6 +2443,7 @@ static void xhci_detach_slot(XHCIState *xhci, USBPort= *uport) static TRBCCode xhci_get_port_bandwidth(XHCIState *xhci, uint64_t pctx) { dma_addr_t ctx; + const MemTxAttrs memtx_attrs =3D { .memory =3D true }; =20 DPRINTF("xhci_get_port_bandwidth()\n"); =20 @@ -2450,9 +2452,9 @@ static TRBCCode xhci_get_port_bandwidth(XHCIState *xh= ci, uint64_t pctx) DPRINTF("xhci: bandwidth context at "DMA_ADDR_FMT"\n", ctx); =20 /* TODO: actually implement real values here. This is 80% for all port= s. */ - if (stb_dma(xhci->as, ctx, 0, MEMTXATTRS_UNSPECIFIED) !=3D MEMTX_OK || + if (stb_dma(xhci->as, ctx, 0, memtx_attrs) !=3D MEMTX_OK || dma_memory_set(xhci->as, ctx + 1, 80, xhci->numports, - MEMTXATTRS_UNSPECIFIED) !=3D MEMTX_OK) { + memtx_attrs) !=3D MEMTX_OK) { qemu_log_mask(LOG_GUEST_ERROR, "%s: DMA memory write failed!\n", __func__); return CC_TRB_ERROR; --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263643; cv=none; d=zohomail.com; s=zohoarc; b=TbzADESGpv1I3QQw0gV87a6qOfODwKTiZu5U2LrWrQq+ixgV5tm/PkMrnr00+va+FefzMJ/s0yAtSCtxm9IsRIfIFw25hoAmcbDkQPaQLnawrqiZwdCysBRTxh+D8IS1ePeie45jMe518eBOFJSzX3Q+brFStoxqBEWNA5WHBjI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263643; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=2jgMLOeYT9BCfaJV19jLJeM4W2A2g7uiQmX72sNK/fM=; b=K7cM6Td0W6GURIC8rjAUR8pscMK0j+7qkNpZ/ct8N3OvDRzDDsmEmdYqUbAXb0WBfOzam2x8aeKwjJvLqGpF6Ryw5r+doBB4kI8wqRHZg3IH0C/ujv7PSBZRpxTLLpw7yNxCi12PX72IJ0xx8WDuW1CKgRna8e5cCJnng/1ZEPc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 179226364301975.14408830100717; Sat, 17 Oct 2026 12:00:43 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9Zz-0008KR-DU; Sat, 17 Oct 2026 14:56:27 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9Zg-0008Bt-BR; Sat, 17 Oct 2026 14:56:11 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9Ze-0003bQ-9m; Sat, 17 Oct 2026 14:56:07 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 204E31DE6A5; Sat, 17 Oct 2026 21:55:59 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 0B97C443370; Sat, 17 Oct 2026 21:55:57 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263359; bh=VizHhZ8is8WAjfuxExgoMd5lQnEZNAOVdpL1b1WDjpo=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=VYRBeAl8eedi7YOWloGFThKpkieyK7sd+4TApO9gCfduWy4NsaupqHPRX1AI0c8rb V6xqaY7bnwCosHYYjDnt/Zn5FXx+/+WTT5XyIxHMvuKrU2bwHDRFA/Ok6WcLPTaO23 FqhgRWQJU9oK7/a+ehgwsa5LWkYIlhMf7ZavO4t1c6QVP1i26GMJMaNk0uMmd9MoME y9UupNrrZ6jbVhduv5I3555A/K8IC/UmmxAqzrdJ4sBvGxMDc8XHGTR2Qrk+H5a7Nr g4iuTntbu+5VT/n1ExaDx99/SZyMpBSsT1wDNjDCMseSGi9ySabgl1kXE22DHCrqou XrdB3NxRgHpcA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Eric Farman , Matthew Rosato , Michael Tokarev Subject: [Stable-10.0.15 05/63] virtio-ccw: Limit ISC to MAX_ISC Date: Sat, 17 Oct 2026 21:54:21 +0300 Message-ID: <20261017185528.722197-5-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263643542158500 Content-Type: text/plain; charset="utf-8" From: Eric Farman The interrupt subclass is often defined as a uint8, though in practice it will be within the range of just 0-7. Ensure that a guest-supplied subclass does not extend beyond its expected range, especially when used as an array index. Cc: qemu-stable@nongnu.org Fixes: 25a08b8ded ("s390x/css: update css_adapter_interrupt") Reviewed-by: Matthew Rosato Link: https://lore.kernel.org/qemu-devel/20260922201526.2383047-2-farman@li= nux.ibm.com Signed-off-by: Eric Farman (cherry picked from commit 92b935de2709cdbb1c4ee2b48814640a71e8a438) Signed-off-by: Michael Tokarev diff --git a/hw/s390x/css.c b/hw/s390x/css.c index 991fc12608..79a6c90175 100644 --- a/hw/s390x/css.c +++ b/hw/s390x/css.c @@ -680,8 +680,13 @@ void css_adapter_interrupt(CssIoAdapterType type, uint= 8_t isc) S390FLICState *fs =3D s390_get_flic(); S390FLICStateClass *fsc =3D s390_get_flic_class(fs); uint32_t io_int_word =3D (isc << 27) | IO_INT_WORD_AI; - IoAdapter *adapter =3D channel_subsys.io_adapters[type][isc]; + IoAdapter *adapter; + + if (type >=3D CSS_IO_ADAPTER_TYPE_NUMS || isc > MAX_ISC) { + return; + } =20 + adapter =3D channel_subsys.io_adapters[type][isc]; if (!adapter) { return; } diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c index 43f3b162c8..5d7112b028 100644 --- a/hw/s390x/virtio-ccw.c +++ b/hw/s390x/virtio-ccw.c @@ -44,6 +44,10 @@ static int virtio_ccw_dev_post_load(void *opaque, int ve= rsion_id) CcwDevice *ccw_dev =3D CCW_DEVICE(dev); CCWDeviceClass *ck =3D CCW_DEVICE_GET_CLASS(ccw_dev); =20 + if (dev->thinint_isc > MAX_ISC) { + return -EINVAL; + } + ccw_dev->sch->driver_data =3D dev; if (ccw_dev->sch->thinint_active) { dev->routes.adapter.adapter_id =3D css_get_adapter_id( @@ -657,6 +661,8 @@ static int virtio_ccw_cb(SubchDev *sch, CCW1 ccw) } else { if (ccw_dstream_read(&sch->cds, thinint)) { ret =3D -EFAULT; + } else if (thinint.isc > MAX_ISC) { + ret =3D -ENOSYS; } else { thinint.ind_bit =3D be64_to_cpu(thinint.ind_bit); thinint.summary_indicator =3D --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263872; cv=none; d=zohomail.com; s=zohoarc; b=GjcyueDQQ/D6gDQ4nTbfWy+VI1UYj9VoPpUUMmpt19h5X89hf2co2tCVCy1TlNqmFbEx0yjO9eT19/t3PDsa9WfOFNkVCSrlV3BFM/ZO2vXl2aBWvLcTx1R4MHSseu23SDx2frI0eNwvpuciLA8QdWlua2+w5jpw0ZZR0fEkK64= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263872; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=M7s6YbkHHrsZM2MBYAvRzmWLej1Zq8Oj976T/NrjEK0=; b=JzUHj/Ra3oS9MPDfjiq4EuDgOyF9AKVUlK/f9cX5PtzGQUJVKhf0NAXaos8IRStPlpYZjSn776ldv6jxxPBYOG77BzdqpyhDU1w7+WkFUZ/apCi203LoVAIbnVYXSDqsZeyU1gy9IKsT2RJzdfOpGp+9ePdaTbH5N2Sv4CNFjV4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263872022787.4987144095843; Sat, 17 Oct 2026 12:04:32 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9Zv-0008Hp-AE; Sat, 17 Oct 2026 14:56:23 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9Zj-0008CS-Db; Sat, 17 Oct 2026 14:56:12 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9Zg-0003bc-B9; Sat, 17 Oct 2026 14:56:10 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id A8E111DE6A6; Sat, 17 Oct 2026 21:56:00 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 7406C443371; Sat, 17 Oct 2026 21:55:59 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263360; bh=AWYVdoCluqSQdoczhrmj5H3SEP9gyykz8ZRAYDegeIQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=IYZrIjjcGS9UPleyK6+k0I4c7YAPWdH167jWN4lQ//x3t3HzMzkQaa4pzxEm8pOPC I59Ims7BAM6F5XsbEFCQ+VOhPzQDHnCWcplIu5iD5r8k0XWIA7vj96dn0nq8O1ZIBi B3PzPII7K0rY57NzKkW1HscFHlZwXzNvz+yNYCO6o2SZR3Y0Vt/EhJBtCNqHqAPMwY USqh6WCcexRs/Uqvn3KarUn1nOg0ciNHgsXn5DtEZ2dmiuJCTKeSh+PHnVFMpLvnDd 4IeRPzBT4diPRJQ6sSJ2BbRbLYbhmEBaQjjexf35AWMQy5C+jJbdETaz1e29rPfhpC OARffxHKRdktQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Eric Farman , Matthew Rosato , Michael Tokarev Subject: [Stable-10.0.15 06/63] virtio-ccw: Do not overwrite existing indicators Date: Sat, 17 Oct 2026 21:54:22 +0300 Message-ID: <20261017185528.722197-6-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263874197158500 Content-Type: text/plain; charset="utf-8" From: Eric Farman The various indicators pointers allow them to be overwritten, but leak any existing structs that might be there. If indicators exist, ensure that they are released before setting the new ones. Both the regular and adapter interrupt paths check that they aren't being asked to enable interrupts when the other one is enabled, so just do this release once all the potential checks are completed. Cc: qemu-stable@nongnu.org Fixes: 7bca3892cb ("s390x/virtio-ccw: reference-counted indicators") Reviewed-by: Matthew Rosato Link: https://lore.kernel.org/qemu-devel/20260922201526.2383047-3-farman@li= nux.ibm.com Signed-off-by: Eric Farman (cherry picked from commit 13c7ba5e0f14aa4c711ba7fc92cddceeafcb1e3f) Signed-off-by: Michael Tokarev diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c index 5d7112b028..b2887a1443 100644 --- a/hw/s390x/virtio-ccw.c +++ b/hw/s390x/virtio-ccw.c @@ -580,6 +580,11 @@ static int virtio_ccw_cb(SubchDev *sch, CCW1 ccw) if (ret) { break; } + if (dev->indicators) { + /* Need to remove existing indicators first */ + release_indicator(&dev->routes.adapter, dev->indicators); + dev->indicators =3D NULL; + } indicators =3D be64_to_cpu(indicators); dev->indicators =3D get_indicator(indicators, sizeof(uint64_t)= ); sch->curr_status.scsw.count =3D ccw.count - sizeof(indicators); @@ -604,6 +609,11 @@ static int virtio_ccw_cb(SubchDev *sch, CCW1 ccw) if (ret) { break; } + if (dev->indicators2) { + /* Need to remove existing indicators first */ + release_indicator(&dev->routes.adapter, dev->indicators2); + dev->indicators2 =3D NULL; + } indicators =3D be64_to_cpu(indicators); dev->indicators2 =3D get_indicator(indicators, sizeof(uint64_t= )); sch->curr_status.scsw.count =3D ccw.count - sizeof(indicators); @@ -664,6 +674,17 @@ static int virtio_ccw_cb(SubchDev *sch, CCW1 ccw) } else if (thinint.isc > MAX_ISC) { ret =3D -ENOSYS; } else { + if (dev->indicators) { + /* Need to remove existing indicators first */ + release_indicator(&dev->routes.adapter, dev->indicator= s); + dev->indicators =3D NULL; + } + if (dev->summary_indicator) { + /* Need to remove existing indicators first */ + release_indicator(&dev->routes.adapter, + dev->summary_indicator); + dev->summary_indicator =3D NULL; + } thinint.ind_bit =3D be64_to_cpu(thinint.ind_bit); thinint.summary_indicator =3D be64_to_cpu(thinint.summary_indicator); --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263495; cv=none; d=zohomail.com; s=zohoarc; b=mms+0Yw4Qvy06yiYBOKuP/V3TX8x04uRBAgmdhLPY5QeKOH5eVmxE8Lce6SxwE34xhDGx2BZ1mRzsRT6DR8Nwl3MErjGmLVeC1LXBGA28oV9rHYIFM4nydLrCMkHQuzF6AZLC3Bc0QiTME1ZRXURcHto/Fzj91nTeRtzUEbLYQQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263495; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=89e5gNoB2Ei/k8uxIFcdXhA9zCqKYCXVj9clR1OIKRU=; b=QJfqSq8pRTtJmyVbAOoXkG8Mjq7QVWbwIDCFj1VQHqt7z3oAMAiJY6AlH+lkRcLyaH69z0Pcfe9+oI9xUP/PYbFZHz4W8PYnHwxtC2CB4/fH6ofYJEKxf4dUjARFVbGbuzjAgOK9BWkRJTyoQ1pvJ6TE/IKzKt8jfUjGHyJX3FQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263495614566.5475626354832; Sat, 17 Oct 2026 11:58:15 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9aC-0008Pw-VZ; Sat, 17 Oct 2026 14:56:41 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9Zl-0008DN-76; Sat, 17 Oct 2026 14:56:13 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9Zi-0003bn-Cu; Sat, 17 Oct 2026 14:56:12 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 0798E1DE6A7; Sat, 17 Oct 2026 21:56:02 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 14831443372; Sat, 17 Oct 2026 21:56:00 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263362; bh=nLdVmRNqxssAPbTGCImmjqx3OHFVRNYQnUorSN86MNI=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=gArOteBDsYigXg2MAMwWedNuh+wracU8P0m4wbRV/EZA6Vw6ekBQAHmW5b7u35a1j KWMWYD9tUOVNgslWJpahrmODsYl/6mBdM+ckDeWXTm7BQulleMyrbs3/VCRm0g5B2+ acXt+cCkLC7Os/5frvZRdyrcCNwziexI+w0HCXFcmd7oc1VAxEkvN37oMe1jR434zx hwTBzAOxDU0WlJyoe4RxF2p5yaq6rMg+xNc44wAtpjpOLzhn0ZhC+iI3V8pa+B+i3t J/uIqf+iEMtO1n/aYhyEBo6kIcNNE6RN7LqhUTXt1jMlvBoYHjQW5vLukb7kzBZSih gffkyjygYDjKA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Eric Farman , Matthew Rosato , Michael Tokarev Subject: [Stable-10.0.15 07/63] virtio-ccw: Fix rc check in read configuration path Date: Sat, 17 Oct 2026 21:54:23 +0300 Message-ID: <20261017185528.722197-7-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263498521158500 Content-Type: text/plain; charset="utf-8" From: Eric Farman Both the read and write config paths use wrappers around cds->op_handler, depending on the direction the I/O is flowing. But they expect opposite values in the returned variable to indicate success. Fix this by unifying those checks, where CCW_CMD_READ_CONF needs to see !ret as success. The end result is some erroneous data in the SCSW response data, but the overall success/failure is correct. Cc: qemu-stable@nongnu.org Fixes: d895d25ae2 ("s390x: css: report errors from ccw_dstream_read/write") Reviewed-by: Matthew Rosato Link: https://lore.kernel.org/qemu-devel/20260922201526.2383047-4-farman@li= nux.ibm.com Signed-off-by: Eric Farman (cherry picked from commit bd5bc2861fb6b5ba74137ed263465780894ec432) Signed-off-by: Michael Tokarev diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c index b2887a1443..04ac7de5d5 100644 --- a/hw/s390x/virtio-ccw.c +++ b/hw/s390x/virtio-ccw.c @@ -473,7 +473,7 @@ static int virtio_ccw_cb(SubchDev *sch, CCW1 ccw) } else { virtio_bus_get_vdev_config(&dev->bus, vdev->config); ret =3D ccw_dstream_write_buf(&sch->cds, vdev->config, len); - if (ret) { + if (!ret) { sch->curr_status.scsw.count =3D ccw.count - len; } } --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263696; cv=none; d=zohomail.com; s=zohoarc; b=WBGVTJ93qTPkmXuZrT/PvlksJcp0QS8JEaMKq2QYhxADwXIswLUdlDifJiXjpfmZp/GoLIF28AdWF1UD/dQ0OgrFiGbNh48G2kro78+wdamJJ7xCvLgQEjThYLAlWrvAFZtwgNraN/V7CBBgLxdlufVWO8dRpYsKQbgxgZwAJ1c= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263696; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=CxSjajuegttggQUCaCyOSWVZay2nGPRVnMhRlDI6vk4=; b=YCQ6l3dRxfJIGgS75J4Pr42v0hJlWrgM5aL5KYTqTLNSuy9XyCAOuLfxZxCavNJWQjSQxxeRZHL0BlCryhcq+MISrHVO87AvL4hlQFlfHV/jqv9fkSdcYLUjcZDeDpIEF4t2V6x0dZpIAITDdRd5uPhkshkYtVthMFHU2RnMBso= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263696050894.5947106547184; Sat, 17 Oct 2026 12:01:36 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9aH-0008T6-Ox; Sat, 17 Oct 2026 14:56:45 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9Zn-0008EX-47; Sat, 17 Oct 2026 14:56:15 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9Zl-0003by-Aj; Sat, 17 Oct 2026 14:56:14 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id D2F511DE6A8; Sat, 17 Oct 2026 21:56:03 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 68947443373; Sat, 17 Oct 2026 21:56:02 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263363; bh=+MXI3wIY5KUAYYaoBVe5VFV+DcUyibOYnh0uQj7gg8s=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=hEE2B6Bdae6Ju4nXVesjQCoX4IO4zuKJYNzEPFjp3+CQ8smU5hQl+2PVtaOBZ7rYn +NifFs/upQZEK2dXogkzGHKNNNkvySTjf7TtFcZ3rzZCQ8AdcdUu5Z3YcSkYlRxlEk 0LR4SsCeVGNt9UTtSXse+7jfwv4XuoCHaBTuRtpM0bVR0/P3wITnNcKGtnSuuaBRUv NOqfxllDWhjPfvJNkOGuOt2BXesNwvksXMhcvgFcwSxq2dcNaeMlHXrUC2G5xonhMv 4QioCqvP7oz+0GgCXH9+AnV5qFDWKzMBpLP+8/ZCYY1tNHAX5WiOebBFgFa68mHZ0v R1PBjLld+EcQw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Eric Farman , Anthony Krowiak , Matthew Rosato , Michael Tokarev Subject: [Stable-10.0.15 08/63] vfio/ap: Clear error object pointer after non-fatal errors Date: Sat, 17 Oct 2026 21:54:24 +0300 Message-ID: <20261017185528.722197-8-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263696563158500 Content-Type: text/plain; charset="utf-8" From: Eric Farman Registering a new IRQ notifier will allocate an error object if needed, and warn_report_err() will release that memory once it's finished. The pointer remains, however, so subsequent errors after the non-fatal errors in vfio_ap_realize() would cause an assertion failure for a non-NULL pointer. Fix this by clearing the pointer once the warning has been reported, to reset the state of the error objects. Cc: Anthony Krowiak Cc: qemu-stable@nongnu.org Fixes: 1360b2ad1f ("s390x/ap: Wire up the device request notifier interface= ") Fixes: 0fb8a62fe4 ("hw/vfio/ap: notification handler for AP config changed = event") Reviewed-by: Matthew Rosato Reviewed-by: Anthony Krowiak Link: https://lore.kernel.org/qemu-devel/20260922201526.2383047-5-farman@li= nux.ibm.com Signed-off-by: Eric Farman (cherry picked from commit 057ca01937b75d772da5a0f8c0282e7c9dbdfb63) (Mjt: the second commit in Fixes is v10.0.0-1538-g0fb8a62fe46c, which is pa= st 10.0, - so pick up just the first half of the fix for 10.0.x series) Signed-off-by: Michael Tokarev diff --git a/hw/vfio/ap.c b/hw/vfio/ap.c index c7ab4ff57a..0e6501efeb 100644 --- a/hw/vfio/ap.c +++ b/hw/vfio/ap.c @@ -171,8 +171,10 @@ static void vfio_ap_realize(DeviceState *dev, Error **= errp) /* * Report this error, but do not make it a failing condition. * Lack of this IRQ in the host does not prevent normal operation. + * Clear the pointer, since the warning will release it. */ warn_report_err(err); + err =3D NULL; } =20 return; --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263481; cv=none; d=zohomail.com; s=zohoarc; b=fQIEdJruRxM4TeD4sKro4xNkhwAaCG9xthqGmdXRsJDg8qPJd1zVoRqpJECptfvve63h9D4sY9cHLiJYV3km/iGpicceDJt5CmvRWejUriqOG18snHQ1Fa9CI05A2gimDp5DW+vRHGKet3NcGjmwVcY09RpXLiCrLgjrOeQFPa4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263481; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=4KHo/lkcJEqPvADIAaiuWIV4R4jGrJ9NoBaOP6Xmp7Q=; b=Fy2jOIO3jcjmoF07dz+l91lI3zpn/VAkFML/34U0kH6qlQhwqUvdpQ6xXuKvIgdJvNBRyNDK55Btuk/yLmmol4BSPywT/r+lvBOWIdAUfWUATQgThffh6abur0rq1NvUigKHfjgVYnKc2TT3CTmKudy18srci+1/q0BjmokAM3s= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263481907295.6562799738182; Sat, 17 Oct 2026 11:58:01 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9aI-0008UM-FL; Sat, 17 Oct 2026 14:56:46 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9Zo-0008Ep-SP; Sat, 17 Oct 2026 14:56:18 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9Zm-0003cM-Kl; Sat, 17 Oct 2026 14:56:16 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id E8F711DE6A9; Sat, 17 Oct 2026 21:56:04 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 13271443374; Sat, 17 Oct 2026 21:56:03 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263364; bh=S4KO3HMtJ47zu/nn5ta7t0PN4/lDWBv5KmMbCgFVme4=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=WcQopw2vleHdRTtsRDueUoXuwAzXpMSn5qFZhn3vMXFv7S/4TmoYfx1yqKsGElisb dgONzuoGA+efCeF8fLmwtEAgugPTIK24eS8rGA2jD/gtnnhhdI4ldaz5mIMRp0PFzl NQVfwzD35xtNRGaOueKlve+pQrffGP7AcJenAlhyR0EyhlYNCRhaM8ofGtbvQOtqk8 92c3i1sCpypegOobTGe1dIoI3sxRFvlT1s/zPgQb08y6xRa+d9KfWbn5OoeEc/Hzlk +Zg1e0rS/bGjTlV2/J4qt5Or+5mu1N+g+pcizmXwTLSdUlroMbX9pwPK8S14c0vG+9 GdzA+83ZGvtaw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Eric Farman , Christian Borntraeger , Matthew Rosato , Michael Tokarev Subject: [Stable-10.0.15 09/63] hw/intc/s390x: Fix check after g_try_realloc Date: Sat, 17 Oct 2026 21:54:25 +0300 Message-ID: <20261017185528.722197-9-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263484216158500 Content-Type: text/plain; charset="utf-8" From: Eric Farman The loop to store pending IRQs uses g_try_realloc() to expand the buffer being used, but the returned address is stored in a pointer-to-pointer, thus the check is supposed to be examining the contents of the pointer, and not the pointer itself. Define a temporary variable to catch and test the returned pointer. If it's NULL, return to the caller to perform the free on the unmodified buffer. If it's not NULL, store it in the caller's pointer and restart the loop against the new struct. Cc: qemu-stable@nongnu.org Fixes: 3a553fc658 ("s390x/kvm: implement floating-interrupt controller devi= ce") Reviewed-by: Christian Borntraeger Reviewed-by: Matthew Rosato Link: https://lore.kernel.org/qemu-devel/20260922201526.2383047-8-farman@li= nux.ibm.com Signed-off-by: Eric Farman (cherry picked from commit 77cc481c23118d0fc3711525dd64373c6797ceed) Signed-off-by: Michael Tokarev diff --git a/hw/intc/s390_flic_kvm.c b/hw/intc/s390_flic_kvm.c index 10aaafbb31..421b993c69 100644 --- a/hw/intc/s390_flic_kvm.c +++ b/hw/intc/s390_flic_kvm.c @@ -254,6 +254,7 @@ static int __get_all_irqs(KVMS390FLICState *flic, void **buf, int len) { int r; + void *new_buf =3D NULL; =20 do { /* returns -ENOMEM if buffer is too small and number @@ -263,10 +264,11 @@ static int __get_all_irqs(KVMS390FLICState *flic, break; } len *=3D 2; - *buf =3D g_try_realloc(*buf, len); - if (!buf) { + new_buf =3D g_try_realloc(*buf, len); + if (!new_buf) { return -ENOMEM; } + *buf =3D new_buf; } while (r =3D=3D -ENOMEM && len <=3D KVM_S390_FLIC_MAX_BUFFER); =20 return r; --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263480; cv=none; d=zohomail.com; s=zohoarc; b=X2HuCjWHDja27rYCh9HxxRXFMrjGtbg/ZDBzNg911JJGagsU5lRPRZJjTso4PJh1p6H6gi5ewUGILRjYmUTh+VNRmUyQizyu44iQPJrCOCW3/3ZgMYcHHHB7v6Jkj/Rek1kEGXe/5qRPmrDiclQu2xHlgu3xnDGu19uguThozK8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263480; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=9KVwGQgdILRNjU29FW2eNRxjNeGmapYT2nUXXAmD6a8=; b=l4Yz7diOk6jzrfhKghv7UTaU3w+zEp6hCDc478HNsmzUL6ZrPphYBm16X0piTvhjot8IoZfb2niZPFiTGVZkqY1pbKbyUQP6JToQPohX02wPdsMgzCOuMXrVAb5eGUcTQSpeJ+iccVsuPsyL27inj/kVMSxnUS9ewivTe0d7E6I= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263479082689.1099699859836; Sat, 17 Oct 2026 11:57:59 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9a6-0008Ll-HU; Sat, 17 Oct 2026 14:56:35 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9Zq-0008F8-L9; Sat, 17 Oct 2026 14:56:20 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9Zp-0003ca-0H; Sat, 17 Oct 2026 14:56:18 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 60EBB1DE6AA; Sat, 17 Oct 2026 21:56:06 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 2D727443375; Sat, 17 Oct 2026 21:56:05 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263366; bh=tSb0Tqwf4A9fdsaISwiIaIBvnw7/aaR7Lo2gyb4UNkE=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=HgKfHGJkiPaEc077pn2EQj5tpmvAQaXM/K9B8sIuSxJ+EbC0hnpfHcKeOzsp0SRw0 bWwFnX4lhKWe6QTqWCLnwWeciat2lKpbMBLIryMElGY2b2qA9xFoyk81lsIfk5nkgp 6WngcQOR4rPgZoN3LTp0TiNTu+AlG7e7bof+c0bloyy/8AbmM7GhX1s8lbUxgEcE0S yN0vO75zGSTNuO6PqAZmKn/oQjmOh1yxn83R8t1MYP4isrEk8x/aUMrmY3/ttME+d9 3N0bm7CIKX3telqaaiM1ZwXXw0EXJEGpG6TbBpcVoO36PEHyGD4zFsOkIGg3CuM/5l j0NTVzF05XYnA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Eric Farman , Matthew Rosato , Michael Tokarev Subject: [Stable-10.0.15 10/63] s390x/css: Use datastream pointer for checking no-data CCWs Date: Sat, 17 Oct 2026 21:54:26 +0300 Message-ID: <20261017185528.722197-10-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263482162158500 Content-Type: text/plain; charset="utf-8" From: Eric Farman The channel subsystem will reject channel programs that incorporate 256 CCWs without a data transfer, but the existing check to account for this only does so for CCWs with a data address of zero. Other valid CCWs that wouldn't transfer data are not accounted for. Rather than re-inventing the wheel, use the output of the datastream at the end of the entire CCW parsing tree to indicate whether data was moved or not. Cc: qemu-stable@nongnu.org Fixes: e8601dd5d0 ("s390x/css: catch ccw sequence errors") Reviewed-by: Matthew Rosato Link: https://lore.kernel.org/qemu-devel/20260922201526.2383047-9-farman@li= nux.ibm.com Signed-off-by: Eric Farman (cherry picked from commit 930a188edbbcbd68aadaa1db22e4db1b785a2171) Signed-off-by: Michael Tokarev diff --git a/hw/s390x/css.c b/hw/s390x/css.c index 79a6c90175..c480f04d0a 100644 --- a/hw/s390x/css.c +++ b/hw/s390x/css.c @@ -1042,13 +1042,6 @@ static int css_interpret_ccw(SubchDev *sch, hwaddr c= cw_addr, =20 check_len =3D !((ccw.flags & CCW_FLAG_SLI) && !(ccw.flags & CCW_FLAG_D= C)); =20 - if (!ccw.cda) { - if (sch->ccw_no_data_cnt =3D=3D 255) { - return -EINVAL; - } - sch->ccw_no_data_cnt++; - } - /* Look at the command. */ ccw_dstream_init(&sch->cds, &ccw, &(sch->orb)); switch (ccw.cmd_code) { @@ -1129,6 +1122,20 @@ static int css_interpret_ccw(SubchDev *sch, hwaddr c= cw_addr, } sch->last_cmd =3D ccw; sch->last_cmd_valid =3D true; + + /* + * A CCW that transfers no data is allowed, but ensure an upper limit + * is established to prevent long-running channel programs that don't + * move actual data. + */ + if (ret =3D=3D 0 && sch->cds.at_byte =3D=3D 0) { + if (sch->ccw_no_data_cnt =3D=3D 255) { + ret =3D -EINVAL; + } else { + sch->ccw_no_data_cnt++; + } + } + if (ret =3D=3D 0) { if (ccw.flags & CCW_FLAG_CC) { sch->channel_prog +=3D 8; --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263537; cv=none; d=zohomail.com; s=zohoarc; b=VGExEOT+bL8ilDWNptuwwXQbEBniyAA/iTqM2lZ3JgERsiEQmtwml9eeQwWvFnV4oqKbqYEcuVd9/yMxq43zbBYswUpxOU1qJuy+mYT2/XS/CA63KgGQ21rniHK68l9KqZuCMznKpfWGCj/kR/IllUZNIcaBc9Y6g/1lxHwEZKs= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263537; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=tOWE2NJPAHWGEPj2F1ZIdgBmTGrxT9IMfOdhEp5oPT8=; b=b57seMkeJeMnBA08n0PW40vGgdrOgXhusechAewrTz+YFj4+Z3LjfvR8HmRVbW8BWr63TcszfuGEsb1TgQCo8XJO4+ufiaSY6GJYTJqzjr7LskDFD4Gs7Dsc2hzfJF4+2UOmbmi7NIpZrjkIRGfG85DOVO45fpsHGTlbhkaSt2M= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263537292704.5379589126193; Sat, 17 Oct 2026 11:58:57 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9aK-0008VJ-LX; Sat, 17 Oct 2026 14:56:49 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9Zs-0008FQ-1f; Sat, 17 Oct 2026 14:56:20 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9Zq-0003cq-Cy; Sat, 17 Oct 2026 14:56:19 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id DA7971DE6AB; Sat, 17 Oct 2026 21:56:07 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id B1D49443376; Sat, 17 Oct 2026 21:56:06 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263367; bh=y33UjaNmeodbvgW+vvTu/Qo/QJ3QIrjbmPwUOXWxO4g=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=J5nb7hBYbCoJiLax45FIZTp9EUPNjmVef6I17hNtBqJifY2QitM2YgZChAXeHRn6g qu2krfKpF6Gc4pvnGQ3cGBlHzUnBfdjFCakVYbKzsLUzIUQny2ESoSRvojr6vOOxrp cZrn2JZUwfSmup0q+sf0Kj9TZ1+4lVHzeRhE6uJapbUGun5bEMjcIblTAikFzcPrm8 GJc9aShmG0J63iFrjqkLg4IqUYCuUV4P6RqEaAdIRBV1oPr4HJWkhQ85P6JwIcJ7K/ 9oL9xX2MeKAhbWFBMxSUlXgZQR/L5BskGTUnUCKlav0rCT5t8EXt9wanmgdFGeJrwi nFY1gqojd6l3g== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Eric Farman , Janosch Frank , Matthew Rosato , Christian Borntraeger , Michael Tokarev Subject: [Stable-10.0.15 11/63] s390x/sclp: Reject short headers in PV case Date: Sat, 17 Oct 2026 21:54:27 +0300 Message-ID: <20261017185528.722197-11-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263539393158500 Content-Type: text/plain; charset="utf-8" From: Eric Farman An invalid length in an SCCB header correctly generates a specification exception for the regular (non-PV) codepath that processes an SCLP instruction intercept. The PV case doesn't, because the UV enforces a valid length before getting to this point. The length is used to allocate storage later down the line, so doublecheck the length here in the (unlikely) case it is too short. Cc: Janosch Frank Cc: qemu-stable@nongnu.org Fixes: c1db53a591 ("s390/sclp: read sccb from mem based on provided length") Reviewed-by: Matthew Rosato Acked-by: Christian Borntraeger Link: https://lore.kernel.org/qemu-devel/20260922201526.2383047-10-farman@l= inux.ibm.com [farman@linux.ibm.com: Updated commit/comment text, per Janosch] Signed-off-by: Eric Farman (cherry picked from commit 119860f15cd239dced773de9375f741db255652d) Signed-off-by: Michael Tokarev diff --git a/hw/s390x/sclp.c b/hw/s390x/sclp.c index 977b8f5907..ed7481ba4f 100644 --- a/hw/s390x/sclp.c +++ b/hw/s390x/sclp.c @@ -279,6 +279,11 @@ int sclp_service_call_protected(S390CPU *cpu, uint64_t= sccb, uint32_t code) =20 s390_cpu_pv_mem_read(env_archcpu(env), 0, &header, sizeof(SCCBHeader)); =20 + /* We should never end up here due to UV checks, but lets be sure */ + if (be16_to_cpu(header.length) < sizeof(SCCBHeader)) { + goto out_no_write; + } + work_sccb =3D g_malloc0(be16_to_cpu(header.length)); s390_cpu_pv_mem_read(env_archcpu(env), 0, work_sccb, be16_to_cpu(header.length)); @@ -292,6 +297,7 @@ int sclp_service_call_protected(S390CPU *cpu, uint64_t = sccb, uint32_t code) out_write: s390_cpu_pv_mem_write(env_archcpu(env), 0, work_sccb, be16_to_cpu(header.length)); +out_no_write: sclp_c->service_interrupt(sclp, SCLP_PV_DUMMY_ADDR); return 0; } --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263519; cv=none; d=zohomail.com; s=zohoarc; b=CBKIngdC7VCJatEc+FBsl1p61u9dEWfV1hRU5v+N1xaJX/mvmkbBiGQ8PUJfX2XLEckhq1uJoWINxOUkduRsFZOHP8QcoZUVMF8wApAVhAVe5AwB6Fcly5GypwoESS8DRhFG7dr1oTdnUvDwNV1Vvrk9SOzQf+exXEJq3mpyCHY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263519; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=b7sDrcZOi0fcRDNZ1y++eCfYRZjTuZnGOyYriVQl8Jk=; b=ODTDWWWJgFuCjJcTknTYipqHo53TTP7f8MQZxQQ3pMFg6o9XXL+3MAfBrSE69WR9tIcb6kMzaOs0Cg7la4WVDlsXmsniatroOCNFnq5g1l2TSXH1uRmBQSTBE9xq29pEhaTKsVk+r4pXhI9ONljjzwR9O4rAmwSKM0Yf20HMnOs= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263519396747.7412070035629; Sat, 17 Oct 2026 11:58:39 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9aM-00004s-Bi; Sat, 17 Oct 2026 14:56:50 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9aD-0008Rn-Sp; Sat, 17 Oct 2026 14:56:41 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9aC-0003d3-5I; Sat, 17 Oct 2026 14:56:41 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 031F11DE6AC; Sat, 17 Oct 2026 21:56:09 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 1BCF9443377; Sat, 17 Oct 2026 21:56:08 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263369; bh=BrXGxebFoozm8n7AzRscwsHaYJwlpio6lCZ/hQOMtRY=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=JfywOwe0ChY9ivDbcXWACrfNTRal7Kgo9GmNvLi3WaCoFVKMk2sYIaqhMGGb37swp 4g0wozv+Bzl/WVSlIiQsc7sgMqv0YD5q05lJYJLC9Kfy/LCn4ip795WVLuqjUFBShW K6VArr7WyMegCo0/OjxVBKrU+XymaN941EmBYaPR8LaCyojXBy7+jMiCkMnmgZHbF1 XdFRjAH8DI6BcfHVFyGLc+OVT3DYaIQfrMxT0ASlR/MQ4n1/Hi7GU+XEZ5x4ash1Ot NOCxmiyJkSrOn46iusiDFd59suUV/JUaQGiP+817QRZLvYVGgdLfxm+Aw4HUjzLNch sjQlCRIkufbZw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Matthew Rosato , Eric Farman , Farhan Ali , Michael Tokarev Subject: [Stable-10.0.15 12/63] s390x/pci: Fix frame stepping in rpcit_service_call() Date: Sat, 17 Oct 2026 21:54:28 +0300 Message-ID: <20261017185528.722197-12-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263521033158500 Content-Type: text/plain; charset="utf-8" From: Matthew Rosato When walking the guest IO address table, an invalid segment or region entry causes table_translate() to return entry.len equal to the frame size for that table level (1 MiB for ST, 2 GiB for RT). Adding entry.len directly to start only advances to the correct next frame boundary if start is already frame-aligned at that level -- which is true for a well-behaved Linux guest but not a general requirement. Add logic to advance start to the next frame boundary rather than simply adding entry.len. For a frame-aligned start (the typical, well-behaved case) the result is identical. Fixes: 0125861eacc3 ("s390x/pci: fixup the code walking IOMMU tables") Cc: qemu-stable@nongnu.org Signed-off-by: Matthew Rosato Reviewed-by: Eric Farman Reviewed-by: Farhan Ali Link: https://lore.kernel.org/qemu-devel/20260929153012.774530-2-mjrosato@l= inux.ibm.com Signed-off-by: Eric Farman (cherry picked from commit e57ad36701886404baaf5216bacfa9a21f98fd6e) Signed-off-by: Michael Tokarev diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c index d9eb9c9efa..f01cdeae61 100644 --- a/hw/s390x/s390-pci-inst.c +++ b/hw/s390x/s390-pci-inst.c @@ -806,7 +806,8 @@ int rpcit_service_call(S390CPU *cpu, uint8_t r1, uint8_= t r2, uintptr_t ra) coalesce =3D 0; } =20 - start +=3D entry.len; + /* Advance to next frame boundary if start was not frame-aligned */ + start =3D QEMU_ALIGN_UP(start + 1, entry.len); while (entry.iova < start && entry.iova < end) { if (dma_avail > 0 || entry.perm =3D=3D IOMMU_NONE) { dma_avail =3D s390_pci_update_iotlb(iommu, &entry); --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263756; cv=none; d=zohomail.com; s=zohoarc; b=bPbY6QFb3tupdarxg+PRY+v3nz4XiyimmcoI98MNWVuVOidBn2hKYOgUuA2FxTRbi3RCsedBENg8KxgTGo9bammXfnkK45gzrrtPi5JaNcA4y3kb8njolw5WAcm6glwbODeCqCW/ABuPBUAlCnWwTNBd9yRBePGfXVDYJHLD8dY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263756; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=qG/h95ePg9DICcwCiX1neBlLsTl5GAz7HsXSbSZ2pFk=; b=HkOW38P2arTwVHGm9nEzGBY7tHgQLcgW8mv1dL9wQPxn5KP7sK3Nbi/4aKNGwIRCDvQt5cG3ZJjtUu36HfcmY2sRQw1IUddOmYk0m3mZBAO06bvOFWixsH1yS/jurGt/ejwzt3NgwBH5Petx2GDK31OMjrivmIsLYlfIKLwemyA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263756881269.9344670001135; Sat, 17 Oct 2026 12:02:36 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9aL-0008WD-OB; Sat, 17 Oct 2026 14:56:49 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9aF-0008Sl-Hm; Sat, 17 Oct 2026 14:56:44 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9aD-0003dE-IV; Sat, 17 Oct 2026 14:56:43 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id CD82F1DE6AD; Sat, 17 Oct 2026 21:56:10 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 78D23443378; Sat, 17 Oct 2026 21:56:09 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263370; bh=Iwbhg3ibPz1Bhm9E/egqBaWZUe8H2YcpdcesX1LNXIs=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=HJrVWpBWAPY/sXvx+g2AaxCHl7JwsVTgESf9tPp6QMWiMk06J4rFAdDe1BWaGyLj5 W0h+gslKcsu9zemSSxt+8sOLLhmtvcVPcYzsAm7aNHbwEV13tQCdhd00c7OTmKLyDG i+2Db+fOfCzF6ULB2m0mRdq+iZHMXDI2NeJ3rH0Eqv1YFZpHX9ccE3IfXJEr3GUO3e oASG5Y2qznqC8vigKdN34M2RWoLRPqtOSgik3v3cG4q9cRN6nWcQ4jBdEkNynIDRl+ G8VqTvQ5YyPZ10vKRPVOIx/x3Gp8EfQpEbPOQ/eILwHJjSbVZpsdj1MsE9pr7+TH1a 8PtDUEZ+91i/g== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Matthew Rosato , Farhan Ali , Eric Farman , Michael Tokarev Subject: [Stable-10.0.15 13/63] s390x/pci: Use qemu_log_mask() for guest-triggered errors in reg_ioat() Date: Sat, 17 Oct 2026 21:54:29 +0300 Message-ID: <20261017185528.722197-13-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263757737158500 Content-Type: text/plain; charset="utf-8" From: Matthew Rosato The error paths in reg_ioat() that are triggered by a guest providing invalid MPCIFC arguments use error_report(), which writes unconditionally to stderr. A misbehaving guest can exploit this to flood the host log by repeatedly issuing the instruction with bad arguments. Replace these with qemu_log_mask(LOG_GUEST_ERROR, ...) so that the messages are suppressible. Fixes: 863f6f52b713 ("s390: implement pci instructions") Fixes: dfcee1ea4c52 ("s390x/pci: add support for guests that request direct= mapping") Cc: qemu-stable@nongnu.org Signed-off-by: Matthew Rosato Reviewed-by: Farhan Ali Reviewed-by: Eric Farman Link: https://lore.kernel.org/qemu-devel/20260929153012.774530-3-mjrosato@l= inux.ibm.com Signed-off-by: Eric Farman (cherry picked from commit 10a81449a279be0d5b46c3422b445ca3f42d3393) (Mjt: fix #include statements in hw/s390x/s390-pci-inst.c) Signed-off-by: Michael Tokarev diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c index f01cdeae61..1be3bc0f46 100644 --- a/hw/s390x/s390-pci-inst.c +++ b/hw/s390x/s390-pci-inst.c @@ -14,7 +14,7 @@ #include "qemu/osdep.h" #include "exec/memop.h" #include "exec/memory.h" -#include "qemu/error-report.h" +#include "qemu/log.h" #include "system/hw_accel.h" #include "hw/boards.h" #include "hw/pci/pci_device.h" @@ -1042,11 +1042,12 @@ static int reg_ioat(CPUS390XState *env, S390PCIBusD= evice *pbdev, ZpciFib fib, =20 /* currently we only support designation type 1 with translation */ if (t && dt !