From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773242401; cv=none; d=zohomail.com; s=zohoarc; b=iSSto6iUb+28n6QTv2qTRW7lTeQrDq7xDpjYRQFQi7slOjtBWNXoP+2crJ7b3uFeAywwJXX+6MgiqUdWZtmulgf2zIz2kj6BskFaCbBq5YXCOwql6ompba6ON7RR96BXNz8HRG3lfvBy2tZVx+wp19srT3qtOzWgvGO+LsnAWwk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773242401; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=bCncK0TL/js7TM7PkNFvKwczHqWIhV32UrP4Dj3fl2U=; b=nWip1kSXJtZdbo9VlMSiLl1srfsifp2sg65zkqljVV+DXirrLY4h+gwa8OZFdP5FMBZU5wxdE0PfgFwDvdtx/RlSAzqz61e4RqGXCW7lRhKk/FfYC/juPwqLEubBkPCRFiwnGhLo25uMwlraDuJYoNKSQgvq/KUtnRWFpQOSgAQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 177324240183086.65481234189474; Wed, 11 Mar 2026 08:20:01 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LBo-0001V2-HX; Wed, 11 Mar 2026 11:09:36 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0L8q-0003Ra-Nv; Wed, 11 Mar 2026 11:06:36 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0L8p-0004rF-4C; Wed, 11 Mar 2026 11:06:32 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id D880F191E83; Wed, 11 Mar 2026 18:04:21 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id BF8CE37C2BE; Wed, 11 Mar 2026 18:04:59 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241461; bh=LUhS57RFGj7NHBR+NebGguao5HORenCp128BIVnZjc8=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=NStERTxOMCclsfP/vGvNGjcnL3kzWmxNzWqYAE5fRY/lKDGMZCY/mo4DJBX8ug3ia VDrcam/ppGmVF/5GKUmdS+ddCE1hYTIt4xBau8OXzYKLwcT7mHPX4KyoWLiadyhsPN CDIPQFai26jQ7xAJE+2UkjSv3G3qb3YbJcgtadf7myZienSLsVNmF0HSMF/J+Sa8qx efYV0YTuhXonX7uAt+Kzh8XnwuJheSQEhjClgSU/QQ6KCwwTxtu0fWu4b/yig4GatO Ai+hojgIQfhcY+M4yDyKmlkqAdg4l71CHAN23wN42RsAKbTm7SoGkecPwEbgZ+9lZp ipuG7Eu4AgekQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Jaehoon Kim , Matthew Rosato , Farhan Ali , Eric Farman , Thomas Huth , Michael Tokarev Subject: [Stable-10.1.5 01/46] s390x/pci: Fix endianness for zPCI BAR values. Date: Wed, 11 Mar 2026 18:02:37 +0300 Message-ID: <20260311150327.1084669-1-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773242403868158500 Content-Type: text/plain; charset="utf-8" From: Jaehoon Kim During zPCI scan, BAR configuration data retrieved via CLP Query was misinterpreted due to an endianness mismatch between QEMU and the guest kernel. The guest kernel's clp_store_query_pci_fn() expects BAR values in little-endian format and converts them with le32_to_cpu(). However, QEMU was incorrectly sending them in big-endian format, not following the architecture specification. This caused incorrect bit-swapping in the kernel, leading zpci_setup_bus_resources() to perform registration checks against invalid flags, making the process ineffective. Observation values for zPCI device (NVMe passthrough): LPAR from real CLP: [ 0.865595] Resource: PCI Bus 0000:00 -> zdev->bar[0].val: 0x4 [ 0.865597] start: 0x4000000000000000 [ 0.865598] end: 0x4000000000003fff [ 0.865600] flags: 0x100200 QEMU before fix (wrong): [ 0.601083] Resource: PCI Bus 0001:00 -> zdev->bar[0].val: 0x4000000 [ 0.601085] start: 0x4003000000000000 [ 0.601086] end: 0x4003000000003fff [ 0.601087] flags: 0x200 QEMU after fix (correct): [ 0.601116] Resource: PCI Bus 0001:00 -> zdev->bar[0].val: 0x4 [ 0.601117] start: 0x4003000000000000 [ 0.601118] end: 0x4003000000003fff [ 0.601119] flags: 0x100200 Signed-off-by: Jaehoon Kim Reviewed-by: Matthew Rosato Reviewed-by: Farhan Ali Reviewed-by: Eric Farman Message-ID: <20260206164645.1845366-1-jhkim@linux.ibm.com> Signed-off-by: Thomas Huth (cherry picked from commit 00ebc44514a67fb75a46d60e4b44614ebf91230f) Signed-off-by: Michael Tokarev diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c index a3bb5aa221..c12468fc32 100644 --- a/hw/s390x/s390-pci-inst.c +++ b/hw/s390x/s390-pci-inst.c @@ -307,7 +307,7 @@ int clp_service_call(S390CPU *cpu, uint8_t r2, uintptr_= t ra) uint32_t data =3D pci_get_long(pbdev->pdev->config + PCI_BASE_ADDRESS_0 + (i * 4)); =20 - stl_be_p(&resquery->bar[i], data); + stl_le_p(&resquery->bar[i], data); resquery->bar_size[i] =3D pbdev->pdev->io_regions[i].size ? ctz64(pbdev->pdev->io_regions[i].size)= : 0; trace_s390_pci_bar(i, --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773242001; cv=none; d=zohomail.com; s=zohoarc; b=VflYJOHTNc4qwlyP52rfSgeLHiVA/nLSYM2Y8eo9b029RE6XAhtA7/0Hq3EaWdoTX4vKUePUeRNrMcfV4TCzg2V0cFR4+EXpO3aMxIo7aod9q+3r4CkEx1ybUqCHdO6+4y5bZ1Wn6cMFUjk+u17Lv9HjiSilDGEf/ZcybZnveNA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773242001; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=K4ewQZcyWaqxFxbjWgw89qUjx6zwGLruGy4Pg7GfB8U=; b=GXU1yqCbGWx6LqXH52rEqZeIL3RKzkq8G0uFKtHxPpPzm6raRrnCykgpN3hu6p3vyBZLIxuOPbc5I1sY3Jz8/fNJC+xdX8hVXINtfRWxMaI3NIj/6CqLqi6QShjuwB+n+jvarW/4Iht14Mjt6xn9aCxpM1LUz1hU/2deA+1zEKM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 17732420016971007.4353157389445; Wed, 11 Mar 2026 08:13:21 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LBi-0000xm-KX; Wed, 11 Mar 2026 11:09:31 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0L9E-0003tM-SV; Wed, 11 Mar 2026 11:07:03 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0L9B-0004rg-PG; Wed, 11 Mar 2026 11:06:56 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 06FCC191E85; Wed, 11 Mar 2026 18:04:41 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id E79AB37C2C6; Wed, 11 Mar 2026 18:05:18 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241481; bh=UkC+mGEKAng2ipeWdHY5FpVi3rpU3TW2kt6s+TMUcoc=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=gzb362OQhDRH2ecmPSVG6HKVd8iiL/C4ly66rqb8wViTol3t+134CrOQPp/nLrdOR kl+HbJJfSIdDbEaooz5QLJ9G6vc0CDX0yDkligOHDOIL0eXwEbll7gQxTnLHVQlqFi ifvilpcxy2ESmtjdvI76XkqKnrCDhFymodSWdk3uiKQvb7RYnE3BABtXJ+hYSPaNk5 8p1SX3G3MmwPDUjFNjFc4B2f8MdMzJ8qcanegYduYLUFBRdHTcKqBWysY1ddzFnRF8 MmrgpQy7N7xqk/ncTlRltOsk4qKxygTmeXtrcEdAoioViZmfZ42jKo9i9qrZ4lFsB8 OUhhMrK5exChw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Mohamed Mediouni , Pierrick Bouvier , Michael Tokarev Subject: [Stable-10.1.5 02/46] plugins: fix cross-build using LLVM for Windows targets Date: Wed, 11 Mar 2026 18:02:38 +0300 Message-ID: <20260311150327.1084669-2-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773242003618158500 Content-Type: text/plain; charset="utf-8" From: Mohamed Mediouni llvm-dlltool assumes that it's by default targeting the host architecture it's running on. That assumption doesn't hold true when cross-compiling. Signed-off-by: Mohamed Mediouni Reviewed-by: Pierrick Bouvier Tested-by: Pierrick Bouvier Link: https://lore.kernel.org/qemu-devel/20260210040722.11375-1-mohamed@unp= redictable.fr Signed-off-by: Pierrick Bouvier (cherry picked from commit b0353beebb0c4fa4059c88362561a8362ada8b4c) Signed-off-by: Michael Tokarev diff --git a/plugins/meson.build b/plugins/meson.build index 62c991d87f..222aed8c2e 100644 --- a/plugins/meson.build +++ b/plugins/meson.build @@ -41,9 +41,16 @@ if host_os =3D=3D 'windows' # to find missing symbols in current program. win32_qemu_plugin_api_link_flags =3D ['-Lplugins', '-lqemu_plugin_api'] if meson.get_compiler('c').get_id() =3D=3D 'clang' + if host_machine.cpu() =3D=3D 'x86_64' + dlltool_target =3D 'i386:x86-64' + elif host_machine.cpu() =3D=3D 'aarch64' + dlltool_target =3D 'arm64' + else + error('Unknown machine') + endif # With LLVM/lld, delaylib is specified at link time (-delayload) dlltool =3D find_program('llvm-dlltool', required: true) - dlltool_cmd =3D [dlltool, '-d', '@INPUT@', '-l', '@OUTPUT@', '-D', 'qe= mu.exe'] + dlltool_cmd =3D [dlltool, '-m', dlltool_target,'-d', '@INPUT@', '-l', = '@OUTPUT@', '-D', 'qemu.exe'] win32_qemu_plugin_api_link_flags +=3D ['-Wl,-delayload=3Dqemu.exe'] else # With gcc/ld, delay lib is built with a specific delay parameter. --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773241845; cv=none; d=zohomail.com; s=zohoarc; b=Gu0FexgNDTpbHG75EqE0nlQJ2SsEEbkBgN3/WElpjNQbpaVqnCgE0Ugrk+JoGmgxUngNmFZW11fEDxP+C7L+74T7VGGmXxFX4V36zbRCDe/S//11Vyn7ahBVanAn5vEOXXGUtXrHeRVbUZLntolIdZRSCZLEUjHHzr8jsqcazb4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773241845; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=UoGb0BKqTNLVbqMypWVdpjTUN53yHk/kila/Ec8DzfQ=; b=b/6Pg53BjivBuve2zAWFFz/lVbXZiZ9Yaexz19H+eBO5+iFiyRf+W9xhDpEzXLjUy0WK8OzBu208hXB2nZVPlVFt6mByfAG5CGHJvSxo/5taiCsmpoRDvZba3OtlFUX4hB2PZAj2fG4HNW9xWL674RQVPluExx/53Z0SE6OD2lI= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773241845081114.44999040818084; Wed, 11 Mar 2026 08:10:45 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LBI-0007bk-QU; Wed, 11 Mar 2026 11:09:05 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0L9G-0003tR-Ef; Wed, 11 Mar 2026 11:07:03 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0L9C-0004rm-6t; Wed, 11 Mar 2026 11:06:57 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 17F6C191E86; Wed, 11 Mar 2026 18:04:41 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 054D437C2C7; Wed, 11 Mar 2026 18:05:19 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241481; bh=29LT6J/dsLVkqfhdajZM0lyy+YR1nzRrR8wysJ6fTn8=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=AtJPj/8MddmNbLruhV8QZfeTv+0uzwdYBScJ9Qhb5UscMVqRrsXnHPfjRCoGkhvCg qOrqJ7M02KdWizJeHOqZo/QAqvfI7n335mEKIMFHGEDSiLNAkNnWD2oakqZtrL6oJh C98/XJFlUAQNIvnMPqhprZ29OYnLsCO7FE+sPy15DuX/uJO14vk075wgLkUAXsjrna RqBY3ZkaboafeBFr9Xk3nYXyKZ8YGdg6mfru79Pv8uEDLjCofDRtF2FDBkdxvyLob7 hKhZEATAd1q/pW7N2bj4yIl/sLGT5gG1gyQV5eUJlm5/fyhP4F2dS3rbf4J5nKuc5c Bu/2gXSOgNz9g== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Fiona Ebner , Vladimir Sementsov-Ogievskiy , Michael Tokarev Subject: [Stable-10.1.5 03/46] block/mirror: check range when setting zero bitmap for sync write Date: Wed, 11 Mar 2026 18:02:39 +0300 Message-ID: <20260311150327.1084669-3-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773241847494154100 Content-Type: text/plain; charset="utf-8" From: Fiona Ebner Some Proxmox users reported an occasional assertion failure [0][1] in busy VMs when using drive mirror with active mode. In particular, the failure may occur for zero writes shorter than the job granularity: > #0 0x00007b421154b507 in abort () > #1 0x00007b421154b420 in ?? () > #2 0x0000641c582e061f in bitmap_set (map=3D0x7b4204014e00, start=3D14, n= r=3D-1) > #3 0x0000641c58062824 in do_sync_target_write (job=3D0x641c7e73d1e0, > method=3DMIRROR_METHOD_ZERO, offset=3D852480, bytes=3D4096, qiov=3D= 0x0, flags=3D0) > #4 0x0000641c58062250 in bdrv_mirror_top_do_write (bs=3D0x641c7e62e1f0, method=3DMIRROR_METHOD_ZERO, copy_to_target=3Dtrue, offset=3D852480, bytes=3D4096, qiov=3D0x0, flags=3D0) > #5 0x0000641c58061f31 in bdrv_mirror_top_pwrite_zeroes (bs=3D0x641c7e62e= 1f0, offset=3D852480, bytes=3D4096, flags=3D0) The range for the dirty bitmap described by dirty_bitmap_offset and dirty_bitmap_end is narrower than the original range and in fact, dirty_bitmap_end might be smaller than dirty_bitmap_offset. There already is a check for 'dirty_bitmap_offset < dirty_bitmap_end' before resetting the dirty bitmap. Add such a check for setting the zero bitmap too, which uses the same narrower range. [0]: https://forum.proxmox.com/threads/177981/ [1]: https://bugzilla.proxmox.com/show_bug.cgi?id=3D7222 Cc: qemu-stable@nongnu.org Fixes: 7e277545b9 ("mirror: Skip writing zeroes when target is already zero= ") Signed-off-by: Fiona Ebner Message-ID: <20260112152544.261923-1-f.ebner@proxmox.com> Reviewed-by: Vladimir Sementsov-Ogievskiy Signed-off-by: Vladimir Sementsov-Ogievskiy (cherry picked from commit 4a7b1bd18d2e1a6b3796e177ae5df9b198264a0b) Signed-off-by: Michael Tokarev diff --git a/block/mirror.c b/block/mirror.c index b344182c74..bc982cb99a 100644 --- a/block/mirror.c +++ b/block/mirror.c @@ -1514,9 +1514,12 @@ do_sync_target_write(MirrorBlockJob *job, MirrorMeth= od method, assert(!qiov); ret =3D blk_co_pwrite_zeroes(job->target, offset, bytes, flags); if (job->zero_bitmap && ret >=3D 0) { - bitmap_set(job->zero_bitmap, dirty_bitmap_offset / job->granul= arity, - (dirty_bitmap_end - dirty_bitmap_offset) / - job->granularity); + if (dirty_bitmap_offset < dirty_bitmap_end) { + bitmap_set(job->zero_bitmap, + dirty_bitmap_offset / job->granularity, + (dirty_bitmap_end - dirty_bitmap_offset) / + job->granularity); + } } break; =20 --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773242057; cv=none; d=zohomail.com; s=zohoarc; b=eFSG3V7HsPw6J4+Rx1he0c0rG0nQFl4x+ma7JKBp1S2K0ayxUb+WS190p3csW96THOxfyrBJXslHtvzl5r6ClEx4p3npURhH9+AOP1+fKvw+U9TFV94IbSD+44OzL7BU5dR1L1HVuJtSmOSO4xdHM4kyqwTnE+CZKGX3tCex5iU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773242057; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=1Gz7kdd1tK0MuX1S+RI2jvuqkrKyKEPVescjxWN9BMY=; b=ZyRKn9kOV5hjqcqRBFxkaw5cNjXdFJaJbvIBDfggXQca1x2bJxHSySQsqTfGXy/g1NNIdY6M/NBf121jvGuG81IoCD0mcDnz/5puWpQz/2pD+OQv8L9qf6GlE8wCxpvNa1AO4Pc19GmkKUixsRHqLxvlZy+nUykMutmIiW0SCzI= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773242057352208.58265061730503; Wed, 11 Mar 2026 08:14:17 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LBk-0001B2-VI; Wed, 11 Mar 2026 11:09:33 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0L9I-0003tZ-TO; Wed, 11 Mar 2026 11:07:03 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0L9G-0004xM-H2; Wed, 11 Mar 2026 11:07:00 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 2B045191E87; Wed, 11 Mar 2026 18:04:41 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 1686437C2C8; Wed, 11 Mar 2026 18:05:19 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241481; bh=AkGdtL1378GuYkw9TJKFVH4lXWbLXsqU//G2VlqmrT0=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=aovRuT10/jfty8MxrmpY6NKCWrV16PAQy3co/wPTdSncNTXwP6l3GjJxJ38oE+1k9 9fIrs54vvNjB6MUSqSIgHrSOINCGKYxqe3EMjfeke1Uu8+2V8zO4AFFDdK9aSXD9fJ SM3jf1LI9EFbSvfQsb8mwrutmy89RvlV/dkcE9ML8/fBZvLjthvKYLS14g2EBzr5kE zaOXrgXSGxJbEjQSSuut1Y985ssg/Gq3Rvjy6Imfcx2LLIi9Zf3mv1fwmx6OgTsjts KWDtLy/U6k1bYXu54BSmQr4yWMCNTXsFxdrOhpbEUEtAo8Op23cS5EeiedmYKFYvR6 tKmWBP1SFADXw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Fiona Ebner , Vladimir Sementsov-Ogievskiy , Michael Tokarev Subject: [Stable-10.1.5 04/46] iotests: test active mirror with unaligned, small write zeroes op Date: Wed, 11 Mar 2026 18:02:40 +0300 Message-ID: <20260311150327.1084669-4-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773242058976154100 Content-Type: text/plain; charset="utf-8" From: Fiona Ebner This tests the scenario fixed by "block/mirror: check range when setting zero bitmap for sync write" [0]. [0] https://lore.kernel.org/qemu-devel/20260112152544.261923-1-f.ebner@prox= mox.com/ Signed-off-by: Fiona Ebner Message-ID: <20260120113859.251743-1-f.ebner@proxmox.com> Reviewed-by: Vladimir Sementsov-Ogievskiy Tested-by: Vladimir Sementsov-Ogievskiy Signed-off-by: Vladimir Sementsov-Ogievskiy (cherry picked from commit 267d7ae99a1d3b5be9d3421db3bdf651cc18c7ab) Signed-off-by: Michael Tokarev diff --git a/tests/qemu-iotests/151 b/tests/qemu-iotests/151 index 06ee3585db..9b9c815db5 100755 --- a/tests/qemu-iotests/151 +++ b/tests/qemu-iotests/151 @@ -191,6 +191,26 @@ class TestActiveMirror(iotests.QMPTestCase): =20 self.potential_writes_in_flight =3D False =20 + def testUnalignedSmallerThanGranularityWriteZeroes(self): + # Fill the source image + self.vm.hmp_qemu_io('source', 'write -P 1 0 %i' % self.image_len); + + # Start the block job + self.vm.cmd('blockdev-mirror', + job_id=3D'mirror', + filter_node_name=3D'mirror-node', + device=3D'source-node', + target=3D'target-node', + sync=3D'full', + copy_mode=3D'write-blocking') + + # Wait for the READY event + self.wait_ready(drive=3D'mirror') + + for offset in range(6 * self.image_len // 8, 7 * self.image_len //= 8, 1024 * 1024): + self.vm.hmp_qemu_io('source', 'aio_write -z %i 512' % (offset = + 512)) + + self.complete_and_wait(drive=3D'mirror', wait_ready=3DFalse) =20 class TestThrottledWithNbdExportBase(iotests.QMPTestCase): image_len =3D 128 * 1024 * 1024 # MB diff --git a/tests/qemu-iotests/151.out b/tests/qemu-iotests/151.out index 3f8a935a08..2f7d3902f2 100644 --- a/tests/qemu-iotests/151.out +++ b/tests/qemu-iotests/151.out @@ -1,5 +1,5 @@ -...... +....... ---------------------------------------------------------------------- -Ran 6 tests +Ran 7 tests =20 OK --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773242058; cv=none; d=zohomail.com; s=zohoarc; b=lEcCKahQLe+FHXENNTbep2LIOuhFgNqy61llgCdnnpjxO+KsNjMh3ZdM7L/Xop1q7zmRw+6EPV0wDGO0wGol8OBA0o1ftDAmpqa6OUKIKD68FBfa1w9yBKQUKgQec4483iyBQFznfjlnPgbNnMx0Av1X6uz0h2cGPwe6Y++99rU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773242058; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=okdMRNLivTqbv1+SQ1RagToGEgbaPtLSdDkoMAxfwP4=; b=TuoYc3K3azKr0q3nC8TZTA5an25d+PhZxnZJ77cts6EgpzOj3sTtld02GJI5DfH2lcjv47uFzPsoeqAkrg1YGpbhbAYZixN5bJjdihDR2H3Fw1ey54hylSagICEbsjuvINb0yKVsvcfJmgM14wsqBLwDpE2cliQalgPzKXDoj3g= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773242058640728.5046288923777; Wed, 11 Mar 2026 08:14:18 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LBA-00071p-QC; Wed, 11 Mar 2026 11:08:57 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0L9L-0003wy-Lz; Wed, 11 Mar 2026 11:07:06 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0L9I-0004xb-Uz; Wed, 11 Mar 2026 11:07:03 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 490CC191E88; Wed, 11 Mar 2026 18:04:41 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 2928537C2C9; Wed, 11 Mar 2026 18:05:19 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241481; bh=0uZ5ATjhIzDgyacoMi6E796UKRKgVRPT0yaUj1O9yhM=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=r5MyusYyCStSH+h2EmL0/1UmFxYTmGYCC05s0hHOdRVTkFG9KjvOr4Vq4B0r9v8g5 KwOMXWbtazWtPTeExRIKiSWeuQlPZLH5tH5HN+TkjyRpNCfmmzQt3muxhO0nm1xYsY Nk3WjRTtyEmOg4g4CZnVP04HrAtUedfpY+qUnF/89HCgeeGFOxPd2LR2GRp3cDdXNI OWrXQkfVls/TPXUZY00KU+mH7XVwEIgEhgZB/rcaazDW/zYFzy0Qq72K3MtZDYGjqp z6t4ymp198C7x3Yh3p1TtqWV7rF9kZBH2eq6HdXoyVdJ6a3cvoJVu3YFpTMFuXYSPz cG6ZoDqHe5GEg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, John Snow , Peter Maydell , Thomas Huth , Michael Tokarev Subject: [Stable-10.1.5 05/46] python: drop uses of pkg_resources Date: Wed, 11 Mar 2026 18:02:41 +0300 Message-ID: <20260311150327.1084669-5-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773242059681158500 Content-Type: text/plain; charset="utf-8" From: John Snow pkg_resources has been fully dropped from modern pip/setuptools distributions and we should phase out its use. This patch is enough to, by itself, repair most GitLab CI tests upstream; with the exception of tox tests which are still making use of avocado - which will be dropped in a separate series to restore functionality there. Signed-off-by: John Snow Suggested-by: Peter Maydell Message-ID: <20260211195804.135144-3-jsnow@redhat.com> Signed-off-by: Thomas Huth (cherry picked from commit e44a26ba940214824b61976324058e73d9f41658) Signed-off-by: Michael Tokarev diff --git a/python/setup.py b/python/setup.py index c5bc45919a..789fa39b0f 100755 --- a/python/setup.py +++ b/python/setup.py @@ -7,7 +7,6 @@ import setuptools from setuptools.command import bdist_egg import sys -import pkg_resources =20 =20 class bdist_egg_guard(bdist_egg.bdist_egg): @@ -30,9 +29,6 @@ def main(): QEMU tooling installer """ =20 - # https://medium.com/@daveshawley/safely-using-setup-cfg-for-metadata-= 1babbe54c108 - pkg_resources.require('setuptools>=3D39.2') - setuptools.setup(cmdclass=3D{'bdist_egg': bdist_egg_guard}) =20 =20 --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773242575; cv=none; d=zohomail.com; s=zohoarc; b=k71nwPYI1Yb0fZvxIP78ERe8VChDVlfpJEs7Mm3Knl/7rHAK2l34WUwCcUvOX4WBShanM0yLjqrSYDV8l5X+4C9i9xp2UUgYBj9iAVhLbLynSrgeo9KtcoAMi4Cj+kTVWZC6BYbhMFlMn9QsXC6NOvwWhVVPb4jk0VJr2GONwyA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773242575; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=wR+hUPyzcoaLr/0kiZZS1flGn03HnEHVpcuXjPmwacA=; b=j2SOPMOyykRCmOB7SUaBu86itoIZo26tv9nMLSRpUm1Q5R07Vmk0tm9G/Pweh2UyOZneV+G5ivLLWmhwcH0/dqQR1G4rGmtm3PyxGyin9g8m0eWz/0+/cl86WSxO9Dcr/uxvoigMXK5PFAQ8slTaETQhfz7W4EhyNCefPR/jJ10= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773242575017235.70355721807812; Wed, 11 Mar 2026 08:22:55 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LBL-0007r6-5K; Wed, 11 Mar 2026 11:09:07 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0L9M-0003x7-9j; Wed, 11 Mar 2026 11:07:06 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0L9K-0004xr-Df; Wed, 11 Mar 2026 11:07:03 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 5B04A191E89; Wed, 11 Mar 2026 18:04:41 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 472C537C2CA; Wed, 11 Mar 2026 18:05:19 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241481; bh=AREQ/dFnXzezlRlc40BNW1VnJ2gwDKJL+a4jQQus1S0=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=DCySK9BW6wmyKWSutjEWEw7veRgdOBWOWTnUL8exww5M3XdXH3D8f/B0F5+IeC/RQ OXidWZ934wXjnusW46CwLvEULuVBW/lbTS6wES3nOsWnBNc6LFP0nKCoCKyCww+piH 6G7fAZ14mP4t2K26dOuEWse+PwiYpp+QWY81SM7LqU56xThjVmMoTGSlW3tOVugS4H bfFuJGp++EOgpVhhZ3L9qTdCmoYA6pHqbF6C4qu6p9qaD0lSN40gKle8rWFmK7LHY5 sw+ufVK0XF60M37yT+8oge7uWN2ZrgN+WXwc6yBZ6r3FSPBJNNmb8nzhulavMwk5Iw xMKVdiQb4ZwEw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Alex Bradbury , Manos Pitsidianakis , Pierrick Bouvier , Michael Tokarev Subject: [Stable-10.1.5 06/46] contrib/plugins/hotblocks: Correctly free sorted counts list Date: Wed, 11 Mar 2026 18:02:42 +0300 Message-ID: <20260311150327.1084669-6-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773242577017158500 Content-Type: text/plain; charset="utf-8" From: Alex Bradbury g_list_free should be passed the head of the list. Signed-off-by: Alex Bradbury Reviewed-by: Manos Pitsidianakis Reviewed-by: Pierrick Bouvier Link: https://lore.kernel.org/qemu-devel/cf5a00136738b981a12270b76572e8d502= daf208.1753857212.git.asb@igalia.com Signed-off-by: Pierrick Bouvier (cherry picked from commit 90fabd5ddace6ffa5a62a5186201fd071b4e2b74) Signed-off-by: Michael Tokarev diff --git a/contrib/plugins/hotblocks.c b/contrib/plugins/hotblocks.c index 98404b6885..d3dd23ed9f 100644 --- a/contrib/plugins/hotblocks.c +++ b/contrib/plugins/hotblocks.c @@ -73,15 +73,16 @@ static void exec_count_free(gpointer key, gpointer valu= e, gpointer user_data) static void plugin_exit(qemu_plugin_id_t id, void *p) { g_autoptr(GString) report =3D g_string_new("collected "); - GList *counts, *it; + GList *counts, *sorted_counts, *it; int i; =20 g_string_append_printf(report, "%d entries in the hash table\n", g_hash_table_size(hotblocks)); counts =3D g_hash_table_get_values(hotblocks); - it =3D g_list_sort_with_data(counts, cmp_exec_count, NULL); + sorted_counts =3D g_list_sort_with_data(counts, cmp_exec_count, NULL); =20 - if (it) { + if (sorted_counts) { + it =3D sorted_counts; g_string_append_printf(report, "pc, tcount, icount, ecount\n"); =20 for (i =3D 0; i < limit && it->next; i++, it =3D it->next) { @@ -94,7 +95,7 @@ static void plugin_exit(qemu_plugin_id_t id, void *p) qemu_plugin_scoreboard_u64(rec->exec_count))); } =20 - g_list_free(it); + g_list_free(sorted_counts); } =20 qemu_plugin_outs(report->str); --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773241940; cv=none; d=zohomail.com; s=zohoarc; b=iyw9fvzirBfl0DmGOdkl09+txMtu1GlzErs/drtCCGact1YoTgtiOxZa1dbisVYxyS0Ku9CEQx+I6nQ8qllr30a0urAkKvBIopS+s/y7yHy0KX7JPnr2hQ93SVeUtLc/ASUr3T//AfJoNVmsVTcW+zzKk08A6TECX5/LLab33WQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773241940; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=Rq0QLobwwzhc6KsCt7U0KM3311LFEJkCaKJbPg2yi/w=; b=HKJlS1q4AiAygBx8MzW37RZk6rC2VXydyPFP1llBzXOP7BJ3H06KzFZRTAHyGsM1dMQm4NYdvPDWAFODRGafZEvfdwWaCdNDx9+fHJjDYofCpF86ezscyoOoJw0DYg6agl0Um80s3sGZnVNN3oXmBSyRzoj6Z4To/Q+MG1TYaVc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773241940597728.5957606290634; Wed, 11 Mar 2026 08:12:20 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LBr-0001ep-AE; Wed, 11 Mar 2026 11:09:39 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0L9n-0004K4-1E; Wed, 11 Mar 2026 11:07:38 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0L9h-0004yi-BD; Wed, 11 Mar 2026 11:07:28 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 6A991191E8A; Wed, 11 Mar 2026 18:04:41 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 5908037C2CB; Wed, 11 Mar 2026 18:05:19 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241481; bh=cfcf1z7/JpS4xZDWqSxPZgHSdgbv846o0KdJ0aeJQi0=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=xQsHag3kE+tM2lPWDMVEEGCAj2lBiGRGQt7cSK/XTSk/FQltHFLu9daQGbU2cOvCv RwmO/BDEhm5tk6csbKQ8MLLOWBF0B4RQwgG3L+DZ9UVSxb8fc5AlPcNvZzD4A4Akdt o/DmxPItlyRnmNUG84O4uWj8rNp/j3N1mSg8EoHuD5Z34Szc9/9Mr73vDHUYqIIzos 3kEP3s/xPoc2Fgan8kxBoo/gZnbCARQNprhJub+nIerAme7m7omOzsjVtnxez5SNyS 3+RMvukV5cfDWx3n3C6eq2tpHo4WS/sr3BXccZWMkoLB2SKY6RLrjtHFUMNrGkGYdc 2593zJIKnZkmA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Alex Bradbury , Pierrick Bouvier , Michael Tokarev Subject: [Stable-10.1.5 07/46] contrib/plugins/hotblocks: Fix off by one error in iteration of sorted blocks Date: Wed, 11 Mar 2026 18:02:43 +0300 Message-ID: <20260311150327.1084669-7-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773241940927158500 Content-Type: text/plain; charset="utf-8" From: Alex Bradbury The logic to iterate over the hottest blocks will never reach the last item in the list, as it checks `it->next !