From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792268870; cv=none; d=zohomail.com; s=zohoarc; b=Y65o0/E5vO/mwm5hfuNwA2EBgThoFAfzsRtv7b9qG+OoQeSwdMlIa8my0q7Okq/h9bhMXXmKzPS0MOUYLytnJc/7b4BDNxK6C9XVY2yQ4ejB/pjOHNlM6A3vi0xDs7g3tpsSjQGgH8TkuIJRCiuL97dWX2mdbc2l1ROxG+2yqkM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792268870; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=iU/2eap44nyONuh6aDwF/CuDwLRZXJMGZwPFQt6iI0I=; b=PhfNdmplQydEnJVJ9fUgz1HBp8YoBrdPXSbOX5s7+CDbowCRxDvgjXkGl/UgqpLZkO1/9VhxCe7DdHFi41xgehxtv3/vuaRwfjScf4erHXpZs0DC0HCZAduYGJDMnTwioXmVVpRzF6/n+sWI7PDBCQ7YXL3mSto1E4Nj9x0bwnU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792268868992602.0104365756663; Sat, 17 Oct 2026 13:27:48 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB0C-0005Co-As; Sat, 17 Oct 2026 16:27:37 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIAzl-00057k-Ip; Sat, 17 Oct 2026 16:27:12 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIAzd-0003t3-L6; Sat, 17 Oct 2026 16:27:04 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id E3B571DE73C; Sat, 17 Oct 2026 23:26:57 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 01262443413; Sat, 17 Oct 2026 23:26:56 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268817; bh=5szADkSqt+Y+KJByQCD4jhduzE0A1PK/3Wrx2/eB+rs=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=MQhrL91WZSqol8lTRVuwnw0EtoThdtaPicbZdPcjY9UZfq442fHY2tIBvO8XeBg9u klqt9EpnnZfsv4HpjzRMA2sKzIMnP91M5JSuhwD1pvAwL2Zzg9gm/7W5X1a1NiA/9F 4Uvv9GvMV6unppQja40sHIhKumQPzXc6Hd9+j/5nZU8caDOlZ0E7sLkg7UbhoNNHVa rMkoHEYdjSP4wqk25N7XrrkIDLp8rBU4NOM9eRsOgICiS0uhgQoI5sjVNe5XYXwAPu SN/GkJ0Z2CSeTDXWzaACmY6WWUgj82PPva+xBjBFqlvNQfUDpsMam8oz/i+qQSeVPx 2ecGeZD9w66LQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Jean-Francois Bortolotti , Peter Maydell , Michael Tokarev Subject: [Stable-11.1.3 01/73] target/arm: Fix PMSAv8 shareability decode for R-profile MPU regions Date: Sat, 17 Oct 2026 23:25:19 +0300 Message-ID: <20261017202638.728621-1-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792268873450158500 Content-Type: text/plain; charset="utf-8" From: Jean-Francois Bortolotti In Armv8-R AArch32 the shareability field of an MPU region lives in PRBAR, not PRLAR: PRBAR: [31:6] BASE [5] RES0 [4:3] SH [2:1] AP [0] XN PRLAR: [31:6] LIMIT [5:4] RES0 [3:1] AttrIndx [0] EN (Arm Cortex-R52 TRM 100026_0103_00_en: Tables 3-80 and 3-83 for HPRBAR/HPRLAR, Tables 3-124 and 3-127 for PRBAR/PRLAR.) Without this fix, address translation instructions like ATS1HR will return wrong value for PAR.SH. Cc: qemu-stable@nongnu.org Fixes: fca45e3467f7 ("target/arm: Add PMSAv8r functionality") Signed-off-by: Jean-Francois Bortolotti Message-id: 20260925234136.1182108-1-jeff@borto.fr Reviewed-by: Peter Maydell Signed-off-by: Peter Maydell (cherry picked from commit 653b0c06c83d761667474b29ebfb8a312f317c3a) Signed-off-by: Michael Tokarev diff --git a/target/arm/ptw.c b/target/arm/ptw.c index a29de0385f..663a4862a4 100644 --- a/target/arm/ptw.c +++ b/target/arm/ptw.c @@ -3085,7 +3085,7 @@ bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t add= ress, if (!arm_feature(env, ARM_FEATURE_M)) { uint8_t attrindx =3D extract32(matched_rlar, 1, 3); uint64_t mair =3D env->cp15.mair_el[regime_el(mmu_idx)]; - uint8_t sh =3D extract32(matched_rlar, 3, 2); + uint8_t sh =3D extract32(matched_rbar, 3, 2); =20 if (regime_sctlr(env, mmu_idx) & SCTLR_WXN && result->f.prot & PAGE_WRITE && mmu_idx !=3D ARMMMUIdx_Stag= e2) { --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792268962; cv=none; d=zohomail.com; s=zohoarc; b=UCeZlevW1ibVflaaDJYe8/BHVrlV4JHpiX+OggHIfawZCt1PGA4zX4IrMbHCLUPeG8KDQQSeyvMDAXb4J+rwVJMhcEC2bmLWDTP46r+GSHmWJxZLWQRerDKJHIsrGALlxsyxIpPgc5qAQDzLVTn+IjJ2HpTHDYR3+osxVTLGyF4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792268962; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=IaUPb78R7x+qwdU6b+JHb/nElXCzcGqLxSB8v3qPhFg=; b=SY6NEzMPGj3SZdElbOEzXlYbdmi0FGJjTO/SDVpWyGFS4qxhFtCMCkFV/Uv9ZvPbXF7zxtQCsv8gAmSVTKMv5FrkZROp9nlaHkBQne0KGvGqw/s2aPt5d1zZYbdmBXz2SmmemKWrVhYFHLBHiilNv64U+kvnhjGy9fR+vg6GbJg= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792268961508740.606504779331; Sat, 17 Oct 2026 13:29:21 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB0P-0005QI-Dr; Sat, 17 Oct 2026 16:27:49 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIAzp-00058H-DV; Sat, 17 Oct 2026 16:27:18 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIAzi-0003tJ-VV; Sat, 17 Oct 2026 16:27:10 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id B55E71DE73D; Sat, 17 Oct 2026 23:27:03 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 0102D443414; Sat, 17 Oct 2026 23:27:02 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268823; bh=bhA7/owrdMCemIZRffjaxMC93SSySjrJpqFeY4Bc/x4=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=AJpNW/eRSvH1Wc0D1IpkE215i+dT3UnMOTrvHfTKspWtXrrU4K5Rnyg4H773dkA3Q em192x2DdKpdoY/H3nBHdf5aewMtFJ8wpuV+/wK9+nO0V2w2a+4EtvW1zTkyajJQCU cWgNNqFoXMQYfxh2qi215X0OyFYM3EzLtZhCjis5C9yyqPdQoDOycGuhPU5lSlmc9K LzzcQXCzrRf9yKPJQZMCkhKB0tG7irkFZ55HR3doU//T+N/aV/+QWgcS7g6gqWxKY8 EYQWIB356IIi6f2B6OfVNcd4ix4WCxzw+b8fedtdusntIvvXuvklgyzpQJyLWlPxaA zJXs/Zlvqkn7w== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Fuad Tabba , Peter Maydell , Michael Tokarev Subject: [Stable-11.1.3 02/73] target/arm: Fix next timer tick when the offset puts the count ahead Date: Sat, 17 Oct 2026 23:25:20 +0300 Message-ID: <20261017202638.728621-2-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792268963459158500 Content-Type: text/plain; charset="utf-8" From: Fuad Tabba gt_recalc_timer() arms the timer for the ISTATUS 0->1 transition at count =3D=3D cval + offset, treating an overflow of that sum as "beyond the counter's wrap" and arming at INT64_MAX. That reading is valid only when offset <=3D count. When offset > count (a CNTVOFF_EL2 or CNTPOFF_EL2 that puts the timer's counter ahead of the physical count), the sum overflows for every cval still in the future and the wrapped value is the correct next tick, which is what the code used before commit 8d37a1425b99. The timer then never fires on its own. A KVM guest whose counter is set ahead of the host's, as the arch_timer_edge_cases selftest does via KVM_REG_ARM_TIMER_CNT, gets its timer interrupt only when the vCPU is next loaded and KVM rewrites the timer registers, so a guest polling for the interrupt hangs. Reproduced with VHE, nVHE and pKVM hosts on QEMU 11.0.0. The test passes on hardware. Test count + (cval - (count - offset)) for overflow instead, so only a physical count past 2^64 is "never", and add a vtimer test case with an offset that puts the count ahead. Fixes: 8d37a1425b99 ("target/arm: Handle overflow in calculation of next ti= mer tick") Cc: qemu-stable@nongnu.org Signed-off-by: Fuad Tabba Message-id: 20260921074451.3158645-2-fuad.tabba@linux.dev Reviewed-by: Peter Maydell Signed-off-by: Peter Maydell (cherry picked from commit 66d4ea65a064421057f10c4a26d727beedbd1971) Signed-off-by: Michael Tokarev diff --git a/target/arm/helper.c b/target/arm/helper.c index af45234ad2..4ed91ac85a 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -1531,11 +1531,12 @@ static void gt_recalc_timer(ARMCPU *cpu, int timeri= dx) } else { /* * Next transition is when (count - offset) =3D=3D cval, i.e. - * when count =3D=3D (cval + offset). - * If that would overflow, then again we set up the next inter= rupt - * for "as far in the future as possible" for the code below. + * cval - (count - offset) ticks from now. If count plus that + * overflows, set up "as far in the future as possible" below. */ - if (uadd64_overflow(gt->cval, offset, &nexttick)) { + uint64_t remaining =3D gt->cval - (count - offset); + + if (uadd64_overflow(count, remaining, &nexttick)) { nexttick =3D UINT64_MAX; } } diff --git a/tests/tcg/aarch64/system/vtimer.c b/tests/tcg/aarch64/system/v= timer.c index 7d725eced3..e1cfad36be 100644 --- a/tests/tcg/aarch64/system/vtimer.c +++ b/tests/tcg/aarch64/system/vtimer.c @@ -27,6 +27,7 @@ =20 int main(void) { + uint64_t freq, now; int i; =20 ml_printf("VTimer Test\n"); @@ -44,5 +45,32 @@ int main(void) ml_printf("%d: cntv_cval_el0=3D%lx\n", i, read_sysreg(cntv_cval_el= 0)); } =20 + /* + * An offset that puts the virtual count ahead of the physical one, + * so cval + cntvoff wraps for every future cval. The timer must + * still fire. ISTATUS is set by the expiry, so poll it with a bound. + */ + write_sysreg(cntv_ctl_el0, 0); + write_sysreg(cntvoff_el2, -(1ULL << 60)); + asm volatile("isb"); + + freq =3D read_sysreg(cntfrq_el0); + now =3D read_sysreg(cntvct_el0); + write_sysreg(cntv_cval_el0, now + freq / 100); + write_sysreg(cntv_ctl_el0, 1); + + ml_printf("cntvoff_el2=3D%lx\n", read_sysreg(cntvoff_el2)); + ml_printf("cntvct_el0=3D%lx\n", now); + ml_printf("cntv_cval_el0=3D%lx\n", read_sysreg(cntv_cval_el0)); + + while (!(read_sysreg(cntv_ctl_el0) & 4)) { + if (read_sysreg(cntvct_el0) - now > freq) { + ml_printf("FAIL: ISTATUS not set within 1s: cntv_ctl_el0=3D%lx= \n", + read_sysreg(cntv_ctl_el0)); + return 1; + } + } + ml_printf("ISTATUS set at cntvct_el0=3D%lx\n", read_sysreg(cntvct_el0)= ); + return 0; } --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792268963; cv=none; d=zohomail.com; s=zohoarc; b=Iyo7ZstZ0J4sVUzzlU4T8FArb59u4JmphOv7HILHPLy53rKNKBPrQC7VbpFSacWgxtB5K+fPdJE4z8sV23S/bc1PmLS5m2DhfXfvWO3dMRFVbOd2JGIlLfOHrc/g+t2DulnSgLfcKVYdbbVw2wN8BvE2Mzp+w/Ol1YmzkPlbV50= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792268963; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=qlx6p9OmWWQ8WDjtU5VUYx+TRkeyD5X31CtU1ScS5FY=; b=HXTaWILNzMXV/iVs1PgcDwmvzMkj+7SBuH/CKal7m0u0dUwDhmvmfgTIrNwd0z5Wj9A9Ps21UPA50bDh9zR7YOhbEjR361Ry2XDKnb1u4tB32E9KlxyuOiv2SafKdUf2iwDiNF4/HgmlEJxf2ok10eesH2iX3gW7RaH87cgZJao= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792268963314603.0084591195074; Sat, 17 Oct 2026 13:29:23 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB0K-0005I0-Gj; Sat, 17 Oct 2026 16:27:45 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIAzs-00058P-Mx; Sat, 17 Oct 2026 16:27:22 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIAzp-0003tV-5x; Sat, 17 Oct 2026 16:27:16 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id C164F1DE73E; Sat, 17 Oct 2026 23:27:04 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id EBEC4443415; Sat, 17 Oct 2026 23:27:03 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268824; bh=qOEC4Q21/ANmzCz8SsZT9Fz4+umjo5sJIoZ57w3MdUs=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=dzL2ESRGqY68yRxli+bxzI1cVPX+/eNrBT7M01PKSVxyBKo+hhAaWd9ZO1ZBN5Xj/ ITNFTgoycvmyXGNsG/5U5dncRFMZL6W1piR9JEMv7I9oA53VWZaaXWiOyYyYLmr7s/ cCNHqR2ujz0wGYJ6YCbMXW7xPnRUNl+EpEB9WR+LHBib2G90DULSfvkdXZwbxNxfDH w5ctLrPDXgH/ce24nxSdOfmd6LpVc5sGFcpyGqrVcOcUPpzd+ZFAcvUlqENgmebrqY R2Ayi7KVLC4Eo6S8de2TLUkGuxwd82lw1tdDE+GsjgQgQ3SfFZtj41ltj19PZNWiJQ /m8+rGl6RQVCg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Fuad Tabba , Peter Maydell , Michael Tokarev Subject: [Stable-11.1.3 03/73] target/arm: Fix WFxT timeouts when the offset puts the count ahead Date: Sat, 17 Oct 2026 23:25:21 +0300 Message-ID: <20261017202638.728621-3-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792268965326158500 Content-Type: text/plain; charset="utf-8" From: Fuad Tabba The WFIT and WFET helpers arm the wakeup timer at count =3D=3D timeout + offset, treating an overflow of that sum as "beyond the counter's wrap" and arming at INT64_MAX. As in gt_recalc_timer(), that reading is valid only when offset <=3D count: with a CNTVOFF_EL2 that puts the virtual count ahead of the physical count, the sum overflows for every timeout still in the future and the wrapped value was the correct wakeup. The CPU then waits until an interrupt or event instead of waking at its timeout. A Linux guest uses WFIT and WFET in __delay() when FEAT_WFxT is present, which -cpu max advertises. Arm cntval + (timeout - cntvct) instead, so only a physical count past 2^64 is "never", and add a tcg system test that issues WFIT and WFET with such an offset, with a timer interrupt 1s out so a broken WFxT still returns: before this change both wake at the interrupt, after it at their timeout. Fixes: a96edb687e76 ("target/arm: Implement FEAT WFxT and enable for '-cpu = max'") Fixes: da9b86c35fa8 ("target/arm: implement WFET") Cc: qemu-stable@nongnu.org Signed-off-by: Fuad Tabba Message-id: 20260921074451.3158645-3-fuad.tabba@linux.dev Reviewed-by: Peter Maydell Signed-off-by: Peter Maydell (cherry picked from commit 998b6db69e3ec58fd52ddc7a06ece6cf286f3c77) (Mjt: back-port the test across v11.1.0-1104-g602f9163b359 "tests/tcg/aarch64: system tests" make->meson tests conversion) Signed-off-by: Michael Tokarev diff --git a/target/arm/tcg/op_helper.c b/target/arm/tcg/op_helper.c index c4433be2ed..56d7983620 100644 --- a/target/arm/tcg/op_helper.c +++ b/target/arm/tcg/op_helper.c @@ -453,7 +453,8 @@ void HELPER(wfit)(CPUARMState *env, uint32_t rd) raise_exception(env, excp, syn_wfx(1, 0xe, rd, true, WFIT, false),= target_el); } =20 - if (uadd64_overflow(timeout, offset, &nexttick)) { + /* Physical count at the timeout. Only an overflow of it is "never". */ + if (uadd64_overflow(cntval, timeout - cntvct, &nexttick)) { nexttick =3D UINT64_MAX; } if (nexttick > INT64_MAX / gt_cntfrq_period_ns(cpu)) { @@ -710,7 +711,8 @@ void HELPER(wfet)(CPUARMState *env, uint32_t rd) * The WFET should time out when CNTVCT_EL0 >=3D the specified value. */ cpu =3D env_archcpu(env); - if (uadd64_overflow(timeout, offset, &nexttick)) { + /* Physical count at the timeout. Only an overflow of it is "never". */ + if (uadd64_overflow(cntval, timeout - cntvct, &nexttick)) { nexttick =3D UINT64_MAX; } if (nexttick > INT64_MAX / gt_cntfrq_period_ns(cpu)) { diff --git a/tests/tcg/aarch64/Makefile.softmmu-target b/tests/tcg/aarch64/= Makefile.softmmu-target index 3f30be6c5d..4b92a2ffe4 100644 --- a/tests/tcg/aarch64/Makefile.softmmu-target +++ b/tests/tcg/aarch64/Makefile.softmmu-target @@ -83,6 +83,8 @@ QEMU_EL3_BASE_ARGS=3D-semihosting-config enable=3Don,targ= et=3Dnative,chardev=3Doutput,ar run-gpc-test: QEMU_OPTS=3D$(QEMU_EL3_MACHINE) $(QEMU_EL3_BASE_ARGS) -kern= el run-gpc3-test: QEMU_OPTS=3D$(QEMU_EL3_MACHINE) $(QEMU_EL3_BASE_ARGS) -kern= el =20 +run-wfxt: QEMU_OPTS=3D-M virt,virtualization=3Don,gic-version=3D2 -cpu max= -smp 1 -semihosting-config enable=3Don,arg=3D2 -kernel + # Simple Record/Replay Test .PHONY: memory-record run-memory-record: memory-record memory diff --git a/tests/tcg/aarch64/system/wfxt.c b/tests/tcg/aarch64/system/wfx= t.c new file mode 100644 index 0000000000..9d50590a68 --- /dev/null +++ b/tests/tcg/aarch64/system/wfxt.c @@ -0,0 +1,118 @@ +/* + * WFIT/WFET timeout test + * + * Copyright (c) 2026 Google LLC + * Author: Fuad Tabba + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#include +#include + +/* from Linux's include/linux/stringify.h */ +#define __stringify_1(x...) #x +#define __stringify(x...) __stringify_1(x) + +#define read_sysreg(r) ({ \ + uint64_t __val; \ + asm volatile("mrs %0, " __stringify(r) : "=3Dr" (__val)); \ + __val; \ +}) + +#define write_sysreg(r, v) do { \ + uint64_t __val =3D (uint64_t)(v); \ + asm volatile("msr " __stringify(r) ", %x0" \ + : : "rZ" (__val)); \ +} while (0) + +/* .inst forms of WFIT x0 and WFET x0, for assemblers without FEAT_WFxT */ +static inline void wfit(uint64_t timeout) +{ + register uint64_t x0 asm("x0") =3D timeout; + + asm volatile(".inst 0xd5031020" : : "r" (x0) : "memory"); +} + +static inline void wfet(uint64_t timeout) +{ + register uint64_t x0 asm("x0") =3D timeout; + + asm volatile(".inst 0xd5031000" : : "r" (x0) : "memory"); +} + +/* virt machine, GICv2 */ +#define GICD_BASE 0x08000000UL +#define GICC_BASE 0x08010000UL +#define GICD_CTLR 0x000 +#define GICD_ISENABLER0 0x100 +#define GICC_CTLR 0x000 +#define GICC_PMR 0x004 +#define VTIMER_PPI 27 + +static inline void mmio_write32(uintptr_t addr, uint32_t val) +{ + /* GIC registers: MMIO, MMU off at EL2 */ + *(volatile uint32_t *)addr =3D val; +} + +static int test_one(const char *name, void (*wait)(uint64_t), uint64_t fre= q) +{ + uint64_t now, timeout, elapsed; + int early =3D 0; + + /* + * The virtual timer interrupt, 1s out, wakes the CPU even with + * interrupts masked. The timeout, 10ms out, must be what wakes it. + */ + now =3D read_sysreg(cntvct_el0); + write_sysreg(cntv_cval_el0, now + freq); + write_sysreg(cntv_ctl_el0, 1); + timeout =3D now + freq / 100; + + do { + wait(timeout); + early++; + } while (read_sysreg(cntvct_el0) < timeout && early < 1000); + + elapsed =3D read_sysreg(cntvct_el0) - now; + write_sysreg(cntv_ctl_el0, 0); + + ml_printf("%s: woke after %ld ticks (%d wakes)\n", name, elapsed, earl= y); + if (early >=3D 1000) { + ml_printf("FAIL: %s kept waking before its timeout\n", name); + return 1; + } + if (elapsed > freq / 2) { + ml_printf("FAIL: %s woke on the timer interrupt, not its timeout\n= ", + name); + return 1; + } + return 0; +} + +int main(void) +{ + uint64_t freq; + int ret; + + ml_printf("WFxT Test\n"); + + mmio_write32(GICD_BASE + GICD_ISENABLER0, 1u << VTIMER_PPI); + mmio_write32(GICD_BASE + GICD_CTLR, 1); + mmio_write32(GICC_BASE + GICC_PMR, 0xff); + mmio_write32(GICC_BASE + GICC_CTLR, 1); + + /* Put the virtual count ahead of the physical count */ + write_sysreg(cntvoff_el2, -(1ULL << 60)); + asm volatile("isb"); + freq =3D read_sysreg(cntfrq_el0); + + ml_printf("cntvoff_el2=3D%lx cntfrq_el0=3D%ld\n", + read_sysreg(cntvoff_el2), freq); + + ret =3D test_one("wfit", wfit, freq); + ret |=3D test_one("wfet", wfet, freq); + + return ret; +} --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792268969; cv=none; d=zohomail.com; s=zohoarc; b=Ezfcbzg2GGdJuDJ33xlokg/9sJ3ZYngACXDLPbDvZ3/eXJhavhTxDLPHQjKW8lheJX8ek1tWZGBLvLilq0LR4gmD7H1Jg1/UfACwoH3czEF9CeRxukZoerA4+rOJPCeUn8Uaf7jcV8dG9BLKtA1gotkhAikLRA9PBeaKpD+7mKc= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792268969; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=Cp3USjRZaO/1/tA9MS5TPIr882EI8zIDzQjI1d5qyDk=; b=Dxa6sTfFcn6C7kOJjddgplaLYDkzs0nJhEfgwN0zpiwqU8u9m1AsEc1N3Ftol2n9W4zmfOaDIKOWl4QabbJGk3SDte7rNOXkbvdz1b+s+Bx18i+7X417Kq9bwq4hc8lCy2jl2u2MPbGR9GRy2YH2marZBb3Rrdu01oE7l6EuBEM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792268967622971.8721001061273; Sat, 17 Oct 2026 13:29:27 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB0Y-0005eW-MS; Sat, 17 Oct 2026 16:27:58 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIAzt-00058T-Ka; Sat, 17 Oct 2026 16:27:22 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIAzr-0003tg-Nr; Sat, 17 Oct 2026 16:27:17 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id D62311DE73F; Sat, 17 Oct 2026 23:27:05 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id F3342443416; Sat, 17 Oct 2026 23:27:04 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268825; bh=6pXOt0ia7QAaC5wLDLqH+RhiMCf7zr9Wk6BH3Uo71gs=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=lR0zW1SqBua99XtpYgL9wFloQi3nr8rtlqTpFrt2G3VbCZyt7S5r+SsLCYFAeFn7a IM3g3pRKgriBPSB6wT6jzDyVTKS/oVt2AXU5Hct1CrGwpbeU//FcMCmSaS4Nc/ouBg RBDilIbNJkd7eWi+pioVGsgq5njPxskHik3fJMulEQLUkF2NwoJIQzDoxjkhOTyt51 6u7sntbwfxjuwHUZGNMAwatCG3tngycjVDyonb32jnsbiyqU+uE8f4keKRO1AUaZfE SL2vhaTLDc6fVgc6DgqWeJKx6Fz+LJNEdlM2Xhq4DH3V3b4hzyDZL4VLM5laoMh9Ry NhNGjS9YtDcjg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Thomas Huth , Michael Tokarev Subject: [Stable-11.1.3 04/73] hw/usb/hcd-xhci: Limit DMA transfers to plain memory Date: Sat, 17 Oct 2026 23:25:22 +0300 Message-ID: <20261017202638.728621-4-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792268971400158500 Content-Type: text/plain; charset="utf-8" From: Thomas Huth XHCI is a complex controller, involving lots of descriptors that are written and read via DMA transfers. As some recent bugs like https://gitlab.com/qemu-project/qemu/-/work_items/3926 revealed, this can sometimes be exploited from the guest side to crash or stall QEMU. The code currently does DMA writes with the MEMTXATTRS_UNSPECIFIED attribute, i.e. the controller is allowed to write to other MMIO regions, too. However, in normal operation, this should not be necessary, all descriptors should reside in normal memory. So let's decrease the attack surface a little bit and limit the DMA writes to normal memory here. Signed-off-by: Thomas Huth Message-ID: <20260915123242.549150-1-thuth@redhat.com> (cherry picked from commit 89e653b77369ad2d3e579139b1fa2567daa86a79) Signed-off-by: Michael Tokarev diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c index 624ce4ee75..376bc00264 100644 --- a/hw/usb/hcd-xhci.c +++ b/hw/usb/hcd-xhci.c @@ -518,6 +518,7 @@ static inline void xhci_dma_write_u32s(XHCIState *xhci,= dma_addr_t addr, int i; uint32_t tmp[5]; uint32_t n =3D len / sizeof(uint32_t); + const MemTxAttrs memtx_attrs =3D { .memory =3D true }; =20 assert((len % sizeof(uint32_t)) =3D=3D 0); assert(n <=3D ARRAY_SIZE(tmp)); @@ -525,8 +526,7 @@ static inline void xhci_dma_write_u32s(XHCIState *xhci,= dma_addr_t addr, for (i =3D 0; i < n; i++) { tmp[i] =3D cpu_to_le32(buf[i]); } - if (dma_memory_write(xhci->as, addr, tmp, len, - MEMTXATTRS_UNSPECIFIED) !=3D MEMTX_OK) { + if (dma_memory_write(xhci->as, addr, tmp, len, memtx_attrs) !=3D MEMTX= _OK) { qemu_log_mask(LOG_GUEST_ERROR, "%s: DMA memory access failed!\n", __func__); xhci_die(xhci); @@ -613,6 +613,7 @@ static void xhci_write_event(XHCIState *xhci, XHCIEvent= *event, int v) XHCIInterrupter *intr =3D &xhci->intr[v]; XHCITRB ev_trb; dma_addr_t addr; + const MemTxAttrs memtx_attrs =3D { .memory =3D true }; =20 ev_trb.parameter =3D cpu_to_le64(event->ptr); ev_trb.status =3D cpu_to_le32(event->length | (event->ccode << 24)); @@ -629,7 +630,7 @@ static void xhci_write_event(XHCIState *xhci, XHCIEvent= *event, int v) =20 addr =3D intr->er_start + TRB_SIZE*intr->er_ep_idx; if (dma_memory_write(xhci->as, addr, &ev_trb, TRB_SIZE, - MEMTXATTRS_UNSPECIFIED) !=3D MEMTX_OK) { + memtx_attrs) !=3D MEMTX_OK) { qemu_log_mask(LOG_GUEST_ERROR, "%s: DMA memory access failed!\n", __func__); xhci_die(xhci); @@ -2440,6 +2441,7 @@ static void xhci_detach_slot(XHCIState *xhci, USBPort= *uport) static TRBCCode xhci_get_port_bandwidth(XHCIState *xhci, uint64_t pctx) { dma_addr_t ctx; + const MemTxAttrs memtx_attrs =3D { .memory =3D true }; =20 DPRINTF("xhci_get_port_bandwidth()\n"); =20 @@ -2448,9 +2450,9 @@ static TRBCCode xhci_get_port_bandwidth(XHCIState *xh= ci, uint64_t pctx) DPRINTF("xhci: bandwidth context at "DMA_ADDR_FMT"\n", ctx); =20 /* TODO: actually implement real values here. This is 80% for all port= s. */ - if (stb_dma(xhci->as, ctx, 0, MEMTXATTRS_UNSPECIFIED) !=3D MEMTX_OK || + if (stb_dma(xhci->as, ctx, 0, memtx_attrs) !=3D MEMTX_OK || dma_memory_set(xhci->as, ctx + 1, 80, xhci->numports, - MEMTXATTRS_UNSPECIFIED) !=3D MEMTX_OK) { + memtx_attrs) !=3D MEMTX_OK) { qemu_log_mask(LOG_GUEST_ERROR, "%s: DMA memory write failed!\n", __func__); return CC_TRB_ERROR; --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792268995; cv=none; d=zohomail.com; s=zohoarc; b=idZiM+e7MDr2XOg628M1FTdfOLiIfqeAh3ROPgNSH88MyVRi2NeUnjqXe1k2EkRKh72+FpERPuOEmjPmY4PBYpTr6gLi+QMoNZ99sAmDVsupfILBON6im5nwriGc+BblHUTQ6YMM/7xuUm5IMc3F0EPH9n7Q4Ot+U1PBD/SXleU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792268995; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=q2upgg+5rRWHt3tflrnvSZlsIoIiXTWcwWOohpoqs84=; b=aDVNJgXCXabmKwM7tDgJzcv0N8MkP7Z+TfiydOVchHldoCHO8fkF1EB+YnE1YFuTlnCJxIXP2QR0uYepOV2iOe52u34Nf42nP3AbEgjazvTPtjLfCf67vzCr1ouYdCZtSdpMR+DSokTJYhNaPxXO//c0WDa2UeVPVUjysRoomBQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792268995989967.9414458490436; Sat, 17 Oct 2026 13:29:55 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB0S-0005Vv-Kj; Sat, 17 Oct 2026 16:27:52 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIAzy-000599-84; Sat, 17 Oct 2026 16:27:29 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIAzu-0003tr-4n; Sat, 17 Oct 2026 16:27:21 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 3C4031DE740; Sat, 17 Oct 2026 23:27:07 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 1C89A443417; Sat, 17 Oct 2026 23:27:05 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268827; bh=H3IVmotbB1n1kOi0CLoH5M1/W6hRgiychaDvbMuojFs=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=eUZ8YV2W4D0iAJl/kl4mbiyyv3V2s3YI+ShqcbIGs7JXpFW6tG8Oq/qN274WzVJdm YAu4XdykBVRI6bTQU+haiSGf/zn1OqT6TCP3t1TIRGT2XOMWachEBxo7tXRN/HAe7s kfWBahGarT/zTo+tyHowBknpLFBZf+hl4JrYZOXzHvBfGioA+rlTEIdioD2pwLeJXu 0WJSKjHQSvy6T6y2WS0w2uLQxUK6gS8ePZOpnYBR2f0h2drzT8t33mXSgpsoibdu4o 6rakf0yIXLzbFv2cSy4WBIz3tCrqKevLzEq/1w8LGtPhZvvYAZBSjSpmqxjIFixG1g vJgCbd9yvTxQg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Eric Farman , Matthew Rosato , Michael Tokarev Subject: [Stable-11.1.3 05/73] virtio-ccw: Limit ISC to MAX_ISC Date: Sat, 17 Oct 2026 23:25:23 +0300 Message-ID: <20261017202638.728621-5-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792268997935158500 Content-Type: text/plain; charset="utf-8" From: Eric Farman The interrupt subclass is often defined as a uint8, though in practice it will be within the range of just 0-7. Ensure that a guest-supplied subclass does not extend beyond its expected range, especially when used as an array index. Cc: qemu-stable@nongnu.org Fixes: 25a08b8ded ("s390x/css: update css_adapter_interrupt") Reviewed-by: Matthew Rosato Link: https://lore.kernel.org/qemu-devel/20260922201526.2383047-2-farman@li= nux.ibm.com Signed-off-by: Eric Farman (cherry picked from commit 92b935de2709cdbb1c4ee2b48814640a71e8a438) Signed-off-by: Michael Tokarev diff --git a/hw/s390x/css.c b/hw/s390x/css.c index 3a67b67053..9be895a797 100644 --- a/hw/s390x/css.c +++ b/hw/s390x/css.c @@ -654,8 +654,13 @@ void css_adapter_interrupt(CssIoAdapterType type, uint= 8_t isc) S390FLICState *fs =3D s390_get_flic(); S390FLICStateClass *fsc =3D s390_get_flic_class(fs); uint32_t io_int_word =3D (isc << 27) | IO_INT_WORD_AI; - IoAdapter *adapter =3D channel_subsys.io_adapters[type][isc]; + IoAdapter *adapter; + + if (type >=3D CSS_IO_ADAPTER_TYPE_NUMS || isc > MAX_ISC) { + return; + } =20 + adapter =3D channel_subsys.io_adapters[type][isc]; if (!adapter) { return; } diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c index d82874ed27..c422444015 100644 --- a/hw/s390x/virtio-ccw.c +++ b/hw/s390x/virtio-ccw.c @@ -46,6 +46,10 @@ static int virtio_ccw_dev_post_load(void *opaque, int ve= rsion_id) CcwDevice *ccw_dev =3D CCW_DEVICE(dev); CCWDeviceClass *ck =3D CCW_DEVICE_GET_CLASS(ccw_dev); =20 + if (dev->thinint_isc > MAX_ISC) { + return -EINVAL; + } + ccw_dev->sch->driver_data =3D dev; if (ccw_dev->sch->thinint_active) { dev->routes.adapter.adapter_id =3D css_get_adapter_id( @@ -659,6 +663,8 @@ static int virtio_ccw_cb(SubchDev *sch, CCW1 ccw) } else { if (ccw_dstream_read(&sch->cds, thinint)) { ret =3D -EFAULT; + } else if (thinint.isc > MAX_ISC) { + ret =3D -ENOSYS; } else { thinint.ind_bit =3D be64_to_cpu(thinint.ind_bit); thinint.summary_indicator =3D --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792268962; cv=none; d=zohomail.com; s=zohoarc; b=ek+Kw91Qiz+1nGY1QxmfbZxUb0PkR3Vpjx2FWFYGKt4TH41oojU31gFlXtiSwyA4xbJX4Z6Go7S5jQ7xDVDExlmTp5bKL65l3dFC3U0F1TlwMlM44AannDsv1F3new5fhTPS5P+mMqOSoYGVQdRBlEfJwZvgmBeviDIifkEHi2w= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792268962; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=LBRBTg/lZibkNirC8w0lkmWSpnMwJHdWoyapWs4xFqg=; b=Kh5AUHvIoiUCF3h69dk3WoCxUW2DzewaZdlAG8qaQ5VdH+ds3i7PKARGhMXUptce7SGBxKXFNHq0gDpPcHWFx0iZ/mX8gSCuQrl5X0Q2v/CRoNAybN/Wfh+xENbL17CG0mRNjIdPafWn4yzBkk9iOKNlB4NFPBu1tOQbKefwoXM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792268962182291.4372490116541; Sat, 17 Oct 2026 13:29:22 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB0R-0005Uz-F0; Sat, 17 Oct 2026 16:27:52 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB03-0005A0-FP; Sat, 17 Oct 2026 16:27:29 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIAzw-0003u0-EB; Sat, 17 Oct 2026 16:27:23 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 40F301DE741; Sat, 17 Oct 2026 23:27:08 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 87561443418; Sat, 17 Oct 2026 23:27:07 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268828; bh=aseanVXaJ8+l8u+z0m2VZ+uGWZ0vXLlTPQNEV8iyFZw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=GoZYo4eN1GTELkCbtxBGjE2ROgTQk0/zMEfixpLjMpPPr3IPGFdlF1ImZI97xDSQu ZAf0wAZFgXevtgVgW31Qr0OPi5oZia+JwlgQO1F9zBZPI3qPA2E+HJL5uFGTYwjaZl m069DW9KYGbAiLDP5TBaF+C2EGYHlF7ZqFx1gX6ssuN5aCki4GMtrYjTuNZzl8i7FN sP8MlRcJ+aw4pWDGWOeG7VFIWoZonqDbm93WpndgpeT1fNQ0STnXvd0+hh5uPmDc6p h79iLtL4kAEpl8wLFfu/NO3b0sPO3W/mkTkbCBhziiza4YK19zFN/Huogv76V9xn/d HLI+ga1aWubOg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Eric Farman , Matthew Rosato , Michael Tokarev Subject: [Stable-11.1.3 06/73] virtio-ccw: Do not overwrite existing indicators Date: Sat, 17 Oct 2026 23:25:24 +0300 Message-ID: <20261017202638.728621-6-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792268963437158500 Content-Type: text/plain; charset="utf-8" From: Eric Farman The various indicators pointers allow them to be overwritten, but leak any existing structs that might be there. If indicators exist, ensure that they are released before setting the new ones. Both the regular and adapter interrupt paths check that they aren't being asked to enable interrupts when the other one is enabled, so just do this release once all the potential checks are completed. Cc: qemu-stable@nongnu.org Fixes: 7bca3892cb ("s390x/virtio-ccw: reference-counted indicators") Reviewed-by: Matthew Rosato Link: https://lore.kernel.org/qemu-devel/20260922201526.2383047-3-farman@li= nux.ibm.com Signed-off-by: Eric Farman (cherry picked from commit 