=3D ZPCI_IOTA_RTTO) { - error_report("unsupported ioat dt %d t %d", dt, t); + qemu_log_mask(LOG_GUEST_ERROR, + "unsupported ioat dt %d t %d\n", dt, t); s390_program_interrupt(env, PGM_OPERAND, ra); return -EINVAL; } else if (!t && !pbdev->rtr_avail) { - error_report("relaxed translation not allowed"); + qemu_log_mask(LOG_GUEST_ERROR, "relaxed translation not allowed\n"= ); s390_program_interrupt(env, PGM_OPERAND, ra); return -EINVAL; } --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263741; cv=none; d=zohomail.com; s=zohoarc; b=Rurp/N6suoT/CiZlA9EJZKveMlkc2mutWSPJhSq9AGnCOBRrtiMp7W4HEFTLmOEZA/WbnR6VtiGBsp5jrjh2574r4sDOtgznv4oaLdvTkvmbSLHLM4/IiFgYCoLvaKC8r9zeUmqu0Pv1JVFutV7RBE0/VHTRaQbk+7JstN5PEUk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263741; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=OfFegWU8X4P9gydUyIXhHk6i13ytxDDEVJs9/i40vjg=; b=lw2kqx+357Fx+oicLWAK3iikW0lIciyVMdmGeX7jX/myNAecZ3CzJFDUeUjYcKV8kSHkmlcuB+LLRIB9SrDXTQNiD2Uy2nVc17fchF98Ig0ONrWpoHgi8O30ybflVIZ3WASWQnwp22yGJZu5yD5KF2d0m7GVa5GBzoNag1Ze7Rs= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263741044951.2174840007165; Sat, 17 Oct 2026 12:02:21 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9aN-00005C-Ex; Sat, 17 Oct 2026 14:56:51 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9aH-0008T1-5P; Sat, 17 Oct 2026 14:56:45 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9aF-0003e9-EL; Sat, 17 Oct 2026 14:56:44 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 131AF1DE6AE; Sat, 17 Oct 2026 21:56:12 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 256BF443379; Sat, 17 Oct 2026 21:56:11 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263372; bh=ITnnyncWib2x191MC0zn0HdualC3ggSRiq0YHZ6cAEg=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=WnH3R1rf688Ak6Z2qfR0sowhA6/1nxrg22L3F0KvafmXN9cFe9cMvA+KjrXgx+iyX JUax8GO8gyCbDRYwCdTl+UhfxuaiZUBEFLstRp4Qe54Tspjkpzvo7aVo/8MDk9q5YE mzmy+1PFcrL66oaCBGWl+vOuFhY3leci3geWIEIg3ibvXWr3PdY9k9ieG/KMlFTMua Z7KzEVZaDIeMfWUeD2/3x/6zQW18sl/DSfUoyRPP/CU5yJU1P8ZL/zY+V3fpMbrnHX AXj0ckjMrgJXhFjf9LEosP2IwtT5bQLPRoGbg6Ynb7/7emB9j3RZe653D1p1z3qfka +Pm5T3Cnqfgvw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Matthew Rosato , Farhan Ali , Eric Farman , Michael Tokarev Subject: [Stable-10.0.15 14/63] s390x/pci: Reject apertures beyond IOAT capacity in translation mode Date: Sat, 17 Oct 2026 21:54:30 +0300 Message-ID: <20261017185528.722197-14-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263741518158500 Content-Type: text/plain; charset="utf-8" From: Matthew Rosato In order to support direct mapping (which is only bound by the aperture size of the underlying host EDMA reported via vfio) QEMU reports the host-provided EDMA to the guest. However, when using translation mode QEMU only supports up to 4 TiB currently (the size of a single RT table). Reject attempts by a guest to register a translation aperture that would exceed what QEMU can support by giving an operand exception on the MPCIFC instruction that requested the large aperture. This restriction can be removed in the future if/when support for additional IOAT regions is added. Cc: qemu-stable@nongnu.org Signed-off-by: Matthew Rosato Reviewed-by: Farhan Ali Link: https://lore.kernel.org/qemu-devel/20260929153012.774530-4-mjrosato@l= inux.ibm.com Signed-off-by: Eric Farman (cherry picked from commit d818e2b0e6317fe5685ce3671bdb566402ff00e9) Signed-off-by: Michael Tokarev diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c index 1be3bc0f46..f93c48842e 100644 --- a/hw/s390x/s390-pci-inst.c +++ b/hw/s390x/s390-pci-inst.c @@ -1052,6 +1052,21 @@ static int reg_ioat(CPUS390XState *env, S390PCIBusDe= vice *pbdev, ZpciFib fib, return -EINVAL; } =20 + /* + * We report an EDMA that may exceed what QEMU can handle in support + * of direct-mapping. If the guest attempts to register an IOAT that + * is too large, reject it with an informative message. Only direct + * mapping can be used for guests of this size until support is added + * to QEMU for additional IOAT regions. + */ + if (t && pal >=3D ZPCI_TABLE_SIZE_RT) { + qemu_log_mask(LOG_GUEST_ERROR, + "ioat pal 0x%"PRIx64" exceeds max translatable addre= ss\n", + pal); + s390_program_interrupt(env, PGM_OPERAND, ra); + return -EINVAL; + } + iommu->pba =3D pba; iommu->pal =3D pal; iommu->g_iota =3D g_iota; diff --git a/include/hw/s390x/s390-pci-bus.h b/include/hw/s390x/s390-pci-bu= s.h index 04944d4fed..afe205959f 100644 --- a/include/hw/s390x/s390-pci-bus.h +++ b/include/hw/s390x/s390-pci-bus.h @@ -140,6 +140,7 @@ enum ZpciIoatDtype { #define ZPCI_PT_BITS 8 #define ZPCI_ST_SHIFT (ZPCI_PT_BITS + TARGET_PAGE_BITS) #define ZPCI_RT_SHIFT (ZPCI_ST_SHIFT + ZPCI_TABLE_BITS) +#define ZPCI_TABLE_SIZE_RT (1ULL << (ZPCI_RT_SHIFT + ZPCI_TABLE_BITS)) =20 #define ZPCI_RTE_FLAG_MASK 0x3fffULL #define ZPCI_RTE_ADDR_MASK (~ZPCI_RTE_FLAG_MASK) --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263492; cv=none; d=zohomail.com; s=zohoarc; b=c2yPHwchqNzC4sSoFDcSHlScZPV+eYzUL1Yz9So3dwru64WjDwQ0jzBf7ukg5p2Xi5FbkKLkndIXSIFj1nvytE3sYgTQmFwnRW0bz7hotrxSXANOsDcDhViX/Vwo3owVBKisENlBu5hlEHdpxrVo9oI8lrqMRZGjugr7RxUjX9Q= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263492; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=xPN/slyTN3beixQlv5pozLGZe/qjlhfI9nnDGEWyZBM=; b=E5U9AIWJUN9rkF/A5nGckVg/74XoLEuy1xeZ7EhXr3JQyoUadKDBpGrkmf77Mm0vlwWEe3WglM6FyqtPCt9dgjO3meTwZ6anHK9Z8H09RYo3+mUeIb8Isv0/lY+2Os8SZHiHNINikopRR9doD3B/Vs9Zui1LsHwaSisdSfV4VX0= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263492226358.0074112377746; Sat, 17 Oct 2026 11:58:12 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9aQ-00008s-6A; Sat, 17 Oct 2026 14:56:54 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9aI-0008Ud-NI; Sat, 17 Oct 2026 14:56:46 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9aG-0003eS-W2; Sat, 17 Oct 2026 14:56:46 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 28A3E1DE6AF; Sat, 17 Oct 2026 21:56:13 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 489FC44337A; Sat, 17 Oct 2026 21:56:12 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263373; bh=GNvFlSvRYQx1Z0kpH1RH2RJMqbL+Qv5NB/rcxSmHl3M=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=ZjOqg/EtDTHIJsNSZm0/s93u79MX+2VCotzxlG0h5v0VhftLIyzsj7Iabxn0Fm/qT 6ck0FgiPhlxJIoY6kt8kbJyn6KNIAib3fN06pfLXMslfhwzD/KrX12nITXxS7Bzf8W 3Qig8mH3UuSvlTarD6yU2yyFidT07grNf0EhQ2ot0+zfE/7SKW/LxMrP8K47ujqt36 4lzO+9RQyLoR0YBSRdAtOwrhnawUTPh8Yp6s+465HPDPePKv+EC8nl1hhwv2wiyPRd 3HsZbcQ3PmKd2XY9Bldtdo3SWiaXUhJmTtv0VL8vgdvSU2Oedy8uQmVybYbrB8bo30 JHz+g5VQMdgIg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-10.0.15 15/63] hw/usb/dev-smartcard-reader: validate interrupt transfer length Date: Sat, 17 Oct 2026 21:54:31 +0300 Message-ID: <20261017185528.722197-15-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263492596158500 From: Marc-Andr=C3=A9 Lureau A guest can submit an interrupt IN transfer shorter than the 2-byte RDR_to_PC_NotifySlotChange message. usb_packet_copy() asserts that the packet has enough space, so a zero- or one-byte request triggers an assertion failure, crashing QEMU. Check the transfer length before copying and stall the endpoint when it is too short. The notification is preserved for a subsequent properly-sized transfer. Note: a later refactoring patch will switch to usb_packet_size(), but this patch open-code p->iov.size for consistency with the rest of the code. Fixes: CVE-2026-18609 Fixes: 367071447ec5 ("usb-ccid: add CCID bus") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4128 Signed-off-by: Marc-Andr=C3=A9 Lureau Acked-by: Philippe Mathieu-Daud=C3=A9 (cherry picked from commit 1847dcd96d7dbb7d4478b61e1bd7a5ca563d910c) Signed-off-by: Michael Tokarev diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index 73deb3ce83..6206ea7834 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -1123,6 +1123,10 @@ static void ccid_handle_data(USBDevice *dev, USBPack= et *p) break; case CCID_INT_IN_EP: if (s->notify_slot_change) { + if (p->iov.size < 2) { + p->status =3D USB_RET_STALL; + break; + } /* page 56, RDR_to_PC_NotifySlotChange */ buf[0] =3D CCID_MESSAGE_TYPE_RDR_to_PC_NotifySlotChange; buf[1] =3D s->bmSlotICCState; --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263907; cv=none; d=zohomail.com; s=zohoarc; b=Q6tR1MSzVxiad4tv67DhzCCT3vQ6dvcow6b6Gzo23rRBG7XtwQhw1uAYsSk2np49mgOedL+pvLm7zxS/rFRz7NvCFjsenTJh9jkmIkDkD0y+XE4kqGIpWkEbKc8JrzYCr2Z9ng6rXoYbZHIBPn1P1///z8NhFa67lp5UuZkPpF8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263907; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=KsuN7+Ap3foUw8pgmatUljpncOs8I4wdw0EemPXcciY=; b=SE0w0VNJhWEBYpVSWVbw3LJ78v7U5ivF/YgcQOf6pyiBNXQPgyGYwvV2LNw8E/Gsg19uwQfysUvaK4M28mUWU3OHq1zEz276/YFU7r1gZVbloYtUQ0WYuYahml1wN789N801qbO5Ld0VPNVq+xvgY9Ua6sLP3ICaGJ/zbPxvECU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263907206776.7424346819721; Sat, 17 Oct 2026 12:05:07 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9aP-00007A-6C; Sat, 17 Oct 2026 14:56:53 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9aK-0008Vd-J1; Sat, 17 Oct 2026 14:56:48 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9aI-0003ej-KX; Sat, 17 Oct 2026 14:56:48 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 06D0F1DE6B0; Sat, 17 Oct 2026 21:56:15 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 779A144337B; Sat, 17 Oct 2026 21:56:13 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263375; bh=3lx4x7V98BCb9blSP8MfpfClQ8EmEau2vjwkgGHQIpU=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=OYIpxyucAZ795giULI+wAJ/8rW2owNzE++9hzlU8cYfegwcdniu62ZoOJfIbdzQHf eS+V1G9Aru5Neq6hzn8n2oDyMi6H0Ep39Zt6A3Dp9nt9Q1YGenHRuwR3eWlkSpelsu 6f2vNEQNxP2bqbc/W3JIWVyEpNxBwD3g4QSnt3rs59d/v5K39rC4qgK1sZTSmOHg64 78NKHp7Soe8wkNtt46x9cBZpC2SwweaNA3cfTrFzp1Arbb6MVD9A0YuooltjP0Alj3 eowXNDCR28gglcmHetaJBKD1FJXCBCaThJyz60afrCiSf5iig2LbLQVywRaryTSqUB oN+U6b1u/B6XQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , Warisjeet Singh , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-10.0.15 16/63] hw/usb/dev-smartcard-reader: fix OOB read from pending bulk-in ring Date: Sat, 17 Oct 2026 21:54:32 +0300 Message-ID: <20261017185528.722197-16-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263908771158500 From: Marc-Andr=C3=A9 Lureau ccid_bulk_in_get() decrements bulk_in_pending_num when a slot becomes active, but the slot is only truly free after ccid_bulk_in_release(). A guest can fill all 8 ring slots, partially read one (leaving pos non-zero), then send another command whose response reuses the active slot. The stale pos > new len makes the uint32_t subtraction in ccid_bulk_in_copy_to_guest() wrap, reading past data[]. Move the decrement to ccid_bulk_in_release() so the slot stays busy until then. Add an assert(pos <=3D len) before the subtraction. Resetting or removing the card must also discard the active slot so that its stale position and pointer cannot be reused. In practice, the device advertises bMaxCCIDBusySlots=3D1, so a conforming host never has more than one command in flight and the ring never fills. Fixes: CVE-2026-18204 Fixes: 367071447ec5 ("usb-ccid: add CCID bus") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4086 Reported-by: Warisjeet Singh Reviewed-by: Philippe Mathieu-Daud=C3=A9 Signed-off-by: Marc-Andr=C3=A9 Lureau (cherry picked from commit 49851e859506c6326288162718573c1e22ab9bf4) Signed-off-by: Michael Tokarev diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index 6206ea7834..f91eda1a14 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -570,6 +570,10 @@ static void ccid_remove_pending_answer(USBCCIDState *s, =20 static void ccid_bulk_in_clear(USBCCIDState *s) { + if (s->current_bulk_in !=3D NULL) { + s->current_bulk_in->pos =3D 0; + s->current_bulk_in =3D NULL; + } s->bulk_in_pending_start =3D 0; s->bulk_in_pending_end =3D 0; s->bulk_in_pending_num =3D 0; @@ -580,6 +584,7 @@ static void ccid_bulk_in_release(USBCCIDState *s) assert(s->current_bulk_in !=3D NULL); s->current_bulk_in->pos =3D 0; s->current_bulk_in =3D NULL; + s->bulk_in_pending_num--; } =20 static void ccid_bulk_in_get(USBCCIDState *s) @@ -587,8 +592,6 @@ static void ccid_bulk_in_get(USBCCIDState *s) if (s->current_bulk_in !=3D NULL || s->bulk_in_pending_num =3D=3D 0) { return; } - assert(s->bulk_in_pending_num > 0); - s->bulk_in_pending_num--; s->current_bulk_in =3D &s->bulk_in_pending[(s->bulk_in_pending_start++) % BULK_IN_PENDING= _NUM]; } @@ -1079,6 +1082,7 @@ static void ccid_bulk_in_copy_to_guest(USBCCIDState *= s, USBPacket *p, =20 ccid_bulk_in_get(s); if (s->current_bulk_in !=3D NULL) { + assert(s->current_bulk_in->pos <=3D s->current_bulk_in->len); len =3D MIN(s->current_bulk_in->len - s->current_bulk_in->pos, p->iov.size); if (len) { --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263669; cv=none; d=zohomail.com; s=zohoarc; b=Sl6wwJ+MBGYW3GLL+ymwiPy6JsXCYa9VwJlooaPklDnrYQtPKFWfntuPYHu0UH9gKsOu0vFDUmFn2KDnUsFQFr7npvU3pMRmbyQUyCVQohm9bx+zFuxGeFDc1ra1+YAKXFCteu5i/jr6jslWClhHNO3OqpuA9/IqiGqrGFubcFQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263669; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=+3DrsS7rH3EZWSJSPoTHkJ1mdiCfeBuCgsHC8XGVv+g=; b=l2mZXyUNsg5KBX/0wXfu+czz8Aw4+DZNZgVraeSOAH08LNQ8qM0Vj92zpwxi35h9HYxfuHo3TCv9sbbHzLfZNz48hFnPuf7GZo6bS3ZKwq78n2cSjIcUBt8ShT3K6WXzqESPf/b5JBQsWO0YIioQWhicV1LlChHXe304PVLqhRg= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263669765159.08307421775783; Sat, 17 Oct 2026 12:01:09 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9aj-0000Ww-Ab; Sat, 17 Oct 2026 14:57:13 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9ag-0000TB-Ga; Sat, 17 Oct 2026 14:57:10 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9ae-0003f2-AM; Sat, 17 Oct 2026 14:57:10 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id F36F61DE6B1; Sat, 17 Oct 2026 21:56:15 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 3BC3044337C; Sat, 17 Oct 2026 21:56:15 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263375; bh=1ecRbq9letlyxM/bF+GswFVOddcm84SXj9vjz4pGFdw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=hIFZcU+Zug0UfUpjDtPSjefYiS5jftuGUgz+d4KyR3l4HLo7WkgGYjmFey3PYB3nR lwKlw5DPFlHDGFJ50iT7iSP9HDdPF5/7XmnCV6VwbTAT9LpvEL5KTeozsxmMmAjNAJ tgUUvnYY4Fj8u7K4HWKEdweltfVaeVq+E35MjVEmMINo4Zz4gbNhPYfmN8NXBcQJlE PmPiWh6GEhB5q+ZwjGWyEZ97xRt5UpfBQQpKnQbSAm8IGq7Mklf7+lZtV4MpKqfwiH LWWBew0g2oRDdMdFyHodjFylwdKZ4MNXmQRVJrWRkz0sNCTLiJK4S7CovTa9TYL9RC FwVdDJBQQ9tRQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-10.0.15 17/63] hw/usb/dev-smartcard-reader: fix assert on pending answers overflow Date: Sat, 17 Oct 2026 21:54:33 +0300 Message-ID: <20261017185528.722197-17-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263670072158500 From: Marc-Andr=C3=A9 Lureau A guest can send PC_to_RDR_XfrBlock USB messages faster than the async card backend can process them. When the pending_answers ring buffer (128 entries) fills, ccid_add_pending_answer() hits an assert() and crashes QEMU. The CCID spec (section 4) states that a slot can only accept one command at a time. A second command to a busy slot must be rejected with CMD_SLOT_BUSY (section 6.2.6). Enforce this by checking pending_answers_num before queuing a new APDU. When the slot is already busy, report ERROR_CMD_SLOT_BUSY and send a DataBlock error response back to the guest. Fixes: CVE-2026-18410 Fixes: 367071447ec5 ("usb-ccid: add CCID bus") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3997 Signed-off-by: Marc-Andr=C3=A9 Lureau Acked-by: Philippe Mathieu-Daud=C3=A9 (cherry picked from commit d7f20657e756744fec8f84cd225a3b07cfb78526) Signed-off-by: Michael Tokarev diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index f91eda1a14..6298464a22 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -166,6 +166,7 @@ enum { ERROR_XFR_PARITY_ERROR =3D -3, ERROR_XFR_OVERRUN =3D -4, ERROR_HW_ERROR =3D -5, + ERROR_CMD_SLOT_BUSY =3D -32, }; =20 /* 6.2.6 RDR_to_PC_SlotStatus definitions */ @@ -949,6 +950,13 @@ static void ccid_on_apdu_from_guest(USBCCIDState *s, C= CID_XferBlock *recv) ccid_write_data_block_error(s, recv->hdr.bSlot, recv->hdr.bSeq); return; } + if (s->pending_answers_num > 0) { + DPRINTF(s, D_WARN, + "usb-ccid: slot already busy, rejecting apdu\n"); + ccid_report_error_failed(s, ERROR_CMD_SLOT_BUSY); + ccid_write_data_block_error(s, recv->hdr.bSlot, recv->hdr.bSeq); + return; + } len =3D le32_to_cpu(recv->hdr.dwLength); DPRINTF(s, 1, "%s: seq %d, len %u\n", __func__, recv->hdr.bSeq, len); --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263475; cv=none; d=zohomail.com; s=zohoarc; b=nm10H+nIDk0PoMJtVQePYHr3sSKEEvi4rWRVDcpufdqMtkKjUiMY3y7LuznnMVVQ/atwI8WX3IHVjoMg9cDlCP3OgSMEJSZkkc6G+H8tekz6RWv3v8NoFS5ctVIViWqXjZjHdsnFpKLWpNQUsBTNdc3cssEd42JOjcPHWPi1Aic= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263475; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=aw/oX0REp0ZKvrAhhokYP6hPj5nGKqhW0qCW7fJoVUs=; b=Jyg37bVOQtpit6SjW9is6iK8mV+oub1yZI+Z86NBOeHwzsAfLGqbX4JCY1pjflIhN4f/avWcdmA88s+0AElACJn5zCCNAyLuwta+k1UexYV8rSIwsM98sqB9YPPW7Ydbj5ziqSFqsWhPWci80SRCS9NpSSsTnl6KvI1eWsUA/qA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263473336170.49280170528175; Sat, 17 Oct 2026 11:57:53 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9ar-0000Zg-Le; Sat, 17 Oct 2026 14:57:23 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9aj-0000Wu-2M; Sat, 17 Oct 2026 14:57:13 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9ag-0003fK-1c; Sat, 17 Oct 2026 14:57:11 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 8E9251DE6B2; Sat, 17 Oct 2026 21:56:17 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 3F20B44337D; Sat, 17 Oct 2026 21:56:16 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263377; bh=zreQw6wX3nc1zr12UdNGFLvv+qXzGfCTY0NEFlRquCA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=o5gmxnIj6KDkwuHjZRL9AkbQ8aAbVCZBVnVeNt+SCuIa3Zd+u/8lzZpE8EDl4Uy4U yl4uIH6U4pWa75gm1gXCtLSpu7PdzUw8wo+LMb97j/HIMnLAen7cRZ4H0Yn/znFL91 gUJJ+botgHr4tgtVZ9Euxr7A9jeqNqejaU5aoM5NywMnObC9MS5sxEKv6N3aSo+Jec 1FBEMRHzHyfDiGgVKGqAIpwj+AFCTueeGgN7vzJ76b3v0dAFExQULICcg3mRumnu5y 7f1yLB9tz1sniXbB6iqcZaRUHONhvoYtPwCvX4v35g9DoP60OotCJ9tuQKVc27NPb7 YeeD+svYlw5eg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-10.0.15 18/63] hw/usb/dev-smartcard-reader: decode bulk-out length as little-endian Date: Sat, 17 Oct 2026 21:54:34 +0300 Message-ID: <20261017185528.722197-18-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263480155158500 From: Marc-Andr=C3=A9 Lureau The CCID Rev 1.1 specification states in section 1.3, Document Conventions, that fields larger than one byte are stored in little-endian format. The bulk message header's dwLength field is a four-byte field described in section 6, CCID Messages. Decode dwLength with le32_to_cpu() before using it to assemble and validate Bulk-OUT messages. This fixes message handling on big-endian hosts. Reviewed-by: Philippe Mathieu-Daud=C3=A9 Signed-off-by: Marc-Andr=C3=A9 Lureau (cherry picked from commit 069dcc103be7600f2197ecb202c8276022fc35d2) Signed-off-by: Michael Tokarev diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index 6298464a22..81b2905526 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -993,6 +993,7 @@ static const char *ccid_message_type_to_str(uint8_t typ= e) static void ccid_handle_bulk_out(USBCCIDState *s, USBPacket *p) { CCID_Header *ccid_header; + uint32_t payload_len; =20 if (p->iov.size + s->bulk_out_pos > BULK_OUT_DATA_SIZE) { goto err; @@ -1005,17 +1006,18 @@ static void ccid_handle_bulk_out(USBCCIDState *s, U= SBPacket *p) } =20 ccid_header =3D (CCID_Header *)s->bulk_out_data; - if ((s->bulk_out_pos - 10 < ccid_header->dwLength) && + payload_len =3D le32_to_cpu(ccid_header->dwLength); + if ((s->bulk_out_pos - 10 < payload_len) && (p->iov.size =3D=3D CCID_MAX_PACKET_SIZE)) { DPRINTF(s, D_VERBOSE, "usb-ccid: bulk_in: expecting more packets (%u/%u)\n", - s->bulk_out_pos - 10, ccid_header->dwLength); + s->bulk_out_pos - 10, payload_len); return; } - if (s->bulk_out_pos - 10 !=3D ccid_header->dwLength) { + if (s->bulk_out_pos - 10 !=3D payload_len) { DPRINTF(s, 1, "usb-ccid: bulk_in: message size mismatch (got %u, expecte= d %u)\n", - s->bulk_out_pos - 10, ccid_header->dwLength); + s->bulk_out_pos - 10, payload_len); goto err; } =20 --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263737; cv=none; d=zohomail.com; s=zohoarc; b=RyNUUfe6woFooSgnl2MEfvsZcYNtaBwni7gWsNFs7stoQi/pOPRVslEFM5iItMO968IogFntcTic9XIDg+LNv27rtl2KYgHwtYJYPVKzhYt6bDNztY3fVRQMP7n7TkZAzaUOcN+PpzkHmhV072MO9x6MtoteIopoU1Hp7bgnEU0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263737; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=H8YONuhU6AICfCitlIi1sYXb0Bj7hqxNRxWHlGh8PfI=; b=KXJ3Qh20ywgQibsrRlz7kihAcoIF8peXM+fkAfLDd+cjvkwxafSBKBIahafhJ5F+U91BgmEFvrke/QuYjvwhy74PwB0xkXYga8sr71e8affKL80TgA5xDQabr9Li/fwSPa8Do9uZiS7yIasbHMA/ZrbDwEVKM9s9RWSU2XMQUsI= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263737914228.8960073894109; Sat, 17 Oct 2026 12:02:17 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9b4-0000uc-LW; Sat, 17 Oct 2026 14:57:35 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9ak-0000YK-A7; Sat, 17 Oct 2026 14:57:14 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9ai-0003gI-Pp; Sat, 17 Oct 2026 14:57:14 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id CD21A1DE6B3; Sat, 17 Oct 2026 21:56:18 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id D8BD644337E; Sat, 17 Oct 2026 21:56:17 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263378; bh=RCLJBtu4un76A2/PxUP84DT7XnR+7pgRtnzWN4ApPLw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=EhKEFjcPHJM1dAxdpp5bXcNn8dIx4Iqvd0PlX6XMawwZ/CSZJnGd/1Eua9q/Hnz+M 52RXzQllZZDWCJ0KeiUsR0WnHqjkrYwpZIJtpt0dzkTjiCAkY743genXG/zgI8RN9r 1OusBBdcZAiIiKpdObcDKO3OGXAn9dR5K4gxPqCelDMOYVuRBGwL8MBMVoBFLazojq BF5ZB6Rrb94MWpt4S1XYa6uA47F9z4+fPDx1AxVD/5Hl7ghsERWNDQoDkMAEXvo6Cr K2VJFOyrb+3DYokZlN22KLqVBqhyARtEIg5l4dREbiIXbGUUeUvKoZe6i4gRYprKXd tTJQijaH+Z+nQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-10.0.15 19/63] hw/usb/dev-smartcard-reader: validate migrated fields in post_load Date: Sat, 17 Oct 2026 21:54:35 +0300 Message-ID: <20261017185528.722197-19-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263739561158500 From: Marc-Andr=C3=A9 Lureau Validate fields loaded from the migration stream to reject crafted or corrupt data before it can cause harm. Signed-off-by: Marc-Andr=C3=A9 Lureau Acked-by: Philippe Mathieu-Daud=C3=A9 (cherry picked from commit 665494c3ac0737e8067b6365f99c237bd5e5356a) Signed-off-by: Michael Tokarev diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index 81b2905526..9d3e60e32e 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -1360,6 +1360,26 @@ static void ccid_realize(USBDevice *dev, Error **err= p) static int ccid_post_load(void *opaque, int version_id) { USBCCIDState *s =3D opaque; + int i; + + if (s->bulk_in_pending_end - s->bulk_in_pending_start > BULK_IN_PENDIN= G_NUM) { + return -EINVAL; + } + + if (s->pending_answers_num > PENDING_ANSWERS_NUM) { + return -EINVAL; + } + + if (s->bulk_out_pos > BULK_OUT_DATA_SIZE) { + return -EINVAL; + } + + for (i =3D 0; i < BULK_IN_PENDING_NUM; i++) { + if (s->bulk_in_pending[i].len > BULK_IN_BUF_SIZE || + s->bulk_in_pending[i].pos > s->bulk_in_pending[i].len) { + return -EINVAL; + } + } =20 /* * This must be done after usb_device_attach, which sets state to ATTA= CHED, --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263614; cv=none; d=zohomail.com; s=zohoarc; b=QvbQvdEub9LYqXj7Pb8wvx8y+6ws5PClH2MYSuIH1WUqhEr2UyMhjskdRJSgEeHhynfTtt9hQzayMMgyIEoVuEBKEx6B8GEbeO6w4B84QNqEVs3ai0pNogo+O1A5H1KjD8sObAijVMaIy/a1tF1DrXdw4d4vY7eR27xwxsQtB+4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263614; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=DSq4o70cCcLJq2F9gvLMOUtrLWMDVDV4LfSFt+JK1PQ=; b=iddyI50tjnWTsLmW7Iaq02lrWZgtPGj2lRm2ijUHx/z6Se/MOZCLJKrnvlEeO207wHwdRir3fNi4P11LDccFKwAqiLKer9KDkufqYQ5LQGQzU4kcjsqwKIXts79azeAmUUkoRDJSLhO1ZkXlw8NFuSL77bQ28iGrlkJBUk0P0Os= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263614130685.6079099895593; Sat, 17 Oct 2026 12:00:14 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9b6-0000x2-IR; Sat, 17 Oct 2026 14:57:36 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9am-0000Z7-95; Sat, 17 Oct 2026 14:57:16 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9ak-0003hx-A0; Sat, 17 Oct 2026 14:57:15 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 24F321DE6B4; Sat, 17 Oct 2026 21:56:20 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 0C39E44337F; Sat, 17 Oct 2026 21:56:18 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263380; bh=bpfYntOhAfAfbmdF4AuYIx6jTkfFicR2cdRYip4fyJs=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=bIQ9FNyPRhFqDkyMdK8MYKA/Iiqn2YwSzmgAFPMdppkRBglyrhmrINn6LCA6+akos 7EAv3RHTvM5khD5pVb/jKF/FYtLs/be9XFvUciXcOwF8sD6kBR75Su//pE6Pe1S1W2 bDOVy5/fY1CQ4v+xbR7bsZj6hbxxfZ4gY4TS2bZoZIPfOHnCQvKfoUKXQNOMU8VbiT jeaWLQxWXFQsxiLuEKI6ZVp5OltGtSdAvGuj9iZ4dY0uADMgYO3UblXeMCoFK7rwp6 /frpayIDlOE5Xr6KUe3a21K5nSljE6Ig9M6QkAKacBRKoyVZhCeItUpqqgftlaXCLN dgP2wYXkErYkg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Andrey Drobyshev , =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , Michael Tokarev Subject: [Stable-10.0.15 20/63] hw/display/qxl: factor out qxl_guest_phys2virt() Date: Sat, 17 Oct 2026 21:54:36 +0300 Message-ID: <20261017185528.722197-20-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263614996158500 From: Andrey Drobyshev Split the GROUP_GUEST half of qxl_phys2virt() into the helper qxl_guest_phys2virt(). Also add a bool 'report_bug' param to the qxl_get_check_slot_offset() called from it: when it's false, a failing check just returns false without calling qxl_set_guest_bug(). All existing callers pass true, so there's no functional change. This is in preparation for a quiet caller that validates guest addresses which might be legitimately stale, when flagging a guest bug would be wrong. Message-ID: <20260825172051.435372-2-andrey.drobyshev@virtuozzo.com> Reviewed-by: Marc-Andr=C3=A9 Lureau Signed-off-by: Andrey Drobyshev (cherry picked from commit 050f5408bfcff56a65aed6d9ab81e35f4ba82631) Signed-off-by: Michael Tokarev diff --git a/hw/display/qxl.c b/hw/display/qxl.c index 96fba65a92..7dc4da3d93 100644 --- a/hw/display/qxl.c +++ b/hw/display/qxl.c @@ -1427,7 +1427,7 @@ static void qxl_reset_surfaces(PCIQXLDevice *d) /* can be also called from spice server thread context */ static bool qxl_get_check_slot_offset(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, uint32_t *s, uint64_t *o, - size_t size_requested) + size_t size_requested, bool report_b= ug) { uint64_t phys =3D le64_to_cpu(pqxl); uint32_t slot =3D (phys >> (64 - 8)) & 0xff; @@ -1435,42 +1435,55 @@ static bool qxl_get_check_slot_offset(PCIQXLDevice = *qxl, QXLPHYSICAL pqxl, uint64_t size_available; =20 if (slot >=3D NUM_MEMSLOTS) { - qxl_set_guest_bug(qxl, "slot too large %d >=3D %d", slot, - NUM_MEMSLOTS); + if (report_bug) { + qxl_set_guest_bug(qxl, "slot too large %d >=3D %d", slot, + NUM_MEMSLOTS); + } return false; } if (!qxl->guest_slots[slot].active) { - qxl_set_guest_bug(qxl, "inactive slot %d\n", slot); + if (report_bug) { + qxl_set_guest_bug(qxl, "inactive slot %d\n", slot); + } return false; } if (offset < qxl->guest_slots[slot].delta) { - qxl_set_guest_bug(qxl, - "slot %d offset %"PRIu64" < delta %"PRIu64"\n", - slot, offset, qxl->guest_slots[slot].delta); + if (report_bug) { + qxl_set_guest_bug(qxl, + "slot %d offset %"PRIu64" < delta %"PRIu64"\= n", + slot, offset, qxl->guest_slots[slot].delta); + } return false; } offset -=3D qxl->guest_slots[slot].delta; if (offset > qxl->guest_slots[slot].size) { - qxl_set_guest_bug(qxl, - "slot %d offset %"PRIu64" > size %"PRIu64"\n", - slot, offset, qxl->guest_slots[slot].size); + if (report_bug) { + qxl_set_guest_bug(qxl, + "slot %d offset %"PRIu64" > size %"PRIu64"\n= ", + slot, offset, qxl->guest_slots[slot].size); + } return false; } size_available =3D memory_region_size(qxl->guest_slots[slot].mr); if (qxl->guest_slots[slot].offset + offset >=3D size_available) { - qxl_set_guest_bug(qxl, - "slot %d offset %"PRIu64" > region size %"PRIu64= "\n", - slot, qxl->guest_slots[slot].offset + offset, - size_available); + if (report_bug) { + qxl_set_guest_bug(qxl, + "slot %d offset %"PRIu64" > region size %"PR= Iu64 + "\n", slot, + qxl->guest_slots[slot].offset + offset, + size_available); + } return false; } size_available -=3D qxl->guest_slots[slot].offset + offset; if (size_requested > size_available) { - qxl_set_guest_bug(qxl, - "slot %d offset %"PRIu64" size %zu: " - "overrun by %"PRIu64" bytes\n", - slot, offset, size_requested, - size_requested - size_available); + if (report_bug) { + qxl_set_guest_bug(qxl, + "slot %d offset %"PRIu64" size %zu: " + "overrun by %"PRIu64" bytes\n", + slot, offset, size_requested, + size_requested - size_available); + } return false; } =20 @@ -1480,25 +1493,31 @@ static bool qxl_get_check_slot_offset(PCIQXLDevice = *qxl, QXLPHYSICAL pqxl, } =20 /* can be also called from spice server thread context */ -void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, int group_id, - size_t size) +static void *qxl_guest_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, + size_t size, bool report_bug) { uint64_t offset; uint32_t slot; - void *ptr; + uint8_t *ptr; =20 + if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset, size, + report_bug)) { + return NULL; + } + ptr =3D memory_region_get_ram_ptr(qxl->guest_slots[slot].mr); + ptr +=3D qxl->guest_slots[slot].offset; + ptr +=3D offset; + return ptr; +} + +void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, int group_id, + size_t size) +{ switch (group_id) { case MEMSLOT_GROUP_HOST: - offset =3D le64_to_cpu(pqxl) & 0xffffffffffff; - return (void *)(intptr_t)offset; + return (void *)(intptr_t)(le64_to_cpu(pqxl) & 0xffffffffffff); case MEMSLOT_GROUP_GUEST: - if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset, size)) { - return NULL; - } - ptr =3D memory_region_get_ram_ptr(qxl->guest_slots[slot].mr); - ptr +=3D qxl->guest_slots[slot].offset; - ptr +=3D offset; - return ptr; + return qxl_guest_phys2virt(qxl, pqxl, size, true); } return NULL; } @@ -2021,7 +2040,7 @@ static void qxl_dirty_one_surface(PCIQXLDevice *qxl, = QXLPHYSICAL pqxl, bool rc; =20 size =3D (uint64_t)height * abs(stride); - rc =3D qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset, size); + rc =3D qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset, size, true= ); assert(rc =3D=3D true); trace_qxl_surfaces_dirty(qxl->id, offset, size); qxl_set_dirty(qxl->guest_slots[slot].mr, --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263512; cv=none; d=zohomail.com; s=zohoarc; b=Ol2fDH1+BCfB8QsfbKJydWbdubQJY0Di8BdSk6rdWwmcdQEXKJUkA7pA3kGhFUkx0ugjQiYRxL2z8jCvmw4t1wD4nDYKPEe7hiNqQskKBP1Q29yc8T95ZS3JYaW4cWiFDY4A+oPzNx2lBRM1vhdJBBGagjwTJPLd+X1et0KKw8o= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263512; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=xglsc1F4z5XjAtUcDmxhCmR2RF2O7eE8u7bKG8k5kRU=; b=F54Ly70MQWQq270aHCvdE01BMcEw4vvm6eHDvOzeqPJ+8hujf+Dh9xdRelXWVu7Ek2Tj/FJ/lLme2XfrbBE2K7FhyR5+s0uY3nhsHrYzPLpcjPcFQrhQAFCGeVW9pjVptg7zHBubuo8GdFVDzEKZqvQ09y2GWyi2jcVUWmRUnWg= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263512740999.5492458279726; Sat, 17 Oct 2026 11:58:32 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9bE-0001Fl-Qa; Sat, 17 Oct 2026 14:57:45 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9b8-00014v-9L; Sat, 17 Oct 2026 14:57:38 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9b6-0003iT-Bt; Sat, 17 Oct 2026 14:57:37 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id BFB1D1DE6B5; Sat, 17 Oct 2026 21:56:21 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 6DEE3443380; Sat, 17 Oct 2026 21:56:20 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263381; bh=qjpDxnfEm9cJ3vEgcmHzNJu+SLJ9x9KAe7d+Nn/yIrA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=MIjBzDy16gf76/Eg/Baikk5TPUVcfXtU0qxNPFgkjpsVjBp0c0vpuTDqOfT9vDlxz le6+IMbQIlSwqkc8KPM/yAW1BM3FJOCv4pgMYrD+suIiqFSiI009TF7Ixk1jCtcDvl u9IGIER8jEcM4XBKeFoJgzHRyBzCxyFla2kTvIZejPwjTfobe5iAM93HU6Lw8ZMRMv bQ2PTmmxC1sjVI+1D+G8j/FroxC3vHZECkBanwbW6FBI0GH23oZQ7lI/KpxTFWQaRj JiZvQ/AYsMMBzy9HcjmPrgaxB6lpce/R+NPIzEcKl4O660Rz9V8EOwTtNwQ7EgewqS EAEPzMkeOVJYA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Andrey Drobyshev , =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , Michael Tokarev Subject: [Stable-10.0.15 21/63] hw/display/qxl: validate replayed commands in qxl_post_load Date: Sat, 17 Oct 2026 21:54:37 +0300 Message-ID: <20261017185528.722197-21-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263514983158500 From: Andrey Drobyshev On incoming migration qxl_post_load() replays the tracked cursor and surface commands by handing their guest addresses straight to spice, without revalidating them. Those addresses were checked when the guest submitted them, but the guest may have freed or reused that memory before migration, so qxl's tracked pointer can be stale. spice-server then re-parses the command from that memory and, for a stale cursor, reads a garbage shape pointer -- aborting the target in memslot_get_virt() (again, spice-server function) and failing the migration. Validate each replayed command with qxl_guest_phys2virt(report_bug=3Dfalse) before adding it to the replay list, and for a cursor also validate the nested shape pointer. Commands that no longer resolve are skipped rather than replayed. report_bug is false so a stale pointer is not mistaken for a live guest error, which would needlessly disable a healthy guest's display. Message-ID: <20260825172051.435372-3-andrey.drobyshev@virtuozzo.com> Reviewed-by: Marc-Andr=C3=A9 Lureau Signed-off-by: Andrey Drobyshev (cherry picked from commit 95bc45193bbebcb11a45fa40c5642712cd4401bc) Signed-off-by: Michael Tokarev diff --git a/hw/display/qxl.c b/hw/display/qxl.c index 7dc4da3d93..418c317158 100644 --- a/hw/display/qxl.c +++ b/hw/display/qxl.c @@ -2412,6 +2412,37 @@ static void qxl_create_memslots(PCIQXLDevice *d) } } =20 +/* + * Validate a command tracked for loadvm replay before handing its guest + * address to spice-server. + */ +static bool qxl_loadvm_cmd_valid(PCIQXLDevice *d, QXLPHYSICAL data, + uint32_t type) +{ + switch (type) { + case QXL_CMD_SURFACE: + return qxl_guest_phys2virt(d, data, + sizeof(QXLSurfaceCmd), false) !=3D NULL; + + case QXL_CMD_CURSOR: { + QXLCursorCmd *cmd =3D qxl_guest_phys2virt(d, data, sizeof(QXLCurso= rCmd), + false); + + if (!cmd) { + return false; + } + if (le32_to_cpu(cmd->type) =3D=3D QXL_CURSOR_SET) { + return qxl_guest_phys2virt(d, le64_to_cpu(cmd->u.set.shape), + sizeof(QXLCursor), false) !