=3D NULL` before entering the loop. It's hard to trigger this off-by-one error with the default limit=3D20, but it is a bug and is problematic if that default is changed to something larger. Signed-off-by: Alex Bradbury Reviewed-by: Pierrick Bouvier Link: https://lore.kernel.org/qemu-devel/f1ba2e57c6126472c0c8310774009f2455= efc370.1753857212.git.asb@igalia.com Signed-off-by: Pierrick Bouvier (cherry picked from commit 1c1e45fcd66269f8a6dbd97fd7b8267d8f6f58af) Signed-off-by: Michael Tokarev diff --git a/contrib/plugins/hotblocks.c b/contrib/plugins/hotblocks.c index d3dd23ed9f..cf4d6b8c36 100644 --- a/contrib/plugins/hotblocks.c +++ b/contrib/plugins/hotblocks.c @@ -82,10 +82,9 @@ static void plugin_exit(qemu_plugin_id_t id, void *p) sorted_counts =3D g_list_sort_with_data(counts, cmp_exec_count, NULL); =20 if (sorted_counts) { - it =3D sorted_counts; g_string_append_printf(report, "pc, tcount, icount, ecount\n"); =20 - for (i =3D 0; i < limit && it->next; i++, it =3D it->next) { + for (i =3D 0, it =3D sorted_counts; i < limit && it; i++, it =3D i= t->next) { ExecCount *rec =3D (ExecCount *) it->data; g_string_append_printf( report, "0x%016"PRIx64", %d, %ld, %"PRId64"\n", --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773241920; cv=none; d=zohomail.com; s=zohoarc; b=BSQ6iurhm7oTnxz/6x//u8eIvPJgq8NYCXD9xjvqkRX8uuPEOSqvsiVOkgoQP8zD/cLfcV1+/TyTQtpeK4cuzJGQPR5EucruwxoWvOEhF6BAqzG9BlwWADA5LvJtG7dOYegCoJuewaCsyOV6OzRM2NEKCogLCJ/sqlBiZkAH/yo= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773241920; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=kkg8aUHyILWwQ3+0hqFTlPB6ypecqke33sQVMjes/Ww=; b=g1l+P1wLlckfKwkibnIQaF29zJ0dHfUAr4ng308cDQTgdK6jFU0QzlPH4W+fcIQU+3kvOE+zn4rqg9tBw0gUoJMp7sx0mtKzPg5N7JCB2ckicI+JCpV4AfDyAf7AdAPuOMvBRuEpko7Tzyo4GYgCTVowKqf5AU9wp+uzYaxUQCI= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773241920787273.729470733516; Wed, 11 Mar 2026 08:12:00 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LBX-000080-Dk; Wed, 11 Mar 2026 11:09:21 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0L9n-0004K5-1a; Wed, 11 Mar 2026 11:07:38 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0L9j-0004yv-QH; Wed, 11 Mar 2026 11:07:29 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 84FC3191E8B; Wed, 11 Mar 2026 18:04:41 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 67E4737C2CC; Wed, 11 Mar 2026 18:05:19 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241481; bh=FSMGlYph0E646l8xPKs1QSoOKQfE4LlZnojK7QnNiVY=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Ay9T1yZI47WRdKCUwgn16ksYctPPZMBDLUGDyJm5KUMGJqA9UPFT8922TCCODCLES ak17wFklOSzFia/GfwS+WDhFgHYeaLNHg3DWvN6S5rmPyg5sO2pcCiGRAPoYM22MHX /yQo9zlSbf07/wiJfmQV/doQTqPXh0COGeLAJhG5qdVoZQA98NDEUxMjfMaoT0FrMn WdWBkRH7lvN10lm62hWv+5ejkvlXaGj6VnJudHWzVzgKXpEL3y/BiixLT3T9v/S++7 G7DbhAnKE9mSa2wWoKn3B1+hd5WhpV6XqhzhDxVIcZ0dFsY8NQjm6D1iqqjRhjFArJ oEeb2aysjQU9Q== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Alex Bradbury , Manos Pitsidianakis , Pierrick Bouvier , Michael Tokarev Subject: [Stable-10.1.5 08/46] contrib/plugins/hotblocks: Print uint64_t with PRIu64 rather than PRId64 Date: Wed, 11 Mar 2026 18:02:44 +0300 Message-ID: <20260311150327.1084669-8-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773241922466154100 Content-Type: text/plain; charset="utf-8" From: Alex Bradbury qemu_plugin_u64_sum returns a uint64_t, so PRIu64 is the correct format specifier. Signed-off-by: Alex Bradbury Reviewed-by: Manos Pitsidianakis Reviewed-by: Pierrick Bouvier Link: https://lore.kernel.org/qemu-devel/5d26c9d99ee87ac4a4034ff64e3d888125= 3eedf3.1753857212.git.asb@igalia.com Signed-off-by: Pierrick Bouvier (cherry picked from commit e777f6ab91406884136b5679a9d64124832668d8) Signed-off-by: Michael Tokarev diff --git a/contrib/plugins/hotblocks.c b/contrib/plugins/hotblocks.c index cf4d6b8c36..40d8dae1cd 100644 --- a/contrib/plugins/hotblocks.c +++ b/contrib/plugins/hotblocks.c @@ -87,7 +87,7 @@ static void plugin_exit(qemu_plugin_id_t id, void *p) for (i =3D 0, it =3D sorted_counts; i < limit && it; i++, it =3D i= t->next) { ExecCount *rec =3D (ExecCount *) it->data; g_string_append_printf( - report, "0x%016"PRIx64", %d, %ld, %"PRId64"\n", + report, "0x%016"PRIx64", %d, %ld, %"PRIu64"\n", rec->start_addr, rec->trans_count, rec->insns, qemu_plugin_u64_sum( --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773241980; cv=none; d=zohomail.com; s=zohoarc; b=WEsxti/Ap/XXyxYTKNYXGtSTYXdhJm4lvcCjat3uLEefOWPLTMltglGhZCWKv0o9pl6aXqaXQ8naYBUqUW+rnkWuHz1eXEp2knhReRXgYnoOcEjJFojksjal8SKhG2gtqJpglR16k1qGJGI1iBh273k1JGRM1lIGHM5aDSHoM9U= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773241980; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=mhzeueCqVNGWpQAbNKo8AooJINJ5igjpmdfxK0jsjUI=; b=irOeOYnglHjM5kMb+h+qnOc0nWlFQlIa5uiqnP+xKLJqdV5WVXpMDB19YmdJlUguB6wmSXoGEMb1WZKzbrBFoSje0qV6rSUQ5PgYwh3LuRvE/nemp/JY8j3InLk1ugMeQ1U3X+2ixZjozaOQjJOuPYfqWP6djOXp2dV4p3erWZM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773241979985337.2306638848579; Wed, 11 Mar 2026 08:12:59 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LBr-0001ev-Aj; Wed, 11 Mar 2026 11:09:39 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0L9q-0004Ka-F2; Wed, 11 Mar 2026 11:07:39 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0L9p-0005NG-0I; Wed, 11 Mar 2026 11:07:34 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 9C81C191E8C; Wed, 11 Mar 2026 18:04:41 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 81FB137C2CD; Wed, 11 Mar 2026 18:05:19 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241481; bh=WFDBd59LDeMuZab62RqqgKOzLkJ6gBfNQUKMlGkvZNE=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=EstVVpZX0FM/XP7uGMB7GAgq0MxGDuGYfBzrm2Tzvj+W0zBUYbpKEYblLhtXfg+yH CAXn6BnsCsa2A/RVacsKrXclvaDDfj7lILZihVlzfu6n5/4tqwailrcElXfl6oI54v YGnd9/1/yYp/VJFP6mYDV5cu0hwl+kAbRjhKEiEKxkFdt6wIGn5lxOsqLSP9+GjnhB l9h1Nce5z4AxIEb9kpHqbjYUid/i+c//xzIYkk5Rm9IP8bV+IbcqPK2AfGqM6n3WaD RYZAvBcTnHNBSr/eX3prAvnZmXVwR/CKbQUYkI/kviUn29z076wwJWiJcRLsKJsjha DQGR3cTQ2fgwg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Alex Bradbury , Pierrick Bouvier , Michael Tokarev Subject: [Stable-10.1.5 09/46] docs/about/emulation: Add documentation for hotblocks plugin arguments Date: Wed, 11 Mar 2026 18:02:45 +0300 Message-ID: <20260311150327.1084669-9-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773241982822154100 Content-Type: text/plain; charset="utf-8" From: Alex Bradbury Currently just 'inline'. Signed-off-by: Alex Bradbury Reviewed-by: Pierrick Bouvier Link: https://lore.kernel.org/qemu-devel/35128cc5a86a0c18418f9d3150fb8771c5= 4ef7d8.1753857212.git.asb@igalia.com Signed-off-by: Pierrick Bouvier (cherry picked from commit e4ed74c9aef68cb2e7c10c2b7597fee5491a506a) Signed-off-by: Michael Tokarev diff --git a/docs/about/emulation.rst b/docs/about/emulation.rst index 456d01d5b0..9c963f4705 100644 --- a/docs/about/emulation.rst +++ b/docs/about/emulation.rst @@ -463,6 +463,16 @@ Example:: 0x000000004002b0, 1, 4, 66087 ... =20 +Behaviour can be tweaked with the following arguments: + +.. list-table:: Hot Blocks plugin arguments + :widths: 20 80 + :header-rows: 1 + + * - Option + - Description + * - inline=3Dtrue|false + - Use faster inline addition of a single counter. =20 Hot Pages ......... --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773241845; cv=none; d=zohomail.com; s=zohoarc; b=l1bRgJufmw4sVyzbcx4qDAxaoDGL5ggs/0h0Yc3nsn2JgpQ6COSysSePfpTx7kzmY4dam9uiHQlCrYgtCQT79n4AmYvK11Wk7IDaUdxCyvVPf3+fA8lZyNDZJwn3qnzFALqvQ06gFa1qgQoL2RiFHLRC/uru+YE7PK1IEEFFhMc= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773241845; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=/emhi+RMJR4D52cOf85+smcIzVpI0shy2Y+RZg1wWDI=; b=f0mQyzcuoRgPjAa6kmlHHoy4vwUEMsHBlSwADF5ejEldsduNEQjAllHglF3vaeBmP/J+C+Fsy9wK4nk2olF/xFifa4U0qSURSxY9jno73+b2dM8XEr8fcBSOB8x1PGk4aaCx7mlWxdbOiA7FuljdyFP6lz8PmB1Ge0g7JFAI5Z8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773241845620390.5680091720044; Wed, 11 Mar 2026 08:10:45 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LBs-0001lr-SS; Wed, 11 Mar 2026 11:09:41 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0L9q-0004Kb-QA; Wed, 11 Mar 2026 11:07:40 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0L9o-0005NL-W0; Wed, 11 Mar 2026 11:07:34 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id AAEAD191E8D; Wed, 11 Mar 2026 18:04:41 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 99C4C37C2CE; Wed, 11 Mar 2026 18:05:19 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241481; bh=yQnZjgyMz3ySbNBJU7G+jkBzponQ6pRrFaMlgEJtwFA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=j45f77DDIt6UyheXiIFKVj/jlT6PAv8AEeXx4L/pBC3Zi/gacCpf/rLzhL1JFXdaD 8JxgQ9c/sfmeItiyobzY5TlZUAE06be6cwLU1eUH22Cc38f84x2C26vtfC+TDwUTvn 3nFhJ29HygLL9CydM2vUm5cuK56mjPv0Vvq3zmNXhuRYe3YRImSlCm4CUFpRzPgMwo vKy76Boz+kllmybKeI8lSPx81C/IROYudRhUxEoPyXCg878V7bOeu4veqOgvMgDdCd PFDac/6gl2Sl3B/MWS90egpoz01SK0jCW1BAF4Cto11Clo72xln0lw8jWNLmlFbk4r CjM6mD008RVqw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Jamin Lin , =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= , Michael Tokarev Subject: [Stable-10.1.5 10/46] hw/i2c/aspeed_i2c: Fix out-of-bounds read in I2C MMIO handlers Date: Wed, 11 Mar 2026 18:02:46 +0300 Message-ID: <20260311150327.1084669-10-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773241846457158500 From: Jamin Lin The ASPEED I2C controller exposes a per-bus MMIO window of 0x80 bytes on AST2600/AST1030/AST2700, but the backing regs[] array was sized for only 28 dwords (0x70 bytes). This allows guest reads in the range [0x70..0x7f] to index past the end of regs[]. Fix this by: - Sizing ASPEED_I2C_NEW_NUM_REG to match the 0x80-byte window (0x80 >> 2 =3D 32 dwords). - Avoiding an unconditional pre-read from regs[] in the legacy/new read handlers. Initialize the return value to -1 and only read regs[] for offsets that are explicitly handled/valid, leaving invalid offsets to return -1 with a guest error log. Signed-off-by: Jamin Lin Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3290 Reviewed-by: C=C3=A9dric Le Goater Link: https://lore.kernel.org/qemu-devel/20260210024331.3984696-2-jamin_lin= @aspeedtech.com Signed-off-by: C=C3=A9dric Le Goater (cherry picked from commit c2c5beec42bf9872b37e78b9e259132df7435cb5) Signed-off-by: Michael Tokarev diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c index c48fa2050b..c455c3eb7c 100644 --- a/hw/i2c/aspeed_i2c.c +++ b/hw/i2c/aspeed_i2c.c @@ -94,7 +94,7 @@ static uint64_t aspeed_i2c_bus_old_read(AspeedI2CBus *bus= , hwaddr offset, unsigned size) { AspeedI2CClass *aic =3D ASPEED_I2C_GET_CLASS(bus->controller); - uint64_t value =3D bus->regs[offset / sizeof(*bus->regs)]; + uint64_t value =3D -1; =20 switch (offset) { case A_I2CD_FUN_CTRL: @@ -105,7 +105,7 @@ static uint64_t aspeed_i2c_bus_old_read(AspeedI2CBus *b= us, hwaddr offset, case A_I2CD_DEV_ADDR: case A_I2CD_POOL_CTRL: case A_I2CD_BYTE_BUF: - /* Value is already set, don't do anything. */ + value =3D bus->regs[offset / sizeof(*bus->regs)]; break; case A_I2CD_CMD: value =3D SHARED_FIELD_DP32(value, BUS_BUSY_STS, i2c_bus_busy(bus-= >bus)); @@ -113,21 +113,20 @@ static uint64_t aspeed_i2c_bus_old_read(AspeedI2CBus = *bus, hwaddr offset, case A_I2CD_DMA_ADDR: if (!aic->has_dma) { qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n", __func= __); - value =3D -1; break; } + value =3D bus->regs[offset / sizeof(*bus->regs)]; break; case A_I2CD_DMA_LEN: if (!aic->has_dma) { qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n", __func= __); - value =3D -1; + break; } + value =3D bus->regs[offset / sizeof(*bus->regs)]; break; - default: qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, off= set); - value =3D -1; break; } =20 @@ -139,7 +138,7 @@ static uint64_t aspeed_i2c_bus_new_read(AspeedI2CBus *b= us, hwaddr offset, unsigned size) { AspeedI2CClass *aic =3D ASPEED_I2C_GET_CLASS(bus->controller); - uint64_t value =3D bus->regs[offset / sizeof(*bus->regs)]; + uint64_t value =3D -1; =20 switch (offset) { case A_I2CC_FUN_CTRL: @@ -159,13 +158,12 @@ static uint64_t aspeed_i2c_bus_new_read(AspeedI2CBus = *bus, hwaddr offset, case A_I2CS_CMD: case A_I2CS_INTR_CTRL: case A_I2CS_DMA_LEN_STS: - /* Value is already set, don't do anything. */ + case A_I2CS_INTR_STS: + value =3D bus->regs[offset / sizeof(*bus->regs)]; break; case A_I2CC_DMA_ADDR: value =3D extract64(bus->dma_dram_offset, 0, 32); break; - case A_I2CS_INTR_STS: - break; case A_I2CM_CMD: value =3D SHARED_FIELD_DP32(value, BUS_BUSY_STS, i2c_bus_busy(bus-= >bus)); break; @@ -176,13 +174,13 @@ static uint64_t aspeed_i2c_bus_new_read(AspeedI2CBus = *bus, hwaddr offset, if (!aic->has_dma64) { qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA 64 bits support\n", __func__); - value =3D -1; + break; } + value =3D bus->regs[offset / sizeof(*bus->regs)]; break; default: qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, off= set); - value =3D -1; break; } =20 diff --git a/include/hw/i2c/aspeed_i2c.h b/include/hw/i2c/aspeed_i2c.h index 2daacc10ce..efe8b1a0c5 100644 --- a/include/hw/i2c/aspeed_i2c.h +++ b/include/hw/i2c/aspeed_i2c.h @@ -36,8 +36,7 @@ OBJECT_DECLARE_TYPE(AspeedI2CState, AspeedI2CClass, ASPEE= D_I2C) #define ASPEED_I2C_NR_BUSSES 16 #define ASPEED_I2C_SHARE_POOL_SIZE 0x800 #define ASPEED_I2C_BUS_POOL_SIZE 0x20 -#define ASPEED_I2C_OLD_NUM_REG 11 -#define ASPEED_I2C_NEW_NUM_REG 28 +#define ASPEED_I2C_NEW_NUM_REG (0x80 >> 2) =20 #define A_I2CD_M_STOP_CMD BIT(5) #define A_I2CD_M_RX_CMD BIT(3) --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773241802; cv=none; d=zohomail.com; s=zohoarc; b=cwAmJSiUxlvhpMh0H1CkyjWd5QYkf3aVDq2Sf505ZFWn+9j7LgvoXVh5ScWzhhERxKo/+jsvrS/EMSGH+dyUlbufMHTB/7j6YREYDmpt/E43Zta6wKtirJaV/x5/T4R9sYq7h29H7IxL6xZkGl2c8UCJF8D4CzvXrBbjk9Mhpm0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773241802; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=uYPX5EcW2XMFFFTSWLrXs0CD0H8qjD9DJE4ILv92+p4=; b=VTgk9bxNDOF2Ln87KgsfM1KBvYgVheEGu8vu0kenX+zEMccUiiZx8GiG8oqFrVdbJLB99m8TGkF391DMY5Qm0tw1/yMUb6460H0ZxEc+NXa+J+oCDgyyM1yZmcCrL0hehDZAVW/snL68lWSwtmQFw0PACkexB/HsPca6WD4FIbw= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773241802028456.75643274957974; Wed, 11 Mar 2026 08:10:02 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LBf-0000at-AV; Wed, 11 Mar 2026 11:09:27 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0L9x-0004Pc-Oc; Wed, 11 Mar 2026 11:07:43 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0L9t-0005Pc-L8; Wed, 11 Mar 2026 11:07:40 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id BC9D8191E8E; Wed, 11 Mar 2026 18:04:41 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id A80FF37C2CF; Wed, 11 Mar 2026 18:05:19 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241481; bh=FB4jjS7oGuteuSerXx9FNPqkF7kbcDZLD/fyDh8Zzks=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=IxxosI9SSHdyBEiR3wFKx+u+M5UOxfEdjlzcFUmi6Brle804THNBu0Q7/2Ra9RX3R yI9WW3EhV2fnCBi91P6lwD9oVXsSQLg+YUsCzCzRxVsg15bAmVPTlL5Q1wZBTAHf/d 9CKU0FyN4JOfDb8AfH4R+qvVEcB99LYjGJPTtyJ3h9HiijLzOI6YZ13UYiB35vDGA4 azU3J7ZQVXlsWcdWmkRXgdLc+LV+9kqkyS7tCMbPywOVXz7D7mkEJgqdsrfZGsIlkB Q5PI2vBhjfdtyURvyvUBd+0eA1oicIcT8fL/cM5VjeAFPdJf5vefyQR5a+SUnhtvix 9Y0nNn7CDKYOg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?UTF-8?q?Alex=20Benn=C3=A9e?= , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Richard Henderson , Michael Tokarev Subject: [Stable-10.1.5 11/46] target/arm: Account for SME in aarch64_sve_narrow_vq() assertion Date: Wed, 11 Mar 2026 18:02:47 +0300 Message-ID: <20260311150327.1084669-11-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773241804039158500 From: Peter Maydell In aarch64_sve_narrow_vq() we assert that the new VQ is within the maximum supported range for the CPU. We forgot to update this to account for SME, which might have a different maximum. Update the assert to permit any VQ which is valid for either SVE or SME. Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell Reviewed-by: Alex Benn=C3=A9e Reviewed-by: Philippe Mathieu-Daud=C3=A9 Reviewed-by: Richard Henderson Message-id: 20260202133353.2231685-2-peter.maydell@linaro.org (cherry picked from commit 42eab40a12f12f044a5ca7b7d889d9a1f0d172ee) Signed-off-by: Michael Tokarev diff --git a/target/arm/helper.c b/target/arm/helper.c index 318452d816..518c0c191f 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -9660,7 +9660,7 @@ void aarch64_sve_narrow_vq(CPUARMState *env, unsigned= vq) uint64_t pmask; =20 assert(vq >=3D 1 && vq <=3D ARM_MAX_VQ); - assert(vq <=3D env_archcpu(env)->sve_max_vq); + assert(vq <=3D arm_max_vq(env_archcpu(env))); =20 /* Zap the high bits of the zregs. */ for (i =3D 0; i < 32; i++) { diff --git a/target/arm/internals.h b/target/arm/internals.h index 1b3d0244fd..36fa5c3d40 100644 --- a/target/arm/internals.h +++ b/target/arm/internals.h @@ -1881,6 +1881,15 @@ static inline uint64_t arm_mdcr_el2_eff(CPUARMState = *env) ((1 << (1 - 1)) | (1 << (2 - 1)) | \ (1 << (4 - 1)) | (1 << (8 - 1)) | (1 << (16 - 1))) =20 +/* + * Return the maximum SVE/SME VQ for this CPU. This defines + * the maximum possible size of the Zn vector registers. + */ +static inline int arm_max_vq(ARMCPU *cpu) +{ + return MAX(cpu->sve_max_vq, cpu->sme_max_vq); +} + /* * Return true if it is possible to take a fine-grained-trap to EL2. */ --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773242576; cv=none; d=zohomail.com; s=zohoarc; b=T0k0ILbhKShmzH69efagdDqMixKLTuQ8nH+5wXVyjXofk4qwAreaj8+I+Ica9Rcoc99IonY9QxYh42HtdENuizAN6LgOKLFqxDInbzysKbGPPTS3Q70xOeF+tyBFCyazWOsEpyTYL0vF0kPPgQZg+NdV6SD3m+dAt4d531xaX6M= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773242576; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=2vYwLVRjBSbd1Wmjc9FY2xdiPj8JuNKe22MpvM5ZP/8=; b=QlXWxrscumU+P5RNaCBLIX06B3aTesTodUhKnYHxagiubfiKyoA8GHMac65PAxRTQJ/2/da4QrBmHXv9prX8NCaNoDagLR39kVvS2SQes2t1yCUWzk7qLKOSZiIC+btgbB/6hsfn+/5nVre09bJe+DEYY++ZfRx+/+pM4xkw9Og= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773242576580508.9453185876133; Wed, 11 Mar 2026 08:22:56 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LBv-0001uS-C5; Wed, 11 Mar 2026 11:09:43 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LAG-00050A-B8; Wed, 11 Mar 2026 11:08:02 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LAE-0005Pk-PN; Wed, 11 Mar 2026 11:08:00 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id CB89A191E8F; Wed, 11 Mar 2026 18:04:41 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id B9E8737C2D0; Wed, 11 Mar 2026 18:05:19 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241481; bh=YtDoghmkkyVJMChQomssBGKozuJ8XG9j41PlyEXUoaY=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=oILzqdkb1eXsLcdZlbwUP7sjBItwGinpCzgPRsu/pITlfiZpiHciTQT/tC88RFysk uOJj0FAUgTRbAtDpH1NWcLpTZoCtaN5DAc8eLa13r29eYkI08bE7CqCjPLVPdl/fYt kPs2y1zUbpKynDmdSmsv9m1IAqd0nnsm04ENUCsfQCRNteKhzqN5W9CA4N3NzPRQMZ jTzna6I+TIM6GmiG7bhS4Fy88tehwodTzaCcxGNan4Wp7yffjyGQnO1rM1obyptS9G kA7Z00luh0YMJgproEIDMco9oNuF18tVUemOivgLeELKToskqnQhDioGPWmAxkroIG lIUZnUiArovDQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , Richard Henderson , Manos Pitsidianakis , Michael Tokarev Subject: [Stable-10.1.5 12/46] target/arm: Fix feature check in DO_SVE2_RRX, DO_SVE2_RRX_TB Date: Wed, 11 Mar 2026 18:02:48 +0300 Message-ID: <20260311150327.1084669-12-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773242579276154100 Content-Type: text/plain; charset="utf-8" From: Peter Maydell In the macros DO_SVE2_RRX and DO_SVE2_RRX_TB we use the feature check aa64_sve, thus exposing this set of instructions in SVE as well as SVE2. Use aa64_sve2 instead, so they UNDEF on an SVE1-only CPU as they should. Strictly, the condition here should be "SVE2 or SME"; but we will correct that in a following commit with all the other missing "or SME" checks. Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell Reviewed-by: Richard Henderson Reviewed-by: Manos Pitsidianakis Message-id: 20260202133353.2231685-4-peter.maydell@linaro.org (cherry picked from commit ee5bf0962ed6e0eb42d6bc9bfb3687f2408e3580) Signed-off-by: Michael Tokarev diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c index 07b827fa8e..d69a2f5d75 100644 --- a/target/arm/tcg/translate-sve.c +++ b/target/arm/tcg/translate-sve.c @@ -3769,7 +3769,7 @@ TRANS_FEAT(UDOT_zzxw_2s, aa64_sme2_or_sve2p1, gen_gve= c_ool_arg_zzxz, gen_helper_gvec_udot_idx_2h, a) =20 #define DO_SVE2_RRX(NAME, FUNC) \ - TRANS_FEAT(NAME, aa64_sve, gen_gvec_ool_zzz, FUNC, \ + TRANS_FEAT(NAME, aa64_sve2, gen_gvec_ool_zzz, FUNC, \ a->rd, a->rn, a->rm, a->index) =20 DO_SVE2_RRX(MUL_zzx_h, gen_helper_gvec_mul_idx_h) @@ -3787,7 +3787,7 @@ DO_SVE2_RRX(SQRDMULH_zzx_d, gen_helper_sve2_sqrdmulh_= idx_d) #undef DO_SVE2_RRX =20 #define DO_SVE2_RRX_TB(NAME, FUNC, TOP) \ - TRANS_FEAT(NAME, aa64_sve, gen_gvec_ool_zzz, FUNC, \ + TRANS_FEAT(NAME, aa64_sve2, gen_gvec_ool_zzz, FUNC, \ a->rd, a->rn, a->rm, (a->index << 1) | TOP) =20 DO_SVE2_RRX_TB(SQDMULLB_zzx_s, gen_helper_sve2_sqdmull_idx_s, false) --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773242305; cv=none; d=zohomail.com; s=zohoarc; b=e21zIVKOmPdULVHgUMrbU8aUIvQEQCLxPnz/oRZL8v8xB8vMcmBhcMv5fKrcW6UQY8ng5v5xqWaemQie4Sz+E/R0SgUDOyB7oK/xty6mWXyQM1I1DqsfEZYoRvRGa+Waf4q9lUw/BRA1ALa5tlFbejc/z25tA6pr5Mco5b9hzJs= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773242305; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=YIkTZSdBUXUkc3x0t7zCIx3G5zraFIHZDSqMp1iy424=; b=QyhPpvBTe5xzhbT5PU5icBJTkSJlEPtIohiMg4J7NyZ/K552zPIvgsxX1wAe2C7T8rGq7xHpOdPTS0IFyQE59RJI9V84uN0GOJEQEBSmvpXkVb59M3jElBRunHnSOvl0G6gykoX3IbO3iAk1jQfgubJRUwV0cntPVvxYXMBghxQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773242305355670.2058931774185; Wed, 11 Mar 2026 08:18:25 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LBo-0001Ux-Ht; Wed, 11 Mar 2026 11:09:36 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LAK-00055q-VP; Wed, 11 Mar 2026 11:08:09 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LAJ-0005Sw-DC; Wed, 11 Mar 2026 11:08:04 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id DA990191E90; Wed, 11 Mar 2026 18:04:41 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id C8D0237C2D1; Wed, 11 Mar 2026 18:05:19 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241481; bh=E3cGNeFeUOznE9BBJTE5+LSH/VZ5Z74D9SNno9Uqbrg=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=TEG1gsecXPEhLb/TBppUtkMRVtQtiNx9/fkNtRyzskcUuGAcgOCTU+I3tkShB4mqg PcACnJDtAyZqQ5shGpI+YkcUpHaMuww7UGT/3q8efbm4zoeWbcd0QmDhvzZFrwLr4A uG/GjjBF638O/5l4lHuTHNAtnruIVAQztwaKs7p48m7JmP34bVNAx/JvGqsUfSqPWK qg5KmwR2WiLJd/6fuxkEvFjP7k9rg/Il4pDRmMtDQ1ybU0Pf96p6fM1vRRKw1FSxLm COIiKx6V8yMe8aowlnbHbtHLppTrqp2hkjesRznqpCSg6PjTstGe/v1w8JTjISBkUc HlraiVubJdOCg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , Richard Henderson , Michael Tokarev Subject: [Stable-10.1.5 13/46] target/arm/tcg: Allow SVE RAX1 in SME2p1 streaming mode Date: Wed, 11 Mar 2026 18:02:49 +0300 Message-ID: <20260311150327.1084669-13-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773242307274158500 Content-Type: text/plain; charset="utf-8" From: Peter Maydell The SVE RAX1 instruction is permitted in SME streaming mode starting from SME2p1. We forgot to allow this relaxation when we implemented SME2p1. Cc: qemu-stable@nongnu.org Fixes: 7b1613a1020d2 ("target/arm: Enable FEAT_SME2p1 on -cpu max") Signed-off-by: Peter Maydell Reviewed-by: Richard Henderson Message-id: 20260202133353.2231685-5-peter.maydell@linaro.org (cherry picked from commit 433097a2242120918090201129e5fbb8e16b3e34) Signed-off-by: Michael Tokarev diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c index d69a2f5d75..76e4a6c52c 100644 --- a/target/arm/tcg/translate-sve.c +++ b/target/arm/tcg/translate-sve.c @@ -7803,8 +7803,17 @@ TRANS_FEAT_NONSTREAMING(SM4E, aa64_sve2_sm4, gen_gve= c_ool_arg_zzz, TRANS_FEAT_NONSTREAMING(SM4EKEY, aa64_sve2_sm4, gen_gvec_ool_arg_zzz, gen_helper_crypto_sm4ekey, a, 0) =20 -TRANS_FEAT_NONSTREAMING(RAX1, aa64_sve2_sha3, gen_gvec_fn_arg_zzz, - gen_gvec_rax1, a) +static bool trans_RAX1(DisasContext *s, arg_RAX1 *a) +{ + if (!dc_isar_feature(aa64_sve2_sha3, s)) { + return false; + } + if (!dc_isar_feature(aa64_sme2p1, s)) { + /* SME2p1 adds this as valid in streaming SVE mode */ + s->is_nonstreaming =3D true; + } + return gen_gvec_fn_arg_zzz(s, gen_gvec_rax1, a); +} =20 TRANS_FEAT(FCVTNT_sh, aa64_sve2, gen_gvec_fpst_arg_zpz, gen_helper_sve2_fcvtnt_sh, a, 0, FPST_A64) --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773242422; cv=none; d=zohomail.com; s=zohoarc; b=GNzUk8/ZQcSyDkCuKTssO35JhxkKfhDpsXZs8pu4Y4AVO+RKNvj9yTOvuWDmFEFyMklz6VxhNoEkogEEO7p3IRNRGwUq5DODyZpCpTqNQGvtdfjDPXrC7z8RN0dfRsRaglRXhiF5kEMslbq4mVIxzVyrlO0SpZ5RCy5rgFSde4A= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773242422; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=UImrmbzQXV0nCRtWtpZ5h7uMzbj7VBLQMrelWEhNVro=; b=Ryyp8l5TDsBMlYSUuTgVhUxekMGGiR7/ckIu4SPV4AWq+DGJF6ePk+gD29om8oe29TFh9jsUtZ2BCpjCLvlshNF19mXusyeYfD1p+Pr/0pudrabhdTKnygAUWpEQ1NO2TMKdcIvv4RS7vEsjXxklNR3wRepLtQL4qG7hxcHJt5Q= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773242422677200.622598753773; Wed, 11 Mar 2026 08:20:22 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LBu-0001q6-VR; Wed, 11 Mar 2026 11:09:43 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LAJ-00053w-FM; Wed, 11 Mar 2026 11:08:05 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LAH-0005Wx-Qv; Wed, 11 Mar 2026 11:08:03 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id EC002191E91; Wed, 11 Mar 2026 18:04:41 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id D8B3A37C2D2; Wed, 11 Mar 2026 18:05:19 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241481; bh=NdhzromMZdMHzC5HcOa4NW5LzPrFNoc2g+/F4uDGNmE=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=XTD7QTUaqsE50Ol8eaAPJNuye43z09tNfr+2ut6YCc3+lb6YLh6SxnVDW98PMen26 bkEQVW3j716gNhAa+Jf6SLHXgVomv3KpW4EpWDeXzsicS+elB27vPVsvh/6e9JjEpt cfrmdudJmV8MdRjDQ9Xxh/FSp8hnVjslUccpCIUZX4VszFnPw1gUtYvM9h2KVQenxl ZProcWAGecBbeWN8V1XTMED/QgoJJZQXI8+ke5RK/G1KOYduQ6c/PuiFaPAFaZfNg5 Pn+bFoz1PtWfAuOHbm4JXk4Z63NbkU7/2uzy3UsbBYZ+TwZ/QlWdCszBMoH+ZNbkal d3JrEOHJOIlsg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , Richard Henderson , Manos Pitsidianakis , Michael Tokarev Subject: [Stable-10.1.5 14/46] target/arm: Don't let 'sme=on' downgrade SME Date: Wed, 11 Mar 2026 18:02:50 +0300 Message-ID: <20260311150327.1084669-14-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773242424002158500 Content-Type: text/plain; charset="utf-8" From: Peter Maydell In our handling of the boolean 'sme' CPU property, we write this 0/1 value directly to ID_AA64PFR1_EL1.SME. This worked when the only valid values in that field were 0 (for no SME) and 1 (for SME1). However, with the addition of SME2 the SME field can now also read 2. This means that "-cpu max,sme=3Don" will result in an inconsistent set of ID registers, where ID_AA64PFR1_EL1.SME claims SME1 but ID_AA64SMFR0_EL1.SMEver claims SME2p1. This isn't a valid thing to report, and confuses Linux into reporting SME2 to userspace but not actually enabling userspace access for it. Fix this bug by having arm_cpu_sme_finalize() fix up the ID_AA64PFR1_EL1.SME field to match ID_AA64SMFR0.SMEver. This means the "sme" property's semantics are "off" for "no SME" and "on" for "enable at whatever the default SME version this CPU provides is". Update the documentation to clarify what 'sve=3Don' and 'sme=3Don' do. (We don't have the equivalent bug for 'sve=3Don' because ID_AA64PFR0_EL1.SVE only has 0 and 1 as valid values, but the semantics of the property are the same.) Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell Reviewed-by: Richard Henderson Reviewed-by: Manos Pitsidianakis Message-id: 20260202133353.2231685-6-peter.maydell@linaro.org (cherry picked from commit aeb3c147fc4a1eb9a73f9f10923fc06def088aeb) Signed-off-by: Michael Tokarev diff --git a/docs/system/arm/cpu-features.rst b/docs/system/arm/cpu-feature= s.rst index 37d5dfd15b..024119449c 100644 --- a/docs/system/arm/cpu-features.rst +++ b/docs/system/arm/cpu-features.rst @@ -318,6 +318,11 @@ SVE CPU Property Parsing Semantics provided an error will be generated. To avoid this error, one must enable at least one vector length prior to enabling SVE. =20 + 10) Enabling SVE (with ``sve=3Don`` or by default) enables all the SVE + sub-features that the CPU supports (for example, it may also + enable SVE2). There are not generally any lower-level controls + for disabling specific SVE sub-features. + SVE CPU Property Examples ------------------------- =20 @@ -430,6 +435,11 @@ and all vector lengths must be powers of 2. The maxim= um vector length supported by qemu is 2048 bits. Otherwise, there are no additional constraints on the set of vector lengths supported by SME. =20 +As with SVE, ``sme=3Don`` enables all the SME sub-features the CPU +supports (for example, it may also enable SME2), and there are +no lower-level controls for fine-grained disabling of specific +SME sub-features. + SME User-mode Default Vector Length Property -------------------------------------------- =20 diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c index 26cf7e6dfa..057e9fa431 100644 --- a/target/arm/cpu64.c +++ b/target/arm/cpu64.c @@ -364,6 +364,16 @@ void arm_cpu_sme_finalize(ARMCPU *cpu, Error **errp) =20 cpu->sme_vq.map =3D vq_map; cpu->sme_max_vq =3D 32 - clz32(vq_map); + + /* + * The "sme" property setter writes a bool value into ID_AA64PFR1_EL1.= SME + * (and at this point we know it's not 0). Correct that value to report + * the same SME version as ID_AA64SMFR0_EL1.SMEver. + */ + if (FIELD_EX64_IDREG(&cpu->isar, ID_AA64SMFR0, SMEVER) !=3D 0) { + /* SME2 or better */ + FIELD_DP64_IDREG(&cpu->isar, ID_AA64PFR1, SME, 2); + } } =20 static bool cpu_arm_get_sme(Object *obj, Error **errp) @@ -376,6 +386,11 @@ static void cpu_arm_set_sme(Object *obj, bool value, E= rror **errp) { ARMCPU *cpu =3D ARM_CPU(obj); =20 + /* + * For now, write 0 for "off" and 1 for "on" into the PFR1 field. + * We will correct this value to report the right SME + * level (SME vs SME2) in arm_cpu_sme_finalize() later. + */ FIELD_DP64_IDREG(&cpu->isar, ID_AA64PFR1, SME, value); } =20 --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773241940; cv=none; d=zohomail.com; s=zohoarc; b=BUSpZ5qR8V5csFulK23u5EZIJPgayEFC6jMwo2LkJi/Ncf48GZskZ6QS44CWZFG21oG5Wieoz2ZVgy5p04SbeMZ9MCuwXBs0t2D/NcFxxDMPnavpLZTJrVX7H2UIVrdxCp/QIni90j8QFsUhyYWEY5tKCImTekibSKDWBDsCHL4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773241940; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=bqPC3vrxNuGDKf7z6T1UaFpDqZ6I4fCnbFesn89uZgs=; b=VbIEphziOfDQRqe1KR55fJMK/1LKYgV7GMi35kSdI5JqUUIbYNbHXWThn68lPyNYbram1Ly7FRuxKnbKjdXSXXOSsP2+5xmZ07l1edude1zhn9K/BYH0OMVThl9D8IcjOEgYCZ+n9wQdWdLT4+qrNB6QYBR2+reEj79hkmdVX8w= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773241940522627.0549080380514; Wed, 11 Mar 2026 08:12:20 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LBm-0001LT-JM; Wed, 11 Mar 2026 11:09:34 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LAN-00057V-He; Wed, 11 Mar 2026 11:08:09 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LAL-0005Xs-0L; Wed, 11 Mar 2026 11:08:06 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 0A120191E92; Wed, 11 Mar 2026 18:04:42 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id EA3AC37C2D3; Wed, 11 Mar 2026 18:05:19 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241482; bh=B7Xyma4ORPJwDb6eJyWXh/OIOtfS6PL1qPgGD/rPWWQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=nlxO+dMd8N3EPoGcvaP9VnCT+2eAuoqzQDgJo80JBjGA6gZoW+E/rlSPZySvclH9g vcx/7btBKnxqJCcQMpDfll3yFGrXxCYQkvOzIfqbT6BTDY2LWd309onZeVoctDvGxe BNw/JErBwiESj/kOMYCpz4UvnXouVFSxlUPRP4IwrBnlHk3gjKMDue635qObyTVdtl FTcPE6nOShEB0k1YtE9j4F0Tug8tdzLBWTfq8Jd2tUwifMaPYDF3coe4esu2hBgALi mJMjAhwtQ9OKAI+YqfSorEfsUlLHLJWW8Uy7ziG9LxKAKZYFvhY5LVsRoABJZhFFUJ OlFvokwRW1QjQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Akihiko Odaki , Dmitry Osipenko , Joelle van Dyne , "Michael S. Tsirkin" , Michael Tokarev Subject: [Stable-10.1.5 15/46] virtio-gpu-virgl: Add virtio-gpu-virgl-hostmem-region type Date: Wed, 11 Mar 2026 18:02:51 +0300 Message-ID: <20260311150327.1084669-15-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773241943627154100 Content-Type: text/plain; charset="utf-8" From: Akihiko Odaki Commit e27194e087ae ("virtio-gpu-virgl: correct parent for blob memory region") made the name member of MemoryRegion unset, causing a NULL pointer dereference[1]: > Thread 2 "qemu-system-x86" received signal SIGSEGV, Segmentation fault. > (gdb) bt > #0 0x00007ffff56565e2 in __strcmp_evex () at /lib64/libc.so.6 > #1 0x0000555555841bdb in find_fd (head=3D0x5555572337d0 , > name=3D0x0, id=3D0) at ../migration/cpr.c:68 > #2 cpr_delete_fd (name=3Dname@entry=3D0x0, id=3Did@entry=3D0) at > ../migration/cpr.c:77 > #3 0x000055555582290a in qemu_ram_free (block=3D0x7ff7e93aa7f0) at > ../system/physmem.c:2615 > #4 0x000055555581ae02 in memory_region_finalize (obj=3D) > at ../system/memory.c:1816 > #5 0x0000555555a70ab9 in object_deinit (obj=3D, > type=3D) at ../qom/object.c:715 > #6 object_finalize (data=3D0x7ff7e936eff0) at ../qom/object.c:729 > #7 object_unref (objptr=3D0x7ff7e936eff0) at ../qom/object.c:1232 > #8 0x0000555555814fae in memory_region_unref (mr=3D) at > ../system/memory.c:1848 > #9 flatview_destroy (view=3D0x555559ed6c40) at ../system/memory.c:301 > #10 0x0000555555bfc122 in call_rcu_thread (opaque=3D) at > ../util/rcu.c:324 > #11 0x0000555555bf17a7 in qemu_thread_start (args=3D0x555557b99520) at > ../util/qemu-thread-posix.c:393 > #12 0x00007ffff556f464 in start_thread () at /lib64/libc.so.6 > #13 0x00007ffff55f25ac in __clone3 () at /lib64/libc.so.6 The intention of the aforementioned commit is to prevent a MemoryRegion from parenting itself while its references is counted indendependently of the device. To achieve the same goal, add a type of QOM objects that count references and parent MemoryRegions. [1] https://lore.kernel.org/qemu-devel/4eb93d7a-1fa9-4b3c-8ad7-a2eb64f025a0= @collabora.com/ Cc: qemu-stable@nongnu.org Fixes: e27194e087ae ("virtio-gpu-virgl: correct parent for blob memory regi= on") Fixes: da9b1cd37f66 ("virtio-gpu-virgl: correct parent for blob memory regi= on") in 10.1.x Signed-off-by: Akihiko Odaki Tested-by: Dmitry Osipenko Tested-by: Joelle van Dyne Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Message-Id: <20260214-region-v1-1-229f00ae1f38@rsg.ci.i.u-tokyo.ac.jp> (cherry picked from commit b2a279094c3b86667969cc645f7fb1087e08dd19) Signed-off-by: Michael Tokarev diff --git a/hw/display/virtio-gpu-virgl.c b/hw/display/virtio-gpu-virgl.c index b25ddc0746..362828f54e 100644 --- a/hw/display/virtio-gpu-virgl.c +++ b/hw/display/virtio-gpu-virgl.c @@ -52,11 +52,17 @@ virgl_get_egl_display(G_GNUC_UNUSED void *cookie) =20 #if VIRGL_VERSION_MAJOR >=3D 1 struct virtio_gpu_virgl_hostmem_region { + Object parent_obj; MemoryRegion mr; struct VirtIOGPU *g; bool finish_unmapping; }; =20 +#define TYPE_VIRTIO_GPU_VIRGL_HOSTMEM_REGION "virtio-gpu-virgl-hostmem-reg= ion" + +OBJECT_DECLARE_SIMPLE_TYPE(virtio_gpu_virgl_hostmem_region, + VIRTIO_GPU_VIRGL_HOSTMEM_REGION) + static struct virtio_gpu_virgl_hostmem_region * to_hostmem_region(MemoryRegion *mr) { @@ -70,14 +76,22 @@ static void virtio_gpu_virgl_resume_cmdq_bh(void *opaqu= e) virtio_gpu_process_cmdq(g); } =20 -static void virtio_gpu_virgl_hostmem_region_free(void *obj) +/* + * MR could outlive the resource if MR's reference is held outside of + * virtio-gpu. In order to prevent unmapping resource while MR is alive, + * and thus, making the data pointer invalid, we will block virtio-gpu + * command processing until MR is fully unreferenced and freed. + */ +static void virtio_gpu_virgl_hostmem_region_finalize(Object *obj) { - MemoryRegion *mr =3D MEMORY_REGION(obj); - struct virtio_gpu_virgl_hostmem_region *vmr; + struct virtio_gpu_virgl_hostmem_region *vmr =3D VIRTIO_GPU_VIRGL_HOSTM= EM_REGION(obj); VirtIOGPUBase *b; VirtIOGPUGL *gl; =20 - vmr =3D to_hostmem_region(mr); + if (!vmr->g) { + return; + } + vmr->finish_unmapping =3D true; =20 b =3D VIRTIO_GPU_BASE(vmr->g); @@ -92,11 +106,26 @@ static void virtio_gpu_virgl_hostmem_region_free(void = *obj) qemu_bh_schedule(gl->cmdq_resume_bh); } =20 +static const TypeInfo virtio_gpu_virgl_hostmem_region_info =3D { + .parent =3D TYPE_OBJECT, + .name =3D TYPE_VIRTIO_GPU_VIRGL_HOSTMEM_REGION, + .instance_size =3D sizeof(struct virtio_gpu_virgl_hostmem_region), + .instance_finalize =3D virtio_gpu_virgl_hostmem_region_finalize +}; + +static void virtio_gpu_virgl_types(void) +{ + type_register_static(&virtio_gpu_virgl_hostmem_region_info); +} + +type_init(virtio_gpu_virgl_types) + static int virtio_gpu_virgl_map_resource_blob(VirtIOGPU *g, struct virtio_gpu_virgl_resource *res, uint64_t offset) { + g_autofree char *name =3D NULL; struct virtio_gpu_virgl_hostmem_region *vmr; VirtIOGPUBase *b =3D VIRTIO_GPU_BASE(g); MemoryRegion *mr; @@ -117,21 +146,16 @@ virtio_gpu_virgl_map_resource_blob(VirtIOGPU *g, } =20 vmr =3D g_new0(struct virtio_gpu_virgl_hostmem_region, 1); + name =3D g_strdup_printf("blob[%" PRIu32 "]", res->base.resource_id); + object_initialize_child(OBJECT(g), name, vmr, + TYPE_VIRTIO_GPU_VIRGL_HOSTMEM_REGION); vmr->g =3D g; =20 mr =3D &vmr->mr; - memory_region_init_ram_ptr(mr, OBJECT(mr), NULL, size, data); + memory_region_init_ram_ptr(mr, OBJECT(vmr), "mr", size, data); memory_region_add_subregion(&b->hostmem, offset, mr); memory_region_set_enabled(mr, true); =20 - /* - * MR could outlive the resource if MR's reference is held outside of - * virtio-gpu. In order to prevent unmapping resource while MR is aliv= e, - * and thus, making the data pointer invalid, we will block virtio-gpu - * command processing until MR is fully unreferenced and freed. - */ - OBJECT(mr)->free =3D virtio_gpu_virgl_hostmem_region_free; - res->mr =3D mr; =20 return 0; @@ -159,7 +183,7 @@ virtio_gpu_virgl_unmap_resource_blob(VirtIOGPU *g, * 1. Begin async unmapping with memory_region_del_subregion() * and suspend/block cmd processing. * 2. Wait for res->mr to be freed and cmd processing resumed - * asynchronously by virtio_gpu_virgl_hostmem_region_free(). + * asynchronously by virtio_gpu_virgl_hostmem_region_finalize(). * 3. Finish the unmapping with final virgl_renderer_resource_unmap(). */ if (vmr->finish_unmapping) { @@ -182,7 +206,7 @@ virtio_gpu_virgl_unmap_resource_blob(VirtIOGPU *g, /* memory region owns self res->mr object and frees it by itself */ memory_region_set_enabled(mr, false); memory_region_del_subregion(&b->hostmem, mr); - object_unref(OBJECT(mr)); + object_unparent(OBJECT(vmr)); } =20 return 0; --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773242802; cv=none; d=zohomail.com; s=zohoarc; b=bu9ss0181Bq+esfyNYEsqSudgcZURn+bbMp7mf5CPxdJkP3+IQWNZdZ4t8B2UaEEnWVaELVZkVeRUAV7j5AV8UDVg7MT2Jxdl2kTwGexrYG2wg0P6l1mRiuAMEmv4vWtj1bsxc2W1P47xF8iF0QcE7XaHoolT1sUbge3tg31qJw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773242802; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=s0Pt40S/Arhe21HQZkUcd/bFiBK6Et68RW+6juXJTrk=; b=Ynu8Fgmb0OG23zP1p6ZEDGUJCq8qom36wtzMgj2bOTYAfKH3Aufcw90DInNRiNexyBpa/M0A101JwCQQqUS3Sp2K+i4bLciapTPDmnMCIKJExFrkEBkKG7b+v+kz5ZnNVD1s+HDXZDi5/BrRfMfNqEhQ9YEPMxHowzaZ1MhHiIs= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773242802781943.653707219283; Wed, 11 Mar 2026 08:26:42 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LBq-0001cD-7n; Wed, 11 Mar 2026 11:09:38 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LAO-00057Y-OU; Wed, 11 Mar 2026 11:08:09 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LAM-0005YN-G3; Wed, 11 Mar 2026 11:08:08 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 19BE7191E93; Wed, 11 Mar 2026 18:04:42 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 0820B37C2D4; Wed, 11 Mar 2026 18:05:20 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241482; bh=Ro8UnxtJVJpfd1sf5NQVHGQMRXpvO6vhRa0rTywA/k4=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=lxp9jAXqPtCsHGxy98a6rFkLTY8WkDQ3purhuJdEgGHM1xjTGZoSPxiEDS0A7diTA C2Z4gAnJ/XqBe/20JHarMZRD5agtkZ6DRN5Jl7qj55Hu/JJwXvsUmikfklptfpFo4w bkvLIB6YmMTeflutAC9BWJcoAtXtKCC8hHW0as2N+KxUFUCInJat5k1okZAhQQa3ik heXDghXilDubeSMOPj4aOAWHBj8tyywl8Kcnj82tesQCHPLWraOkSe/y7we7f5mkJs qYMhM+1D89eYCt0NBgcgInwsmdGxuRJWsLDeQx8687GdbsCrmpmAyegY8hZ+kmT7Hu 5SMG5iWd3D2mw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Manos Pitsidianakis , "Michael S. Tsirkin" , Michael Tokarev Subject: [Stable-10.1.5 16/46] virtio-snd: remove TODO comments Date: Wed, 11 Mar 2026 18:02:52 +0300 Message-ID: <20260311150327.1084669-16-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773242804165158500 Content-Type: text/plain; charset="utf-8" From: Manos Pitsidianakis Replying with a VIRTIO_SND_S_BAD_MSG error does not warrant a device reset. Instead, a device reset happens when the driver requests it from the transport. Signed-off-by: Manos Pitsidianakis Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Message-Id: <20260220-virtio-snd-series-v1-2-207c4f7200a2@linaro.org> (cherry picked from commit 34238f078a04f24b91199249b83846ab082b4e05) (Mjt: pick this one up so the next commit applies cleanly) Signed-off-by: Michael Tokarev diff --git a/hw/audio/virtio-snd.c b/hw/audio/virtio-snd.c index eca3319e59..47e95e56e4 100644 --- a/hw/audio/virtio-snd.c +++ b/hw/audio/virtio-snd.c @@ -168,9 +168,6 @@ static void virtio_snd_handle_pcm_info(VirtIOSound *s, sizeof(virtio_snd_query_info)); =20 if (msg_sz !=3D sizeof(virtio_snd_query_info)) { - /* - * TODO: do we need to set DEVICE_NEEDS_RESET? - */ qemu_log_mask(LOG_GUEST_ERROR, "%s: virtio-snd command size incorrect %zu vs \ %zu\n", __func__, msg_sz, sizeof(virtio_snd_query_info)); @@ -184,9 +181,6 @@ static void virtio_snd_handle_pcm_info(VirtIOSound *s, =20 if (iov_size(cmd->elem->in_sg, cmd->elem->in_num) < sizeof(virtio_snd_hdr) + size * count) { - /* - * TODO: do we need to set DEVICE_NEEDS_RESET? - */ error_report("pcm info: buffer too small, got: %zu, needed: %zu", iov_size(cmd->elem->in_sg, cmd->elem->in_num), sizeof(virtio_snd_pcm_info)); @@ -244,9 +238,6 @@ uint32_t virtio_snd_set_pcm_params(VirtIOSound *s, virtio_snd_pcm_set_params *st_params; =20 if (stream_id >=3D s->snd_conf.streams || s->pcm->pcm_params =3D=3D NU= LL) { - /* - * TODO: do we need to set DEVICE_NEEDS_RESET? - */ virtio_error(VIRTIO_DEVICE(s), "Streams have not been initialized.= \n"); return cpu_to_le32(VIRTIO_SND_S_BAD_MSG); } @@ -297,9 +288,6 @@ static void virtio_snd_handle_pcm_set_params(VirtIOSoun= d *s, sizeof(virtio_snd_pcm_set_params)); =20 if (msg_sz !=3D sizeof(virtio_snd_pcm_set_params)) { - /* - * TODO: do we need to set DEVICE_NEEDS_RESET? - */ qemu_log_mask(LOG_GUEST_ERROR, "%s: virtio-snd command size incorrect %zu vs \ %zu\n", __func__, msg_sz, sizeof(virtio_snd_pcm_set_params= )); @@ -609,9 +597,6 @@ static void virtio_snd_handle_pcm_release(VirtIOSound *= s, sizeof(stream_id)); =20 if (msg_sz !=3D sizeof(stream_id)) { - /* - * TODO: do we need to set DEVICE_NEEDS_RESET? - */ qemu_log_mask(LOG_GUEST_ERROR, "%s: virtio-snd command size incorrect %zu vs \ %zu\n", __func__, msg_sz, sizeof(stream_id)); @@ -623,9 +608,6 @@ static void virtio_snd_handle_pcm_release(VirtIOSound *= s, trace_virtio_snd_handle_pcm_release(stream_id); stream =3D virtio_snd_pcm_get_stream(s, stream_id); if (stream =3D=3D NULL) { - /* - * TODO: do we need to set DEVICE_NEEDS_RESET? - */ error_report("already released stream %"PRIu32, stream_id); virtio_error(VIRTIO_DEVICE(s), "already released stream %"PRIu32, @@ -668,9 +650,6 @@ process_cmd(VirtIOSound *s, virtio_snd_ctrl_command *cm= d) sizeof(virtio_snd_hdr)); =20 if (msg_sz !=3D sizeof(virtio_snd_hdr)) { - /* - * TODO: do we need to set DEVICE_NEEDS_RESET? - */ qemu_log_mask(LOG_GUEST_ERROR, "%s: virtio-snd command size incorrect %zu vs \ %zu\n", __func__, msg_sz, sizeof(virtio_snd_hdr)); --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773242062; cv=none; d=zohomail.com; s=zohoarc; b=b6NawjTjCMU3fbZFcOjTHsTkqKS2mRv33K4D2Z13Iw0n9f6qEq6sltCkpONk9Br2DisECat+9BVwCQLMlz4w8nKVCgVPd21AwiqUg4vKgRSQUMDoAzKfu+WUUl0sEjCwQ6narte2078SotO589EZFImYavAMBP5EEjjApuoZMm0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773242062; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=LQgVUuy05wO6/xxSIMy+JQAVyTt76sjfKvaXqsZM/Vg=; b=IxrmFQ7ggv5ykeHNpY01wWnJzX7m/oISaEMBu2RFx/yip0J/bm8Xn6nydgQR1LoKQ01tveGS2JJJ8NsNPq8jn7ELAt+JUi3CgnvxsxOqmEdhfn3yqddGaZhjatbnO+wG3L4/bn5mJu0EaXp8MwWif+X7NGLdjpyegAZ5usi4fBU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773242062354931.6202336214616; Wed, 11 Mar 2026 08:14:22 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LBw-0001y6-2h; Wed, 11 Mar 2026 11:09:44 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LAk-0006Xr-Kj; Wed, 11 Mar 2026 11:08:30 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LAj-0005Yi-1s; Wed, 11 Mar 2026 11:08:30 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 2AECB191E94; Wed, 11 Mar 2026 18:04:42 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 1851437C2D5; Wed, 11 Mar 2026 18:05:20 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241482; bh=XjtU8PzwkUDwywIBXQiUHl139CIGqa2zBETUbCIwQrs=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=uPAywV9MUtJIrKN6+ur44VB1ZGmRSTspjfEIIzCYj8PLMdd6KYQwoGrkeCPo64CRI 4hCHhHrlEAdjRKsmM8Pvl/pUpjRBndNhX1AV1ZAyrDfVb6aGf+VxhKRBOnTbWBDVvN WhT+sohABevzHKh074EmE6drknO3UauXQwz8B8OdCEc0kvIQ5amSNR2X1m5d3ZqB6s 0S6EmoJAsxdkjgd2AGHB/5IJe6VZKXzPNjO9fj6ITF8wH++oPeTlovHdOuMpO14oTw kQkbNYfwauYWAviqJz0s7LYf2h+KJLV3CTf4XzHUi5jbbb7U0pg5c4m7g4JsgofJLR 50NAYqPf9pgAQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Manos Pitsidianakis , =?UTF-8?q?=E7=BD=97=E9=93=AD=E6=BA=90?= , "Michael S. Tsirkin" , Michael Tokarev Subject: [Stable-10.1.5 17/46] virtio-snd: handle 5.14.6.2 for PCM_INFO properly Date: Wed, 11 Mar 2026 18:02:53 +0300 Message-ID: <20260311150327.1084669-17-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773242063677158500 From: Manos Pitsidianakis The section 5.14.6.2 of the VIRTIO spec says: 5.14.6.2 Driver Requirements: Item Information Request - The driver MUST NOT set start_id and count such that start_id + count is greater than the total number of particular items that is indicated in the device configuration space. - The driver MUST provide a buffer of sizeof(struct virtio_snd_hdr) + count * size bytes for the response. While we performed some check for the second requirement, it failed to check for integer overflow. Add also a check for the first requirement, which should limit exposure to any overflow, since realistically the number of streams will be low enough in value such that overflow is improbable. Cc: qemu-stable@nongnu.org Reported-by: =E7=BD=97=E9=93=AD=E6=BA=90 Signed-off-by: Manos Pitsidianakis Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Message-Id: <20260220-virtio-snd-series-v1-3-207c4f7200a2@linaro.org> (cherry picked from commit 61679d7dcfa2dffc8fb115aa19b09e0e7cf5ea5c) Signed-off-by: Michael Tokarev diff --git a/hw/audio/virtio-snd.c b/hw/audio/virtio-snd.c index 47e95e56e4..38d9a9712c 100644 --- a/hw/audio/virtio-snd.c +++ b/hw/audio/virtio-snd.c @@ -156,7 +156,7 @@ static virtio_snd_pcm_set_params *virtio_snd_pcm_get_pa= rams(VirtIOSound *s, static void virtio_snd_handle_pcm_info(VirtIOSound *s, virtio_snd_ctrl_command *cmd) { - uint32_t stream_id, start_id, count, size; + uint32_t stream_id, start_id, count, size, tmp; virtio_snd_pcm_info val; virtio_snd_query_info req; VirtIOSoundPCMStream *stream =3D NULL; @@ -179,11 +179,34 @@ static void virtio_snd_handle_pcm_info(VirtIOSound *s, count =3D le32_to_cpu(req.count); size =3D le32_to_cpu(req.size); =20 - if (iov_size(cmd->elem->in_sg, cmd->elem->in_num) < - sizeof(virtio_snd_hdr) + size * count) { + /* + * 5.14.6.2 Driver Requirements: Item Information Request + * "The driver MUST NOT set start_id and count such that start_id + co= unt + * is greater than the total number of particular items that is indica= ted + * in the device configuration space." + */ + if (start_id > s->snd_conf.streams + || !g_uint_checked_add(&tmp, start_id, count) + || start_id + count > s->snd_conf.streams) { + error_report("pcm info: start_id + count is greater than the total= " + "number of streams, got: start_id =3D %u, count =3D %= u", + start_id, count); + cmd->resp.code =3D cpu_to_le32(VIRTIO_SND_S_BAD_MSG); + return; + } + + /* + * 5.14.6.2 Driver Requirements: Item Information Request + * "The driver MUST provide a buffer of sizeof(struct virtio_snd_hdr) + + * count * size bytes for the response." + */ + if (!g_uint_checked_mul(&tmp, size, count) + || !g_uint_checked_add(&tmp, tmp, sizeof(virtio_snd_hdr)) + || iov_size(cmd->elem->in_sg, cmd->elem->in_num) < + sizeof(virtio_snd_hdr) + size * count) { error_report("pcm info: buffer too small, got: %zu, needed: %zu", iov_size(cmd->elem->in_sg, cmd->elem->in_num), - sizeof(virtio_snd_pcm_info)); + sizeof(virtio_snd_pcm_info) * count); cmd->resp.code =3D cpu_to_le32(VIRTIO_SND_S_BAD_MSG); return; } --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773241909; cv=none; d=zohomail.com; s=zohoarc; b=MqjaZxAriNQH8gN9t/F8sVj84SSV9f4xuBrqfk49v76qGx5/C0ocC9ii2hYCdfz0YN3pE1Ddj6V5eE/JyInqNXK0CKXkvxoHB0/i9Kg1O8hFf89Ncc6BSw4EWXfuYt+AksQ00oVR33KjDZhE8RDfDDV7hpxvZsK7hjtGy/AxkMs= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773241909; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=ad5nKP6LMd1LEDKeRYr4Oaj6LDwDKR351cR+OyD2KSo=; b=nayN4Oc8z2tmNQX6SJA3TT55cqQx2nk4h3I/eO+M8Vt7z5uujduDAg0q3gKN1dL3OjjIynmSgerVMY79bgvfSdHfTpZBe6OOFbn2viGdMv7iQm56T99h/qGKkAgf9JwLoBSkbX7VfZatfUrif5qQV5M49nTAF5v/m6DRd9iIyzc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773241909083479.247196017903; Wed, 11 Mar 2026 08:11:49 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LBw-00021I-Re; Wed, 11 Mar 2026 11:09:44 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LAl-0006ZG-Ng; Wed, 11 Mar 2026 11:08:32 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LAk-0005Yu-9u; Wed, 11 Mar 2026 11:08:31 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 3CD52191E95; Wed, 11 Mar 2026 18:04:42 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 2992F37C2D6; Wed, 11 Mar 2026 18:05:20 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241482; bh=LgH8KYxOi8GRUGWnbzF3XW3/9o4LU+rtDfY/7m1mayc=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=B8is/rtz7rVXMqkrxRmuKfthbCaxkbt+Bn6FQy0n3AqAtvbqGPD26QhX9fDVA4fEv Z5VUCVAQJuijvo6y+xGDUwQMZPUNxtPUocatkWhj3rhYZiIRG3ZefTKuDkhQgWRwQU Ft2kjCR/eEz6dTQkNkCLNZ6HXUrKTVRdiL4elCOddcON40qjfSrSUIeVLwADNEL0rZ UTXcKTTvpER92A1AgtJY6YSO1lpP3glHNCJMdShF7xTB/aJ0S0VrUboky9Nu48Obtd ZoWQ/K3z/uslV7EhsW5TUdwfZ80F/pCnuHXT2r857oyEwmxHafxKjD83rhhF+NXITf JARS5SRVbVuwQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Manos Pitsidianakis , DARKNAVY , "Michael S. Tsirkin" , Michael Tokarev Subject: [Stable-10.1.5 18/46] virtio-snd: fix max_size bounds check in input cb Date: Wed, 11 Mar 2026 18:02:54 +0300 Message-ID: <20260311150327.1084669-18-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773241910776158500 Content-Type: text/plain; charset="utf-8" From: Manos Pitsidianakis In 98e77e3d we calculated the max size and checked that each buffer is smal= ler than it. We neglected to subtract the size of the virtio_snd_pcm_status header from the max size, and max_size was thus larger than the correct value, leading to potential OOB writes. If the buffer cannot fit the header or can fit only the header, return the buffer immediately. Cc: qemu-stable@nongnu.org Fixes: 98e77e3dd8dd6e7aa9a7dffa60f49c8c8a49d4e3 ("virtio-snd: add max size = bounds check in input cb") Reported-by: DARKNAVY Signed-off-by: Manos Pitsidianakis Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Message-Id: <20260220-virtio-snd-series-v1-4-207c4f7200a2@linaro.org> (cherry picked from commit bcb53328aa70023f1405fade4e253e7f77567261) Signed-off-by: Michael Tokarev diff --git a/hw/audio/virtio-snd.c b/hw/audio/virtio-snd.c index 38d9a9712c..effae20bf0 100644 --- a/hw/audio/virtio-snd.c +++ b/hw/audio/virtio-snd.c @@ -1255,6 +1255,12 @@ static void virtio_snd_pcm_in_cb(void *data, int ava= ilable) } =20 max_size =3D iov_size(buffer->elem->in_sg, buffer->elem->in_nu= m); + if (max_size <=3D sizeof(virtio_snd_pcm_status)) { + return_rx_buffer(stream, buffer); + continue; + } + max_size -=3D sizeof(virtio_snd_pcm_status); + for (;;) { if (buffer->size >=3D max_size) { return_rx_buffer(stream, buffer); --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773242027; cv=none; d=zohomail.com; s=zohoarc; b=BPYdFCrdMs0BbA2C03s1Byb9BUXHg7dSF1q8jRCYjQiIxr++bKjaVvUQxb2A6qtBuHEmbK65muqiLJ26/UAwY3OBOec33Y/ZjUZSn6Q3CR1FTxOODJnS8hpnxtSWf2VRobkukl1EosZbzzOLtgqr9JUO8CqnfHjWC1xPaQjpj2Q= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773242027; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=v1x3NyZ3H8kQLXn5mLfh9D4/LqphMoclcHgkj4rZlOU=; b=R3hQTM3mfYZ2vOXmD9ux78e4dD77p8gpWTdYZRzdXjpBk5k830vOvKnEkm9pC1phH1gsKDxCnByf07inqMUub7oczFnKUWwJh20uK77orHBU03MB3ptoDtrLmqIClbZDNQUVeygdmK0U8EdhLMskboheVJVre1D+S4E46bUO6yk= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 177324202758797.89039115060609; Wed, 11 Mar 2026 08:13:47 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LBy-00025v-Ml; Wed, 11 Mar 2026 11:09:47 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LAo-0006lG-Rs; Wed, 11 Mar 2026 11:08:35 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LAn-0005c3-52; Wed, 11 Mar 2026 11:08:34 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 4DB37191E96; Wed, 11 Mar 2026 18:04:42 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 3AE5137C2D7; Wed, 11 Mar 2026 18:05:20 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241482; bh=K59F1FOeSSxSINjkczzPnubxlW7suABX40ajiMSS0ek=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=SAfh6WGTIqWyNX6ATNslL5/yTKBREpxkhdMvBRMNHiWZgl6kXHpD9eESTjW2l8jvV l49jMoDQC//1WrNIMY/G1uIm6JMepk9w6LikOlgjJTOd7x8xrPO3JNCZx3HpVly7sR YYYUz2zVeSgI0MXIRpJOyahx3ipo+Gh/oCbOe9MWUYHicDHBf5LJM17REH4ZCv1qP2 FJUjv6uLyWhVXT34nddIR1WRY90mI1eo78yoUr0KhU987R2a9/Er4sPcn5GU+By1C1 3uW/tNdkavcfDXZKciZjmQQaiVgUd133JHJW81B69gLynGhFsC6hWCIm5juSZZLwuu apwaFkh/t4uPQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Manos Pitsidianakis , DARKNAVY , "Michael S. Tsirkin" , Michael Tokarev Subject: [Stable-10.1.5 19/46] virtio-snd: tighten read amount in in_cb Date: Wed, 11 Mar 2026 18:02:55 +0300 Message-ID: <20260311150327.1084669-19-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773242029684158500 