13c7ba5e0f14aa4c711ba7fc92cddceeafcb1e3f) Signed-off-by: Michael Tokarev diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c index c422444015..a28fac97a4 100644 --- a/hw/s390x/virtio-ccw.c +++ b/hw/s390x/virtio-ccw.c @@ -582,6 +582,11 @@ static int virtio_ccw_cb(SubchDev *sch, CCW1 ccw) if (ret) { break; } + if (dev->indicators) { + /* Need to remove existing indicators first */ + release_indicator(&dev->routes.adapter, dev->indicators); + dev->indicators =3D NULL; + } indicators =3D be64_to_cpu(indicators); dev->indicators =3D get_indicator(indicators, sizeof(uint64_t)= ); sch->curr_status.scsw.count =3D ccw.count - sizeof(indicators); @@ -606,6 +611,11 @@ static int virtio_ccw_cb(SubchDev *sch, CCW1 ccw) if (ret) { break; } + if (dev->indicators2) { + /* Need to remove existing indicators first */ + release_indicator(&dev->routes.adapter, dev->indicators2); + dev->indicators2 =3D NULL; + } indicators =3D be64_to_cpu(indicators); dev->indicators2 =3D get_indicator(indicators, sizeof(uint64_t= )); sch->curr_status.scsw.count =3D ccw.count - sizeof(indicators); @@ -666,6 +676,17 @@ static int virtio_ccw_cb(SubchDev *sch, CCW1 ccw) } else if (thinint.isc > MAX_ISC) { ret =3D -ENOSYS; } else { + if (dev->indicators) { + /* Need to remove existing indicators first */ + release_indicator(&dev->routes.adapter, dev->indicator= s); + dev->indicators =3D NULL; + } + if (dev->summary_indicator) { + /* Need to remove existing indicators first */ + release_indicator(&dev->routes.adapter, + dev->summary_indicator); + dev->summary_indicator =3D NULL; + } thinint.ind_bit =3D be64_to_cpu(thinint.ind_bit); thinint.summary_indicator =3D be64_to_cpu(thinint.summary_indicator); --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792268922; cv=none; d=zohomail.com; s=zohoarc; b=BU5+JsnzOcyNOQrMoAbtzKnOnUc7zTit5h6osCjQLdATQ8z69pjjg95w7M4uwTMwMwCscamDdEGNTmNIMxk+C00M5fsvSRkAAj6XHs2sO6rvv721oDW+ZdWNuOvnMuNDOMgK3wuJXQfGoXWylwa/x+lSPLyGPD10WAGM/qB4cwE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792268922; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=EZM4ESoJ3Jsvi2P1P+ACEJ0khXoSipcJw3rm/fPbbfw=; b=fSlGGptYcxJoS8a9OwDyiXGKelxTjQesky+Ob1AfPaa4lioL4XqfInBmim5OsjAFZABtKsxmnNkf+8WQs7lrc7qOxCNc2ZSrCqh87I2BsTrAl4KTzBXJSqE5T2fPvGEoN/JOXn8ShcRqNHFWW5xaJGOCOnS9BOswMUga0Onl9jE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 179226892098676.56325710337774; Sat, 17 Oct 2026 13:28:40 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB0R-0005V8-FM; Sat, 17 Oct 2026 16:27:52 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB05-0005Aj-MV; Sat, 17 Oct 2026 16:27:35 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB02-0003uQ-A0; Sat, 17 Oct 2026 16:27:28 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 398641DE742; Sat, 17 Oct 2026 23:27:09 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 72A7D443419; Sat, 17 Oct 2026 23:27:08 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268829; bh=zDfY0jDVIJEScbQkYChOCCOZdJu7kmri3YOwtAgm5yc=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=FjzQg6ltRY5kNL9vbYPZUxqcvSM3ISNhOzVoKh+fmGVO/UfcNJz38+/XRwaWSq6n7 i5A16fUQnGo+bXIXy83q8sc4SJvgVRfL1PN69ZRd0rBUC7iFVRXAM4D4+7nHJvVtIb sdpWkArla0po25gK3WVQKAVpeWQYnw+T2A0nKlF3YExZAXeO9+YKSa8XhpDjIRWfX5 V84lZXNqrgdNbk8aP2jYCS247dgMG6svGouaXPJwSFfEWmAqEjii0UpBSClVaFtJuD bpd8ThOn0ZLYMf2N7W3n2Eczs85RxM5B0uGQ7JxbSb0JLT4SeR7rVXa39QpjX49A8u JcdC8qAbNuGsw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Eric Farman , Matthew Rosato , Michael Tokarev Subject: [Stable-11.1.3 07/73] virtio-ccw: Fix rc check in read configuration path Date: Sat, 17 Oct 2026 23:25:25 +0300 Message-ID: <20261017202638.728621-7-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792268925023158500 Content-Type: text/plain; charset="utf-8" From: Eric Farman Both the read and write config paths use wrappers around cds->op_handler, depending on the direction the I/O is flowing. But they expect opposite values in the returned variable to indicate success. Fix this by unifying those checks, where CCW_CMD_READ_CONF needs to see !ret as success. The end result is some erroneous data in the SCSW response data, but the overall success/failure is correct. Cc: qemu-stable@nongnu.org Fixes: d895d25ae2 ("s390x: css: report errors from ccw_dstream_read/write") Reviewed-by: Matthew Rosato Link: https://lore.kernel.org/qemu-devel/20260922201526.2383047-4-farman@li= nux.ibm.com Signed-off-by: Eric Farman (cherry picked from commit bd5bc2861fb6b5ba74137ed263465780894ec432) Signed-off-by: Michael Tokarev diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c index a28fac97a4..c27e49c865 100644 --- a/hw/s390x/virtio-ccw.c +++ b/hw/s390x/virtio-ccw.c @@ -475,7 +475,7 @@ static int virtio_ccw_cb(SubchDev *sch, CCW1 ccw) } else { virtio_bus_get_vdev_config(&dev->bus, vdev->config); ret =3D ccw_dstream_write_buf(&sch->cds, vdev->config, len); - if (ret) { + if (!ret) { sch->curr_status.scsw.count =3D ccw.count - len; } } --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269032; cv=none; d=zohomail.com; s=zohoarc; b=CeOOko5O82I0VpnICGJ1130WEQaQkPwhDwcNvf6xmd1nXsTJG1YjW1DVBFQPGoCSSdTezEHWayDKvqS5wIccp4hPVDjQPmP7EF2wM/CWEEUjAz2gzOOO3EWJhdfMTe+PY8cfz/EybyuhOmhnRw2MyEoEcySpHLKKhALKe0qqez4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269032; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=eT3jtB5HhTAg5b/2kiPNklv0gqn1cgA4dh3ymbaYwWU=; b=EvxAHcUCtMG47rtk5pxCAwLfNVOXfVXehPpkNrgGlrzcOigYg46vj6M0rHcyRr0HuGVPWS9LxD9ii4CERYXLEgnKJuE8mLhDXLC5mUoP/0Rp79Hj/q/Lc8crXEwBDVfri4VZTfC9m/DU06lT1hCvZQleo4uCXoCn3nl5+ImpXic= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269032228896.4205927540514; Sat, 17 Oct 2026 13:30:32 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB0V-0005Zv-O3; Sat, 17 Oct 2026 16:27:55 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB09-0005Cm-Lc; Sat, 17 Oct 2026 16:27:35 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB05-0003uc-Dt; Sat, 17 Oct 2026 16:27:30 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 73E0C1DE743; Sat, 17 Oct 2026 23:27:10 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 6B58B44341A; Sat, 17 Oct 2026 23:27:09 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268830; bh=KHePKfogxeS8j3nlAq9JkImMvLuEe70YBvA2vP9BZHk=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=XaQ7uDTTgpggwwD33FUQY1jQgV8q+aepLa6e5aEtAaJ+FkipznF7Rx57Z3PFWaFwb eL7nDDTNKlnzV2s2LOKNvS5qZSC6hwJA9pLd60xiIAWR/wT7u6Gk377gnZNy9judqz mScr5yZJcoPFDfD20u2PBgfr1MhulbRwBo6s4G3vgjfe0YGQFWiwk/1CaJ9tG9rF+g 72kdtuyjjqs8ahLJs2xIivxTYQUEBJ49XuPcJKU6V8WX4Zu3aUfyoVVRkaI7SYi/MN fXmRDySrBfsLRv4UTyGlY7oyC6KQA3SkS9tZrKq2Iavu5JdHpXHqPNiGGovkr0o5ZP r18NkIXmGf3vQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Eric Farman , Anthony Krowiak , Matthew Rosato , Michael Tokarev Subject: [Stable-11.1.3 08/73] vfio/ap: Clear error object pointer after non-fatal errors Date: Sat, 17 Oct 2026 23:25:26 +0300 Message-ID: <20261017202638.728621-8-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269032916158500 Content-Type: text/plain; charset="utf-8" From: Eric Farman Registering a new IRQ notifier will allocate an error object if needed, and warn_report_err() will release that memory once it's finished. The pointer remains, however, so subsequent errors after the non-fatal errors in vfio_ap_realize() would cause an assertion failure for a non-NULL pointer. Fix this by clearing the pointer once the warning has been reported, to reset the state of the error objects. Cc: Anthony Krowiak Cc: qemu-stable@nongnu.org Fixes: 1360b2ad1f ("s390x/ap: Wire up the device request notifier interface= ") Fixes: 0fb8a62fe4 ("hw/vfio/ap: notification handler for AP config changed = event") Reviewed-by: Matthew Rosato Reviewed-by: Anthony Krowiak Link: https://lore.kernel.org/qemu-devel/20260922201526.2383047-5-farman@li= nux.ibm.com Signed-off-by: Eric Farman (cherry picked from commit 057ca01937b75d772da5a0f8c0282e7c9dbdfb63) Signed-off-by: Michael Tokarev diff --git a/hw/vfio/ap.c b/hw/vfio/ap.c index 6e2a1223ea..2926e04ad4 100644 --- a/hw/vfio/ap.c +++ b/hw/vfio/ap.c @@ -247,8 +247,10 @@ static void vfio_ap_realize(DeviceState *dev, Error **= errp) /* * Report this error, but do not make it a failing condition. * Lack of this IRQ in the host does not prevent normal operation. + * Clear the pointer, since the warning will release it. */ warn_report_err(err); + err =3D NULL; } =20 if (!vfio_ap_register_irq_notifier(vapdev, VFIO_AP_CFG_CHG_IRQ_INDEX, = &err)) @@ -256,8 +258,10 @@ static void vfio_ap_realize(DeviceState *dev, Error **= errp) /* * Report this error, but do not make it a failing condition. * Lack of this IRQ in the host does not prevent normal operation. + * Clear the pointer, since the warning will release it. */ warn_report_err(err); + err =3D NULL; } =20 return; --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792268961; cv=none; d=zohomail.com; s=zohoarc; b=mT+AwNi3qiWXtVKsRTWGm3qRrub1Jk9go4GVLqUsPjhADhveRR/VqBukL7ff5ad9ffapll/yip8gvoKrZJqJhJ0xtTN1Nfcmpcdc6fv+hiocWoYGAv8ydArQqmSQfIkjJFT698eLoo9JiiGfBuRcoycZAap+C24KsaB9Wl9fsLs= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792268961; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=JBCy+or+7YAi6CBSbIR/kuf2n54jzgwUC2dlPrHFF9w=; b=U59BUBlhaWowe/fIMU7OFI+Lqvbe1Wq3wuhV7BeBV6yVIlfF5XrZO+yQNIVnq0qA8tCGcbAwmgwdWyiqlCHO0p1Z6lfxO9WR7dsFCMSExPWjy07ET5XFYaU/cI0A5qug+9orqFYbOmr6jCmQ28OdxXiPxo3cEGzbaALv+br5neE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792268961559984.2904488101718; Sat, 17 Oct 2026 13:29:21 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB0W-0005aj-DM; Sat, 17 Oct 2026 16:27:56 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB0A-0005D6-TR; Sat, 17 Oct 2026 16:27:35 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB09-0003ut-2b; Sat, 17 Oct 2026 16:27:34 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id A3AF41DE744; Sat, 17 Oct 2026 23:27:11 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id CBB2744341B; Sat, 17 Oct 2026 23:27:10 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268831; bh=ujj/GZ/nl/OjvoV3hZONmCoWIDoQ1pNnvRBGWdinfmg=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=xRI2OpsbaCAG+pNGp/gzLp70gZu09YcHGJ3VHAoBRsuDVbMMzl2jiZ3oI8xQh+/O/ WAvCFpKwE0YSxRtQKei3Fp7bWlmuCFVt0urPK1CHtNQPp4Dv5X1dnAG70KM4YobLMo KdAr0WsXOWOdP79J84xKRyXankxPS0Pd3R9ybwAV1go1JOkhXLUTmQDaam+IFZ5Mu3 kPKIGUNy3H5jgTJfH+4Asnw6J+e8nE12mKiVoUWYfv00EBps29ZwlGO5PEhKmHeYMj 3bWy52rq6SSICcjObMPsjGFracpB7Y8IIeIOtplDCKOZNaPvAWqi+pLNt8KBXxOkr6 IrL9aI4nRGy3g== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Eric Farman , Christian Borntraeger , Matthew Rosato , Michael Tokarev Subject: [Stable-11.1.3 09/73] hw/intc/s390x: Fix check after g_try_realloc Date: Sat, 17 Oct 2026 23:25:27 +0300 Message-ID: <20261017202638.728621-9-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792268963436158500 Content-Type: text/plain; charset="utf-8" From: Eric Farman The loop to store pending IRQs uses g_try_realloc() to expand the buffer being used, but the returned address is stored in a pointer-to-pointer, thus the check is supposed to be examining the contents of the pointer, and not the pointer itself. Define a temporary variable to catch and test the returned pointer. If it's NULL, return to the caller to perform the free on the unmodified buffer. If it's not NULL, store it in the caller's pointer and restart the loop against the new struct. Cc: qemu-stable@nongnu.org Fixes: 3a553fc658 ("s390x/kvm: implement floating-interrupt controller devi= ce") Reviewed-by: Christian Borntraeger Reviewed-by: Matthew Rosato Link: https://lore.kernel.org/qemu-devel/20260922201526.2383047-8-farman@li= nux.ibm.com Signed-off-by: Eric Farman (cherry picked from commit 77cc481c23118d0fc3711525dd64373c6797ceed) Signed-off-by: Michael Tokarev diff --git a/hw/intc/s390_flic_kvm.c b/hw/intc/s390_flic_kvm.c index f833a3996a..e9e04ea70a 100644 --- a/hw/intc/s390_flic_kvm.c +++ b/hw/intc/s390_flic_kvm.c @@ -254,6 +254,7 @@ static int __get_all_irqs(KVMS390FLICState *flic, void **buf, int len) { int r; + void *new_buf =3D NULL; =20 do { /* returns -ENOMEM if buffer is too small and number @@ -263,10 +264,11 @@ static int __get_all_irqs(KVMS390FLICState *flic, break; } len *=3D 2; - *buf =3D g_try_realloc(*buf, len); - if (!buf) { + new_buf =3D g_try_realloc(*buf, len); + if (!new_buf) { return -ENOMEM; } + *buf =3D new_buf; } while (r =3D=3D -ENOMEM && len <=3D KVM_S390_FLIC_MAX_BUFFER); =20 return r; --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792268962; cv=none; d=zohomail.com; s=zohoarc; b=AkgvtlM9cLkgzUQ8MpGKU1JGyTbUcZwNZvkfO9XxWVuNERbaMfZmI2QFozjTko8a8/vkjdexhK8ToB23OsV7zl0lp1bL0kPEpPB8I+3lt+LyDmlX/cHQwqNkcVi2h3cv20j3b69koFU4xX9axEykCaHahGKL3cekEwFwtFi++uI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792268962; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=IHxw9enzB2BiNQt9gCcs/teh4au+oBEh9VdNdT9/4g8=; b=ZLP+MsziY1KBuBv6lBtP7Lq3Fkft4YMGuX79Ph362Clz7YgyKIpNdbNIPbxgMaudpL75o110I5XPHzlIUOUQIftvhAHp+1MkpXCfHcIqb1U9kVdav8c+0HGQcifNfWQGUFLNjhmISwkMEjEha49fevxii6FL35kd1Shdln0E24I= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 179226896256857.738843760071745; Sat, 17 Oct 2026 13:29:22 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB0c-0005mY-Uq; Sat, 17 Oct 2026 16:28:04 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB0E-0005H9-8l; Sat, 17 Oct 2026 16:27:39 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB0B-0003vD-5K; Sat, 17 Oct 2026 16:27:37 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 92ECD1DE745; Sat, 17 Oct 2026 23:27:12 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id D6F6744341C; Sat, 17 Oct 2026 23:27:11 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268832; bh=VcvUbPAXldWAHPO6IWKGzyVdoVokx/0DFamuIiWP80k=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=S5jaJOj+tWpRGb5IHpnT1AWMo2gDgSu08By8SWWf02hLOYZGEtlJOltWSJbXea8AC iU4gSCaQViQdmQN17jTPmk3D54M6hFy26MWtGVVzU8qzWVwMNnKlL+BhY+YAuCLSmQ A7s73Ms9CTdU9CGpfJUH9g19CMj5swZiA7b572D9IvfmTfYzLc0qPF3rZPgEEXlMAh Yi/uNFF7jkbwvX75z+8300dpTGy8psvCqCIhcttaAX51GDBYPnpV3yrBMLnpBq8eLU mrrefhAMvbA27VWp7D/+pSmj/PGyi8i53gMughvf28jBYhBf3B5RGJMAGv7zooRNUQ FA0UYQ5CMnV9g== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Eric Farman , Matthew Rosato , Michael Tokarev Subject: [Stable-11.1.3 10/73] s390x/css: Use datastream pointer for checking no-data CCWs Date: Sat, 17 Oct 2026 23:25:28 +0300 Message-ID: <20261017202638.728621-10-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792268963432158500 Content-Type: text/plain; charset="utf-8" From: Eric Farman The channel subsystem will reject channel programs that incorporate 256 CCWs without a data transfer, but the existing check to account for this only does so for CCWs with a data address of zero. Other valid CCWs that wouldn't transfer data are not accounted for. Rather than re-inventing the wheel, use the output of the datastream at the end of the entire CCW parsing tree to indicate whether data was moved or not. Cc: qemu-stable@nongnu.org Fixes: e8601dd5d0 ("s390x/css: catch ccw sequence errors") Reviewed-by: Matthew Rosato Link: https://lore.kernel.org/qemu-devel/20260922201526.2383047-9-farman@li= nux.ibm.com Signed-off-by: Eric Farman (cherry picked from commit 930a188edbbcbd68aadaa1db22e4db1b785a2171) Signed-off-by: Michael Tokarev diff --git a/hw/s390x/css.c b/hw/s390x/css.c index 9be895a797..d4d4f4a220 100644 --- a/hw/s390x/css.c +++ b/hw/s390x/css.c @@ -1016,13 +1016,6 @@ static int css_interpret_ccw(SubchDev *sch, hwaddr c= cw_addr, =20 check_len =3D !