=3D NULL; + } + return true; + } + + default: + g_assert_not_reached(); + } +} + static int qxl_post_load(void *opaque, int version) { PCIQXLDevice* d =3D opaque; @@ -2450,12 +2481,17 @@ static int qxl_post_load(void *opaque, int version) if (d->guest_surfaces.cmds[in] =3D=3D 0) { continue; } + if (!qxl_loadvm_cmd_valid(d, d->guest_surfaces.cmds[in], + QXL_CMD_SURFACE)) { + continue; + } cmds[out].cmd.data =3D d->guest_surfaces.cmds[in]; cmds[out].cmd.type =3D QXL_CMD_SURFACE; cmds[out].group_id =3D MEMSLOT_GROUP_GUEST; out++; } - if (d->guest_cursor) { + if (d->guest_cursor && + qxl_loadvm_cmd_valid(d, d->guest_cursor, QXL_CMD_CURSOR)) { cmds[out].cmd.data =3D d->guest_cursor; cmds[out].cmd.type =3D QXL_CMD_CURSOR; cmds[out].group_id =3D MEMSLOT_GROUP_GUEST; --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263501; cv=none; d=zohomail.com; s=zohoarc; b=RgTFkiFFnlBbemqUBwKEQ1bk+s8pEqI/lusBKTzh+CxdTyr+4H98KDm6I3Gh81lwYYXiHtv9/0Xa5sYDydjMCOsyiQj3iBltHZzj/hUgzmkZkfmwAU/xrgVewEiQrINZUu9e9sWIUX0JF+645X6y636Gf5XmssLzgiOB0dLkY+s= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263501; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=d5dX1RWWliVX/2ZH1865RLI0Yb3dFU4PFueFFjzhcDU=; b=EF4fXuB9Lvn8Ayjk8bv83XtB9aJolNKif3vE664X676nHPhnb5OiLn2lXRGBNBrBlgV0l41yjkXrx3ERYGvOqtWIR1ieOxbFHCE8Wnfm9+PTi5zMVybh1twaUIy4TnNrj1J0qzHrbeNIPLaRkzpm7ovxpXOv4cL8ODNgsNjHsKQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263501119224.05798650048223; Sat, 17 Oct 2026 11:58:21 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9bK-0001L3-FL; Sat, 17 Oct 2026 14:57:50 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9b9-00017f-RP; Sat, 17 Oct 2026 14:57:40 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9b8-0003jV-5h; Sat, 17 Oct 2026 14:57:39 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id E54AA1DE6B6; Sat, 17 Oct 2026 21:56:22 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 262DB443381; Sat, 17 Oct 2026 21:56:21 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263382; bh=r5DQgms0iD5a5ZsGnHKrsccO7ElCUYkz73/DwksP4FM=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Vw3if7kkllfi//sp4spLoOFppuaftszWSVzKVN/Ht98KQRhSfyGiSccyHmXWpgOnn jkJZtX2rf3+ofQbwaut9OdSowOtjSD5RvHbu+uQO1PnHnVitdEVjQgNjxyTk6oA6K4 FVe2P3lkJp9owf7ntcL4kMQ8NC8mmMhsde6fCe0GeZw5KwFrGAgflmbmiFue1QmqX0 p+ps0ctTYsONuy1xNZ/+5gihbd8KF8g5Nj2OQTbaZuHeSY0L9paKq0UgqiA2/vqH5z U1A5G1vultutK6kMCv7OzKaJxWvsbr2e1eXX5+NAW2eBFCGxxHi5vP8EwrqxofDWEv LddznXif5ORbg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Andrey Drobyshev , =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , Michael Tokarev Subject: [Stable-10.0.15 22/63] hw/display/qxl: trace skipped stale loadvm commands Date: Sat, 17 Oct 2026 21:54:38 +0300 Message-ID: <20261017185528.722197-22-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263502636158500 From: Andrey Drobyshev Emit a trace event when qxl_post_load() drops a cursor or surface command whose guest address no longer resolves, so a migration that lands on a stale tracked pointer is visible instead of silent. Message-ID: <20260825172051.435372-4-andrey.drobyshev@virtuozzo.com> Reviewed-by: Marc-Andr=C3=A9 Lureau Signed-off-by: Andrey Drobyshev (cherry picked from commit 7e429d3624c4ad911af533e2f8f914b12f36dadc) Signed-off-by: Michael Tokarev diff --git a/hw/display/qxl.c b/hw/display/qxl.c index 418c317158..1ab063b36e 100644 --- a/hw/display/qxl.c +++ b/hw/display/qxl.c @@ -2483,6 +2483,8 @@ static int qxl_post_load(void *opaque, int version) } if (!qxl_loadvm_cmd_valid(d, d->guest_surfaces.cmds[in], QXL_CMD_SURFACE)) { + trace_qxl_post_load_stale_cmd(d->id, "surface", + d->guest_surfaces.cmds[in]); continue; } cmds[out].cmd.data =3D d->guest_surfaces.cmds[in]; @@ -2490,12 +2492,15 @@ static int qxl_post_load(void *opaque, int version) cmds[out].group_id =3D MEMSLOT_GROUP_GUEST; out++; } - if (d->guest_cursor && - qxl_loadvm_cmd_valid(d, d->guest_cursor, QXL_CMD_CURSOR)) { - cmds[out].cmd.data =3D d->guest_cursor; - cmds[out].cmd.type =3D QXL_CMD_CURSOR; - cmds[out].group_id =3D MEMSLOT_GROUP_GUEST; - out++; + if (d->guest_cursor) { + if (qxl_loadvm_cmd_valid(d, d->guest_cursor, QXL_CMD_CURSOR)) { + cmds[out].cmd.data =3D d->guest_cursor; + cmds[out].cmd.type =3D QXL_CMD_CURSOR; + cmds[out].group_id =3D MEMSLOT_GROUP_GUEST; + out++; + } else { + trace_qxl_post_load_stale_cmd(d->id, "cursor", d->guest_cu= rsor); + } } qxl_spice_loadvm_commands(d, cmds, out); g_free(cmds); diff --git a/hw/display/trace-events b/hw/display/trace-events index 52786e6e18..db19233847 100644 --- a/hw/display/trace-events +++ b/hw/display/trace-events @@ -80,6 +80,7 @@ qxl_io_unexpected_vga_mode(int qid, uint64_t addr, uint64= _t val, const char *des qxl_io_write(int qid, const char *mode, uint64_t addr, const char *aname, = uint64_t val, unsigned size, int async) "%d %s addr=3D%"PRIu64 " (%s) val= =3D%"PRIu64" size=3D%u async=3D%d" qxl_memslot_add_guest(int qid, uint32_t slot_id, uint64_t guest_start, uin= t64_t guest_end) "%d %u: guest phys 0x%"PRIx64 " - 0x%" PRIx64 qxl_post_load(int qid, const char *mode) "%d %s" +qxl_post_load_stale_cmd(int qid, const char *kind, uint64_t data) "%d skip= stale %s cmd 0x%"PRIx64 qxl_pre_load(int qid) "%d" qxl_pre_save(int qid) "%d" qxl_reset_surfaces(int qid) "%d" --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263743; cv=none; d=zohomail.com; s=zohoarc; b=erVPgRP9pMeSYMD88KKchiCT4v78Hw+BLEHT/KnUZ1vCcQapIrPmM0+RdGUc64oKuJDq2BIV4sD8q9ulTgJvrVurIXkGY4XQAyLs0ns9yOfIS0h+GewL88Y2H/FkoSfyi5nonZgSPrxMVogEYkwR7vleBGS7R6DM96OsUYa/C54= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263743; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=K1RT/AgftwOqdqQFqZ5ymNDJkmpmXl/fAIncpD2fO4w=; b=Slc9vnp1fmQrNZA7Q9I6AuV2kqG4cYcamLHsmEX5a/yhBjniaJjSjwANZUcVFcoV5efLZ4QPEpDAXtfShrEJ1crgjqhlWViTXSkxYHamx4Ups1BgRkX8ZTIiOxcEL4tn9p4N1jMKYFhvyusu2uK9b+CKQMPUEKHVURtwXJg80Qo= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 179226374341140.656036159601285; Sat, 17 Oct 2026 12:02:23 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9bL-0001PF-0S; Sat, 17 Oct 2026 14:57:51 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9bB-00019s-JQ; Sat, 17 Oct 2026 14:57:41 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9b9-0003my-PY; Sat, 17 Oct 2026 14:57:41 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 098C51DE6B7; Sat, 17 Oct 2026 21:56:24 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 24C26443382; Sat, 17 Oct 2026 21:56:23 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263384; bh=Q9VF8Y4bDhFUZY1LDExeEBGJXdcW1eIe32RT9tL5uWQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=lxvMFxucmDJ5drb/ZqQBWn5GDSGrvQpo7DK7aaTHNuRyERv23t8s051La/MhrsK2k NswpARkEDhrrzc+mnlcO5dxlJ+UGkokw50aFWRtj71v7j7J9kythTrY+i+zgk5IO9S 7I+eTuZjzkfyUJRMa8YRyQsyutX9nQyM2GpF1fQsElfbJ5RyBAKm2yuwtXOiAKjkGY DK2KuSH35LnNqn2AjZVzwl3vsUhqYkXNZ+/jt+lEnptTbkn07aaloCNrU+aHkjiY1F 7/7dmv0EJcRkHSmPfVlMuOxEbu5iuaxGisA1UxFyl9WPHqZv6719lfMYPCLXokSUp8 kCGqPCan7Rfkw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, "Denis V. Lunev" , Eric Blake , Vladimir Sementsov-Ogievskiy , Michael Tokarev Subject: [Stable-10.0.15 23/63] block/nbd: clear reply.cookie when the reply is rejected Date: Sat, 17 Oct 2026 21:54:39 +0300 Message-ID: <20261017185528.722197-23-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263745559158500 Content-Type: text/plain; charset="utf-8" From: "Denis V. Lunev" nbd_receive_replies() reads a reply header into s->reply and, when the header turns out to be unusable, reports a channel error and returns without touching it. The cookie stays there until the request which owns the reply clears it, and until then the waiters are explicitly allowed to look at a cookie which is not theirs: if (s->reply.cookie !=3D 0) { ind2 =3D COOKIE_TO_INDEX(s->reply.cookie); assert(!s->requests[ind2].receiving); Two of the error paths leave a value chosen by the server behind: one returns before the cookie is validated at all, the other returns because that validation has failed. A waiter which picks such a cookie up turns it into an index which is not in requests[] and accesses the array out of bounds, at an offset the server controls. The reply is of no use to anybody at this point, so clear the cookie before the mutex is released and keep the invariant that a non-zero s->reply.cookie is always an index of a live request. Observing the stale cookie takes a second thread, which a multiqueue configuration provides. Within one AioContext there is no yield point between the failed read and the clearing done by the owner in nbd_co_receive_one_chunk(), so nothing else of this node runs in between. The parked waiters cannot see it either, as they are woken only after the cookie has been cleared. What can get in is a request entering nbd_receive_replies() afresh, one just sent or one back for its next reply chunk, because that path takes the mutex without looking at the state. Cc: Eric Blake Cc: Vladimir Sementsov-Ogievskiy Signed-off-by: Denis V. Lunev Reviewed-by: Vladimir Sementsov-Ogievskiy Message-ID: <20260820115228.587427-2-den@openvz.org> Signed-off-by: Vladimir Sementsov-Ogievskiy (cherry picked from commit 9998d225bb95c0baa17d51f760e46a51886ccfdf) Signed-off-by: Michael Tokarev diff --git a/block/nbd.c b/block/nbd.c index 887841bc81..ba9fb0103c 100644 --- a/block/nbd.c +++ b/block/nbd.c @@ -464,20 +464,19 @@ static coroutine_fn int nbd_receive_replies(BDRVNBDSt= ate *s, uint64_t cookie, error_setg(errp, "server dropped connection"); } if (ret < 0) { - nbd_channel_error(s, ret); - return ret; + goto err; } if (nbd_reply_is_structured(&s->reply) && s->info.mode < NBD_MODE_STRUCTURED) { - nbd_channel_error(s, -EINVAL); + ret =3D -EINVAL; error_setg(errp, "unexpected structured reply"); - return -EINVAL; + goto err; } ind2 =3D COOKIE_TO_INDEX(s->reply.cookie); if (ind2 >=3D MAX_NBD_REQUESTS || !s->requests[ind2].coroutine) { - nbd_channel_error(s, -EINVAL); + ret =3D -EINVAL; error_setg(errp, "unexpected cookie value"); - return -EINVAL; + goto err; } if (s->reply.cookie =3D=3D cookie) { /* We are done */ @@ -485,6 +484,13 @@ static coroutine_fn int nbd_receive_replies(BDRVNBDSta= te *s, uint64_t cookie, } nbd_recv_coroutine_wake_one(&s->requests[ind2]); } + +err: + /* Waiters look at this cookie, so do not leave a rejected one behind.= */ + s->reply.cookie =3D 0; + nbd_channel_error(s, ret); + + return ret; } =20 static int coroutine_fn GRAPH_RDLOCK --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263483; cv=none; d=zohomail.com; s=zohoarc; b=c/P9MpKMuNy5w5foVKsOduLVBGZsr11m/4F2LjwJZVCTwBW446kzCnd5op53DKTX94f9MZ3rwztbTbU2D/eOLtd39bttHZrV23yEs6P4II3CG04JZJ28fCl11XoPRauxncvMrrGwarrOOILbKzYiRpJTRLAdXm8YrrER7SWveTA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263483; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=KVUKE3D4TvxBNC/j9M1+tazvv7tQvMzj6Z4Y/UnBH0k=; b=Rz+YxeE6tUMzWAIy8Eob6I0IpNTk0DJehMsFK2qz1nn9gMx/7bbo0nd0wsWqTy8h/j9IxwIH40gr0KhTRYV/qSFBsItEUlhsQMrXv1Eb45cs3dC6eALpV9BkEKCtLL1GzO2rrP1SnDBfCEMJH/M87uJi8kis0pNqSahnYo3fEgc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263483966530.4189931218158; Sat, 17 Oct 2026 11:58:03 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9bQ-0001k3-3N; Sat, 17 Oct 2026 14:57:56 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9bD-0001ER-Ex; Sat, 17 Oct 2026 14:57:44 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9bB-0003nC-J9; Sat, 17 Oct 2026 14:57:43 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 42A3A1DE6B8; Sat, 17 Oct 2026 21:56:25 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 406EF443383; Sat, 17 Oct 2026 21:56:24 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263385; bh=oJsc6/tOmpQbDFPR1ta47R2tU6r0Zn2MtySy6a7GzBo=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=sNooEokHPH54l2CDVftkS6/SAjHUdQtDPmjt37Y4tP18Bsns2rBrUOAuk2ggIYVj5 RmQjjk9vGgPW4S5car+XTKiwG6qX1Uhxf8yPyxIUrO5nKrdlVdxW/VQz98A4q1+Ze+ 8o1qds3u64F77tM4qVUetMOi2Q/P/HWMcPoQGFn6Dql5DjbHh34uUAiqQbDrOdc0SY oJlB8s7d4AkOZy3u+e4lUfbBs879vT1C1YZJbZ4jPDAdLVUV6bJ9/8m7f3hkOx5ljM ELSWYWxE2gZ6OMTYBR3/uSrCMWfyArgKPQ9XW0KMJNDGpgjFIqiyASl3PFh5K5Yw1S P7zA4KebEop7A== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, "Denis V. Lunev" , Eric Blake , Vladimir Sementsov-Ogievskiy , Michael Tokarev Subject: [Stable-10.0.15 24/63] block/nbd: never index requests[] with an unchecked cookie Date: Sat, 17 Oct 2026 21:54:40 +0300 Message-ID: <20261017185528.722197-24-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263486949158500 Content-Type: text/plain; charset="utf-8" From: "Denis V. Lunev" Cookies are converted into indices of s->requests[] in several places and the result is used right away, without any check: int i =3D COOKIE_TO_INDEX(cookie); ... return nbd_co_receive_offset_data_payload(s, s->requests[i].offset, COOKIE_TO_INDEX() subtracts one, so a zero cookie becomes an index of -1 and the access lands in front of the array. This is undefined and, depending on the type of the index and on what the compiler has put there, it can as well pass silently: at the site above i is signed, so even a plain i < MAX_NBD_REQUESTS check would happily let -1 through. Route every conversion through a helper which hands out the slot only for a cookie in range and owned by a request in flight, so that the check can not be forgotten again. The helper reports through an Error, as the one cookie which is not ours to trust, the one taken from the wire in nbd_receive_replies(), is a protocol error rather than an internal inconsistency and has to stay a channel error. Every other cookie is one we have issued and still own, so a bad value there is a bug in this file, which is what &error_abort spells out. The cookie of the reply in flight goes through the helper as well. It is not an unchecked value either: it has passed the check on the wire path, or it has been cleared by the previous commit. Cc: Eric Blake Cc: Vladimir Sementsov-Ogievskiy Signed-off-by: Denis V. Lunev Reviewed-by: Vladimir Sementsov-Ogievskiy Message-ID: <20260820115228.587427-3-den@openvz.org> Signed-off-by: Vladimir Sementsov-Ogievskiy (cherry picked from commit 75b0a993dacbd5f8579e8f8c228f9bae80541e42) Signed-off-by: Michael Tokarev diff --git a/block/nbd.c b/block/nbd.c index ba9fb0103c..8b4bf57610 100644 --- a/block/nbd.c +++ b/block/nbd.c @@ -136,6 +136,19 @@ static void nbd_clear_bdrvstate(BlockDriverState *bs) s->x_dirty_bitmap =3D NULL; } =20 +static NBDClientRequest *nbd_request_by_cookie(BDRVNBDState *s, uint64_t c= ookie, + Error **errp) +{ + uint64_t ind =3D COOKIE_TO_INDEX(cookie); + + if (ind >=3D MAX_NBD_REQUESTS || !s->requests[ind].coroutine) { + error_setg(errp, "unexpected cookie value"); + return NULL; + } + + return &s->requests[ind]; +} + /* Called with s->receive_mutex taken. */ static bool coroutine_fn nbd_recv_coroutine_wake_one(NBDClientRequest *req) { @@ -420,7 +433,8 @@ static coroutine_fn int nbd_receive_replies(BDRVNBDStat= e *s, uint64_t cookie, Error **errp) { int ret; - uint64_t ind =3D COOKIE_TO_INDEX(cookie), ind2; + NBDClientRequest *req =3D nbd_request_by_cookie(s, cookie, &error_abor= t); + NBDClientRequest *owner; QEMU_LOCK_GUARD(&s->receive_mutex); =20 while (true) { @@ -435,10 +449,10 @@ static coroutine_fn int nbd_receive_replies(BDRVNBDSt= ate *s, uint64_t cookie, * woken by whoever set s->reply.cookie (or never wait in this * yield). So, we should not wake it here. */ - ind2 =3D COOKIE_TO_INDEX(s->reply.cookie); - assert(!s->requests[ind2].receiving); + owner =3D nbd_request_by_cookie(s, s->reply.cookie, &error_abo= rt); + assert(!owner->receiving); =20 - s->requests[ind].receiving =3D true; + req->receiving =3D true; qemu_co_mutex_unlock(&s->receive_mutex); =20 qemu_coroutine_yield(); @@ -452,7 +466,7 @@ static coroutine_fn int nbd_receive_replies(BDRVNBDStat= e *s, uint64_t cookie, */ =20 qemu_co_mutex_lock(&s->receive_mutex); - assert(!s->requests[ind].receiving); + assert(!req->receiving); continue; } =20 @@ -472,17 +486,16 @@ static coroutine_fn int nbd_receive_replies(BDRVNBDSt= ate *s, uint64_t cookie, error_setg(errp, "unexpected structured reply"); goto err; } - ind2 =3D COOKIE_TO_INDEX(s->reply.cookie); - if (ind2 >=3D MAX_NBD_REQUESTS || !s->requests[ind2].coroutine) { + owner =3D nbd_request_by_cookie(s, s->reply.cookie, errp); + if (!owner) { ret =3D -EINVAL; - error_setg(errp, "unexpected cookie value"); goto err; } if (s->reply.cookie =3D=3D cookie) { /* We are done */ return 0; } - nbd_recv_coroutine_wake_one(&s->requests[ind2]); + nbd_recv_coroutine_wake_one(owner); } =20 err: @@ -859,7 +872,6 @@ static coroutine_fn int nbd_co_do_receive_one_chunk( { ERRP_GUARD(); int ret; - int i =3D COOKIE_TO_INDEX(cookie); void *local_payload =3D NULL; NBDStructuredReplyChunk *chunk; =20 @@ -917,8 +929,9 @@ static coroutine_fn int nbd_co_do_receive_one_chunk( return -EINVAL; } =20 - return nbd_co_receive_offset_data_payload(s, s->requests[i].offset, - qiov, errp); + return nbd_co_receive_offset_data_payload( + s, nbd_request_by_cookie(s, cookie, &error_abort)->offset, + qiov, errp); } =20 if (nbd_reply_type_is_error(chunk->type)) { @@ -1065,7 +1078,7 @@ static bool coroutine_fn nbd_reply_chunk_iter_receive= (BDRVNBDState *s, =20 break_loop: qemu_mutex_lock(&s->requests_lock); - s->requests[COOKIE_TO_INDEX(cookie)].coroutine =3D NULL; + nbd_request_by_cookie(s, cookie, &error_abort)->coroutine =3D NULL; s->in_flight--; qemu_co_queue_next(&s->free_sema); qemu_mutex_unlock(&s->requests_lock); --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263535; cv=none; d=zohomail.com; s=zohoarc; b=Cb0gQkdCv6IiJ9xvlc6+9PYpt6uM5zy+Xn5WHcbjRSDsGLYC/U3UDBWcfbAjzeWrlbo4G/tscRMwREr9EhznWUgMCi2mS1qazOA1w06YfN8BVibSP0pc2CZkbhnUCibqsFDY/0/Hxax92Hhh5DRHXOgj7brO3cV+FllQ3/XyIC4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263535; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=60yp8SdfW3dxHPBtRkQT1F/idFFGPvDdHDEJzJJ/Kxg=; b=GLOBypTM15VeJAKpJSogNtIfmwGDp8SicLMUiKc7bpbYNQxl3F7lgDxH6PW389OF2KmVnaUn0FF/Ux9WhMThnuC4jp3yxQi7G59Xhp+Kj4Iisktql7rNdcZ1zJjrl69VM10ky+T/lINLLM3QHpX0LzVchY7Q0HKqA7Ioggfx35k= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263535340164.8395883394528; Sat, 17 Oct 2026 11:58:55 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9bT-0001sm-0L; Sat, 17 Oct 2026 14:57:59 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9bF-0001IX-FS; Sat, 17 Oct 2026 14:57:46 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9bD-0003nU-7G; Sat, 17 Oct 2026 14:57:45 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id C44221DE6B9; Sat, 17 Oct 2026 21:56:26 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 8BF63443384; Sat, 17 Oct 2026 21:56:25 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263386; bh=YraBQF2Z/9JeBp9y5eXG82G+r6IyQysyjIQjfoPjd4E=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=wJ0YTRU8f4pyxPLPaiHORMnX/5vgIcuv2MNwxWPg2mVoH+1SZOrJwjOTCkJoVpUCD OzrNckUvImHP65O3qbBTi2SJUTF2faFOs1yXgA48E9ntnIxKLRHDijwFolJqNZGM7s B7wWErtjKiU8GwtpngY7vZEnwlSy75lSW/X18u3dUkiPbgBDUTciwT2FjHL+eCFKYF /jP4lHYjLboL6C8ktrMAau8MgzpUu632wIY9b6GXZ9mGXYbBcqVzC2kuvb3LmVOLBB Kuiu4AAC2vnED+cMrYfevKRrKIK3ph++jFEhy/Vxjh3/iLRxxpEvh1rbJvoNJgBbeZ Qts2YLrmnI3JA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, "Denis V. Lunev" , Eric Blake , Vladimir Sementsov-Ogievskiy , Michael Tokarev Subject: [Stable-10.0.15 25/63] block/nbd: clear reply.cookie under receive_mutex Date: Sat, 17 Oct 2026 21:54:41 +0300 Message-ID: <20261017185528.722197-25-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263537755158500 Content-Type: text/plain; charset="utf-8" From: "Denis V. Lunev" s->reply is documented as protected by s->receive_mutex, but the cookie is cleared without it once the owning request has consumed its chunk. A waiter in nbd_receive_replies() inspects the very same field under the mutex, and does so with two separate loads: if (s->reply.cookie !=3D 0) { ind2 =3D COOKIE_TO_INDEX(s->reply.cookie); assert(!s->requests[ind2].receiving); Nothing keeps those two loads consistent. If the owner clears the cookie in between, the second one reads 0, COOKIE_TO_INDEX() turns it into an index of -1, and s->requests[] is accessed out of bounds: Assertion `!s->requests[ind2].receiving' failed. (gdb) p cookie $1 =3D 8 (gdb) p s->reply.cookie $2 =3D 0 (gdb) p &((NBDClientRequest *)s->requests)[-1].receiving $3 =3D (_Bool *) 0x5555558416c0 (gdb) p &s->in_flight $4 =3D (unsigned int *) 0x5555558416c0 (gdb) p s->in_flight $5 =3D 8 The cookie we wait for is 8, yet reply.cookie reads 0 one line after it was found non-zero, so the index is -1. requests[-1].receiving lands on in_flight, which is non-zero while requests are outstanding, and that is what the assertion trips over. Hitting this requires two coroutines of one NBD node to run in different threads, as there is no yield point between the two loads for the owner to squeeze into. A multiqueue configuration provides exactly that, with the virtqueues of one disk spread over several iothreads. Note that a compiler is free to merge the two loads into one, in which case the race is invisible, so builds with reduced optimization are much more likely to trip over it. Accessing s->reply without the mutex is fine for the coroutine that owns the reply: a non-zero cookie makes the field private to it. Releasing that ownership is not, as it races with the waiters which are explicitly allowed to look at the cookie. Clear it under the mutex, in the same critical section as the wakeup, and make nbd_recv_coroutines_wake() caller-locked, as CoMutex is not recursive. It has a single caller. The added acquisition cannot block behind the header read in nbd_receive_replies(), because that path is only reachable with reply.cookie =3D=3D 0 while we still own a non-zero cookie. Merging the clear with the wakeup also keeps a newcomer from starting a header read in between, which would stall this already completed request for the duration of that read. There is no cookie to own when we get here after an error, and then a newcomer can indeed be inside that read. It does not hold us for long either, as the channel has been shut down before the error was reported, so the read it sits in returns right away. Fixes: 4ddb5d2fde ("block/nbd: drop connection_co") Cc: Eric Blake Cc: Vladimir Sementsov-Ogievskiy Signed-off-by: Denis V. Lunev Reviewed-by: Vladimir Sementsov-Ogievskiy Message-ID: <20260820115228.587427-4-den@openvz.org> Signed-off-by: Vladimir Sementsov-Ogievskiy (cherry picked from commit cd3be3bd96c0e86f683c210a2c8f46b7da161807) Signed-off-by: Michael Tokarev diff --git a/block/nbd.c b/block/nbd.c index 8b4bf57610..1f03270aed 100644 --- a/block/nbd.c +++ b/block/nbd.c @@ -161,11 +161,11 @@ static bool coroutine_fn nbd_recv_coroutine_wake_one(= NBDClientRequest *req) return false; } =20 +/* Called with s->receive_mutex taken. */ static void coroutine_fn nbd_recv_coroutines_wake(BDRVNBDState *s) { int i; =20 - QEMU_LOCK_GUARD(&s->receive_mutex); for (i =3D 0; i < MAX_NBD_REQUESTS; i++) { if (nbd_recv_coroutine_wake_one(&s->requests[i])) { return; @@ -972,9 +972,11 @@ static coroutine_fn int nbd_co_receive_one_chunk( /* For assert at loop start in nbd_connection_entry */ *reply =3D s->reply; } - s->reply.cookie =3D 0; =20 - nbd_recv_coroutines_wake(s); + WITH_QEMU_LOCK_GUARD(&s->receive_mutex) { + s->reply.cookie =3D 0; + nbd_recv_coroutines_wake(s); + } =20 return ret; } --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263632; cv=none; d=zohomail.com; s=zohoarc; b=Xk3KwpvUP5QfKB5Z0XjF03AuAtdws0Djslor4QeumbuZm3t7/Jw+h8WPcmOw5yWoH9uWIvabaVrTthNLzZL7kLnmqiElr37zTNpibfs8L4bUY8GaDb6ccSUNqlTkdwz6U2EGKTP7kdSMABRZuCbMgBeF/KAtnboPef3Jw2T1DEs= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263632; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=NssKdGbvWPnxVADG0ug31pvHDXmt1WdKokhfe7EnTN4=; b=PtbKLlHaMrbIHTEFCsmfiffR1Qpn3wrsOh/2pzWX/MaSnUXiOhLg5oQNi6vA6PTN+V2gyCbqRoPVV/VFD0oSKNgJ/VuRVjHL51ttVs7WuVi108RdWkZquuv1n6bvYY/ICPqliVf74x7y9vy0p4LC0T98d9J6RrRJSajPVv0m0yY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 179226363266053.923618652741766; Sat, 17 Oct 2026 12:00:32 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9bh-0002UT-ED; Sat, 17 Oct 2026 14:58:14 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9ba-0002Qr-Qw; Sat, 17 Oct 2026 14:58:07 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9bY-0003nm-Tu; Sat, 17 Oct 2026 14:58:06 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id DA7511DE6BA; Sat, 17 Oct 2026 21:56:27 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 1D22D443385; Sat, 17 Oct 2026 21:56:27 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263387; bh=L+QCPRUOaXiTORFTDWEsFsIdaajPtAzQJChxuKteEQE=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=s6dMz2mtdjANmECP3d/jzRtvtW49esTO2I9JUhTQBMP728xd90W1x9P9y17LB4HZM eYO/Rmx2vuHAkolAQm3aUuecLAFU1cqEMIy0Qq7Wf7M0XWd9mfOZ3g/+wX4GnRqgtO L4yQMjuXidabJI+v6FW/S7JZvQRgcBY66T6qPYE9HBdd+x2t5eSwbqbSsE4hsrwIql 7LvyW5l13wCgTVVjnkZjraTcVK+W18r5D6G/ZICBPch6zpx40dvOaxgvn2YDFrywI3 FWMTTTWX81FQFHVVLRJW7cY0ct2WNEmtQoN6y0Tg11zsoV3cWNNhfkEMnBs9sa7avc KZK52zrorLlBA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Daniel Paziyski , Klaus Jensen , Michael Tokarev Subject: [Stable-10.0.15 26/63] hw/nvme: fix assertion failure on sr-iov capable nvme controller removal Date: Sat, 17 Oct 2026 21:54:42 +0300 Message-ID: <20261017185528.722197-26-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263633386158500 Content-Type: text/plain; charset="utf-8" From: Daniel Paziyski In a nvme subsystem, the ctrls array maps controller IDs to nvme controller= s. The value of the array elements can either be NULL (no controller present f= or this ID), SUBSYS_SLOT_RSVD, or any other value, representing a pointer to t= he nvme controller structure. The SUBSYS_SLOT_RSVD value is special: when a nvme controller physical func= tion is being created and is reserving the controller IDs for its virtual functi= ons, it indicates that the slot is soon going to be filled by its corresponding virtual function when it is realized, and on virtual function removal, it m= eans that its controller has been removed. When the physical function is being removed, it goes through its list of secondary controllers (virtual functions), ensures that their slots have the SUBSYS_SLOT_RSVD values, and then frees up the controller IDs by setting the NULL value. This traversal occurs before the virtual functions are destroye= d, causing an assertion failure because the slots contain as values the pointe= rs to the secondary controllers. Destroy the virtual functions (and therefore, the secondary controllers) af= ter they are offlined in the nvme_ctrl_reset call of the physical function, but before releasing the controller IDs of the secondary controllers in nvme_subsys_unregister_ctrl. QEMU command line (boot with a hotunplug-aware OS, such as Linux): qemu-system-x86_64 -M q35 -device pcie-root-port,id=3Drp -monitor stdio= \ -device nvme-subsys,id=3Dsubsys0 \ -device nvme,subsys=3Dsubsys0,serial=3Dctrl0,sriov_max_vfs=3D1,\ sriov_vq_flexible=3D2,sriov_vi_flexible=3D1,max_ioqpairs=3D4,msix_qsize=3D2= ,bus=3Drp,id=3Dctrl0 In the QEMU monitor: device_del ctrl0 Message in stderr: qemu-system-x86_64: ../hw/nvme/subsys.c:49: nvme_subsys_unreserve_cntlids: = Assertion `subsys->ctrls[cntlid] =3D=3D SUBSYS_SLOT_RSVD' failed. Cc: qemu-stable@nongnu.org Fixes: 44c2c09488db ("hw/nvme: Add support for SR-IOV") Signed-off-by: Daniel Paziyski Reviewed-by: Klaus Jensen Signed-off-by: Klaus Jensen (cherry picked from commit 90fcba23c526f3417953429832d0a97be4389fdb) Signed-off-by: Michael Tokarev diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c index cc6d3bc1a7..f5719372f9 100644 --- a/hw/nvme/ctrl.c +++ b/hw/nvme/ctrl.c @@ -9082,6 +9082,10 @@ static void nvme_exit(PCIDevice *pci_dev) } } =20 + if (!pci_is_vf(pci_dev) && n->params.sriov_max_vfs) { + pcie_sriov_pf_exit(pci_dev); + } + nvme_subsys_unregister_ctrl(n->subsys, n); =20 g_free(n->cq); @@ -9101,10 +9105,6 @@ static void nvme_exit(PCIDevice *pci_dev) host_memory_backend_set_mapped(n->pmr.dev, false); } =20 - if (!pci_is_vf(pci_dev) && n->params.sriov_max_vfs) { - pcie_sriov_pf_exit(pci_dev); - } - if (n->params.msix_exclusive_bar && !pci_is_vf(pci_dev)) { msix_uninit_exclusive_bar(pci_dev); } else { --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263511; cv=none; d=zohomail.com; s=zohoarc; b=lXcvEV/K+UByuEvrSK2+z3uE+i59vSzFAWqhO/s+Ga/WCE8NiaM+TBst9s7V0UuA+6F7u1ozHqDXDi3rGbFnUz4zJMf66WhG8d6ej38gVXF4L/7dyv48UPt67W78jYQy/IpgCtelsPL0d19wv1g8ZMpnpKfhHYqqlywyhl1G0kM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263511; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=H7CslsdbPpgnM0K6jnowmuQcSMh187DjjwGWADjpa58=; b=cydQ5fF1BUSR99BMTfdzOFuBNK/7Cb2nSIzL/XQAOLUHaGYO82vu1n/XIG8O+ozezCkgpM0HJvP95Lcr6kGec34mlF2CoBO8mSB4g+9WwUaiXpLvtLVUdT6YR959U4R9QTzwzygaiI4qSiG1uiMHRvQr7QjyOxSXWzBi56K0oRE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263509687759.0113652263428; Sat, 17 Oct 2026 11:58:29 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9bv-0002n5-8U; Sat, 17 Oct 2026 14:58:27 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9bc-0002UJ-Pv; Sat, 17 Oct 2026 14:58:10 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9bb-0003o5-05; Sat, 17 Oct 2026 14:58:08 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 2721D1DE6BB; Sat, 17 Oct 2026 21:56:29 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 1CCC9443386; Sat, 17 Oct 2026 21:56:28 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263389; bh=ckQ2TnRzgwn5Uso3kT+FWmC8W2ouGiGbkoqTHfgPbpU=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=BNMjisxutYG5nt8yiyO8+rFhj3zo09CmLDRsbnNBIGKacQ1MhsnwLc7oSGwuS1Xu3 NfB3hAMOTM1ls9ISPrpmu5Iq58IpXo3VRbjl6EDC4hqDyuNHQ0TnFkP6MgtxxaQ+Zd QEtwg3Ph2B+uvqb8I0jSqLqVRX3nZ4lJFMGLddLu2DbIxo1ghjy7X4++DW0dRBRSPd 8VcoQ94wMPJYaMF/tr17L93DftEgxht6rOZwpUXhV5T9qQxG3TFZVvl4LopeM0aDOs jzVLyXM4YAVYBH8NyrIV5k2FemWS+Hkx3mXMzgwEd7h/46FPnFT/BllsVTB2cZJsyD elsH5L2PpfXcw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Daniel Paziyski , Klaus Jensen , Michael Tokarev Subject: [Stable-10.0.15 27/63] hw/nvme: fix memory leak on sr-iov capable nvme controller removal Date: Sat, 17 Oct 2026 21:54:43 +0300 Message-ID: <20261017185528.722197-27-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263514982158500 Content-Type: text/plain; charset="utf-8" From: Daniel Paziyski If a nvme controller is SR-IOV capable, its list of secondary controllers (virtual functions) is stored in the sec_ctrl_list dynamically allocated array, located in the NvmeCtrl struct. Free the secondary controller list after destroying the virtual functions a= nd freeing their controller IDs. QEMU command line (boot with a hotunplug-aware OS, such as Linux): qemu-system-x86_64 -M q35 -device pcie-root-port,id=3Drp -monitor stdio= \ -device nvme-subsys,id=3Dsubsys0 \ -device nvme,subsys=3Dsubsys0,serial=3Dctrl0,sriov_max_vfs=3D1,\ sriov_vq_flexible=3D2,sriov_vi_flexible=3D1,max_ioqpairs=3D4,msix_qsize=3D2= ,bus=3Drp,id=3Dctrl0 In the QEMU monitor: device_del ctrl0 quit ASAN splat: =3D=3D78982=3D=3DERROR: LeakSanitizer: detected memory leaks Direct leak of 32 byte(s) in 1 object(s) allocated from: #0 0x7fcbab32bea9 in calloc (/usr/lib/libasan.so.8+0x12bea9) (BuildId: = 7f2845989b820f536270e19ec47df085ae89a675) #1 0x7fcbaa2a34b2 in g_malloc0 (/usr/lib/libglib-2.0.so.0+0x694b2) (Bui= ldId: cb17d184459352a7985a010f1cd3acef4a4f90d8) #2 0x559c531fff4b in nvme_subsys_register_ctrl ../hw/nvme/subsys.c:65 #3 0x559c531d715e in nvme_init_subsys ../hw/nvme/ctrl.c:9582 #4 0x559c531d7a7d in nvme_realize ../hw/nvme/ctrl.c:9637 #5 0x559c5323c0da in pci_qdev_realize ../hw/pci/pci.c:2316 #6 0x559c54001e88 in device_set_realized ../hw/core/qdev.c:514 #7 0x559c5402462e in property_set_bool ../qom/object.c:2484 #8 0x559c5401dbd2 in object_property_set ../qom/object.c:1548 #9 0x559c5402b76c in object_property_set_qobject ../qom/qom-qobject.c:28 #10 0x559c5401e24c in object_property_set_bool ../qom/object.c:1618 #11 0x559c53fffd77 in qdev_realize ../hw/core/qdev.c:277 #12 0x559c53934166 in qdev_device_add_from_qdict ../system/qdev-monitor= .c:740 #13 0x559c53934272 in qdev_device_add ../system/qdev-monitor.c:758 #14 0x559c538867c8 in device_init_func ../system/vl.c:1217 #15 0x559c5487236a in qemu_opts_foreach ../util/qemu-option.c:1148 #16 0x559c53891205 in qemu_create_cli_devices ../system/vl.c:2762 #17 0x559c53891968 in qmp_x_exit_preconfig ../system/vl.c:2822 #18 0x559c53898108 in qemu_init ../system/vl.c:3862 #19 0x559c545efabf in main ../system/main.c:71 #20 0x7fcba7627780 (/usr/lib/libc.so.6+0x27780) (BuildId: 1fa174a830ce= f40a5b2388add4318ee2795f573e) #21 0x7fcba76278b8 in __libc_start_main (/usr/lib/libc.so.6+0x278b8) (B= uildId: 1fa174a830cef40a5b2388add4318ee2795f573e) #22 0x559c524df1f4 in _start (BuildId: 35402cb4fc46114b7a4102258726bbde= c82cd9bc) Cc: qemu-stable@nongnu.org Fixes: c6159d0e384f ("hw/nvme: Allocate sec-ctrl-list as a dynamic array") Signed-off-by: Daniel Paziyski Reviewed-by: Klaus Jensen Signed-off-by: Klaus Jensen (cherry picked from commit 6ee626e34979eae2d3e2318b00f0c340a474dd23) Signed-off-by: Michael Tokarev diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c index f5719372f9..60f67741f9 100644 --- a/hw/nvme/ctrl.c +++ b/hw/nvme/ctrl.c @@ -9088,6 +9088,10 @@ static void nvme_exit(PCIDevice *pci_dev) =20 nvme_subsys_unregister_ctrl(n->subsys, n); =20 + if (!pci_is_vf(pci_dev) && n->params.sriov_max_vfs) { + g_free(n->sec_ctrl_list); + } + g_free(n->cq); g_free(n->sq); g_free(n->aer_reqs); --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263525; cv=none; d=zohomail.com; s=zohoarc; b=i8wXH2XLzWNY4fKiHrcsCHeYF5JFYkqiku7Py+14sClaj4oOSic8Jgq/+LW7dRLrq3n5ro2jMNm05uUmnHmVFPa2my+9urPpL2q2Ln/8djAhwOBC45UTdaH20Ek6IM4rkTTZGSdrYG8ArhNcgb85NxoRMybnTu7obFD6VtiltKg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263525; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=3uO1dnq1gPLK+Mh5OIRTm18y5zTkFmisgwHNnxNfB9o=; b=n3ejseSvEYCEHPzVeMdW57DR+9GVZ7pnHJ9oB9olMgvUpQ53qtyefl8LiOU/rId0IpembSnhJVyDdYiTzh7//+hJXDbx1/B+2X8G7ExZv7rUi2aWXuRyg7SZO6Fsos7Jzp44jSpT3hu3MaFJVbTbhvBYRvfc15X58B5cdqS8D8c= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263525039218.95281355899556; Sat, 17 Oct 2026 11:58:45 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9bv-0002mw-8O; Sat, 17 Oct 2026 14:58:27 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9be-0002US-2P; Sat, 17 Oct 2026 14:58:10 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9bc-0003pH-C2; Sat, 17 Oct 2026 14:58:09 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id A73881DE6BC; Sat, 17 Oct 2026 21:56:30 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 89ECF443387; Sat, 17 Oct 2026 21:56:29 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263390; bh=btOADbjU4ohHDsx/av2aQjrK/0woUKACSy5djYFM2u4=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=wlOxCr9LUrdoLf2cTRvXkmo22VSnZ8pn3zzYeU83NMhv/+4nLEmJLhBtxroLjxyFL Gr7jlAF05zBg2YIpN2v8XPr8M3s+USVVfAcMiMHVM1QNNR04ZN1tlbOH7Bcfo9JFfM 2i4wGy2dC+l/wmPEIWhQrTQI1wgpMZ6Cmy7nNkbfCiqHKpWxGPMzz6YATcHhmkF+iL fYB9pcfsb6Vv5fM03Eq3mycgvxWBMtiSfqBDucraomuzmS9fBFk35doiF3kNcOrR+I jNb030NzvmUbGlNIwRuGTE62LBVjLpBHhlsCm/MxC+j2JxOVb/lG+pVNrUCnA6P00R ncbPioiupnqpg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, =?UTF-8?q?Jakub=20Lipov=C3=BD?= , Paolo Bonzini , Michael Tokarev Subject: [Stable-10.0.15 28/63] target/i386/tcg: raise #GP(0) on null SS load with RPL != CPL Date: Sat, 17 Oct 2026 21:54:44 +0300 Message-ID: <20261017185528.722197-28-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263527482158500 From: Jakub Lipov=C3=BD In 64-bit mode, loading a null selector into SS raises #GP(0) if CPL =3D 3, or if CPL < 3 and CPL !=3D RPL. helper_load_seg() only implemented the first case: the null-selector path never examined the selector's RPL, so a null selector with non-zero RPL (such as 0x0003) loaded successfully at CPL < 3. This was caught by test_sreg() in kvm-unit-tests x86/emulator64.c, which additionally fails its subsequent non-null check because the wrongly succeeded load leaves 3 in SS. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/4204 Cc: qemu-stable@nongnu.org Signed-off-by: Jakub Lipov=C3=BD Link: https://lore.kernel.org/r/20260818164414.245189-1-lipovyjakub@tillia.= cz Signed-off-by: Paolo Bonzini (cherry picked from commit 8d496d8f9fcea2199f6dc32f700d13b1d9ed3358) Signed-off-by: Michael Tokarev diff --git a/target/i386/tcg/seg_helper.c b/target/i386/tcg/seg_helper.c index 8158d6175e..85fe6e8008 100644 --- a/target/i386/tcg/seg_helper.c +++ b/target/i386/tcg/seg_helper.c @@ -1382,11 +1382,12 @@ void helper_load_seg(CPUX86State *env, int seg_reg,= int selector) =20 selector &=3D 0xffff; cpl =3D env->hflags & HF_CPL_MASK; + rpl =3D selector & 3; if ((selector & 0xfffc) =3D=3D 0) { /* null selector case */ if (seg_reg =3D=3D R_SS #ifdef TARGET_X86_64 - && (!(env->hflags & HF_CS64_MASK) || cpl =3D=3D 3) + && (!(env->hflags & HF_CS64_MASK) || cpl =3D=3D 3 || cpl !=3D = rpl) #endif ) { raise_exception_err_ra(env, EXCP0D_GPF, 0, GETPC()); @@ -1410,7 +1411,6 @@ void helper_load_seg(CPUX86State *env, int seg_reg, i= nt selector) if (!(e2 & DESC_S_MASK)) { raise_exception_err_ra(env, EXCP0D_GPF, selector & 0xfffc, GET= PC()); } - rpl =3D selector & 3; dpl =3D (e2 >> DESC_DPL_SHIFT) & 3; if (seg_reg =3D=3D R_SS) { /* must be writable segment */ --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263769; cv=none; d=zohomail.com; s=zohoarc; b=GuRnxc+cm1omoHTDjxsO+uKrwZ0xU97qfKSIVTZukJerSa3P9XTuHkJDut8gUlbNOidB3dtz4G28zeC93+pJm5NMen9iKnjlnblLY88sqkJOvxbigJGG8gFXiNRRX79gui3vrTouOtiTxmSEpvb3afP90rYthRusQQ+X5RhUwOA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263769; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=EU8xbf3ppv9ZmgvMDEY4kK8BW6Hls10QInZVsPtwG50=; b=S11H91AntkQdmeQcl4mz1nJOK83dTR8JArO6OjHj8ilibN9YbhUZlDqN8gX4mOw5ZW0nTjkZFKnmaeuroFUahx71/n8GsJoXafGzEMCNkq1UgOxKfqEjYJ/ZADQWrKVdF3oNbn/2RGgIntTnN3rA2TumhBpyIZC9xakfJt1oKFM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263769583344.70336130522765; Sat, 17 Oct 2026 12:02:49 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9bw-0002xx-RT; Sat, 17 Oct 2026 14:58:29 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9bg-0002Wg-A8; Sat, 17 Oct 2026 14:58:12 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9be-0003pb-8t; Sat, 17 Oct 2026 14:58:11 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 3B7001DE6BD; Sat, 17 Oct 2026 21:56:32 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id E9161443388; Sat, 17 Oct 2026 21:56:30 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263392; bh=gAUs2yr/5f4nsR0oLds1KQvQ2Mm0MC9rJNKjOG9/Pr0=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=OvHf6+msp4dKwmTbMYs+1/XHgnmFPcSFl8/o03azq0segMBJlcwPlyjk4le2rUPeX 8kJPVXazLPLUMjqq9ekQIVd5OkUGSS09wp4TJv7cr6sML5yZcv/B4Z1hBNX7WcVRPi rEtOB20FHXRXWZvfPltkD5wIt6sErpagy/9vAVMdEiLJauNsQDLz/CbwInONkXPtOd mr53sNfXPcZyvtNPR+Q5UuJD4GoGmBrXWynDR+ZbbwqyS48UF6Jd1aUOKAeORSiqjL YUaTS1hLS35dqxKprJ+gwkQbzK/3fv5vySueNpbAdJr6l4E7lGTueVL3SzFzVdQKnU Mff+coKex66GQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Simon Scherer , Paolo Bonzini , Michael Tokarev Subject: [Stable-10.0.15 29/63] target/i386: clear C1 for all x87 compare instructions Date: Sat, 17 Oct 2026 21:54:45 +0300 Message-ID: <20261017185528.722197-29-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263769978158500 Content-Type: text/plain; charset="utf-8" From: Simon Scherer The SDM specifies that FCOM/FCOMP/FCOMPP/FUCOM/FUCOMP/FUCOMPP/FICOM/FICOMP/ FCOMI/FCOMIP/FUCOMI/FUCOMIP unconditionally clear C1 in the FPU status word, regardless of the comparison result. helper_fcom_ST0_FT0/helper_fucom_ST0_FT0 only cleared C3, C2, C0 (mask 0x4500) before OR-ing in the comparison result, leaving C1 (bit 9) at whatever value it already had. FICOM/FICOMP dispatch through the same helpers after converting their integer operand, so they inherited the same bug. helper_fcomi_ST0_FT0/helper_fucomi_ST0_FT0 never touched the FPU status word at all, so C1 was left untouched by those too. This patch clears C1 explicitly in all four helpers, adding the clear into the existing fpus mask for fcom/fucom since fcom_ccval never sets bit 9. For fcomi/fucomi add a new separate clear. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4378 Signed-off-by: Simon Scherer Link: https://lore.kernel.org/r/20260828082235.128360-1-scherer.simon89@gma= il.com Signed-off-by: Paolo Bonzini (cherry picked from commit 6802a4b2391936ccb2ea0f76851bd1a43413b0b5) Signed-off-by: Michael Tokarev diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c index 3e312c7a8b..184cf8b4e8 100644 --- a/target/i386/tcg/fpu_helper.c +++ b/target/i386/tcg/fpu_helper.c @@ -538,7 +538,8 @@ void helper_fcom_ST0_FT0(CPUX86State *env) FloatRelation ret; =20 ret =3D floatx80_compare(ST0, FT0, &env->fp_status); - env->fpus =3D (env->fpus & ~0x4500) | fcom_ccval[ret + 1]; + /* C1 is unconditionally cleared to 0 */ + env->fpus =3D (env->fpus & ~0x4700) | fcom_ccval[ret + 1]; merge_exception_flags(env, old_flags); } =20 @@ -548,7 +549,8 @@ void helper_fucom_ST0_FT0(CPUX86State *env) FloatRelation ret; =20 ret =3D floatx80_compare_quiet(ST0, FT0, &env->fp_status); - env->fpus =3D (env->fpus & ~0x4500) | fcom_ccval[ret + 1]; + /* C1 is unconditionally cleared to 0 */ + env->fpus =3D (env->fpus & ~0x4700) | fcom_ccval[ret + 1]; merge_exception_flags(env, old_flags); } =20 @@ -563,6 +565,8 @@ void helper_fcomi_ST0_FT0(CPUX86State *env) /* OF, SF, and AF are unconditionally cleared to 0 */ CC_SRC =3D fcomi_ccval[ret + 1]; CC_OP =3D CC_OP_EFLAGS; + /* C1 is unconditionally cleared to 0 */ + env->fpus &=3D ~0x0200; merge_exception_flags(env, old_flags); } =20 @@ -575,6 +579,8 @@ void helper_fucomi_ST0_FT0(CPUX86State *env) /* OF, SF, and AF are unconditionally cleared to 0 */ CC_SRC =3D fcomi_ccval[ret + 1]; CC_OP =3D CC_OP_EFLAGS; + /* C1 is unconditionally cleared to 0 */ + env->fpus &=3D ~0x0200; merge_exception_flags(env, old_flags); } =20 --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263549; cv=none; d=zohomail.com; s=zohoarc; b=OD7m61YhOfDaewYRkgwNa4vOZuR7t3d2JR93jRbnWmgeloSzw49hpyJVsPX7CZTxuaIu8EdJ8xa+2YB5LzbTlC3cV6uLGOB2hWH7/4sca/8VHcWU/VBjRVsrfiaLW41CxFKXnvzIyCfDkUKqIyvitaAKrbmUIAW8DTY99lZZdy4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263549; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=QQGC1Rnh8U5Xfs1Anb8lR1biCI6G4asPQW8W/yJgfeE=; b=jWj1SgLfHjfkhNKtH/IVZSV5/9rVbex5opBRWkoJmycv4gt3G0u+w6p6xOizk3XeH2wCnXaItHL//105UN7KwdOc3ZoDyv9UYpm8IdKcjj7gR0ppeN+0BniuWzSt4KFfi7VunWfQsmN8C7rgvBagR1kOVdC8Zng1GRuqrUuPlLY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263549117108.26432909440268; Sat, 17 Oct 2026 11:59:09 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9cC-0003Z7-KU; Sat, 17 Oct 2026 14:58:46 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9c2-0003Sc-Aa; Sat, 17 Oct 2026 14:58:34 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9c0-0003pr-DS; Sat, 17 Oct 2026 14:58:34 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id A999E1DE6BE; Sat, 17 Oct 2026 21:56:33 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 9DC2C443389; Sat, 17 Oct 2026 21:56:32 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263393; bh=awy2pZ56vk4336K7Be9QQz9699or3lJ1eeqRWZW4KK0=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=pV/gLdMdV3uVVDK+Uu/Dft5PoRXD2q9UEUONkj8y7dZXQRmLHW94slFURFJnjGGYD f6HOaM7FyqoeLRU3EEPddLAhVm7yE1IuGj4M7LYNi7Al2o+bD6mw67vCfMq21TZ5XK l2tvxgF59iu+tul+uHAa53H/E2UAqvuScsBpmZhhwj+yEt9YS07uVY1wMaVaz2g9cV 7bHtXdZveDR3jUWouZeMLoG5WopPRK+nzIDY3xgHnPxEbz2iZk5JprwfH3QXNXeV6x Siu+/HHF9lyzHhYzLc4ejaixC3NP+SXc9z2JWuvzrbXII7EcvAquyuE8vLeI6+nhX5 OW9oIu3fwnqug== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Simon Scherer , Paolo Bonzini , Michael Tokarev Subject: [Stable-10.0.15 30/63] target/i386: Don't clear C1 for FCOMI/FCOMIP/FUCOMI/FUCOMIP Date: Sat, 17 Oct 2026 21:54:46 +0300 Message-ID: <20261017185528.722197-30-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263549623158500 Content-Type: text/plain; charset="utf-8" From: Simon Scherer Commit 6802a4b23919 ("target/i386: clear C1 for all x87 compare instructions") added an unconditional C1 clear to helper_fcomi_ST0_FT0() and helper_fucomi_ST0_FT0(), based on the SDM listing "C1 Set to 0" under FPU Flags Affected for FCOMI/FCOMIP/FUCOMI/FUCOMIP. Testing on real x86-64 Intel and AMD hardware shows these instructions leave C1 unchanged, unlike FCOM/FUCOM/FICOM. The SDM text appears to have been carried over from the FCOM/FUCOM description. Revert that part of the commit. The FCOM/FUCOM/FICOM changes are kept. Fixes: 6802a4b23919 ("target/i386: clear C1 for all x87 compare instruction= s") Signed-off-by: Simon Scherer Link: https://lore.kernel.org/r/20260911105811.16854-1-scherer.simon89@gmai= l.com Signed-off-by: Paolo Bonzini (cherry picked from commit 6d5fb14d36a6d11e88f04878021b2d99ce6c07e9) Signed-off-by: Michael Tokarev diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c index 184cf8b4e8..02da4d0b26 100644 --- a/target/i386/tcg/fpu_helper.c +++ b/target/i386/tcg/fpu_helper.c @@ -565,8 +565,6 @@ void helper_fcomi_ST0_FT0(CPUX86State *env) /* OF, SF, and AF are unconditionally cleared to 0 */ CC_SRC =3D fcomi_ccval[ret + 1]; CC_OP =3D CC_OP_EFLAGS; - /* C1 is unconditionally cleared to 0 */ - env->fpus &=3D ~0x0200; merge_exception_flags(env, old_flags); } =20 @@ -579,8 +577,6 @@ void helper_fucomi_ST0_FT0(CPUX86State *env) /* OF, SF, and AF are unconditionally cleared to 0 */ CC_SRC =3D fcomi_ccval[ret + 1]; CC_OP =3D CC_OP_EFLAGS; - /* C1 is unconditionally cleared to 0 */ - env->fpus &=3D ~0x0200; merge_exception_flags(env, old_flags); } =20 --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263696; cv=none; d=zohomail.com; s=zohoarc; b=Jh2+CjSdNj50zQmRORJyIt9QXNtJw/QPp5ZavnwZ0dPOsn85XDQer5o1ehkj9ICvJ6g3F61BYbPXHmK1oPsQsxoNP8U3sjRyWw/MB5YFzqBO+Os9GkuESV3McmTuVgFdCFgYrXAlHNti+qo7Mt3/Kcf2FhDM0029XutxPRJ+XE8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263696; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=uvX/34s4UUWgN8Q+f2H8lLhiPWM6gIz4t1NaG/JOOCM=; b=Q0rL7OydVXfltcg9PJ4CcyuMhmfrl+BXRTbqZmwpBknwvpbrwrnLdYxGyiTVLNRAOeNa1imPheW9POV51J2QO5w82mbhvdRpX7HiM0+ADpq2LaVZ8infRoUtFChKYeXKFgFOimWTP1fEJc+pmquwo973NIyvhD6fzoJChfGr+pQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263696173846.6029728175239; Sat, 17 Oct 2026 12:01:36 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9cI-0003wT-Ez; Sat, 17 Oct 2026 14:58:50 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9c3-0003TV-Nb; Sat, 17 Oct 2026 14:58:36 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9c1-0003qQ-OB; Sat, 17 Oct 2026 14:58:35 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 6402E1DE6BF; Sat, 17 Oct 2026 21:56:35 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 1292144338A; Sat, 17 Oct 2026 21:56:33 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263395; bh=LK7pOWEmvXVNe1OtftuZdvx7LDJF7xQ5LtMBve5pgQk=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=wKquG11kXRmO7y8B2KZRKx2IO7ZKMURsahTpweH4/p078FNDg4tYbnZ9NpTiiOR7T P2dbltF3N1daFg9xQydh/WOgfC3cC3PaajMUxHLWFgHQOq5Z9vCZqdwE9v4PeZLery ssHonqQ18+ItddjVBap/mVBqTMjVZv+amTwTvBmgnwu2i0raTibxTrSlYp5z+T93In vgbXmw6TDy0qhWmfG4Ui2srDytzUsygYwNwXjw7tUoo+VHcNHLAmRDa+gSoA65gmQN WIyk0LWNY2AS7LzRePSPtOxvAnm7f5/kLsGka9d7ipFBFAXNW8Q4ubNHs6w84gXOLn 91O4RNA6zu7UA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Maxim Levitsky , "Vulnerability Report" , Paolo Bonzini , Michael Tokarev Subject: [Stable-10.0.15 31/63] accel/kvm: protect kvm_resample_fd_list with a mutex Date: Sat, 17 Oct 2026 21:54:47 +0300 Message-ID: <20261017185528.722197-31-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263696653158500 Content-Type: text/plain; charset="utf-8" From: Maxim Levitsky Legacy PCI INTx interrupts are level triggered and can, in theory, be share= d. Upon receiving such an interrupt, VFIO kernel driver masks it in a generic = way, using INTX_DISABLE bit in the PCI config space. It then waits for the guest to signal completion (EOI) of the interrupt, upon which VFIO re-enables the interrupt. The completion is signaled with another eventfd. For split irqchip mode, KVM doesn't have a notion of EOI on IOAPIC level. Instead it signals EOI with a userspace VM exit, KVM_EXIT_IOAPIC_EOI. Upon receiving this VM exit, Qemu manually signals the above-mentioned even= tfd. The problem that this patch resolves is that QEMU keeps these eventfds in a linked list without any locking to prevent the list from being corrupted = by concurrent access. Such use is possible and guest triggerable if the guest rapidly toggles INTX mode of a VFIO device and at the same time signals EOI with an arbitra= ry vector. Fix this by protecting this list (kvm_resample_fd_list) with a mutex. This patch was only compile tested. Reported-by: "Vulnerability Report" Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3942 Signed-off-by: Maxim Levitsky Link: https://lore.kernel.org/r/20260923004651.101197-1-mlevitsk@redhat.com Signed-off-by: Paolo Bonzini (cherry picked from commit 0f98b46846eb04791f5f4c992d3441c8a8b48872) Signed-off-by: Michael Tokarev diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c index 57727b3fea..66783fcf11 100644 --- a/accel/kvm/kvm-all.c +++ b/accel/kvm/kvm-all.c @@ -127,6 +127,7 @@ typedef struct KVMResampleFd KVMResampleFd; static QLIST_HEAD(, KVMResampleFd) kvm_resample_fd_list =3D QLIST_HEAD_INITIALIZER(kvm_resample_fd_list); =20 +static QemuMutex kvm_resample_fd_list_lock; static QemuMutex kml_slots_lock; =20 #define kvm_slots_lock() qemu_mutex_lock(&kml_slots_lock) @@ -138,6 +139,8 @@ static inline void kvm_resample_fd_remove(int gsi) { KVMResampleFd *rfd; =20 + qemu_mutex_lock(&kvm_resample_fd_list_lock); + QLIST_FOREACH(rfd, &kvm_resample_fd_list, node) { if (rfd->gsi =3D=3D gsi) { QLIST_REMOVE(rfd, node); @@ -145,6 +148,8 @@ static inline void kvm_resample_fd_remove(int gsi) break; } } + + qemu_mutex_unlock(&kvm_resample_fd_list_lock); } =20 static inline void kvm_resample_fd_insert(int gsi, EventNotifier *event) @@ -154,20 +159,26 @@ static inline void kvm_resample_fd_insert(int gsi, Ev= entNotifier *event) rfd->gsi =3D gsi; rfd->resample_event =3D event; =20 + qemu_mutex_lock(&kvm_resample_fd_list_lock); QLIST_INSERT_HEAD(&kvm_resample_fd_list, rfd, node); + qemu_mutex_unlock(&kvm_resample_fd_list_lock); } =20 void kvm_resample_fd_notify(int gsi) { KVMResampleFd *rfd; =20 + qemu_mutex_lock(&kvm_resample_fd_list_lock); + QLIST_FOREACH(rfd, &kvm_resample_fd_list, node) { if (rfd->gsi =3D=3D gsi) { event_notifier_set(rfd->resample_event); trace_kvm_resample_fd_notify(gsi); - return; + break; } } + + qemu_mutex_unlock(&kvm_resample_fd_list_lock); } =20 /** @@ -2572,6 +2583,7 @@ static int kvm_init(MachineState *ms) int type; =20 qemu_mutex_init(&kml_slots_lock); + qemu_mutex_init(&kvm_resample_fd_list_lock); =20 s =3D KVM_STATE(ms->accelerator); =20 diff --git a/hw/intc/ioapic.c b/hw/intc/ioapic.c index 8cd1d85e06..d29a579156 100644 --- a/hw/intc/ioapic.c +++ b/hw/intc/ioapic.c @@ -241,7 +241,6 @@ void ioapic_eoi_broadcast(int vector) continue; } =20 -#ifdef CONFIG_KVM /* * When IOAPIC is in the userspace while APIC is still in * the kernel (i.e., split irqchip), we have a trick to @@ -257,8 +256,9 @@ void ioapic_eoi_broadcast(int vector) * operations below because we don't know whether there're * emulated devices that are using/sharing the same IRQ. */ - kvm_resample_fd_notify(n); -#endif + if (kvm_enabled()) { + kvm_resample_fd_notify(n); + } =20 if (!(entry & IOAPIC_LVT_REMOTE_IRR)) { continue; --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263641; cv=none; d=zohomail.com; s=zohoarc; b=e8v2BZaPgzZw1O1hmV9UmzqayL232/A4jyu37IgfLbZgqG8wpsYoc5GzaFdD8QYl6uwUt7ZWxl+0ASrD3k/iYm0wI7Jg92vFagCnNanIxhb74h079kpy6bMbHztlEhE0W9P8iamd2ZgshQqhNA1J9UKusIqABO+nMYBVH9bkQuI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263641; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=yORHeG5mNodk9fxZjjCNHL8nKUtHDYT5HoY3YdD+iQM=; b=dNTB1y7JqEQE9sY+HdFmJHa7DkcRgfnO9cPdPltIxlNwH+B6HOWCDZGOQK//KpdfHhjpZoQb/0BodCBZ+ILMhrVbzv44zVc+yMLTUj0Rg13zpoj3NMX/SYI0OfoH0GNXhMnU62PyZErp/z7oYTnZ0+0g/aUpxDXZm78HIxoc/vk= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263641508307.8901691176977; Sat, 17 Oct 2026 12:00:41 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9cI-0003vU-9T; Sat, 17 Oct 2026 14:58:50 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9c5-0003Uw-Ro; Sat, 17 Oct 2026 14:58:38 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9c3-0003rr-Rf; Sat, 17 Oct 2026 14:58:37 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 8278D1DE6C0; Sat, 17 Oct 2026 21:56:36 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id B0CDF44338B; Sat, 17 Oct 2026 21:56:35 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263396; bh=JG2OZB0G7bDBx1Eg8+jX2hzX482Ryji3SBhBjSQ2CmA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=ITLsLqEEb+joet+Xr7UqLiUJgTFKv2xOIPcgXqd37J+ETryFdBToh2ki/ibGf45HM zQvJ0qOLV9h+LtPmOxqWxEr5IXuJ0lOLSmfdQDKpmUPmBBg32PVlVz2blRe85g7WG/ Ger5DLNFiUnWdUseHDuhUwZxbvLoe/diLf7wtq7pWDMkmMlWKT9crCZPz7NNmaSUBd 5wwX8YWYfUifYdeTc6W/nYTeoeGv/mF9QvWfgw6tzSrbwFg27sWn8jPwDg7wBMTp0I myNePdsHYCR98XkNSG64/FEYcqnAC6+F4hVhl14chlOi/zDMtnelDvojPqmJ+7byfV tj2vwLagQz92w== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Paolo Bonzini , Andrey Polivoda , Michael Tokarev Subject: [Stable-10.0.15 32/63] target/i386/tcg: ignore VEX.L for unary scalar instructions Date: Sat, 17 Oct 2026 21:54:48 +0300 Message-ID: <20261017185528.722197-32-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263643593158500 Content-Type: text/plain; charset="utf-8" From: Paolo Bonzini According to both Volume 2 of Intel 64 and IA-32 Architectures Software Developer's Manual and Volume 4 of AMD64 Architecture Programmer's Manual, VEX.L is a "don't care" bit for `VROUNDSS`, `VROUNDSD`, `VMOVSS`, `VMOVSD`. Currently, QEMU handles VEX.L with these instructions differently: - In the VMOVSS and VMOVSD case, VEX.L allows to select the register size (XMM or YMM), leading to differences between QEMU and the real hardware. - In `gen_VROUNDSS()` and `gen_VROUNDSD()`, there is an assert which checks that `s->vex_l` is not set. When either instruction is encountered with V= EX.L bit set, the QEMU process crashes with an assertion failure. These behaviors deviate from real hardware, and in VROUNDSS/VROUNDSD case, it also allows unprivileged guest userspace to crash the QEMU process itsel= f. Instead, always handle the instructions as if VEX.L=3D0. Reported-by: Andrey Polivoda Signed-off-by: Paolo Bonzini (cherry picked from commit a5b4837a253ed3944dd7d4419c52830079e221ec) Signed-off-by: Michael Tokarev diff --git a/target/i386/tcg/decode-new.c.inc b/target/i386/tcg/decode-new.= c.inc index 704858ff57..b3989e07b4 100644 --- a/target/i386/tcg/decode-new.c.inc +++ b/target/i386/tcg/decode-new.c.inc @@ -260,6 +260,7 @@ #define svm(a) .intercept =3D SVM_EXIT_##a, .has_intercept =3D true, =20 #define avx2_256 .vex_special =3D X86_VEX_AVX2_256, +#define vex_lig .vex_special =3D X86_VEX_LIG, =20 #define P_00 1 #define P_66 (1 << PREFIX_DATA) @@ -887,8 +888,8 @@ static const X86OpEntry opcodes_0F3A[256] =3D { * For other unary operations such as VSQRTSx this is hidden by the "R= EPScalar" * value of vex_special, because the table lists the operand types of = VSQRTPx. */ - [0x0a] =3D X86_OP_ENTRY4(VROUNDSS, V,x, H,x, W,ss, vex3 cpuid(SSE41= ) p_66), - [0x0b] =3D X86_OP_ENTRY4(VROUNDSD, V,x, H,x, W,sd, vex3 cpuid(SSE41= ) p_66), + [0x0a] =3D X86_OP_ENTRY4(VROUNDSS, V,x, H,x, W,ss, vex3 vex_lig cpu= id(SSE41) p_66), + [0x0b] =3D X86_OP_ENTRY4(VROUNDSD, V,x, H,x, W,sd, vex3 vex_lig cpu= id(SSE41) p_66), [0x0c] =3D X86_OP_ENTRY4(VBLENDPS, V,x, H,x, W,x, vex4 cpuid(SSE4= 1) p_66), [0x0d] =3D X86_OP_ENTRY4(VBLENDPD, V,x, H,x, W,x, vex4 cpuid(SSE4= 1) p_66), [0x0e] =3D X86_OP_ENTRY4(VPBLENDW, V,x, H,x, W,x, vex4 cpuid(SSE4= 1) avx2_256 p_66), @@ -944,8 +945,8 @@ static void decode_0F10(DisasContext *s, CPUX86State *e= nv, X86OpEntry *entry, ui static const X86OpEntry opcodes_0F10_mem[4] =3D { X86_OP_ENTRY3(MOVDQ, V,x, None,None, W,x, vex4_unal), /* MO= VUPS */ X86_OP_ENTRY3(MOVDQ, V,x, None,None, W,x, vex4_unal), /* MO= VUPD */ - X86_OP_ENTRY3(VMOVSS_ld, V,x, H,x, M,ss, vex5), - X86_OP_ENTRY3(VMOVSD_ld, V,x, H,x, M,sd, vex5), + X86_OP_ENTRY3(VMOVSS_ld, V,x, H,x, M,ss, vex5 vex_lig), + X86_OP_ENTRY3(VMOVSD_ld, V,x, H,x, M,sd, vex5 vex_lig), }; =20 if ((get_modrm(s, env) >> 6) =3D=3D 3) { @@ -967,8 +968,8 @@ static void decode_0F11(DisasContext *s, CPUX86State *e= nv, X86OpEntry *entry, ui static const X86OpEntry opcodes_0F11_mem[4] =3D { X86_OP_ENTRY3(MOVDQ, W,x, None,None, V,x, vex4_unal), /* MOV= UPS */ X86_OP_ENTRY3(MOVDQ, W,x, None,None, V,x, vex4_unal), /* MOV= UPD */ - X86_OP_ENTRY3(VMOVSS_st, M,ss, None,None, V,x, vex5), - X86_OP_ENTRY3(VMOVLPx_st, M,sd, None,None, V,x, vex5), /* MOVSD */ + X86_OP_ENTRY3(VMOVSS_st, M,ss, None,None, V,x, vex5 vex_lig), + X86_OP_ENTRY3(VMOVLPx_st, M,sd, None,None, V,x, vex5 vex_lig), /* = MOVSD */ }; =20 if ((get_modrm(s, env) >> 6) =3D=3D 3) { @@ -2401,6 +2402,10 @@ static bool validate_vex(DisasContext *s, X86Decoded= Insn *decode) case X86_VEX_None: break; =20 + case X86_VEX_LIG: + s->vex_l =3D 0; + break; + case X86_VEX_REPScalar: /* * Instructions which differ between 00/66 and F2/F3 in the diff --git a/target/i386/tcg/decode-new.h b/target/i386/tcg/decode-new.h index 9282296900..25f7d2215e 100644 --- a/target/i386/tcg/decode-new.h +++ b/target/i386/tcg/decode-new.h @@ -263,6 +263,12 @@ typedef enum X86VEXSpecial { * operands, and thus handled by decode_op_size. */ X86_VEX_AVX2_256, + + /* + * Instructions that do not care about VEX.L; used for scalar operands= , because + * they *should* be used only with VEX.L=3D0 but may accept VEX.L=3D1 = on some machines. + */ + X86_VEX_LIG, } X86VEXSpecial; =20 =20 --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263675; cv=none; d=zohomail.com; s=zohoarc; b=RSUnuKKjfNP48VkllvIJQOePPl0A15unKxaRahaBrx/DWgNAR8t5OtrDXgSBI1M+JkxuR25CrO/73ymAjtpH5UNNwofnmFjnCgNtpljOtewwTGyuzAhOdRcmbyxNJi/d66d8hM8TB6c4aendeyrj+cUGboz/duAA1PIgyHd+PMg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263675; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=pP9OmHXtrz+3nnIdJlrZaGwhhxSWYICNxDuo1+kQGVs=; b=hTBoVE+Q8pyk5gFA8qLaXspyjF04k9Ar/0sbSFjF0vX44qfNkpE0hTtCqDJQRsD8wa3MDN67hpsh4aMljW3gcoi1XZk8zULDWXB5EKxNOJt48PRkzoPzXJyvxrGbN/0lVxf0j3fZy4naoAvABinPkiOjqjvIQjozYNgjUR9/VdI= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263675426335.81324220325325; Sat, 17 Oct 2026 12:01:15 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9cL-0004A5-GT; Sat, 17 Oct 2026 14:58:53 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9c6-0003X5-SA; Sat, 17 Oct 2026 14:58:40 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9c5-0003sG-7O; Sat, 17 Oct 2026 14:58:38 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 140291DE6C1; Sat, 17 Oct 2026 21:56:38 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id E4B7E44338C; Sat, 17 Oct 2026 21:56:36 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263398; bh=3c4dsn4vPTBlsQBOnxH6KKy/ZmaHzHTUNHtF6bjD/3U=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=qRnjMgv5Ps9cpNeTLmteEJcnMG5FKfRJL5vYbn2ZZtQhBGNeBQXxLaQaESTvxJqn5 E2vSPmqzCmb+aIPxdu0Ytq8EVzAAVKHtBp8hW+IagfLzWtg7aGazC0+bvWcuPRD/DR xsit4f71OE1uSeh+VlbL7R9weaKgxX+N/+/6AaGreqGmrUnm3NOIYFqzoz2/eo2/BJ 7fdKjRQSK/TZ3XwUTri4E0qTj3gI0guAmX1iqmBR1VzKxqQba9BjSrdLNVQlixUxC4 1/7EFjeckZ8Of66JG3ZaMJCthbAGhpS/CsjW+dsGh5SBi39tpyncDGuSJ52V5NTkwG 2C0SyaHYXR3pQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Tommaso Califano , =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , Michael Tokarev Subject: [Stable-10.0.15 33/63] hw/usb: Fix USB MTP Use-After-Free in usb_mtp_deletefn List Iteration Date: Sat, 17 Oct 2026 21:54:49 +0300 Message-ID: <20261017185528.722197-33-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263676140158500 From: Tommaso Califano In QEMU's USB MTP (Media Transfer Protocol) device emulation, the usb_mtp_d= eletefn() function in hw/usb/dev-mtp.c iterates over a child object list using QLIST_= FOREACH while the recursive call may free the current element. After the free, the = macro reads the le_next field from freed memory to advance the iterator. Replace QLIST_FOREACH with QLIST_FOREACH_SAFE, which saves the next pointer= before the iteration body executes. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3991 Signed-off-by: Tommaso Califano Reviewed-by: Daniel P. Berrang=C3=A9 Signed-off-by: Daniel P. Berrang=C3=A9 (cherry picked from commit d198957674b3c2cf8b9437ba91304cc421b219bb) Signed-off-by: Michael Tokarev diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c index 326c92a43d..1ea97bf8b3 100644 --- a/hw/usb/dev-mtp.c +++ b/hw/usb/dev-mtp.c @@ -1153,7 +1153,7 @@ enum { =20 static int usb_mtp_deletefn(MTPState *s, MTPObject *o, uint32_t trans) { - MTPObject *iter, *iter2; + MTPObject *iter, *iter2, *iter2_next; int ret =3D 0; =20 /* @@ -1162,7 +1162,7 @@ static int usb_mtp_deletefn(MTPState *s, MTPObject *o= , uint32_t trans) =20 QLIST_FOREACH(iter, &o->children, list) { if (iter->format =3D=3D FMT_ASSOCIATION) { - QLIST_FOREACH(iter2, &iter->children, list) { + QLIST_FOREACH_SAFE(iter2, &iter->children, list, iter2_next) { ret |=3D usb_mtp_deletefn(s, iter2, trans); } } --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792264055; cv=none; d=zohomail.com; s=zohoarc; b=hS8LSKMPYlWAKra2faKxTKXmBsZs3Rl6qdMpgsOs1E/BkKI62QQJdU5xZwTxVcrBqi8rFiSP6g6Z5ntbVBAg/enqI6kqCBDuKn1Xhh285tyyEHnPQxep1diLh7CqlDaVQMZCTSTczCyuNGyIqrfpd2xrj1Ir1xjjxH9bfIWvrKo= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792264055; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=iDOLs9mfFcJ1Bi9IAfFfvJlPN+SohfCo7UMjfPWb43c=; b=OYcXhpKVVSOGmvCktQPhUzMLC2tvt9rKHI2VAmcs2gnpZLJaR8kUmrYY2Om4gtJQmHYwSA9xbFLXLUlY+yaJ6zXO4ZE9q37yHYkciv2LPnRBaNP+fN3Tb51Y19yVCGRopVcxJ+pvFDKom1qwYvgycdQN/deo0N1mnL2DV0EgMJ4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792264055271209.10716664943902; Sat, 17 Oct 2026 12:07:35 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9cN-0004KL-Bw; Sat, 17 Oct 2026 14:58:55 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9c9-0003Z8-11; Sat, 17 Oct 2026 14:58:42 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9c7-0003sb-9W; Sat, 17 Oct 2026 14:58:40 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id ADAA01DE6C2; Sat, 17 Oct 2026 21:56:39 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 7273344338D; Sat, 17 Oct 2026 21:56:38 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263399; bh=utj2xCsRp2Uc13EzW7emphQNA0FAb6+fYVJOJP8PKoA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=gaSatI+OKAKhPP1S7dMpiULrpimp3xz91/REpR5IQcXYuB6rPuq7+KrbrMiaep/29 XnIOJPI361tHSC+pnFGKice8on2e3y/XYBI/xxTiWQCpBPOR7Lc4i4EMp8NwAoLBIk VKlsPo24UKlrB4LhP2SeTZCoIHARh589/wwkxQ5S3v21Wg4REYvaNt/W+icxUlwczc zQo/amm+i0ODV1XT/beX2bgi6u+7ACOayFk1F/Be/+ztrnYAQDbhDqaQPEdLcNP6oY z7i5JyaL/dkCv3RiHAYlleKfRw0HjEmzaZBlzqiH7lgZaLgH4aFikJL7PaEQKsGy8l WT2Vk4GoMKeJg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-10.0.15 34/63] io: prevent unbounded read of websocket data from client Date: Sat, 17 Oct 2026 21:54:50 +0300 Message-ID: <20261017185528.722197-34-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792264055668158500 From: Daniel P. Berrang=C3=A9 The QIOChannelWebsock class wraps an underlying QIOChannel instance, providing a websocket server handshake and packet encoding/decoding. When a watch is added to QIOChannelWebsock, this in turn creates a watch on the underlying QIOChannel that is always monitoring G_IO_IN, as long as the 'encinput' buffer has space. When this watch fires, it reads data off the wire into 'encinput' and then decodes as much of 'encinput' as possible into the 'rawinput' buffer. The qio_channel_websock_set_watch method checks to see that 'encinput' does not exceed a max limit, but fails to check that 'rawinput' size. Since any data read into 'encinput', can usually be immediately decoded into 'rawinput', the 'encinput' size check is largely a no-op, and so 'rawinput' will grow without bound. This is readily seen with the chardev socket backend if enabling websockets, connecting a client that sends data, while not running any guest OS to consume data from the chardev via a virtual serial port. The qio_channel_websock_read_wire() method will also unconditionally read more data into 'encinput' if it has less than 4k present, which is then decoded into 'rawinput'. IOW, if qio_channel_websock_read_wire() is triggered for lots of small reads, it will be reading and decoding more data to 'rawinput' than is consumed. Skip reading more data if 'rawinput' is already at its max size. Reported-by: Aisle Research Fixes: CVE-2026-101291 Fixes: 2d1d0e70cf3e ("io: add QIOChannelWebsock class") Reviewed-by: Marc-Andr=C3=A9 Lureau Reviewed-by: Philippe Mathieu-Daud=C3=A9 Signed-off-by: Daniel P. Berrang=C3=A9 (cherry picked from commit 4668899d66159dd611cd6432f880d9610ce12771) Signed-off-by: Michael Tokarev diff --git a/io/channel-websock.c b/io/channel-websock.c index a442e4bc48..5dd80ad45c 100644 --- a/io/channel-websock.c +++ b/io/channel-websock.c @@ -976,7 +976,8 @@ static ssize_t qio_channel_websock_read_wire(QIOChannel= Websock *ioc, { ssize_t ret; =20 - if (ioc->encinput.offset < 4096) { + if (ioc->encinput.offset < 4096 && + ioc->rawinput.offset < QIO_CHANNEL_WEBSOCK_MAX_BUFFER) { size_t want =3D 4096 - ioc->encinput.offset; =20 buffer_reserve(&ioc->encinput, want); @@ -1100,6 +1101,7 @@ static void qio_channel_websock_set_watch(QIOChannelW= ebsock *ioc) cond |=3D G_IO_OUT; } if (ioc->encinput.offset < QIO_CHANNEL_WEBSOCK_MAX_BUFFER && + ioc->rawinput.offset < QIO_CHANNEL_WEBSOCK_MAX_BUFFER && !ioc->io_eof) { cond |=3D G_IO_IN; } --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792264190; cv=none; d=zohomail.com; s=zohoarc; b=niLD+0ghGPCX6xyEzHE+ozsj5b03pYM8uAhNuTWa/PXge9cM868Gq1YAndm8BLUxz88pO6u+X7MA4VwlU8NTHENGh1vw/QMArKcRUmdjH+sWWwbmxaQYT2E6IP0uFhSmzO8GlY7PSuHSfo94M53O0hHwNSfQs20pAgSg65lnrEs= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792264190; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=Sz8Kyqwj+YOfoiNkvFyd+PbZzrnw6luJSigMmFMpHf0=; b=N+RfVf/29UHjFsrFaZQsoNtYSr7VOEW9MlyjaqSGnd7o2H26KZbwIm85R8rIAu4Z8rS9xwWA+m5vF9TVguDFgYFvLR0f138gbnGkLRpdNZ/gmOZbb3hLdH0rdvGW3fXLAO/Qmvs8zY6feuL8Bfw7IRGPcE4QSl7JPA9hNFXnjE4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792264190719477.35704281301264; Sat, 17 Oct 2026 12:09:50 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9cW-0004rY-TH; Sat, 17 Oct 2026 14:59:05 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9cU-0004lq-H0; Sat, 17 Oct 2026 14:59:02 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9cS-0003su-E7; Sat, 17 Oct 2026 14:59:02 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id DCEBF1DE6C3; Sat, 17 Oct 2026 21:56:40 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id E338E44338E; Sat, 17 Oct 2026 21:56:39 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263400; bh=HhIHdn5OOsvsF5pb7qu3RhyLKktjC6Ltc2bilV7sHzY=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=sZjH8VAefqVnUjk38Wiy7Zqvze0UHAcHS9V61ugjL5SUmg2litw3B5FMLP82SluBb /Jd227se3KAXetPuZK9wNN/l93TlF5ogyrEqD7wnErfOvrmCyqL9hfPPgTlRR+mlSq IgqAg3rkXtFGMql8Ak7oCEqghJVGtt2CZihC14Kaf+6YrHy8UtJ523AR2Yp7UU1qU8 reu1rnlBJOPBHOX4Y4YbGTaguJKMOgDHI75R8gw1iifsJ8nPsBHwTKKSjGibJWPsp3 G7dU6UqBz7018DSbO4C8vefAsflg+8GgKPgzBbsSjsfImKCmNyh0l3ucfowLEVntNn nmTKfyc5FfMaw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, "Denis V. Lunev" , Kevin Wolf , Hanna Reitz , Alberto Garcia , Michael Tokarev Subject: [Stable-10.0.15 35/63] block/throttle-groups: fix crash when enabling I/O limits on a busy disk Date: Sat, 17 Oct 2026 21:54:51 +0300 Message-ID: <20261017185528.722197-35-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792264192323158500 Content-Type: text/plain; charset="utf-8" From: "Denis V. Lunev" throttle_group_register_tgm() stores tgm->throttle_state before it takes tg->lock, so the I/O path can see a member whose group still has NULL tokens[] and an empty member list. A request in an iothread then reaches throttle_group_co_io_limits_intercept(), wins tg->lock ahead of the registering thread, and next_throttle_token() passes the NULL token to throttle_group_next_tgm(), which dereferences it: throttle_group_next_tgm (tgm=3D0x0) at block/throttle-groups.c:185 next_throttle_token (tgm=3D..., direction=3DTHROTTLE_READ) throttle_group_co_io_limits_intercept (tgm=3D..., bytes=3D8192, ...) blk_co_do_preadv_part (blk=3D..., offset=3D..., bytes=3D8192, ...) blk_aio_read_entry (opaque=3D...) coroutine_trampoline (i0=3D..., i1=3D...) blk_io_limits_enable() does not drain the BlockBackend, unlike its disable counterpart, so nothing keeps requests away while the group is built. A guest probing a disk that libvirt has just attached, at the moment the QoS settings for it are applied, is enough to hit this. Publish tgm->throttle_state with a release store once the member is linked into the group and its timers exist, and read it with an acquire load on the two unlocked I/O paths. A request that sees the new pointer then also sees a fully built group. Cc: Kevin Wolf Cc: Hanna Reitz Cc: Alberto Garcia Signed-off-by: Denis V. Lunev Message-ID: <20260908145554.3215221-2-den@openvz.org> Reviewed-by: Kevin Wolf Acked-by: Alberto Garcia Signed-off-by: Kevin Wolf (cherry picked from commit 429bf66a1f235847af89f7ef91d71b9c47b73892) Signed-off-by: Michael Tokarev diff --git a/block/block-backend.c b/block/block-backend.c index 8b39baea13..cfa8a30e9e 100644 --- a/block/block-backend.c +++ b/block/block-backend.c @@ -1338,6 +1338,7 @@ blk_co_do_preadv_part(BlockBackend *blk, int64_t offs= et, int64_t bytes, QEMUIOVector *qiov, size_t qiov_offset, BdrvRequestFlags flags) { + ThrottleGroupMember *tgm =3D &blk->public.throttle_group_member; int ret; BlockDriverState *bs; IO_CODE(); @@ -1357,9 +1358,8 @@ blk_co_do_preadv_part(BlockBackend *blk, int64_t offs= et, int64_t bytes, bdrv_inc_in_flight(bs); =20 /* throttling disk I/O */ - if (blk->public.throttle_group_member.throttle_state) { - throttle_group_co_io_limits_intercept(&blk->public.throttle_group_= member, - bytes, THROTTLE_READ); + if (qatomic_load_acquire(&tgm->throttle_state)) { + throttle_group_co_io_limits_intercept(tgm, bytes, THROTTLE_READ); } =20 ret =3D bdrv_co_preadv_part(blk->root, offset, bytes, qiov, qiov_offse= t, @@ -1413,6 +1413,7 @@ blk_co_do_pwritev_part(BlockBackend *blk, int64_t off= set, int64_t bytes, QEMUIOVector *qiov, size_t qiov_offset, BdrvRequestFlags flags) { + ThrottleGroupMember *tgm =3D &blk->public.throttle_group_member; int ret; BlockDriverState *bs; IO_CODE(); @@ -1431,9 +1432,8 @@ blk_co_do_pwritev_part(BlockBackend *blk, int64_t off= set, int64_t bytes, =20 bdrv_inc_in_flight(bs); /* throttling disk I/O */ - if (blk->public.throttle_group_member.throttle_state) { - throttle_group_co_io_limits_intercept(&blk->public.throttle_group_= member, - bytes, THROTTLE_WRITE); + if (qatomic_load_acquire(&tgm->throttle_state)) { + throttle_group_co_io_limits_intercept(tgm, bytes, THROTTLE_WRITE); } =20 if (!blk->enable_write_cache) { diff --git a/block/throttle-groups.c b/block/throttle-groups.c index ee5dea9621..94a10c689a 100644 --- a/block/throttle-groups.c +++ b/block/throttle-groups.c @@ -581,7 +581,6 @@ void throttle_group_register_tgm(ThrottleGroupMember *t= gm, ThrottleState *ts =3D throttle_group_incref(groupname); ThrottleGroup *tg =3D container_of(ts, ThrottleGroup, ts); =20 - tgm->throttle_state =3D ts; tgm->aio_context =3D ctx; qatomic_set(&tgm->restart_pending, 0); =20 @@ -602,6 +601,9 @@ void throttle_group_register_tgm(ThrottleGroupMember *t= gm, read_timer_cb, write_timer_cb, tgm); + + /* The I/O path reads this without tg->lock, so publish it last */ + qatomic_store_release(&tgm->throttle_state, ts); } =20 /* Unregister a ThrottleGroupMember from its group, removing it from the l= ist, --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263590; cv=none; d=zohomail.com; s=zohoarc; b=kSKzHcvarLFiY9DzIqn/TURmDy2n9NRD7MumO93gKSctv0bAvoNmvUfm10L+M42yGemWiwxczK5yXZ5TVNv59wY0E9GIcvKLJEeVizDqWTh20gHQVG0G+nkbbWKWviFnVRWsugzJ3/K4THL//ihnAZK60ge5Rt4WZRili6qF18c= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263590; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=gIJszxkDwJm8Jco+2ZMzRUWu18Kq+iMg1KEyBWHbiu0=; b=Tz3hm/OFEfm2P337cPZDCWc2X9s+xFdVpFgkNNZH/nVmAVyskEqMivY+Mt9AJ+PyP84NuQRaOCfzz8yWR2Jo/ZwzUYFDNnVgVSqRTxpoETLfosW2CzT0SMe+A8UjvF8hi56g9qItv82ILcIv3gmpvk9MObbJbJegXhtJTu5r7bs= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263590091535.4584709034274; Sat, 17 Oct 2026 11:59:50 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9cZ-00051A-Ry; Sat, 17 Oct 2026 14:59:08 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9cX-0004sy-C7; Sat, 17 Oct 2026 14:59:05 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9cV-0003tT-Ij; Sat, 17 Oct 2026 14:59:05 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 732011DE6C4; Sat, 17 Oct 2026 21:56:42 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 1E2C644338F; Sat, 17 Oct 2026 21:56:41 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263402; bh=ZafvBSm/LhoxM26OS3duVotEFaFUdHJv5VXNEI0wyNo=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=MQNGdnxtoHIWa394YVEFGfJMcmDEGLpU7rc+Kxrb8nBhDuIX37PTXaBlJ7cU9ncD3 pD3EQpgNuykVTpTBWXCM3dxlwqRvaoAi6c6I/N08GqhASOkI20uSA85mxMR4EHGaMo J0cUAJ8GKe1S5J4Ke5TKPbx0EsUhEnlup6iIos3KS6H7hrRMWmz8LVRE97AhgPXjH/ 66W8rlHuTiUQUrYCq8iD81c7+Im5DEiWAMiS5ox/nqPG2E9JLaVK3y6LpGjYS1Rilu HSlDNTeCDqgBL6mE3TtbTDdX+lfQ3L6KNEd866MPR6BWEvxUX3OMIJRDHfxVQIA5Oj Ubv2qlfmczRbQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, "Denis V. Lunev" , Stefan Hajnoczi , Michael Tokarev Subject: [Stable-10.0.15 36/63] iotests: cover inactivating a read-only node Date: Sat, 17 Oct 2026 21:54:52 +0300 Message-ID: <20261017185528.722197-36-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263590468158500 Content-Type: text/plain; charset="utf-8" From: "Denis V. Lunev" A driver which writes something out on .bdrv_inactivate has nothing to write for a node it can not write to, and has to answer such a request with success rather than with the error its refused write produces. The test inactivates nodes in several ways and never a read-only one, so nothing caught that. Add a read-only node and take it through a deactivation and back. The case is generic, as every driver implementing the handler has to answer the same way. Cc: Stefan Hajnoczi Signed-off-by: Denis V. Lunev (cherry picked from commit 2910b995f6c8afd3eaa950e24432a0e044274ac5) Signed-off-by: Michael Tokarev diff --git a/tests/qemu-iotests/tests/inactive-node-nbd b/tests/qemu-iotest= s/tests/inactive-node-nbd index a95b37e796..52c63fdf26 100755 --- a/tests/qemu-iotests/tests/inactive-node-nbd +++ b/tests/qemu-iotests/tests/inactive-node-nbd @@ -46,6 +46,7 @@ def node_is_active(_vm, node_name): return node['active'] =20 with iotests.FilePath('disk.img') as path, \ + iotests.FilePath('ro.img') as ro_path, \ iotests.FilePath('snap.qcow2') as snap_path, \ iotests.FilePath('snap2.qcow2') as snap2_path, \ iotests.FilePath('target.img') as target_path, \ @@ -57,6 +58,7 @@ with iotests.FilePath('disk.img') as path, \ iotests.log('Preparing disk...') iotests.qemu_img_create('-f', iotests.imgfmt, path, img_size) iotests.qemu_img_create('-f', iotests.imgfmt, target_path, img_size) + iotests.qemu_img_create('-f', iotests.imgfmt, ro_path, img_size) =20 iotests.qemu_img_create('-f', 'qcow2', '-b', path, '-F', iotests.imgfm= t, snap_path) @@ -69,6 +71,9 @@ with iotests.FilePath('disk.img') as path, \ 