Content-Type: text/plain; charset="utf-8" From: Manos Pitsidianakis The amount of bytes to read passed to AUD_read() should never surpass the maximum available buffer length. Tighten the current amount by MIN(, max_size - ). Cc: qemu-stable@nongnu.org Fixes: 98e77e3dd8dd6e7aa9a7dffa60f49c8c8a49d4e3 ("virtio-snd: add max size = bounds check in input cb") Reported-by: DARKNAVY Signed-off-by: Manos Pitsidianakis Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Message-Id: <20260220-virtio-snd-series-v1-5-207c4f7200a2@linaro.org> (cherry picked from commit 7994203bb1b83a6604f3ab00fe9598909bb66164) Signed-off-by: Michael Tokarev diff --git a/hw/audio/virtio-snd.c b/hw/audio/virtio-snd.c index effae20bf0..32b3ea48b3 100644 --- a/hw/audio/virtio-snd.c +++ b/hw/audio/virtio-snd.c @@ -1240,7 +1240,7 @@ static void virtio_snd_pcm_in_cb(void *data, int avai= lable) { VirtIOSoundPCMStream *stream =3D data; VirtIOSoundPCMBuffer *buffer; - size_t size, max_size; + size_t size, max_size, to_read; =20 WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) { while (!QSIMPLEQ_EMPTY(&stream->queue)) { @@ -1266,10 +1266,12 @@ static void virtio_snd_pcm_in_cb(void *data, int av= ailable) return_rx_buffer(stream, buffer); break; } + to_read =3D stream->params.period_bytes - buffer->size; + to_read =3D MIN(to_read, available); + to_read =3D MIN(to_read, max_size - buffer->size); size =3D AUD_read(stream->voice.in, - buffer->data + buffer->size, - MIN(available, (stream->params.period_bytes - - buffer->size))); + buffer->data + buffer->size, + to_read); if (!size) { available =3D 0; break; --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773241926; cv=none; d=zohomail.com; s=zohoarc; b=UDV3G6BNDcf0ZRLuQxA4KnHOo3XodyFenhmz3to1bQWfFLAFYAzYQ9wvwxD/XTB1jd+Xl0o8g3dyf0FJhX7J8aCsaU6Ww12pQxzdYrLGpvs902N9PTzaZ5HgtOmxixXoAdBZaO2cVQO8khaAkjKgGUXjN6mpgjGjjAlm8jU7Lhs= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773241926; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=EidjrLkykcg7DTP36jkbFLnnmwzZRYdu81nS1G0BLb4=; b=IXeqDOCaYzXCwEVbMUIfVWxmQyIygtiHhQf7Tr9dPI0MIBiMnAETxpsRb60wT6DnBRljOkxdB8mUSOlMWmkaZKTFF8wJB7wN7tRPlUtaUihZB2ZNUwm4a/RtdnC7AtZ/oZeSwwiyXJPekH9NEWYPqGnA8WqbOoG+d8oi8XL94gw= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773241926969491.169276363231; Wed, 11 Mar 2026 08:12:06 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LCI-0002dD-3N; Wed, 11 Mar 2026 11:10:06 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LAq-0006lT-7A; Wed, 11 Mar 2026 11:08:38 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LAn-0005cH-Eu; Wed, 11 Mar 2026 11:08:35 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 66AB5191E97; Wed, 11 Mar 2026 18:04:42 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 4B75637C2D8; Wed, 11 Mar 2026 18:05:20 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241482; bh=N0GMzjC3W7RYbcpelKlOxpYSyS8lFWCXR90eEAeuy70=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=caRHpBDGqRJ8JN1hbgYhl5vlmmFAhKrYdhQuwzYG6jATNqN3CjlimTSETn1nIBKmi H35mkAlBvzjP3Df7RAu6V0mgtNJOV0daXQ25L084TWq0q3MAo0qEIzudRyrTVugMD7 9drHVam8vm1erE1qDKJxbbA7eegaUR0AZYVk8YrgAfvdKgBEisP22+N+HewZkVZHGM JYjgfsY/Pi7KyYNL/zX7P1QAt2cjX0QnXunDTFKiUcdChnI3wx5nrVAjGl76jyOz2e Dvk9Fimg4SwkbHs9/shLfSAzeYS0Xd2b8UF8s/NwlAguGD1gRyV7AHImlovYHlcPvV b9hFTKqEzwyJQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Kuan-Wei Chiu , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-10.1.5 20/46] hw/misc/virt_ctrl: Fix incorrect trace event in read operation Date: Wed, 11 Mar 2026 18:02:56 +0300 Message-ID: <20260311150327.1084669-20-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773241928589154100 From: Kuan-Wei Chiu The virt_ctrl_read() function currently invokes trace_virt_ctrl_write() instead of trace_virt_ctrl_read(). This results in read operations appearing as write operations in the trace output, which is misleading during debugging and analysis. Replace the incorrect trace call with the proper read-specific trace event to accurately reflect the hardware behavior. Fixes: 0791bc02b8fb ("m68k: add a system controller") Signed-off-by: Kuan-Wei Chiu Reviewed-by: Philippe Mathieu-Daud=C3=A9 Message-ID: <20260111184915.1363318-1-visitorckw@gmail.com> Signed-off-by: Philippe Mathieu-Daud=C3=A9 (cherry picked from commit 8608ed356ef90815cc5bcf04fcdbde987fd24bca) Signed-off-by: Michael Tokarev diff --git a/hw/misc/virt_ctrl.c b/hw/misc/virt_ctrl.c index 9f16093ca2..7dc2fe4f94 100644 --- a/hw/misc/virt_ctrl.c +++ b/hw/misc/virt_ctrl.c @@ -43,7 +43,7 @@ static uint64_t virt_ctrl_read(void *opaque, hwaddr addr,= unsigned size) break; } =20 - trace_virt_ctrl_write(s, addr, size, value); + trace_virt_ctrl_read(s, addr, size, value); =20 return value; } --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773241814; cv=none; d=zohomail.com; s=zohoarc; b=G+VkZ3YXKGuaw+ANbKxgSNjXMCPkdwTpFUTU87XOni1qVZcbjC5YGAvGWvMPll7FqqvQq1lSCzrpsd47H8Gb+MPqvlcMMUYf6pd0zAC2gbGlgL19RGDkhdlbZjQTw0t6TQEhGPYUWROYByJMCMI8clHOxiaq8B2kEcVMBzDERLU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773241814; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=wha4kEnhBwijLqq93bxpQGpMzcFQ2CBwCdz/BVvpZKc=; b=mp1lOCtzulQiERBc+U2ro1BS6bkaqBlvyk3yRRkAdFdU40Ik3qGSGI9+dl0Wbg7fcpkoPDVwesYOw6W0gW/ctVonb2EtiBRCfnH14WQprXVfkoBthE/yW7BnouNKAHaE2d5BPP0p71sm6UkgQJEGy6+Dl0v+5OGkyZO08zm383g= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773241814712836.272202336865; Wed, 11 Mar 2026 08:10:14 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LC1-0002Ch-Uo; Wed, 11 Mar 2026 11:09:53 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LAu-0006rP-5W; Wed, 11 Mar 2026 11:08:41 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LAq-0005ce-CD; Wed, 11 Mar 2026 11:08:38 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 7B131191E98; Wed, 11 Mar 2026 18:04:42 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 64C4B37C2D9; Wed, 11 Mar 2026 18:05:20 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241482; bh=OQyjN3JiNQKujPfiQykMp7epgbhDBXLON+2RERmtywM=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=XJY+9ZnGIaSjg5t+u5+6+H5Om/gTiM36vFOvM/TiiJmBGsnQ5YRpbjo8Zt/WwzD25 nyFQ+h7AcAAcho9s5bsbzR+e7737MS9a8FK3a6nB22+0EX01RyXlkPalm1msom+vYC n62pxTeOBGnrK38vRRs74EpOx/q6JlWxXdXoJQ6Zn1/3lHEjH7tUsOUlM3f6KpUNmZ Ephgkj3HKmUaWp6fhEn94Knc19ZO0mTFPw0BtGrBN4pSj8K+SfZIhtstbg7UYw+uin dHG182groP6H0xSmnxoDxGKJjHYICyuHJhFUE+teIjvs30sUz2xNoWMeE61PMZflbT /jeqVrWwBCMxg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Weixie Cui , Thomas Huth , Alistair Francis , Richard Henderson , Peter Maydell , Michael Tokarev Subject: [Stable-10.1.5 21/46] hw/ssi/xilinx_spips: Reset TX FIFO in reset Date: Wed, 11 Mar 2026 18:02:57 +0300 Message-ID: <20260311150327.1084669-21-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773241839225158500 Content-Type: text/plain; charset="utf-8" From: Weixie Cui In xilinx_spips_reset() and xlnx_zynqmp_qspips_reset() a cut and paste error meant we reset the RX FIFO twice and the TX FIFO not at all. Correct this to reset both FIFOs. Cc: qemu-stable@nongnu.org Signed-off-by: Weixie Cui Reviewed-by: Thomas Huth Reviewed-by: Alistair Francis Reviewed-by: Richard Henderson Message-id: 20260223095905.67709-1-cuiweixie@gmail.com [Rewrote commit message] Signed-off-by: Peter Maydell (cherry picked from commit 669683cf1414ce442d2faea160dbc69747aef007) Signed-off-by: Michael Tokarev diff --git a/hw/ssi/xilinx_spips.c b/hw/ssi/xilinx_spips.c index a79f3b8e49..9c5b58a9ec 100644 --- a/hw/ssi/xilinx_spips.c +++ b/hw/ssi/xilinx_spips.c @@ -369,7 +369,7 @@ static void xilinx_spips_reset(DeviceState *d) memset(s->regs, 0, sizeof(s->regs)); =20 fifo8_reset(&s->rx_fifo); - fifo8_reset(&s->rx_fifo); + fifo8_reset(&s->tx_fifo); /* non zero resets */ s->regs[R_CONFIG] |=3D MODEFAIL_GEN_EN; s->regs[R_SLAVE_IDLE_COUNT] =3D 0xFF; @@ -397,7 +397,7 @@ static void xlnx_zynqmp_qspips_reset(DeviceState *d) memset(s->regs, 0, sizeof(s->regs)); =20 fifo8_reset(&s->rx_fifo_g); - fifo8_reset(&s->rx_fifo_g); + fifo8_reset(&s->tx_fifo_g); fifo32_reset(&s->fifo_g); s->regs[R_INTR_STATUS] =3D R_INTR_STATUS_RESET; s->regs[R_GPIO] =3D 1; --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773241971; cv=none; d=zohomail.com; s=zohoarc; b=VHVGRDx0JO5XWc8kfeAc7hkDd4gazP2nvdvDGCjUHuCmi41/9bQLKK2yymRLza+/a4YSEphJWrNIAHM/fMg0c3aIL8Y8PyCLpY4fNzrk18H5KjE1mdI2FPvmwCUTo+lGFnEFoAOTcoER3XYohT02gX+U6tKb8Ed7giDJCjsCxLk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773241971; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=0yKaRJV5kJwPY7OcN7v+7slSG/wOM4OVIT+qGRVNdU0=; b=nFMK38L9qTTu5Uh69k3p0fUw4E8WRhxPHvn3jjxiEsutbLHiDkii7kptkQRArnxuR06BuVhs2dZxHXaWSmo99C1kl4+T9Bk+UZxy4KS/ujTAg0YhTGwC2CKNlOIDf9ad0lx3mn8jSCIS6qVVUMKiB/+NoA4JRoXOCBQLLt4W9tg= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773241971407911.7803375670752; Wed, 11 Mar 2026 08:12:51 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LCy-0003PF-Kc; Wed, 11 Mar 2026 11:10:50 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LBE-0007MC-3u; Wed, 11 Mar 2026 11:09:00 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LBC-0005cw-H1; Wed, 11 Mar 2026 11:08:59 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 955AD191E99; Wed, 11 Mar 2026 18:04:42 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 7952737C2DA; Wed, 11 Mar 2026 18:05:20 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241482; bh=HjMOGCTo1aZscX1vCw2n+onzv51zYPcKRM6CWfJzUog=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=ILtqm+dkoWyUcFgUBAN+ME7dedSXurudUfthVqLo5cvUJUDv5VuSdBxndStvLv6Fb bPH/x/62dxGUNZGZkcfJzugcqEygNG3YiisIReAC8/wmHHyjEcz6oRpAXg5XvhxVHz Qk3VPvRbdygy66b175hM+zuTgM7KjuQylEm2OLBSt6v2riykN629OpZlwpvH+QYp+e zJnvnEEWKH/nsL/JgdhsuncWRKdXyXTOAOZtTPQBnb79K0Vxt5tZ4qznPOGrDelFgz 9CBbcBdqSCnTEZlr/pqE6gPklcpmDyLtaPOJzBXJBlF431+AFPbqu1J0/2/35nbXPl qHF/eylBbsnhQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, =?UTF-8?q?Alex=20Benn=C3=A9e?= , Gustavo Romero , Peter Maydell , Michael Tokarev Subject: [Stable-10.1.5 22/46] target/arm: set the correct TI bits for WFIT traps Date: Wed, 11 Mar 2026 18:02:58 +0300 Message-ID: <20260311150327.1084669-22-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773241973321154100 From: Alex Benn=C3=A9e The WFIT trap should be reported as 0b10. Cc: qemu-stable@nongnu.org Signed-off-by: Alex Benn=C3=A9e Reviewed-by: Gustavo Romero Message-id: 20260220171945.1065102-1-alex.bennee@linaro.org Reviewed-by: Peter Maydell Signed-off-by: Peter Maydell (cherry picked from commit 662fd548a027c9362df71ebfc0c9cdd7b1f349fb) Signed-off-by: Michael Tokarev diff --git a/target/arm/tcg/op_helper.c b/target/arm/tcg/op_helper.c index 575e566280..048090369f 100644 --- a/target/arm/tcg/op_helper.c +++ b/target/arm/tcg/op_helper.c @@ -448,7 +448,7 @@ void HELPER(wfit)(CPUARMState *env, uint64_t timeout) =20 if (target_el) { env->pc -=3D 4; - raise_exception(env, excp, syn_wfx(1, 0xe, 0, false), target_el); + raise_exception(env, excp, syn_wfx(1, 0xe, 2, false), target_el); } =20 if (uadd64_overflow(timeout, offset, &nexttick)) { --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773242197; cv=none; d=zohomail.com; s=zohoarc; b=h1WypMPg7U7X+tKKOipT6dhBxm/0C49k/DVEQJeB3qVcd09pEOA4swJBTUH7lIvLcxLPeoY9g7xqm59mHO0/Rq+FktWox0YjV+5GvLZn02BuuYnZ9pTqrAXWTt9XCcvWuXz8RHKTSHyDY5HDFmhkIhtqremD0Jy88kwJIR/xq8I= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773242197; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=vwy2vUB2UNAolUBmx7boV1oeT/Hgci5qVHtIVMC38eY=; b=OC1bJQOia82aXweEJFBtvxMjz4i7Kx2ZOST+1t0PEcfGG2jRGLNzNy//ObLfeLB9BCwJUwuFV/idAuMmHCFHgYvwBsDq9N/PoH6Ox+dZeIhCvS9//hGZ0JsJNowgO+WBZWbjX4+VEPLywmUa7ErdWS6xUz5RSoMpwMA5Io2xL8c= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773242197032205.7660563487185; Wed, 11 Mar 2026 08:16:37 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LDJ-0003ah-7L; Wed, 11 Mar 2026 11:11:12 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LBI-0007cy-D5; Wed, 11 Mar 2026 11:09:04 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LBG-0005dr-2l; Wed, 11 Mar 2026 11:09:04 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id A3B38191E9A; Wed, 11 Mar 2026 18:04:42 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 9271037C2DB; Wed, 11 Mar 2026 18:05:20 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241482; bh=ehjHPasUuekmBpODA5II2+xVPRfhwkoUi23mVAH+18U=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=g/dWcJy8gHk2SJGoL2bTa9fHuMI1CR3DkX2EU+vwM/GPwDw0IF+ed2L70JaomqUZa XpkZb+h1+TnZdLm/4cpMHVBeMg2dLtYstmaBlSTHow0X/5HFW2WAzH1B5Pq3f2Pasz XTJR0qpQLOFVx4upWx/Tmu9n/v7FwgqcFb4neFdOYrY9SQTZAtAj06gv01ql/m5hJq vyqOAA5NYtYReyrROUOqSvD0dUO10uOAHjVtXYKmW/ULPCgCtCxLZ4QjoeHO3NCu/Y XMA6dtBYURPnMcOIZqU68La0fVsgkZeIaNHcLfGUkdh3FEhyV/PQMh7ByNzYjYJ2ML oux/mdP7XiYpw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Richie Buturla , Christian Schoenebeck , Michael Tokarev Subject: [Stable-10.1.5 23/46] hw/9pfs: fix data race in v9fs_mark_fids_unreclaim() Date: Wed, 11 Mar 2026 18:02:59 +0300 Message-ID: <20260311150327.1084669-23-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773242199155154100 Content-Type: text/plain; charset="utf-8" From: Richie Buturla A data race between v9fs_mark_fids_unreclaim() and v9fs_path_copy() causes an inconsistent read of fidp->path. In v9fs_path_copy(), the path size is set before the data pointer is allocated, creating a window where size is non-zero but data is NULL. v9fs_co_open2() holds a write lock during path modifications, but v9fs_mark_fids_unreclaim() was not acquiring a read lock, allowing it to race. Fix by holding the path read lock during FID table iteration. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3300 Signed-off-by: Richie Buturla Link: https://lore.kernel.org/qemu-devel/20260211154450.254338-1-richie@lin= ux.ibm.com/ Fixes: 7a46274529 ("hw/9pfs: Add file descriptor reclaim support") Signed-off-by: Christian Schoenebeck (cherry picked from commit c96f6d2398a9dc068fa82088ea43020a52e2b26d) Signed-off-by: Michael Tokarev diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c index acfa7db4e1..c70096e6be 100644 --- a/hw/9pfs/9p.c +++ b/hw/9pfs/9p.c @@ -558,6 +558,7 @@ static int coroutine_fn v9fs_mark_fids_unreclaim(V9fsPD= U *pdu, V9fsPath *path) sizeof(V9fsFidState *), 1); gint i; =20 + v9fs_path_read_lock(s); g_hash_table_iter_init(&iter, s->fids); =20 /* @@ -578,6 +579,7 @@ static int coroutine_fn v9fs_mark_fids_unreclaim(V9fsPD= U *pdu, V9fsPath *path) g_array_append_val(to_reopen, fidp); } } + v9fs_path_unlock(s); =20 for (i =3D 0; i < to_reopen->len; i++) { fidp =3D g_array_index(to_reopen, V9fsFidState*, i); --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773242300; cv=none; d=zohomail.com; s=zohoarc; b=RFM7ykkDIPSN9lktufFRJIm6WlkrXErewfL89W9JVNMtChIFt6a372hiv+Daq1tG1JDJEBr+v7+pIrlYM1SsarSjYbk3FSktYuU2Zaa9XoHdLz16CZ/N5lSvctquxoi2A/IlAqo8J+0aanNCJ9RI/tW9Be297dNsB7eecuTGjBE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773242300; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=XR1vWAFa+UuhKahLj+l4VvRs/hcAnWsc0EmhljVTlO0=; b=XL1gFMEyvVJ+YE2Re04PjaJoal4UjFyMKiPhTLz8Twu2imiQNkYd2S3uuqdMFUqNLOw2gY1uzYn/5CBxv7DVPtJVupM4x32Pq6sifaqXv7sRUjmjAnox8eT8U3sd992YtWbfSjaTr/rB1LaeQadjq//QDp4bfvburuKzT+B9lUA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773242300909637.6396758822076; Wed, 11 Mar 2026 08:18:20 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LDR-0003uv-0q; Wed, 11 Mar 2026 11:11:19 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LBH-0007Y8-Bf; Wed, 11 Mar 2026 11:09:03 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LBF-0005fk-Ky; Wed, 11 Mar 2026 11:09:03 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id B3126191E9B; Wed, 11 Mar 2026 18:04:42 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id A131E37C2DC; Wed, 11 Mar 2026 18:05:20 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241482; bh=r3LcDIg2pnrfXeb/zGiJh/vlHgX5s501/V26fC4Qu3A=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=EbubaTsd2lJjfp9cXvceQnNWxz11dEeSn11vGsI0IOqXNMYNC3fjATgM/70JJi8E9 4n9BFhXwOUjBHhij9LEaeRW7xLnxo7Zdj2RxfyIHMhGRu6qZ0O7XctjI7p0tFqSKZ5 Y6IcO66Fkm+PJtAOwuu/89XpTwJXtzsA8U8Wh38FIr3Gm2ca2RVejeQVsPBDd+pLBn iP3lcY20b7GrpJAiGrtQeSPrNALX2iO8hjmtNMNUrDzudNHtxNRUr0XARTsspo2i0F rl47GEDvaEGyaCPZYOj93D6t27lyQsOry9SpbWhIlx47sDhc9Z2wKWOtrJKJywIDT6 UpZ3Tng94dWAA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Christian Schoenebeck , Oliver Chang , Greg Kurz , Michael Tokarev Subject: [Stable-10.1.5 24/46] hw/9pfs: fix missing EOPNOTSUPP on Twstat and Trenameat for fs synth driver Date: Wed, 11 Mar 2026 18:03:00 +0300 Message-ID: <20260311150327.1084669-24-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773242303128154100 Content-Type: text/plain; charset="utf-8" From: Christian Schoenebeck Renaming files/dirs is only supported by path-based fs drivers. EOPNOTSUPP should be returned on any renaming attempt for not path-based fs drivers. This was already the case for 9p "Trename" request type. However for 9p request types "Trenameat" and "Twstat" this was yet missing. So fix this by checking in Twstat and Trenameat request handlers whether the fs driver in use is really path based, if not return EOPNOTSUPP and abort further handling of the request. This fixes a crash with the 9p "synth" fs driver which is not path-based. The crash happened because the synth driver stores and expects a raw V9fsSynthNode pointer instead of a C-string on V9fsPath.data. So the C-string delivered by 9p server to synth fs driver was incorrectly casted to a V9fsSynthNode pointer, eventually causing a segfault. Reported-by: Oliver Chang Fixes: https://issues.oss-fuzz.com/issues/477990727 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3298 Signed-off-by: Christian Schoenebeck Reviewed-by: Greg Kurz Link: https://lore.kernel.org/qemu-devel/E1vrbaP-000Gqb-B3@kylie.crudebyte.= com/ (cherry picked from commit b72d15f47cbd2fc93580f33fa86a7e23595a68dd) Signed-off-by: Michael Tokarev diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c index c70096e6be..388b2418ea 100644 --- a/hw/9pfs/9p.c +++ b/hw/9pfs/9p.c @@ -3514,6 +3514,12 @@ static void coroutine_fn v9fs_renameat(void *opaque) goto out_err; } =20 + /* if fs driver is not path based, return EOPNOTSUPP */ + if (!(s->ctx.export_flags & V9FS_PATHNAME_FSCONTEXT)) { + err =3D -EOPNOTSUPP; + goto out_err; + } + v9fs_path_write_lock(s); err =3D v9fs_complete_renameat(pdu, olddirfid, &old_name, newdirfid, &new_name); @@ -3604,6 +3610,11 @@ static void coroutine_fn v9fs_wstat(void *opaque) } } if (v9stat.name.size !=3D 0) { + /* if fs driver is not path based, return EOPNOTSUPP */ + if (!(s->ctx.export_flags & V9FS_PATHNAME_FSCONTEXT)) { + err =3D -EOPNOTSUPP; + goto out; + } v9fs_path_write_lock(s); err =3D v9fs_complete_rename(pdu, fidp, -1, &v9stat.name); v9fs_path_unlock(s); --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773242758; cv=none; d=zohomail.com; s=zohoarc; b=gDc3OJeMTAGlVbQv5IWlTEzR4xYsdTdnyxsEBFXJ6kVHM/wb79PLJiqpwQv4ZspGirhYF8kWkW6SIsRy8WEWxz56Bnp3PyXFmRt4k0DGahN1nEa8hHsWv/PI/8KjsaAFLBN5LZXMXNbD+/xsU71PLK/nceoRtbglf0CMHwWnHeI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773242758; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=anmyfdkjBmrkviZFvyeqFKTe2qVc6hyfaAWu1NnkVfc=; b=jS8Y6yYV+4Cz3vKZODCWBkf5juF33fJszBxGbvA80guKArPXYCOgeBU8AjPZCMTjIwsgrqXifhKYTb2r11avFs6w8Lt2BD6gIW7FYGipXORdyrFZrjou/UC9f1ETAbGyhDAZ8WSnL8JRQPVD5elaV3z+1iiR9+fKErQUDQmPVtI= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773242758934813.066765060104; Wed, 11 Mar 2026 08:25:58 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LDp-0004Wq-GC; Wed, 11 Mar 2026 11:11:41 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LBK-0007rV-Ql; Wed, 11 Mar 2026 11:09:06 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LBI-0005g5-UO; Wed, 11 Mar 2026 11:09:06 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id C6364191E9C; Wed, 11 Mar 2026 18:04:42 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id B048C37C2DD; Wed, 11 Mar 2026 18:05:20 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241482; bh=M6opmQWek9i4k2a3jmuHHkaT2owoodzgFfXuXulARNg=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=m6mHkrCPmccAHKnt5771vVoFC8ZZ1ka8kzoXNUGpfCKF5CjDp+A6jAmQmtpbGBJbd Decb2aN7zy+6yBgfAGBMEsn8j9L0IadS3SkHZ19FaY3uR0FjrXOPdh3N8CRuisNdBV lzcqRxW+dvaoUusJvyhJk2TxQmSL2rqb5Msk7t0fxBewM+Fu20aczcf7xA3xGzCeUN pMBLcLuE68ttH+oRqNX296OKgUvcyHkZzpapojTuaDwvfeqepsHNdxNNzc9dKOk+61 Bcf71r17N0EzLpFdZM55t8k1LKCCi0jszuc5UCZ/fnGoUSAm+Ssg+LTPYN7CvJkI2+ Mod+lKusEuuYw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Josh Poimboeuf , Justin Forbes , Alexey Makhalov , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Paolo Bonzini , Michael Tokarev Subject: [Stable-10.1.5 25/46] hw/i386/vmmouse: Fix hypercall clobbers Date: Wed, 11 Mar 2026 18:03:01 +0300 Message-ID: <20260311150327.1084669-25-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773242760020158500 From: Josh Poimboeuf Fedora QA reported the following kernel panic: BUG: unable to handle page fault for address: 0000000040003e54 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 1082ec067 P4D 0 Oops: Oops: 0002 [#1] SMP NOPTI CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.19.0-0.rc4.260108gf0b9= d8eb98df.34.fc43.x86_64 #1 PREEMPT(lazy) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS edk2-20251119-3.= fc43 11/19/2025 RIP: 0010:vmware_hypercall4.constprop.0+0x52/0x90 Code: 48 83 c4 20 5b e9 69 f0 fc fe 8b 05 a0 c1 b2 01 85 c0 74 23 b8 68 5= 8 4d 56 b9 27 00 00 00 31 d2 bb 04 00 00 00 66 ba 58 56 ed <89> 1f 89 0e 41= 89 10 5b e9 3c f0 fc fe 6a 00 49 89 f9 45 31 c0 31 RSP: 0018:ff5eeb3240003e40 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 000000000000ffca RCX: 000000000000ffac RDX: 0000000000000000 RSI: 0000000040003e58 RDI: 0000000040003e54 RBP: ff1e05f3c1204800 R08: ff5eeb3240003e5c R09: 000000009d899c41 R10: 000000000000003d R11: ff5eeb3240003ff8 R12: 0000000000000000 R13: 00000000000000ff R14: ff1e05f3c02f9e00 R15: 000000000000000c FS: 0000000000000000(0000) GS:ff1e05f489e40000(0000) knlGS:0000000000000= 000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000040003e54 CR3: 000000010841d002 CR4: 0000000000771ef0 PKRU: 55555554 Call Trace: vmmouse_report_events+0x13e/0x1b0 psmouse_handle_byte+0x15/0x60 ps2_interrupt+0x8a/0xd0 ... It was triggered by dereferencing a bad pointer (RDI) immediately after a VMware hypercall for VMWARE_CMD_ABSPOINTER_DATA in the vmmouse driver: ffffffff82135070 : ... ffffffff821350ac: b8 68 58 4d 56 mov $0x564d5868,%eax ffffffff821350b1: b9 27 00 00 00 mov $0x27,%ecx ffffffff821350b6: 31 d2 xor %edx,%edx ffffffff821350b8: bb 04 00 00 00 mov $0x4,%ebx ffffffff821350bd: 66 ba 58 56 mov $0x5658,%dx ffffffff821350c1: ed in (%dx),%eax <-- hyp= ercall ffffffff821350c2: 89 1f mov %ebx,(%rdi) <-- cr= ash Reading the kernel disassembly shows that RDI should contain the value of a valid kernel stack address here (0xff5eeb3240003e54). Instead it contains 0x40003e54, suggesting the hypervisor cleared the upper 32 bits. And indeed, Alexey discovered that QEMU's vmmouse_get_data() and vmmouse_set_data() are only saving/restoring the lower 32 bits, while clearing the upper 32. Fix that by changing the type of the saved data array from uint32_t to uint64_t. Fixes: 548df2acc6fc ("VMMouse Emulation, by Anthony Liguori.") Reported-by: Justin Forbes Debugged-by: Alexey Makhalov Signed-off-by: Josh Poimboeuf Link: https://lore.kernel.org/r/c508fc1d4a4ccd8c9fb1e51b71df089e31115a53.17= 70309998.git.jpoimboe@kernel.org Reviewed-by: Philippe Mathieu-Daud=C3=A9 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3293 Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini (cherry picked from commit 48c8916aec4319efc60324d9d971831a8a1d6350) Signed-off-by: Michael Tokarev diff --git a/hw/i386/vmmouse.c b/hw/i386/vmmouse.c index 3896159b05..07184a8d56 100644 --- a/hw/i386/vmmouse.c +++ b/hw/i386/vmmouse.c @@ -72,7 +72,7 @@ struct VMMouseState { ISAKBDState *i8042; }; =20 -static void vmmouse_get_data(uint32_t *data) +static void vmmouse_get_data(uint64_t *data) { X86CPU *cpu =3D X86_CPU(current_cpu); CPUX86State *env =3D &cpu->env; @@ -82,7 +82,7 @@ static void vmmouse_get_data(uint32_t *data) data[4] =3D env->regs[R_ESI]; data[5] =3D env->regs[R_EDI]; } =20 -static void vmmouse_set_data(const uint32_t *data) +static void vmmouse_set_data(const uint64_t *data) { X86CPU *cpu =3D X86_CPU(current_cpu); CPUX86State *env =3D &cpu->env; @@ -197,7 +197,7 @@ static void vmmouse_disable(VMMouseState *s) vmmouse_remove_handler(s); } =20 -static void vmmouse_data(VMMouseState *s, uint32_t *data, uint32_t size) +static void vmmouse_data(VMMouseState *s, uint64_t *data, uint32_t size) { int i; =20 @@ -221,7 +221,7 @@ static void vmmouse_data(VMMouseState *s, uint32_t *dat= a, uint32_t size) static uint32_t vmmouse_ioport_read(void *opaque, uint32_t addr) { VMMouseState *s =3D opaque; - uint32_t data[6]; + uint64_t data[6]; uint16_t command; =20 vmmouse_get_data(data); @@ -247,7 +247,7 @@ static uint32_t vmmouse_ioport_read(void *opaque, uint3= 2_t addr) vmmouse_request_absolute(s); break; default: - printf("vmmouse: unknown command %x\n", data[1]); + printf("vmmouse: unknown command %" PRIx64 "\n", data[1]); break; } break; --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773242824; cv=none; d=zohomail.com; s=zohoarc; b=YpXuy2qYqzeguQpXc4PoH+qhT+GRNy5rl5dRaGtbB1hPITlfPWgz0r5vnu2RKZWAUUwgfDddGpANaCjkpA9z3zlvzYy/2RaT36DPBTu7Lm8Kudi60JHlKOU9RfiQwSQ4Sm9NqqCvA+waLhPzOq8zqU3FAiuYQmnssThA7qgWe40= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773242824; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=s4aN9PDhrR+3byRl/fQzmOrBbw+PLIlJFR2oUBeHxlc=; b=Xomb6CgAxjYRW+cdqn4OQJtzzjAV9CD4HEpxGNKkYpVBfAFqF7yPpjAozTyAEvUirm8WN1SECvH0YTgM41SLUxdr3RLMGyv7e4yFj9nNk1187N2aSaEsx3J49HxJiurtHDEQznK2Ejt4jgwC2zEflFaxXXGTfzS0dFTLmYRHxkY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773242824951584.9280449707957; Wed, 11 Mar 2026 08:27:04 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LDp-0004OB-1w; Wed, 11 Mar 2026 11:11:41 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LBL-00080B-S4; Wed, 11 Mar 2026 11:09:07 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LBJ-0005gJ-TQ; Wed, 11 Mar 2026 11:09:07 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id D738E191E9D; Wed, 11 Mar 2026 18:04:42 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id C327E37C2DE; Wed, 11 Mar 2026 18:05:20 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241482; bh=1HjWwuWMbJ/lQLP8MJ0zy8gCLPzqeUaEQHlIXn44DXw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=bdpZk7nedMhY7yGQyqTJufDTwNmWE5Q3v6B4P92aKPqSE9WL3GOIGZ8R8yjnr4x/T OWN78TSQPnIM7Vci0M77KewqnAaULf7J6S6n/ZMv93F3H4sxmJXrthd8TALJ0yDAbb Fzz9sTJrlVrI+foHeyWs0WL8ZrLzSFcQ0VtTHpBgmJrCsaFNumJTTa7Q7uobZwr4k+ PKm8sNWc++31HdNRrmyF+JAmHfCWLG9jK3Lrxwvr3umI9giDI7SsTKzSP/15Zii1S8 cI2X6npdwCy3cxi93wDZbLenDLSFDsOyx0qP4CRfGGom20KdSHri28H/x3lOYJCWGX x23iMIqzd3f7A== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Bernhard Beschow , Mohamed Mediouni , "Wei Liu (Microsoft)" , Paolo Bonzini , Michael Tokarev Subject: [Stable-10.1.5 26/46] target/i386/emulate/x86_decode: Fix compiler warning Date: Wed, 11 Mar 2026 18:03:02 +0300 Message-ID: <20260311150327.1084669-26-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773242826255158500 Content-Type: text/plain; charset="utf-8" From: Bernhard Beschow When compiling for i386-softmmu under MSYS2, GCC emits the following warnin= g: In function 'get_reg_val', inlined from 'calc_modrm_operand64' at ../src/target/i386/emulate/x86= _decode.c:1796:15: ../src/target/i386/emulate/x86_decode.c:1703:5: error: 'memcpy' forming o= ffset [4, 7] is out of the bounds [0, 4] of object 'val' with type 'target_= ulong' {aka 'unsigned int'} [-Werror=3Darray-bounds=3D] 1703 | memcpy(&val, | ^~~~~~~~~~~~ 1704 | get_reg_ref(env, reg, rex_present, is_extended, size), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1705 | size); | ~~~~~ ../src/target/i386/emulate/x86_decode.c: In function 'calc_modrm_operand6= 4': ../src/target/i386/emulate/x86_decode.c:1702:18: note: 'val' declared here 1702 | target_ulong val =3D 0; | ^~~ In the calc_modrm_operand64() case the compiler sees size =3D=3D 8 to be me= m-copied to a target_ulong variable which is only 4 bytes wide in case of i386-softm= mu. Note that when size !