((ccw.flags & CCW_FLAG_SLI) && !(ccw.flags & CCW_FLAG_D= C)); =20 - if (!ccw.cda) { - if (sch->ccw_no_data_cnt =3D=3D 255) { - return -EINVAL; - } - sch->ccw_no_data_cnt++; - } - /* Look at the command. */ ccw_dstream_init(&sch->cds, &ccw, &(sch->orb)); switch (ccw.cmd_code) { @@ -1103,6 +1096,20 @@ static int css_interpret_ccw(SubchDev *sch, hwaddr c= cw_addr, } sch->last_cmd =3D ccw; sch->last_cmd_valid =3D true; + + /* + * A CCW that transfers no data is allowed, but ensure an upper limit + * is established to prevent long-running channel programs that don't + * move actual data. + */ + if (ret =3D=3D 0 && sch->cds.at_byte =3D=3D 0) { + if (sch->ccw_no_data_cnt =3D=3D 255) { + ret =3D -EINVAL; + } else { + sch->ccw_no_data_cnt++; + } + } + if (ret =3D=3D 0) { if (ccw.flags & CCW_FLAG_CC) { sch->channel_prog +=3D 8; --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269198; cv=none; d=zohomail.com; s=zohoarc; b=kzkyHlvWUhHGThk6B89Fth2etYmyZe6333BZlOqDOCfZcfO417bsgxq997zVBnzBqDL0CoSZ+1z7MXi5N5anikWfxEqzBTFVwIVshX0dnHBnLo/seiqWaX/sKZA4Qr+eHeg2MXYGjvEGwZax9R1yFyDxpJWrQBILehUBUHP1Lpk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269198; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=v3OQX8i+hZ8DGJVqRpTaI2Hdctlt5jujjgrciRoGPmg=; b=AfEqBEJ24TwuvxBaINxoiGSSqxn5nOxobxzr4HziS7E8N2eOS7FHOVIZ4IxnH0VVygHUlfmai6m88urXqupZYrETZQYcFuiTL//bZICrIg1KLrk9fZTHB0upy04Yt87JPBVYkA2oB2puxqiz3ggRCJrVK8Sy56K6fAPkv8HOjyI= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269198827160.1670297557215; Sat, 17 Oct 2026 13:33:18 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB0f-0005y7-R4; Sat, 17 Oct 2026 16:28:08 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB0E-0005H8-8f; Sat, 17 Oct 2026 16:27:39 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB0C-0003vN-Dr; Sat, 17 Oct 2026 16:27:37 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 5623B1DE746; Sat, 17 Oct 2026 23:27:14 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id C5A0444341D; Sat, 17 Oct 2026 23:27:12 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268834; bh=YvudTu1TjQ7XzZhzWIPBrU8F7GjFpeEV26Ryt+HR480=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Z1vmyPlTyJ1PuGObCczViDc9j8ipIVoEH+LUa7oS1AAEZEKAHpsgyqq2XXHi4AbCh +LmqEju1I7awpKThXEWUI0l1kcdZVKfOWuxb3Ra7CxSBcdU7X0iQmqjfXRUMUt7m5O ghA1j7oTgbhlV2lR8XvJS682kEFIymFxnNK+oOIaPQ0ZoyAreo3OyuMOKlIOyayhML UIK/rlzpVkZfpHQ2Z2Y1NqLJahoEzBIM9oe5jnMnbqLfUgGqDoySIbHC6u3dMNl9vd YzXpp0uCV0+hS6qoxmEG3mtI1CZGleEROdBq3l9KclSOK8x4s6x3AmmLvhuFbYuyxE mMIz0Z5EKOO7A== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Eric Farman , Janosch Frank , Matthew Rosato , Christian Borntraeger , Michael Tokarev Subject: [Stable-11.1.3 11/73] s390x/sclp: Reject short headers in PV case Date: Sat, 17 Oct 2026 23:25:29 +0300 Message-ID: <20261017202638.728621-11-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269199797158500 Content-Type: text/plain; charset="utf-8" From: Eric Farman An invalid length in an SCCB header correctly generates a specification exception for the regular (non-PV) codepath that processes an SCLP instruction intercept. The PV case doesn't, because the UV enforces a valid length before getting to this point. The length is used to allocate storage later down the line, so doublecheck the length here in the (unlikely) case it is too short. Cc: Janosch Frank Cc: qemu-stable@nongnu.org Fixes: c1db53a591 ("s390/sclp: read sccb from mem based on provided length") Reviewed-by: Matthew Rosato Acked-by: Christian Borntraeger Link: https://lore.kernel.org/qemu-devel/20260922201526.2383047-10-farman@l= inux.ibm.com [farman@linux.ibm.com: Updated commit/comment text, per Janosch] Signed-off-by: Eric Farman (cherry picked from commit 119860f15cd239dced773de9375f741db255652d) Signed-off-by: Michael Tokarev diff --git a/hw/s390x/sclp.c b/hw/s390x/sclp.c index b452f2ce54..8e5bd21f03 100644 --- a/hw/s390x/sclp.c +++ b/hw/s390x/sclp.c @@ -275,6 +275,11 @@ int sclp_service_call_protected(S390CPU *cpu, uint64_t= sccb, uint32_t code) =20 s390_cpu_pv_mem_read(env_archcpu(env), 0, &header, sizeof(SCCBHeader)); =20 + /* We should never end up here due to UV checks, but lets be sure */ + if (be16_to_cpu(header.length) < sizeof(SCCBHeader)) { + goto out_no_write; + } + work_sccb =3D g_malloc0(be16_to_cpu(header.length)); s390_cpu_pv_mem_read(env_archcpu(env), 0, work_sccb, be16_to_cpu(header.length)); @@ -288,6 +293,7 @@ int sclp_service_call_protected(S390CPU *cpu, uint64_t = sccb, uint32_t code) out_write: s390_cpu_pv_mem_write(env_archcpu(env), 0, work_sccb, be16_to_cpu(header.length)); +out_no_write: sclp_c->service_interrupt(sclp, SCLP_PV_DUMMY_ADDR); return 0; } --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269193; cv=none; d=zohomail.com; s=zohoarc; b=mugsyOsc70WzmPGXj/yIctaquqfJd7uh4aLunYgxLjf5m0MlyLLydJ5AgyhUF3UDD9amtzIHZbHtPdlZ2AlHzEMTD+1FC3m6/AbLHaUnirZSeTK1thzc69xJQho4s9pykzMvS7fHQYQnQ5zgwRgmakuGkZxx45ljl05yM9ma/T4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269193; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=JBM1FnKYeFLmM/o1tS9in39IddH92mr9vHLA1QHBzSQ=; b=naPPP7FSqcb/MkjYS8PNruOYX8PerNaaRQ0iDrfuKz6ToH7RE+OnBSnA9FeGl5u1YmmuPuEoDr0eSZcL8pEzTjViwXY9Xp9H/7k4NQe/n49yOz5efRb4eEvhprdD+VfpYpcfPbnS/yzIB4T6QGaPI78MP+2nt8agSF0NY6CdLgM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269193169182.46025545612724; Sat, 17 Oct 2026 13:33:13 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB0f-0005wU-EO; Sat, 17 Oct 2026 16:28:05 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB0H-0005Hz-GO; Sat, 17 Oct 2026 16:27:43 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB0F-0003vo-NK; Sat, 17 Oct 2026 16:27:41 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 6FD021DE747; Sat, 17 Oct 2026 23:27:15 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 8A82444341E; Sat, 17 Oct 2026 23:27:14 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268835; bh=h0BWN6CVMO1GBm/Xer5ieqPEukNQ6yblUgmEV/ew2Ug=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Tk64E4hLQt6qX1K5o3829B8JREAKy+9SJxrHIwHSX863hBpqeLvTDsKbRp1i+OC93 YXoW1Uu85fDebIKwCLmXN0eJDqPmxpZkWmNQNDUR8Hh0nO1FdrdQP6RB4luaa+SXY2 NhaJAFPt9R6JtaMGjlW3k2ztPQiWw/3eYVAdgu1J8Xsz30tDbEZre4Mw9s7Mk4e3Cr yQBfjf8oN40x11AixlnEQ8FcGq9GHkZEZm2rsBzHqRaogOE5hfWlpgYVP2tUSW6I0Y tKnb2rv/hTi2TWKUYSMH3pthBvRS7JhRlfGF08swFwpZe2Glzq0/4Qn29hITmKpaBf uL8gCW/3fnq8Q== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Matthew Rosato , Eric Farman , Farhan Ali , Michael Tokarev Subject: [Stable-11.1.3 12/73] s390x/pci: Fix frame stepping in rpcit_service_call() Date: Sat, 17 Oct 2026 23:25:30 +0300 Message-ID: <20261017202638.728621-12-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269193658158500 Content-Type: text/plain; charset="utf-8" From: Matthew Rosato When walking the guest IO address table, an invalid segment or region entry causes table_translate() to return entry.len equal to the frame size for that table level (1 MiB for ST, 2 GiB for RT). Adding entry.len directly to start only advances to the correct next frame boundary if start is already frame-aligned at that level -- which is true for a well-behaved Linux guest but not a general requirement. Add logic to advance start to the next frame boundary rather than simply adding entry.len. For a frame-aligned start (the typical, well-behaved case) the result is identical. Fixes: 0125861eacc3 ("s390x/pci: fixup the code walking IOMMU tables") Cc: qemu-stable@nongnu.org Signed-off-by: Matthew Rosato Reviewed-by: Eric Farman Reviewed-by: Farhan Ali Link: https://lore.kernel.org/qemu-devel/20260929153012.774530-2-mjrosato@l= inux.ibm.com Signed-off-by: Eric Farman (cherry picked from commit e57ad36701886404baaf5216bacfa9a21f98fd6e) Signed-off-by: Michael Tokarev diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c index 652e1712ec..bac813fb6a 100644 --- a/hw/s390x/s390-pci-inst.c +++ b/hw/s390x/s390-pci-inst.c @@ -808,7 +808,8 @@ int rpcit_service_call(S390CPU *cpu, uint8_t r1, uint8_= t r2, uintptr_t ra) coalesce =3D 0; } =20 - start +=3D entry.len; + /* Advance to next frame boundary if start was not frame-aligned */ + start =3D QEMU_ALIGN_UP(start + 1, entry.len); while (entry.iova < start && entry.iova < end) { if (dma_avail > 0 || entry.perm =3D=3D IOMMU_NONE) { dma_avail =3D s390_pci_update_iotlb(iommu, &entry); --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792268995; cv=none; d=zohomail.com; s=zohoarc; b=mVM14fKGwV+UzvDv11PLRQgB+Nk8WCBq5s5XNpTVs20MosfJqD0Fy+A0ycmuF4+jTysF9wngV3BV2+XRmaOCftul0ogbEiDeY5n8mtznN1WMWnqVCtg9bGtsJ1kV5ixuS2zK4GwcSRRkfoXofjXWaL//GC+R+hcAI+yUpXsi7m0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792268995; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=CZmoC8XOdY2a+YrdYwBgeu+X4STSuiI4PGgjl6bRHp4=; b=eay5b5E4PL+4QLqvE3czZKwC9EvbUZd49/5tXq5lYRFGNsJdPO25ETepwLN491FXjjboRt6iCWHrKuTHMNkgSgL9CPxdUqKZJREVD+zXxnNIatd+6Uu4pmbBEmzrfey3fgKGPrEct1EeVLgyB86Wuhpex8d/8+5eTVZVnNN2raQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792268994568243.08651506078786; Sat, 17 Oct 2026 13:29:54 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB1q-0006wf-8L; Sat, 17 Oct 2026 16:29:18 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB0b-0005kl-He; Sat, 17 Oct 2026 16:28:01 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB0Z-0003vp-Ni; Sat, 17 Oct 2026 16:28:01 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 770B81DE748; Sat, 17 Oct 2026 23:27:16 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id A0E6344341F; Sat, 17 Oct 2026 23:27:15 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268836; bh=oafjU6Mi33R4pVRatYjACDwsepVjxzZeaDUf/Pv4Jqk=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=fAcmHJ1WfcQptX2xhHLkabBUt0NSRuBJ20oj4FrZtx7kcriCWe2hLTM6iOike2oVL KLbSDy3FCFZoT55I1tOToCLqqeV4TV7gDOZ+yur6XyN0tRif/FYQzYjdyEI5c5nGTn 7+ANb+AwjoL2EM+1c0FW0coVKYM4sN3wALyGZbYPtNaCqNncF9A+NsLHa5aTXCLzdW IEimkZ5WeDooL9rolStu1W/6t6cNGFEV9ZQtEswGhe6gJg4j003Sjual6qDVJOSMQo pgAz8Bf3mm2z/lZqmluuqj5JDOuWUBDjhV4uqXoHfYTcekllTZtsbjcpIHxQGdxx3k 1Y7rBeDDo8vVw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Matthew Rosato , Farhan Ali , Eric Farman , Michael Tokarev Subject: [Stable-11.1.3 13/73] s390x/pci: Use qemu_log_mask() for guest-triggered errors in reg_ioat() Date: Sat, 17 Oct 2026 23:25:31 +0300 Message-ID: <20261017202638.728621-13-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792268997940158500 Content-Type: text/plain; charset="utf-8" From: Matthew Rosato The error paths in reg_ioat() that are triggered by a guest providing invalid MPCIFC arguments use error_report(), which writes unconditionally to stderr. A misbehaving guest can exploit this to flood the host log by repeatedly issuing the instruction with bad arguments. Replace these with qemu_log_mask(LOG_GUEST_ERROR, ...) so that the messages are suppressible. Fixes: 863f6f52b713 ("s390: implement pci instructions") Fixes: dfcee1ea4c52 ("s390x/pci: add support for guests that request direct= mapping") Cc: qemu-stable@nongnu.org Signed-off-by: Matthew Rosato Reviewed-by: Farhan Ali Reviewed-by: Eric Farman Link: https://lore.kernel.org/qemu-devel/20260929153012.774530-3-mjrosato@l= inux.ibm.com Signed-off-by: Eric Farman (cherry picked from commit 10a81449a279be0d5b46c3422b445ca3f42d3393) Signed-off-by: Michael Tokarev diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c index bac813fb6a..73417edade 100644 --- a/hw/s390x/s390-pci-inst.c +++ b/hw/s390x/s390-pci-inst.c @@ -15,8 +15,8 @@ #include "exec/memop.h" #include "exec/target_page.h" #include "system/memory.h" -#include "qemu/error-report.h" #include "qemu/bswap.h" +#include "qemu/log.h" #include "system/hw_accel.h" #include "hw/core/boards.h" #include "hw/pci/pci_device.h" @@ -1044,11 +1044,12 @@ static int reg_ioat(CPUS390XState *env, S390PCIBusD= evice *pbdev, ZpciFib fib, =20 /* currently we only support designation type 1 with translation */ if (t && dt !=3D ZPCI_IOTA_RTTO) { - error_report("unsupported ioat dt %d t %d", dt, t); + qemu_log_mask(LOG_GUEST_ERROR, + "unsupported ioat dt %d t %d\n", dt, t); s390_program_interrupt(env, PGM_OPERAND, ra); return -EINVAL; } else if (!t && !pbdev->rtr_avail) { - error_report("relaxed translation not allowed"); + qemu_log_mask(LOG_GUEST_ERROR, "relaxed translation not allowed\n"= ); s390_program_interrupt(env, PGM_OPERAND, ra); return -EINVAL; } --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269276; cv=none; d=zohomail.com; s=zohoarc; b=WZzoXLe3EYnsetNlXdBk7EltVEkQJSRdgqLDf4NFn+/FuU9PGGePzDobFJLUeSJLFd+7z1f/MF+xtqfs6BKoPq/nuUjTpqdQmfYBEo68gVE6Usa9r0J3Uz7Ky+lEYH5FMUWDRfTf0xsTJEoY0/n0Cp222QNitrfxjXgPpmOUH6I= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269276; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=7Xu8BqgMwFnMYE1NvFGr6G4iGXRh8Y74gdDLsFUAIFA=; b=k9DGwWYxh8j3fR9FxskVbAn7gAZyGBGAPbMLMweBxImv2JZmL/F0TprIokPgh3IpEtL2UNaNT2mgVKb3jA+fW4/opCMW0Cd5Gxc5YS/TnkgcGlZdkhP+yQArTAUPxltfxEiqurVY5sRFta2ZTszVlnZJl+lynGE+/mz17A1xoBk= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269276628403.68582269224817; Sat, 17 Oct 2026 13:34:36 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB1u-0007Y1-EJ; Sat, 17 Oct 2026 16:29:22 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB0e-0005uV-OB; Sat, 17 Oct 2026 16:28:04 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB0c-0003wD-W6; Sat, 17 Oct 2026 16:28:04 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id DCB541DE749; Sat, 17 Oct 2026 23:27:17 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id D62F0443420; Sat, 17 Oct 2026 23:27:16 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268837; bh=nH0CvQP+rDYWKCBng+koUebVNeteBTGd0leESiXIIR4=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=oTRXbnCVymAupLOiK/Z8C/5jgS9aATxDD/qMehOHv4hpKkhBbSigjceZbWFMkJryl uZHul2+TwM0QdPOrLmtiKFyoJ9ir+Ov8FtRJR7YsgtCoSkGgPDTWwS5FJwaTCoizyN K5xIPk0RDeXShaxpA3MHtAUeb5IlnpteO9FLt3aLpmzoBp4AL1u+ejaQ057u22y6vs KFG4t2EqRVuPeLpkGYp5/0I2WppmMCrZIKAMVIAUQ87SKHeKZBxt9YrulMwEB1F6iG MBkjYQdjBhAB/BD55DM4KzA8IzrvzOsAWibKaTY35/wbJWZ9nOUgPZvIl+tD0yMPFg nODk856ajLQYw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Matthew Rosato , Farhan Ali , Eric Farman , Michael Tokarev Subject: [Stable-11.1.3 14/73] s390x/pci: Reject apertures beyond