'active=3Doff') vm.add_blockdev(f'file,node-name=3Dtarget-file,filename=3D{target_path= }') vm.add_blockdev(f'{iotests.imgfmt},file=3Dtarget-file,node-name=3Dtarg= et-fmt') + vm.add_blockdev(f'file,node-name=3Dro-file,filename=3D{ro_path},read-o= nly=3Don') + vm.add_blockdev(f'{iotests.imgfmt},file=3Dro-file,node-name=3Dro-fmt,' + 'read-only=3Don') vm.add_blockdev(f'file,node-name=3Dsnap-file,filename=3D{snap_path}') vm.add_blockdev(f'file,node-name=3Dsnap2-file,filename=3D{snap2_path}') =20 @@ -288,6 +293,15 @@ with iotests.FilePath('disk.img') as path, \ iotests.log(qemu_io.cmd('map'), filters=3D[filter_qemu_io]) qemu_io.close() =20 + iotests.log('\n=3D=3D=3D Inactivating a read-only node =3D=3D=3D') + + # A driver which writes something out on inactivation has nothing to + # write for a node it can not write to, and must not fail the request + vm.qmp_log('blockdev-set-active', node_name=3D'ro-fmt', active=3DFalse) + iotests.log('ro-fmt active: %s' % node_is_active(vm, 'ro-fmt')) + vm.qmp_log('blockdev-set-active', node_name=3D'ro-fmt', active=3DTrue) + iotests.log('ro-fmt active: %s' % node_is_active(vm, 'ro-fmt')) + iotests.log('\n=3D=3D=3D Resuming VM activates all images =3D=3D=3D') vm.qmp_log('cont') =20 diff --git a/tests/qemu-iotests/tests/inactive-node-nbd.out b/tests/qemu-io= tests/tests/inactive-node-nbd.out index a458b4fc05..3c43020053 100644 --- a/tests/qemu-iotests/tests/inactive-node-nbd.out +++ b/tests/qemu-iotests/tests/inactive-node-nbd.out @@ -227,6 +227,14 @@ discard failed: Operation not permitted qemu-io: Failed to get allocation status: Operation not permitted =20 =20 +=3D=3D=3D Inactivating a read-only node =3D=3D=3D +{"execute": "blockdev-set-active", "arguments": {"active": false, "node-na= me": "ro-fmt"}} +{"return": {}} +ro-fmt active: False +{"execute": "blockdev-set-active", "arguments": {"active": true, "node-nam= e": "ro-fmt"}} +{"return": {}} +ro-fmt active: True + =3D=3D=3D Resuming VM activates all images =3D=3D=3D {"execute": "cont", "arguments": {}} {"return": {}} --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263881; cv=none; d=zohomail.com; s=zohoarc; b=JFqsH7iEFp+nIR71pWhGv3bfC/L+g+cLsV9PiN6bZOfDnzrU3UpFxd4Qo0rCtALYgAYHk3TtRo4KD1+EQs+t+65DaJHy7JCsWmwmS5pYhrLWhwbBEfMcVF+7DcZ2pPfROksTa3JFcHg65rpTJki9PRFyFQg8SULYQNjGX+Bym8k= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263881; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=Ll02a0dm4HO7SbLBEfyh7IhWs7AIqPYFPHefhdjMVfg=; b=IobU/hUjsRMET+x2XpXDfN1xqngzr5PcB+2uFlUTLiw6gcTRcImKUeR3EltOOumAQEWO32BbHbnIlC7cNkaVgtqY0roGcQiVlJu2poh3KEgbRvLy8GowYBLSItYOFdn2JAwSRErualIMk3tLSFOrCMzBzXkhC3u1HHYG7MHzAHk= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263881361287.70363271277154; Sat, 17 Oct 2026 12:04:41 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9dR-0005T7-1b; Sat, 17 Oct 2026 15:00:04 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9cX-0004wh-TP; Sat, 17 Oct 2026 14:59:05 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9cW-0003wD-16; Sat, 17 Oct 2026 14:59:05 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id BCF3D1DE6C6; Sat, 17 Oct 2026 21:56:43 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id D51B6443390; Sat, 17 Oct 2026 21:56:42 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263403; bh=XySdoke8VI/HQlJG18mz7u8dZBLFrbe8di+XMwBRHj0=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=B0SU870Q3UYfbBmDtCtvNS+lR+ZpcBUUzm2UoeAGvvVREhcBk3OarUVeQn4TnRDm0 mPn+03NKpYt5/I58vFSqZChnEZmEvalL3kY0/mBHQg21F5jOrqaBC7wdGvH4144FyE GuvA3iPiiSM//JoVuhDrFA+l9+rdNv5NcBvCqCauFzYgqDi7v1iydLaHiqSgPY7Bao Jlffo+RKJtsJvVck8FagTdSpmwYqIWl8bjf/AE+IXK1YTqxNI1l5ccn5aFuEkv5P75 Y0PHwbJfbox+NhMiTZC58NYFzqjncR1TYGIkYoal37kFt2s3Z+JV8hFAoEpymdh/L7 GMnCtijRE0sXQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, "Denis V. Lunev" , Fiona Ebner , Kevin Wolf , Michael Tokarev Subject: [Stable-10.0.15 37/63] block: fix bdrv_next() skipping monitor-owned nodes Date: Sat, 17 Oct 2026 21:54:53 +0300 Message-ID: <20261017185528.722197-37-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263882604158500 Content-Type: text/plain; charset="utf-8" From: "Denis V. Lunev" it->bs is the cursor into monitor_bdrv_states for the second phase of bdrv_next(), so it has to be NULL when that phase starts. Commit f6d38c9f6d made the first phase store the node it returns there, to unreference the right one when the graph changes underneath. The cursor is now left pointing at the last BlockBackend root, so the second phase resumes from there instead of from the head of the list and never returns a node added before it. A skipped node drops out of the vm_stop and migration handover paths: not flushed, not inactivated, not snapshotted. bdrv_inactivate_all() still reports success, so the node keeps its image lock and the migration target cannot open the image. Only detached nodes are hit in practice, as these callers also recurse into children. Reset the cursor when the second phase starts. old_bs is taken at the top of the function, so f6d38c9f6d keeps working. Cc: qemu-stable@nongnu.org Fixes: f6d38c9f6d ("block-backend: fix edge case in bdrv_next() where BDS a= ssociated to BB changes") Signed-off-by: Denis V. Lunev Cc: Fiona Ebner Cc: Kevin Wolf Message-ID: <20260828222005.2888213-1-den@openvz.org> Reviewed-by: Fiona Ebner Tested-by: Fiona Ebner Reviewed-by: Kevin Wolf Signed-off-by: Kevin Wolf (cherry picked from commit 8daaf8d3b1c5f2ef98e526e036277083bc5fe34b) Signed-off-by: Michael Tokarev diff --git a/block/block-backend.c b/block/block-backend.c index cfa8a30e9e..f1886572a3 100644 --- a/block/block-backend.c +++ b/block/block-backend.c @@ -625,6 +625,7 @@ BlockDriverState *bdrv_next(BdrvNextIterator *it) return bs; } it->phase =3D BDRV_NEXT_MONITOR_OWNED; + it->bs =3D NULL; } =20 /* Then return the monitor-owned BDSes without a BB attached. Ignore a= ll diff --git a/tests/qemu-iotests/tests/inactive-node-nbd b/tests/qemu-iotest= s/tests/inactive-node-nbd index 52c63fdf26..405c8cce59 100755 --- a/tests/qemu-iotests/tests/inactive-node-nbd +++ b/tests/qemu-iotests/tests/inactive-node-nbd @@ -47,6 +47,7 @@ def node_is_active(_vm, node_name): =20 with iotests.FilePath('disk.img') as path, \ iotests.FilePath('ro.img') as ro_path, \ + iotests.FilePath('detached.img') as detached_path, \ iotests.FilePath('snap.qcow2') as snap_path, \ iotests.FilePath('snap2.qcow2') as snap2_path, \ iotests.FilePath('target.img') as target_path, \ @@ -59,6 +60,7 @@ with iotests.FilePath('disk.img') as path, \ iotests.qemu_img_create('-f', iotests.imgfmt, path, img_size) iotests.qemu_img_create('-f', iotests.imgfmt, target_path, img_size) iotests.qemu_img_create('-f', iotests.imgfmt, ro_path, img_size) + iotests.qemu_img_create('-f', iotests.imgfmt, detached_path, img_size) =20 iotests.qemu_img_create('-f', 'qcow2', '-b', path, '-F', iotests.imgfm= t, snap_path) @@ -69,6 +71,9 @@ with iotests.FilePath('disk.img') as path, \ vm.add_blockdev(f'file,node-name=3Ddisk-file,filename=3D{path}') vm.add_blockdev(f'{iotests.imgfmt},file=3Ddisk-file,node-name=3Ddisk-f= mt,' 'active=3Doff') + vm.add_blockdev(f'file,node-name=3Ddetached-file,filename=3D{detached_= path}') + vm.add_blockdev(f'{iotests.imgfmt},file=3Ddetached-file,' + 'node-name=3Ddetached-fmt') vm.add_blockdev(f'file,node-name=3Dtarget-file,filename=3D{target_path= }') vm.add_blockdev(f'{iotests.imgfmt},file=3Dtarget-file,node-name=3Dtarg= et-fmt') vm.add_blockdev(f'file,node-name=3Dro-file,filename=3D{ro_path},read-o= nly=3Don') @@ -310,6 +315,17 @@ with iotests.FilePath('disk.img') as path, \ iotests.log('snap2-fmt active: %s' % node_is_active(vm, 'snap2-fmt')) iotests.log('target-fmt active: %s' % node_is_active(vm, 'target-fmt')) =20 + iotests.log('\n=3D=3D=3D Inactivating all nodes at once =3D=3D=3D') + + # detached-fmt has no parent and no BlockBackend, so nothing can reach= it + # by recursion. It is only inactivated if bdrv_next() actually returns= it. + vm.qmp_log('stop') + vm.qmp_log('blockdev-set-active', active=3DFalse) + + iotests.log('detached-fmt active: %s' % node_is_active(vm, 'detached-f= mt')) + iotests.log('detached-file active: %s' + % node_is_active(vm, 'detached-file')) + iotests.log('\nShutting down...') vm.shutdown() log =3D vm.get_log() diff --git a/tests/qemu-iotests/tests/inactive-node-nbd.out b/tests/qemu-io= tests/tests/inactive-node-nbd.out index 3c43020053..28b1322554 100644 --- a/tests/qemu-iotests/tests/inactive-node-nbd.out +++ b/tests/qemu-iotests/tests/inactive-node-nbd.out @@ -243,5 +243,13 @@ snap-fmt active: True snap2-fmt active: True target-fmt active: True =20 +=3D=3D=3D Inactivating all nodes at once =3D=3D=3D +{"execute": "stop", "arguments": {}} +{"return": {}} +{"execute": "blockdev-set-active", "arguments": {"active": false}} +{"return": {}} +detached-fmt active: False +detached-file active: False + Shutting down... =20 --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263696; cv=none; d=zohomail.com; s=zohoarc; b=L3N3zMRSb7EUpt3goE8SvYEzDWExMDv2yzxJGZec7RWdL5eRtL3DoaLFnn4IYnJr4PhB/OyLbawHGuRI+GC3UYLeqB4Yn1tU5yyPOrUhqrxL8H6bwWWbbCDJf0MWAhOZP7gz2VuP3ZhVR/9kDJbC3+vNQ6zgpikDJw1mw+OVMQk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263696; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=YcYE8p8DeizcVPbBTyO0qc3Wi0G3Q5KGZeUjA2rSMWk=; b=HSLT4XInx2cwUCPr0LOHA7CkRBjoI9hbYl4WwMiuxnOlxHIeeGofvJm8tOXa6l1ouIGRZ4iNpN9hBT3DHgPIxrfXUD/02aXpRV0qOGmHxG5fk36R5JSD6nQ0bQ9YESgLnepAKR7yOX+e+IdtDhubUy8s5O4RjbySOF6bOn/Wd0s= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 179226369610534.551792957613884; Sat, 17 Oct 2026 12:01:36 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9dD-0005N4-MA; Sat, 17 Oct 2026 14:59:49 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9ca-00054u-TO; Sat, 17 Oct 2026 14:59:10 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9cY-0003x2-Sy; Sat, 17 Oct 2026 14:59:08 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 079181DE6C7; Sat, 17 Oct 2026 21:56:45 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id F0625443391; Sat, 17 Oct 2026 21:56:43 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263405; bh=G78ifZATUZmrcYRB9DS51345KrtEBCiRFDFB4kitCmM=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=GwnCZ8fuuUImgud+bdFGcO5lVpJCN36Nt1ttmw8vdRT5cpIOd6XumWIFBK7E7FR1m dKKbi5K1hBZriLWulcrkS1hJNd1zH4P5JdfDk8CcxErYj2fJ/JhgV8zhT19fG4Iyb3 rLYiP0TEVAWe+VJ9EsKDmGm1gX7GeWk7XiaAlZwtcVCQQ2xM0Mgf5I3iIuwMw9ZCtZ wtNVldU3kcwXuRCxXikaK8g7I7YSAUgiqqojSrOLzxQRjwcB8c/AJPAlqFM/LeKqB0 LFQyKu1zwXka5G+vgtmvZ8yl1+J0sZWW3oGUE0eBcnW8hWnXEemI2s9rgo7L+8XBKp 9HeL46OW/E1ow== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Stefan Hajnoczi , Eric Biggers , Ben Chaney , Kevin Wolf , Michael Tokarev Subject: [Stable-10.0.15 38/63] file-posix: add statx(STATX_DIOALIGN) support Date: Sat, 17 Oct 2026 21:54:54 +0300 Message-ID: <20261017185528.722197-38-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263696590158500 Content-Type: text/plain; charset="utf-8" From: Stefan Hajnoczi Linux v6.1 commit 825cf206ed51 ("statx: add direct I/O alignment information") added an interface to fetch O_DIRECT alignment values for block devices and file systems. Prefer STATX_DIOALIGN to older interfaces and probing, but keep them as fallbacks in case STATX_DIOALIGN cannot provide the information. STATX_DIOALIGN support as of Linux 6.1: - btrfs: no - ext4: yes - XFS: yes - block devices: yes - dm-crypt: yes This change fixes #1290 ("IO alignment probing delivers incorrect results on Linux when used with e.g. dm-crypt") on Linux host kernel version 6.1 or later by avoiding the problematic probing code in raw_probe_alignment(). It would be nice to fix the probing code but I have not been able to reproduce it. Stable/LTS distros ship Linux 6.1+, so the number of users without STATX_DIOALIGN is becoming small. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/1290 Cc: Eric Biggers Signed-off-by: Stefan Hajnoczi Message-ID: <20260922154351.226540-1-stefanha@redhat.com> Reviewed-by: Ben Chaney Reviewed-by: Kevin Wolf Signed-off-by: Kevin Wolf (cherry picked from commit 196a50b0902b0951ce331212f7bcf109de832b5f) Signed-off-by: Michael Tokarev diff --git a/block/file-posix.c b/block/file-posix.c index 796553bafd..f7d5d80ef1 100644 --- a/block/file-posix.c +++ b/block/file-posix.c @@ -410,28 +410,48 @@ static void raw_probe_alignment(BlockDriverState *bs,= int fd, Error **errp) =20 bs->bl.request_alignment =3D 0; s->buf_align =3D 0; - /* Let's try to use the logical blocksize for the alignment. */ - if (probe_logical_blocksize(fd, &bs->bl.request_alignment) < 0) { - bs->bl.request_alignment =3D 0; - } =20 -#ifdef __linux__ +#if defined(__linux__) && defined(STATX_DIOALIGN) + struct statx stx; + /* - * The XFS ioctl definitions are shipped in extra packages that might - * not always be available. Since we just need the XFS_IOC_DIOINFO ioc= tl - * here, we simply use our own definition instead: + * Linux 6.1 introduced an interface for both block devices and file + * systems. The system call returns with the STATX_DIOALIGN bit cleared + * when the information is unavailable. */ - struct xfs_dioattr { - uint32_t d_mem; - uint32_t d_miniosz; - uint32_t d_maxiosz; - } da; - if (ioctl(fd, _IOR('X', 30, struct xfs_dioattr), &da) >=3D 0) { - bs->bl.request_alignment =3D da.d_miniosz; - /* The kernel returns wrong information for d_mem */ - /* s->buf_align =3D da.d_mem; */ + if (statx(fd, "", AT_EMPTY_PATH, STATX_DIOALIGN, &stx) =3D=3D 0 && + (stx.stx_mask & STATX_DIOALIGN)) { + bs->bl.request_alignment =3D stx.stx_dio_offset_align; + s->buf_align =3D stx.stx_dio_mem_align; + } +#endif /* defined(__linux__) && defined(STATX_DIOALIGN) */ + +#ifdef __linux__ + if (!bs->bl.request_alignment) { + /* + * The XFS ioctl definitions are shipped in extra packages that mi= ght + * not always be available. Since we just need the XFS_IOC_DIOINFO= ioctl + * here, we simply use our own definition instead: + */ + struct xfs_dioattr { + uint32_t d_mem; + uint32_t d_miniosz; + uint32_t d_maxiosz; + } da; + if (ioctl(fd, _IOR('X', 30, struct xfs_dioattr), &da) >=3D 0) { + bs->bl.request_alignment =3D da.d_miniosz; + /* The kernel returns wrong information for d_mem */ + /* s->buf_align =3D da.d_mem; */ + } + } +#endif /* __linux__ */ + + /* Let's try to use the logical blocksize for the alignment. */ + if (!bs->bl.request_alignment) { + if (probe_logical_blocksize(fd, &bs->bl.request_alignment) < 0) { + bs->bl.request_alignment =3D 0; + } } -#endif =20 /* * If we could not get the sizes so far, we can only guess them. First= try --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792264086; cv=none; d=zohomail.com; s=zohoarc; b=BuMqMrCT6cRpxQolQ+biHyiNIbdQuiUMmELchF56KKWgbtXEHH7uoUrTLE8PhdzSAJcSBx4IPYPTtcZHhUEQS02FUYrXsspHmx5dRwiw9WV9fTufXSJaPOWWLmSQsL/9OQerK91sn7Y8FmqnR1yjRb8GTedqd0vk/Ij5+Z8CkbQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792264086; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=lrKYo0ur2crpVYgw6boEm+m6uOGmjnR5vjMp+fOnlEM=; b=RUOx4QYQ+8Ok9I24a8kIHBD1wswwLAZQyJyLl2TBxYShagTyxIMtlKuQWwQuvKXjzYsTIibyyPJPhX9qmctoZiJLe2D3GLnEZXAwoX9450xIL2ukrdEgmWY+2+e53EtgtpaogCzHANgD3YAuNI3TNd5X6TNbyq8gPWC8qQY45Sg= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792264086856933.7520068724253; Sat, 17 Oct 2026 12:08:06 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9dp-0005mK-CW; Sat, 17 Oct 2026 15:00:25 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9cv-0005IT-Qz; Sat, 17 Oct 2026 14:59:36 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9ct-0003xD-B6; Sat, 17 Oct 2026 14:59:28 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id D1CBE1DE6C8; Sat, 17 Oct 2026 21:56:46 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 6A34D443392; Sat, 17 Oct 2026 21:56:45 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263406; bh=jCSsbYm8DAsppID2FPzEXBfhxFllFwpdgjpTmV+qdkI=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=i28m0zCRM4lshGsjAd7XoehHUGTdNmT9l4E6ls1zFifazK1GLUC83ZywniVCWJDpt V+BCnbUw9s6woHJugS30HJWDMexdKY3NobCwSwVh8OmtDESOjwZXSYqqj9q2xSc3Bj C0d3wyBkI+4HbcWSAfVT30Zqo66BWGhaIT0LGA0lzdBIIqaw6zeS6/Im2mih3EKeB3 /UEh0z4iKWXCsFbUVQfnZdaqM08p0ka4oDooD1GIEK/GxES0nZP29kNSI6o5P77svT nCFbve069HclrcnVLpic787N1/mujbyyd6wiEdPyGX0vGtcbBrLywv7B2gGKRGzsr6 6fCOVK+T2L1NA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, "Denis V. Lunev" , Andrey Drobyshev , Kevin Wolf , Hanna Reitz , Michael Tokarev Subject: [Stable-10.0.15 39/63] qcow2: do not clear the dirty bit when reopening a read-only node Date: Sat, 17 Oct 2026 21:54:55 +0300 Message-ID: <20261017185528.722197-39-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792264088302158500 Content-Type: text/plain; charset="utf-8" From: "Denis V. Lunev" qcow2_reopen_prepare() clears the dirty bit whenever the node is reopened read-only, with an unguarded header write. A read-only node can still be dirty, inherited from an earlier writable session, and it holds no BLK_PERM_WRITE to resolve that. A read-only to read-only reopen of a dirty image therefore fails outright: $ qemu-io -r -f qcow2 dirty.qcow2 <<< $'reopen -r\nquit' qemu-io: failed while preparing to reopen image 'dirty.qcow2' Where the file node below is writable the write is not refused early, and bdrv_co_write_req_prepare() aborts on its BLK_PERM_WRITE assertion instead. Clear it only for a node that is writable now, the predicate qcow2_do_open() already uses for the repair. bdrv_is_writable() also excludes an inactive node, whose header must not be touched either. Signed-off-by: Denis V. Lunev Reviewed-by: Andrey Drobyshev CC: Kevin Wolf CC: Hanna Reitz CC: Andrey Drobyshev Cc: qemu-stable@nongnu.org Message-ID: <20260824133729.1141990-2-den@openvz.org> Reviewed-by: Kevin Wolf Signed-off-by: Kevin Wolf (cherry picked from commit af28b65fae6fcbc22efdbcd4d71b37fd0c8adf89) Signed-off-by: Michael Tokarev diff --git a/block/qcow2.c b/block/qcow2.c index 6f495c97d5..14dddd6273 100644 --- a/block/qcow2.c +++ b/block/qcow2.c @@ -2016,9 +2016,11 @@ qcow2_reopen_prepare(BDRVReopenState *state,BlockReo= penQueue *queue, goto fail; } =20 - ret =3D qcow2_mark_clean(state->bs); - if (ret < 0) { - goto fail; + if (bdrv_is_writable(state->bs)) { + ret =3D qcow2_mark_clean(state->bs); + if (ret < 0) { + goto fail; + } } } =20 diff --git a/tests/qemu-iotests/039 b/tests/qemu-iotests/039 index 94a8bfe754..3d0c073d65 100755 --- a/tests/qemu-iotests/039 +++ b/tests/qemu-iotests/039 @@ -95,6 +95,40 @@ $QEMU_IMG info --image-opts \ # The dirty bit must still be set: this open never wrote any guest data _qcow2_dump_header | grep incompatible_features =20 +echo +echo "=3D=3D Read-only reopen must not clear the dirty bit =3D=3D" + +# A read-only node cannot write the header, and must keep the dirty bit +$QEMU_IO -r -c "reopen -r" -c "read -P 0x5a 0 512" "$TEST_IMG" \ + | _filter_qemu_io + +# The dirty bit must still be set +_qcow2_dump_header | grep incompatible_features + +echo +echo "=3D=3D Read-only reopen must not write through a writable file node = =3D=3D" + +# The write the header update needs is refused by the permission system +echo "{'execute': 'qmp_capabilities'} + {'execute': 'blockdev-reopen', + 'arguments': {'options': [{'node-name': 'drive', + 'driver': 'qcow2', + 'read-only': true, + 'file': 'prot'}]}} + {'execute': 'quit'}" \ + | $QEMU -qmp stdio -nographic -nodefaults \ + -blockdev "{'node-name': 'prot', + 'driver': 'file', + 'filename': '$TEST_IMG'}" \ + -blockdev "{'node-name': 'drive', + 'driver': 'qcow2', + 'file': 'prot', + 'read-only': true}" \ + | _filter_qmp + +# The dirty bit must still be set +_qcow2_dump_header | grep incompatible_features + echo echo "=3D=3D Repairing the image file must succeed =3D=3D" =20 @@ -108,6 +142,22 @@ echo "=3D=3D Data should still be accessible after rep= air =3D=3D" =20 $QEMU_IO -c "read -P 0x5a 0 512" "$TEST_IMG" | _filter_qemu_io =20 +echo +echo "=3D=3D A read-write to read-only reopen must clear the dirty bit =3D= =3D" + +_make_test_img -o "compat=3D1.1,lazy_refcounts=3Don" $size + +# The kill keeps the close from clearing the bit, so the header shows what +# the reopen did with it +_NO_VALGRIND \ +$QEMU_IO -c "write -P 0x5a 0 512" \ + -c "reopen -r" \ + -c "sigraise $(kill -l KILL)" "$TEST_IMG" 2>&1 \ + | _filter_qemu_io + +# The dirty bit must not be set +_qcow2_dump_header | grep incompatible_features + echo echo "=3D=3D Opening a dirty image read/write should repair it =3D=3D" =20 diff --git a/tests/qemu-iotests/039.out b/tests/qemu-iotests/039.out index c66361128f..ce8ee57721 100644 --- a/tests/qemu-iotests/039.out +++ b/tests/qemu-iotests/039.out @@ -27,6 +27,19 @@ incompatible_features [0] =3D=3D Read-only open must not crash on close =3D=3D incompatible_features [0] =20 +=3D=3D Read-only reopen must not clear the dirty bit =3D=3D +read 512/512 bytes at offset 0 +512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) +incompatible_features [0] + +=3D=3D Read-only reopen must not write through a writable file node =3D=3D +QMP_VERSION +{"return": {}} +{"return": {}} +{"timestamp": {"seconds": TIMESTAMP, "microseconds": TIMESTAMP}, "event"= : "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}} +{"return": {}} +incompatible_features [0] + =3D=3D Repairing the image file must succeed =3D=3D ERROR cluster 5 refcount=3D0 reference=3D1 Rebuilding refcount structure @@ -45,6 +58,13 @@ incompatible_features [] read 512/512 bytes at offset 0 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) =20 +=3D=3D A read-write to read-only reopen must clear the dirty bit =3D=3D +Formatting 'TEST_DIR/t.IMGFMT', fmt=3DIMGFMT size=3D134217728 +wrote 512/512 bytes at offset 0 +512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) +./common.rc: Killed ( VALGRIND_QEMU=3D"${VALGRIND_QEMU_IO}" _qemu_proc_exe= c "${VALGRIND_LOGFILE}" "$QEMU_IO_PROG" $QEMU_IO_ARGS "$@" ) +incompatible_features [] + =3D=3D Opening a dirty image read/write should repair it =3D=3D Formatting 'TEST_DIR/t.IMGFMT', fmt=3DIMGFMT size=3D134217728 wrote 512/512 bytes at offset 0 --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792264057; cv=none; d=zohomail.com; s=zohoarc; b=hyRzuv9cmM9G9h3hT7Otez3n/Y5uaqy1LEqDUxMq9OYhPhpGtUo4XjWKsfmt+UIG2orHdN8z9tTApPeQSnECoVYANaUkOU5Db5o+vHMhHx62r96h2khn0TzOTxy1vd5QRvVB8UNq+o1Vqjweib2et5sixnkgzMhUYretx8F742Y= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792264057; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=wdzXF/W2aEedYmWoqsV6KvATpQf0daClXl5R4HPPXZc=; b=COie7qZ/MrACw+/e54kqPifkTUm5wtRxnLLo9mPZeMYoLnN4+EcmldEebd0NbYDVBH9xVq38n/HAjy55YzsXdgro+IzvqqEIfbJlIfNplT1joMWMk6RKBDihzCJ123T6c9e7AFtFyNJgevdBQcbYMQFbDi2NcaDxjAdzU2g+XRE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792264057951942.59510136083; Sat, 17 Oct 2026 12:07:37 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9e6-0006FX-JG; Sat, 17 Oct 2026 15:00:44 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9cy-0005J8-V0; Sat, 17 Oct 2026 14:59:36 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9cw-0003xc-FR; Sat, 17 Oct 2026 14:59:31 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 0BE051DE6C9; Sat, 17 Oct 2026 21:56:48 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 120D3443393; Sat, 17 Oct 2026 21:56:46 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263408; bh=OQ8OS3/3dwMvofshuWTyn5iO3Zh/dIugLRLHB8hUGB4=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=O5N47WNBfPzqIjtWimHy44MaOaidgnuT3v7Y5OP/d6x1uf7sk8zkC/WlSmHr6rNCp BpGPEY08kLMCOxELS5tXpyWccl/c2dSoePgWZC101XGP6xACCJ1kvqgE2Vs+VoRaCF GrGCsq4jN9bIUdlrXmwHF6xPQLO+00sS2cYqr5wmInVdJ5KbnRhdFA+O6vfKJnrNiN gHuC8kZa0sdVMbHWFe0bYjcDDqfJp4lajuXyKjdhUEuiszUAYDGBw7/c3cfAixsJlU btTHn4tvf3D0MTwCf2HTyXcBKwGj2dBYMeqjg73REGTXwPq8VO/pkowE3B04TXuAIF uKnqQBpmSvziw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, "Denis V. Lunev" , Andrey Drobyshev , Kevin Wolf , Hanna Reitz , Michael Tokarev Subject: [Stable-10.0.15 40/63] block: reject a reopen of an unusable node instead of crashing Date: Sat, 17 Oct 2026 21:54:56 +0300 Message-ID: <20261017185528.722197-40-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792264061767158500 Content-Type: text/plain; charset="utf-8" From: "Denis V. Lunev" qcow2_signal_corruption() drops bs->drv, so a node can lose its driver at any time and a reopen has to expect that. Both ends of the path assume otherwise: $ qemu-io -c "read 0 64k" -c "reopen -r" corrupt.qcow2 qcow2: Marking image as corrupt: Cluster allocation offset 0x1200 unaligned (L2 offset: 0x40000, L2 index: 0); ... Segmentation fault bdrv_reopen_queue_child() dereferences bs->drv while descending into the children the node opened itself, and bdrv_reopen_prepare() asserts on it. commit_clean() reopens the base of a commit job back to read-only, so a base which goes corrupt under the job arrives here too. There is nothing to reopen for such a node, so stop descending into its children and let bdrv_reopen_prepare() report what every caller of bdrv_reopen() already handles. bdrv_reopen_commit() and bdrv_reopen_abort() keep their assertion, only a prepared entry reaches them. Signed-off-by: Denis V. Lunev Reviewed-by: Andrey Drobyshev CC: Kevin Wolf CC: Hanna Reitz CC: Andrey Drobyshev Cc: qemu-stable@nongnu.org Message-ID: <20260824133729.1141990-3-den@openvz.org> Reviewed-by: Kevin Wolf Signed-off-by: Kevin Wolf (cherry picked from commit efe98c2a0932c09ada26b8afac3606a66f561933) (Mjt: fixup iotest output accross v11.1.0-800-g3c0c7bfeba92 "qemu-io: propagate errors through Error API instead of printf") Signed-off-by: Michael Tokarev diff --git a/block.c b/block.c index 1c1c19d04a..0875e92536 100644 --- a/block.c +++ b/block.c @@ -4476,6 +4476,11 @@ bdrv_reopen_queue_child(BlockReopenQueue *bs_queue, = BlockDriverState *bs, !qdict_haskey(options, "backing.driver"); } =20 + /* An unusable node is rejected by bdrv_reopen_prepare(), do not desce= nd */ + if (!bs->drv) { + return bs_queue; + } + QLIST_FOREACH(child, &bs->children, next) { QDict *new_child_options =3D NULL; bool child_keep_old =3D keep_old_opts; @@ -4859,9 +4864,16 @@ bdrv_reopen_prepare(BDRVReopenState *reopen_state, B= lockReopenQueue *queue, bool drv_prepared =3D false; =20 assert(reopen_state !=3D NULL); - assert(reopen_state->bs->drv !=3D NULL); GLOBAL_STATE_CODE(); + drv =3D reopen_state->bs->drv; + if (drv =3D=3D NULL) { + GRAPH_RDLOCK_GUARD_MAINLOOP(); + + error_setg(errp, "Block node '%s' has no driver left to reopen", + bdrv_get_device_or_node_name(reopen_state->bs)); + return -ENOMEDIUM; + } =20 /* This function and each driver's bdrv_reopen_prepare() remove * entries from reopen_state->options as they are processed, so diff --git a/tests/qemu-iotests/060 b/tests/qemu-iotests/060 index 5cd21a6f68..ce49fc34ec 100755 --- a/tests/qemu-iotests/060 +++ b/tests/qemu-iotests/060 @@ -486,6 +486,36 @@ echo # Image should not have been marked corrupt _img_info --format-specific | grep 'corrupt:' =20 +echo +echo "=3D=3D=3D Testing the reopen of an image corrupted at runtime =3D=3D= =3D" +echo + +_make_test_img 64M +poke_file "$TEST_IMG" "$l1_offset" "\x00\x00\x00\x00\x2a\x2a\x2a\x2a" + +# The read leaves the node unusable, the reopen must report that +echo "{'execute': 'qmp_capabilities'} + {'execute': 'human-monitor-command', + 'arguments': {'command-line': 'qemu-io drive \"read 0 512\"'}} + {'execute': 'blockdev-reopen', + 'arguments': {'options': [{'node-name': 'drive', + 'driver': 'qcow2', + 'read-only': true, + 'file': { + 'driver': 'file', + 'filename': '$TEST_IMG' + }}]}} + {'execute': 'quit'}" \ + | $QEMU -qmp stdio -nographic -nodefaults \ + -blockdev "{'node-name': 'drive', + 'driver': 'qcow2', + 'file': { + 'driver': 'file', + 'filename': '$TEST_IMG' + }}" \ + 2>&1 \ + | _filter_qmp | _filter_qemu_io + # success, all done echo "*** done" rm -f $seq.full diff --git a/tests/qemu-iotests/060.out b/tests/qemu-iotests/060.out index a37bf446e9..ad1912a43b 100644 --- a/tests/qemu-iotests/060.out +++ b/tests/qemu-iotests/060.out @@ -436,4 +436,17 @@ qcow2: Image is corrupt: L2 table offset 0x2a2a2a00 un= aligned (L1 index: 0); fur {"return": {}} =20 corrupt: false + +=3D=3D=3D Testing the reopen of an image corrupted at runtime =3D=3D=3D + +Formatting 'TEST_DIR/t.IMGFMT', fmt=3DIMGFMT size=3D67108864 +QMP_VERSION +{"return": {}} +qcow2: Marking image as corrupt: L2 table offset 0x2a2a2a00 unaligned (L1 = index: 0); further corruption events will be suppressed +{"timestamp": {"seconds": TIMESTAMP, "microseconds": TIMESTAMP}, "event"= : "BLOCK_IMAGE_CORRUPTED", "data": {"device": "", "msg": "L2 table offset 0= x2a2a2a00 unaligned (L1 index: 0)", "node-name": "drive", "fatal": true}} +read failed: Input/output error +{"return": ""} +{"error": {"class": "GenericError", "desc": "Block node 'drive' has no dri= ver left to reopen"}} +{"timestamp": {"seconds": TIMESTAMP, "microseconds": TIMESTAMP}, "event"= : "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}} +{"return": {}} *** done --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263756; cv=none; d=zohomail.com; s=zohoarc; b=i0Rt7RLuqW2s90K6gQtFc0AiLF1gUYjQBLyc0Vfdyf4oxdk5BnPQrIihlPjcDpCXhzgk1MxES6KEyA7wtkQA+XBcsRMaNW2vnSEreafViz04pJj5SeFEAwX1ou751E3o4aqUvyX0nqxO4tdouEu6vf+Z4bBy7Ob2I+LUDJ21iBs= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263756; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=0Xzy8wR7CNccyXmQ75to7LS8JSfJCyPmOhyWFAzFIrc=; b=ft1WY4U/MDIWdidigiHKV4nnBEVdVDBA5vJGoTwjTQWCM81UmZBJYr6QtwEmXUr+CbLEZis1hRihcscj/XtR5A/AxTJVhEEKqZMKYqYpsO1WvlHs9OHCFg4ktxNPB3mvZxu1AUEUhpkePFSwWbLJwoBr9sJBl2orLOHb3KeZXIc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263756681407.0418041556777; Sat, 17 Oct 2026 12:02:36 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9dz-0005yT-6e; Sat, 17 Oct 2026 15:00:37 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9d1-0005Jg-4a; Sat, 17 Oct 2026 14:59:38 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9cx-0003z1-7K; Sat, 17 Oct 2026 14:59:34 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 0811A1DE6CB; Sat, 17 Oct 2026 21:56:49 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 3FEA8443394; Sat, 17 Oct 2026 21:56:48 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263409; bh=YlO931WFFyyG0i+43j3kHDkut8TQMRFC+XiQ8wIamE0=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=hYi61qTFa1BLHGt+SWVSUkbfm5ARLt1WSKJEWCmeoUakbPiqpqIFjfU8B4zI5IXnd 2rpAWVZPorQwWzRcbJVLJvLhU8Gm+IlvF16LNyIWnwisXc5nppeAbabb18HxQqy6tN Lj4ukFvMNI0NvaQ0VpJCpTp3NpfbTgyxOkqqo17MeIMR9PMZgkt2QYfW/t5js5rICO cVR6/gDhEU/sNpkylVzRuHn7qNisoxv3zuAJ5UX6gCPN0uG4PzB5ot+pTWtVwgrlao xYfBWqhJ9tvg5CDXNePm0S5g56VdCAEv0XIGbW2IwTEZpbtJ2hUKI6m7A8Lkn1eiVX 3IHrPhCxPjzJQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Kevin Wolf , Michael Tokarev Subject: [Stable-10.0.15 41/63] block: Fix corruption from broken RMW atomicity Date: Sat, 17 Oct 2026 21:54:57 +0300 Message-ID: <20261017185528.722197-41-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263757776158500 Content-Type: text/plain; charset="utf-8" From: Kevin Wolf When emulating 512 byte sector devices on top of 4k native host storage, QEMU performs a read-modify-write cycle for misaligned write requests. These requests are marked as serialising so that any other writes to the same 4k block will have to wait and can't overwrite the block in the middle, which would make the RMW write back stale data. In principle, this mechanism works fine, but there is a race condition in the implementation: bdrv_find_conflicting_request() assumes that req->waiting_for =3D=3D NULL means that the request is the active owner of the data blocks it touches and everyone else has to wait for this request. However, there is a window between tracked_request_begin() and bdrv_wait_serialising_requests_locked() where any new request has req->waiting_for =3D=3D NULL even if it conflicts with an already running serialising request. So at this point, we have seemingly two active owners at the same time until the new request checks for conflicts. For a third request coming in, this isn't a problem, it just might wait for a little longer than necessary. However, if the original RMW request calls bdrv_wait_serialising_requests_locked() again (which it does in bdrv_aligned_pwritev() -> bdrv_co_write_req_prepare() before writing back the RMW buffer), it will now wait on the other request that snuck in, which is fatal and makes the RMW buffer stale. This scenario causes data corruption. Fix this by checking for conflicts already in tracked_request_begin() while holding the bs->reqs_lock mutex, so that the race window is closed and req->waiting_for =3D=3D NULL really has the intended meaning. For good measure, add an active_owner boolean that is set when a request is marked serialising and has completed waiting for other requests, and assert that it is not set when waiting for another request, so that in the case of another bug, we'd crash instead of causing data corruption. Cc: qemu-stable@nongnu.org Buglink: https://redhat.atlassian.net/browse/RHEL-272836 Signed-off-by: Kevin Wolf Message-ID: <20261002132135.93345-2-kwolf@redhat.com> Signed-off-by: Kevin Wolf (cherry picked from commit 0bd5a1b3d60cca595e19bb73eec83307259be671) Signed-off-by: Michael Tokarev diff --git a/block/io.c b/block/io.c index 1e7c8658da..ae28a0ada1 100644 --- a/block/io.c +++ b/block/io.c @@ -48,6 +48,9 @@ bdrv_parent_cb_resize(BlockDriverState *bs); static int coroutine_fn bdrv_co_do_pwrite_zeroes(BlockDriverState *bs, int64_t offset, int64_t bytes, BdrvRequestFlags flags); =20 +static void coroutine_fn +bdrv_wait_serialising_requests_locked(BdrvTrackedRequest *self); + static void GRAPH_RDLOCK bdrv_parent_drained_begin(BlockDriverState *bs, BdrvChild *ignore) { @@ -618,6 +621,7 @@ static void coroutine_fn tracked_request_begin(BdrvTrac= kedRequest *req, .type =3D type, .co =3D qemu_coroutine_self(), .serialising =3D false, + .active_owner =3D false, .overlap_offset =3D offset, .overlap_bytes =3D bytes, }; @@ -626,6 +630,15 @@ static void coroutine_fn tracked_request_begin(BdrvTra= ckedRequest *req, =20 qemu_mutex_lock(&bs->reqs_lock); QLIST_INSERT_HEAD(&bs->tracked_requests, req, list); + + /* + * Set .waiting_for while we're holding the lock, otherwise we'd open = a race + * window where another request in the middle of its RMW cycle starts + * waiting for us, leading to potential data corruption if this request + * overwrites a block the RMW request has already read. + */ + bdrv_wait_serialising_requests_locked(req); + qemu_mutex_unlock(&bs->reqs_lock); } =20 @@ -686,6 +699,15 @@ bdrv_wait_serialising_requests_locked(BdrvTrackedReque= st *self) BdrvTrackedRequest *req; =20 while ((req =3D bdrv_find_conflicting_request(self))) { + /* + * If this request is the active owner of the data blocks it acces= ses, + * no other conflicting request may exist; other requests have to = wait + * for this one, not the other way around. If this condition is + * violated, RMW operations may be interrupted in the middle, oper= ate on + * stale data and introduce data corruption. + */ + assert(!self->active_owner); + self->waiting_for =3D req; qemu_co_queue_wait(&req->wait_queue, &self->bs->reqs_lock); self->waiting_for =3D NULL; @@ -807,6 +829,7 @@ void coroutine_fn bdrv_make_request_serialising(BdrvTra= ckedRequest *req, =20 tracked_request_set_serialising(req, align); bdrv_wait_serialising_requests_locked(req); + req->active_owner =3D true; =20 qemu_mutex_unlock(&req->bs->reqs_lock); } diff --git a/include/block/block_int-common.h b/include/block/block_int-com= mon.h index ebb4e56a50..7fb2d228c6 100644 --- a/include/block/block_int-common.h +++ b/include/block/block_int-common.h @@ -80,6 +80,7 @@ typedef struct BdrvTrackedRequest { enum BdrvTrackedRequestType type; =20 bool serialising; + bool active_owner; int64_t overlap_offset; int64_t overlap_bytes; =20 --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263897; cv=none; d=zohomail.com; s=zohoarc; b=au7SnvUHZQTlCc+AYeuR1Oz1p/wUzNh7e9EVTdEy8mypK/EjLb/q9LCKnzkRTtrQ0u77uLrF05cpT+VNLgQk8gdzjbYCrYPicwDObJAi6/R8Xk9gKr2ZRrcTvQ4Jhz5XSjSiiZ+cRcCNFtqDvBt63Rktsi0CGOfQU5W2j33JdBU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263897; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=Au9lkNHG4SyepGOIRYbk4kwbs5HMfvmO0SPa9YESoQI=; b=C6XeZ5lHA8n0zIhkAnsbfUfVkHt/p/dO0FBdKw7qysZEKS0cwPLk8nc4ldWWHu2763ubnf/Iy1g8l3o2UYv9tg3E55I9hHjImeQQsFt7Sp0XeDhOrYc9nB5+FxsJZjTaZI9DWDFIBZVnYpC07IEL3+xxCxNGkOUn7bt3MR5UyZQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263897874796.1670215511086; Sat, 17 Oct 2026 12:04:57 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9eQ-0006fq-Ma; Sat, 17 Oct 2026 15:01:02 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9d2-0005Jn-9T; Sat, 17 Oct 2026 14:59:38 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9d0-0003zS-D5; Sat, 17 Oct 2026 14:59:36 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 55C271DE6CC; Sat, 17 Oct 2026 21:56:50 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 3CBFB443395; Sat, 17 Oct 2026 21:56:49 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263410; bh=Dg8HAUdamYBN061rFx5Tmq0LNxTmZA2/5JFRg3UBEok=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=CfB8BImLU524ZNZNjjAYwSLlqBPLMIEhtHwoZHHvt9Me9PYvHj4fyrDEWvhKhs5/6 pFf21yWz2DgQm+e0Y+VCLERankAtUG6dFfgAKSz24nCH3wVV7iv12Ox+8S46Ih1ygx znEy+ZaTdKKuViZ/CRt1r3jFS6rW2t3NPqYimSutHrrrpjifX+vUJDKhxmJre+1BRI qGPlU4FZvq48pi9WvttYkAKv6VMRr2kWmLcZsOadvy/O8sU8EclILbT6u7NOHA9LFs ur0VJAWcPtdOSzWLRbuFd/SPobeURgrDO1uqV5N4tW87W5IQiENgdEM/ZThc4/sz9y MFogFKzq2rVhA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Kevin Wolf , Michael Tokarev Subject: [Stable-10.0.15 42/63] block: Remove now redundant bdrv_wait_serialising_requests() calls Date: Sat, 17 Oct 2026 21:54:58 +0300 Message-ID: <20261017185528.722197-42-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263898578158500 Content-Type: text/plain; charset="utf-8" From: Kevin Wolf All callers of bdrv_wait_serialising_requests() (as opposed to bdrv_wait_serialising_requests_locked()) are just duplicating the check that tracked_request_begin() already performs now. After removing them, bdrv_wait_serialising_requests() has no callers left and can go as well. Signed-off-by: Kevin Wolf Message-ID: <20261002132135.93345-3-kwolf@redhat.com> Signed-off-by: Kevin Wolf (cherry picked from commit cf4f672c11d663f87462cfd99a92124b30804e99) Signed-off-by: Michael Tokarev diff --git a/block/io.c b/block/io.c index ae28a0ada1..6ffbe26d4c 100644 --- a/block/io.c +++ b/block/io.c @@ -806,20 +806,6 @@ void bdrv_dec_in_flight(BlockDriverState *bs) bdrv_wakeup(bs); } =20 -static void coroutine_fn -bdrv_wait_serialising_requests(BdrvTrackedRequest *self) -{ - BlockDriverState *bs =3D self->bs; - - if (!qatomic_read(&bs->serialising_in_flight)) { - return; - } - - qemu_mutex_lock(&bs->reqs_lock); - bdrv_wait_serialising_requests_locked(self); - qemu_mutex_unlock(&bs->reqs_lock); -} - void coroutine_fn bdrv_make_request_serialising(BdrvTrackedRequest *req, uint64_t align) { @@ -1387,8 +1373,6 @@ bdrv_aligned_preadv(BdrvChild *child, BdrvTrackedRequ= est *req, * it ensures that the CoR read and write operations are atomic and * guest writes cannot interleave between them. */ bdrv_make_request_serialising(req, bdrv_get_cluster_size(bs)); - } else { - bdrv_wait_serialising_requests(req); } =20 if (flags & BDRV_REQ_COPY_ON_READ) { @@ -2025,8 +2009,6 @@ bdrv_co_write_req_prepare(BdrvChild *child, int64_t o= ffset, int64_t bytes, } =20 bdrv_wait_serialising_requests_locked(req); - } else { - bdrv_wait_serialising_requests(req); } =20 assert(req->overlap_offset <=3D offset); @@ -3476,7 +3458,6 @@ static int coroutine_fn GRAPH_RDLOCK bdrv_co_copy_ran= ge_internal( =20 /* BDRV_REQ_SERIALISING is only for write operation */ assert(!