=3D 1, get_reg_ref() always returns a pointer to an 8 = byte register, regardless of the target_ulong size. Fix the compiler warning by always providing 8 bytes of storage by means of uint64_t. Fixes: 77a2dba45cc9 ("target/i386/emulate: stop overloading decode->op[N].p= tr") cc: qemu-stable Signed-off-by: Bernhard Beschow Reviewed-by: Mohamed Mediouni Reviewed-by: Wei Liu (Microsoft) Link: https://lore.kernel.org/r/20260223233950.96076-2-mohamed@unpredictabl= e.fr Signed-off-by: Paolo Bonzini (cherry picked from commit c86bca1671e9e4161e2a93d73514384de510bbf3) Signed-off-by: Michael Tokarev diff --git a/target/i386/emulate/x86_decode.c b/target/i386/emulate/x86_dec= ode.c index 2eca39802e..aa14d42c8f 100644 --- a/target/i386/emulate/x86_decode.c +++ b/target/i386/emulate/x86_decode.c @@ -1689,7 +1689,7 @@ void *get_reg_ref(CPUX86State *env, int reg, int rex_= present, target_ulong get_reg_val(CPUX86State *env, int reg, int rex_present, int is_extended, int size) { - target_ulong val =3D 0; + uint64_t val =3D 0; memcpy(&val, get_reg_ref(env, reg, rex_present, is_extended, size), size); --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773242763; cv=none; d=zohomail.com; s=zohoarc; b=iSi8sAy5JOK8hP90q2wGZYYdHfYtS6Ze95vHrwYAB//fGUzTtLGHvhbrBiguKBwZHuVNdbTunwKCXZ8K6e9aKMvcsRMuv0pijND71cszXj/25SNuPgIHpBVNb2ym2sBcytXs/NpIoVZLe9mw8OaaHf33tjPEvjHppkU+cwsieSg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773242763; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=J4bP6TK5AEvvcETDUwWfe/Rxy/00mrXQrdu7iJUEubA=; b=St3l4crZeCLaapOlaslDbbNd2akhDADWocnLbx0hrNIKtANz9lp2GzZ7sIqSZ56JH2gao1Sq8KMAMUkw03Jn4w5L1iYgQLbgg6LW2+NUhH3z6ZAz8a0eaPOiZkMALNMULfpF8eVNXPGr07C3TwU9op91jQEdH7/Zkjh13TVkdTU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773242763266666.4741728514604; Wed, 11 Mar 2026 08:26:03 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LDt-0004wn-8B; Wed, 11 Mar 2026 11:11:45 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LBi-0000x0-7b; Wed, 11 Mar 2026 11:09:30 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LBg-0005gx-D5; Wed, 11 Mar 2026 11:09:29 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id E9DD8191E9E; Wed, 11 Mar 2026 18:04:42 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id D476337C2DF; Wed, 11 Mar 2026 18:05:20 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241482; bh=tKIQbFDzUG8EirEZwKlk5qDDgVJRTRx1UDa675ZwRzM=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=wehspkt1jYFZvLOV566PlDYzX7A0notWtmJqhYTgH2mZGCuX4PWcaBZEfJMnvTzRo Kc5PbyWjY8lbr9uParlhZnaJvC5pAWZbostCoZb+JNCGG6Vxwzh0QfHyFN7ZW56jb2 NqLoCjkch/BQ03x+HHjouVbVWgp/C3KZFTjwa5P8Xiv9FUWt6mDQ397HG/F1T4Ywj7 qiE7jvDpI1AMLMqbJLBY7nq4+uZsNfepjBrRnBS2HawnpwARH+8Z/3y3sIaI8rFJi6 7Wo3hLOAeEMnU01vSfnPnTi8w1o5m3KNER3CmE+5gsYJNL2mpTFcmNhhX3l44z5K6G d3DU7sWdcoagw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Bernhard Beschow , Mohamed Mediouni , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , "Wei Liu (Microsoft)" , Paolo Bonzini , Michael Tokarev Subject: [Stable-10.1.5 27/46] target/i386/hvf/x86_mmu: Fix compiler warning Date: Wed, 11 Mar 2026 18:03:03 +0300 Message-ID: <20260311150327.1084669-27-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773242766264154100 From: Bernhard Beschow When reusing the code in WHPX, GCC emits the following warning when compili= ng for i386-softmmu under MSYS2: In file included from ../src/target/i386/emulate/x86_mmu.c:20: ../src/target/i386/emulate/x86_mmu.c: In function 'vmx_write_mem': ../src/target/i386/emulate/x86_mmu.c:251:25: error: format '%llx' expects= argument of type 'long long unsigned int', but argument 3 has type 'target= _ulong' {aka 'unsigned int'} [-Werror=3Dformat=3D] 251 | VM_PANIC_EX("%s: mmu_gva_to_gpa %llx failed\n", __fun= c__, gva); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ = ~~~ | = | | = target_ulong {aka unsigned int} ../src/target/i386/emulate/panic.h:34:12: note: in definition of macro 'V= M_PANIC_EX' 34 | printf(__VA_ARGS__); \ | ^~~~~~~~~~~ ../src/target/i386/emulate/x86_mmu.c:251:48: note: format string is defin= ed here 251 | VM_PANIC_EX("%s: mmu_gva_to_gpa %llx failed\n", __fun= c__, gva); | ~~~^ | | | long long unsigned= int | %x Fix the warning by reusing the target-specific macro TARGET_FMT_lx which ex= ists for this exact purpose. Fixes: c97d6d2cdf97 ("i386: hvf: add code base from Google's QEMU repositor= y") cc: qemu-stable Signed-off-by: Bernhard Beschow Reviewed-by: Mohamed Mediouni Reviewed-by: Philippe Mathieu-Daud=C3=A9 Reviewed-by: Wei Liu (Microsoft) Link: https://lore.kernel.org/r/20260223233950.96076-3-mohamed@unpredictabl= e.fr Signed-off-by: Paolo Bonzini (cherry picked from commit 529e5e7643078e19d65e694f51cad64be49090ab) Signed-off-by: Michael Tokarev diff --git a/target/i386/hvf/x86_mmu.c b/target/i386/hvf/x86_mmu.c index afc5c17d5d..fe44d2edf4 100644 --- a/target/i386/hvf/x86_mmu.c +++ b/target/i386/hvf/x86_mmu.c @@ -244,7 +244,8 @@ void vmx_write_mem(CPUState *cpu, target_ulong gva, voi= d *data, int bytes) int copy =3D MIN(bytes, 0x1000 - (gva & 0xfff)); =20 if (!mmu_gva_to_gpa(cpu, gva, &gpa)) { - VM_PANIC_EX("%s: mmu_gva_to_gpa %llx failed\n", __func__, gva); + VM_PANIC_EX("%s: mmu_gva_to_gpa " TARGET_FMT_lx " failed\n", + __func__, gva); } else { address_space_write(&address_space_memory, gpa, MEMTXATTRS_UNSPECIFIED, data, copy); @@ -265,7 +266,8 @@ void vmx_read_mem(CPUState *cpu, void *data, target_ulo= ng gva, int bytes) int copy =3D MIN(bytes, 0x1000 - (gva & 0xfff)); =20 if (!mmu_gva_to_gpa(cpu, gva, &gpa)) { - VM_PANIC_EX("%s: mmu_gva_to_gpa %llx failed\n", __func__, gva); + VM_PANIC_EX("%s: mmu_gva_to_gpa " TARGET_FMT_lx " failed\n", + __func__, gva); } address_space_read(&address_space_memory, gpa, MEMTXATTRS_UNSPECIF= IED, data, copy); --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773242546; cv=none; d=zohomail.com; s=zohoarc; b=V+1Ksjgnsl5ISetrNbi6i0yC3XfbNwoFxmsD+ac463frSNmEy644vUwrYMDL7J3iWCI2K7HSiiHQ4sofPEz7ZPilIDKc8mHZHjPTIWHyXBoY94CXVEQho2e+SuKmzpriL8zybW4rxRRkZcWyiEk4VJ2m1H/cNdxu43tIKaLZJxw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773242546; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=/34feIuBJnD43Wat87TqSs/aPaJ/VqAdr7e05XjIQQU=; b=GFbU2zHety9MpldfXeF35He3wjH1svruH+fCUo3fCxiIMptvIehXVSHsUaMijmbP4Fxe4DCGBDYEvw1hoF3BqxIiug2bUONTZcY73tVKP3HRVyBa8QUZ81rrLXjWyw7mBgBX8gSMOtJEznWawUseRdoZVd+skaDDQ5nRx3l86N8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773242546286118.6621747472841; Wed, 11 Mar 2026 08:22:26 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LDv-0005AB-3D; Wed, 11 Mar 2026 11:11:47 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LBj-00015f-KX; Wed, 11 Mar 2026 11:09:31 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LBh-0005hR-BH; Wed, 11 Mar 2026 11:09:31 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 06CBD191E9F; Wed, 11 Mar 2026 18:04:43 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id E846237C2E0; Wed, 11 Mar 2026 18:05:20 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241483; bh=e14xFKU6PZwBStPyZdwDeVLuMz+xSw0CgIS4SxWRuqc=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=bwqmhYqYf75eV5bF2uGaOf5kzcQopYBwp4J+50l3p1hOOhXrtP/ZUEYCu2ZlyHdJH 5HXPN0KBi0cZgXMRvbzaCrZRQ3n9w/wU4WaKwoYTbSlG30Yy52XEqTtyYBGxI9kwAk nxzoKccZriQan6mlNj+7PHzjlwmTXdTtkGOMPCrWGYPTpHlzyjdHLfCtWr6l5BZg2m qeetV5Q5nsx7PYjyAK6eECKjlSaLC+RwonJ3hw/6/GDvD+TqgCHZSP6SIzRiZrCkq+ MSAP9EBt9SsBgoMBARGgA1dOqmlgaOP4ZLo+FGx38oGlgADfLBtjtt4H0/5cBDOWS+ Hifr34hkWunuA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , Michael Tokarev Subject: [Stable-10.1.5 28/46] io: separate freeing of tasks from marking them as complete Date: Wed, 11 Mar 2026 18:03:04 +0300 Message-ID: <20260311150327.1084669-28-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773242548935154100 From: Daniel P. Berrang=C3=A9 The original design of QIOTask was intended to simplify lifecycle management by automatically freeing it when the task was marked as complete. This overlooked the fact that when a QIOTask is used in combination with a GSource, there may be times when the source callback is never invoked. This is typically when a GSource is released before any I/O event arrives. In such cases it is not desirable to mark a QIOTask as complete, but it still needs to be freed. To satisfy this, the task must be released manually. Reviewed-by: Marc-Andr=C3=A9 Lureau Signed-off-by: Daniel P. Berrang=C3=A9 (cherry picked from commit 163cd0ae1182e67509b271f244a73dfd938337b9) Signed-off-by: Michael Tokarev diff --git a/include/io/task.h b/include/io/task.h index 0b5342ee84..98847f5994 100644 --- a/include/io/task.h +++ b/include/io/task.h @@ -96,7 +96,7 @@ typedef void (*QIOTaskWorker)(QIOTask *task, * 1000, * myobject_operation_timer, * task, - * NULL); + * qio_task_free); * } * * @@ -138,9 +138,8 @@ typedef void (*QIOTaskWorker)(QIOTask *task, * the callback func 'myobject_operation_notify' shown * earlier to deal with the results. * - * Once this function returns false, object_unref will be called - * automatically on the task causing it to be released and the - * ref on QMyObject dropped too. + * Once this function returns FALSE, the task will be freed, + * causing it release the ref on QMyObject too. * * The QIOTask module can also be used to perform operations * in a background thread context, while still reporting the @@ -208,8 +207,8 @@ typedef void (*QIOTaskWorker)(QIOTask *task, * 'err' attribute in the task object to determine if * the operation was successful or not. * - * The returned task will be released when qio_task_complete() - * is invoked. + * The returned task must be released by calling + * qio_task_free() when no longer required. * * Returns: the task struct */ @@ -218,6 +217,19 @@ QIOTask *qio_task_new(Object *source, gpointer opaque, GDestroyNotify destroy); =20 +/** + * qio_task_free: + * task: the task object to free + * + * Free the resources associated with the task. Typically + * the qio_task_complete() method will be called immediately + * before this to trigger the task callback, however, it is + * permissible to free the task in the case of cancellation. + * The destroy callback will be used to release the opaque + * data provided to qio_task_new(). + */ +void qio_task_free(QIOTask *task); + /** * qio_task_run_in_thread: * @task: the task struct @@ -268,8 +280,9 @@ void qio_task_wait_thread(QIOTask *task); * qio_task_complete: * @task: the task struct * - * Invoke the completion callback for @task and - * then free its memory. + * Invoke the completion callback for @task. This should typically + * only be invoked once on a task, and then qio_task_free() used + * to free it. */ void qio_task_complete(QIOTask *task); =20 diff --git a/io/channel-tls.c b/io/channel-tls.c index d1c6cf72b2..ce4ee6bb98 100644 --- a/io/channel-tls.c +++ b/io/channel-tls.c @@ -170,6 +170,7 @@ static void qio_channel_tls_handshake_task(QIOChannelTL= S *ioc, trace_qio_channel_tls_handshake_fail(ioc); qio_task_set_error(task, err); qio_task_complete(task); + qio_task_free(task); return; } =20 @@ -183,6 +184,7 @@ static void qio_channel_tls_handshake_task(QIOChannelTL= S *ioc, trace_qio_channel_tls_credentials_allow(ioc); } qio_task_complete(task); + qio_task_free(task); } else { GIOCondition condition; QIOChannelTLSData *data =3D g_new0(typeof(*data), 1); @@ -270,11 +272,13 @@ static void qio_channel_tls_bye_task(QIOChannelTLS *i= oc, QIOTask *task, trace_qio_channel_tls_bye_fail(ioc); qio_task_set_error(task, err); qio_task_complete(task); + qio_task_free(task); return; } =20 if (status =3D=3D QCRYPTO_TLS_BYE_COMPLETE) { qio_task_complete(task); + qio_task_free(task); return; } =20 diff --git a/io/channel-websock.c b/io/channel-websock.c index ec5e09f9ab..13975de4d8 100644 --- a/io/channel-websock.c +++ b/io/channel-websock.c @@ -545,6 +545,7 @@ static gboolean qio_channel_websock_handshake_send(QIOC= hannel *ioc, trace_qio_channel_websock_handshake_fail(ioc, error_get_pretty(err= )); qio_task_set_error(task, err); qio_task_complete(task); + qio_task_free(task); wioc->hs_io_tag =3D 0; return FALSE; } @@ -561,6 +562,7 @@ static gboolean qio_channel_websock_handshake_send(QIOC= hannel *ioc, trace_qio_channel_websock_handshake_complete(ioc); qio_task_complete(task); } + qio_task_free(task); wioc->hs_io_tag =3D 0; return FALSE; } @@ -588,6 +590,7 @@ static gboolean qio_channel_websock_handshake_io(QIOCha= nnel *ioc, trace_qio_channel_websock_handshake_fail(ioc, error_get_pretty(err= )); qio_task_set_error(task, err); qio_task_complete(task); + qio_task_free(task); wioc->hs_io_tag =3D 0; return FALSE; } diff --git a/io/task.c b/io/task.c index 451f26f8b4..331febd4e1 100644 --- a/io/task.c +++ b/io/task.c @@ -70,8 +70,12 @@ QIOTask *qio_task_new(Object *source, return task; } =20 -static void qio_task_free(QIOTask *task) +void qio_task_free(QIOTask *task) { + if (!task) { + return; + } + qemu_mutex_lock(&task->thread_lock); if (task->thread) { if (task->thread->destroy) { @@ -110,6 +114,7 @@ static gboolean qio_task_thread_result(gpointer opaque) =20 trace_qio_task_thread_result(task); qio_task_complete(task); + qio_task_free(task); =20 return FALSE; } @@ -196,7 +201,6 @@ void qio_task_complete(QIOTask *task) { task->func(task, task->opaque); trace_qio_task_complete(task); - qio_task_free(task); } =20 =20 diff --git a/tests/unit/test-io-task.c b/tests/unit/test-io-task.c index 115dba8970..b1c8ecb7ab 100644 --- a/tests/unit/test-io-task.c +++ b/tests/unit/test-io-task.c @@ -73,6 +73,7 @@ static void test_task_complete(void) src =3D qio_task_get_source(task); =20 qio_task_complete(task); + qio_task_free(task); =20 g_assert(obj =3D=3D src); =20 @@ -84,6 +85,28 @@ static void test_task_complete(void) } =20 =20 +static void test_task_cancel(void) +{ + QIOTask *task; + Object *obj =3D object_new(TYPE_DUMMY); + Object *src; + struct TestTaskData data =3D { NULL, NULL, false }; + + task =3D qio_task_new(obj, task_callback, &data, NULL); + src =3D qio_task_get_source(task); + + qio_task_free(task); + + g_assert(obj =3D=3D src); + + object_unref(obj); + + g_assert(data.source =3D=3D NULL); + g_assert(data.err =3D=3D NULL); + g_assert(data.freed =3D=3D false); +} + + static void task_data_free(gpointer opaque) { struct TestTaskData *data =3D opaque; @@ -101,6 +124,7 @@ static void test_task_data_free(void) task =3D qio_task_new(obj, task_callback, &data, task_data_free); =20 qio_task_complete(task); + qio_task_free(task); =20 object_unref(obj); =20 @@ -123,6 +147,7 @@ static void test_task_failure(void) =20 qio_task_set_error(task, err); qio_task_complete(task); + qio_task_free(task); =20 object_unref(obj); =20 @@ -260,6 +285,7 @@ int main(int argc, char **argv) module_call_init(MODULE_INIT_QOM); type_register_static(&dummy_info); g_test_add_func("/crypto/task/complete", test_task_complete); + g_test_add_func("/crypto/task/cancel", test_task_cancel); g_test_add_func("/crypto/task/datafree", test_task_data_free); g_test_add_func("/crypto/task/failure", test_task_failure); g_test_add_func("/crypto/task/thread_complete", test_task_thread_compl= ete); --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773241975; cv=none; d=zohomail.com; s=zohoarc; b=FvmTiCIpjqbCxk7fGj54nAftu/4U5cRc5X/e45GIOEAAA9zowuLxPInbvTsrM9lo4afuy27AHfdUNAhbcMLtDbhLEvqL0dxFLpqgQUS+/XiGwLiPkysfTJGwEfuc3LhQ0MEbmz1YYOYl1Bpq6av0BfruprdG/YjRmOqHU1GZQp0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773241975; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=oB2lmmp+7pvnbhGIdIvCeO4tHPjIuZPna6chfqxOYXo=; b=gPhpCs2p6ol1+Pwl2qpjKb9Qz6I8kDemOyj/yzgslP29JsuEYPjziI5P/LP/RpG+lPDDJon2sqDxXXWLLg1y5pjNuD92zMaYJlj2zeWMt7Z1Skf27wBGFY8DXWXemoVp8Fbh3Kku8SGF5N+hYRNSeT+pvnRl1EdOK8OANgjKSG4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773241975489221.84327588780502; Wed, 11 Mar 2026 08:12:55 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LD7-0003Xy-64; Wed, 11 Mar 2026 11:11:01 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LBl-0001JM-PU; Wed, 11 Mar 2026 11:09:33 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LBj-0005lW-NL; Wed, 11 Mar 2026 11:09:33 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 165C7191EA0; Wed, 11 Mar 2026 18:04:43 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 0491037C2E1; Wed, 11 Mar 2026 18:05:21 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241483; bh=CYzXWLGQoPXvgockatRsrujnVIM9hpdoLe9ML5C28m0=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=qd25xpnejlajLhxFTaR5+KcQr07MekyJxH/+6OHuZzlxuB9g87VvRMmF5mPLL3mSR PgIBw1ZpB+MsgMklJROS3/bCYT8PB7kS9qVF8dgMN0HDTJP4Kn/n4YcO9J1BQwvARq g6rhExcrq5obGigfHnip+bEAXlOABfJjYR+1W5RNRIdIR4cYAbITsZYXQDSXoqX7zO hgQYGQFMYhzelP9AyBJ+EcP5buuCfc5tDyv3RPIfhxNn4fHO9G2WBzscKbocJw7hlJ aPZ5TLLhN5BEe8w7EAa1JXhk9AVhTmEE1G+Y3Evj4qkcP3nwI5SwzoeYhkCV7Otg3j f+nONhxpc58vQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , Michael Tokarev Subject: [Stable-10.1.5 29/46] io: fix cleanup for TLS I/O source data on cancellation Date: Wed, 11 Mar 2026 18:03:05 +0300 Message-ID: <20260311150327.1084669-29-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773241977137158500 From: Daniel P. Berrang=C3=A9 The TLS code will create a GSource for tracking completion of the handshake process, passing a QIOChannelTLSData struct that contains various data items. The data struct is freed by the callback when it completes, which means when a source is cancelled, nothing is free'ing the data struct or its contents. Switch to provide a data free callback to the GSource, which ensures the QIOChannelTLSData struct is always freed even when the main event callback never fires. Fixes: https://gitlab.com/qemu-project/qemu/-/issues/3114 Reviewed-by: Marc-Andr=C3=A9 Lureau Signed-off-by: Daniel P. Berrang=C3=A9 (cherry picked from commit d39d0f3acdd7c1bb275db7e97b511f98254ecd9f) Signed-off-by: Michael Tokarev diff --git a/io/channel-tls.c b/io/channel-tls.c index ce4ee6bb98..a686ee2058 100644 --- a/io/channel-tls.c +++ b/io/channel-tls.c @@ -153,13 +153,32 @@ struct QIOChannelTLSData { }; typedef struct QIOChannelTLSData QIOChannelTLSData; =20 +static void qio_channel_tls_io_data_free(gpointer user_data) +{ + QIOChannelTLSData *data =3D user_data; + /* + * Usually 'task' will be NULL since the GSource + * callback will either complete the task or pass + * it on to a new GSource. We'll see a non-NULL + * task here only if the GSource was released before + * its callback triggers + */ + if (data->task) { + qio_task_free(data->task); + } + if (data->context) { + g_main_context_unref(data->context); + } + g_free(data); +} + static gboolean qio_channel_tls_handshake_io(QIOChannel *ioc, GIOCondition condition, gpointer user_data); =20 -static void qio_channel_tls_handshake_task(QIOChannelTLS *ioc, - QIOTask *task, - GMainContext *context) +static gboolean qio_channel_tls_handshake_task(QIOChannelTLS *ioc, + QIOTask *task, + GMainContext *context) { Error *err =3D NULL; int status; @@ -170,8 +189,7 @@ static void qio_channel_tls_handshake_task(QIOChannelTL= S *ioc, trace_qio_channel_tls_handshake_fail(ioc); qio_task_set_error(task, err); qio_task_complete(task); - qio_task_free(task); - return; + return TRUE; } =20 if (status =3D=3D QCRYPTO_TLS_HANDSHAKE_COMPLETE) { @@ -184,7 +202,7 @@ static void qio_channel_tls_handshake_task(QIOChannelTL= S *ioc, trace_qio_channel_tls_credentials_allow(ioc); } qio_task_complete(task); - qio_task_free(task); + return TRUE; } else { GIOCondition condition; QIOChannelTLSData *data =3D g_new0(typeof(*data), 1); @@ -208,8 +226,9 @@ static void qio_channel_tls_handshake_task(QIOChannelTL= S *ioc, condition, qio_channel_tls_handshake_io, data, - NULL, + qio_channel_tls_io_data_free, context); + return FALSE; } } =20 @@ -225,11 +244,9 @@ static gboolean qio_channel_tls_handshake_io(QIOChanne= l *ioc, qio_task_get_source(task)); =20 tioc->hs_ioc_tag =3D 0; - g_free(data); - qio_channel_tls_handshake_task(tioc, task, context); - - if (context) { - g_main_context_unref(context); + if (!qio_channel_tls_handshake_task(tioc, task, context)) { + /* task is kept by new GSource so must not be released yet */ + data->task =3D NULL; } =20 return FALSE; @@ -252,14 +269,16 @@ void qio_channel_tls_handshake(QIOChannelTLS *ioc, func, opaque, destroy); =20 trace_qio_channel_tls_handshake_start(ioc); - qio_channel_tls_handshake_task(ioc, task, context); + if (qio_channel_tls_handshake_task(ioc, task, context)) { + qio_task_free(task); + } } =20 static gboolean qio_channel_tls_bye_io(QIOChannel *ioc, GIOCondition condi= tion, gpointer user_data); =20 -static void qio_channel_tls_bye_task(QIOChannelTLS *ioc, QIOTask *task, - GMainContext *context) +static gboolean qio_channel_tls_bye_task(QIOChannelTLS *ioc, QIOTask *task, + GMainContext *context) { GIOCondition condition; QIOChannelTLSData *data; @@ -272,14 +291,12 @@ static void qio_channel_tls_bye_task(QIOChannelTLS *i= oc, QIOTask *task, trace_qio_channel_tls_bye_fail(ioc); qio_task_set_error(task, err); qio_task_complete(task); - qio_task_free(task); - return; + return TRUE; } =20 if (status =3D=3D QCRYPTO_TLS_BYE_COMPLETE) { qio_task_complete(task); - qio_task_free(task); - return; + return TRUE; } =20 data =3D g_new0(typeof(*data), 1); @@ -299,7 +316,10 @@ static void qio_channel_tls_bye_task(QIOChannelTLS *io= c, QIOTask *task, trace_qio_channel_tls_bye_pending(ioc, status); ioc->bye_ioc_tag =3D qio_channel_add_watch_full(ioc->master, condition, qio_channel_tls_bye_io, - data, NULL, context); + data, + qio_channel_tls_io_data_= free, + context); + return FALSE; } =20 =20 @@ -312,11 +332,9 @@ static gboolean qio_channel_tls_bye_io(QIOChannel *ioc= , GIOCondition condition, QIOChannelTLS *tioc =3D QIO_CHANNEL_TLS(qio_task_get_source(task)); =20 tioc->bye_ioc_tag =3D 0; - g_free(data); - qio_channel_tls_bye_task(tioc, task, context); - - if (context) { - g_main_context_unref(context); + if (!qio_channel_tls_bye_task(tioc, task, context)) { + /* task is kept by new GSource so must not be released yet */ + data->task =3D NULL; } =20 return FALSE; --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773242670; cv=none; d=zohomail.com; s=zohoarc; b=bDuhahAxlP5nem1xXeBk3YwO4s7bN0LaTS+zL+9BANJ8LUkQ3JlsbijVrL8o8Mz4z3nPMAEUGCnS5x8px81Ul4Hww0YTV4FWAN3KEFsR92SfBjGK6meQKBeIEmLvDkjI33R6tPS9wDXlVwgy7sPo0A04SZ4elmKjLxv8UNnfZPg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773242670; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=hk+6WitVlVGkLnyfFcKBYLT4xUuwHfgalIqmE+TwtW8=; b=HaSuZWKJNzisjpVhr+bP8pj/SIhNzKqYi8YFZl7ytEcTRX4T11zBkSnbWg3KiKDML1kDyCeCp2laRqJ8V0b/JMIqkyw6RirK2lE1BPwtDKEvuE14MmIbxXTZQCS6aiOiWCfybPCZIWgS35pQqW6YelBJBELxgRHTGzEn5QOQ0Co= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773242670475745.6103887479366; Wed, 11 Mar 2026 08:24:30 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LEB-0006zz-JL; Wed, 11 Mar 2026 11:12:05 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LBn-0001RV-7z; Wed, 11 Mar 2026 11:09:35 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LBl-0005lx-7D; Wed, 11 Mar 2026 11:09:34 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 26DFA191EA1; Wed, 11 Mar 2026 18:04:43 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 14E5C37C2E2; Wed, 11 Mar 2026 18:05:21 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241483; bh=OX1yRQrjvcNrTu5Uqdaf9TalndvJT2EDN5zhfa1wsv8=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=OXKrQH/OmJ4fgCyPhyKg4jK+lW/lzwLpbPKOPX7P5B0tUSj5f32RPdZLJ4DaLI8Z6 kn98JyJaLOJZ+/vSqOR4ipA96ZAAJEwIyRCxKqPTiI23nCHa6m/p6SD06o3WW4RNS/ 9hTfOhxeNRtICUWlUEvvZiGABiVTrcRkIg6I8DWN7/OA10i7LOjYG5p16udQUAv0XX n4UsqMk7iQ9DEAJeLqHzeAO9b/XT15qUMlDF2MAIEcsuVieti6P0SmBLJdstQy2xFr eQJkJ04H5YigyV8UbY77keZUfdnitwsI6IOrcKYbdQaFmT/SoNb4LiPoJoLJ0wLPG1 JppE2wb6Qa6Fg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , Michael Tokarev Subject: [Stable-10.1.5 30/46] io: fix cleanup for websock I/O source data on cancellation Date: Wed, 11 Mar 2026 18:03:06 +0300 Message-ID: <20260311150327.1084669-30-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773242671435158500 From: Daniel P. Berrang=C3=A9 The websock code will create a GSource for tracking completion of the handshake process, passing a QIOTask which is freed by the callback when it completes, which means when a source is cancelled, nothing is free'ing the task. Switch to provide a data free callback to the GSource, which ensures the QIOTask is always freed even when the main event callback never fires. Fixes: https://gitlab.com/qemu-project/qemu/-/issues/3114 Signed-off-by: Daniel P. Berrang=C3=A9 (cherry picked from commit 9545c059f77e3f814fcbaba83203572ea655c50e) Signed-off-by: Michael Tokarev diff --git a/io/channel-websock.c b/io/channel-websock.c index 13975de4d8..c9d5861230 100644 --- a/io/channel-websock.c +++ b/io/channel-websock.c @@ -526,11 +526,32 @@ static int qio_channel_websock_handshake_read(QIOChan= nelWebsock *ioc, return 1; } =20 +typedef struct QIOChannelWebsockData { + QIOTask *task; +} QIOChannelWebsockData; + +static void qio_channel_websock_data_free(gpointer user_data) +{ + QIOChannelWebsockData *data =3D user_data; + /* + * Usually 'task' will be NULL since the GSource + * callback will either complete the task or pass + * it on to a new GSource. We'll see a non-NULL + * task here only if the GSource was released before + * its callback triggers + */ + if (data->task) { + qio_task_free(data->task); + } + g_free(data); +} + static gboolean qio_channel_websock_handshake_send(QIOChannel *ioc, GIOCondition condition, gpointer user_data) { - QIOTask *task =3D user_data; + QIOChannelWebsockData *data =3D user_data; + QIOTask *task =3D data->task; QIOChannelWebsock *wioc =3D QIO_CHANNEL_WEBSOCK( qio_task_get_source(task)); Error *err =3D NULL; @@ -545,7 +566,6 @@ static gboolean qio_channel_websock_handshake_send(QIOC= hannel *ioc, trace_qio_channel_websock_handshake_fail(ioc, error_get_pretty(err= )); qio_task_set_error(task, err); qio_task_complete(task); - qio_task_free(task); wioc->hs_io_tag =3D 0; return FALSE; } @@ -562,7 +582,6 @@ static gboolean qio_channel_websock_handshake_send(QIOC= hannel *ioc, trace_qio_channel_websock_handshake_complete(ioc); qio_task_complete(task); } - qio_task_free(task); wioc->hs_io_tag =3D 0; return FALSE; } @@ -574,7 +593,8 @@ static gboolean qio_channel_websock_handshake_io(QIOCha= nnel *ioc, GIOCondition condition, gpointer user_data) { - QIOTask *task =3D user_data; + QIOChannelWebsockData *data =3D user_data, *newdata =3D NULL; + QIOTask *task =3D data->task; QIOChannelWebsock *wioc =3D QIO_CHANNEL_WEBSOCK( qio_task_get_source(task)); Error *err =3D NULL; @@ -590,7 +610,6 @@ static gboolean qio_channel_websock_handshake_io(QIOCha= nnel *ioc, trace_qio_channel_websock_handshake_fail(ioc, error_get_pretty(err= )); qio_task_set_error(task, err); qio_task_complete(task); - qio_task_free(task); wioc->hs_io_tag =3D 0; return FALSE; } @@ -603,12 +622,14 @@ static gboolean qio_channel_websock_handshake_io(QIOC= hannel *ioc, error_propagate(&wioc->io_err, err); =20 trace_qio_channel_websock_handshake_reply(ioc); + newdata =3D g_new0(QIOChannelWebsockData, 1); + newdata->task =3D g_steal_pointer(&data->task); wioc->hs_io_tag =3D qio_channel_add_watch( wioc->master, G_IO_OUT, qio_channel_websock_handshake_send, - task, - NULL); + newdata, + qio_channel_websock_data_free); return FALSE; } =20 @@ -904,12 +925,12 @@ void qio_channel_websock_handshake(QIOChannelWebsock = *ioc, gpointer opaque, GDestroyNotify destroy) { - QIOTask *task; + QIOChannelWebsockData *data =3D g_new0(QIOChannelWebsockData, 1); =20 - task =3D qio_task_new(OBJECT(ioc), - func, - opaque, - destroy); + data->task =3D qio_task_new(OBJECT(ioc), + func, + opaque, + destroy); =20 trace_qio_channel_websock_handshake_start(ioc); trace_qio_channel_websock_handshake_pending(ioc, G_IO_IN); @@ -917,8 +938,8 @@ void qio_channel_websock_handshake(QIOChannelWebsock *i= oc, ioc->master, G_IO_IN, qio_channel_websock_handshake_io, - task, - NULL); + data, + qio_channel_websock_data_free); } =20 =20 --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773242303; cv=none; d=zohomail.com; s=zohoarc; b=G9QZ23i9j/HwUhMkA1FlZqcn/3DJNRCTX3YXNV5MEQ46Dnp5Uu+g/pfiC+lrf39GGmHsOLYcZ+Mb5s8qofLdWPOWoCr1xzFNzW4QR49Nr3Osr5YfHKPnL7eVguhXH2gn6+40IUhFQ1MoBhZu39zs/boXVWxrJ0YSY467ppTwMwg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773242303; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=sJiE7uNHEvsiY/+RrRDh4zn3+YLFeKF90Wu94hXJjYg=; b=lYZPRpAuOYb/0l3ik7zPXC2USO/8uPj4adYr58FEZas0sBHTg8N+bw22brskuZXWqMfS2ZIdv0WCMRdsUHRbJrbujkfFbqW4WQrYeRO9GR3T7jF8yvuHEj+A4xv0g8mHBRmD/SbJjOnSeyiIymbnLhVB75KfnEdN0hrk0zgmO3s= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773242302997510.59256838960187; Wed, 11 Mar 2026 08:18:22 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LDZ-00040s-TH; Wed, 11 Mar 2026 11:11:26 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LC8-0002R6-Um; Wed, 11 Mar 2026 11:09:59 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LC7-0005mQ-9r; Wed, 11 Mar 2026 11:09:56 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 38AEF191EA2; Wed, 11 Mar 2026 18:04:43 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 256C137C2E3; Wed, 11 Mar 2026 18:05:21 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241483; bh=h/kUl/xQLmRb/S4svpv2ZTc8FHO1O9r77yc2rDjhLuM=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=b/NkV7Yt78mzjgOuzF/yV5Qs46geax5JXz7dzaksXl0R/NqZKxIB9CVbRPCs5gGId WQMM1d9gAp97IwOXgVaKSxpo4wsD0XWF7IUSy83Y5kj0W2BRLOIcozscAkO55DbbYr ti1Z7OXpAZ/sFZbhLiecaS4XhxPeSfetEJzKI9gfB/tah/SyLYE2hV0JqVRx7IvYoo tS2JT0x0s2tpt6Gy45OmgJctyXKtt32NJm5R4v5TfAmDL0TTfzKFhDGuwdVIOLOwKL oQBWGUknJe/qy1UkLMC/4zm+1vZkjKDofH06ss4ZvCckHL8BChvuB1I0kXwu+p6aFj 5QXmnPz4CJcVA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-10.1.5 31/46] hw/net/smc91c111: Don't allow negative-length packets Date: Wed, 11 Mar 2026 18:03:07 +0300 Message-ID: <20260311150327.1084669-31-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773242303253158500 From: Peter Maydell The smc91c111 data frame format in memory (figure 8-1 in the datasheet) includes a "byte count" field which is intended to be the total size of the data frame, including not just the packet data but also the leading and trailing information like the status word and the byte count field itself. It is therefore possible for the guest to set this to a value so small that the leading and trailing fields won't fit and the packet has effectively a negative area. We weren't checking for this, with the result that when we subtract 6 from the length to get the length of the packet proper we end up with a negative length, which is then inconsistently handled in the qemu_send_packet() code such that we can try to transmit a very large amount of data and read off the end of the device's data array. Treat excessively small length values the same way we do excessively large values. As with the oversized case, the datasheet does not describe what happens for this software error case, and there is no relevant tx error condition for this, so we just log and drop the packet. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3304 Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daud=C3=A9 Message-id: 20260226175549.1319476-1-peter.maydell@linaro.org (cherry picked from commit d8e19f8042dcaff8e077292209c8196acb150bdd) Signed-off-by: Michael Tokarev diff --git a/hw/net/smc91c111.c b/hw/net/smc91c111.c index 5cd78e334b..f2c2e22dd0 100644 --- a/hw/net/smc91c111.c +++ b/hw/net/smc91c111.c @@ -30,6 +30,12 @@ * LAN91C111 datasheet). */ #define MAX_PACKET_SIZE 2048 +/* + * Size of the non-data fields in a data frame: status word, + * byte count, control byte, and last data byte; this defines + * the smallest value the byte count in the frame can validly be. + */ +#define MIN_PACKET_SIZE 6 =20 #define TYPE_SMC91C111 "smc91c111" OBJECT_DECLARE_SIMPLE_TYPE(smc91c111_state, SMC91C111) @@ -289,7 +295,7 @@ static void smc91c111_do_tx(smc91c111_state *s) *(p++) =3D 0x40; len =3D *(p++); len |=3D ((int)*(p++)) << 8; - if (len > MAX_PACKET_SIZE) { + if (len < MIN_PACKET_SIZE || len > MAX_PACKET_SIZE) { /* * Datasheet doesn't say what to do here, and there is no * relevant tx error condition listed. Log, and drop the packe= t. @@ -300,7 +306,13 @@ static void smc91c111_do_tx(smc91c111_state *s) smc91c111_complete_tx_packet(s, packetnum); continue; } - len -=3D 6; + /* + * Convert from size of the data frame to number of bytes of + * actual packet data. Whether the "last data byte" field is + * included in the packet depends on the ODD bit in the control + * byte at the end of the frame. + */ + len -=3D MIN_PACKET_SIZE; control =3D p[len + 1]; if (control & 0x20) len++; --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773242300; cv=none; d=zohomail.com; s=zohoarc; b=Zj+KDSsxZi5ia8tDvZlG2ojZAEyg8edD/RPE3ihitG3CZ3IY2KzHwtOFqPoomkNYgpFdU8tRBy17aiUQnxZmP+hBGmn+vQ3sLG+ZqeVFq5fcZtZZD1I6Ev23QleDU7mKspx6T+ojjg2rAgvJzcJPfcJjIzumaxq4JUePuIvZltw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773242300; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=AAKzuoOrJUp8jOW1q60n1JJGs4qi0we/EgmNMP5J38Y=; b=GNo31mfuiS3pSPVtMXMKbeJh3EUCjvcx9tCbE6T0Rm26GXY/lSbkMgiZ6ZkxgNFPIqQ54ng0HwSyhtOlYRUUH4O9pPghCc8gxFXierD8E3Q9InGpao7dMy4dM13upMae92S9aLy20dzx2SHuTlBrabVE+CgQ5vV0U3mrMCZzY8M= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773242300876718.1461603635568; Wed, 11 Mar 2026 08:18:20 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LEM-0007P6-01; Wed, 11 Mar 2026 11:12:14 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LCA-0002RI-6T; Wed, 11 Mar 2026 11:09:59 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LC8-0005mz-QM; Wed, 11 Mar 2026 11:09:57 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 5272B191EA3; Wed, 11 Mar 2026 18:04:43 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 36A8937C2E4; Wed, 11 Mar 2026 18:05:21 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241483; bh=uIKZ9OHCybJ/gZkACDfYorTkJXG2LgGPSPVro8zrSvk=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=kQEl0AHtM41lDJ3E/WfFfBYBLE7kpxR/XX9Yz8siFoh+X5RP6JMvMgTcR3/XX88OR ZPeAs+VOAupsd4iEOcLQpUxDR4SZr2vr1KeG0+btlX+YO2TJYIVIniyhxy3juGUlOc Z3W+u/6jarLPs82iPFKn3Cz74RP6Fh6V+L6GCVTy+1gZNec6z3W+zdFZIoKI1mogYQ 18kdHnYCZmgMxwUrAZ9BjHSOrKhYWnUwen8JXIz6TB8x6abYsIGCN0dwTYz/BYRAvp nHKXZYTh0KIeiF+b7p5OPvJP4KOnXDth2dCtjmMARQGsuzr3v0Isw4fEHgQqT5swVR 428/ZACITSjlg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, "Halil Oktay (oblivionsage)" , Kevin Wolf , Michael Tokarev Subject: [Stable-10.1.5 32/46] block/vmdk: fix OOB read in vmdk_read_extent() Date: Wed, 11 Mar 2026 18:03:08 +0300 Message-ID: <20260311150327.1084669-32-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773242301283158500 Content-Type: text/plain; charset="utf-8" From: "Halil Oktay (oblivionsage)" Bounds check for marker.size doesn't account for the 12-byte marker header, allowing zlib to read past the allocated buffer. Move the check inside the has_marker block and subtract the marker size. Fixes: CVE-2026-2243 Reported-by: Halil Oktay (oblivionsage) Signed-off-by: Halil Oktay (oblivionsage) Reviewed-by: Kevin Wolf Signed-off-by: Kevin Wolf (cherry picked from commit cfda94eddb6c9c49b66461c950b22845a46a75c9) Signed-off-by: Michael Tokarev diff --git a/block/vmdk.c b/block/vmdk.c index 64051d55aa..af9387ee0e 100644 --- a/block/vmdk.c +++ b/block/vmdk.c @@ -1951,10 +1951,10 @@ vmdk_read_extent(VmdkExtent *extent, int64_t cluste= r_offset, marker =3D (VmdkGrainMarker *)cluster_buf; compressed_data =3D marker->data; data_len =3D le32_to_cpu(marker->size); - } - if (!data_len || data_len > buf_bytes) { - ret =3D -EINVAL; - goto out; + if (!data_len || data_len > buf_bytes - sizeof(VmdkGrainMarker)) { + ret =3D -EINVAL; + goto out; + } } ret =3D uncompress(uncomp_buf, &buf_len, compressed_data, data_len); if (ret !=3D Z_OK) { --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773242801; cv=none; d=zohomail.com; s=zohoarc; b=aBAnu/oIW4QZWXQKIGeBa4n79F2Abg2hzQtE5iEKgVyyl7eAmFtMORBsgCBkOosmKiRTLx3T1vGo7+3dL9kvUZCVkety6Jr+tOLol4t0uuI+itACeQdwnHkn0jV40Tl+EkLD+Qc+hbO+UC3IF9QJkRrSuS4j1G8n1Uz9Rxn28wo= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773242801; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=pwJTzTWJX3UNt9rfXRjBC+5tjiNHSAtUoDAzKN1sZ9g=; b=DhBQl100LneojKEqUB6BKWSvds92UVLMHh1Ob1XMMT6z1BmOs4mh+5WhTtkCTbI7HVP/JiM0aRnbqs5eHaRKAJRp4xFNkNEVRxpu3ZyaYskJtPGWIyDH7/VXG3kryKEArSBTOq6/scdYeDtFXjDgUkBr71xOpNnox6RE5s2Al9E= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773242801672195.30585667870082; Wed, 11 Mar 2026 08:26:41 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LEN-0007cA-0f; Wed, 11 Mar 2026 11:12:15 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LCD-0002cL-NJ; Wed, 11 Mar 2026 11:10:01 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LCA-0005pK-Ef; Wed, 11 Mar 2026 11:10:00 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 632AD191EA4; Wed, 11 Mar 2026 18:04:43 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 50D8F37C2E5; Wed, 11 Mar 2026 18:05:21 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241483; bh=1+0w7xRv/DZ7PGz4an+pI/7zGWxeu5zPdwS/hJ4BtIg=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=p5+KyAX0dPMMbr8mdemDZegCGJcuhr+3hKdYcIaB5GnnwijRoYgc0FE4vYoEi8CdF gtj4Pzk6I37xgNNd8oOc5EYZJ/kuVjG8X1hA1B0bTOs9XVdwdECD01kpwD2SPDC8ca EOhNgp+6MyhGZhYTZ6JtvjSSYkqut5hSWPEmMZ32JneYTp9YNggcQo1Kp95bWWyxRV DtcsUEDSfaWRDW+/0EKlR6dOn1HQEV3+JR1mQl3vuWz2WCfbOIUmmcItlPshRykYvZ +bN8FHrKqDu5wfKN2JpAdM0z6HLqL8Np6soBTC5Zx3n5vxnK5Z3cYixw7VMoGvm43x Qb8+xL7Mk6hiA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Antoine Damhet , Kevin Wolf , Michael Tokarev Subject: [Stable-10.1.5 33/46] block/curl: fix concurrent completion handling Date: Wed, 11 Mar 2026 18:03:09 +0300 Message-ID: <20260311150327.1084669-33-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773242803129158500 Content-Type: text/plain; charset="utf-8" From: Antoine Damhet curl_multi_check_completion would bail upon the first completed transfer even if more completion messages were available thus leaving some in flight IOs stuck. Rework a bit the loop to make the iterations clearer and drop the breaks. The original hang can be somewhat reproduced with the following command: $ qemu-img convert -p -m 16 -O qcow2 -c --image-opts \ 'file.driver=3Dhttps,file.url=3Dhttps://scaleway.testdebit.info/10G.iso,f= ile.readahead=3D1M' \ /tmp/test.qcow2 Fixes: 1f2cead32443 ("curl: Ensure all informationals are checked for compl= etion") Cc: qemu-stable@nongnu.org Signed-off-by: Antoine Damhet Message-ID: <20260212162730.440855-2-adamhet@scaleway.com> Signed-off-by: Kevin Wolf (cherry picked from commit 6f7b0a23a6ea0cc72ad222ab37936248d99d4256) Signed-off-by: Michael Tokarev diff --git a/block/curl.c b/block/curl.c index 96498aac1d..dabd2a905e 100644 --- a/block/curl.c +++ b/block/curl.c @@ -324,17 +324,11 @@ curl_find_buf(BDRVCURLState *s, uint64_t start, uint6= 4_t len, CURLAIOCB *acb) static void curl_multi_check_completion(BDRVCURLState *s) { int msgs_in_queue; + CURLMsg *msg; =20 /* Try to find done transfers, so we can free the easy * handle again. */ - for (;;) { - CURLMsg *msg; - msg =3D curl_multi_info_read(s->multi, &msgs_in_queue); - - /* Quit when there are no more completions */ - if (!msg) - break; - + while ((msg =3D curl_multi_info_read(s->multi, &msgs_in_queue))) { if (msg->msg =3D=3D CURLMSG_DONE) { int i; CURLState *state =3D NULL; @@ -397,7 +391,6 @@ static void curl_multi_check_completion(BDRVCURLState *= s) } =20 curl_clean_state(state); - break; } } } --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773242884; cv=none; d=zohomail.com; s=zohoarc; b=HZm+eA/PKxJQ6lrGqZhkuu4MQoXu9jiY+TdV+seW200dgTnYjeZTUbo2V5hi8yNOEK6RTGmDcwhE7HEPEPweoijqF+fDanQ3S+u9amFUwuLlCuFx06VG1oAxECTEaCe4j49e+bM4vqyXy+1bpwOtSoKqkhQmgqWNoAbmZiGeRpA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773242884; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=gnAqGJeH3fp/VcW9lykx2lorZUaXSLmxiZBdwdui/NY=; b=L4Y+YWN2X5TiEd+M/SPRxytybml0bwqxdzTde2B/M8TSJ9Ts6KxyZEiRfPHBQzRI+jA32lnSOPQchFRBw9qgceBxrQHDYdeZiIfGSvxHRd0YR5W21a+QND7SxbcnVVrFunVxr+ZYIZprjogHcNfibEYAUGR7k5t6BplEvSOGXTE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773242884079875.6198530445746; Wed, 11 Mar 2026 08:28:04 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LEO-0007mX-Fm; Wed, 11 Mar 2026 11:12:16 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LCD-0002cM-PU; Wed, 11 Mar 2026 11:10:02 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LCB-0005pV-Mb; Wed, 11 Mar 2026 11:10:01 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 77265191EA5; Wed, 11 Mar 2026 18:04:43 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 61B9E37C2E6; Wed, 11 Mar 2026 18:05:21 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241483; bh=CLgO+i9uE6yw0o/c7fPWp6c3Ly99nYGSb8fZpZqd5P0=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=AXHf5pzOYJ2iAFh7cOHIMbEZO2j4hyUD7jtlojOjjMXROwljwqUUpy1foURHxq6Xk FubPjl5BlV/iT/tHllHNBQ8lPgxFm3D7hPLfPrrPop7VKvkVUpOx1pIL6gFi7N8VQb EwJnLixXNER+jo32LcZqse4ObODSRiv2mqzwxfR2SlxQf5xQoTw80bsk6dVDI2A74O QLeCfat2lwpEBvJEAvT1MRjL3tvuXQjuSuKMSsQ6YER0Xv5OU166ZIUn5wBxw2oRi/ 4fYBO8rc6mXT8wIs2k5fIm1SRiDvzDIW9fZu0NSu8EXriBHETCwMz/dYiJTIEufArK EGc0sAsECCN+Q== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Kevin Wolf , Fiona Ebner , Jean-Louis Dupond , Michael Tokarev Subject: [Stable-10.1.5 34/46] mirror: Fix missed dirty bitmap writes during startup Date: Wed, 11 Mar 2026 18:03:10 +0300 Message-ID: <20260311150327.1084669-34-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773242884870158500 Content-Type: text/plain; charset="utf-8" From: Kevin Wolf Currently, mirror disables the block layer's dirty bitmap before its own replacement is working. This means that during startup, there is a window in which the allocation status of blocks in the source has already been checked, but new writes coming in aren't tracked yet, resulting in a corrupted copy: 1. Dirty bitmap is disabled in mirror_start_job() 2. Some request are started in mirror_top_bs while s->job =3D=3D NULL 3. mirror_dirty_init() -> bdrv_co_is_allocated_above() runs and because the request hasn't completed yet, the block isn't allocated 4. The request completes, still sees s->job =3D=3D NULL and skips the bitmap, and nothing else will mark it dirty either One ingredient is that mirror_top_opaque->job is only set after the job is fully initialized. For the rationale, see commit 32125b1460 ("mirror: Fix access of uninitialised fields during start"). Fix this by giving mirror_top_bs access to dirty_bitmap and enabling it to track writes from the beginning. Disabling the block layer's tracking and enabling the mirror_top_bs one happens in a drained section, so there is no danger of races with in-flight requests any more. All of this happens well before the block allocation status is checked, so we can be sure that no writes will be missed. Cc: qemu-stable@nongnu.org Closes: https://gitlab.com/qemu-project/qemu/-/issues/3273 Fixes: 32125b14606a ('mirror: Fix access of uninitialised fields during sta= rt') Signed-off-by: Kevin Wolf Message-ID: <20260219202446.312493-1-kwolf@redhat.com> Reviewed-by: Fiona Ebner Tested-by: Jean-Louis Dupond Signed-off-by: Kevin Wolf (cherry picked from commit 0f51f9c3420b31bb383e456dd7bf24d3056eeb73) Signed-off-by: Michael Tokarev diff --git a/block/mirror.c b/block/mirror.c index bc982cb99a..fa1d975eb9 100644 --- a/block/mirror.c +++ b/block/mirror.c @@ -99,6 +99,7 @@ typedef struct MirrorBlockJob { =20 typedef struct MirrorBDSOpaque { MirrorBlockJob *job; + BdrvDirtyBitmap *dirty_bitmap; bool stop; bool is_commit; } MirrorBDSOpaque; @@ -1675,9 +1676,11 @@ bdrv_mirror_top_do_write(BlockDriverState *bs, Mirro= rMethod method, abort(); } =20 - if (!copy_to_target && s->job && s->job->dirty_bitmap) { - qatomic_set(&s->job->actively_synced, false); - bdrv_set_dirty_bitmap(s->job->dirty_bitmap, offset, bytes); + if (!copy_to_target) { + if (s->job) { + qatomic_set(&s->job->actively_synced, false); + } + bdrv_set_dirty_bitmap(s->dirty_bitmap, offset, bytes); } =20 if (ret < 0) { @@ -1904,13 +1907,35 @@ static BlockJob *mirror_start_job( =20 bdrv_drained_begin(bs); ret =3D bdrv_append(mirror_top_bs, bs, errp); - bdrv_drained_end(bs); - if (ret < 0) { + bdrv_drained_end(bs); + bdrv_unref(mirror_top_bs); + return NULL; + } + + bs_opaque->dirty_bitmap =3D bdrv_create_dirty_bitmap(mirror_top_bs, + granularity, + NULL, errp); + if (!bs_opaque->dirty_bitmap) { + bdrv_drained_end(bs); bdrv_unref(mirror_top_bs); return NULL; } =20 + /* + * The mirror job doesn't use the block layer's dirty tracking because= it + * needs to be able to switch seemlessly between background copy mode = (which + * does need dirty tracking) and write blocking mode (which doesn't) a= nd + * doing that would require draining the node. Instead, mirror_top_bs = takes + * care of updating the dirty bitmap as appropriate. + * + * Note that write blocking mode only becomes effective after mirror_r= un() + * sets mirror_top_opaque->job (see should_copy_to_target()). Until th= en, + * we're still in background copy mode irrespective of @copy_mode. + */ + bdrv_disable_dirty_bitmap(bs_opaque->dirty_bitmap); + bdrv_drained_end(bs); + /* Make sure that the source is not resized while the job is running */ s =3D block_job_create(job_id, driver, NULL, mirror_top_bs, BLK_PERM_CONSISTENT_READ, @@ -2005,24 +2030,13 @@ static BlockJob *mirror_start_job( s->base_overlay =3D bdrv_find_overlay(bs, base); s->granularity =3D granularity; s->buf_size =3D ROUND_UP(buf_size, granularity); + s->dirty_bitmap =3D bs_opaque->dirty_bitmap; s->unmap =3D unmap; if (auto_complete) { s->should_complete =3D true; } bdrv_graph_rdunlock_main_loop(); =20 - s->dirty_bitmap =3D bdrv_create_dirty_bitmap(s->mirror_top_bs, granula= rity, - NULL, errp); - if (!s->dirty_bitmap) { - goto fail; - } - - /* - * The dirty bitmap is set by bdrv_mirror_top_do_write() when not in a= ctive - * mode. - */ - bdrv_disable_dirty_bitmap(s->dirty_bitmap); - bdrv_graph_wrlock_drained(); ret =3D block_job_add_bdrv(&s->common, "source", bs, 0, BLK_PERM_WRITE_UNCHANGED | BLK_PERM_WRITE | @@ -2102,9 +2116,6 @@ fail: g_free(s->replaces); blk_unref(s->target); bs_opaque->job =3D NULL; - if (s->dirty_bitmap) { - bdrv_release_dirty_bitmap(s->dirty_bitmap); - } job_early_fail(&s->common.job); } =20 @@ -2118,6 +2129,7 @@ fail: bdrv_graph_wrunlock(); bdrv_drained_end(bs); =20 + bdrv_release_dirty_bitmap(bs_opaque->dirty_bitmap); bdrv_unref(mirror_top_bs); =20 return NULL; --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773242026; cv=none; d=zohomail.com; s=zohoarc; b=FAwt5QxkgfjTX6IdaqVN/b1N5bvPvSpdmzphz0wWHIVkmWnGINQ4wt5NcAqG+Kr4WsHW21Pwtm4mIoBV7eMi9Y8KDgKBdNsDLXkVlIxbC4RjTdexU/2SPWoGEvTSORiqnordBg0yYMSAwKNNRcjNdAsEb+OfAEvLsjcJjmpjCCc= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773242026; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=k5cTb7UXGWAliksi+kRjSyJnKdFxAlUQlISTmgdJ5ow=; b=Ki9azp0EEbM9bMl8y4S8Z1BIISPvgyUzZHNhbj7Qg2y8yATgv+018eKOEV/JUV8d/nH6aiyJ8ZM1Pp2Zgf08rli2LxOHFbL8K1aM9IK/krpeaLucdjI/EQw9aSMyVuHvebRfAnZ180KHil7GbD/lzey1MVeVmoFh5x7jjxXSgDg= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773242026737325.29006764502697; Wed, 11 Mar 2026 08:13:46 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LDy-0005pr-Gi; Wed, 11 Mar 2026 11:11:50 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LCH-0002oo-8n; Wed, 11 Mar 2026 11:10:06 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LCF-0005q8-AQ; Wed, 11 Mar 2026 11:10:05 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 8F0CA191EA6; Wed, 11 Mar 2026 18:04:43 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 74CC337C2E7; Wed, 11 Mar 2026 18:05:21 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241483; bh=UGBbBxhOn8DTGsq59K6g9NwOYbkKfELTilKfS+WEXZI=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=EzwrkR56/40pnSSfQv2XlYk5u4DyCH6Yto9kdrLVBxoY29v3s1ZxjyIDj3VopMWqj klTo9QmXqpCLs6EY12uFqH4HgriLfSZnC293KejA/ovInkBJivDTF+M1c1dwxmTV6k G550kPvAEA6uAUZ/kzGqed/uWu6ep3CSVjTd9i6HvpXZ1B42FoA+1zxww1EDX9UTSE 2uSEnKX42Q02EJfv8h29GzNUhfs5WOvTdp/tbHYtmvRzwfVplH33NVlP9QCMHLjYxb Yl9L+Qw9t8yfVvtnNUMImOOziDYcWvAL1DcuLHw/JGaf2Z2+f1lVey+KsmeidoQOSR ie/bDXpbcqDew== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Dmitry Guryanov , Hanna Czenczek , Kevin Wolf , Michael Tokarev Subject: [Stable-10.1.5 35/46] block/throttle-groups: fix deadlock with iolimits and muliple iothreads Date: Wed, 11 Mar 2026 18:03:11 +0300 Message-ID: <20260311150327.1084669-35-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773242027762158500 Content-Type: text/plain; charset="utf-8" From: Dmitry Guryanov Details: https://gitlab.com/qemu-project/qemu/-/issues/3144 The function schedule_next_request is called with tg->lock held and it may call throttle_group_co_restart_queue, which takes tgm->throttled_reqs_lock, qemu_co_mutex_lock may leave current coroutine if other iothread has taken the lock. If the next coroutine will call throttle_group_co_io_limits_intercept - it will try to take the mutex tg->lock which will never be released. Here is the backtrace of the iothread: Thread 30 (Thread 0x7f8aad1fd6c0 (LWP 24240) "IO iothread2"): #0 futex_wait (futex_word=3D0x5611adb7d828, expected=3D2, private=3D0) at= ../sysdeps/nptl/futex-internal.h:146 #1 __GI___lll_lock_wait (futex=3Dfutex@entry=3D0x5611adb7d828, private=3D= 0) at lowlevellock.c:49 #2 0x00007f8ab5a97501 in lll_mutex_lock_optimized (mutex=3D0x5611adb7d828= ) at pthread_mutex_lock.c:48 #3 ___pthread_mutex_lock (mutex=3D0x5611adb7d828) at pthread_mutex_lock.c= :93 #4 0x00005611823f5482 in qemu_mutex_lock_impl (mutex=3D0x5611adb7d828, fi= le=3D0x56118289daca "../block/throttle-groups.c", line=3D372) at ../util/qe= mu-thread-posix.c:94 #5 0x00005611822b0b39 in throttle_group_co_io_limits_intercept (tgm=3D0x5= 611af1bb4d8, bytes=3D4096, direction=3DTHROTTLE_READ) at ../block/throttle-= groups.c:372 #6 0x00005611822473b1 in blk_co_do_preadv_part (blk=3D0x5611af1bb490, off= set=3D15972311040, bytes=3D4096, qiov=3D0x7f8aa4000f98, qiov_offset=3D0, fl= ags=3DBDRV_REQ_REGISTERED_BUF) at ../block/block-backend.c:1354 #7 0x0000561182247fa0 in blk_aio_read_entry (opaque=3D0x7f8aa4005910) at = ../block/block-backend.c:1619 #8 0x000056118241952e in coroutine_trampoline (i0=3D-1543497424, i1=3D326= 50) at ../util/coroutine-ucontext.c:175 #9 0x00007f8ab5a56f70 in ?? () at ../sysdeps/unix/sysv/linux/x86_64/__sta= rt_context.S:66 from target:/lib64/libc.so.6 #10 0x00007f8aad1ef190 in ?? () #11 0x0000000000000000 in ?? () The lock is taken in line 386: (gdb) p tg.lock $1 =3D {lock =3D {__data =3D {__lock =3D 2, __count =3D 0, __owner =3D 2424= 0, __nusers =3D 1, __kind =3D 0, __spins =3D 0, __elision =3D 0, __list =3D= {__prev =3D 0x0, __next =3D 0x0}}, __size =3D "\002\000\000\000\000\000\000\000\260^\000\000\001", '\000' = , __align =3D 2}, file =3D 0x56118289daca "../block/throt= tle-groups.c", line =3D 386, initialized =3D true} The solution is to use tg->lock to protect both ThreadGroup fields and ThrottleGroupMember.throttled_reqs. It doesn't seem to be possible to use separate locks because we need to first manipulate ThrottleGroup fields, then schedule next coroutine using throttled_reqs and after than update token field from ThrottleGroup depending on the throttled_reqs state. Signed-off-by: Dmitry Guryanov Message-ID: <20251208085528.890098-1-dmitry.guryanov@gmail.com> Reviewed-by: Hanna Czenczek Signed-off-by: Kevin Wolf (cherry picked from commit d4816177654d59e26ce212c436513f01842eb410) Signed-off-by: Michael Tokarev diff --git a/block/throttle-groups.c b/block/throttle-groups.c index 66fdce9a90..5329ff1fdb 100644 --- a/block/throttle-groups.c +++ b/block/throttle-groups.c @@ -295,19 +295,15 @@ static bool throttle_group_schedule_timer(ThrottleGro= upMember *tgm, /* Start the next pending I/O request for a ThrottleGroupMember. Return wh= ether * any request was actually pending. * + * This assumes that tg->lock is held. + * * @tgm: the current ThrottleGroupMember * @direction: the ThrottleDirection */ static bool coroutine_fn throttle_group_co_restart_queue(ThrottleGroupMemb= er *tgm, ThrottleDirection= direction) { - bool ret; - - qemu_co_mutex_lock(&tgm->throttled_reqs_lock); - ret =3D qemu_co_queue_next(&tgm->throttled_reqs[direction]); - qemu_co_mutex_unlock(&tgm->throttled_reqs_lock); - - return ret; + return qemu_co_queue_next(&tgm->throttled_reqs[direction]); } =20 /* Look for the next pending I/O request and schedule it. @@ -378,12 +374,8 @@ void coroutine_fn throttle_group_co_io_limits_intercep= t(ThrottleGroupMember *tgm /* Wait if there's a timer set or queued requests of this type */ if (must_wait || tgm->pending_reqs[direction]) { tgm->pending_reqs[direction]++; - qemu_mutex_unlock(&tg->lock); - qemu_co_mutex_lock(&tgm->throttled_reqs_lock); qemu_co_queue_wait(&tgm->throttled_reqs[direction], - &tgm->throttled_reqs_lock); - qemu_co_mutex_unlock(&tgm->throttled_reqs_lock); - qemu_mutex_lock(&tg->lock); + &tg->lock); tgm->pending_reqs[direction]--; } =20 @@ -410,15 +402,15 @@ static void coroutine_fn throttle_group_restart_queue= _entry(void *opaque) ThrottleDirection direction =3D data->direction; bool empty_queue; =20 + qemu_mutex_lock(&tg->lock); empty_queue =3D !throttle_group_co_restart_queue(tgm, direction); =20 /* If the request queue was empty then we have to take care of * scheduling the next one */ if (empty_queue) { - qemu_mutex_lock(&tg->lock); schedule_next_request(tgm, direction); - qemu_mutex_unlock(&tg->lock); } + qemu_mutex_unlock(&tg->lock); =20 g_free(data); =20 @@ -569,7 +561,6 @@ void throttle_group_register_tgm(ThrottleGroupMember *t= gm, read_timer_cb, write_timer_cb, tgm); - qemu_co_mutex_init(&tgm->throttled_reqs_lock); } =20 /* Unregister a ThrottleGroupMember from its group, removing it from the l= ist, diff --git a/include/block/throttle-groups.h b/include/block/throttle-group= s.h index 2355e8d9de..7dfc81f7b5 100644 --- a/include/block/throttle-groups.h +++ b/include/block/throttle-groups.h @@ -35,8 +35,7 @@ =20 typedef struct ThrottleGroupMember { AioContext *aio_context; - /* throttled_reqs_lock protects the CoQueues for throttled requests. = */ - CoMutex throttled_reqs_lock; + /* Protected by ThrottleGroup.lock */ CoQueue throttled_reqs[THROTTLE_MAX]; =20 /* Nonzero if the I/O limits are currently being ignored; generally --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773242789; cv=none; d=zohomail.com; s=zohoarc; b=KDz7VdXlsfPiEIf6FpQjyMM5E+aU/eUa3P76wCU0kPVkFGAY58c2z4kmtXAROqG4zZeUG0rmWwuDxeB8hgZAXZmV0FsPsBeaQxJSa90+qanuY24QGJNL6hf1TdcmWMY2VmwOSWfxzVHd9E8TC0Zqgt9IZR2HYXOd7EWgIxOal8E= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773242789; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=WmcHOaQHs0DGTepknbFFZyIIMbeuvt9pNK3b3dObcA0=; b=XLHTDJRhDH5ltTARuqC0qvRXPfnr0yUZxyt92BxqukYCVGqL9YOMbMr2cnNzD7/JoK4d67Y/gkZ8ZS0J6Lw9DPwtORZ21/I7SHuXNmZzCUHYOEkduwlp1HgBqhGm5UUWpWyvGDSr6++2kUAdewXcL9AKwzACUAu2lBfPILL+iZY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773242789342626.0273216657763; Wed, 11 Mar 2026 08:26:29 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LDw-0005OC-82; Wed, 11 Mar 2026 11:11:48 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LCd-0003I9-GZ; Wed, 11 Mar 2026 11:10:29 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LCZ-0005qA-BV; Wed, 11 Mar 2026 11:10:27 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 9EF83191EA7; Wed, 11 Mar 2026 18:04:43 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 8DD8D37C2E8; Wed, 11 Mar 2026 18:05:21 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241483; bh=ILL435L5rWwcT5meFV53UIM7pEhV/Tf1PkXA/GyQVRY=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=CBnVBzzoyYJeGrKXGWi+AC3crY8QXvqOEfKhQc0Jzg2xR4M2s4qTbMFdHjXG8v4Xe Z3QkJ6Pd9OND/BG2a/q00taLf1WrXaLHLB/ovlWVTXvYS5yJKPLhORBxmyrcISFNsX V+sK/O9MYHBgvgvuHdPHr6DD5Tv6i0Ot/CFElk9O4vBOV3/myTJQ04f+b25AnvkZLt QO+tK17DpiyX6vM+zSd17eomV61a1q1i/Rlm6MpgNbd58f1KBprnxEuUlrUR6GG8ZN OmPJyI9IlPtTB4G41pGtc6KpPlv+ykJ1TrmyNGySdHW8eljrA5PcpGY883K7XzNnop 2XKUKoYTXEhcw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Kevin Wolf , Michael Tokarev Subject: [Stable-10.1.5 36/46] block: Never drop BLOCK_IO_ERROR with action=stop for rate limiting Date: Wed, 11 Mar 2026 18:03:12 +0300 Message-ID: <20260311150327.1084669-36-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773242790717154100 Content-Type: text/plain; charset="utf-8" From: Kevin Wolf Commit 2155d2dd introduced rate limiting for BLOCK_IO_ERROR to emit an event only once a second. This makes sense for cases in which the guest keeps running and can submit more requests that would possibly also fail because there is a problem with the backend. However, if the error policy is configured so that the VM is stopped on errors, this is both unnecessary because stopping the VM means that the guest can't issue more requests and in fact harmful because stopping the VM is an important state change that management tools need to keep track of even if it happens more than once in a given second. If an event is dropped, the management tool would see a VM randomly going to paused state without an associated error, so it has a hard time deciding how to handle the situation. This patch disables rate limiting for action=3Dstop by not relying on the event type alone any more in monitor_qapi_event_queue_no_reenter(), but checking action for BLOCK_IO_ERROR, too. If the error is reported to the guest or ignored, the rate limiting stays in place. Fixes: 2155d2dd7f73 ('block-backend: per-device throttling of BLOCK_IO_ERRO= R reports') Signed-off-by: Kevin Wolf Message-ID: <20260304122800.51923-1-kwolf@redhat.com> Signed-off-by: Kevin Wolf (cherry picked from commit 544ddbb6373d61292a0e2dc269809cd6bd5edec6) Signed-off-by: Michael Tokarev diff --git a/monitor/monitor.c b/monitor/monitor.c index c5a5d30877..ae7cf64de0 100644 --- a/monitor/monitor.c +++ b/monitor/monitor.c @@ -363,14 +363,33 @@ monitor_qapi_event_queue_no_reenter(QAPIEvent event, = QDict *qdict) { MonitorQAPIEventConf *evconf; MonitorQAPIEventState *evstate; + bool throttled; =20 assert(event < QAPI_EVENT__MAX); evconf =3D &monitor_qapi_event_conf[event]; trace_monitor_protocol_event_queue(event, qdict, evconf->rate); + throttled =3D evconf->rate; + + /* + * Rate limit BLOCK_IO_ERROR only for action !=3D "stop". + * + * If the VM is stopped after an I/O error, this is important informat= ion + * for the management tool to keep track of the state of QEMU and we c= an't + * merge any events. At the same time, stopping the VM means that the = guest + * can't send additional requests and the number of events is already + * limited, so we can do without rate limiting. + */ + if (event =3D=3D QAPI_EVENT_BLOCK_IO_ERROR) { + QDict *data =3D qobject_to(QDict, qdict_get(qdict, "data")); + const char *action =3D qdict_get_str(data, "action"); + if (!strcmp(action, "stop")) { + throttled =3D false; + } + } =20 QEMU_LOCK_GUARD(&monitor_lock); =20 - if (!evconf->rate) { + if (!throttled) { /* Unthrottled event */ monitor_qapi_event_emit(event, qdict); } else { diff --git a/qapi/block-core.json b/qapi/block-core.json index dc6eb4ae23..c17fd62c2c 100644 --- a/qapi/block-core.json +++ b/qapi/block-core.json @@ -5717,7 +5717,7 @@ # .. note:: If action is "stop", a `STOP` event will eventually follow # the `BLOCK_IO_ERROR` event. # -# .. note:: This event is rate-limited. +# .. note:: This event is rate-limited, except if action is "stop". # # Since: 0.13 # --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773242876; cv=none; d=zohomail.com; s=zohoarc; b=YPPjEPvQwX2i/6egeeSyqfs8gGNsWJFmZxybE/CWsa6vfmAyAumcFcg1IkELyx4aDbdw0L9An0pEq65MxwkSp2Fb3f9Y/80swMLC0yhOFOCOrMeUSO7Nl9uUv9e2lVG0hAQgiBtwbRllhnGRpqePibxXWgZdVe4bUlHIVdBn+9Y= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773242876; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=k/kyokPV6ss980X9FvvjOKllBTXQS6hizMPs+CXq3nc=; b=GtAYJu5NeJwDlVKbAcbNX0nbyoanToMhverVS7O6oV+bRT7SBz0OzW8yia9zpiMhi4j/OQV3LTRWPWZqSekh4v6GIsi1sOjAO1Ivow9NuBpXLJY+2j0mvgP2PIkavDXiM+NNlIAIyUWWeIhHQUkC7/4S+03xbqs7m1zHOpcboLk= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773242876067698.55424478315; Wed, 11 Mar 2026 08:27:56 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LEv-0000nf-E0; Wed, 11 Mar 2026 11:12:49 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LCe-0003JH-WA; Wed, 11 Mar 2026 11:10:31 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LCc-00061w-RN; Wed, 11 Mar 2026 11:10:28 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id AE417191EA8; Wed, 11 Mar 2026 18:04:43 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 9C91D37C2E9; Wed, 11 Mar 2026 18:05:21 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241483; bh=xvgjrtvfJYd0ggRcn57FNea3wevtXiKb9K1bOQPoMLM=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=uWNDRTiFBMw7KzCgdaeh63C2DSJdDZ45wKv/Luc3J6WMUq7y1Xxc4GbQmptfjVI1S n2qIbnlkECwXDew1ggKlX3sgQfvgd356glzUqhpuqWK+ArPTWi6aKA/Bl9bxhmmkh1 6/8opTPEV2fIZEW0x2ZENHia+5IqMaI0XRKmBLfm5ZCCPQiwOUA2HeaBoJnfH5MH6S +z49npMMF5a+WFXcViuheJE/QsAGgE9LyqxbSNBsmhEANNswNEuKQUqRnJF4wHRGSQ mrXsbIeYvEQL4iR4SxsuLdt1nH74ZuW1XgbNeJ5hmR+Tkv2JxzDmYFjLnouE+W+rGH VRalijSxb8SwA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Hanna Czenczek , Kevin Wolf , Michael Tokarev Subject: [Stable-10.1.5 37/46] block/nfs: Do not enter coroutine from CB Date: Wed, 11 Mar 2026 18:03:13 +0300 Message-ID: <20260311150327.1084669-37-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773242878054154100 From: Hanna Czenczek The reasoning I gave for why it would be safe to call aio_co_wake() despite holding the mutex was wrong: It is true that the current request will not re-acquire the mutex, but a subsequent request in the same coroutine can. Because the mutex is a non-coroutine mutex, this will result in a deadlock. Therefore, we must either not enter the coroutine here (only scheduling it), or release the mutex around aio_co_wake(). I opt for the former, as it is the behavior prior to the offending commit, and so seems safe to do. Fixes: deb35c129b859b9bec70fd42f856a0b7c1dc6e61 ("nfs: Run co BH CB in the coroutine=E2=80=99s AioContext") Buglink: https://gitlab.com/qemu-project/qemu/-/issues/2622#note_2965097035 Cc: qemu-stable@nongnu.org Signed-off-by: Hanna Czenczek Message-ID: <20260102153246.154207-1-hreitz@redhat.com> Reviewed-by: Kevin Wolf Signed-off-by: Kevin Wolf (cherry picked from commit 1d6610099bd7fc159626a38e60a3c84343ff67f7) Signed-off-by: Michael Tokarev diff --git a/block/nfs.c b/block/nfs.c index 1d3a34a30c..b78f4f86e8 100644 --- a/block/nfs.c +++ b/block/nfs.c @@ -249,14 +249,15 @@ nfs_co_generic_cb(int ret, struct nfs_context *nfs, v= oid *data, } =20 /* - * Safe to call: nfs_service(), which called us, is only run from the = FD - * handlers, never from the request coroutine. The request coroutine = in - * turn will yield unconditionally. - * No need to release the lock, even if we directly enter the coroutin= e, as - * the lock is never re-taken after yielding. (Note: If we do enter t= he - * coroutine, @task will probably be dangling once aio_co_wake() retur= ns.) + * Using aio_co_wake() here could re-enter the coroutine directly, whi= le we + * still hold the mutex. The current request will not attempt to re-t= ake + * the mutex, so that is fine; but if the same coroutine then goes on = to + * submit another request, that new request will try to re-take the mu= tex, + * resulting in a deadlock. + * To prevent that, only schedule the coroutine so it will be entered = later, + * with the mutex released. */ - aio_co_wake(task->co); + aio_co_schedule(qemu_coroutine_get_aio_context(task->co), task->co); } =20 static int coroutine_fn nfs_co_preadv(BlockDriverState *bs, int64_t offset, @@ -716,8 +717,8 @@ nfs_get_allocated_file_size_cb(int ret, struct nfs_cont= ext *nfs, void *data, if (task->ret < 0) { error_report("NFS Error: %s", nfs_get_error(nfs)); } - /* Safe to call, see nfs_co_generic_cb() */ - aio_co_wake(task->co); + /* Must not use aio_co_wake(), see nfs_co_generic_cb() */ + aio_co_schedule(qemu_coroutine_get_aio_context(task->co), task->co); } =20 static int64_t coroutine_fn nfs_co_get_allocated_file_size(BlockDriverStat= e *bs) --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773242545; cv=none; d=zohomail.com; s=zohoarc; b=eGgA3u6eLTyW3c7A3VbwZmuZKbnveeCIBgaVmzq7tlvyZekbodsa6GkElUGtoKInZUOFzOK7EaChFA3XzJIwK7Bu69O+L6x+DquxzS8W5kyquyYqY3sV1cwIuZf9uGWBsGhe6HJcxVue+UZ+0c6aCFtSyhfdKZJErBGKhD4WJNs= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773242545; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=QYNYwwcy7gssIzTmj0y4OlxCCsb9e/0o50Jcl80gSl0=; b=VnfqSiuwosKdc0rx2+clWg30JVnCoS3Y+sl6ViIkOqLj9e139IBWTP0LrVVn14TsdULaDtol0ZM6uGJhJhYLlMLLAqDFbqrbxIURi9HG6q/nQ+dbOKSTh8ezEMzGKPP5KB+7RBUg/nSae/TG3eKvXlJVDBpEezjA7LvPQgxyVgs= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773242545134256.7372791301025; Wed, 11 Mar 2026 08:22:25 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LEJ-0007FR-Jz; Wed, 11 Mar 2026 11:12:13 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LCg-0003KH-PU; Wed, 11 Mar 2026 11:10:33 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LCf-00066C-0Z; Wed, 11 Mar 2026 11:10:30 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id BD3C0191EA9; Wed, 11 Mar 2026 18:04:43 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id AB04037C2EA; Wed, 11 Mar 2026 18:05:21 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241483; bh=Tap+1p3sDYHUxlsdu61MBmComIk/a+J4T9/QEAPfN1U=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=RpEsRKT/rHyU084XStEQU8Rp6OwGQYmgAQgDsD7xDigFvhK3dgjwHc8Z5PEvM73pW lt3yVDVC0VcMZkjq6dyl5exdtALLmKJ0btFfLaYDJQVj8ubmWZor5VVnzghhbOm3d9 MmxDiuiBA3FHxvmTJEaQlIr919jrDFjYF/qh2S/2+OrFof9zs2tK72Xmz0lKjgDNpa s3sZzsDrJglT+1ccW/naqkpJ6MoHxu32s5dKsKR1dHmUroWLWMmPG/0qi9liRUcBMh 92VpXvkKk1rGPN/9eyq5rdksEQly0UU/Xfj632gsr6UR600maVpw8hZ0YbGeV4VBOW NLn7tHTAZoosg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Dmitry Osipenko , =?UTF-8?q?Alex=20Benn=C3=A9e?= , Michael Tokarev Subject: [Stable-10.1.5 38/46] virtio-gpu: Ensure BHs are invoked only from main-loop thread Date: Wed, 11 Mar 2026 18:03:14 +0300 Message-ID: <20260311150327.1084669-38-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773242546715154100 From: Dmitry Osipenko QEMU's display GL core is tied to main-loop thread and virtio-gpu interacts with display while processing GPU commands. Virtio-gpu BHs work in generic AIO context that can be invoked on vCPU thread, while GL and UI toolkits are bound to the main-loop thread. Make virtio-gpu BHs use iohandler AIO context that is handled in a main-loop thread only. 0 SDL_GL_MakeCurrent() (libSDL3) 1 SDL_GL_MakeCurrent_REAL() (libSDL2) 2 sdl2_gl_make_context_current() (ui/sdl2-gl.c:201) 3 make_current() (virglrenderer.c:639) 4 vrend_finish_context_switch() (vrend_renderer.c:11630) 5 vrend_hw_switch_context() (vrend_renderer.c:11613) 6 vrend_renderer_force_ctx_0() (vrend_renderer.c:12986) 7 virgl_renderer_force_ctx_0() (virglrenderer.c:460) 8 virtio_gpu_virgl_process_cmd() (virtio-gpu-virgl.c:1013) 9 virtio_gpu_process_cmdq() (virtio-gpu.c:1050) 10 virtio_gpu_gl_handle_ctrl() (virtio-gpu-gl.c:86) 11 aio_bh_poll() (util/async.c) 12 aio_poll() (util/aio-posix.c) 13 blk_pwrite() (block/block-gen.c:1985) 14 pflash_update() (pflash_cfi01.c:396) 15 pflash_write() (pflash_cfi01.c:541) 16 memory_region_dispatch_write() (system/memory.c:1554) 17 flatview_write() (system/physmem.c:3333) 18 address_space_write() (system/physmem.c:3453) 19 kvm_cpu_exec() (accel/kvm/kall-all.c:3248) 20 kvm_vcpu_thread_fn() (accel/kvm/kaccel-ops.c:53) Cc: qemu-stable@nongnu.org Signed-off-by: Dmitry Osipenko Message-ID: <20260303151422.977399-8-dmitry.osipenko@collabora.com> Message-ID: <20260304165043.1437519-10-alex.bennee@linaro.org> Signed-off-by: Alex Benn=C3=A9e (cherry picked from commit 235f9b36383e4cc7a790bca51eddbe38edd5438c) Signed-off-by: Michael Tokarev diff --git a/hw/display/virtio-gpu-virgl.c b/hw/display/virtio-gpu-virgl.c index 362828f54e..a65fca9c62 100644 --- a/hw/display/virtio-gpu-virgl.c +++ b/hw/display/virtio-gpu-virgl.c @@ -1199,9 +1199,9 @@ int virtio_gpu_virgl_init(VirtIOGPU *g) } =20 #if VIRGL_VERSION_MAJOR >=3D 1 - gl->cmdq_resume_bh =3D aio_bh_new(qemu_get_aio_context(), - virtio_gpu_virgl_resume_cmdq_bh, - g); + gl->cmdq_resume_bh =3D virtio_bh_io_new_guarded(DEVICE(g), + virtio_gpu_virgl_resume_= cmdq_bh, + g); #endif =20 return 0; diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c index 0a1a625b0e..3a71a80677 100644 --- a/hw/display/virtio-gpu.c +++ b/hw/display/virtio-gpu.c @@ -1514,9 +1514,9 @@ void virtio_gpu_device_realize(DeviceState *qdev, Err= or **errp) =20 g->ctrl_vq =3D virtio_get_queue(vdev, 0); g->cursor_vq =3D virtio_get_queue(vdev, 1); - g->ctrl_bh =3D virtio_bh_new_guarded(qdev, virtio_gpu_ctrl_bh, g); - g->cursor_bh =3D virtio_bh_new_guarded(qdev, virtio_gpu_cursor_bh, g); - g->reset_bh =3D qemu_bh_new(virtio_gpu_reset_bh, g); + g->ctrl_bh =3D virtio_bh_io_new_guarded(qdev, virtio_gpu_ctrl_bh, g); + g->cursor_bh =3D virtio_bh_io_new_guarded(qdev, virtio_gpu_cursor_bh, = g); + g->reset_bh =3D virtio_bh_io_new_guarded(qdev, virtio_gpu_reset_bh, g); qemu_cond_init(&g->reset_cond); QTAILQ_INIT(&g->reslist); QTAILQ_INIT(&g->cmdq); diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c index 9a81ad912e..4698b47426 100644 --- a/hw/virtio/virtio.c +++ b/hw/virtio/virtio.c @@ -4418,3 +4418,13 @@ QEMUBH *virtio_bh_new_guarded_full(DeviceState *dev, return qemu_bh_new_full(cb, opaque, name, &transport->mem_reentrancy_guard); } + +QEMUBH *virtio_bh_io_new_guarded_full(DeviceState *dev, + QEMUBHFunc *cb, void *opaque, + const char *name) +{ + DeviceState *transport =3D qdev_get_parent_bus(dev)->parent; + + return aio_bh_new_full(iohandler_get_aio_context(), cb, opaque, name, + &transport->mem_reentrancy_guard); +} diff --git a/include/hw/virtio/virtio.h b/include/hw/virtio/virtio.h index c594764f23..963bcba825 100644 --- a/include/hw/virtio/virtio.h +++ b/include/hw/virtio/virtio.h @@ -543,4 +543,14 @@ QEMUBH *virtio_bh_new_guarded_full(DeviceState *dev, #define virtio_bh_new_guarded(dev, cb, opaque) \ virtio_bh_new_guarded_full((dev), (cb), (opaque), (stringify(cb))) =20 +/* + * The "_io" variant runs BH only on a main-loop thread, while generic BH + * may run on a vCPU thread. + */ +QEMUBH *virtio_bh_io_new_guarded_full(DeviceState *dev, + QEMUBHFunc *cb, void *opaque, + const char *name); +#define virtio_bh_io_new_guarded(dev, cb, opaque) \ + virtio_bh_io_new_guarded_full((dev), (cb), (opaque), (stringify(cb))) + #endif --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773242301; cv=none; d=zohomail.com; s=zohoarc; b=j/7r/XAQTqhE5Yr7KDTgjc+Rp0V1TmsS7ohNs0zQ0CFOXehUhaPDVcLvIpbNoCuZ7Aj4BCmZzTlni99DkRbPYfQIcayBmBkcwvc5wImd51nHxE78C48X5b0au/yZDJZPlcxax4MurEdiH4TqKOGRa/stqbwGRqscFDrZWY+t2a0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773242301; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=I9j9ZdZxFQI2maNQ7rjyvtKJd8K1lpnAjOrdRkJG5mE=; b=DGtQL136Gp+ORVJ4UprWFtVsV0eVBEgDFsYvZ5OPqXBXBYdOMEn4oma4VRrf8kBZTSjNsvFpy0ttPIZ8M+IUBQGxvGtodSEnezrwkifOZhrUB4iCdr4Sj+xLGop2kyNJguaLdL9PUfLNlf/ptmYb6WB+gG5pwboarCxKh6WPtNQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773242301351389.6227971053645; Wed, 11 Mar 2026 08:18:21 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LEx-0001Im-Re; Wed, 11 Mar 2026 11:12:52 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LCi-0003Ks-7B; Wed, 11 Mar 2026 11:10:33 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LCg-00066a-F6; Wed, 11 Mar 2026 11:10:31 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id D57CB191EAA; Wed, 11 Mar 2026 18:04:43 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id BBBBC37C2EB; Wed, 11 Mar 2026 18:05:21 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241483; bh=NyOkkYHXSesyPk6l9bUYnlkfII1YnExUjDXhYWA9fOw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=w+FrniagMYNaF/12OImMHfIENs2X7kMztctcFVibO1lsrCThMpFxl4oplvntBiPDl wbiLO3I0Icce0FSiHCkxaZcG5eGTZG4C3CCtIwvExfW1OZ8sc4hUerS5bcY5K/uwqF ftYoUuPs7Hipsfy9P3le5ylXxsNuJvixvjTDs0d58W2sXhnkedZE+VbVcCIeDVp9aa PsYvymPHj/QtMvRahA+yapV1icatKnAoxDIwRpotCcnorSaGgn/7Z4jPM27n4ggvVE 1m9GIv63QUntskFYIVV88+cqQS74d9fuWlUugPEugjVVLOQ7cIZCLl6TKZ3pk0IN1s lZzbVozMY1RDw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , Alistair Francis , "Edgar E. Iglesias" , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-10.1.5 39/46] hw/net/xilinx_ethlite: Check for oversized TX packets Date: Wed, 11 Mar 2026 18:03:15 +0300 Message-ID: <20260311150327.1084669-39-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773242303262158500 From: Peter Maydell The xilinx_ethlite network device wasn't checking that the TX packet size set by the guest was within the size of its dual port RAM, with the effect that the guest could get it to read off the end of the RAM block. Check the length. There is no provision in this very simple device for reporting errors, so as with various RX errors we just report via tracepoint. This lack of length check has been present since the device was first introduced, though the code implementing the tx path has changed somewhat since then. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3317 Fixes: b43848a1005ce ("xilinx: Add ethlite emulation") Signed-off-by: Peter Maydell Reviewed-by: Alistair Francis Reviewed-by: Edgar E. Iglesias Message-ID: <20260303172718.437015-1-peter.maydell@linaro.org> [PMD: renamed size -> tx_size to avoid shadow=3Dcompatible-local error] Signed-off-by: Philippe Mathieu-Daud=C3=A9 (cherry picked from commit 6595a8d5d17ea1716ddafb34455ec2b29381e232) Signed-off-by: Michael Tokarev diff --git a/hw/net/trace-events b/hw/net/trace-events index 72b69c4a8b..698290fe79 100644 --- a/hw/net/trace-events +++ b/hw/net/trace-events @@ -517,3 +517,4 @@ xen_netdev_rx(int dev, int idx, int status, int flags) = "vif%u idx %d status %d f # xilinx_ethlite.c ethlite_pkt_lost(uint32_t rx_ctrl) "rx_ctrl:0x%" PRIx32 ethlite_pkt_size_too_big(uint64_t size) "size:0x%" PRIx64 +ethlite_pkt_tx_size_too_big(uint64_t size) "size:0x%" PRIx64 diff --git a/hw/net/xilinx_ethlite.c b/hw/net/xilinx_ethlite.c index 42b19d07c7..665def8a34 100644 --- a/hw/net/xilinx_ethlite.c +++ b/hw/net/xilinx_ethlite.c @@ -162,9 +162,15 @@ static void port_tx_write(void *opaque, hwaddr addr, u= int64_t value, break; case TX_CTRL: if ((value & (CTRL_P | CTRL_S)) =3D=3D CTRL_S) { - qemu_send_packet(qemu_get_queue(s->nic), - txbuf_ptr(s, port_index), - s->port[port_index].reg.tx_len); + uint32_t tx_size =3D s->port[port_index].reg.tx_len; + + if (tx_size >=3D BUFSZ_MAX) { + trace_ethlite_pkt_tx_size_too_big(tx_size); + } else { + qemu_send_packet(qemu_get_queue(s->nic), + txbuf_ptr(s, port_index), + tx_size); + } if (s->port[port_index].reg.tx_ctrl & CTRL_I) { eth_pulse_irq(s); } --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773242421; cv=none; d=zohomail.com; s=zohoarc; b=Cf4Fdhl/3Meupr0AxPam6Bi5mwVXFx+3OeVY42diMnu/UiuN8BOW1Hp8Aq6iNa4dHd9F6KTJQQ5GYJTR6hFPywJYeRp0H+P0HbLuEt7yqrf21L3oJ4L/E4XquqxT7S2wXoQSRA/bnZeiok6Rcc9ZVZ9WCL7wPYRS/S3i+1aWKPM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773242421; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=moaq7aAotLVAHCO+R3GnxrRUBxMLHN1WhstuHvJmu8I=; b=aC9VGeUm3q74lj+7ckVPtCTdA8yqq2yV1w4oK4XGgdpwU21wMkdcV5moxzSnUBK0UStRhYlEXhOpwq2AQo5TCRAx5oOT0nW+E6AK9x9Pgl7flxPFkYlHXteM/e2gA6wggR6dAPqTIQTqC7YzWoNMOvV/5+lwkepMey6gOsrGK0w= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773242421723718.3366887610738; Wed, 11 Mar 2026 08:20:21 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LEM-0007Xs-Ne; Wed, 11 Mar 2026 11:12:14 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LCk-0003LL-3u; Wed, 11 Mar 2026 11:10:36 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LCi-00066n-7W; Wed, 11 Mar 2026 11:10:33 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id E3ED6191EAB; Wed, 11 Mar 2026 18:04:43 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id D27B437C2EC; Wed, 11 Mar 2026 18:05:21 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241483; bh=i5G8m9dRPewkpdIulNcPCBXXnfGy3NUn3VT0YYzQvXM=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=xYK748be4Xc4egzaagQzkHGoWdwl8C/0li5H8XyhFGXzIeB9xZaeqp68BzK3gd4gP bH1mCEdqZUvB9d9kQHTc77V1sLb7z3KwSeUe/wyTmxf5Rjej5daZkzY7dNH227vu5b vnQNRPeTaeUJLUgXIMNJOS9bJemLne5ilWb9VZIMLr1QM4OeOV58HlxO3CKfhO1GNR JH1cdf+qKNi16Xyqw2gYTHpsPoqHtjoclvQdUozeqUHv9A6K7ymAB4enfv82zeV2uy mAGzUN2O+Zxau6VmlDMmeoKP7xfetSDq9wBhlpiPGtTdPWgo+iX8vbj6WxxCU6VFkK vfAdd/HFUry3w== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Bingwu Zhang , Helge Deller , Michael Tokarev Subject: [Stable-10.1.5 40/46] linux-user: Deal with mmap where start > reserved_va Date: Wed, 11 Mar 2026 18:03:16 +0300 Message-ID: <20260311150327.1084669-40-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773242423947158500 Content-Type: text/plain; charset="utf-8" From: Bingwu Zhang Fixes: 4c13048e02d9 ("linux-user: Use page_find_range_empty for mmap_find_v= ma_reserved") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3310 Signed-off-by: Bingwu Zhang Reviewed-by: Helge Deller Signed-off-by: Helge Deller (cherry picked from commit f2813e13fe910e01127271a87177a477b9438bc6) Signed-off-by: Michael Tokarev diff --git a/linux-user/mmap.c b/linux-user/mmap.c index da5ff46a0f..e49dbaaa20 100644 --- a/linux-user/mmap.c +++ b/linux-user/mmap.c @@ -418,12 +418,15 @@ abi_ulong mmap_next_start; static abi_ulong mmap_find_vma_reserved(abi_ulong start, abi_ulong size, abi_ulong align) { - target_ulong ret; + target_ulong ret =3D -1; =20 - ret =3D page_find_range_empty(start, reserved_va, size, align); + if (start <=3D reserved_va) { + ret =3D page_find_range_empty(start, reserved_va, size, align); + } if (ret =3D=3D -1 && start > mmap_min_addr) { /* Restart at the beginning of the address space. */ - ret =3D page_find_range_empty(mmap_min_addr, start - 1, size, alig= n); + ret =3D