IOAT capacity in translation mode Date: Sat, 17 Oct 2026 23:25:32 +0300 Message-ID: <20261017202638.728621-14-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269277363158500 Content-Type: text/plain; charset="utf-8" From: Matthew Rosato In order to support direct mapping (which is only bound by the aperture size of the underlying host EDMA reported via vfio) QEMU reports the host-provided EDMA to the guest. However, when using translation mode QEMU only supports up to 4 TiB currently (the size of a single RT table). Reject attempts by a guest to register a translation aperture that would exceed what QEMU can support by giving an operand exception on the MPCIFC instruction that requested the large aperture. This restriction can be removed in the future if/when support for additional IOAT regions is added. Cc: qemu-stable@nongnu.org Signed-off-by: Matthew Rosato Reviewed-by: Farhan Ali Link: https://lore.kernel.org/qemu-devel/20260929153012.774530-4-mjrosato@l= inux.ibm.com Signed-off-by: Eric Farman (cherry picked from commit d818e2b0e6317fe5685ce3671bdb566402ff00e9) Signed-off-by: Michael Tokarev diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c index 73417edade..09026360d4 100644 --- a/hw/s390x/s390-pci-inst.c +++ b/hw/s390x/s390-pci-inst.c @@ -1054,6 +1054,21 @@ static int reg_ioat(CPUS390XState *env, S390PCIBusDe= vice *pbdev, ZpciFib fib, return -EINVAL; } =20 + /* + * We report an EDMA that may exceed what QEMU can handle in support + * of direct-mapping. If the guest attempts to register an IOAT that + * is too large, reject it with an informative message. Only direct + * mapping can be used for guests of this size until support is added + * to QEMU for additional IOAT regions. + */ + if (t && pal >=3D ZPCI_TABLE_SIZE_RT) { + qemu_log_mask(LOG_GUEST_ERROR, + "ioat pal 0x%"PRIx64" exceeds max translatable addre= ss\n", + pal); + s390_program_interrupt(env, PGM_OPERAND, ra); + return -EINVAL; + } + iommu->pba =3D pba; iommu->pal =3D pal; iommu->g_iota =3D g_iota; diff --git a/include/hw/s390x/s390-pci-bus.h b/include/hw/s390x/s390-pci-bu= s.h index 9228523ce8..f182bab246 100644 --- a/include/hw/s390x/s390-pci-bus.h +++ b/include/hw/s390x/s390-pci-bus.h @@ -140,6 +140,7 @@ enum ZpciIoatDtype { #define ZPCI_PT_BITS 8 #define ZPCI_ST_SHIFT (ZPCI_PT_BITS + TARGET_PAGE_BITS) #define ZPCI_RT_SHIFT (ZPCI_ST_SHIFT + ZPCI_TABLE_BITS) +#define ZPCI_TABLE_SIZE_RT (1ULL << (ZPCI_RT_SHIFT + ZPCI_TABLE_BITS)) =20 #define ZPCI_RTE_FLAG_MASK 0x3fffULL #define ZPCI_RTE_ADDR_MASK (~ZPCI_RTE_FLAG_MASK) --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792268974; cv=none; d=zohomail.com; s=zohoarc; b=MAIKTyHmYFXvf6hOEYFTmz4aU9wCvi3atfVv7kKF0CrYWeVKUam2a1ZZIM9PyIihOpPYxG1DwMAdXPZQX959AoRtmUJm7IX86mH9nAu+DkbobfgF6BiuqTzXDTzMaDvtVcPUlo7AU4n7PfPUo8v7PegCCPbHrPzDF4opeq/+zoM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792268974; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=N2ZXdAizu3PtMQ8JZOztJ+8HMe9eO/FL/8KSngptI+M=; b=h1W1UxpDJ2oDXSTkUN7Yz2mcIhC6fHLz3r0Ut9Y6wj5bZeNyAYUxgoro5AvyH1Tl04rDAH/RqxTEHsFrNHZEIVw+9ac8IZMlCGFcJrXN3a2B98X0zUMXGfJHpiHZsB4Z/P/ifOTUXj7ry6OSl6YnpxyfU+kBD8YizxFqAimNz20= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792268973842225.83692743976508; Sat, 17 Oct 2026 13:29:33 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB1r-0007Bi-Q5; Sat, 17 Oct 2026 16:29:20 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB0e-0005uW-MW; Sat, 17 Oct 2026 16:28:04 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB0c-0003x5-Vg; Sat, 17 Oct 2026 16:28:04 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id E26271DE74A; Sat, 17 Oct 2026 23:27:18 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 311AB443421; Sat, 17 Oct 2026 23:27:18 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268838; bh=b7xkjTBsF9ZvVjOy6rFxJMSpZBaWEGNLu9oZjM3tevg=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=ik6fUy1k+JXBA6j3lWkEjHz0cOsr6q6fWMjGqdjuJMCJMlbebJwM7PbKA3nJEqDCE jVaf7YB3P5skxf2QwRxL8rIlMsn8bmn/ZAczqPc60Vo8g3395cwmucRZUapE5V78T1 MYg3B3xQAcs5nFCTsHffS96+II6SARC/rH4B5DnBftst66uC/9bdJNtTKwi8KRVxAz XogQrp2RFUZ9Ef3Qhp+D9fAPJ42MuBEUYb/22gJf8RH+IZrXNRPIBR5uALitjZ+d8S NbJafCWE7wqbhrkDOFD6EwHvfYXLtpoq/8XgldnrGBMmt9hghi/Cvewba+Nf6j0mkh G7nCkxeP//UKg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-11.1.3 15/73] hw/usb/dev-smartcard-reader: validate interrupt transfer length Date: Sat, 17 Oct 2026 23:25:33 +0300 Message-ID: <20261017202638.728621-15-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792268975618158500 From: Marc-Andr=C3=A9 Lureau A guest can submit an interrupt IN transfer shorter than the 2-byte RDR_to_PC_NotifySlotChange message. usb_packet_copy() asserts that the packet has enough space, so a zero- or one-byte request triggers an assertion failure, crashing QEMU. Check the transfer length before copying and stall the endpoint when it is too short. The notification is preserved for a subsequent properly-sized transfer. Note: a later refactoring patch will switch to usb_packet_size(), but this patch open-code p->iov.size for consistency with the rest of the code. Fixes: CVE-2026-18609 Fixes: 367071447ec5 ("usb-ccid: add CCID bus") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4128 Signed-off-by: Marc-Andr=C3=A9 Lureau Acked-by: Philippe Mathieu-Daud=C3=A9 (cherry picked from commit 1847dcd96d7dbb7d4478b61e1bd7a5ca563d910c) Signed-off-by: Michael Tokarev diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index 964c142d10..bba97a2b19 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -1122,6 +1122,10 @@ static void ccid_handle_data(USBDevice *dev, USBPack= et *p) break; case CCID_INT_IN_EP: if (s->notify_slot_change) { + if (p->iov.size < 2) { + p->status =3D USB_RET_STALL; + break; + } /* page 56, RDR_to_PC_NotifySlotChange */ buf[0] =3D CCID_MESSAGE_TYPE_RDR_to_PC_NotifySlotChange; buf[1] =3D s->bmSlotICCState; --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269048; cv=none; d=zohomail.com; s=zohoarc; b=C/nclzBwBEnM30qmq0aPAboRj6if9FIkdMeZk0esErR+vhsU57uR0Mhfpy6o82otSEX5VszOvkOQSq26nSeY19S3hZWO32IcRir4AdW9nr/wjLllQa1Ji2KFRE6Dmt+Es0uL9/+tFHOVsbBQrWssS6Eku/0EitcJvRR2HbosIdY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269048; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=4zNkeSOerhlm5qLzNmlIJOydfOSf0BDoFfWpyco1eBw=; b=SobD4x3Noj8B+MlW6xQkTNlPZ6OeHAKBCfqchFOvv7nuZPv+xsgG4pTFqOu0un47uh6I71GvluXtFAdJm4YWVhc6HWX3I2c/GYEjYFQtccjnULUV/4b25U3Iz9HV1KL+YRgJvmUyKQLde6NpHhJYokW5hFqjhMmj716hSasl5oI= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269048114137.73894191440183; Sat, 17 Oct 2026 13:30:48 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB1q-0006xM-8k; Sat, 17 Oct 2026 16:29:18 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB0h-00062h-SQ; Sat, 17 Oct 2026 16:28:09 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB0g-0003xP-3N; Sat, 17 Oct 2026 16:28:07 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id EC1A41DE74B; Sat, 17 Oct 2026 23:27:19 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 1F9FF443422; Sat, 17 Oct 2026 23:27:19 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268839; bh=68cmUY1QwDoYLeMIO9z89j05rrMVPbqlL9YaOcVbpoY=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=KpMf5joagGIcj0qRaxIiiDQnu892bivqtByeIvzzcFFse1sRPejARObecYLVtQ8ko O/NHSt6b2G7DXx4+NaVfkM09G0WEoBJACx8PhUJLheLJn/cI+kBDTtv5tch/bsLCIU sHsUOgrYCefU8JxRQcvrScLBZ9Y5DK1M42Ktae3gVBgYb15LoSzVu5AfFpOutm9gST nMllutlhwLYlai6qkuCncITBtv31G22KbC8ueueGY6aVoEacJpXTEawdLsNbAGv78O YJrC9nwAZIAKKWqQ2MHQ9HPVvY3Dan0XeC0SUQIKKcZPCf9hpW8LXYHW23IRYqa1XN Ie8ks/a/EzONg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , Warisjeet Singh , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-11.1.3 16/73] hw/usb/dev-smartcard-reader: fix OOB read from pending bulk-in ring Date: Sat, 17 Oct 2026 23:25:34 +0300 Message-ID: <20261017202638.728621-16-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269048988158500 From: Marc-Andr=C3=A9 Lureau ccid_bulk_in_get() decrements bulk_in_pending_num when a slot becomes active, but the slot is only truly free after ccid_bulk_in_release(). A guest can fill all 8 ring slots, partially read one (leaving pos non-zero), then send another command whose response reuses the active slot. The stale pos > new len makes the uint32_t subtraction in ccid_bulk_in_copy_to_guest() wrap, reading past data[]. Move the decrement to ccid_bulk_in_release() so the slot stays busy until then. Add an assert(pos <=3D len) before the subtraction. Resetting or removing the card must also discard the active slot so that its stale position and pointer cannot be reused. In practice, the device advertises bMaxCCIDBusySlots=3D1, so a conforming host never has more than one command in flight and the ring never fills. Fixes: CVE-2026-18204 Fixes: 367071447ec5 ("usb-ccid: add CCID bus") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4086 Reported-by: Warisjeet Singh Reviewed-by: Philippe Mathieu-Daud=C3=A9 Signed-off-by: Marc-Andr=C3=A9 Lureau (cherry picked from commit 49851e859506c6326288162718573c1e22ab9bf4) Signed-off-by: Michael Tokarev diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index bba97a2b19..aee966c0c9 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -570,6 +570,10 @@ static void ccid_remove_pending_answer(USBCCIDState *s, =20 static void ccid_bulk_in_clear(USBCCIDState *s) { + if (s->current_bulk_in !=3D NULL) { + s->current_bulk_in->pos =3D 0; + s->current_bulk_in =3D NULL; + } s->bulk_in_pending_start =3D 0; s->bulk_in_pending_end =3D 0; s->bulk_in_pending_num =3D 0; @@ -580,6 +584,7 @@ static void ccid_bulk_in_release(USBCCIDState *s) assert(s->current_bulk_in !=3D NULL); s->current_bulk_in->pos =3D 0; s->current_bulk_in =3D NULL; + s->bulk_in_pending_num--; } =20 static void ccid_bulk_in_get(USBCCIDState *s) @@ -587,8 +592,6 @@ static void ccid_bulk_in_get(USBCCIDState *s) if (s->current_bulk_in !=3D NULL || s->bulk_in_pending_num =3D=3D 0) { return; } - assert(s->bulk_in_pending_num > 0); - s->bulk_in_pending_num--; s->current_bulk_in =3D &s->bulk_in_pending[(s->bulk_in_pending_start++) % BULK_IN_PENDING= _NUM]; } @@ -1078,6 +1081,7 @@ static void ccid_bulk_in_copy_to_guest(USBCCIDState *= s, USBPacket *p, =20 ccid_bulk_in_get(s); if (s->current_bulk_in !=3D NULL) { + assert(s->current_bulk_in->pos <=3D s->current_bulk_in->len); len =3D MIN(s->current_bulk_in->len - s->current_bulk_in->pos, p->iov.size); if (len) { --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269029; cv=none; d=zohomail.com; s=zohoarc; b=FwXzM8l5gEfT4nWo8Kmy+V92v4QtCd+dRHK3Rzrjsm1sU8U/IVHqG+0md5s1CzREGvJSlH9u2Dp6BpP/RvEUamGd4qbRDzczlogUdk3dSg6sV13UgxdxDMKei+pMxVmlsyXRUytS5mo5WvkYNeJaOwtBPAHwykfLPhK9mG3g1/I= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269029; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=iueHmPqXLSPp/y8+70AlGXoTlj6nXZdPsEJDr2UhSIQ=; b=QOmREIVpA9bsWdIvM1MaB6zYBOH7cO6SXw+CMxZvM779356AH6CxE7w1oJyJch8bAXMD3+kpRbs4Nzwf54EncbfoMvd1JCmWeRgwZ75BtKV8qls4gJQfAW9oLg7nnvNCwTD9vFHqL3IK9eWk/mIJ5xjGdffyvmlwNUlgbpWo8vg= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269029569684.124662497702; Sat, 17 Oct 2026 13:30:29 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB25-0007xN-EH; Sat, 17 Oct 2026 16:29:35 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB0h-00062g-RL; Sat, 17 Oct 2026 16:28:08 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB0g-0003xQ-3M; Sat, 17 Oct 2026 16:28:07 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 115481DE74C; Sat, 17 Oct 2026 23:27:21 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 29540443423; Sat, 17 Oct 2026 23:27:20 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268841; bh=T29+x61vRVPGumRCB3fkn+sH97oemALwx2atp0ZP7x0=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=hfR07zX9oeDJxbhOTDus+yjXp4jg3wwjaUquDJoV5qqwSfhkx0iU9CIUOltJ8dDrq nk9ZZ8BZ0YRXUSt0hvBgp9xcoTX7P4QaQ2vq2D0vJhrsj1yg+9Pk7KZuqXH+pVW4hD HApfDDbIYSh8ik4pwlEmHsMUXYgqnKn5GwASrVPoMLIXDnXqEH+so/fDnJfy5Y9kNo XEO4dowClumgD2/YIQ2CmdGIplAW23OpFeijhWTA9h1A4QBz3cgx/ijdGUMa87Up5A cSg+FfKbeelsYNTylFnLk+qq8OcyVZEKInq/lFkJQu6dFR3vN22Fua+rYQryrJIEQm 8oYBW0HQme6Fw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-11.1.3 17/73] hw/usb/dev-smartcard-reader: fix assert on pending answers overflow Date: Sat, 17 Oct 2026 23:25:35 +0300 Message-ID: <20261017202638.728621-17-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269030716158500 From: Marc-Andr=C3=A9 Lureau A guest can send PC_to_RDR_XfrBlock USB messages faster than the async card backend can process them. When the pending_answers ring buffer (128 entries) fills, ccid_add_pending_answer() hits an assert() and crashes QEMU. The CCID spec (section 4) states that a slot can only accept one command at a time. A second command to a busy slot must be rejected with CMD_SLOT_BUSY (section 6.2.6). Enforce this by checking pending_answers_num before queuing a new APDU. When the slot is already busy, report ERROR_CMD_SLOT_BUSY and send a DataBlock error response back to the guest. Fixes: CVE-2026-18410 Fixes: 367071447ec5 ("usb-ccid: add CCID bus") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3997 Signed-off-by: Marc-Andr=C3=A9 Lureau Acked-by: Philippe Mathieu-Daud=C3=A9 (cherry picked from commit d7f20657e756744fec8f84cd225a3b07cfb78526) Signed-off-by: Michael Tokarev diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index aee966c0c9..9cbacf08e7 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -166,6 +166,7 @@ enum { ERROR_XFR_PARITY_ERROR =3D -3, ERROR_XFR_OVERRUN =3D -4, ERROR_HW_ERROR =3D -5, + ERROR_CMD_SLOT_BUSY =3D -32, }; =20 /* 6.2.6 RDR_to_PC_SlotStatus definitions */ @@ -949,6 +950,13 @@ static void ccid_on_apdu_from_guest(USBCCIDState *s, C= CID_XferBlock *recv) ccid_write_data_block_error(s, recv->hdr.bSlot, recv->hdr.bSeq); return; } + if (s->pending_answers_num > 0) { + DPRINTF(s, D_WARN, + "usb-ccid: slot already busy, rejecting apdu\n"); + ccid_report_error_failed(s, ERROR_CMD_SLOT_BUSY); + ccid_write_data_block_error(s, recv->hdr.bSlot, recv->hdr.bSeq); + return; + } len =3D le32_to_cpu(recv->hdr.dwLength); DPRINTF(s, 1, "%s: seq %d, len %u\n", __func__, recv->hdr.bSeq, len); --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269193; cv=none; d=zohomail.com; s=zohoarc; b=dTqInScAuu1CI3WQmZsTEOnZ+vXdsRBwJVmg7rFtZzyNlVbxgSGVEGdSKfmvScf1ZJ1Z6BMfgFli1W74pUTR6s5Qjs23sU9636q08eGjk8h3I1h+7bsfZcuFvl/xCf1S+nbiHNfAmSc0ftzZRAYC/YHcsoo3XLRB+29SLGda8W0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269193; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=M+pyIC11pgHA7RYIvc8aKrhwM7z22X4tKStMPzSoVFY=; b=doDQxFW2dmkIlAqmU99kOfWjsbQ/tTEr5n9nPkqG0XvBEBbqIIknQuQPpu1IwagQ1G1/N+g2wpHvv6h1YatbT2b1aCpaaBI6pxjZkss9jVsedG0Z1FrRKU0CmM0x0QpoNpTqYe4w+Q2SqrsmPFkwqT1bWlBPqfjaiksCIymVpk4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269193111563.6903114499158; Sat, 17 Oct 