(read_flags & BDRV_REQ_SERIALISING)); - bdrv_wait_serialising_requests(&req); =20 ret =3D src->bs->drv->bdrv_co_copy_range_from(src->bs, src, src_offset, --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263929; cv=none; d=zohomail.com; s=zohoarc; b=lujsGGyXuJdz90iWdNqwuo3wwmILQ60nD/XjxM56+Xyc4UsEgk9It2LHhL4myPwXwOGQtXutZL2hGVnMf7K7XGts4YhciQyIPRwT/OoRDpyzbWGQzRJQnJ0VjjwoKlw/pVmRne1C5raG42PIkixibJt5A17bhAYBwl4AJkQfdao= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263929; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=oqx7OXkj8QuFRl5nur7L5CPZJhf3i8Eefs/wdGbx9Wc=; b=UTyyNoqRP84yMvGVHN734cyFsk5OiIoIM30g0xt/PXczgfML46tI7MZoQiN7xnoNL1e1dHIUg6RWXe/jY1Vg1Oj9kgv30Lwz9sxgZ2r7NmYhiJZz548XLIw3Hzp1bg3Dwe5EqYbSU8kLsg0SBsMLFKPHUhX0pkt4V1ZwwlNu70g= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263929473806.1509933240557; Sat, 17 Oct 2026 12:05:29 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9e1-00060u-MR; Sat, 17 Oct 2026 15:00:39 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9d4-0005LB-8L; Sat, 17 Oct 2026 14:59:40 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9d2-0003zr-Ia; Sat, 17 Oct 2026 14:59:37 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 6CEA61DE6CE; Sat, 17 Oct 2026 21:56:51 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 89FF0443396; Sat, 17 Oct 2026 21:56:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263411; bh=i/cnUT9s/y34O8nVZIBrK2DSVdUZg+RaPsRGjem2qgs=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=m/EJwWvIsCqLCnrCEmXZz8Sv7XpkQnRdDGkZdZZWQFlvHD8rK1hkf/gpXzMHPdsUa bX3WUoZyX9h4LaAtrBigveRJCuPm36fBQ2dOLRyWBN3FXi1cdT6RSEx36Gsf2zvqNW qH5f6x5CpFKXS3Kvbx3Jknf2WkxsPmhtTsL0wDH41DeWFsyRsjA0sFaMsfAMql0/fA 3WSlHq3pReBCuZF96BZgivAeP6t3HnsysaS8SjLn09h6/eiZm+62EMFi9bapLF1xA0 PzVXLBjwRslFQggDdYbn0gKkUc2xlheeey2cKWzhZTlwtuktvRLRNatDeAZslybzmT TWilLnqH90CkQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Manos Pitsidianakis , Richard Henderson , Michael Tokarev Subject: [Stable-10.0.15 43/63] accel/kvm: Replace legacy cpu_physical_memory_write() call Date: Sat, 17 Oct 2026 21:54:59 +0300 Message-ID: <20261017185528.722197-43-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263931155158500 From: Philippe Mathieu-Daud=C3=A9 cpu_physical_memory_write() is legacy (see commit b7ecba0f6f6), replace it by address_space_write(). Both if() ladders only differ in the address space argument: rework to have a single address_space_write() call. No logical change intended. Signed-off-by: Philippe Mathieu-Daud=C3=A9 Reviewed-by: Manos Pitsidianakis Reviewed-by: Richard Henderson Message-Id: <20260616020839.19104-3-philmd@oss.qualcomm.com> (cherry picked from commit c08b84cd6e55b7dde247a396450d49a069775235) (Mjt: pick this one up so the next commit, which modifies this place again, applies cleanly) (Mjt: drop `const' from `const AddressSpace *as' across v11.0.0-2179-g77293= ecc95db "system/memory: Constify various MemoryRegionCache arguments") Signed-off-by: Michael Tokarev diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c index 66783fcf11..13d44abb31 100644 --- a/accel/kvm/kvm-all.c +++ b/accel/kvm/kvm-all.c @@ -2851,16 +2851,12 @@ void kvm_flush_coalesced_mmio_buffer(void) struct kvm_coalesced_mmio_ring *ring =3D s->coalesced_mmio_ring; while (ring->first !=3D ring->last) { struct kvm_coalesced_mmio *ent; + AddressSpace *as; =20 ent =3D &ring->coalesced_mmio[ring->first]; - - if (ent->pio =3D=3D 1) { - address_space_write(&address_space_io, ent->phys_addr, - MEMTXATTRS_UNSPECIFIED, ent->data, - ent->len); - } else { - cpu_physical_memory_write(ent->phys_addr, ent->data, ent->= len); - } + as =3D ent->pio =3D=3D 1 ? &address_space_io : &address_space_= memory; + address_space_write(as, ent->phys_addr, MEMTXATTRS_UNSPECIFIED, + ent->data, ent->len); smp_wmb(); ring->first =3D (ring->first + 1) % KVM_COALESCED_MMIO_MAX; } --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263891; cv=none; d=zohomail.com; s=zohoarc; b=PkrqNPC163QtEMUxDi+P0AXAF71V8m+LekoD1xSzONBSVCgvSJe+HjH6+VD3AhiQjLY8qItUMNHKEZWvkTTyR48xvfHZ1ggGm82skDCPxK23B0/Woj6uA5Vl+10SCyOAQNQSIj5weDBm+JB3XRmASUpLuKNtjKSIE4n8hI19VmQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263891; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=VSOSSryKuKQ3SIJW130xyo0MdIe5jx2/yVfsXmkMK7Q=; b=M6AqKHF+e1YxlLlXzObcluNGQxOnTGmGbgtToWw/GABgkhPURAEv1dARHTG9jNIpf2j/pC10E2/BHN00NA8impK6zRdbWUlRxnBj2gqLw/a1dLZEn7ZSPq58+ytN0DUa2NduBoH8VjfISzJypMC4ylpE//x7pl41n2pxPLSAE/w= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263891502393.5482421586835; Sat, 17 Oct 2026 12:04:51 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9eX-0007RP-Ap; Sat, 17 Oct 2026 15:01:09 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9dR-0005Yu-8E; Sat, 17 Oct 2026 15:00:04 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9dN-000403-R8; Sat, 17 Oct 2026 15:00:00 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 7BA4E1DE6CF; Sat, 17 Oct 2026 21:56:52 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id A38B9443397; Sat, 17 Oct 2026 21:56:51 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263412; bh=89Xk3cst3xlBoAObjfSiAUTAt07Ma4hw6vkcXvBpLfQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=j5p4OGdf1lMIvU2IA+tXyEOV0poQ7GPTxxPqK+2qKo2fIRR208KDCQnh8i2q2S/U0 ZnxuYqO7EyS+Z7kT/zwR6z5Iyf0yTscbrwMmDY1zKOUkesHb+O1jlxywaFFcnY5ZfU WtUxZUrVxyOtrFJQT+kIWzlCzokqbc4mEzLkBLz47P+Z/NZSqZVa3r4h9mhiXfNoy0 TRtL7eqVBE1/CniVC9F9YCR4arl/LXD74TQJpBC3OsC3lTmYsRxbWIu52Jk2e45Tgw jfytshvGsGNPuGej3MxhbGX89PpQzfgoGvGCadFlfJ8ryUaHlYqzzNpe+U+oP/MKxU WLLcK4aHST7Ww== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Maxim Levitsky , Paolo Bonzini , Michael Tokarev Subject: [Stable-10.0.15 44/63] accel/kvm: coalesced mmio: check lenght of the MMIO write entry Date: Sat, 17 Oct 2026 21:55:00 +0300 Message-ID: <20261017185528.722197-44-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263892438158500 Content-Type: text/plain; charset="utf-8" From: Maxim Levitsky KVM's coalesced mmio ring buffer has entries that contain deffered MMIO writes. Each such entry contains the length, an 8 byte value and a guest address. While the length value comes from the kernel, it is still possible for an attacker to corrupt the length field using another exploit. The attacker can then invoke kvm_flush_coalesced_mmio_buffer, which blindly trusts the length and can be used to inflict further damage. Add a sanity check on the length field to prevent this. This patch was only compile tested. Reported by: "Labs, STAR" Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3863 Signed-off-by: Maxim Levitsky Link: https://lore.kernel.org/r/20260923004631.100997-1-mlevitsk@redhat.com Signed-off-by: Paolo Bonzini (cherry picked from commit 12916d64b78ec5dd0171e607ad2ffcc34537f3cf) Signed-off-by: Michael Tokarev diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c index 13d44abb31..9edd64fac7 100644 --- a/accel/kvm/kvm-all.c +++ b/accel/kvm/kvm-all.c @@ -2854,9 +2854,15 @@ void kvm_flush_coalesced_mmio_buffer(void) AddressSpace *as; =20 ent =3D &ring->coalesced_mmio[ring->first]; - as =3D ent->pio =3D=3D 1 ? &address_space_io : &address_space_= memory; - address_space_write(as, ent->phys_addr, MEMTXATTRS_UNSPECIFIED, - ent->data, ent->len); + if (ent->len > sizeof(ent->data)) { + warn_report("coalesced MMIO entry has invalid len %u", + ent->len); + } else { + as =3D ent->pio =3D=3D 1 ? &address_space_io : &address_sp= ace_memory; + address_space_write(as, ent->phys_addr, MEMTXATTRS_UNSPECI= FIED, + ent->data, ent->len); + } + smp_wmb(); ring->first =3D (ring->first + 1) % KVM_COALESCED_MMIO_MAX; } --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263924; cv=none; d=zohomail.com; s=zohoarc; b=Fscy585IRvKboO8iGym8yx2SOsH5TfO5aTCfb636ixD6/osSZ0Cglucf1otsLkvCnygZlY/SLakTYKKeQI/55wikDSD81mknN5S/61UfnevwGBnp0oJaJ05RvaxXC69yjcbnW5zCS298ynK5AsflysQuu8/rQDX1iUiWyouZbEY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263924; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=VwADHzBOR4NqDoIIwT9KW6tNM79Z5wjM1wbaUrVIbCc=; b=GJXwXdtxyqnbxkaK66rkijKr5XeFKJiWYbF3WU4zyAL9CMEpwbrt9mffRBnQkuXpJrxd+TegjYz7MmEqql35wAP16FFNwqLcfI+JmwatQffdWfbmkcVbZQDGdp1F7zzKa28+ZE34Vx+Lv47Bu7bH7M9B/7GiVFcEloUVT8MPN1Q= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263924538923.4060138417542; Sat, 17 Oct 2026 12:05:24 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9ec-0007zO-Po; Sat, 17 Oct 2026 15:01:15 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9dR-0005Yv-Qo; Sat, 17 Oct 2026 15:00:04 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9dP-00040H-Oz; Sat, 17 Oct 2026 15:00:01 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 26AA41DE6D0; Sat, 17 Oct 2026 21:56:54 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id DE937443398; Sat, 17 Oct 2026 21:56:52 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263414; bh=KIe7/Zr2q8cJ8X1SQu3MBDVC6x/u9G9DW/ciEHoz4Ps=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=yKc5o1tpkqBlrssMXPSBmxI5Md+Z95wN6ITmlXUYiKLGfb0+vhjTgeQ2me4obXsSF m5pECK1IjWDIno7VmYvuZ6kEan8UmkwwdELSVe7zws2QZFXdRqzUSioPVl7TmsSUUH Iphgym7MThViS6GHbL+0vot9HJmio6n6Z/ttv/RsKjMI2F8cP4BfKjiNkRclHo9Vdq k3x8ggvmXVkIO49uNd/OqWGydS0C9NXIUEkAxOvhhmPS768c+j7t+f3s86o3z7c5JC 3ujBbHldsNDX2Z5VHCAF56MaczqVrIXu4/uU4Ourm3oaaMQJsvERC6l93LywSUA422 /7mHueRD2bIRg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , Peter Xu , Juraj Marcin , Michael Tokarev Subject: [Stable-10.0.15 45/63] io: cork TLS writes to avoid small TLS records Date: Sat, 17 Oct 2026 21:55:01 +0300 Message-ID: <20261017185528.722197-45-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263925199158500 From: Daniel P. Berrang=C3=A9 The migration code caches vmstate/ram writes into an iovec and flushes this periodically. The total amount of data to sent may be 100's of KB, but split across many iovec, each of which is potentially quite small. The QIOChannelTLS receives the iovec, but since GNUTLS cannot accept iovec data, it iterates calling send for each element. As a result of the migration data pattern, this results in GNUTLS putting lots of small TLS records on the wire. This has shown writes alternate between about 4k and 30 bytes in some tests. This is triggering the nagle algorithm on migration-test for many of the TLS test cases, resulting in a "go slow" for I/O that eventually hits the migration timeout configured by the test. Not every contributor reports seeing the "go slow" but for those who do see it, it hits >=3D 95% of the time for at least one of the migration TLS test cases run by 'make check'. While we could disable the nagle algorithm (and multifd channels already do this), that would stil result in lots of small TLS records hitting the wire which is not good for throughput. The migration code flushes in batches because it wants large writes for high throughput. To achieve this we must tell GNUTLS to encrypt data but not immediately sent TLS records by "corking" its output. Once the complete iovec has been written to GNUTLS, it can be uncorked allowing it to hit the wire. There is added complexity with uncorking on non-blocking channels as not all encrypted data can be sent at once. qio_channel_write() will return what was sent, but some data might remain pending inside GNUTLS buffers. A later call to qio_channel_write() will provide the same plain text data buffers that have already been cached. Thus the code must attempt to uncork GNUTLS again to clear pending data and then deduct the equivalent amount of plain text. Overall this corking action fixes the test suite timeouts, but more importantly, it also improves the performance of TLS protection migrations in the real world. Tests with one workload show at 36% increase in throughput. Reviewed-by: Peter Xu Tested-by: Juraj Marcin Signed-off-by: Daniel P. Berrang=C3=A9 (cherry picked from commit 99a8b5a0dda91e3cdabbf3fec47a504197af63c7) Signed-off-by: Michael Tokarev diff --git a/crypto/tlssession.c b/crypto/tlssession.c index 6d8f8df623..a1bfdc7902 100644 --- a/crypto/tlssession.c +++ b/crypto/tlssession.c @@ -534,6 +534,39 @@ qcrypto_tls_session_read(QCryptoTLSSession *session, } =20 =20 +void qcrypto_tls_session_write_cork(QCryptoTLSSession *sess) +{ + gnutls_record_cork(sess->handle); +} + + +ssize_t qcrypto_tls_session_write_uncork(QCryptoTLSSession *sess, + Error **errp) +{ + int ret; + ret =3D gnutls_record_uncork(sess->handle, 0); + if (ret =3D=3D GNUTLS_E_AGAIN || + ret =3D=3D GNUTLS_E_INTERRUPTED) { + ret =3D gnutls_record_check_corked(sess->handle); + if (ret < 0) { + error_setg(errp, + "Cannot query pending TLS output: %s", + gnutls_strerror(ret)); + return -1; + } + + return ret; + } else if (ret < 0) { + error_setg(errp, + "Cannot uncork TLS output: %s", + gnutls_strerror(ret)); + return -1; + } + + return 0; +} + + size_t qcrypto_tls_session_check_pending(QCryptoTLSSession *session) { @@ -738,4 +771,16 @@ qcrypto_tls_session_get_peer_name(QCryptoTLSSession *s= ess) return NULL; } =20 +void qcrypto_tls_session_write_cork(QCryptoTLSSession *sess) +{ +} + + +ssize_t qcrypto_tls_session_write_uncork(QCryptoTLSSession *sess, + Error **errp) +{ + error_setg(errp, "TLS requires GNUTLS support"); + return -1; +} + #endif diff --git a/include/crypto/tlssession.h b/include/crypto/tlssession.h index d77ae0d423..0e85982389 100644 --- a/include/crypto/tlssession.h +++ b/include/crypto/tlssession.h @@ -193,6 +193,31 @@ typedef ssize_t (*QCryptoTLSSessionReadFunc)(char *buf, void *opaque, Error **errp); =20 +/** + * qcrypto_tls_session_write_cork: + * @sess: the TLS session object + * + * Causes future qcrypto_tls_session_write() calls to encrypt + * and queue data, without sending on the wire. + */ +void qcrypto_tls_session_write_cork(QCryptoTLSSession *sess); + +/** + * qcrypto_tls_session_write_uncork: + * @sess: the TLS session object + * @errp: pointer to a NULL-initialized error object + * + * Attempt to send previously queued data. If the underlying + * stream is non-blocking, then only a subset of data (if any) + * may be written. To process outstanding data, this method + * must be called again until it returns 0. + * + * Returns: the number of bytes remaining to be sent, + * or -1 on error. + */ +ssize_t qcrypto_tls_session_write_uncork(QCryptoTLSSession *sess, + Error **errp); + /** * qcrypto_tls_session_set_callbacks: * @sess: the TLS session object diff --git a/include/io/channel-tls.h b/include/io/channel-tls.h index 7e9023570d..9e9b00c034 100644 --- a/include/io/channel-tls.h +++ b/include/io/channel-tls.h @@ -50,6 +50,7 @@ struct QIOChannelTLS { QIOChannelShutdown shutdown; guint hs_ioc_tag; guint bye_ioc_tag; + size_t corked; }; =20 /** diff --git a/io/channel-tls.c b/io/channel-tls.c index d25a55c107..ff0dda3eaa 100644 --- a/io/channel-tls.c +++ b/io/channel-tls.c @@ -21,6 +21,7 @@ #include "qemu/osdep.h" #include "qapi/error.h" #include "qemu/module.h" +#include "qemu/iov.h" #include "io/channel-tls.h" #include "trace.h" #include "qemu/atomic.h" @@ -425,12 +426,24 @@ static ssize_t qio_channel_tls_writev(QIOChannel *ioc, QIOChannelTLS *tioc =3D QIO_CHANNEL_TLS(ioc); size_t i; ssize_t done =3D 0; + ssize_t remain; + g_autofree struct iovec *tmpiov =3D NULL; + size_t ntmpiov =3D 0; =20 - for (i =3D 0 ; i < niov ; i++) { - ssize_t ret =3D qcrypto_tls_session_write(tioc->session, - iov[i].iov_base, - iov[i].iov_len, - errp); + /* + * The previous write encrypted all the data, but some + * was not able to be sent on the wire when uncorked, + * so we returned a short write. The encrypted data + * will still be cached by GNUTLS and the session will + * be in a corked state. + * + * This write call will be trying to write the remaining + * plain text data again, but we must avoid sending that + * into GNUTLS. Instead flush the previously encrypted + * pending data. + */ + while (tioc->corked) { + ssize_t ret =3D qcrypto_tls_session_write_uncork(tioc->session, er= rp); if (ret =3D=3D QCRYPTO_TLS_SESSION_ERR_BLOCK) { if (done) { return done; @@ -440,12 +453,74 @@ static ssize_t qio_channel_tls_writev(QIOChannel *ioc, } else if (ret < 0) { return -1; } + done +=3D (tioc->corked - ret); + tioc->corked =3D ret; + } + + /* + * If we flushed pending data, we must discard an + * equivalent amount of plain text data from this + * write call, and then process what's left over, + * if any. + */ + if (done) { + ssize_t total =3D iov_size(iov, niov); + if (done =3D=3D total) { + return done; + } + + tmpiov =3D g_new0(struct iovec, niov); + ntmpiov =3D iov_copy(tmpiov, niov, iov, niov, + done, total - done); + + iov =3D tmpiov; + niov =3D ntmpiov; + } + + /* + * At this point we should ony be processing "new" + * data, not seen by a previous write call so we + * send to GNUTLS as normal. + */ + qcrypto_tls_session_write_cork(tioc->session); + for (i =3D 0 ; i < niov ; i++) { + ssize_t ret =3D qcrypto_tls_session_write(tioc->session, + iov[i].iov_base, + iov[i].iov_len, + errp); + if (ret =3D=3D QCRYPTO_TLS_SESSION_ERR_BLOCK) { + error_setg(errp, "Unexpected TLS blocking I/O while corked"); + return -1; + } else if (ret < 0) { + return -1; + } done +=3D ret; if (ret < iov[i].iov_len) { break; } } - return done; + + /* + * On non-blocking sockets, uncorking may not succeed + * in sending all encrypted data, so we have to check + * what was actually sent to see if GNUTLS remains in + * the corked state with pending data. + */ + remain =3D qcrypto_tls_session_write_uncork(tioc->session, errp); + if (remain < 0) { + return -1; + } else if (remain) { + tioc->corked =3D remain; + } + /* + * done =3D=3D what we sent to GNUTLS for encryption & sending + * remain =3D=3D subset of 'done' that was encrypted but not sent + */ + if (done && (remain =3D=3D done)) { + return QIO_CHANNEL_ERR_BLOCK; + } else { + return done - remain; + } } =20 static int qio_channel_tls_set_blocking(QIOChannel *ioc, --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263875; cv=none; d=zohomail.com; s=zohoarc; b=IUSV67fdZGIIznfXhwl6JDR82cp2IfpXqz1a+bLg77Le3DHO10oxMe04/jkOlvFQsiQReUvVLVNmMJ4I9BSpsrmq5q5OcW5Jh9U0KsR2LFma9XoL/1bChoJb9jiREadrSxg58GeMWkgrcOdi7QniJ/4Qor+JufidKe3vPkMEhnU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263875; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=nszVTFdjX99C/dimVyjUS8TVDeYbQ86mw+MnLNKbNKE=; b=WwLBD+8LYf8ec+hsflT4o5GaRFiagBFgSNQv1KEzrmOVxQKYKcmDiZ55zAkuQWGrJnx6I4xzN72Q4WuyG1lxKsC+ynl1mDz5fMFdYtXh4WJqX8rWKStCU4JRVQhrnLj1Vi1opfE2Ah8Y7INjv3mJZpbUjkoICmkvPeRrC386cEk= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 179226387510418.48330616541091; Sat, 17 Oct 2026 12:04:35 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9eS-0006v0-Ue; Sat, 17 Oct 2026 15:01:05 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9dV-0005fz-0O; Sat, 17 Oct 2026 15:00:10 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9dS-00041f-Ul; Sat, 17 Oct 2026 15:00:04 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 275AF1DE6D1; Sat, 17 Oct 2026 21:56:55 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 58850443399; Sat, 17 Oct 2026 21:56:54 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263415; bh=dUujO7ZkXn6wFZ4Eq+BHDBZZLoaQWT8D2WtWl8q53Ow=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=RjCiw4ysMPxLcKMZWNamd5X3CPTjn1ONrx9L+Brz6gFlagGQRIsJNF90mhs5BDj5s e67TXRVKP+2er9eRNaLfWgHmiyQT+v5mJ5kZl9QC65rlhua1c2+T2+JEULMggDgN0h IcgdWRJmDlBm5oYhEbdvysNG6pwKaJuYuActmlIRyH6WAdXFp1deXbvVFL3JwGaplW pVrGrNgq81rpoeFQ8QjTw0IcEpcQqX5S2np+tvqX8Gk6kx1KMFoSu69XvgD98DHRcC oSmMLMdfwLnPMhGErlSSt84P4UjMQiQCnz+R7O4beSiK3jgEvLGdDeOiCg79QFAQeU 3a/CjVYO7uLrQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Stefan Berger , =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , Michael Tokarev Subject: [Stable-10.0.15 46/63] tpm_emulator: Reject sending commands smaller than the request header Date: Sat, 17 Oct 2026 21:55:02 +0300 Message-ID: <20261017185528.722197-46-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263876172158500 From: Stefan Berger Reject any TPM request from being sent to the TPM emulator that is shorter than the size of the request header. Fixes: f4ede81eed29 ("tpm: Added support for TPM emulator") Reviewed-by: Marc-Andr=C3=A9 Lureau Link: https://lore.kernel.org/qemu-devel/20261002142516.2063735-4-stefanb@l= inux.ibm.com Signed-off-by: Stefan Berger (cherry picked from commit 6728170d2d081d8aad46807bc5e64520650f2795) Signed-off-by: Michael Tokarev diff --git a/backends/tpm/tpm_emulator.c b/backends/tpm/tpm_emulator.c index 00fe015a94..1d9c6735e8 100644 --- a/backends/tpm/tpm_emulator.c +++ b/backends/tpm/tpm_emulator.c @@ -179,6 +179,11 @@ static int tpm_emulator_unix_tx_bufs(TPMEmulator *tpm_= emu, ssize_t ret; bool is_selftest =3D false; =20 + if (in_len < sizeof(struct tpm_req_hdr)) { + error_setg(errp, "tpm-emulator: invalid request size %u", in_len); + return -1; + } + if (selftest_done) { *selftest_done =3D false; is_selftest =3D tpm_util_is_selftest(in, in_len); --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263743; cv=none; d=zohomail.com; s=zohoarc; b=OLpmltzQeN2B/jJUcB2gk8f7AiTw4MYYeiEhuBn9vcVWIHk1ynOhgEywBx82TEQxokm7PpAiKu/AWpNSH018PP44hXeMchMbAh38cMahZNAWW6L/r8b3Jxgcl6OAOcymCR1sMWc1DbDHQrc4NyZv6s9tdapzQe9XDZolbxaLZt8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263743; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=j8LjP2R2f8rOg+DO/DnFOGj2HoxsF3nu2ZRNpBfiRro=; b=Rmmuiz9hR19QI2XquL1A1h+DPV1ZgQ3lGl+H0eEv+DIRwLEfmvwwL7DBIWsYx2pz9Fk7XfLo1uw9oPPgKIgWsDNBbe0GdMskYQnFEx+hFFGY607ilKa5ziuKhRqa/czgYJyw+3fj9B7M8BPDUH2uKO0IhyKqUEn2m16AntI8xWY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 179226374358753.2935207276098; Sat, 17 Oct 2026 12:02:23 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9eT-000715-P8; Sat, 17 Oct 2026 15:01:06 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9dW-0005g7-OL; Sat, 17 Oct 2026 15:00:10 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9dT-00041v-K9; Sat, 17 Oct 2026 15:00:06 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 309941DE6D2; Sat, 17 Oct 2026 21:56:56 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 5A64F44339A; Sat, 17 Oct 2026 21:56:55 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263416; bh=xUDaSs0dFvWdsRtn6qWHsTNkADKNx8vi3MO318Oj/x4=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=O/ySc/V5QftO2AMjNc38G2FQZhnINTtSJ3kRxMu6rV3dFjRK3XS/mIupd+UmTUogr 84ckjgk49iO8qYQjwBSw+qQRYDV3aB/pkVjCvFdRIIH1FjpPJtgzP/YLa7Rdkhp48e ju+JogoeVxhkSAjjCj2AK/g+MkWzRttGNT8sC80E8dE6Ggk3JynAfWf/SOZSbh+zJU q8RJJCdJJ6JseUvAYzar5EvmHIWEgCGhglgHmdDuJ4oCGjSwn5W9/4cjSxPo5NcdOF 7n4/JnXoJZ+S8tRf2BNQBVr8uhclUl2iMUgy0TePJhBczoVH0X82N6umbAZO/it0YG dXY3BmyU4sSqg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-10.0.15 47/63] hw/display/vga: fix OOB writes after external surface resize Date: Sat, 17 Oct 2026 21:55:03 +0300 Message-ID: <20261017185528.722197-47-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263745554158500 From: Marc-Andr=C3=A9 Lureau virtio-vga has two renderers (VGA core and virtio-gpu) sharing a single QemuConsole, with no invalidation protocol between them. When virtio-gpu replaces the surface (SET_SCANOUT) or destroys it (reset via qemu_console_set_surface(con, NULL)), the VGA renderer's cached geometry (last_scr_width, last_height, last_depth, etc.) is never cleared: vga_common_reset() does not run during a virtio-gpu reset. The text draw path was fixed by 418396be80 (CVE-2026-77913), but vga_draw_blank() and vga_draw_graphic() still trust stale cache against a foreign surface: vga_draw_blank() uses last_scr_width/height to memset the display surface. When the surface has been replaced by a smaller one (e.g. after a text-to-graphics mode switch, or a virtio-gpu reset installing a 16x16 placeholder), the memset writes past the surface buffer. Use the actual surface dimensions for the memset bounds instead of the cached last_scr values. vga_draw_graphic() decides whether to recreate the DisplaySurface based solely on VGA register state (line_offset, width, height, depth, byteswap, allocated). When virtio-gpu replaces the surface with a smaller one, the predicate sees no change and the drawing loop writes a full VGA-geometry frame into the undersized surface. Add surface dimension checks to the predicate so that a foreign surface whose size does not match the VGA geometry triggers a resize before drawing. Ideally the two renderers could coordinate through a console-level invalidation callback, but these defensive checks are needed regardless as a safety net against any path that replaces the surface. Fixes: CVE-2026-97889 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4579 Reported-by: david korczynski (@david1766) Reviewed-by: Philippe Mathieu-Daud=C3=A9 Signed-off-by: Marc-Andr=C3=A9 Lureau Message-ID: <20261001104112.2167807-2-marcandre.lureau@redhat.com> (cherry picked from commit 35164929cfa33b9f5001de72c0f3e37e9a4612c2) Signed-off-by: Michael Tokarev diff --git a/hw/display/vga.c b/hw/display/vga.c index 405ea89ed4..41ca1aa897 100644 --- a/hw/display/vga.c +++ b/hw/display/vga.c @@ -1623,7 +1623,9 @@ static void vga_draw_graphic(VGACommonState *s, int f= ull_update) height !=3D s->last_height || s->last_depth !=3D depth || s->last_byteswap !=3D byteswap || - allocate_surface !=3D surface_is_allocated(surface)) { + allocate_surface !=3D surface_is_allocated(surface) || + disp_width !=3D surface_width(surface) || + height !=3D surface_height(surface)) { /* display parameters changed -> need new display surface */ s->last_scr_width =3D disp_width; s->last_scr_height =3D height; @@ -1773,9 +1775,9 @@ static void vga_draw_blank(VGACommonState *s, int ful= l_update) dpy_gfx_replace_surface(s->con, surface); } =20 - w =3D s->last_scr_width * surface_bytes_per_pixel(surface); + w =3D surface_width(surface) * surface_bytes_per_pixel(surface); d =3D surface_data(surface); - for(i =3D 0; i < s->last_scr_height; i++) { + for (i =3D 0; i < surface_height(surface); i++) { memset(d, 0, w); d +=3D surface_stride(surface); } --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263752; cv=none; d=zohomail.com; s=zohoarc; b=MPnWhuoqQGVBpDP1CQQiJw7ozP1OuZ8G93NrwpHIKsrbo9KqjbzMrckfqyMFvIk0fhgOiAXUuSVG8AahsvniEYiKJJYT49laS0UpOuZYjSqVP5w5opCHgViKF6uR5etg2PVw4pqwh4V9caK0vw7NrHM5Rv6yWzpbdZxxiB10uNI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263752; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=WFBW4VJWKDF5RQw4THkMhIa/X0tqwCcOWuOwERNUogw=; b=eskrHZILoNSF7N5TWLy5MRXzNzK/YMBqhJDHnmGpZuUDCGD3gdyFctLFMTraEsWE8IDuPlNVQtxPGl/Rfow+K3lV1wIf19K1rT9i+n66JrPcisbE7SbwSngJ9Egp2hT4I0iG0SDhJeGuBmK4pDdJ25uV3s4nGBX/gT899s9kLWc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263752930599.8417178946254; Sat, 17 Oct 2026 12:02:32 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9ec-00082c-Uh; Sat, 17 Oct 2026 15:01:15 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9dY-0005gL-JJ; Sat, 17 Oct 2026 15:00:12 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9dW-00043J-GU; Sat, 17 Oct 2026 15:00:08 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id C9DBA1DE6D3; Sat, 17 Oct 2026 21:56:57 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 79BAB44339B; Sat, 17 Oct 2026 21:56:56 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263417; bh=L7lJBFASxJrLnWb8tTLuV3iuCk4R8ObHLAU5dp8ASMs=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=HOAIT0o3/fHFcsI4yHF73/A7IfvQLB8Q96D4Ar33XjgT70DaeVRNMuFIFfNWQQlxU fmZYS3Sbm6Hs83cS/CIiRMyqMNEeOTv9I6HibIg/mmwMsqYo2+PlEM5+YRm/oGRnEr r2cUTleZB+uxE1Y8hbSRuujHGsqDQURr9CXzptnri/e8jUKZucqY/JTXA3hqLveBN4 py7geV2pUwrcWI9EFw7y+NnU6yER8StHDsDITRv/MQXQYc7930QKXF7UXH1N+kJ01e aUNl1FaQ7lDStYEUXhlAH28WPG8Wx4uTB7Yd1Z6ZhOARajJ9zDawdu34LHaqQranCy XoLGa5WItmK2Q== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Dominic P , Richard Henderson , Michael Tokarev Subject: [Stable-10.0.15 48/63] tcg/optimize: Do not derive s_mask from rotated s_mask Date: Sat, 17 Oct 2026 21:55:04 +0300 Message-ID: <20261017185528.722197-48-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263753820158500 Content-Type: text/plain; charset="utf-8" From: Dominic P fold_shift computes s_mask for a rotate by a constant by rotating the input s_mask. The result is not a sign mask. For TCG_TYPE_I32, fold_masks_zosa_int then ORs in INT32_MIN, which can make it look like one: after sextract_i32 x,0,8 (s_mask ...ffffff80), rotr_i32 by 1 gives 0x7fffffc0, which becomes ...ffffffc0. A following sextract_i32 0,8 is then folded to a mov. rotl_i32 by 31 fails the same way. ARM, qemu-arm exits 255 instead of 7 (correct with -one-insn-per-tb): ldr r1, [r2] @ *r2 =3D=3D 3 sxtb r1, r1 ror r1, r1, #1 sxtb r1, r1 @ dropped cmp r1, #0 movle r0, #255 movgt r0, #7 i386, the same with rotl_i32: movsbl %al, %eax roll $31, %eax movsbl %al, %eax # dropped Handle rotates like the logical right shift and let fold_masks_zo recompute s_mask from z_mask and o_mask. Cc: qemu-stable@nongnu.org Fixes: 93a967fbb57 ("tcg/optimize: Propagate sign info for shifting") Signed-off-by: Dominic P Signed-off-by: Richard Henderson Message-ID: <20260930185124.3036980-2-gcc@gcc.dp11.uk> (cherry picked from commit d228536a5142cdd4b28e4feda74fa4859290787f) (Mjt: back-port to 10.0 across: v10.0.0-1791-g03329e3ce460 "tcg/optimize: Build and use o_bits in fold_shi= ft", v10.0.0-430-g005a87e148dc "tcg: Merge INDEX_op_rot{l,r}_{i32,i64}", v10.0.0-427-g3949f365eb6e "tcg: Merge INDEX_op_sar_{i32,i64}" v10.0.0-425-g74dbd36f1f87 "tcg: Merge INDEX_op_shr_{i32,i64}") Signed-off-by: Michael Tokarev diff --git a/tcg/optimize.c b/tcg/optimize.c index c7c16518f0..217c9187a6 100644 --- a/tcg/optimize.c +++ b/tcg/optimize.c @@ -2603,17 +2603,26 @@ static bool fold_shift(OptContext *ctx, TCGOp *op) =20 z_mask =3D do_constant_folding(op->opc, ctx->type, z_mask, sh); =20 - if (op->opc =3D=3D INDEX_op_shr_i32 || op->opc =3D=3D INDEX_op_shr= _i64) { + switch (op->opc) { + CASE_OP_32_64(shr): + CASE_OP_32_64(rotl): + CASE_OP_32_64(rotr): /* - * Logical right shift will force the sign bit zero. + * Logical right shift will force the sign bit zero, and + * a rotate may move bits unrelated to the sign into it. * Don't bother computing s_mask and let fold_masks * recompute from z_mask. */ return fold_masks_z(ctx, op, z_mask); - } =20 - s_mask =3D do_constant_folding(op->opc, ctx->type, s_mask, sh); - return fold_masks_zs(ctx, op, z_mask, s_mask); + CASE_OP_32_64(sar): + CASE_OP_32_64(shl): + s_mask =3D do_constant_folding(op->opc, ctx->type, s_mask, sh); + return fold_masks_zs(ctx, op, z_mask, s_mask); + + default: + g_assert_not_reached(); + } } =20 switch (op->opc) { --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263923; cv=none; d=zohomail.com; s=zohoarc; b=C9TZo+7KS5dC94TS3DHlNjTgA5X8DZslYACOcZVxYzEq+O+8+0HSi4t7YJcexPcNQM8JiwAR8z41q5uwJGBVqdu/gxby/OLb4lpMpyUq8Yhy8DlqaPiqbp0GeP1aUC/OyZKpyETXrR1/GKJ8Dk1VpbXTpqyiNqXT9YkyZAhVjeU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263923; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=Jop3Ejh/nqr9Pbq7oTzdnv6UkoejS2NMNYMDhrGiyTI=; b=DMB7AODRBMAquUmJrV6ofpszFS2yRoQonzuGYE0H9mZDtIEUhZ/FerOLPwfHmWqIAoxsRUSTwhldIZL+JjBdelA0ChqCwYdLr5VMGUU08BcMgMfANWCkNBM3pYN1V5iJcktmx9tsZD0lBaP8eVQWeFVdbVejt0TmMh+O8cgh5xs= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263923530593.3098537865671; Sat, 17 Oct 2026 12:05:23 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9eY-0007YY-Qc; Sat, 17 Oct 2026 15:01:11 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9du-000616-6m; Sat, 17 Oct 2026 15:00:30 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9ds-00043g-F2; Sat, 17 Oct 2026 15:00:29 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id C21501DE6D4; Sat, 17 Oct 2026 21:56:58 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 08EDC44339C; Sat, 17 Oct 2026 21:56:57 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263418; bh=WPmq/gXtDSPH2oUP+8Lx/W76wasYeiTwsmanO0qP4FY=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Kb4svJX0DQdUuZ30KzNf+eCR2hbDpBsMJaBbwsd4Ae2khUUx0mrMt0xSse5KiLjUH kDkwrcocxiOyl/ArPWls4o2iuyp990lPVhjEKcy4CABwMsHJGzHjgfST27Dbh0fYmR CU4KOqbVLJDLEWVFOCBjJLSwknnA4QiiHPGzL4ajC9H/ZnaUUMbTi1LXgziTJPOdDW YFcIjVwhK/wsR7iuy++sM79Vji2teP8+DG+AGi7n9e76gGPw0BZ2OUDhl3V80Wc74a 9UbCyTb1yq2iG23TnDkqInitdzvAXcA8fOCRDi8gm54mJPOXdEnMTyQcHobCTEipzo NaguKsJqPSOFw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Dominic P , Richard Henderson , Michael Tokarev Subject: [Stable-10.0.15 49/63] tests/tcg: Add tests for sign extension after rotate Date: Sat, 17 Oct 2026 21:55:05 +0300 Message-ID: <20261017185528.722197-49-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263925124158500 Content-Type: text/plain; charset="utf-8" From: Dominic P Cover the rotr_i32 (ARM ror) and rotl_i32 (i386 roll) forms fixed by the previous patch. Both tests fail without it. Signed-off-by: Dominic P Signed-off-by: Richard Henderson Message-ID: <20260930185124.3036980-3-gcc@gcc.dp11.uk> (cherry picked from commit f9ca6b19acb1b935e7abc920410c993b059a8b4d) (Mjt: back-port across Makefile=3D>meson conversion for tests) Signed-off-by: Michael Tokarev diff --git a/tests/tcg/arm/Makefile.target b/tests/tcg/arm/Makefile.target index 6189d7a0e2..da9fb7eca0 100644 --- a/tests/tcg/arm/Makefile.target +++ b/tests/tcg/arm/Makefile.target @@ -32,6 +32,9 @@ run-fcvt: fcvt ARM_TESTS +=3D pcalign-a32 pcalign-a32: CFLAGS+=3D-marm =20 +ARM_TESTS +=3D test-arm-opt-ror +test-arm-opt-ror: CFLAGS+=3D-marm + ifeq ($(CONFIG_ARM_COMPATIBLE_SEMIHOSTING),y) =20 # Semihosting smoke test for linux-user diff --git a/tests/tcg/arm/test-arm-opt-ror.c b/tests/tcg/arm/test-arm-opt-= ror.c new file mode 100644 index 0000000000..2579168a13 --- /dev/null +++ b/tests/tcg/arm/test-arm-opt-ror.c @@ -0,0 +1,21 @@ +/* SPDX-License-Identifier: GPL-2.0-or-later */ +/* Regression test for tcg optimize vs sign bit repetitions after rotate. = */ + +#include + +int main(void) +{ + /* Load from memory so that TCG does not see a constant. */ + volatile int v =3D 3; + int x =3D v, gt; + + asm("sxtb %1, %1\n\t" + "ror %1, %1, #1\n\t" + "sxtb %1, %1\n\t" + "cmp %1, #0\n\t" + "movle %0, #0\n\t" + "movgt %0, #1" + : "=3Dr"(gt), "+r"(x) : : "cc"); + assert(gt); + return 0; +} diff --git a/tests/tcg/i386/test-i386-opt-rol.c b/tests/tcg/i386/test-i386-= opt-rol.c new file mode 100644 index 0000000000..e0393147e1 --- /dev/null +++ b/tests/tcg/i386/test-i386-opt-rol.c @@ -0,0 +1,21 @@ +/* SPDX-License-Identifier: GPL-2.0-or-later */ +/* Regression test for tcg optimize vs sign bit repetitions after rotate. = */ + +#include + +int main(void) +{ + /* Load from memory so that TCG does not see a constant. */ + volatile int v =3D 3; + int x =3D v; + char test; + + asm("movsbl %b1, %1\n\t" + "roll $31, %1\n\t" + "movsbl %b1, %1\n\t" + "testl %1, %1\n\t" + "setg %0" + : "=3Dq"(test), "+q"(x)); + assert(test); + return 0; +} --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263957; cv=none; d=zohomail.com; s=zohoarc; b=Ek0FZNHZVgS41M6DDCVcwoffV+QTH/cGo2KYIHGjyi1DdeSpfAFH0S+Pd+pBHRx7Qb+8+uOx4Ob2J5+fibo2aWcoeMlj6mFKSune8ks3KL3/se3FojcF27LDKIk5uxC7w6ZfSkWC/u7wbTQ9vwtmdCrSDnsqrZk74ET/xqB8dyw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263957; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=U1YCrzrm5/6v3MdU26qjHZ21H6sWEJh8VzWSGDJWecQ=; b=aoXclQAkU4vIqZHyKo3B3cwjCUi1+Uj/+j1fvi5Rd2uvfz4/S0FTIR4qGwde0PChoqxeHyB00iPTMfQpM7ensTQSJr8d9heZtJN534JDiXP6d9ZhrkBd0VkbgEx9It2yLbR6urcWkjPMRoN0cyXFC6Dn5JCMbPIy2WSqhMOcaws= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263957040747.7357260177849; Sat, 17 Oct 2026 12:05:57 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9ej-0000Fq-Cs; Sat, 17 Oct 2026 15:01:22 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9dw-00065g-EI; Sat, 17 Oct 2026 15:00:37 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9du-0004Eu-IS; Sat, 17 Oct 2026 15:00:32 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id B8D641DE6D5; Sat, 17 Oct 2026 21:56:59 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 0139D44339D; Sat, 17 Oct 2026 21:56:58 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263419; bh=8Och7Zdq9MgqsBPXY3P4wtKteocByE7zzrGQebHds6c=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=xNC8Z9JrMc5MexUUVCbgrGjlxln05zWEZOvW6klr5JV11sjb+XpuW5tDMvws7QWef CSByVEr8sLWGQ8XYXXENXCkABnr/sFQiZcg796qG4pB+ksYpuDZzqwvdhgdOdH4upU wzvwFgQsIbynDq4UY4cvlrtNgjaww8hofqMzzWDCZBwcHS09Yd6cifFKBikP4zVgMI rsoBUnv5P1JyRtLZtQ8xrbwnQ2dReZKYXB20sBxvr+XjjyngethhL6vdLtnAo2XgJ5 weThYqOFU3TUl2gWiHCbH7VIxWWzZbdWilrZ88Z8x2I4GBfrBGXiWuy1uYarsmAJnN bYTz8DHDf2sbg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Artemii Mashanov , Paolo Bonzini , Michael Tokarev Subject: [Stable-10.0.15 50/63] target/i386/tcg: zero FXSAVE FOP and reserved slot bytes Date: Sat, 17 Oct 2026 21:55:06 +0300 Message-ID: <20261017185528.722197-50-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263957749158500 Content-Type: text/plain; charset="utf-8" From: Artemii Mashanov TCG's do_xsave_fpu() omitted writing the FOP field and the reserved bytes (10..15) of each x87 register slot. Those parts of the destination buffer retained their previous contents. The reserved bytes of all eight slots are zeroed. TCG does not yet track the actual FOP value, this patch stores a fixed zero instead. Add a regression test in tests/tcg/x86_64/fxsave.c. It fills the FXSAVE area with 0xcc, executes FNINIT and FXSAVE64, then verifies that FOP and all reserved slot bytes are zero. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3522 Signed-off-by: Artemii Mashanov Link: https://lore.kernel.org/r/20260826171655.117679-1-ralerrdirsardx@gmai= l.com Signed-off-by: Paolo Bonzini (cherry picked from commit 0dd9fb43ea221260969be449b596e7252abbca80) (Mjt: fixup for make=3D>meson test conversion) Signed-off-by: Michael Tokarev diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c index 02da4d0b26..7c95a2e9af 100644 --- a/target/i386/tcg/fpu_helper.c +++ b/target/i386/tcg/fpu_helper.c @@ -2616,6 +2616,7 @@ static void do_xsave_fpu(X86Access *ac, target_ulong = ptr) access_stw(ac, ptr + XO(legacy.fcw), env->fpuc); access_stw(ac, ptr + XO(legacy.fsw), fpus); access_stw(ac, ptr + XO(legacy.ftw), fptag ^ 0xff); + access_stw(ac, ptr + XO(legacy.fpop), 0); =20 /* In 32-bit mode this is eip, sel, dp, sel. In 64-bit mode this is rip, rdp. @@ -2628,6 +2629,8 @@ static void do_xsave_fpu(X86Access *ac, target_ulong = ptr) for (i =3D 0; i < 8; i++) { floatx80 tmp =3D ST(i); do_fstt(ac, addr, tmp); + access_stw(ac, addr + 10, 0); + access_stl(ac, addr + 12, 0); addr +=3D 16; } } diff --git a/tests/tcg/x86_64/Makefile.target b/tests/tcg/x86_64/Makefile.t= arget index c48767fef8..0f8f48b1a5 100644 --- a/tests/tcg/x86_64/Makefile.target +++ b/tests/tcg/x86_64/Makefile.target @@ -20,6 +20,7 @@ X86_64_TESTS +=3D test-1648 X86_64_TESTS +=3D test-2175 X86_64_TESTS +=3D cross-modifying-code X86_64_TESTS +=3D fma +X86_64_TESTS +=3D fxsave TESTS=3D$(MULTIARCH_TESTS) $(X86_64_TESTS) test-x86_64 else TESTS=3D$(MULTIARCH_TESTS) diff --git a/tests/tcg/x86_64/fxsave.c b/tests/tcg/x86_64/fxsave.c new file mode 100644 index 0000000000..d08a4e8a0e --- /dev/null +++ b/tests/tcg/x86_64/fxsave.c @@ -0,0 +1,66 @@ +/* + * SPDX-License-Identifier: GPL-2.0-or-later + * See https://gitlab.com/qemu-project/qemu/-/issues/3522 + */ + +#include +#include +#include + +#define FXSAVE_FOP_OFFSET 6 +#define FXSAVE_X87_OFFSET 32 +#define FXSAVE_SLOT_SIZE 16 +#define FXSAVE_RESERVED_START 10 +#define FXSAVE_NUM_SLOTS 8 + +struct fxsave_area { + uint8_t raw[512]; +} __attribute__((aligned(16))); + +_Static_assert(sizeof(struct fxsave_area) =3D=3D 512, + "FXSAVE area must be exactly 512 bytes"); + +static uint16_t u16_le(const uint8_t *p) +{ + uint16_t v; + memcpy(&v, p, sizeof(v)); + return v; +} + +int main(void) +{ + struct fxsave_area area; + uint16_t fop; + + memset(&area, 0xcc, sizeof(area)); + + __asm__ volatile( + "fninit\n\t" + "fxsave64 %0" + : "+m" (area) + : + : "memory" + ); + + fop =3D u16_le(&area.raw[FXSAVE_FOP_OFFSET]); + if (fop !=3D 0) { + fprintf(stderr, "FOP: expected 0, got 0x%04x\n", (unsigned)fop); + return 1; + } + + for (int slot =3D 0; slot < FXSAVE_NUM_SLOTS; slot++) { + int base =3D FXSAVE_X87_OFFSET + slot * FXSAVE_SLOT_SIZE; + for (int b =3D FXSAVE_RESERVED_START; b < FXSAVE_SLOT_SIZE; b++) { + uint8_t val =3D area.raw[base + b]; + if (val !=3D 0) { + fprintf(stderr, + "Slot %d byte %d (offset %d): expected 0x00, " + "got 0x%02x\n", + slot, b, base + b, (unsigned)val); + return 1; + } + } + } + + return 0; +} --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792264174; cv=none; d=zohomail.com; s=zohoarc; b=HZD0P9lirMLoViHItDQx05dtQlkwqeN5yFplkiI2ZQ0qyV09K5rJalDDvLRig64cirbldJS8w43EXpZ4oAmKDhWlyEKfzdSnwKX6NElnRnP+rvwqJh3JbLmWn29eE8U7rCdfD3YFLF9Ps1wWdE8+6jjUr6GkknSqItgIDLOMRaM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792264174; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=QB0EIvOBE2Ho865gVuP7VKSaDt79BzdYE68WTpsY7hM=; b=KMN0pJAYSBaMZCOcrvR8+fHtzYc1G9VCJ811lculZENIRkrCOp3rdPTlpL/YbloxldfOQHcEyKMfysypCY2waTLCwUXHVnSaDUMeAofsROtalDTOOpojL5vxrLLpS9fafTS7boPk+nQ+xFGRmMSWvoh0TNLpe0D/Iar036cLWFg= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792264174416578.4422486903544; Sat, 17 Oct 2026 12:09:34 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9eg-0008L4-He; Sat, 17 Oct 2026 15:01:18 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9dx-00067M-Il; Sat, 17 Oct 2026 15:00:37 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9dv-0004GT-Sj; Sat, 17 Oct 2026 15:00:33 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 37ACC1DE6D6; Sat, 17 Oct 2026 21:57:01 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 12E3C44339E; Sat, 17 Oct 2026 21:56:59 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263421; bh=t3Y7hPWOb7S5GvmzRzlZql2w9QrWwtr+vAgksoJgcdY=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=A5GeMqH0N8aOVHJ9JnHZlAFDeNYrjJzohfk+hqXUTbFcwEEk//PqMHYVKOrtq1i/q UPuBO3rWb9ddHSzXBUoFUMXYiGWQ64sgSmQAGgpvdOdNsyBQ9xIAt30bWqf+UMM8qB L0kpED1bkbHV0VCx6W2HUrlRoUkILXMHkEyGgJnw2gyHN9Dzhag00mqRGLCjziTgEr oQ0nl0Y+KFJOAkwiW3uXZxvISXLbIoxQaltZOvl3n6lSvwB4lZXCI43XceUy6bypgS kBtQ2Oc1KNqQlX4WTRUJk7LC5RPlXHyJsT0yG9Ipz4CPqo59/NW1mtiAdInj0MtsCR zlPjkbOs1RAOw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Artemii Mashanov , Paolo Bonzini , Michael Tokarev Subject: [Stable-10.0.15 51/63] target/i386: fix immediate stack adjustment for RET and RETF Date: Sat, 17 Oct 2026 21:55:07 +0300 Message-ID: <20261017185528.722197-51-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792264176275158501 Content-Type: text/plain; charset="utf-8" From: Artemii Mashanov The imm16 operand of RET and RETF specifies an unsigned 16-bit count of additional bytes to release from the stack. Previously, gen_RET() and gen_RETF() stored this operand in an int16_t. For example, 0xcaf5 was interpreted as -13579 instead of 51957. Use uint16_t for the adjustment in both functions to preserve the immediate's unsigned value. Tested locally with near and far returns in both 32-bit and 64-bit modes. Each combination covered the form without an immediate and immediate values 0x0000, 0x0001, 0x7fff, 0x8000, 0xcaf5, and 0xffff. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2599 Signed-off-by: Artemii Mashanov Link: https://lore.kernel.org/r/20260924200420.21068-1-ralerrdirsardx@gmail= .com Signed-off-by: Paolo Bonzini (cherry picked from commit 21b6c3e5bccfc07d2719f6de27c40df5af283748) Signed-off-by: Michael Tokarev diff --git a/target/i386/tcg/emit.c.inc b/target/i386/tcg/emit.c.inc index af1cea92be..4b657500ec 100644 --- a/target/i386/tcg/emit.c.inc +++ b/target/i386/tcg/emit.c.inc @@ -3585,7 +3585,7 @@ static void gen_RDxxBASE(DisasContext *s, X86DecodedI= nsn *decode) =20 static void gen_RET(DisasContext *s, X86DecodedInsn *decode) { - int16_t adjust =3D decode->e.op1 =3D=3D X86_TYPE_I ? decode->immediate= : 0; + uint16_t adjust =3D decode->e.op1 =3D=3D X86_TYPE_I ? decode->immediat= e : 0; =20 MemOp ot =3D gen_pop_T0(s); gen_stack_update(s, adjust + (1 << ot)); @@ -3596,7 +3596,7 @@ static void gen_RET(DisasContext *s, X86DecodedInsn *= decode) =20 static void gen_RETF(DisasContext *s, X86DecodedInsn *decode) { - int16_t adjust =3D decode->e.op1 =3D=3D X86_TYPE_I ? decode->immediate= : 0; + uint16_t adjust =3D decode->e.op1 =3D=3D X86_TYPE_I ? decode->immediat= e : 0; =20 if (!PE(s) || VM86(s)) { gen_lea_ss_ofs(s, s->A0, cpu_regs[R_ESP], 0); --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792264180; cv=none; d=zohomail.com; s=zohoarc; b=J4KvGUEkIGAi89gTPkDkBuUd/Z0NF3L3B/Km9NPQ0B4xgRTB4Uyk86b3VMNdWEZNgvCxWWu+DnpJwdtD+uGHD0ljmikZsOv+9fH3xJlVpE3wPxTa2q+sv0neTwHuj9mBnYn+EoY0LJNOQRQSFCCF4wjbESWr6LQzHjcsWUIs5ls= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792264180; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=qNrabkX0iV0yQootbpbOGTUmudajFZlW1kplfC0Dzo0=; b=a/91+b8uPwgtFNq/HkLMzIMn9kLxgo1SCVD1+eV6jpkzBWbYFB1vO4FR+4DryHg4wtyhxufjXfQ3lMf1iUFZRdXUKDcsGjdYEtkjbAFOjwyz1oEGRiGyqfCOEBXj328Ujo/Y6uBx/hh42woNCKDNh9ZXAhKAQ1fpkkjnmsAl6mk= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792264180693138.73322312299467; Sat, 17 Oct 2026 12:09:40 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9ed-00087c-Rn; Sat, 17 Oct 2026 15:01:16 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9dz-0006Dk-MS; Sat, 17 Oct 2026 15:00:37 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9dy-0004Gi-0h; Sat, 17 Oct 2026 15:00:35 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id A04CF1DE6D7; Sat, 17 Oct 2026 21:57:02 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 7D83044339F; Sat, 17 Oct 2026 21:57:01 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263422; bh=BZJu4URBLdBr7Z7aHjzSCqrfILnRF6fUTjCqT4kRgfY=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=lNS2QzBqHmynN6S91ajkLm07M8v4dkYQ+xo62YM0LupG0wev9dR+wCxRhnvYK492V Wu6RAPatLvC29vjHPde0Y31pYEf8iee00BUrUIh+LSrg1c/CCASCEHgtSfmvkdID2r qLxtqeOOteRtMpqnSa02OZahy+WISyXc0VA97A8g4znyVU/d7lncvg6yqSu+IiCEav o4WsEwUf5baxuBIbzhvakMeaxqdRD0BXMEBw+d4s8pjeYu9N1Aqmf/umN2JFLRoTFR DLL3Mj7ND13LuQW8Qob3inwcyyxqnkE1rY2qfGjVZUJ7rnDMhFn63JBcMaVgh8n3NL iSjcSvrgKBc/g== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Aurelien Jarno , Richard Henderson , Michael Tokarev Subject: [Stable-10.0.15 52/63] tcg/riscv64: Remove vector min/max ops with immediates Date: Sat, 17 Oct 2026 21:55:08 +0300 Message-ID: <20261017185528.722197-52-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792264182155158500 Content-Type: text/plain; charset="utf-8" From: Aurelien Jarno RVV 1.0 only defines vmin, vminu, vmax and vmaxu instructions for the vector-vector and vector-scalar case, not the for vector-immediate case. Remove the immediate variant from TCG code generation. Fixes: 1631f19b04fe ("tcg/riscv: Implement vector min/max ops") Signed-off-by: Aurelien Jarno Reviewed-by: Richard Henderson Signed-off-by: Richard Henderson Message-ID: <20261008181611.3015838-1-aurelien@aurel32.net> (cherry picked from commit 306d9ab85fdbbc626c067777cea70dccec22dae9) Signed-off-by: Michael Tokarev diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc index 4e2cc24a86..9a6662948c 100644 --- a/tcg/riscv/tcg-target.c.inc +++ b/tcg/riscv/tcg-target.c.inc @@ -301,13 +301,9 @@ typedef enum { OPC_VSSUBU_VI =3D 0x88000057 | V_OPIVI, =20 OPC_VMAX_VV =3D 0x1c000057 | V_OPIVV, - OPC_VMAX_VI =3D 0x1c000057 | V_OPIVI, OPC_VMAXU_VV =3D 0x18000057 | V_OPIVV, - OPC_VMAXU_VI =3D 0x18000057 | V_OPIVI, OPC_VMIN_VV =3D 0x14000057 | V_OPIVV, - OPC_VMIN_VI =3D 0x14000057 | V_OPIVI, OPC_VMINU_VV =3D 0x10000057 | V_OPIVV, - OPC_VMINU_VI =3D 0x10000057 | V_OPIVI, =20 OPC_VMSEQ_VV =3D 0x60000057 | V_OPIVV, OPC_VMSEQ_VI =3D 0x60000057 | V_OPIVI, @@ -2492,19 +2488,19 @@ static void tcg_out_vec_op(TCGContext *s, TCGOpcode= opc, break; case INDEX_op_smax_vec: set_vtype_len_sew(s, type, vece); - tcg_out_opc_vv_vi(s, OPC_VMAX_VV, OPC_VMAX_VI, a0, a1, a2, c2); + tcg_out_opc_vv(s, OPC_VMAX_VV, a0, a1, a2); break; case INDEX_op_smin_vec: set_vtype_len_sew(s, type, vece); - tcg_out_opc_vv_vi(s, OPC_VMIN_VV, OPC_VMIN_VI, a0, a1, a2, c2); + tcg_out_opc_vv(s, OPC_VMIN_VV, a0, a1, a2); break; case INDEX_op_umax_vec: set_vtype_len_sew(s, type, vece); - tcg_out_opc_vv_vi(s, OPC_VMAXU_VV, OPC_VMAXU_VI, a0, a1, a2, c2); + tcg_out_opc_vv(s, OPC_VMAXU_VV, a0, a1, a2); break; case INDEX_op_umin_vec: set_vtype_len_sew(s, type, vece); - tcg_out_opc_vv_vi(s, OPC_VMINU_VV, OPC_VMINU_VI, a0, a1, a2, c2); + tcg_out_opc_vv(s, OPC_VMINU_VV, a0, a1, a2); break; case INDEX_op_shls_vec: set_vtype_len_sew(s, type, vece); @@ -2792,10 +2788,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsign= ed flags) case INDEX_op_sssub_vec: case INDEX_op_usadd_vec: case INDEX_op_ussub_vec: - case INDEX_op_smax_vec: - case INDEX_op_smin_vec: - case INDEX_op_umax_vec: - case INDEX_op_umin_vec: return C_O1_I2(v, v, vK); case INDEX_op_sub_vec: return C_O1_I2(v, vK, v); @@ -2805,6 +2797,10 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsign= ed flags) case INDEX_op_sarv_vec: case INDEX_op_rotlv_vec: case INDEX_op_rotrv_vec: + case INDEX_op_smax_vec: + case INDEX_op_smin_vec: + case INDEX_op_umax_vec: + case INDEX_op_umin_vec: return C_O1_I2(v, v, v); case INDEX_op_shls_vec: case INDEX_op_shrs_vec: --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792264028; cv=none; d=zohomail.com; s=zohoarc; b=PwWT8oOl7KALEokf24TOsHXx8aEaEpKzFvbuqPjraDwq14IHYw+9QwnA2OF4bvaut3ZNoDt7+cNpnIdGh6zX77HM+3AB+EbYQyxW+2cnJLFbiooSY+KOd5RIJP5o8+TC5ZjoexZkFlXUd4WjlP+C2hqp8A41mX1W9N24gp85itk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792264028; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=wBOpgMuMW0GyRnw28Bn7pR92FquGu2yJMLhD4peC1fs=; b=FEYuQ8sJJrW8FZA339b5i07DW/+S2+hok1cIJbmThbmJCohsWYzYWswaONVGGOeVNm/7xzXuK0iUJZaP5h+Z/YriwLTSRa24kEuznOYuAopB679ivq/iKKb8UnLrO3BcjfJTxNYkLVh2eOt2wizmwLsc3aqA2EZnbDqF3qB6TlA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 17922640285051002.9066532355648; Sat, 17 Oct 2026 12:07:08 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9fV-0001pE-Sk; Sat, 17 Oct 2026 15:02:12 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9eL-0006bB-QR; Sat, 17 Oct 2026 15:01:01 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9eJ-0004Gs-25; Sat, 17 Oct 2026 15:00:56 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 249561DE6D8; Sat, 17 Oct 2026 21:57:04 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id D38C74433A0; Sat, 17 Oct 2026 21:57:02 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263424; bh=w6bfGn+k7mNKlyOr7aaA0IZOkh2xDIo3g4pyqzQO3dY=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=VzYiCG1LR+tr+2IN9fNqFMkSm1TXc1/0+BBosCKyL1evy13EmBMEpcnP8GvLhDqkQ dU3TdB0RIJJj1aXaeITYfIOngvg0bcH9nENk9L4STKvVPB11cpFyrN9PIAe9eHpnSh dgJtCppvPtiXes0ESwZrY/Y/OZemFPFUkShp0Qy7kN20yk8E3SYCSKEzGcNHjhPw3f n+p5ynllBmkZBu0BzoBrvt25Am/IdL3GrB1dkJN4awtwdscdIhtDSoJReSCpZW3SYw LwzgICjLI5PW7kG/yTwDJMnQzYr0KWupewa88i/CGyLS0ZQtkKBNhx/8hzI4scDsJt ttkyZ7Nq9Gbcw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Fuad Tabba , Itaru Kitayama , Gustavo Romero , Peter Maydell , Michael Tokarev Subject: [Stable-10.0.15 53/63] target/arm: Clear TTBR[5:0] from a 52-bit table base address Date: Sat, 17 Oct 2026 21:55:09 +0300 Message-ID: <20261017185528.722197-53-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792264029148158500 Content-Type: text/plain; charset="utf-8" From: Fuad Tabba get_phys_addr_lpae() can read the first descriptor of a walk from the wrong address. This happens with a 52-bit OA when the initial lookup table has fewer than eight entries and its base address has bit 51 set, or bit 50 for a two-entry table. The walk then faults or translates through whatever that address holds. VTTBR walks for stage 2 take the same path. For example, the 16KB granule with a 48-bit VA has a two-entry level 0 (FEAT_LPA2). The 64KB granule with a 44-bit VA has a four-entry level 1 (FEAT_LPA). KVM's page_fault_test hangs on this in its 16KB, 52-bit PA guest mode under TCG, as reported on kvmarm. With a 52-bit OA, TTBR[5:2] hold bits [51:48] of the base address. Such a table is 64-byte aligned (R_KBLCR), so bits [5:0] of the base address are zero. get_phys_addr_lpae() ORs TTBR[5:2] into bits [51:48], but then clears only the bits in indexmask. For these tables indexmask covers fewer than six bits, so TTBR[5] stays in the address, and TTBR[4] too for a two-entry table. Clear TTBR[5:0] when forming a 52-bit table base address. Cc: qemu-stable@nongnu.org Fixes: 7a928f43d872 ("target/arm: Implement FEAT_LPA") Reported-by: Itaru Kitayama Reviewed-by: Gustavo Romero Signed-off-by: Fuad Tabba Message-id: 20261009115728.1299384-2-fuad.tabba@linux.dev Link: https://lore.kernel.org/kvmarm/B4C0AC3E-6A4F-4A7B-B7BC-81207539115E@l= inux.dev/ Signed-off-by: Fuad Tabba Reviewed-by: Peter Maydell Signed-off-by: Peter Maydell (cherry picked from commit 0dedeff9328d4d458dc849176e9bd4582b2b2bd8) Signed-off-by: Michael Tokarev diff --git a/target/arm/ptw.c b/target/arm/ptw.c index fa6973adf1..e34b4bb9ab 100644 --- a/target/arm/ptw.c +++ b/target/arm/ptw.c @@ -1797,13 +1797,16 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1= Translate *ptw, descaddr =3D extract64(ttbr, 0, 48); =20 /* - * For FEAT_LPA and PS=3D6, bits [51:48] of descaddr are in [5:2] of T= TBR. + * With a 52-bit OA (FEAT_LPA or FEAT_LPA2), bits [51:48] of descaddr = are + * in [5:2] of TTBR, and bits [5:0] of the base address are zero: a ta= ble + * under 64 bytes is still 64-byte aligned (R_KBLCR). * * Otherwise, if the base address is out of range, raise AddressSizeFa= ult. * In the pseudocode, this is !IsZero(baseregister<47:outputsize>), * but we've just cleared the bits above 47, so simplify the test. */ if (outputsize > 48) { + descaddr &=3D ~MAKE_64BIT_MASK(0, 6); descaddr |=3D extract64(ttbr, 2, 4) << 48; } else if (descaddr >> outputsize) { level =3D 0; --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792264042; cv=none; d=zohomail.com; s=zohoarc; b=SnF1nh6ijj6yg+duzciKyngJyiilnMrmpIkh7FRbsg0jSC4kY/WYsHp7sivzP0L9BtT+IjJQN+Esw0jLhqjHo900wfipDDrXG6JGqr7ogDlLbyAAtH3puIUdak49oyzt4h53+mvniGL0gJGhCWbwBLehp4+46+lcmoK40zi6iYw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792264042; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=uTKh27INmdkIqmNgJTkNv+0LBAVkFFUFyRL+5XdJf9c=; b=cLJsi+q2pwD8NmkxVuqYZ8+On07f8CGeCUdwxWxPi1IH64pt2CAWKLinmEx7Mf8AU62ZkCMtOIkQ5qCvReDFSyPho+nQ/Pi1dH5XdWwGz0yfeZSjISXDfyNElIBd97e32fR3kz2EcQu/H1CfnL4BPyT1Z4C/7CU3TBZK+TBan6g= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792264042126777.2314786050991; Sat, 17 Oct 2026 12:07:22 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9ej-0000Fm-DT; Sat, 17 Oct 2026 15:01:22 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9eN-0006bL-DX; Sat, 17 Oct 2026 15:01:01 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9eL-0004H8-AG; Sat, 17 Oct 2026 15:00:59 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id DB8AD1DE6D9; Sat, 17 Oct 2026 21:57:05 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 6EF554433A1; Sat, 17 Oct 2026 21:57:04 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263425; bh=PPWstB1vIONAW9PLM+eKXHQ3pHqbCRNoVXdk2T+uPBE=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=tyxA9PdBcxb1lQP1qeZ0Rw8/unf5Q0QZ/cYAj64gDsxQxcAG6/jm230uLcxrki3mH dG8/GGW+jd792iLPwYlKP1dj0F0j1B/dRuOqTKT6ysuSCHv2Se1hhGyZop3GS5HjlM hfpZnKxVrGR0r3C0JIQnz3fEPJba/EbMQxqa4Nh15x5HiXiRJh4VQ9rfgYHaLtMxsX VJnZTQco79adYpuIRAy5ZuWuxDx+MKIrfopymuwiuMVotk4klgZ/eZKH5oTmgCinpd yZlzhSyB7geWczjktmx7WlstzzuLK5Wmk7HH+qw0eMnWltHC4ZppwL2jIgklYyN31C xn6S34IIGzibA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Fuad Tabba , Gustavo Romero , Peter Maydell , Michael Tokarev Subject: [Stable-10.0.15 54/63] tests/tcg/aarch64: Add a test for a two-entry 52-bit TTBR table Date: Sat, 17 Oct 2026 21:55:10 +0300 Message-ID: <20261017185528.722197-54-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792264043586158500 Content-Type: text/plain; charset="utf-8" From: Fuad Tabba Add a test checking that, with a 52-bit OA, TTBR[4] of a two-entry level 0 table is taken only as base address bit 50, not also as bit 4. Reviewed-by: Gustavo Romero Signed-off-by: Fuad Tabba Message-id: 20261009115728.1299384-3-fuad.tabba@linux.dev Signed-off-by: Peter Maydell (cherry picked from commit bb79850255c885fa91e6c095b4e0d967ce6c98ca) (Mjt: adjust test for before make=3D>meson conversion) Signed-off-by: Michael Tokarev diff --git a/tests/tcg/aarch64/Makefile.softmmu-target b/tests/tcg/aarch64/= Makefile.softmmu-target index 46713d49b9..321562ccda 100644 --- a/tests/tcg/aarch64/Makefile.softmmu-target +++ b/tests/tcg/aarch64/Makefile.softmmu-target @@ -72,6 +72,8 @@ run-vtimer: QEMU_OPTS=3D$(QEMU_EL2_MACHINE) $(QEMU_BASE_A= RGS) -kernel =20 run-wfxt: QEMU_OPTS=3D-M virt,virtualization=3Don,gic-version=3D2 -cpu max= -smp 1 -semihosting-config enable=3Don,arg=3D2 -kernel =20 +run-ttbr-baddr: QEMU_OPTS=3D-M virt,virtualization=3Don -cpu max -semihost= ing-config enable=3Don,arg=3D2 -kernel + # Simple Record/Replay Test .PHONY: memory-record run-memory-record: memory-record memory diff --git a/tests/tcg/aarch64/system/ttbr-baddr.c b/tests/tcg/aarch64/syst= em/ttbr-baddr.c new file mode 100644 index 0000000000..b29c9e1ab0 --- /dev/null +++ b/tests/tcg/aarch64/system/ttbr-baddr.c @@ -0,0 +1,153 @@ +/* + * TTBR base address with a 52-bit layout and a small initial lookup table + * + * With a 52-bit OA, walk a two-entry level 0 table through an IPA with + * bit 50 set, which stage 2 maps back onto the table, so the walk + * succeeds only if TTBR[4] is cleared from bit 4 of the base address. + * + * Copyright (c) 2026 Google LLC + * Author: Fuad Tabba + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#include +#include + +/* from Linux's include/linux/stringify.h */ +#define __stringify_1(x...) #x +#define __stringify(x...) __stringify_1(x) + +#define read_sysreg(r) ({ \ + uint64_t __val; \ + asm volatile("mrs %0, " __stringify(r) : "=3Dr" (__val)); \ + __val; \ +}) + +#define write_sysreg(r, v) do { \ + uint64_t __val =3D (uint64_t)(v); \ + asm volatile("msr " __stringify(r) ", %x0" \ + : : "rZ" (__val)); \ +} while (0) + +/* + * kernel.ld links the test at 1GB, so the tables below lie within the + * blocks mapped at RAM_BASE. + */ +#define RAM_BASE 0x40000000UL +#define HIGH_IPA (1UL << 50) +#define TEST_VA (0xffff000000000000UL | RAM_BASE) + +/* + * Stage 1: 16KB granule, 48-bit VA, so level 0 has two entries. + * Stage 2: 64KB granule, 52-bit IPA, mapping RAM at its own address and + * again at HIGH_IPA. + */ +static uint64_t s1_l0[2048] __attribute__((aligned(16384))); +static uint64_t s1_l1[2048] __attribute__((aligned(16384))); +static uint64_t s1_l2[2048] __attribute__((aligned(16384))); +static uint64_t s2_l1[1024] __attribute__((aligned(65536))); +static uint64_t s2_l2[8192] __attribute__((aligned(65536))); +static uint64_t s2_l2_high[8192] __attribute__((aligned(65536))); + +#define TCR_T0SZ(x) ((uint64_t)(x) << 0) +#define TCR_T1SZ(x) ((uint64_t)(x) << 16) +#define TCR_TG0_16K (2UL << 14) +#define TCR_TG1_16K (1UL << 30) +#define TCR_IPS_52 (6UL << 32) +#define TCR_DS (1UL << 59) + +#define VTCR_T0SZ(x) ((uint64_t)(x) << 0) +#define VTCR_SL0_L1 (2UL << 6) +#define VTCR_TG0_64K (1UL << 14) +#define VTCR_PS_52 (6UL << 16) +#define VTCR_RES1 (1UL << 31) + +#define HCR_VM (1UL << 0) +#define HCR_RW (1UL << 31) + +#define PAR_F (1UL << 0) +#define PAR_PA(par) ((par) & 0xfffffffff000UL) +#define S2_BLOCK ((1 << 10) | (3 << 6) | (0xf << 2) | 1) + +static void tlb_flush(void) +{ + asm volatile("dsb sy; tlbi alle1; dsb sy; isb" : : : "memory"); +} + +static uint64_t at(uint64_t ttbr1) +{ + uint64_t par; + + write_sysreg(ttbr1_el1, ttbr1); + tlb_flush(); + asm volatile("at s12e1r, %1; isb; mrs %0, par_el1" + : "=3Dr" (par) : "r" (TEST_VA)); + return par; +} + +static void setup_tables(void) +{ + /* Stage 1: TEST_VA -> RAM_BASE, 32MB block, AF */ + s1_l0[0] =3D (uint64_t)s1_l1 | 3; + s1_l1[0] =3D (uint64_t)s1_l2 | 3; + s1_l2[(RAM_BASE >> 25) & 0x7ff] =3D RAM_BASE | (1 << 10) | 1; + + /* Stage 2: 512MB blocks at RAM_BASE and HIGH_IPA | RAM_BASE, AF, RW */ + s2_l1[0] =3D (uint64_t)s2_l2 | 3; + s2_l1[HIGH_IPA >> 42] =3D (uint64_t)s2_l2_high | 3; + s2_l2[RAM_BASE >> 29] =3D RAM_BASE | S2_BLOCK; + s2_l2_high[RAM_BASE >> 29] =3D RAM_BASE | S2_BLOCK; +} + +static int check(const char *name, uint64_t par) +{ + int ok =3D !(par & PAR_F) && PAR_PA(par) =3D=3D RAM_BASE; + + ml_printf("%s: PAR_EL1=3D%lx %s\n", name, par, ok ? "ok" : "FAIL"); + return !ok; +} + +int main(void) +{ + uint64_t mmfr0 =3D read_sysreg(id_aa64mmfr0_el1); + uint64_t tcr =3D TCR_T0SZ(16) | TCR_T1SZ(16) | TCR_TG0_16K | TCR_TG1_1= 6K | + TCR_DS; + uint64_t base =3D (uint64_t)s1_l0; + int ret =3D 0; + + ml_printf("TTBR base address test\n"); + + /* + * PARange 52 bits (FEAT_LPA) and TGran16 with 52-bit addresses + * (FEAT_LPA2) + */ + if ((mmfr0 & 0xf) !=3D 6 || ((mmfr0 >> 20) & 0xf) !=3D 2) { + ml_printf("SKIP: no 52-bit PA or no FEAT_LPA2 with 16KB\n"); + return ret; + } + + /* + * The test runs at EL2 (arg=3D2) and walks the EL1&0 regime with AT, = so + * the EL1 MMU settings below only affect those walks. + */ + setup_tables(); + write_sysreg(mair_el1, 0xff); + write_sysreg(sctlr_el1, read_sysreg(sctlr_el1) | 1); + + /* + * 52-bit OA: TTBR[4] is base address bit 50, so with it set the + * level 0 table is at IPA HIGH_IPA | s1_l0. Stage 2 maps that IPA + * onto s1_l0 (through s2_l2_high), so the walk succeeds only if + * TTBR[4] does not also offset the two-entry table by 0x10. + */ + write_sysreg(vtcr_el2, VTCR_T0SZ(12) | VTCR_SL0_L1 | VTCR_TG0_64K | + VTCR_PS_52 | VTCR_RES1); + write_sysreg(vttbr_el2, (uint64_t)s2_l1); + write_sysreg(hcr_el2, HCR_RW | HCR_VM); + write_sysreg(tcr_el1, tcr | TCR_IPS_52); + ret |=3D check("ips52", at(base)); + ret |=3D check("ips52 ttbr[4]", at(base | (1 << 4))); + + return ret; +} --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792264185; cv=none; d=zohomail.com; s=zohoarc; b=IunsSd/Ql8cwnGwnoI6YXd4vgBNqu9KRdhxTsQpJGnTOgE4AEOdBewkNrGONaUo8zjhyStJ97UUj1za49Fgp3mWBIVdFSf+sW869QiYQOvXSgbNV/SrxuL8yXL9QiCDlsXd7qNftDTg19rdgDrfGVV+5ELhjSuPr161gfkRS/ms= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792264185; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=bDgfvtyx+OV90UpY/Stwx7yHXENEfIyROC2ciepYIVk=; b=cALKhvPYxZRiRNTkQ7D++jNv1RlgCS47QHlJFoXtocHOdQsDiPWfrzEx10x4pvVnySeI9wA2CyVkMsxWcSXHAD03zATlu0ZYRqwmTESAYBHM4K13LdFHEWXGq1Y2fNzRohHqzlOLBuzzJMCu62YwbzdW7Ve4v/9P5hQE4jf1810= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792264185441905.1735001694992; Sat, 17 Oct 2026 12:09:45 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9fd-0001zz-Ih; Sat, 17 Oct 2026 15:02:19 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9eP-0006bU-0y; Sat, 17 Oct 2026 15:01:01 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9eN-0004Il-BL; Sat, 17 Oct 2026 15:01:00 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 618ED1DE6DA; Sat, 17 Oct 2026 21:57:07 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 3AC434433A2; Sat, 17 Oct 2026 21:57:06 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263427; bh=xBLK8b3uWjjwdYJKq9VXmqgziRyyn4QZInBmirGy5bI=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=hgr3Ux2gWoeGmsenYHPMEovmYaBWWcSkqZDwXdYuWvCb9WSkCGz6OnHemiB1qV3pl E0Knsj0hRcFl9eiODRS1Et8LqAGiA/opmNED+WL9tirxfJ/PwZ/2xYTjN1gWYc76dG ZD16HeSekRdYPgebThglYSUhJm8WvXahsLdPgaMMDEoSoqgCmHxdWUo8V7v7PxI3TO yW1nPVWIdITD3KtwW/zq83GroEOel1y/YreIJ2VOXCW+z6HRRbNDWIdlXrfgYs73yp z5NIpCBkWWxE8mCajPTx124aqYq3u2TCCda2A0U3ceWsmlOu/pn/DMfl7VxSZEhu2Q aNauFvTlk0cDA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Fuad Tabba , Gustavo Romero , Peter Maydell , Michael Tokarev Subject: [Stable-10.0.15 55/63] target/arm: Use the 52-bit TTBR base address layout when TCR.DS is set Date: Sat, 17 Oct 2026 21:55:11 +0300 Message-ID: <20261017185528.722197-55-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792264186428158500 Content-Type: text/plain; charset="utf-8" From: Fuad Tabba With TCR.DS set, TTBR[5:2] hold bits [51:48] of the translation table base address, whatever the OA size. If the effective OA size is below 52 bits, setting any of them is a level 0 Address size fault (AArch64_S1TTBaseAddress(), AArch64_S1Walk()). get_phys_addr_lpae() uses the 52-bit layout only when the OA size is over 48 bits. With TCR.DS set and an IPS of 48 bits, it takes TTBR[5:2] as base address bits [5:2] instead. A guest that sets them gets no fault: the walk either succeeds with TTBR[5:2] ignored, or reads its first descriptor from the wrong address. VTTBR walks with VTCR.DS take the same path. Use the 52-bit layout whenever TCR.DS is set, and check the whole base address against the OA size. Fixes: ef56c2425e5f ("target/arm: Implement FEAT_LPA2") Cc: qemu-stable@nongnu.org Reviewed-by: Gustavo Romero Signed-off-by: Fuad Tabba Message-id: 20261009115728.1299384-4-fuad.tabba@linux.dev Reviewed-by: Peter Maydell Signed-off-by: Peter Maydell (cherry picked from commit 2c372119465e14f26c094bdcca58e4b1fca84afd) Signed-off-by: Michael Tokarev diff --git a/target/arm/ptw.c b/target/arm/ptw.c index e34b4bb9ab..da96a1df09 100644 --- a/target/arm/ptw.c +++ b/target/arm/ptw.c @@ -1797,18 +1797,21 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1= Translate *ptw, descaddr =3D extract64(ttbr, 0, 48); =20 /* - * With a 52-bit OA (FEAT_LPA or FEAT_LPA2), bits [51:48] of descaddr = are - * in [5:2] of TTBR, and bits [5:0] of the base address are zero: a ta= ble - * under 64 bytes is still 64-byte aligned (R_KBLCR). + * With a 52-bit OA (FEAT_LPA or FEAT_LPA2), or with TCR.DS set at any= OA + * size, bits [51:48] of descaddr are in [5:2] of TTBR, and bits [5:0]= of + * the base address are zero: a table under 64 bytes is still 64-byte + * aligned (R_KBLCR). * - * Otherwise, if the base address is out of range, raise AddressSizeFa= ult. - * In the pseudocode, this is !IsZero(baseregister<47:outputsize>), - * but we've just cleared the bits above 47, so simplify the test. + * If the base address is out of range, raise AddressSizeFault. + * In the pseudocode, this is !IsZero(address) + * in AArch64_OAOutOfRange(), but descaddr has no bits set above 51, + * so simplify the test. */ - if (outputsize > 48) { + if (outputsize > 48 || param.ds) { descaddr &=3D ~MAKE_64BIT_MASK(0, 6); descaddr |=3D extract64(ttbr, 2, 4) << 48; - } else if (descaddr >> outputsize) { + } + if (descaddr >> outputsize) { level =3D 0; fi->type =3D ARMFault_AddressSize; goto do_fault; --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792264063; cv=none; d=zohomail.com; s=zohoarc; b=HUhyarPZLb53PqCi9+D6b5FE4+kWmp8Yq7MI/T3zp1tVwMfFjwvWMMc4j9o4FFjzf9LFTjhcg+E4QG+MjiHf32i7vV1tCjhvx3t99l2kWGsMufyJqMrB5EvMeailozRQlonk4EntRpGRe2XbTYgS2l3xHblhmw13dc4mZJi04n0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792264063; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=6noHXjYX8cwCpWPuUXF8bqKUKYwjH/owly41OxbYc9o=; b=TGNhm4XFico/fmwyEmj6MwdQS8OmRl3bW7znaFkfkTpUk94pNYBA7OMXZcZQ1XIq3JHKuOPj9jo/1d1SMPSxbMM/TxPL/euqxXedj9gyoEXlsPICXXiv7HwThParXvF0JqzZ/LOWGWJJpi5E5dF57WW3jHw0rycODyAF+DMuZ24= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792264063486271.187123745229; Sat, 17 Oct 2026 12:07:43 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9fh-0002IT-Lc; Sat, 17 Oct 2026 15:02:21 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9eR-0006le-1Q; Sat, 17 Oct 2026 15:01:03 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9eO-0004J5-So; Sat, 17 Oct 2026 15:01:02 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 76B021DE6DB; Sat, 17 Oct 2026 21:57:08 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 96CF84433A3; Sat, 17 Oct 2026 21:57:07 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263428; bh=FXzr5fLZUvw+pZqQK2VFOPfwNcrD8X1apSacBXHdOXI=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=epZmkYVTwGdN3Kg+ZStauQU5UQOdrGoA4jW6dkmsbyg0917zkgSKr+nzKDoz9nb20 0LV1S+LCQntLRdKyXFekZUdC849LUaTk6m1CY4sA9YdEYn28JrBQLn5mmao8wzy7i+ xuAXl3wuB311fn6VxVljFKfik2whDkIQWwxwD4XX6cvuDVp+HI6U4Cz0D8zSXQjWY6 FOO8/zZXJ3DFjsRR04/oP6CxNfXz+tr9YRiqqYmk8jacAhEs3c8CXavbWzmpEXqHjO cNj3Z4aR9uf7jb8RgUqKp00O8DbF1i1zamnWRFA5czazA1S3g2UQGmUe8FxjmbqhoG YocKopwp6ultQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Fuad Tabba , Gustavo Romero , Peter Maydell , Michael Tokarev Subject: [Stable-10.0.15 56/63] tests/tcg/aarch64: Test the TTBR layout with TCR.DS and a 48-bit OA Date: Sat, 17 Oct 2026 21:55:12 +0300 Message-ID: <20261017185528.722197-56-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792264065771158500 Content-Type: text/plain; charset="utf-8" From: Fuad Tabba Extend the TTBR base address test to check that, with TCR.DS or VTCR.DS and a 48-bit OA, setting TTBR[5:2] is a level 0 Address size fault. Reviewed-by: Gustavo Romero Signed-off-by: Fuad Tabba Message-id: 20261009115728.1299384-5-fuad.tabba@linux.dev Signed-off-by: Peter Maydell (cherry picked from commit 2579771a28a200cba27d843fbda549def09f421d) Signed-off-by: Michael Tokarev diff --git a/tests/tcg/aarch64/system/ttbr-baddr.c b/tests/tcg/aarch64/syst= em/ttbr-baddr.c index b29c9e1ab0..20a240410d 100644 --- a/tests/tcg/aarch64/system/ttbr-baddr.c +++ b/tests/tcg/aarch64/system/ttbr-baddr.c @@ -4,6 +4,8 @@ * With a 52-bit OA, walk a two-entry level 0 table through an IPA with * bit 50 set, which stage 2 maps back onto the table, so the walk * succeeds only if TTBR[4] is cleared from bit 4 of the base address. + * With TCR.DS or VTCR.DS and a 48-bit OA, check that setting TTBR[5:2] + * is a level 0 Address size fault. * * Copyright (c) 