page_find_range_empty(mmap_min_addr, MIN(start - 1, reserv= ed_va), + size, align); } =20 return ret; --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773242883; cv=none; d=zohomail.com; s=zohoarc; b=U+epHFnf/3ZrUkEOmsKTrtScLE3QRqeH8aohPUYtsp8JCKxZdcix26yXa89Pkii4EZ46f0mkr/7eTWKglfvUeUzwevRW0we2oUgqMK6PLUzYUy12OU1/92R/7JB0fmDMSNfuLdfgHaMSuExsdXUmBzTGxrBhu7qJpMt1ouf1ueE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773242883; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=P03XDHw8kHX9MXRxoctKF7FeXnbrEHb9tIO8SR87M4o=; b=jWsXaTl60iJiOaGra9hVykj0w5grBwgyIgG6fbixNgsuEqQI7Rsh66Nzdx5sm3TjBD+iDbbZoITGnOgklyCSM/a9+KUHNG4wMZ/I+PUbRkVI/UhZFUg4MSRp3aS480fMfO4mRvAI9FnZmFPuLHDcgvDVmYRjJKnHVwOHl6vJxXQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773242883459662.514884615804; Wed, 11 Mar 2026 08:28:03 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LF3-00022b-7z; Wed, 11 Mar 2026 11:12:57 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LD5-0003Zp-Mo; Wed, 11 Mar 2026 11:10:58 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LD4-00067G-37; Wed, 11 Mar 2026 11:10:55 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id F3C00191EAC; Wed, 11 Mar 2026 18:04:43 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id E1A2137C2ED; Wed, 11 Mar 2026 18:05:21 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241483; bh=5nIFjrc047+JvsJsHpfsBbnpEIAWbY0o4NYp3LQnSc8=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=QnPSsje6ZJC27y3ZxNml9C1rYT787vGd7K896kYCSDrHuJc/GgUPjfZQLPUr9hplb X/uOjZe63VfR4ya2v6zGnBUn5VGXGcWWdgfmMRZzKvAoyufqiLx0Rn69xPKVgRcZAw puQM6zYLn+7BsDT7mE0lz37LlRSrqgjZ+PWOnm2Z/PLQ3Q3krsQFUdVqXcS01ACpoP UFRqasu4r3qW13e1y7/s3FGperr+nvSKyonq4kEkl2gzwFwLCKG3V3pod7QavOx9Ib +RPHO7QAVQrVcNL9RRSVbFsUgRLX0HGdzNyHABPV9gweI8gYb6/rxSmDMxWKnSB/+h ZUD79vs49s0rQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Bingwu Zhang , Helge Deller , Warner Losh , Michael Tokarev Subject: [Stable-10.1.5 41/46] bsd-user: Deal with mmap where start > reserved_va Date: Wed, 11 Mar 2026 18:03:17 +0300 Message-ID: <20260311150327.1084669-41-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773242886303154100 Content-Type: text/plain; charset="utf-8" From: Bingwu Zhang Fixes: f12294b5bd21 ("bsd-user: Use page_find_range_empty for mmap_find_vma= _reserved") Signed-off-by: Bingwu Zhang Reviewed-by: Helge Deller Reviewed-by: Warner Losh Signed-off-by: Helge Deller (cherry picked from commit e8e7d1f97785be2fd81fc520e0c7b9d228c10a56) Signed-off-by: Michael Tokarev diff --git a/bsd-user/mmap.c b/bsd-user/mmap.c index 47e317517c..3cb8057ca1 100644 --- a/bsd-user/mmap.c +++ b/bsd-user/mmap.c @@ -258,12 +258,14 @@ abi_ulong mmap_next_start =3D TASK_UNMAPPED_BASE; static abi_ulong mmap_find_vma_reserved(abi_ulong start, abi_ulong size, abi_ulong alignment) { - abi_ulong ret; + abi_ulong ret =3D -1; =20 - ret =3D page_find_range_empty(start, reserved_va, size, alignment); + if (start <=3D reserved_va) { + ret =3D page_find_range_empty(start, reserved_va, size, alignment); + } if (ret =3D=3D -1 && start > TARGET_PAGE_SIZE) { /* Restart at the beginning of the address space. */ - ret =3D page_find_range_empty(TARGET_PAGE_SIZE, start - 1, + ret =3D page_find_range_empty(TARGET_PAGE_SIZE, MIN(start - 1, res= erved_va), size, alignment); } =20 --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773241958; cv=none; d=zohomail.com; s=zohoarc; b=HhpalWAgWn2Z1/UAjHaRrAEbQ4swZ/XGAD5HZvSM5gqGNoyobUDp6FMk7PqTobkF38ER6h4vhz3cmx/+k7GUS+HmFMPS8DoRRKGI72iVUpdvuRmQisw37CRYt7AMDTlSHb5b46wggaMnz48u8dlGT8SwUmn0hzRpt4f9XtaDkd0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773241958; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=DMAAGrsm3kVk7l/bXuA2rKxaEQt3VPXYmmmROQgvT5o=; b=aCqqIBrvGbCnBV11NQzAhFV8olsqIElHTumqN9Za/7DwUVDaEQSQPkMIrjSDZabY8Ihp/BUGdHSRL/OncC2iB6xh3fdomuA0Bw2fSZRVoI0eWf5sVu507oqPEdSLcZqwB3HpXY49DQWHGOC/xFl2OgYXtTq8V/726/VNocjf9co= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773241958811466.37632073342775; Wed, 11 Mar 2026 08:12:38 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LEN-0007bC-0r; Wed, 11 Mar 2026 11:12:15 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LD7-0003az-Ig; Wed, 11 Mar 2026 11:11:01 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LD5-00067g-Pr; Wed, 11 Mar 2026 11:10:57 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 0E8DE191EAD; Wed, 11 Mar 2026 18:04:44 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id F10AF37C2EE; Wed, 11 Mar 2026 18:05:21 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241484; bh=+W3eicgXEE2AmYSo7J29g83NNYv1Bgs92Oh+32965CA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=adbfE1GZj0+J4NvKhdhMj3LDmE6GygSWSuyvsfbGNWrfztrcOEhQwQbZarMtIb2Sd UDR9EpaiS+wOlEakcZ9uiO2fXctflORFRa8OeUuV48qDIYk42waFscd2MTwQ3jGJRc ox4caIJfPYnwEycrCSxU3MqXTq6sfrPe5FFPPvtTFcez7T8KpDvRuWzEBkPLQImdCR GAaKGCQfSSk+Mg6teqM4mqUdWj3XBu0nSvFd+592PqiaDHdoEYl0Z/n4bPHJgD7WDq FFEQxlPlc17fUm/Al8QX9NgkN8FSXf/Cun8+HDWKJdCxdaj7HlgR0bXHT9OOhlaNe8 F+FZadrQ5l+/Q== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Bingwu Zhang , Helge Deller , Michael Tokarev Subject: [Stable-10.1.5 42/46] tests/tcg/multiarch/test-mmap: Check mmaps beyond reserved_va Date: Wed, 11 Mar 2026 18:03:18 +0300 Message-ID: <20260311150327.1084669-42-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773241961236154100 Content-Type: text/plain; charset="utf-8" From: Bingwu Zhang Unfixed mmap calls where start > reserved_va or the max guest addr should have a valid result. Signed-off-by: Bingwu Zhang Signed-off-by: Helge Deller (cherry picked from commit c865b6bce5d0c882b86fb7c3512174cdaf235017) Signed-off-by: Michael Tokarev diff --git a/tests/tcg/multiarch/test-mmap.c b/tests/tcg/multiarch/test-mma= p.c index e297f4b1e9..fd9055a90e 100644 --- a/tests/tcg/multiarch/test-mmap.c +++ b/tests/tcg/multiarch/test-mmap.c @@ -491,6 +491,20 @@ void check_shrink_mmaps(void) munmap(c, 2 * pagesize); } =20 +void check_mmaps_beyond_addr_space(void) +{ + unsigned char *addr; + addr =3D mmap((void *)(-(unsigned long)pagesize * 10), pagesize * 2, + PROT_READ, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); + fprintf(stdout, "%s addr=3D%p errno=3D%d", __func__, (void *)addr, err= no); + fail_unless(addr !=3D MAP_FAILED); + + memcpy(dummybuf, addr, 2 * pagesize); + munmap(addr, 2 * pagesize); + + fprintf(stdout, " passed\n"); +} + int main(int argc, char **argv) { char tempname[] =3D "/tmp/.cmmapXXXXXX"; @@ -534,6 +548,7 @@ int main(int argc, char **argv) check_file_unfixed_eof_mmaps(); check_invalid_mmaps(); check_shrink_mmaps(); + check_mmaps_beyond_addr_space(); =20 /* Fails at the moment. */ /* check_aligned_anonymous_fixed_mmaps_collide_with_host(); */ --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773242194; cv=none; d=zohomail.com; s=zohoarc; b=SlfrV1sk0t2kaRVNNT6jyb59TYsUPLU/YGjeXSo0TWdK0Nx6uVUIryYRtCUtU7lx86oB84zb4685TDlBW+EIMzyeZmYtbOq+/JoNe7JnBE5YYKkhaB10t0lVDLxbJmbCncMnDxg0ZibfxlgCotha+4EbnvKQ1jD9T1E9+YAkDJY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773242194; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=W2gJBJ5llIUJniSrgFXix60thjr9rJ5NBerrfSJZcEs=; b=KdxakRDTp+imtOTrykVYa7UhexIinD2w1DEgZPa7Lok5QEBmLNvcqSFwowahxTcxjB8X7ccga55SF+6BeCBLSWyMAtDI+yMALjK2b3PyqmkL+UsDFXJeHILs8L1zgkuMrREBFSrWn1E2N7ClndK+lrwz3tM4EAMMNxzInNTviT4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773242194336755.5985352217787; Wed, 11 Mar 2026 08:16:34 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LF4-00027R-H8; Wed, 11 Mar 2026 11:12:58 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LDA-0003b6-9V; Wed, 11 Mar 2026 11:11:05 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LD7-0006Bq-8i; Wed, 11 Mar 2026 11:10:58 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 299C7191EAE; Wed, 11 Mar 2026 18:04:44 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 0C5A937C2EF; Wed, 11 Mar 2026 18:05:22 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241484; bh=zsJdKC1oSdqH86t/OM5dqP2jvqDdEPy1KD1EWd5IWzA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Me2SOTetAr2MQ6fRalNzVQsyhbpDC0xRyXchutNcOUMacgO0FqxY5KxfEJtRmvqaM xpV0CR6ytKM9nJGFgcOrMWK+IBPGojfz59PgejZaYgACKMFz0Mk+k1YCUQ6TPIImgT tmprZFF+8RUZznH5/M9vmnC9OP+CpD8OxGoT/rGBloghgSJJsLAijH22RcvFVi4YWW t18oOw4ReafET4rWaTipFQyDJ3QCod0i9cQ1WZIjOS7DBfxBJkryGP1rdZryVBDJbJ DdgQ+3nVyK5QbhYrzPWypc270J20GtdkFGLxvEVkxveE1iR7V4fABxaG7uYZXPQWC3 lg/irF9vqroOw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Andreas Schwab , Helge Deller , Michael Tokarev Subject: [Stable-10.1.5 43/46] linux-user: fix TIOCGSID ioctl Date: Wed, 11 Mar 2026 18:03:19 +0300 Message-ID: <20260311150327.1084669-43-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773242197041154100 Content-Type: text/plain; charset="utf-8" From: Andreas Schwab TIOCGSID is IOC_R, not IOC_W. Signed-off-by: Andreas Schwab Reviewed-by: Helge Deller Signed-off-by: Helge Deller (cherry picked from commit 6a1221614fd9344a22cafea78e48d6ded95f317d) Signed-off-by: Michael Tokarev diff --git a/linux-user/ioctls.h b/linux-user/ioctls.h index 6ecfe6306e..5b7d00e92f 100644 --- a/linux-user/ioctls.h +++ b/linux-user/ioctls.h @@ -26,7 +26,7 @@ IOCTL(TIOCSCTTY, 0, TYPE_INT) IOCTL(TIOCGPGRP, IOC_R, MK_PTR(TYPE_INT)) IOCTL(TIOCSPGRP, IOC_W, MK_PTR(TYPE_INT)) - IOCTL(TIOCGSID, IOC_W, MK_PTR(TYPE_INT)) + IOCTL(TIOCGSID, IOC_R, MK_PTR(TYPE_INT)) IOCTL(TIOCOUTQ, IOC_R, MK_PTR(TYPE_INT)) IOCTL(TIOCSTI, IOC_W, MK_PTR(TYPE_INT)) IOCTL(TIOCMGET, IOC_R, MK_PTR(TYPE_INT)) --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773242629; cv=none; d=zohomail.com; s=zohoarc; b=aGO3Rx9dS1756byaxLGzjADL77nqWBAA1lKJsb/8BePRb3csZpuBojLzHhw53Z+tUBPzFJ+jTEc17bQoHVE7qfcF6t2Vk24Dzg/4GUjAXjR5iAFLNJ/OEO5FbL4qkoaaxAmDmE6nAkA49nQ5xgTBGBv9lyEL9e8M7+WRhM/pyj0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773242629; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=wNnQ3Jz52BVk1k8+o9E+oj2UWxOoVGDBGkrdoyS21iI=; b=fHQ3G+7PC48C+ctoZhcuJ7NKksmNFFf2O9fPNmN++2hyAOMfFaO3nlRcYzJEHzWJd2CCWhNZkwbD5Nlz0A3mq8/vEAshcsyUxKxm/hzD91wt9cQedLtJ/Cw1nZWlzjG5RwmrsP+XV2mM2D8+sMR9aKfrHj20ZXfu+9o2zL6Ixjk= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773242629494800.8693252308827; Wed, 11 Mar 2026 08:23:49 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LGx-0005aO-SM; Wed, 11 Mar 2026 11:14:59 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LDD-0003bi-En; Wed, 11 Mar 2026 11:11:07 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LDA-0006CX-An; Wed, 11 Mar 2026 11:11:01 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 3C30F191EAF; Wed, 11 Mar 2026 18:04:44 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 2827C37C2F0; Wed, 11 Mar 2026 18:05:22 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241484; bh=0AjJCEY3OniQicr/5x6Rf/4txbaYcDKZPAUmt5ItGJQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=LqjW1u8BrEod3cFfKkddFwb2wGvUKwHl/nMZyZ5QAgxJXjpG7voCto4VLRFeGux29 lu2nRyxpSbtg4ne+inZIY7CilpDtwLMUaj0BWlxjO5oQyt9nPocAOdfN/P72cEGAvd KzSk78ptcr6PrCKN9FlxdeoxUreyrP4D/wYmHfS9md4M9HrC7sg1tZySyh8S3hBBwo JZ8+47Kz9xLUa4ARiFqMwXXE20u+OSsHmp1Z3C5Q7GqT/JUbmFcvL4WTQRnexUHcXc viS1gheok7bcE/8WMEiMZ0uaw3hB6rIyjvw8Q2CEleW6u5WpGcErAqlk5tBNtfcBIk u9iL9jB+xgchw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-10.1.5 44/46] hw/net/npcm_gmac: Catch accesses off the end of the register array Date: Wed, 11 Mar 2026 18:03:20 +0300 Message-ID: <20260311150327.1084669-44-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773242631149158500 From: Peter Maydell In the npcm_gmac device, we create the iomem MemoryRegion with a size of 8KB, but NPCM_GMAC_NR_REGS is only 0x1060 / 4. This means there's a range of offsets that the guest can access that don't have gmac->regs[] entries. We weren't catching this, so the guest could get us to index off the end of the regs array. Catch and log these invalid accesses. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3316 Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daud=C3=A9 Message-ID: <20260306154016.2194091-1-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daud=C3=A9 (cherry picked from commit 550391c7134d295d73b2b0e7a1111a922b78c13c) Signed-off-by: Michael Tokarev diff --git a/hw/net/npcm_gmac.c b/hw/net/npcm_gmac.c index 5e32cd3edf..176cd604d8 100644 --- a/hw/net/npcm_gmac.c +++ b/hw/net/npcm_gmac.c @@ -700,6 +700,13 @@ static uint64_t npcm_gmac_read(void *opaque, hwaddr of= fset, unsigned size) NPCMGMACState *gmac =3D opaque; uint32_t v =3D 0; =20 + if (offset >=3D NPCM_GMAC_REG_SIZE) { + qemu_log_mask(LOG_GUEST_ERROR, + "%s: invalid register offset: 0x%04" HWADDR_PRIx"\n", + DEVICE(gmac)->canonical_path, offset); + return v; + } + switch (offset) { /* Write only registers */ case A_NPCM_DMA_XMT_POLL_DEMAND: @@ -724,6 +731,13 @@ static void npcm_gmac_write(void *opaque, hwaddr offse= t, =20 trace_npcm_gmac_reg_write(DEVICE(gmac)->canonical_path, offset, v); =20 + if (offset >=3D NPCM_GMAC_REG_SIZE) { + qemu_log_mask(LOG_GUEST_ERROR, + "%s: invalid register offset: 0x%04" HWADDR_PRIx"\n", + DEVICE(gmac)->canonical_path, offset); + return; + } + switch (offset) { /* Read only registers */ case A_NPCM_GMAC_VERSION: diff --git a/include/hw/net/npcm_gmac.h b/include/hw/net/npcm_gmac.h index 6340ffe92c..0c21b25a82 100644 --- a/include/hw/net/npcm_gmac.h +++ b/include/hw/net/npcm_gmac.h @@ -24,7 +24,8 @@ #include "hw/sysbus.h" #include "net/net.h" =20 -#define NPCM_GMAC_NR_REGS (0x1060 / sizeof(uint32_t)) +#define NPCM_GMAC_REG_SIZE 0x1060 +#define NPCM_GMAC_NR_REGS (NPCM_GMAC_REG_SIZE / sizeof(uint32_t)) =20 #define NPCM_GMAC_MAX_PHYS 32 #define NPCM_GMAC_MAX_PHY_REGS 32 --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773242114; cv=none; d=zohomail.com; s=zohoarc; b=ZMdSJCKsX8+YFSBAqD9VsD6FfNevkB7V9/rZxUIQJL0dvcOxTxEM6VPfqJA5SBWk9J7K29Q2PWRCWRMY1wQ+auLmJ7c/PlaPhRgmh+0pO9fu/6TkcQSg0Pt6CLmRXsxKIdIFWskBaXZjwMeL2eEy+Igx+e5Foyq4XB9laqosMs8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773242114; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=/Lb63hDM2pvTNUXwHKKAd0iNr0TsyxWkTIuQ1LqiyhU=; b=H9bjplIv3KdQ+JUysV35Zu5K1TgAxwqmvWRaRLhgTnJEaIc2EzpaEmAsG/Rb/85ynTZcajicYuSEaxJ1latkvaCAyqH6sxgntcAQNnPghw1YWwJRYfzPWip6u4t61BwIWZDo5wH9A0e0SaKvZP+Jvlx8vLLseP0qF1Fx9fKULcQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773242114535549.443544441656; Wed, 11 Mar 2026 08:15:14 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LGC-0003Lc-DT; Wed, 11 Mar 2026 11:14:10 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LDa-00048r-Do; Wed, 11 Mar 2026 11:11:32 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LDX-0006Cu-Hq; Wed, 11 Mar 2026 11:11:25 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 4F928191EB0; Wed, 11 Mar 2026 18:04:44 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 3A8AC37C2F1; Wed, 11 Mar 2026 18:05:22 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241484; bh=UOHERBVKctc1IB4WPVzAOc87vL2x9tIYVtkWf39RJRU=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=JDnwElft2DvCdjxq6e8OC449ijdWSNWqmO3n37xHaVr2oxr9L7s7UlvHJ6Wlsbp7s u9L3TkEtYXdGaNiT2sDKhfSTDfLP0AGXZnlW/4Oiypqo+0POs2MdXiciAPRi30JJeG LmnBc34Q1ke0GdDT0QODXt89paPxkS2Z67Jk5V2joeVQxChNKJE/NAegfozoeO4vSJ kp7LwwNIhp8Rn5TV3UUwBSmECCPN9lEex3t26A/nex8IgXYop+dVaigOYlxWn4Ue0N 9GnnxDSGKPVOahv6zYEIM16nBO3aFv5hQ10TGZmZbh7rR2rQeIwWCKiHiKG93X6/XC I3ItW22UvqmNQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, rail5 , Bibo Mao , Song Gao , Michael Tokarev Subject: [Stable-10.1.5 45/46] target/loongarch: Preserve PTE permission bits in LDPTE Date: Wed, 11 Mar 2026 18:03:21 +0300 Message-ID: <20260311150327.1084669-45-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773242116130158500 Content-Type: text/plain; charset="utf-8" From: rail5 The LDPTE helper loads a page table entry (or huge page entry) from guest memory and currently applies the PALEN mask to the whole 64-bit value. That mask is intended to constrain the physical address bits, but masking the full entry also clears upper permission bits in the PTE, including NX (bit 62). As a result, LoongArch TCG can incorrectly allow instruction fetches from NX mappings when translation is driven through software page-walk. Fix this by masking only the PPN/address field with PALEN while preserving permission bits, and by clearing any non-architectural (software) bits using a hardware PTE mask. LDDIR is unchanged since it returns the base address of the next page table level. Reported at: https://gitlab.com/qemu-project/qemu/-/issues/3319 Fixes: 56599a705f2 ("target/loongarch: Introduce loongarch_palen_mask()") Cc: qemu-stable@nongnu.org Signed-off-by: rail5 (Andrew S. Rightenburg) Reviewed-by: Bibo Mao Reviewed-by: Song Gao Signed-off-by: Song Gao (cherry picked from commit 2d877bc02a3b94998cbdd784d194c173d308a98a) (Mjt: backport to 10.1.x which lacks v10.2.0-1568-g56599a705f "target/loongarch: Introduce loongarch_palen_mask()") Signed-off-by: Michael Tokarev diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c index 9ca85a56a2..266b0b97d0 100644 --- a/target/loongarch/cpu.c +++ b/target/loongarch/cpu.c @@ -575,6 +575,17 @@ static void loongarch_cpu_reset_hold(Object *obj, Rese= tType type) =20 #ifdef CONFIG_TCG env->fcsr0_mask =3D FCSR0_M1 | FCSR0_M2 | FCSR0_M3; + + if (is_la64(env)) { + env->hw_pte_mask =3D MAKE_64BIT_MASK(0, 9) | + R_TLBENTRY_64_PPN_MASK | + R_TLBENTRY_64_NR_MASK | + R_TLBENTRY_64_NX_MASK | + R_TLBENTRY_64_RPLV_MASK; + } else { + env->hw_pte_mask =3D MAKE_64BIT_MASK(0, 9) | + R_TLBENTRY_32_PPN_MASK; + } #endif env->fcsr0 =3D 0x0; =20 diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h index 9538e8d61d..65b702938f 100644 --- a/target/loongarch/cpu.h +++ b/target/loongarch/cpu.h @@ -380,6 +380,7 @@ typedef struct CPUArchState { uint32_t fcsr0_mask; uint64_t lladdr; /* LL virtual address compared against SC */ uint64_t llval; + uint64_t hw_pte_mask; /* Mask of architecturally-defined (hardware) PT= E bits. */ #endif #ifndef CONFIG_USER_ONLY #ifdef CONFIG_TCG diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_h= elper.c index 8872593ff0..9a86b4bb52 100644 --- a/target/loongarch/tcg/tlb_helper.c +++ b/target/loongarch/tcg/tlb_helper.c @@ -559,6 +559,20 @@ bool loongarch_cpu_tlb_fill(CPUState *cs, vaddr addres= s, int size, cpu_loop_exit_restore(cs, retaddr); } =20 +static inline uint64_t loongarch_sanitize_hw_pte(CPULoongArchState *env, + uint64_t pte) +{ + uint64_t ppn_mask =3D is_la64(env) ? R_TLBENTRY_64_PPN_MASK : R_TLBENT= RY_32_PPN_MASK; + + /* + * Keep only architecturally-defined PTE bits. Guests may use some + * otherwise-unused bits for software purposes. + */ + pte &=3D env->hw_pte_mask; + + return (pte & ~ppn_mask) | ((pte & ppn_mask) & TARGET_PHYS_MASK); +} + target_ulong helper_lddir(CPULoongArchState *env, target_ulong base, target_ulong level, uint32_t mem_idx) { @@ -599,6 +613,7 @@ void helper_ldpte(CPULoongArchState *env, target_ulong = base, target_ulong odd, { CPUState *cs =3D env_cpu(env); target_ulong phys, tmp0, ptindex, ptoffset0, ptoffset1, badv; + uint64_t pte_raw; uint64_t ptbase =3D FIELD_EX64(env->CSR_PWCL, CSR_PWCL, PTBASE); uint64_t ptwidth =3D FIELD_EX64(env->CSR_PWCL, CSR_PWCL, PTWIDTH); uint64_t dir_base, dir_width; @@ -611,7 +626,6 @@ void helper_ldpte(CPULoongArchState *env, target_ulong = base, target_ulong odd, * and the other is the huge page entry, * whose bit 6 should be 1. */ - base =3D base & TARGET_PHYS_MASK; if (FIELD_EX64(base, TLBENTRY, HUGE)) { /* * Gets the huge page level and Gets huge page size. @@ -635,7 +649,7 @@ void helper_ldpte(CPULoongArchState *env, target_ulong = base, target_ulong odd, * when loaded into the tlb, * so the tlb page size needs to be divided by 2. */ - tmp0 =3D base; + tmp0 =3D loongarch_sanitize_hw_pte(env, base); if (odd) { tmp0 +=3D MAKE_64BIT_MASK(ps, 1); } @@ -647,12 +661,15 @@ void helper_ldpte(CPULoongArchState *env, target_ulon= g base, target_ulong odd, } else { badv =3D env->CSR_TLBRBADV; =20 + base =3D base & TARGET_PHYS_MASK; + ptindex =3D (badv >> ptbase) & ((1 << ptwidth) - 1); ptindex =3D ptindex & ~0x1; /* clear bit 0 */ ptoffset0 =3D ptindex << 3; ptoffset1 =3D (ptindex + 1) << 3; phys =3D base | (odd ? ptoffset1 : ptoffset0); - tmp0 =3D ldq_phys(cs->as, phys) & TARGET_PHYS_MASK; + pte_raw =3D ldq_le_phys(cs->as, phys); + tmp0 =3D loongarch_sanitize_hw_pte(env, pte_raw); ps =3D ptbase; } =20 --=20 2.47.3 From nobody Tue Apr 7 20:12:06 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1773242858; cv=none; d=zohomail.com; s=zohoarc; b=jIDOFydzdaH2Qfu3no1C0pz5COC1XIU2oKVkKddXqDMTsb3+Bk+elb5upAKN6x1Cuz9awzuhmQmMEa6ZUKqFi+doFjPU7kfSzUs9PwAZMmFNDecExDRpgVV+1d2x3FK+t9XO7YHRs+gQs1bqeK4bqrRmc866KcaFY6539Kquqek= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1773242858; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=inDUBod4rxifPap/EUG2mcJZ5KFZ5p0VexH6iiPz9eA=; b=Ad/8a+mIsBNA3izdkjzQXWVvYHSpnoYFWqBeFYmbs3mvTAS7fQGM9vnhf79dvfG5mRhRJ7yIefJQoEfLyoIaX0EynPaHhY0xbnrx91qpdM9z2Gcm83EEVSX97ZIwfexJ2jOQV8J0cgrPVaDxcLVTP3QPtT2Xgc8zP8ne5hA24AM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1773242858335854.3203510668866; Wed, 11 Mar 2026 08:27:38 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1w0LEO-0007ln-5R; Wed, 11 Mar 2026 11:12:16 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LDb-0004AB-2r; Wed, 11 Mar 2026 11:11:34 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1w0LDZ-0006D7-Cj; Wed, 11 Mar 2026 11:11:26 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 61D84191EB1; Wed, 11 Mar 2026 18:04:44 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 4DE0637C2F2; Wed, 11 Mar 2026 18:05:22 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1773241484; bh=UhDEF+0FkvE8wwY7FcHd1IRaCkhOlhAOXEZlZtt+UPQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=NEj0UaiBdlMKTDrHDibW/N5BOmGGNOZ/s2E/1vEDbCDgbPz7ey8DHX1bOTGWDzJiJ 8uQFao80sU+M72sObg7HMIOnVgYfFaG+S+rq2gM5C3CjekmfqQFgCInSkYQQBEzkr1 rpeS+lqteRbc/Yy/mJmv9zHiJOI8+NUl/STqGrIYd7m3ULMFm0i0Kh0FTKvChS1cNA KRS4YRGy1/1zT3h2eUTyRHh997pOMq/hTj3WyiVA0LvgegDEanO7/I5uvCPWUO2+Yj QACPXGRrcYfPzmFsPO7lr1dlQHK2LQ+h+5GNWzUUrCmHeJb3aKYTZkH+bmKUvkw3Nj LtZM/Eu7aZEuQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Hanna Czenczek , Kevin Wolf , Michael Tokarev Subject: [Stable-10.1.5 46/46] fuse: Copy write buffer content before polling Date: Wed, 11 Mar 2026 18:03:22 +0300 Message-ID: <20260311150327.1084669-46-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -2 X-Spam_score: -0.3 X-Spam_bar: / X-Spam_report: (-0.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.819, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.903, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1773242858492158500 Content-Type: text/plain; charset="utf-8" From: Hanna Czenczek aio_poll() in I/O functions can lead to nested read_from_fuse_export() calls, overwriting the request buffer's content. The only function affected by this is fuse_write(), which therefore must use a bounce buffer or corruption may occur. Note that in addition we do not know whether libfuse-internal structures can cope with this nesting, and even if we did, we probably cannot rely on it in the future. This is the main reason why we want to remove libfuse from the I/O path. I do not have a good reproducer for this other than: $ dd if=3D/dev/urandom of=3Dimage bs=3D1M count=3D4096 $ dd if=3D/dev/zero of=3Dcopy bs=3D1M count=3D4096 $ touch fuse-export $ qemu-storage-daemon \ --blockdev file,node-name=3Dfile,filename=3Dcopy \ --export \ fuse,id=3Dexp,node-name=3Dfile,mountpoint=3Dfuse-export,writable=3Dtrue= \ & Other shell: $ qemu-img convert -p -n -f raw -O raw -t none image fuse-export $ killall -SIGINT qemu-storage-daemon $ qemu-img compare image copy Content mismatch at offset 0! (The -t none in qemu-img convert is important.) I tried reproducing this with throttle and small aio_write requests from another qemu-io instance, but for some reason all requests are perfectly serialized then. I think in theory we should get parallel writes only if we set fi->parallel_direct_writes in fuse_open(). In fact, I can confirm that if we do that, that throttle-based reproducer works (i.e. does get parallel (nested) write requests). I have no idea why we still get parallel requests with qemu-img convert anyway. Also, a later patch in this series will set fi->parallel_direct_writes and note that it makes basically no difference when running fio on the current libfuse-based version of our code. It does make a difference without libfuse. So something quite fishy is going on. I will try to investigate further what the root cause is, but I think for now let's assume that calling blk_pwrite() can invalidate the buffer contents through nested polling. Cc: qemu-stable@nongnu.org Reviewed-by: Kevin Wolf Signed-off-by: Hanna Czenczek Message-ID: <20260309150856.26800-2-hreitz@redhat.com> Reviewed-by: Kevin Wolf Signed-off-by: Kevin Wolf (cherry picked from commit a3fcbca0ef643a8aecf354bdeb08b1d81e5b33e7) Signed-off-by: Michael Tokarev diff --git a/block/export/fuse.c b/block/export/fuse.c index 465cc9891d..aec4d8736d 100644 --- a/block/export/fuse.c +++ b/block/export/fuse.c @@ -301,6 +301,12 @@ static void read_from_fuse_export(void *opaque) goto out; } =20 + /* + * Note that aio_poll() in any request-processing function can lead to= a + * nested read_from_fuse_export() call, which will overwrite the conte= nts of + * exp->fuse_buf. Anything that takes a buffer needs to take care tha= t the + * content is copied before potentially polling via aio_poll(). + */ fuse_session_process_buf(exp->fuse_session, &exp->fuse_buf); =20 out: @@ -624,6 +630,7 @@ static void fuse_write(fuse_req_t req, fuse_ino_t inode= , const char *buf, size_t size, off_t offset, struct fuse_file_info *f= i) { FuseExport *exp =3D fuse_req_userdata(req); + QEMU_AUTO_VFREE void *copied =3D NULL; int64_t length; int ret; =20 @@ -638,6 +645,14 @@ static void fuse_write(fuse_req_t req, fuse_ino_t inod= e, const char *buf, return; } =20 + /* + * Heed the note on read_from_fuse_export(): If we call aio_poll() (wh= ich + * any blk_*() I/O function may do), read_from_fuse_export() may be ne= sted, + * overwriting the request buffer content. Therefore, we must copy it= here. + */ + copied =3D blk_blockalign(exp->common.blk, size); + memcpy(copied, buf, size); + /** * Clients will expect short writes at EOF, so we have to limit * offset+size to the image length. @@ -660,7 +675,7 @@ static void fuse_write(fuse_req_t req, fuse_ino_t inode= , const char *buf, } } =20 - ret =3D blk_pwrite(exp->common.blk, offset, size, buf, 0); + ret =3D blk_pwrite(exp->common.blk, offset, size, copied, 0); if (ret >=3D 0) { fuse_reply_write(req, size); } else { --=20 2.47.3