2026 13:33:13 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB1x-0007kb-6P; Sat, 17 Oct 2026 16:29:25 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB1A-0006O2-Kb; Sat, 17 Oct 2026 16:28:46 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB13-0003xs-AN; Sat, 17 Oct 2026 16:28:31 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 31A471DE74D; Sat, 17 Oct 2026 23:27:22 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 5C52A443424; Sat, 17 Oct 2026 23:27:21 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268842; bh=Z+37PwjUJ7yxLliNYq69AncpPD48DSUwO+aZK4c6kR4=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=qsPemA5a6CjVBFAD1gK/cOnz9c7ElXbesF+i2NDzUrQSZy16Qy/Oji46Szfx8lkSL aWnSNT24kpyna4iG24rssAXGIufIQ5i8YTQtWZR4vH7Ydp+wB5DXPLFtjhlVW1Rv9Z E3NwV7mwd+wUSm7plm9oa6z65AL69prVgdl76WQRTZD5JCHvTNvzSPWVzp2j9TcKx7 2qpfvePEitoli4a4H103MlHUuVorBt95lCQ0R87NoyZK9DeGmmiyAc4iCBV2z+qOFl 7QdxuzSuqq6zJVXNYxIvKRbZDbRLr5RKW+J6TDEzSChhb5DxRtyl/tyKy9Q68c0YnY NpXo1ALYBm4oA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-11.1.3 18/73] hw/usb/dev-smartcard-reader: decode bulk-out length as little-endian Date: Sat, 17 Oct 2026 23:25:36 +0300 Message-ID: <20261017202638.728621-18-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269193732158500 From: Marc-Andr=C3=A9 Lureau The CCID Rev 1.1 specification states in section 1.3, Document Conventions, that fields larger than one byte are stored in little-endian format. The bulk message header's dwLength field is a four-byte field described in section 6, CCID Messages. Decode dwLength with le32_to_cpu() before using it to assemble and validate Bulk-OUT messages. This fixes message handling on big-endian hosts. Reviewed-by: Philippe Mathieu-Daud=C3=A9 Signed-off-by: Marc-Andr=C3=A9 Lureau (cherry picked from commit 069dcc103be7600f2197ecb202c8276022fc35d2) Signed-off-by: Michael Tokarev diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index 9cbacf08e7..4cb5f6e1a4 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -993,6 +993,7 @@ static const char *ccid_message_type_to_str(uint8_t typ= e) static void ccid_handle_bulk_out(USBCCIDState *s, USBPacket *p) { CCID_Header *ccid_header; + uint32_t payload_len; =20 if (p->iov.size + s->bulk_out_pos > BULK_OUT_DATA_SIZE) { goto err; @@ -1005,17 +1006,18 @@ static void ccid_handle_bulk_out(USBCCIDState *s, U= SBPacket *p) } =20 ccid_header =3D (CCID_Header *)s->bulk_out_data; - if ((s->bulk_out_pos - 10 < ccid_header->dwLength) && + payload_len =3D le32_to_cpu(ccid_header->dwLength); + if ((s->bulk_out_pos - 10 < payload_len) && (p->iov.size =3D=3D CCID_MAX_PACKET_SIZE)) { DPRINTF(s, D_VERBOSE, "usb-ccid: bulk_in: expecting more packets (%u/%u)\n", - s->bulk_out_pos - 10, ccid_header->dwLength); + s->bulk_out_pos - 10, payload_len); return; } - if (s->bulk_out_pos - 10 !=3D ccid_header->dwLength) { + if (s->bulk_out_pos - 10 !=3D payload_len) { DPRINTF(s, 1, "usb-ccid: bulk_in: message size mismatch (got %u, expecte= d %u)\n", - s->bulk_out_pos - 10, ccid_header->dwLength); + s->bulk_out_pos - 10, payload_len); goto err; } =20 --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269371; cv=none; d=zohomail.com; s=zohoarc; b=ln04v+50c38r/Xf0G4jx9agYiv9J8wCdtV04JUy3yrZ9IbZx9sGDEeu9A42km6jtfVrjOAA93TgungJRzhlnvDXzhiFcwtWNrE54YtioDzeDXHi01kCaBh1SFJ5cq4I+gejfExmImTcEybXS1w8KMSLZdpNijWajm7Sw9Ju2c5k= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269371; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=/erHYAqn8R2UiLyffJc5EaiCrxQO85cW19s33k9sxNo=; b=j3jpRggJiP0lIwVfhI+IP5WYM00uMq0oG4dEU13hoUFsyZVWrGbMBZ/2veV0ILl/P1VSMCyEX7hRAABohxBYmG2GscF+lAmrB6fsvm4zUuQf90vuClBmYSRVyO8M6SI3DIRULHOTsOSmnUzLZW1cizSdiQ3K05tYkyvuwIQ7egc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269371701344.8243143521356; Sat, 17 Oct 2026 13:36:11 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB1u-0007Xl-Es; Sat, 17 Oct 2026 16:29:22 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB19-0006ME-HU; Sat, 17 Oct 2026 16:28:39 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB13-0003xu-Dm; Sat, 17 Oct 2026 16:28:31 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 1EA6F1DE74E; Sat, 17 Oct 2026 23:27:23 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 634C9443425; Sat, 17 Oct 2026 23:27:22 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268843; bh=TvfbHBj8LQynFjroYhLJLapXU5bv3tTKrvXqbKgJewg=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=QmvlWTrLaNYacy+Uv73OKmGNHwu/pVkX+6JR0E/M9BlqTFufGmlZsETWRFhIXboZm TFCsTprr7Fx6Gi180R/GCdyP8Vk5PvmFchy/SDD3tIaNWKk1N0Bh8zsnaAx7ANXq1B 8yMvqPehlp0EFXtvI0YRaUPJOxY7LCVJvHUmrApyGrPFuS4C1T1I2opjq3mjNVp3GD kbY0XJhr9gR8bT2kkFF8DO+4K//OsNNMOhBY+j831DewFMqq2HC8jn+Pcr6Xrfueru K7n7wQw/cmUmEgWLwRIx9rg/bYZ2k24cSspAwfceB9osQyFsEhhXu53YnEfX9rIkyP LAu3e2orc13aA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-11.1.3 19/73] hw/usb/dev-smartcard-reader: validate migrated fields in post_load Date: Sat, 17 Oct 2026 23:25:37 +0300 Message-ID: <20261017202638.728621-19-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269372126158500 From: Marc-Andr=C3=A9 Lureau Validate fields loaded from the migration stream to reject crafted or corrupt data before it can cause harm. Signed-off-by: Marc-Andr=C3=A9 Lureau Acked-by: Philippe Mathieu-Daud=C3=A9 (cherry picked from commit 665494c3ac0737e8067b6365f99c237bd5e5356a) Signed-off-by: Michael Tokarev diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c index 4cb5f6e1a4..b68f371f24 100644 --- a/hw/usb/dev-smartcard-reader.c +++ b/hw/usb/dev-smartcard-reader.c @@ -1359,6 +1359,26 @@ static void ccid_realize(USBDevice *dev, Error **err= p) static int ccid_post_load(void *opaque, int version_id) { USBCCIDState *s =3D opaque; + int i; + + if (s->bulk_in_pending_end - s->bulk_in_pending_start > BULK_IN_PENDIN= G_NUM) { + return -EINVAL; + } + + if (s->pending_answers_num > PENDING_ANSWERS_NUM) { + return -EINVAL; + } + + if (s->bulk_out_pos > BULK_OUT_DATA_SIZE) { + return -EINVAL; + } + + for (i =3D 0; i < BULK_IN_PENDING_NUM; i++) { + if (s->bulk_in_pending[i].len > BULK_IN_BUF_SIZE || + s->bulk_in_pending[i].pos > s->bulk_in_pending[i].len) { + return -EINVAL; + } + } =20 /* * This must be done after usb_device_attach, which sets state to ATTA= CHED, --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269382; cv=none; d=zohomail.com; s=zohoarc; b=OzaFfkK895B8tkn7dqWLiTQjYmwwK/kDuBoAys9/Nnx1vYN6DAH/RbLF1yggP+TYvh43VKm0OGyrcco2m/UjXAJccdEW2J+6MF4yG501omOjrteG0m7LcBv7WOAH7IikVDX+lQsvyAc9rbCR4IHW1ftmWC+SLD1mx6f/Za0dHCc= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269382; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=1YWCFCzWAH4ytsIykhzidxW/nj7rwGvs/b8D2j8M0xo=; b=j9dtwWLQKT+k/t4bEL9UqP3W2XFtOed5IKR4AKumIbuOC6UkXbimbNQIgQSqgb9ma9BQMzvIQvQDouCd1MzKiQah5vCVeq74YmeJyRzqA6aqlV/UO4z85IhVZ7IoBjESDPQGc3g3gOtBbrcXJDLsaujalSlM9RHM5XKg/uA/vWE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269382948735.245706392587; Sat, 17 Oct 2026 13:36:22 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB2X-0000Zh-CU; Sat, 17 Oct 2026 16:30:01 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB1C-0006Oa-J3; Sat, 17 Oct 2026 16:28:46 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB1A-0003zh-W3; Sat, 17 Oct 2026 16:28:38 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 3C42C1DE750; Sat, 17 Oct 2026 23:27:24 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 50EA7443426; Sat, 17 Oct 2026 23:27:23 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268844; bh=RGAd5ibHiodI5YwFcPorHpWGBclDFCGrJpuETcQaFg0=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=xGreYEyUGhAxV0dq1Kezo3GYsLVftb5I90UcSR3iFLsaSdet0Q5gdjyZ0rjlv5bNL 0Qih3+Cu9dLT6Tx9GvHDzVGLgSo4kqpd9qgcxf8X9diAK08c3rI4eR6xNWcrOED3fm ZWD+G35sO2sRaxMSarR8gxYSAwvrwKIAgizzzcNAiplRcUUDVN3TLFLoDkPy+NeNko OAKuMIS17NZ7Bi9gClFlDChq/lmuU3aDFtF8y+IpV0ZuACcdAxTfD7oR0sahN8xcJD tL1DDUdk2FweQzXj7y/h4LHORqcVTbDCyQBUk6Dl++RHbqa/I3Mmw/MNGJN7aUJc1V dyipF7abXZWRg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , Akihiko Odaki , Michael Tokarev Subject: [Stable-11.1.3 20/73] virtio-gpu: disable blob scanouts on mapping cleanup Date: Sat, 17 Oct 2026 23:25:38 +0300 Message-ID: <20261017202638.728621-20-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269385002158500 From: Marc-Andr=C3=A9 Lureau When a blob resource backing is cleaned up (for ex via detach_backing), any scanouts referencing it must be disabled first to prevent the dmabuf from outliving its backing memory. Fixes: CVE-2026-66020 Fixes: 32db3c63ae11 ("virtio-gpu: Add virtio_gpu_set_scanout_blob") Reported-by: Akihiko Odaki Reviewed-by: Akihiko Odaki Signed-off-by: Marc-Andr=C3=A9 Lureau (cherry picked from commit 3ece85b53c124142c7d5cbb1165d4da125b7c369) Signed-off-by: Michael Tokarev diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c index f991baf856..d479595ddb 100644 --- a/hw/display/virtio-gpu.c +++ b/hw/display/virtio-gpu.c @@ -999,6 +999,16 @@ void virtio_gpu_cleanup_mapping_iov(VirtIOGPU *g, void virtio_gpu_cleanup_mapping(VirtIOGPU *g, struct virtio_gpu_simple_resource *res) { + if (res->blob) { + int i, max_outputs =3D g->parent_obj.conf.max_outputs; + + for (i =3D 0; i < max_outputs; i++) { + if (g->parent_obj.scanout[i].resource_id =3D=3D res->resource_= id) { + virtio_gpu_disable_scanout(g, i); + } + } + } + virtio_gpu_cleanup_mapping_iov(g, res->iov, res->iov_cnt); res->iov =3D NULL; res->iov_cnt =3D 0; --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269622; cv=none; d=zohomail.com; s=zohoarc; b=l/MBFG7HfAAPG83ddPM1sEUNU0bkL4HGuo+GD3wMx43DAv5X/h7xGzHyHmUDSwdMNGrpmvt2LACdDs9t/vaIiZJ97OoWFFG2mlfMspNMCAThA+eqr5cSIhw690A17B0z7t9B3QiNFnxMhwzwlMWu9ryhkFVVi1vkhYb5Qg2gw1g= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269622; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=O0j4osvrs7eBIIIpInVd9jhFzNOYwTLSGQ82O34fwdY=; b=eCw9q9pEG7ElpAwsK7n1IzfklXuQU4wEKWrQF6NNSPj/p4FD1s3P66k8k3VQY78dM7hJxKTS9IkUY8XDM48KKI9V1wmO3deJdyYNhgGR/KymcgZ4LWozZuOWuxuvQgrVALmLsdUMD77yQOS4nxBUMFBH6uIrJ/Y1zCCsaK9B8nE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269622984340.2896613186365; Sat, 17 Oct 2026 13:40:22 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB1s-0007DV-0o; Sat, 17 Oct 2026 16:29:20 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB1G-0006Qr-ES; Sat, 17 Oct 2026 16:28:46 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB1C-0003zr-4Y; Sat, 17 Oct 2026 16:28:42 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 930221DE751; Sat, 17 Oct 2026 23:27:25 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 9EF11443427; Sat, 17 Oct 2026 23:27:24 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268845; bh=h57GzFQYmUjzaeP5MHevP5o4XFTUhQB/hhYxJgPWjQE=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=YguwxKmPVTrZPQyQJ3yuArBIqVjJDWoSee4m3bUkqu4TOLP9SspVAjsB5TAQsE+g9 1P1OXqjyfHBZ7z8ti8LItIFFZ76fQQjPL/DLDX8HU/z9EuaOuVO/iYciD00eXbXMPC dm5aiWyrBsam6x7LX/+8yNFz0okNOiqefmqs4zQxr4v3KzfQzLVukhZpGXZ+oWkYtG aJqbxjZVRSjwsk1qQBDtdEYzaMCXh0/zE8ATRT1c+G9K4RZCt+ghaxTUa/HWcZlrEh mqs86qGHN7jG2uHf8l+raQv/K9KH4LRvm0Y6VpgGnEf4bWYJVhI53vkquHwKyviRJx r/0ZukrFvE6tg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Fabiano Rosas , Seungjung Kim , Peter Xu , Michael Tokarev Subject: [Stable-11.1.3 21/73] migration: Introduce VMStateStructMember Date: Sat, 17 Oct 2026 23:25:39 +0300 Message-ID: <20261017202638.728621-21-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269623291158500 Content-Type: text/plain; charset="utf-8" From: Fabiano Rosas When migrating a buffer or array, the vmstate code needs to know the size of the buffer and the number of elements of the array. Today a vmstate writer can choose from a number of macros that take as last input the name of a struct member from where the size/num will be read. At load time, the code will access those values via an opaque pointer to the migrated data and therefore it needs to also know the size of the struct member at that offset. Currently that information is communicated by means of the VMS_VARRAY_* and VMS_VBUFFER_* flags, where each possible type is represented by a flag. So far, that's all fine, but since the vmstate code makes heavy use of macros, handling several types individually (i.e. by name: int, int32_t, etc) requires several versions of a same macro, one for each type. E.g: VMSTATE_VBUFFER_ALLOC_UINT32 ^ This creates a pattern where the vmstate writer has to match the macro name to the data type and has resulted in the code having a tendency of having one macro version for each type, for each type of vmstate. There is also some cognitive load to deal with, e.g. VMSTATE_VARRAY_INT32 doesn't hold an array of int32, it holds an array of something else and the number of elements for the array is stored in a variable of type int32. We're now dealing with the scenario where the code has been expecting int32_t at some places, but a uint64_t macro variant has been added without the code being updated. To address all these situations, introduce a new struct that will hold the offset of the struct members, but also their size, so the various extra macros can all be removed and the person writing the vmstate doesn't need to care about type-checking. Still, keep a minimum check that those fields are at least integers and fit into 64 bits. What changes: 1) type checking changes from individual types to a single check for all integers; 2) there are new ways to access the offsets; num_offset -> num_indirect.offset size_offset -> size_indirect.offset [new] num_indirect.size [new] size_indirect.size 2) reading the offsets goes from checking the VMS_VARRAY_* flags in an if/elseif block to comparing offset.size against the hardcoded sizes in bytes; 3) the VMS_VARRAY_* and VMS_VBUFFER_* flags become obsolete. Removed in the next patch; 4) memory usage increases +1 byte per vmstate; Reported-by: Seungjung Kim Fixes: CVE-2026-6426 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3675 Acked-by: Peter Xu [fixed up vmstate_read_from_offset to work on BE host] Signed-off-by: Fabiano Rosas (cherry picked from commit f9f70b50e3eb7782a7662653e93fb4c3dec56423) Signed-off-by: Michael Tokarev diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h index 1b7f295417..aa423c1e8e 100644 --- a/include/migration/vmstate.h +++ b/include/migration/vmstate.h @@ -31,6 +31,7 @@ =20 typedef struct VMStateInfo VMStateInfo; typedef struct VMStateField VMStateField; +typedef struct VMStateStructMember VMStateStructMember; =20 /* * VMStateInfo allows customized migration of objects that don't fit in @@ -67,15 +68,15 @@ enum VMStateFlags { * to the actual field (e.g. struct a { uint8_t *b; * }). Dereference the pointer before using it as basis for * further pointer arithmetic (see e.g. VMS_ARRAY). Does not - * affect the meaning of VMStateField.num_offset or - * VMStateField.size_offset; see VMS_VARRAY* and VMS_VBUFFER for + * affect