2026 Google LLC * Author: Fuad Tabba @@ -42,10 +44,13 @@ * Stage 1: 16KB granule, 48-bit VA, so level 0 has two entries. * Stage 2: 64KB granule, 52-bit IPA, mapping RAM at its own address and * again at HIGH_IPA. + * Stage 2 with VTCR.DS: 16KB granule, 47-bit IPA, mapping RAM flat. */ static uint64_t s1_l0[2048] __attribute__((aligned(16384))); static uint64_t s1_l1[2048] __attribute__((aligned(16384))); static uint64_t s1_l2[2048] __attribute__((aligned(16384))); +static uint64_t s2ds_l1[2048] __attribute__((aligned(16384))); +static uint64_t s2ds_l2[2048] __attribute__((aligned(16384))); static uint64_t s2_l1[1024] __attribute__((aligned(65536))); static uint64_t s2_l2[8192] __attribute__((aligned(65536))); static uint64_t s2_l2_high[8192] __attribute__((aligned(65536))); @@ -54,20 +59,27 @@ static uint64_t s2_l2_high[8192] __attribute__((aligned= (65536))); #define TCR_T1SZ(x) ((uint64_t)(x) << 16) #define TCR_TG0_16K (2UL << 14) #define TCR_TG1_16K (1UL << 30) +#define TCR_IPS_48 (5UL << 32) #define TCR_IPS_52 (6UL << 32) #define TCR_DS (1UL << 59) =20 #define VTCR_T0SZ(x) ((uint64_t)(x) << 0) #define VTCR_SL0_L1 (2UL << 6) +#define VTCR_TG0_16K (2UL << 14) #define VTCR_TG0_64K (1UL << 14) +#define VTCR_PS_48 (5UL << 16) #define VTCR_PS_52 (6UL << 16) #define VTCR_RES1 (1UL << 31) +#define VTCR_DS (1UL << 32) =20 #define HCR_VM (1UL << 0) #define HCR_RW (1UL << 31) =20 #define PAR_F (1UL << 0) +#define PAR_FST(par) (((par) >> 1) & 0x3f) #define PAR_PA(par) ((par) & 0xfffffffff000UL) +#define FST_ADDR_SIZE_L0 0x00 + #define S2_BLOCK ((1 << 10) | (3 << 6) | (0xf << 2) | 1) =20 static void tlb_flush(void) @@ -86,6 +98,17 @@ static uint64_t at(uint64_t ttbr1) return par; } =20 +static uint64_t at_s1(uint64_t ttbr1) +{ + uint64_t par; + + write_sysreg(ttbr1_el1, ttbr1); + tlb_flush(); + asm volatile("at s1e1r, %1; isb; mrs %0, par_el1" + : "=3Dr" (par) : "r" (TEST_VA)); + return par; +} + static void setup_tables(void) { /* Stage 1: TEST_VA -> RAM_BASE, 32MB block, AF */ @@ -93,6 +116,10 @@ static void setup_tables(void) s1_l1[0] =3D (uint64_t)s1_l2 | 3; s1_l2[(RAM_BASE >> 25) & 0x7ff] =3D RAM_BASE | (1 << 10) | 1; =20 + /* Stage 2 with VTCR.DS: RAM_BASE -> RAM_BASE, 32MB block, AF, RW */ + s2ds_l1[0] =3D (uint64_t)s2ds_l2 | 3; + s2ds_l2[(RAM_BASE >> 25) & 0x7ff] =3D RAM_BASE | S2_BLOCK; + /* Stage 2: 512MB blocks at RAM_BASE and HIGH_IPA | RAM_BASE, AF, RW */ s2_l1[0] =3D (uint64_t)s2_l2 | 3; s2_l1[HIGH_IPA >> 42] =3D (uint64_t)s2_l2_high | 3; @@ -108,6 +135,15 @@ static int check(const char *name, uint64_t par) return !ok; } =20 +/* A level 0 Address size fault */ +static int check_fault(const char *name, uint64_t par) +{ + int ok =3D (par & PAR_F) && PAR_FST(par) =3D=3D FST_ADDR_SIZE_L0; + + ml_printf("%s: PAR_EL1=3D%lx %s\n", name, par, ok ? "ok" : "FAIL"); + return !ok; +} + int main(void) { uint64_t mmfr0 =3D read_sysreg(id_aa64mmfr0_el1); @@ -135,6 +171,25 @@ int main(void) write_sysreg(mair_el1, 0xff); write_sysreg(sctlr_el1, read_sysreg(sctlr_el1) | 1); =20 + /* + * TCR.DS with a 48-bit OA: TTBR[5:2] are base address bits [51:48], + * so setting any of them is a level 0 Address size fault. + */ + write_sysreg(hcr_el2, HCR_RW); + write_sysreg(tcr_el1, tcr | TCR_IPS_48); + ret |=3D check("ips48", at_s1(base)); + ret |=3D check_fault("ips48 ttbr[2]", at_s1(base | (1 << 2))); + ret |=3D check_fault("ips48 ttbr[4]", at_s1(base | (1 << 4))); + + /* The same for VTTBR, with VTCR.DS and a 48-bit PS */ + write_sysreg(vtcr_el2, VTCR_T0SZ(17) | VTCR_SL0_L1 | VTCR_TG0_16K | + VTCR_PS_48 | VTCR_RES1 | VTCR_DS); + write_sysreg(hcr_el2, HCR_RW | HCR_VM); + write_sysreg(vttbr_el2, (uint64_t)s2ds_l1); + ret |=3D check("ps48", at(base)); + write_sysreg(vttbr_el2, (uint64_t)s2ds_l1 | (1 << 2)); + ret |=3D check_fault("ps48 vttbr[2]", at(base)); + /* * 52-bit OA: TTBR[4] is base address bit 50, so with it set the * level 0 table is at IPA HIGH_IPA | s1_l0. Stage 2 maps that IPA --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263919; cv=none; d=zohomail.com; s=zohoarc; b=Dn3no0Ju4M/45WXW5jCQE3c1vqXsnkzKc7ZubgHku42NNbErWxjND3Oha4mlhRUUshDWc2+Mprp5AyBgvqjq6yIRBp+0R+bva4rqY1nCNAFrCl1Lex765mUZaMP6HgXEENIcb4Nmg2N3UZFHcSZG3TxX+ayhhkwl5FMgKzwOMsA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263919; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=3gbbwGmAY4LQk8rGNXFQPksmlsreGSSxdjErgelQ0pM=; b=DDquYd7eSqk8S8Y94n105H9SQ8pNPD6pnySlKz7W7jioz2nzQT52A8R44VC7zuQjLK5cKhIkjAwStm+FBPafow57vxjLJhjqRwTzHq8L+ez0I5DIWDBiGmsKj06Q87oi8APcigI8+OwpQelUQJsO2xI/NIpWqwE24/jQo8YmPxE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263919825919.4020085819434; Sat, 17 Oct 2026 12:05:19 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9fl-0002Z6-CZ; Sat, 17 Oct 2026 15:02:26 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9eS-0006wQ-Mc; Sat, 17 Oct 2026 15:01:04 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9eQ-0004JM-NK; Sat, 17 Oct 2026 15:01:04 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 1CA911DE6DC; Sat, 17 Oct 2026 21:57:10 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id BFA274433A4; Sat, 17 Oct 2026 21:57:08 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263430; bh=36KdazKZYk8egmIh6085uyxvohIyRpcxAwUdJB/IDVY=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=xdmOneCJYIAglr6pcI4+m++xwcim9JkhNQE875zc0qmqrXiHVIVloA5EMv/gdc9r9 OImDUm4WkZvkHCSTCda8OXi16GJUXzZ1GbbHC6o8ZLCyliF/FxCLQfkiaNG6Nj6MyW bTuWaObtql1M6O/oqxZtQHK8QlE2bSUSOThetsS6Mk14fv7MUzaG247qPAN39DjjJV nyc6/Ieb2/We+KlY6SkLMZVNAqmTqj/XHicSAegr3T6ZExmGhvm+oYK8nUR6no/cpu VQSFecil7HmMWUOIZvtdcNJ02Dr0rCGx+MVI/zjlivseZxsYFwLKZDcghY59rwM8jn UYq+MQpinCQKw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, imaginos , Alistair Francis , Michael Tokarev Subject: [Stable-10.0.15 57/63] target/riscv: check G-stage write permission for VS-stage A/D updates Date: Sat, 17 Oct 2026 21:55:13 +0300 Message-ID: <20261017185528.722197-57-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263921086158500 Content-Type: text/plain; charset="utf-8" From: imaginos During a two-stage (VS-stage + G-stage) page-table walk with hardware A/D updating enabled (Svadu / menvcfg.ADUE), a store that reaches a VS-stage leaf PTE whose accessed or dirty bit is clear triggers a hardware write-back of those bits into the PTE. That write-back is an implicit store to the PTE's guest-physical address, so it must be permitted by G-stage. Fix this by re-running the G-stage translation of the guest PTE's address with store semantics. get_physical_address() then also checks that G-stage permits the guest PTE to be written, and raises a guest-page store fault when it does not. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3426 Signed-off-by: imaginos Reviewed-by: Alistair Francis Message-ID: <20260705140508.17692-1-imaginos32@gmail.com> Signed-off-by: Alistair Francis (cherry picked from commit 366b4fba0fae0d9425b230e06c38842d72273d88) Signed-off-by: Michael Tokarev diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c index 0ac10835fe..e407c1b6df 100644 --- a/target/riscv/cpu_helper.c +++ b/target/riscv/cpu_helper.c @@ -1413,6 +1413,7 @@ static int get_physical_address(CPURISCVState *env, h= waddr *physical, int ptshift; target_ulong pte; hwaddr pte_addr; + hwaddr pte_gpa =3D 0; const hwaddr base_root =3D base; int i; =20 @@ -1449,6 +1450,7 @@ static int get_physical_address(CPURISCVState *env, h= waddr *physical, } =20 pte_addr =3D vbase + idx * ptesize; + pte_gpa =3D base + idx * ptesize; } else { pte_addr =3D base + idx * ptesize; } @@ -1701,6 +1703,28 @@ static int get_physical_address(CPURISCVState *env, = hwaddr *physical, return TRANSLATE_FAIL; } =20 + /* + * The implicit store that writes updated A/D bits back to a VS-st= age + * (first-stage) PTE must itself be permitted by G-stage. Re-run t= he + * second-stage translation of the PTE's guest-physical address wi= th + * store semantics. If G-stage denies write, raise G-stage store f= ault + * against the PTE address. + */ + if (two_stage && first_stage) { + int gpa_prot; + hwaddr gpa_paddr; + int gpa_ret =3D get_physical_address(env, &gpa_paddr, &gpa_pro= t, + pte_gpa, NULL, MMU_DATA_STO= RE, + MMUIdx_U, false, true, + is_debug, false); + if (gpa_ret !=3D TRANSLATE_SUCCESS) { + if (fault_pte_addr) { + *fault_pte_addr =3D pte_gpa >> 2; + } + return TRANSLATE_G_STAGE_FAIL; + } + } + pmp_ret =3D get_physical_address_pmp(env, &pmp_prot, pte_addr, sxlen_bytes, MMU_DATA_STORE, PR= V_S); if (pmp_ret !=3D TRANSLATE_SUCCESS) { @@ -2379,6 +2403,10 @@ void riscv_cpu_do_interrupt(CPUState *cs) * doing VS-stage page table walk. */ tinst =3D (riscv_cpu_xlen(env) =3D=3D 32) ? 0x00002000 : 0= x00003000; + + if (cause =3D=3D RISCV_EXCP_STORE_GUEST_AMO_ACCESS_FAULT) { + tinst |=3D 0x20; + } } else { /* * The "Addr. Offset" field in transformed instruction is --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263821; cv=none; d=zohomail.com; s=zohoarc; b=etopU9R0/sOiZhCvl6+ajrqD/utrjNlgEQiibVi4Li7r4x15J5up+yhCuYM8BkGV0iguYd3367Jc700V5P5+wrTBTRDGJpe0sNiNilDbLWOC7Jlr3bB9aHrdG7uUI/zKL66YoNc3/HK2Y7bzQqWCoPKhK4EiEogEKgLIJQru1oU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263821; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=DpNLkQBIZb8ZjPuvEeVKG81zr9JUvKsRF+Bsllivhfs=; b=lKrmy4L2yA9Ai/1X1OvbRf4AhTi0F6Bgj3UPt2aqWxUgKzy2zQjP0wJ8rzoTj9bOuBDU2+WbMEtnb0BP2kqOPH5J8DPqFAVJSLe8hgz/Tn23mlGMlNgvr9+9cXZDOTnG/8CBIEfuF/SpUEOGQP/qxRhj5IxS6bNAwKg4M6uTIK4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263821854716.4214138638018; Sat, 17 Oct 2026 12:03:41 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9fy-00035A-3P; Sat, 17 Oct 2026 15:02:38 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9eo-0000no-L5; Sat, 17 Oct 2026 15:01:28 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9em-0004Ji-Ki; Sat, 17 Oct 2026 15:01:26 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 2D4311DE6DD; Sat, 17 Oct 2026 21:57:11 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 500264433A5; Sat, 17 Oct 2026 21:57:10 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263431; bh=YG5Yd+2JiC+IqULO3jNH652vwHwcVLhTsiVUVIM1sSM=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=bRtDWbI0yMGb3GWwPerDxepSoQNcw2rj92E1AWFRIKHjivOeBVdZt6pBJdY9rcDKg yDuM0/811DTJUDXxcKfTuKkEq1sHwCHt203YQQlsfnjxhLAq81zmvomQvwWNqFK6gv 4JZq42RBT5vIyu7qYXcpgUz7XFvVRfMQ2bPCpJS0ZKi2nSnyvdKsUeinzqKstUVe3E QouAX8O3OJkQe1GtK25VKBw6g2NwyByOafqOtHeZOnElMURSv7jGwAjwukly7kKHiS 3P3bYjpTMf/V7Wo+hB3+daWA7RRFREB9t2woRsIz/TThqjc09ft+X3wXMuQJy5kFxf k7q+dBe4+SW+g== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Zephyr Li , Daniel Henrique Barboza , Alistair Francis , Michael Tokarev Subject: [Stable-10.0.15 58/63] target/riscv: stop translating after WFI Date: Sat, 17 Oct 2026 21:55:14 +0300 Message-ID: <20261017185528.722197-58-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263823188158500 Content-Type: text/plain; charset="utf-8" From: Zephyr Li helper_wfi() never returns to translated code: it either raises an exception or exits the CPU loop after marking the CPU as halted. However, trans_wfi() leaves the translation state as DISAS_NEXT, so instructions following WFI can be included in the same TB. With icount enabled, this makes the following instruction part of the TB's instruction count when WFI exits, causing minstret to be incremented once too many. Set DISAS_NORETURN after emitting the helper. Add a TCG test for both reported cases: WFI waking for a locally enabled pending interrupt with mstatus.MIE clear, and WFI taking a timer interrupt. Cc: qemu-stable@nongnu.org Fixes: 55c2a12cbcd3 ("RISC-V TCG Code Generation") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4230 Signed-off-by: Zephyr Li Reviewed-by: Daniel Henrique Barboza Message-ID: <20260910025324.54990-1-fritchleybohrer@gmail.com> Signed-off-by: Alistair Francis (cherry picked from commit 410166b550ccacdc46065af00e68cea4d60efb65) (Mjt: adjust test to before make=3D>meson conversion) Signed-off-by: Michael Tokarev diff --git a/target/riscv/insn_trans/trans_privileged.c.inc b/target/riscv/= insn_trans/trans_privileged.c.inc index 8a62b4cfcd..3c5f92f608 100644 --- a/target/riscv/insn_trans/trans_privileged.c.inc +++ b/target/riscv/insn_trans/trans_privileged.c.inc @@ -145,6 +145,7 @@ static bool trans_wfi(DisasContext *ctx, arg_wfi *a) decode_save_opc(ctx, 0); gen_update_pc(ctx, ctx->cur_insn_len); gen_helper_wfi(tcg_env); + ctx->base.is_jmp =3D DISAS_NORETURN; return true; #else return false; diff --git a/tests/tcg/riscv64/Makefile.softmmu-target b/tests/tcg/riscv64/= Makefile.softmmu-target index 7c1d44d3f4..9bda32fc2f 100644 --- a/tests/tcg/riscv64/Makefile.softmmu-target +++ b/tests/tcg/riscv64/Makefile.softmmu-target @@ -20,5 +20,9 @@ EXTRA_RUNS +=3D run-issue1060 run-issue1060: issue1060 $(call run-test, $<, $(QEMU) $(QEMU_OPTS)$<) =20 +EXTRA_RUNS +=3D run-test-minstret-wfi +run-test-minstret-wfi: test-minstret-wfi + $(call run-test, $<, $(QEMU) -icount shift=3D1 $(QEMU_OPTS)$<) + # We don't currently support the multiarch system tests undefine MULTIARCH_TESTS diff --git a/tests/tcg/riscv64/test-minstret-wfi.S b/tests/tcg/riscv64/test= -minstret-wfi.S new file mode 100644 index 0000000000..0fd0158d5b --- /dev/null +++ b/tests/tcg/riscv64/test-minstret-wfi.S @@ -0,0 +1,100 @@ +/* SPDX-License-Identifier: GPL-2.0-or-later */ + + .option norvc + + .text + .global _start +_start: + lla t0, trap + csrw mtvec, t0 + li s3, 0 + + /* + * A pending, locally enabled interrupt wakes WFI even with MIE + * clear. + */ + li t0, 0x8 /* MIE_MSIE */ + csrw mie, t0 + csrci mstatus, 0x8 /* MSTATUS_MIE */ + li t0, 0x2000000 /* MSIP0 */ + li t1, 1 + sw t1, 0(t0) + + /* + * The first CSR read and WFI retire before the second read obtains s1, + * so the expected difference is two. + */ + csrr s0, minstret + wfi + csrr s1, minstret + sub s1, s1, s0 + li t1, 2 + beq s1, t1, 1f + ori s3, s3, 1 +1: + + /* Clear the software interrupt before testing the trap path. */ + sw zero, 0(t0) + csrw mie, zero + + /* Schedule a timer interrupt far enough ahead to reach WFI first. */ + li t0, 0x200bff8 /* MTIME */ + ld t1, 0(t0) + addi t1, t1, 100 + li t0, 0x2004000 /* MTIMECMP0 */ + sd t1, 0(t0) + li t0, 0x80 /* MIE_MTIE */ + csrw mie, t0 + csrsi mstatus, 0x8 /* MSTATUS_MIE */ + + /* + * The first CSR read and WFI retire before the trap handler obtains s1, + * so the expected difference is again two. + */ + li s2, 1 + csrr s0, minstret + wfi + beqz s2, 1f + ori s3, s3, 2 +1: + bnez s3, fail + li a0, 0 + j _exit + +fail: + mv a0, s3 + +_exit: + lla a1, semiargs + li t0, 0x20026 /* ADP_Stopped_ApplicationExit */ + sd t0, 0(a1) + sd a0, 8(a1) + li a0, 0x20 /* TARGET_SYS_EXIT_EXTENDED */ + + /* Semihosting call sequence */ + .balign 16 + slli zero, zero, 0x1f + ebreak + srai zero, zero, 0x7 + j . + + .balign 4 +trap: + /* Read minstret before retiring an instruction in the handler. */ + csrr s1, minstret + sub s1, s1, s0 + addi s1, s1, -2 + snez s2, s1 + + /* Disable the timer interrupt before returning past WFI. */ + li t0, 0x2004000 /* MTIMECMP0 */ + li t1, -1 + sd t1, 0(t0) + li t0, 0x80 /* MIE_MTIE */ + csrc mie, t0 + mret + + .data + .balign 16 +semiargs: + .space 16 --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792264195; cv=none; d=zohomail.com; s=zohoarc; b=TmFgL/8/qXVeob1qu7AEFjptzakP5FbbA/2h6Zey7u5/LQXTUyOvBfodbw9zT7JLhRZeawD5BlklypIiEuMZ+PDkTEUoiwNMOBx8Fit48cLPThC4djvroz2gMR8QsEzbSKcrgnXi0iXEyA6IKfYryBTDpRUZ71FPWkPQHtBQNRw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792264195; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=p2nWVHlHXazDDSK76wjNrtQmSpQZl8BXYWirxNYsKxY=; b=eLGRj8ftSXAicuEr+PdyQKl4mddmsGQRlb+R2I/YDRQjXBj6WO22HgAlcGTc7AhLtdmG0IqvHZ0/yevQ4RkAFmNcjq0OaeF0BuVodLRc3P+JeW33kQCC612rm9pOuJ1juMHQoSEwbj0zdtW5hgPeVVMmlrPZuafjPq/ha4RYOow= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792264195616208.63944693099518; Sat, 17 Oct 2026 12:09:55 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9g8-0003O2-7R; Sat, 17 Oct 2026 15:02:48 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9eq-0000ss-Jf; Sat, 17 Oct 2026 15:01:32 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9eo-0004Ju-As; Sat, 17 Oct 2026 15:01:27 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 740431DE6DE; Sat, 17 Oct 2026 21:57:12 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 616AE4433A6; Sat, 17 Oct 2026 21:57:11 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263432; bh=DDoRZW4I8GQsr16Jv7HTCFPdSNBE45iQP+pvSxLFFpU=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=aEWfbcj1Yl/WdZlaaMoaGDUwY5g1Adynlb9F5qWcNqkWAy7D+ctlInixYHScpgroJ /gu1SfFXSRqDo6tw7EddcwjHFw3lDeeFKvTVmBVIjS7Q10T8r3uscCxbPFguczDc/y /ZI37+xRLJ71uHyrLBWALlVeC78hQ5Qfga+Wob8zGza5VaRJ2QuC1V1cn53/fJYUSt 9MsmiN4Bsn67w8p3+EMfYXnfUwKbRUn99UNizP7xdD0vOsP0R5/11d6gM5YvtFsjGM cj0PJWv/eZrQlMxUXVLivD13leXucM2QCBsBJVLTLPvECOfx2zz1p6xqpA6x3n/Dfk /QJcbjjhKyERg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Xie Bo , Daniel Henrique Barboza , Alistair Francis , Michael Tokarev Subject: [Stable-10.0.15 59/63] target/riscv/kvm: Preserve FCSR across migration Date: Sat, 17 Oct 2026 21:55:15 +0300 Message-ID: <20261017185528.722197-59-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792264196462158500 Content-Type: text/plain; charset="utf-8" From: Xie Bo kvm_riscv_get_regs_fp() and kvm_riscv_put_regs_fp() handle f0-f31 but not FCSR. KVM exposes FCSR as a separate 32-bit register in both the F and D register groups, so frm and fflags are lost after migration. Read and write FCSR together with the FP registers and save it in a KVM-only subsection. Older streams do not contain the subsection; in that case the destination keeps its reset value. Fixes: 937f0b45120b ("target/riscv: Implement kvm_arch_get_registers") Fixes: 9997cc1e19d1 ("target/riscv: Implement kvm_arch_put_registers") Signed-off-by: Xie Bo Cc: qemu-stable@nongnu.org Reviewed-by: Daniel Henrique Barboza Message-ID: <20260831074106.1798671-2-xb@ultrarisc.com> Signed-off-by: Alistair Francis (cherry picked from commit e52de6b65f5fa584209a8c147d6170d8370ffdee) Signed-off-by: Michael Tokarev diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h index 8fb1928681..00b97e54bb 100644 --- a/target/riscv/cpu.h +++ b/target/riscv/cpu.h @@ -487,6 +487,9 @@ struct CPUArchState { hwaddr fdt_addr; =20 #ifdef CONFIG_KVM + /* KVM floating-point state */ + uint32_t kvm_fcsr; + /* kvm timer */ bool kvm_timer_dirty; uint64_t kvm_timer_time; diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c index 7b4a2aecbb..f9461e5611 100644 --- a/target/riscv/kvm/kvm-cpu.c +++ b/target/riscv/kvm/kvm-cpu.c @@ -110,6 +110,14 @@ static uint64_t kvm_riscv_vector_reg_id(RISCVCPU *cpu, =20 #define RISCV_FP_D_REG(idx) KVM_RISCV_REG_ID_U64(KVM_REG_RISCV_FP_D, idx) =20 +#define RISCV_FP_F_FCSR_REG \ + KVM_RISCV_REG_ID_U32(KVM_REG_RISCV_FP_F, \ + KVM_REG_RISCV_FP_F_REG(fcsr)) + +#define RISCV_FP_D_FCSR_REG \ + KVM_RISCV_REG_ID_U32(KVM_REG_RISCV_FP_D, \ + KVM_REG_RISCV_FP_D_REG(fcsr)) + #define RISCV_VECTOR_CSR_REG(name) \ KVM_RISCV_REG_ID_ULONG(KVM_REG_RISCV_VECTOR, \ KVM_REG_RISCV_VECTOR_CSR_REG(name)) @@ -722,7 +730,8 @@ static int kvm_riscv_get_regs_fp(CPUState *cs) } env->fpr[i] =3D reg; } - return ret; + return kvm_get_one_reg(cs, RISCV_FP_D_FCSR_REG, + &env->kvm_fcsr); } =20 if (riscv_has_ext(env, RVF)) { @@ -734,7 +743,8 @@ static int kvm_riscv_get_regs_fp(CPUState *cs) } env->fpr[i] =3D reg; } - return ret; + return kvm_get_one_reg(cs, RISCV_FP_F_FCSR_REG, + &env->kvm_fcsr); } =20 return ret; @@ -755,7 +765,8 @@ static int kvm_riscv_put_regs_fp(CPUState *cs) return ret; } } - return ret; + return kvm_set_one_reg(cs, RISCV_FP_D_FCSR_REG, + &env->kvm_fcsr); } =20 if (riscv_has_ext(env, RVF)) { @@ -767,7 +778,8 @@ static int kvm_riscv_put_regs_fp(CPUState *cs) return ret; } } - return ret; + return kvm_set_one_reg(cs, RISCV_FP_F_FCSR_REG, + &env->kvm_fcsr); } =20 return ret; diff --git a/target/riscv/machine.c b/target/riscv/machine.c index 3e52dab690..02cf06368e 100644 --- a/target/riscv/machine.c +++ b/target/riscv/machine.c @@ -188,6 +188,32 @@ static const VMStateDescription vmstate_rv128 =3D { }; =20 #ifdef CONFIG_KVM +static bool kvm_fcsr_needed(void *opaque) +{ + RISCVCPU *cpu =3D opaque; + CPURISCVState *env =3D &cpu->env; + + return kvm_enabled() && + (riscv_has_ext(env, RVF) || riscv_has_ext(env, RVD)); +} + +static int kvm_fcsr_post_load(void *opaque, int version_id) +{ + return kvm_enabled() ? 0 : -ENOTSUP; +} + +static const VMStateDescription vmstate_kvm_fcsr =3D { + .name =3D "cpu/kvm-fcsr", + .version_id =3D 1, + .minimum_version_id =3D 1, + .needed =3D kvm_fcsr_needed, + .post_load =3D kvm_fcsr_post_load, + .fields =3D (const VMStateField[]) { + VMSTATE_UINT32(env.kvm_fcsr, RISCVCPU), + VMSTATE_END_OF_LIST() + } +}; + static bool kvmtimer_needed(void *opaque) { return kvm_enabled(); @@ -510,6 +536,7 @@ const VMStateDescription vmstate_riscv_cpu =3D { &vmstate_pointermasking, &vmstate_rv128, #ifdef CONFIG_KVM + &vmstate_kvm_fcsr, &vmstate_kvmtimer, #endif &vmstate_envcfg, --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792264028; cv=none; d=zohomail.com; s=zohoarc; b=KPurZ3BGTfWF4o8aFGfZwzDJribWUR8bnDXhqCuRYp2AtCimpBLbyIt3g+hX8cg2QgoDhpoi7pr3EvWEMreJpp79MIN8J1lm0jBB4mYnfD6cu/3cA6uL7epOaBszGsYy4cRABe9/fUrjAmBPkJFBw0Rx2+FtIj7sMZaju00QQZI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792264028; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=2jKPh+uC1yVT1EVDiGsqDA33zexiXQLe4Y86+bwk1yc=; b=MNYPTMsrFTpsRqXwwSIwOIIROvdauj8P7oGKhSpo/Xzb7nHNJNKKrT3nc00zJPQDipeMStWbcTc1qI+9uRAZl+EGN9CEiw7dzSv/537EBln9Nl2lyq572Subo+lkVNIFI1dBszr/hQiVbjvhmwoy80fPrphD7tvHN60dlPB+qvM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792264028562837.1723552217921; Sat, 17 Oct 2026 12:07:08 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9fY-0001u1-VA; Sat, 17 Oct 2026 15:02:13 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9es-0000v3-85; Sat, 17 Oct 2026 15:01:32 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9eq-0004L3-MH; Sat, 17 Oct 2026 15:01:30 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 114DE1DE6DF; Sat, 17 Oct 2026 21:57:14 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id D636D4433A7; Sat, 17 Oct 2026 21:57:12 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263434; bh=4rQas78o2qic6KfRrpeVcUvakhKjmJVQYpZLa5rIvQE=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=jFDsTTFcrJ/jVoML+d8BO8436HFHJTz1IfLCeKnr7WDbOABqeOukCDwPEa1hcUjbR gEWdVbvL3niOu7CkId6OH6VLAvqHjc/qIwz3U7SLj5B+ODyvyYrbLmdyDfTCKLR43U IfMvV6AJs6HGUDoD9f2F/bKi8Id8218k+pNFlMNet5R23QvNiEuJdox7aZNaiCAsop B9ZVg2KU9lbh1FT91fUIVShLn40YR6IKHheKIdDv1pdxx2TJlLHoYW/d1p/tWn8tTU K6C0o5gREWSZbDnUhEZIYxE7xzhGvvMo/NS57r/BntGeOYiZmXr08gr+zpXpM3J+Ky 7SLt9ZW59Ln8Q== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Rick Richard , Daniel Henrique Barboza , Alistair Francis , Michael Tokarev Subject: [Stable-10.0.15 60/63] tests/qtest/bios-tables-test: Allow changes to riscv64 virt SPCR Date: Sat, 17 Oct 2026 21:55:16 +0300 Message-ID: <20261017185528.722197-60-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792264029197158500 Content-Type: text/plain; charset="utf-8" From: Rick Richard Allow changes to the riscv64 virt board SPCR -- we are going to fix an error in the UART description there. Signed-off-by: Rick Richard Reviewed-by: Daniel Henrique Barboza Message-ID: <20261005104008.214588-2-rick@sloservers.com> Cc: qemu-stable@nongnu.org Signed-off-by: Alistair Francis (cherry picked from commit ba280c351011618d2e7f9c3773fb4cdf109e40f6) Signed-off-by: Michael Tokarev diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios= -tables-test-allowed-diff.h index dfb8523c8b..aae973048a 100644 --- a/tests/qtest/bios-tables-test-allowed-diff.h +++ b/tests/qtest/bios-tables-test-allowed-diff.h @@ -1 +1,2 @@ /* List of comma-separated changed AML files to ignore */ +"tests/data/acpi/riscv64/virt/SPCR", --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263863; cv=none; d=zohomail.com; s=zohoarc; b=OzPXCZv3IJfdBlqG6Y2eq1LTuWBROV98yrrv6QllNTai2ZT3EGW19nHsIGSoIKb1YGGpSOYQaW6agum7TjdeixPd8F23Qp2/weHLVFSeYCky1xGPLA46ZQWA4FOdm0yPGApQKFtuHVwbik3KML0ECi/gO+rZAepWqU/b2t1gsdY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263863; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=kQs7SBxWPdkfK/4pann9mmBk7FfAmAxcXeGwGmiAH/c=; b=lrs4UsvaM+j4fB1dgTc2jL4iAWjssklSyHyniZB2hBEYlnlYJOwPtL/WU0hw6Cl2/Z88583NQlmfD28VIvBp1F/7SXH7aLbif9wz3u12agcTlmQABbIAlKXY1LP5wKHohtJxRbpw6zj6lPZh2F34p8i8cd0Q5aKh+XkJm50FqZM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263863125562.2500833461014; Sat, 17 Oct 2026 12:04:23 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9fL-0001bx-AT; Sat, 17 Oct 2026 15:02:00 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9et-0000v6-LZ; Sat, 17 Oct 2026 15:01:32 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9es-0004LE-2M; Sat, 17 Oct 2026 15:01:31 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 3A1C61DE6E0; Sat, 17 Oct 2026 21:57:15 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 45B3A4433A8; Sat, 17 Oct 2026 21:57:14 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263435; bh=TkUF34W9eBMWA/1NUiVvvJiTo5XWNwiBO683bo96k5U=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=aBCQ4wOYby73UL6KHDCfNei6O95fCNzOKFR5CsYVQY8PxZR9I3ER9cgRs0uXDHA/1 lZWERg7Ku5zST3EVn4BxltrnTgNVyayMCwE7i9ZYRJADf20xFzGDT35Hziz2867C/E mi2DNup7suryl7JBcc4Yh6/ZxdC/vS9A1kudmNn+36PAcyDzXbKx63pHL9/JlJPuar c1l6B5KqFHmMuS5FyqOvUB8Z9niq2V0y8OMbHjdjxlTa9evA+BJc9VpuGYqL8ZEG0E 9VMtxnb/bcsZ319gulAbxJuTO0WlO0tN9kwQiOqp+W8Ewn3Cy7IiZFc3NeH/Cp7YVO +PkxGa1bvBJeQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Rick Richard , Daniel Henrique Barboza , Alistair Francis , Michael Tokarev Subject: [Stable-10.0.15 61/63] hw/riscv/virt-acpi-build: Fix the UART register width in SPCR Date: Sat, 17 Oct 2026 21:55:17 +0300 Message-ID: <20261017185528.722197-61-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263864067158500 Content-Type: text/plain; charset="utf-8" From: Rick Richard The riscv virt board uses a 16550 UART with an 8-bit register stride, but the SPCR table reports 32, which looks to have been copied from arm virt, whose PL011 has a 32-bit stride. Change it to the correct stride for a 16550. Fixes: 3e6f1e61b4 ("hw/riscv/virt-acpi-build.c: Generate SPCR table") Signed-off-by: Rick Richard Reviewed-by: Daniel Henrique Barboza Message-ID: <20261005104008.214588-3-rick@sloservers.com> Cc: qemu-stable@nongnu.org Signed-off-by: Alistair Francis (cherry picked from commit ee23f530e99d1091f31585dd0ca1b948d4873939) Signed-off-by: Michael Tokarev diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c index b14c1c8e8c..071ec4624d 100644 --- a/hw/riscv/virt-acpi-build.c +++ b/hw/riscv/virt-acpi-build.c @@ -214,7 +214,7 @@ spcr_setup(GArray *table_data, BIOSLinker *linker, RISC= VVirtState *s) AcpiSpcrData serial =3D { .interface_type =3D 0x12, /* 16550 compatible */ .base_addr.id =3D AML_AS_SYSTEM_MEMORY, - .base_addr.width =3D 32, + .base_addr.width =3D 8, .base_addr.offset =3D 0, .base_addr.size =3D 1, .base_addr.addr =3D s->memmap[VIRT_UART0].base, --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792264063; cv=none; d=zohomail.com; s=zohoarc; b=Fz1JxXKs5hj36nCej/w2aimrUeO78oLXFgvc0uiW9thR/pPjDvaDPLXER9JmEDo0IA2Nev5S1d1GbzSND3ItMhzTX47eTeKa2lI7xoBsStMSPqa1RAxvJy6+KhEJ22hz9360l11tfky20Zyg9JSw4SPnpctv45SddcdQdlARiiM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792264063; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=2L5hnbtduTSHKRtLWTuKM9KEvaDcXqCOaydNK2mYFZM=; b=dBdQhDbm3I2GLpU1aRySeT8bDe/Je/IyGGVH0CuW1oqpPD3U1gmjGnGyK1KlYYAH4oGP5toQagMPtviRGj0fHzX1nbGN+HKIFRl34loyWVqdG7vCnWknD2kkSsRprjEFdNCZ/v2IDpCIPtgTsszZqCnraRXqqUTB9kMFxPSn1yw= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 17922640634001019.8490037465167; Sat, 17 Oct 2026 12:07:43 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9fg-000295-ER; Sat, 17 Oct 2026 15:02:20 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9ev-0000xg-Oh; Sat, 17 Oct 2026 15:01:34 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9et-0004LT-OA; Sat, 17 Oct 2026 15:01:33 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id BC4141DE6E1; Sat, 17 Oct 2026 21:57:16 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 6D30E4433A9; Sat, 17 Oct 2026 21:57:15 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263436; bh=qRvolJ5qa/tOZOHlXgDhJ4v57RaF5JF67FPon2iMbWw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=nSejjSQaCUeZ+pc9fEEGMvxgwcZV1HZ0nyGV/uVvDxjMy6w8cRmzDDVPqJ0YLWETf YoC8UhB7C+ULU3R/BQSrKm3H8pKHfAeiq+5f7gt4DYmydD4eZ/fCdMivIVh0RUc//3 G6Y6JiGt+uT5AuTYr/FQ0g8bIQoWZyG0Glfp+bntJvN0GI9FHCU1y+z3YV09Q0G5+O KKN9/noi6JIGwQVZiUjY++Hba2C4J7tGb5FOmq3OyxWSiwZuIYbUM6u7esLBmivOW2 5IIfgJOIpo168HgXKHdK9oV01bddd5sWIDVslI8TgbPWkA5RIUQKJOJmWv74jIWluR 02t01ktP7zClA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Rick Richard , Daniel Henrique Barboza , Alistair Francis , Michael Tokarev Subject: [Stable-10.0.15 62/63] tests/qtest/bios-tables-test: Update riscv64 virt SPCR golden reference Date: Sat, 17 Oct 2026 21:55:18 +0300 Message-ID: <20261017185528.722197-62-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792264063905158500 Content-Type: text/plain; charset="utf-8" From: Rick Richard Update the riscv64 virt SPCR golden reference file to have the fix for the UART register width. Diffs from iasl: @@ -1,58 +1,58 @@ /* * Intel ACPI Component Architecture * AML/ASL+ Disassembler version 20230628 (64-bit version) * Copyright (c) 2000 - 2023 Intel Corporation * * Disassembly of tests/data/acpi/riscv64/virt/SPCR, Sat Oct 3 08:44:51 2= 026 * * ACPI Data Table [SPCR] * * Format: [HexOffset DecimalOffset ByteLength] FieldName : FieldValue (i= n hex) */ [000h 0000 004h] Signature : "SPCR" [Serial Port Cons= ole Redirection Table] [004h 0004 004h] Table Length : 0000005A [008h 0008 001h] Revision : 04 -[009h 0009 001h] Checksum : 13 +[009h 0009 001h] Checksum : 2B [00Ah 0010 006h] Oem ID : "BOCHS " [010h 0016 008h] Oem Table ID : "BXPC " [018h 0024 004h] Oem Revision : 00000001 [01Ch 0028 004h] Asl Compiler ID : "BXPC" [020h 0032 004h] Asl Compiler Revision : 00000001 [024h 0036 001h] Interface Type : 12 [025h 0037 003h] Reserved : 000000 [028h 0040 00Ch] Serial Port Register : [Generic Address Structure] [028h 0040 001h] Space ID : 00 [SystemMemory] -[029h 0041 001h] Bit Width : 20 +[029h 0041 001h] Bit Width : 08 [02Ah 0042 001h] Bit Offset : 00 [02Bh 0043 001h] Encoded Access Width : 01 [Byte Access:8] [02Ch 0044 008h] Address : 0000000010000000 [034h 0052 001h] Interrupt Type : 10 [035h 0053 001h] PCAT-compatible IRQ : 00 [036h 0054 004h] Interrupt : 0000000A [03Ah 0058 001h] Baud Rate : 07 [03Bh 0059 001h] Parity : 00 [03Ch 0060 001h] Stop Bits : 01 [03Dh 0061 001h] Flow Control : 00 [03Eh 0062 001h] Terminal Type : 03 [04Ch 0076 001h] Reserved : 00 [040h 0064 002h] PCI Device ID : FFFF [042h 0066 002h] PCI Vendor ID : FFFF [044h 0068 001h] PCI Bus : 00 [045h 0069 001h] PCI Device : 00 [046h 0070 001h] PCI Function : 00 [047h 0071 004h] PCI Flags : 00000000 [04Bh 0075 001h] PCI Segment : 00 [04Ch 0076 004h] Reserved : 00000000 Raw Table Data: Length 90 (0x5A) - 0000: 53 50 43 52 5A 00 00 00 04 13 42 4F 43 48 53 20 // SPCRZ.....BO= CHS + 0000: 53 50 43 52 5A 00 00 00 04 2B 42 4F 43 48 53 20 // SPCRZ....+BO= CHS 0010: 42 58 50 43 20 20 20 20 01 00 00 00 42 58 50 43 // BXPC ....= BXPC - 0020: 01 00 00 00 12 00 00 00 00 20 00 01 00 00 00 10 // ......... ..= .... + 0020: 01 00 00 00 12 00 00 00 00 08 00 01 00 00 00 10 // ............= .... 0030: 00 00 00 00 10 00 0A 00 00 00 07 00 01 00 03 00 // ............= .... 0040: FF FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 // ............= .... 0050: 00 00 00 00 02 00 58 00 2E 00 // ......X... Signed-off-by: Rick Richard Reviewed-by: Daniel Henrique Barboza Message-ID: <20261005104008.214588-4-rick@sloservers.com> Cc: qemu-stable@nongnu.org Signed-off-by: Alistair Francis (cherry picked from commit 71041ce05c95fe47fd24175bb2b974bb14f3d029) Signed-off-by: Michael Tokarev diff --git a/tests/data/acpi/riscv64/virt/SPCR b/tests/data/acpi/riscv64/vi= rt/SPCR index 59d2c8f7f2..6003c230b1 100644 Binary files a/tests/data/acpi/riscv64/virt/SPCR and b/tests/data/acpi/risc= v64/virt/SPCR differ diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios= -tables-test-allowed-diff.h index aae973048a..dfb8523c8b 100644 --- a/tests/qtest/bios-tables-test-allowed-diff.h +++ b/tests/qtest/bios-tables-test-allowed-diff.h @@ -1,2 +1 @@ /* List of comma-separated changed AML files to ignore */ -"tests/data/acpi/riscv64/virt/SPCR", --=20 2.47.3 From nobody Sat Oct 24 15:41:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792263936; cv=none; d=zohomail.com; s=zohoarc; b=ZuePExEUr71iwuXdevT2k8Qq2jOvG9PSNkTNjNLEE4bF1PWG0kQGxGUm6SRmtLRUt09DM+fGFL5vZcHxUTKfscCbWQ7gAh8Guu1q9KDKzEhSEj7gV79JvcQp0rvo2iiz5M3MNfFlWvT1p3zBzCAqUzrN3+1oxbCApNlNQet2n0Q= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792263936; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=YUBdC80ETa5a0vGmcmul7FN8jd4MIoEFKfbGH+xxufI=; b=IWoVRHo7b36GR/g1BOOV0OOASF/u1CY7t5KE5Og/5Shwh/aj/ay9EGITC9Rs/FJFcqnhonD/ggApfLTLEL4Cu+nzfGhMar++Zvg+LzKnVfosK+8ZLdUQMIOzLI4VdswAflv+Qc0SGk7szhMrnX9msdLbD5WWYCUspbM5nGUOk5Q= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792263936927963.5703336469196; Sat, 17 Oct 2026 12:05:36 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xI9gH-0003o5-Hd; Sat, 17 Oct 2026 15:02:57 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9fI-0001Wg-KK; Sat, 17 Oct 2026 15:01:57 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xI9fF-0004Ls-5L; Sat, 17 Oct 2026 15:01:56 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 4B9EE1DE6E2; Sat, 17 Oct 2026 21:57:18 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 2B7114433AA; Sat, 17 Oct 2026 21:57:16 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792263438; bh=Yt/8Q2QUuv0Ett89CgtDv/9I7FrcG+4VUWUHlrUzq2c=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=C66idgr5QknYqSKlTyMyHqna7DbnCNCA1wRhaV8O+f83975vl4gGg1v9CscnW/VtH 8MLw32WWHfq/OPyfrjU3jjWebT3823pEb5V8DiW2CBppCKHtTDfpwHVeC6lW3APwVK BVj2GoZ1gjdhIPsJvezDgbbNAddZw3cNfvY1YQieFtULznumgxq2vkRMmVRrdx58wZ cVv0Zmw+iPMnCnNLPH+57XjEfXp2s2W2kUCY4jqrCJ70cTeGA8hk9pCeC7YyzN77Mg FeifzXb81FklVV1+SGIZiE1buzcQoPHSjHek0zIRKFZSHBzQGN4oF1UltZZI37IJBu VbW0nE69UjWCA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, dodochicha , Alistair Francis , Michael Tokarev Subject: [Stable-10.0.15 63/63] target/riscv: Check Svnapot PTE before updating A/D bits Date: Sat, 17 Oct 2026 21:55:19 +0300 Message-ID: <20261017185528.722197-63-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792263937301158500 Content-Type: text/plain; charset="utf-8" From: dodochicha Reserved Svnapot PTE encodings must raise a page fault without modifying the PTE. Currently the A/D bits may be updated before the Svnapot encoding is validated. Move the Svnapot validation before the A/D update so reserved PTEs fault without changing the PTE. Cc: qemu-stable@nongnu.org Signed-off-by: dodochicha Message-ID: <20261005115916.21196-1-kevincheng60303@gmail.com> Reviewed-by: Alistair Francis Signed-off-by: Alistair Francis (cherry picked from commit cb82463fa9bf46d90e6a1779bb20aff2bf76a1a7) Signed-off-by: Michael Tokarev diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c index e407c1b6df..fafcad75b8 100644 --- a/target/riscv/cpu_helper.c +++ b/target/riscv/cpu_helper.c @@ -1682,6 +1682,13 @@ static int get_physical_address(CPURISCVState *env, = hwaddr *physical, return sstack_page ? TRANSLATE_PMP_FAIL : TRANSLATE_FAIL; } =20 + if (riscv_cpu_cfg(env)->ext_svnapot && (pte & PTE_N)) { + napot_bits =3D ctzl(ppn) + 1; + if ((i !=3D (levels - 1)) || (napot_bits !=3D 4)) { + return TRANSLATE_FAIL; + } + } + target_ulong updated_pte =3D pte; =20 /* @@ -1769,13 +1776,6 @@ static int get_physical_address(CPURISCVState *env, = hwaddr *physical, /* For superpage mappings, make a fake leaf PTE for the TLB's benefit.= */ target_ulong vpn =3D addr >> PGSHIFT; =20 - if (riscv_cpu_cfg(env)->ext_svnapot && (pte & PTE_N)) { - napot_bits =3D ctzl(ppn) + 1; - if ((i !=3D (levels - 1)) || (napot_bits !=3D 4)) { - return TRANSLATE_FAIL; - } - } - napot_mask =3D (1 << napot_bits) - 1; *physical =3D (((ppn & ~napot_mask) | (vpn & napot_mask) | (vpn & (((target_ulong)1 << ptshift) - 1)) --=20 2.47.3