the meaning of VMStateField.num_indirect or + * VMStateField.size_indirect; see VMS_VARRAY* and VMS_VBUFFER for * those. */ VMS_POINTER =3D 0x002, =20 /* The field is an array of fixed size. VMStateField.num contains * the number of entries in the array. The size of each entry is * given by VMStateField.size and / or opaque + - * VMStateField.size_offset; see VMS_VBUFFER and + * VMStateField.size_indirect; see VMS_VBUFFER and * VMS_MULTIPLY. Each array entry will be processed individually * (VMStateField.info.get()/put() if VMS_STRUCT is not set, * recursion into VMStateField.vmsd if VMS_STRUCT is set). May not @@ -88,8 +89,9 @@ enum VMStateFlags { * array entry. */ VMS_STRUCT =3D 0x008, =20 - /* The field is an array of variable size. The int32_t at opaque + - * VMStateField.num_offset contains the number of entries in the + /* + * The field is an array of variable size. The integer at opaque + + * VMStateField.num_indirect contains the number of entries in the * array. See the VMS_ARRAY description regarding array handling * in general. May not be combined with VMS_ARRAY or any other * VMS_VARRAY*. */ @@ -105,7 +107,7 @@ enum VMStateFlags { VMS_ARRAY_OF_POINTER =3D 0x040, =20 /* The field is an array of variable size. The uint16_t at opaque - * + VMStateField.num_offset + * + VMStateField.num_indirect * contains the number of entries in the array. See the VMS_ARRAY * description regarding array handling in general. May not be * combined with VMS_ARRAY or any other VMS_VARRAY*. */ @@ -114,26 +116,27 @@ enum VMStateFlags { /* The size of the individual entries (a single array entry if * VMS_ARRAY or any of VMS_VARRAY* are set, or the field itself if * neither is set) is variable (i.e. not known at compile-time), - * but the same for all entries. Use the int32_t at opaque + - * VMStateField.size_offset (subject to VMS_MULTIPLY) to determine + * but the same for all entries. Use the integer at opaque + + * VMStateField.size_indirect (subject to VMS_MULTIPLY) to determine * the size of each (and every) entry. */ VMS_VBUFFER =3D 0x100, =20 - /* Multiply the entry size given by the int32_t at opaque + - * VMStateField.size_offset (see VMS_VBUFFER description) with + /* + * Multiply the entry size given by the integer at opaque + + * VMStateField.size_indirect (see VMS_VBUFFER description) with * VMStateField.size to determine the number of bytes to be * allocated. Only valid in combination with VMS_VBUFFER. */ VMS_MULTIPLY =3D 0x200, =20 /* The field is an array of variable size. The uint8_t at opaque + - * VMStateField.num_offset + * VMStateField.num_indirect * contains the number of entries in the array. See the VMS_ARRAY * description regarding array handling in general. May not be * combined with VMS_ARRAY or any other VMS_VARRAY*. */ VMS_VARRAY_UINT8 =3D 0x400, =20 /* The field is an array of variable size. The uint32_t at opaque - * + VMStateField.num_offset + * + VMStateField.num_indirect * contains the number of entries in the array. See the VMS_ARRAY * description regarding array handling in general. May not be * combined with VMS_ARRAY or any other VMS_VARRAY*. */ @@ -187,29 +190,88 @@ typedef enum { MIG_PRI_MAX, } MigrationPriority; =20 + +/* + * VMStateStructMember: Metadata about a single member of the struct + * being migrated by the vmstate. This is kept separate from + * VMStateField because a single VMStateField can reference other + * members of the struct aside from the main struct member that's + * being migrated. + * + * One situation where extra fields are referenced is the common case + * of a struct containing an array or buffer, the size of which is + * stored in another member of the same struct. + * + * Example 1: + * struct IDEState { + * ... + * uint8_t *io_buffer; + * int32_t io_buffer_total_len; + * ... + * } + * VMSTATE_VARRAY_INT32(io_buffer, IDEState, io_buffer_total_len, 1, + * vmstate_info_uint8, uint8_t) + * + * In the above, io_buffer is the main field being migrated by the + * VMSTATE_VARRAY while io_buffer_total_len is the meta field that + * provides the size of the io_buffer. In this particular case, + * io_buffer_total_len is never migrated. + * + * Example 2: + * struct SpaprMachineState { + * ... + * uint32_t fdt_size; + * void *fdt_blob; + * ... + * } + * VMSTATE_UINT32(fdt_size, SpaprMachineState), + * VMSTATE_VBUFFER_ALLOC_UINT32(fdt_blob, SpaprMachineState, 0, NULL, fdt_= size), + * + * Here, fdt_blob is the field being migrated by VMSTATE_VBUFFER_ALLOC + * and fdt_size is the meta field providing the size. In this case, + * the extra field is also independently migrated by the + * VMSTATE_UINT32 above. + */ +struct VMStateStructMember { + /* offsetof the field inside the migrated struct */ + uint32_t offset; + /* size of field itself */ + uint8_t size; +}; + struct VMStateField { const char *name; size_t offset; =20 /* - * @size or @size_offset specifies the size of the element embeded in - * the field. Only one of them should be present never both. When - * @size_offset is used together with VMS_VBUFFER, it means the size is - * dynamic calculated instead of a constant. + * @size directly specifies the size of the element being + * migrated. * - * When the field is an array of any type, this stores the size of one - * element of the array. + * @size_indirect specifies the offset inside a struct where the + * size of the element is stored. * - * NOTE: even if VMS_POINTER or VMS_ARRAY_OF_POINTER may be specified, - * this parameter always reflects the real size of the objects that a - * pointer point to. + * Only one of the above should be present (except for + * VMSTATE_MULTIPLY which uses .size as a multiplier). When + * @size_indirect is used together with VMS_VBUFFER, it means + * the size is dynamic calculated instead of a constant. + * + * When the field is an array of any type, these refer to the size + * of one element of the array. + * + * NOTE: even if VMS_POINTER or VMS_ARRAY_OF_POINTER may be + * specified, these parameters always reflect the real size of the + * objects that a pointer point to. + * + * @num_indirect specifies the offset inside a struct where the + * number of elements of an array is stored. */ size_t size; - size_t size_offset; + VMStateStructMember size_indirect; + VMStateStructMember num_indirect; =20 size_t start; int num; - size_t num_offset; + const VMStateInfo *info; enum VMStateFlags flags; const VMStateDescription *vmsd; @@ -328,6 +390,17 @@ extern const VMStateInfo vmstate_info_g_byte_array; (type_check(t1, typeof_elt_of_field(t2, f)) \ + QEMU_BUILD_BUG_ON_ZERO(!QEMU_IS_ARRAY(((t2 *)0)->f))) =20 +#define type_check_int64(t) \ + (~((t)0) * sizeof(struct { \ + QEMU_BUILD_BUG_ON(sizeof(t) > sizeof(uint64_t)); \ + })) + +#define vmstate_field_offset(_state, _field) { \ + .offset =3D (offsetof(_state, _field) + \ + type_check_int64(typeof_field(_state, _field))), \ + .size =3D sizeof(typeof_field(_state, _field)), \ +} + #define vmstate_offset_value(_state, _field, _type) \ (offsetof(_state, _field) + \ type_check(_type, typeof_field(_state, _field))) @@ -463,7 +536,7 @@ extern const VMStateInfo vmstate_info_g_byte_array; #define VMSTATE_VARRAY_INT32(_field, _state, _field_num, _version, _info, = _type) {\ .name =3D (stringify(_field)), \ .version_id =3D (_version), \ - .num_offset =3D vmstate_offset_value(_state, _field_num, int32_t), \ + .num_indirect =3D vmstate_field_offset(_state, _field_num), \ .info =3D &(_info), \ .size =3D sizeof(_type), \ .flags =3D VMS_VARRAY_INT32|VMS_POINTER, \ @@ -473,7 +546,7 @@ extern const VMStateInfo vmstate_info_g_byte_array; #define VMSTATE_VARRAY_UINT32(_field, _state, _field_num, _version, _info,= _type) {\ .name =3D (stringify(_field)), \ .version_id =3D (_version), \ - .num_offset =3D vmstate_offset_value(_state, _field_num, uint32_t),\ + .num_indirect =3D vmstate_field_offset(_state, _field_num), \ .info =3D &(_info), \ .size =3D sizeof(_type), \ .flags =3D VMS_VARRAY_UINT32|VMS_POINTER, \ @@ -483,7 +556,7 @@ extern const VMStateInfo vmstate_info_g_byte_array; #define VMSTATE_VARRAY_INT32_ALLOC(_field, _state, _field_num, _version, _= info, _type) {\ .name =3D (stringify(_field)), \ .version_id =3D (_version), \ - .num_offset =3D vmstate_offset_value(_state, _field_num, int32_t), \ + .num_indirect =3D vmstate_field_offset(_state, _field_num), \ .info =3D &(_info), \ .size =3D sizeof(_type), \ .flags =3D VMS_VARRAY_INT32 | VMS_POINTER | VMS_ALLOC, \ @@ -493,7 +566,7 @@ extern const VMStateInfo vmstate_info_g_byte_array; #define VMSTATE_VARRAY_UINT32_ALLOC(_field, _state, _field_num, _version, = _info, _type) {\ .name =3D (stringify(_field)), \ .version_id =3D (_version), \ - .num_offset =3D vmstate_offset_value(_state, _field_num, uint32_t),\ + .num_indirect =3D vmstate_field_offset(_state, _field_num), \ .info =3D &(_info), \ .size =3D sizeof(_type), \ .flags =3D VMS_VARRAY_UINT32|VMS_POINTER|VMS_ALLOC, \ @@ -503,7 +576,7 @@ extern const VMStateInfo vmstate_info_g_byte_array; #define VMSTATE_VARRAY_UINT16_ALLOC(_field, _state, _field_num, _version, = _info, _type) {\ .name =3D (stringify(_field)), \ .version_id =3D (_version), \ - .num_offset =3D vmstate_offset_value(_state, _field_num, uint16_t),\ + .num_indirect =3D vmstate_field_offset(_state, _field_num), \ .info =3D &(_info), \ .size =3D sizeof(_type), \ .flags =3D VMS_VARRAY_UINT16 | VMS_POINTER | VMS_ALLOC, \ @@ -513,7 +586,7 @@ extern const VMStateInfo vmstate_info_g_byte_array; #define VMSTATE_VARRAY_UINT16_UNSAFE(_field, _state, _field_num, _version,= _info, _type) {\ .name =3D (stringify(_field)), \ .version_id =3D (_version), \ - .num_offset =3D vmstate_offset_value(_state, _field_num, uint16_t),\ + .num_indirect =3D vmstate_field_offset(_state, _field_num), \ .info =3D &(_info), \ .size =3D sizeof(_type), \ .flags =3D VMS_VARRAY_UINT16, \ @@ -592,7 +665,7 @@ extern const VMStateInfo vmstate_info_g_byte_array; _field, _state, _field_num, _version, _vmsd, _type) { \ .name =3D (stringify(_field)), \ .version_id =3D (_version), \ - .num_offset =3D vmstate_offset_value(_state, _field_num, uint8_t), \ + .num_indirect =3D vmstate_field_offset(_state, _field_num), \ .vmsd =3D &(_vmsd), \ .size =3D sizeof(_type), \ .flags =3D VMS_POINTER | VMS_VARRAY_UINT8 | \ @@ -605,7 +678,7 @@ extern const VMStateInfo vmstate_info_g_byte_array; _field, _state, _field_num, _version, _vmsd, _type) { \ .name =3D (stringify(_field)), \ .version_id =3D (_version), \ - .num_offset =3D vmstate_offset_value(_state, _field_num, uint32_t), \ + .num_indirect =3D vmstate_field_offset(_state, _field_num), \ .vmsd =3D &(_vmsd), \ .size =3D sizeof(_type), \ .flags =3D VMS_POINTER | VMS_VARRAY_UINT32 | \ @@ -617,7 +690,7 @@ extern const VMStateInfo vmstate_info_g_byte_array; #define VMSTATE_VARRAY_OF_POINTER_UINT32(_field, _state, _field_num, _vers= ion, _info, _type) { \ .name =3D (stringify(_field)), = \ .version_id =3D (_version), = \ - .num_offset =3D vmstate_offset_value(_state, _field_num, uint32_t), = \ + .num_indirect =3D vmstate_field_offset(_state, _field_num), = \ .info =3D &(_info), = \ .flags =3D VMS_VARRAY_UINT32 | VMS_ARRAY_OF_POINTER | VMS_POINTER= , \ .offset =3D vmstate_offset_pointer(_state, _field, _type *), = \ @@ -659,7 +732,7 @@ extern const VMStateInfo vmstate_info_g_byte_array; =20 #define VMSTATE_STRUCT_VARRAY_UINT8(_field, _state, _field_num, _version, = _vmsd, _type) { \ .name =3D (stringify(_field)), \ - .num_offset =3D vmstate_offset_value(_state, _field_num, uint8_t), \ + .num_indirect =3D vmstate_field_offset(_state, _field_num), \ .version_id =3D (_version), \ .vmsd =3D &(_vmsd), \ .size =3D sizeof(_type), \ @@ -683,7 +756,7 @@ extern const VMStateInfo vmstate_info_g_byte_array; #define VMSTATE_STRUCT_VARRAY_POINTER_INT32(_field, _state, _field_num, _v= msd, _type) { \ .name =3D (stringify(_field)), \ .version_id =3D 0, \ - .num_offset =3D vmstate_offset_value(_state, _field_num, int32_t), \ + .num_indirect =3D vmstate_field_offset(_state, _field_num), \ .size =3D sizeof(_type), \ .vmsd =3D &(_vmsd), \ .flags =3D VMS_POINTER | VMS_VARRAY_INT32 | VMS_STRUCT, \ @@ -693,7 +766,7 @@ extern const VMStateInfo vmstate_info_g_byte_array; #define VMSTATE_STRUCT_VARRAY_POINTER_UINT32(_field, _state, _field_num, _= vmsd, _type) { \ .name =3D (stringify(_field)), \ .version_id =3D 0, \ - .num_offset =3D vmstate_offset_value(_state, _field_num, uint32_t),\ + .num_indirect =3D vmstate_field_offset(_state, _field_num), \ .size =3D sizeof(_type), \ .vmsd =3D &(_vmsd), \ .flags =3D VMS_POINTER | VMS_VARRAY_INT32 | VMS_STRUCT, \ @@ -703,7 +776,7 @@ extern const VMStateInfo vmstate_info_g_byte_array; #define VMSTATE_STRUCT_VARRAY_POINTER_UINT16(_field, _state, _field_num, _= vmsd, _type) { \ .name =3D (stringify(_field)), \ .version_id =3D 0, \ - .num_offset =3D vmstate_offset_value(_state, _field_num, uint16_t),\ + .num_indirect =3D vmstate_field_offset(_state, _field_num), \ .size =3D sizeof(_type), \ .vmsd =3D &(_vmsd), \ .flags =3D VMS_POINTER | VMS_VARRAY_UINT16 | VMS_STRUCT, \ @@ -722,7 +795,7 @@ extern const VMStateInfo vmstate_info_g_byte_array; =20 #define VMSTATE_STRUCT_VARRAY_UINT32(_field, _state, _field_num, _version,= _vmsd, _type) { \ .name =3D (stringify(_field)), \ - .num_offset =3D vmstate_offset_value(_state, _field_num, uint32_t), \ + .num_indirect =3D vmstate_field_offset(_state, _field_num), \ .version_id =3D (_version), \ .vmsd =3D &(_vmsd), \ .size =3D sizeof(_type), \ @@ -734,7 +807,7 @@ extern const VMStateInfo vmstate_info_g_byte_array; .name =3D (stringify(_field)), \ .version_id =3D (_version), \ .vmsd =3D &(_vmsd), \ - .num_offset =3D vmstate_offset_value(_state, _field_num, int32_t), \ + .num_indirect =3D vmstate_field_offset(_state, _field_num), \ .size =3D sizeof(_type), \ .flags =3D VMS_STRUCT|VMS_VARRAY_INT32|VMS_ALLOC|VMS_POINTER, \ .offset =3D vmstate_offset_pointer(_state, _field, _type), \ @@ -755,7 +828,7 @@ extern const VMStateInfo vmstate_info_g_byte_array; .name =3D (stringify(_field)), \ .version_id =3D (_version), \ .field_exists =3D (_test), \ - .size_offset =3D vmstate_offset_value(_state, _field_size, uint32_t),\ + .size_indirect =3D vmstate_field_offset(_state, _field_size), \ .size =3D (_multiply), \ .info =3D &vmstate_info_buffer, \ .flags =3D VMS_VBUFFER|VMS_POINTER|VMS_MULTIPLY, \ @@ -766,7 +839,7 @@ extern const VMStateInfo vmstate_info_g_byte_array; .name =3D (stringify(_field)), \ .version_id =3D (_version), \ .field_exists =3D (_test), \ - .size_offset =3D vmstate_offset_value(_state, _field_size, int32_t),\ + .size_indirect =3D vmstate_field_offset(_state, _field_size), \ .info =3D &vmstate_info_buffer, \ .flags =3D VMS_VBUFFER|VMS_POINTER, \ .offset =3D offsetof(_state, _field), \ @@ -776,7 +849,7 @@ extern const VMStateInfo vmstate_info_g_byte_array; .name =3D (stringify(_field)), \ .version_id =3D (_version), \ .field_exists =3D (_test), \ - .size_offset =3D vmstate_offset_value(_state, _field_size, uint32_t),\ + .size_indirect =3D vmstate_field_offset(_state, _field_size), \ .info =3D &vmstate_info_buffer, \ .flags =3D VMS_VBUFFER|VMS_POINTER, \ .offset =3D offsetof(_state, _field), \ @@ -786,7 +859,7 @@ extern const VMStateInfo vmstate_info_g_byte_array; .name =3D (stringify(_field)), \ .version_id =3D (_version), \ .field_exists =3D (_test), \ - .size_offset =3D vmstate_offset_value(_state, _field_size, uint64_t),\ + .size_indirect =3D vmstate_field_offset(_state, _field_size), \ .info =3D &vmstate_info_buffer, \ .flags =3D VMS_VBUFFER | VMS_POINTER, \ .offset =3D offsetof(_state, _field), \ @@ -797,7 +870,7 @@ extern const VMStateInfo vmstate_info_g_byte_array; .name =3D (stringify(_field)), \ .version_id =3D (_version), \ .field_exists =3D (_test), \ - .size_offset =3D vmstate_offset_value(_state, _field_size, uint32_t),\ + .size_indirect =3D vmstate_field_offset(_state, _field_size), \ .info =3D &vmstate_info_buffer, \ .flags =3D VMS_VBUFFER|VMS_POINTER|VMS_ALLOC, \ .offset =3D offsetof(_state, _field), \ @@ -857,7 +930,7 @@ extern const VMStateInfo vmstate_info_g_byte_array; #define VMSTATE_UNUSED_VARRAY_UINT32(_state, _test, _version, _field_num, = _size) {\ .name =3D "unused", \ .field_exists =3D (_test), \ - .num_offset =3D vmstate_offset_value(_state, _field_num, uint32_t),\ + .num_indirect =3D vmstate_field_offset(_state, _field_num), \ .version_id =3D (_version), \ .size =3D (_size), \ .info =3D &vmstate_info_unused_buffer, \ @@ -871,7 +944,7 @@ extern const VMStateInfo vmstate_info_g_byte_array; .name =3D (stringify(_field)), \ .field_exists =3D (_test), \ .version_id =3D (_version), \ - .size_offset =3D vmstate_offset_value(_state, _field_size, int32_t),\ + .size_indirect =3D vmstate_field_offset(_state, _field_size), \ .info =3D &vmstate_info_bitmap, \ .flags =3D VMS_VBUFFER|VMS_POINTER, \ .offset =3D offsetof(_state, _field), \ diff --git a/migration/savevm.c b/migration/savevm.c index 34dd06f9f7..e1b707dda6 100644 --- a/migration/savevm.c +++ b/migration/savevm.c @@ -873,14 +873,14 @@ static void vmstate_check(const VMStateDescription *v= msd) * Size must be provided because dest QEMU needs that * info to know what to allocate */ - assert(field->size || field->size_offset); + assert(field->size !=3D 0 || field->size_indirect.size= !=3D 0); } else { /* * Otherwise size info isn't useful (because it's * always the size of host pointer), detect accidental * setup of sizes in this case. */ - assert(field->size =3D=3D 0 && field->size_offset =3D= =3D 0); + assert(field->size =3D=3D 0 && field->size_indirect.si= ze =3D=3D 0); } /* * VMS_ARRAY_OF_POINTER must be used only together with one diff --git a/migration/vmstate.c b/migration/vmstate.c index 50ebe37845..9f49abda24 100644 --- a/migration/vmstate.c +++ b/migration/vmstate.c @@ -78,32 +78,57 @@ vmsd_init_ptr_marker_field(VMStateField *fake, const VM= StateField *field) }; } =20 -static int vmstate_n_elems(void *opaque, const VMStateField *field) +static uint64_t vmstate_read_from_offset(const VMStateStructMember *member, + void *opaque) { - int n_elems =3D 1; + uint8_t *ptr =3D (uint8_t *)opaque + member->offset; + + switch (member->size) { + case 1: { + uint8_t v; + memcpy(&v, ptr, 1); + return v; + } + case 2: { + uint16_t v; + memcpy(&v, ptr, 2); + return v; + } + case 4: { + uint32_t v; + memcpy(&v, ptr, 4); + return v; + } + case 8: { + uint64_t v; + memcpy(&v, ptr, 8); + return v; + } + } + g_assert_not_reached(); +} + +static uint64_t vmstate_n_elems(void *opaque, const VMStateField *field) +{ + uint64_t n_elems =3D 1; =20 if (field->flags & VMS_ARRAY) { n_elems =3D field->num; - } else if (field->flags & VMS_VARRAY_INT32) { - n_elems =3D *(int32_t *)(opaque + field->num_offset); - } else if (field->flags & VMS_VARRAY_UINT32) { - n_elems =3D *(uint32_t *)(opaque + field->num_offset); - } else if (field->flags & VMS_VARRAY_UINT16) { - n_elems =3D *(uint16_t *)(opaque + field->num_offset); - } else if (field->flags & VMS_VARRAY_UINT8) { - n_elems =3D *(uint8_t *)(opaque + field->num_offset); + } else if (field->flags & (VMS_VARRAY_INT32 | VMS_VARRAY_UINT32 + | VMS_VARRAY_UINT16 | VMS_VARRAY_UINT8)) { + n_elems =3D vmstate_read_from_offset(&field->num_indirect, opaque); } =20 trace_vmstate_n_elems(field->name, n_elems); return n_elems; } =20 -static int vmstate_size(void *opaque, const VMStateField *field) +static uint64_t vmstate_size(void *opaque, const VMStateField *field) { - int size; + uint64_t size; =20 if (field->flags & VMS_VBUFFER) { - size =3D *(int32_t *)(opaque + field->size_offset); + size =3D vmstate_read_from_offset(&field->size_indirect, opaque); if (field->flags & VMS_MULTIPLY) { size *=3D field->size; } @@ -124,7 +149,7 @@ static void vmstate_handle_alloc(void *ptr, const VMSta= teField *field, void *opaque) { if (field->flags & VMS_POINTER && field->flags & VMS_ALLOC) { - gsize size =3D vmstate_size(opaque, field); + uint64_t size =3D vmstate_size(opaque, field); size *=3D vmstate_n_elems(opaque, field); if (size) { *(void **)ptr =3D g_malloc(size); @@ -335,8 +360,9 @@ bool vmstate_load_vmsd(QEMUFile *f, const VMStateDescri= ption *vmsd, =20 if (exists) { void *first_elem =3D opaque + field->offset; - int i, n_elems =3D vmstate_n_elems(opaque, field); - int size =3D vmstate_size(opaque, field); + int i; + uint64_t n_elems =3D vmstate_n_elems(opaque, field); + uint64_t size =3D vmstate_size(opaque, field); =20 vmstate_handle_alloc(first_elem, field, opaque); if (field->flags & VMS_POINTER) { @@ -650,8 +676,9 @@ static bool vmstate_save_vmsd_v(QEMUFile *f, const VMSt= ateDescription *vmsd, while (field->name) { if (vmstate_field_exists(vmsd, field, opaque, version_id)) { void *first_elem =3D opaque + field->offset; - int i, n_elems =3D vmstate_n_elems(opaque, field); - int size =3D vmstate_size(opaque, field); + int i; + uint64_t n_elems =3D vmstate_n_elems(opaque, field); + uint64_t size =3D vmstate_size(opaque, field); JSONWriter *vmdesc_loop =3D vmdesc; bool is_prev_null =3D false; /* diff --git a/rust/bindings/migration-sys/lib.rs b/rust/bindings/migration-s= ys/lib.rs index 9581481e42..baa2730ca9 100644 --- a/rust/bindings/migration-sys/lib.rs +++ b/rust/bindings/migration-sys/lib.rs @@ -47,6 +47,7 @@ fn default() -> Self { unsafe impl Zeroable for VMStateFlags {} unsafe impl Zeroable for VMStateField {} unsafe impl Zeroable for VMStateDescription {} +unsafe impl Zeroable for VMStateStructMember {} =20 // The following higher-level helpers could be in "migration" // crate when Rust has const trait impl. @@ -115,3 +116,12 @@ pub const fn with_varray_flag(mut self, flag: VMStateF= lags) -> Self { self.with_varray_flag_unchecked(flag) } } + +impl VMStateStructMember { + pub const fn new(off: usize, size: usize) -> Self { + Self { + offset: off as u32, + size: size as u8, + } + } +} diff --git a/rust/migration/src/vmstate.rs b/rust/migration/src/vmstate.rs index 63d78b4f27..e60c0860cc 100644 --- a/rust/migration/src/vmstate.rs +++ b/rust/migration/src/vmstate.rs @@ -42,7 +42,7 @@ }; =20 use crate::bindings::{self, VMStateFlags}; -pub use crate::bindings::{MigrationPriority, VMStateField}; +pub use crate::bindings::{MigrationPriority, VMStateField, VMStateStructMe= mber}; =20 /// This macro is used to call a function with a generic argument bound /// to the type of a field. The function must take a @@ -120,6 +120,23 @@ pub const fn vmstate_varray_flag(_: Phanto= mData) -> VMStateFlags T::VARRAY_FLAG } =20 +pub const OPAQUE: &[u8; 1048576] =3D &[0; 1048576]; + +pub const fn size_of_ptr_type(_: *const T) -> usize { + ::core::mem::size_of::() +} + +#[macro_export] +macro_rules! size_of_field_type { + ($struct_name:ty, $($field_name:ident).+) =3D> { + $crate::vmstate::size_of_ptr_type(unsafe { + ::core::ptr::addr_of!( + (*$crate::vmstate::OPAQUE.as_ptr().cast::<$struct_name>())= .$($field_name).+ + ) + }) + }; +} + /// Return the `VMStateField` for a field of a struct. The field must be /// visible in the current scope. /// @@ -148,7 +165,10 @@ macro_rules! vmstate_of { .as_bytes() .as_ptr().cast::<::std::os::raw::c_char>(), offset: ::std::mem::offset_of!($struct_name, $($field_name).+), - $(num_offset: ::std::mem::offset_of!($struct_name, $($num).+),= )? + $(num_indirect: $crate::vmstate::VMStateStructMember { + offset: ::std::mem::offset_of!($struct_name, $($num).+) as= u32, + size: $crate::size_of_field_type!($struct_name, $($num).+) as u8, + },)? $(field_exists: $crate::vmstate_exist_fn!($struct_name, $test_= fn),)? // The calls to `call_func_with_field!` are the magic that // computes most of the VMStateField from the type of the fiel= d. diff --git a/rust/tests/tests/vmstate_tests.rs b/rust/tests/tests/vmstate_t= ests.rs index c2c12cfab5..c002ffb2bc 100644 --- a/rust/tests/tests/vmstate_tests.rs +++ b/rust/tests/tests/vmstate_tests.rs @@ -65,7 +65,7 @@ fn test_vmstate_uint16() { b"elem\0" ); assert_eq!(foo_fields[0].offset, 16); - assert_eq!(foo_fields[0].num_offset, 0); + assert_eq!(foo_fields[0].num_indirect.size, 0); assert_eq!(foo_fields[0].info, unsafe { &vmstate_info_int8 }); assert_eq!(foo_fields[0].version_id, 0); assert_eq!(foo_fields[0].size, 1); @@ -86,7 +86,7 @@ fn test_vmstate_unused() { b"unused\0" ); assert_eq!(foo_fields[1].offset, 0); - assert_eq!(foo_fields[1].num_offset, 0); + assert_eq!(foo_fields[1].num_indirect.size, 0); assert_eq!(foo_fields[1].info, unsafe { &vmstate_info_unused_buffer }); assert_eq!(foo_fields[1].version_id, 0); assert_eq!(foo_fields[1].size, 8); @@ -108,7 +108,7 @@ fn test_vmstate_varray_uint16_unsafe() { b"arr\0" ); assert_eq!(foo_fields[2].offset, 0); - assert_eq!(foo_fields[2].num_offset, 4); + assert_eq!(foo_fields[2].num_indirect.offset, 4); assert_eq!(foo_fields[2].info, unsafe { &vmstate_info_uint8 }); assert_eq!(foo_fields[2].version_id, 0); assert_eq!(foo_fields[2].size, 1); @@ -172,7 +172,7 @@ fn test_vmstate_bool_v() { b"val\0" ); assert_eq!(foo_fields[0].offset, 136); - assert_eq!(foo_fields[0].num_offset, 0); + assert_eq!(foo_fields[0].num_indirect.size, 0); assert_eq!(foo_fields[0].info, unsafe { &vmstate_info_bool }); assert_eq!(foo_fields[0].version_id, 2); assert_eq!(foo_fields[0].size, 1); @@ -193,7 +193,7 @@ fn test_vmstate_uint64() { b"wrap\0" ); assert_eq!(foo_fields[1].offset, 128); - assert_eq!(foo_fields[1].num_offset, 0); + assert_eq!(foo_fields[1].num_indirect.size, 0); assert_eq!(foo_fields[1].info, unsafe { &vmstate_info_uint64 }); assert_eq!(foo_fields[1].version_id, 0); assert_eq!(foo_fields[1].size, 8); @@ -215,7 +215,7 @@ fn test_vmstate_struct_varray_uint8() { b"arr_a\0" ); assert_eq!(foo_fields[2].offset, 0); - assert_eq!(foo_fields[2].num_offset, 60); + assert_eq!(foo_fields[2].num_indirect.offset, 60); assert!(foo_fields[2].info.is_null()); // VMSTATE_STRUCT_VARRAY_UINT8 = doesn't set info field. assert_eq!(foo_fields[2].version_id, 1); assert_eq!(foo_fields[2].size, 20); @@ -240,7 +240,7 @@ fn test_vmstate_macro_array() { b"arr_i64\0" ); assert_eq!(foo_fields[4].offset, 144); - assert_eq!(foo_fields[4].num_offset, 0); + assert_eq!(foo_fields[4].num_indirect.size, 0); assert_eq!(foo_fields[4].info, unsafe { &vmstate_info_int64 }); assert_eq!(foo_fields[4].version_id, 0); assert_eq!(foo_fields[4].size, 8); @@ -264,7 +264,7 @@ fn test_vmstate_struct_varray_uint8_wrapper() { unsafe { CStr::from_ptr(foo_fields[5].name) }.to_bytes_with_nul(), b"arr_a_wrap\0" ); - assert_eq!(foo_fields[5].num_offset, 228); + assert_eq!(foo_fields[5].num_indirect.offset, 228); assert!(unsafe { foo_fields[5].field_exists.unwrap()(foo_b_p, 0) }); =20 // The last VMStateField in VMSTATE_FOOB. @@ -316,7 +316,7 @@ fn test_vmstate_pointer() { b"ptr\0" ); assert_eq!(foo_fields[0].offset, 0); - assert_eq!(foo_fields[0].num_offset, 0); + assert_eq!(foo_fields[0].num_indirect.size, 0); assert_eq!(foo_fields[0].info, unsafe { &vmstate_info_int32 }); assert_eq!(foo_fields[0].version_id, 2); assert_eq!(foo_fields[0].size, 4); @@ -341,7 +341,7 @@ fn test_vmstate_struct_pointer() { b"ptr_a\0" ); assert_eq!(foo_fields[1].offset, PTR_SIZE); - assert_eq!(foo_fields[1].num_offset, 0); + assert_eq!(foo_fields[1].num_indirect.size, 0); assert_eq!(foo_fields[1].vmsd, VMSTATE_FOOA.as_ref()); assert_eq!(foo_fields[1].version_id, 0); assert_eq!(foo_fields[1].size, size_of::()); @@ -366,7 +366,7 @@ fn test_vmstate_macro_array_of_pointer() { b"arr_ptr\0" ); assert_eq!(foo_fields[2].offset, 2 * PTR_SIZE); - assert_eq!(foo_fields[2].num_offset, 0); + assert_eq!(foo_fields[2].num_indirect.size, 0); assert_eq!(foo_fields[2].info, unsafe { &vmstate_info_uint8 }); assert_eq!(foo_fields[2].version_id, 0); assert_eq!(foo_fields[2].size, PTR_SIZE); @@ -391,7 +391,7 @@ fn test_vmstate_macro_array_of_pointer_wrapped() { b"arr_ptr_wrap\0" ); assert_eq!(foo_fields[3].offset, (FOO_ARRAY_MAX + 2) * PTR_SIZE); - assert_eq!(foo_fields[3].num_offset, 0); + assert_eq!(foo_fields[3].num_indirect.size, 0); assert_eq!(foo_fields[3].info, unsafe { &vmstate_info_uint8 }); assert_eq!(foo_fields[3].version_id, 0); assert_eq!(foo_fields[3].size, PTR_SIZE); @@ -454,7 +454,7 @@ fn test_vmstate_validate() { b"foo_d_0\0" ); assert_eq!(foo_fields[0].offset, 0); - assert_eq!(foo_fields[0].num_offset, 0); + assert_eq!(foo_fields[0].num_indirect.size, 0); assert!(foo_fields[0].info.is_null()); assert_eq!(foo_fields[0].version_id, 0); assert_eq!(foo_fields[0].size, 0); --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269524; cv=none; d=zohomail.com; s=zohoarc; b=WjTc+NRZgJsTjRYtvPGn3fHGHVLrLjQwcn0qgXHCBGOyJNR8T0jEDLgOYAfm+1o9EyZNLnqWVGiwrdP7hsGp27Jw5z1w93PHyf5yNuuThyWYGdhVFye5I/k3D1drRedYxroBhKM75jJRnlj6+X26XRYxFggFSAs+Hnu02rT8qoo= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269524; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=b+UXOGYg9Np205ayO/XwX+RZOtNtRd/4RXkS8DKsQf0=; b=bz8pGFFWLPvTO2SdDXBD+KvgOlbcE0WHQNSBN+AZEHj0pbKRrzYayBqlMdob2ZgBnvLjD+N2cawKw+iIxkoXofyDVu7X0ubq75TyXFfUEts0ridcZXEWl5RGSwa3fJXZ62xy55E+uRP6KiFL2pyml6b4+uLv62xaAX97CE2HnoQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269524767618.6227728148826; Sat, 17 Oct 2026 13:38:44 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB27-00080I-Ah; Sat, 17 Oct 2026 16:29:39 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB1F-0006Qq-UT; Sat, 17 Oct 2026 16:28:46 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB1E-00040A-16; Sat, 17 Oct 2026 16:28:41 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 82F4B1DE752; Sat, 17 Oct 2026 23:27:26 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id C4FDF443428; Sat, 17 Oct 2026 23:27:25 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268846; bh=/ILOQd/M8FwF35Uq6itv0TONqfJkBHBNThJfrD3Mu+8=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=RsDLNFeTQ9cNLArg5Ajg/id9j5o+9Eq1yXSq6wiFlNJVJlO/yDf/neKUoU61moX9A G/N6fuzifp4UVzwKoj/CZESB5pjnyOFPU6hYV/UHd4yJzY1oEO6N5v+GPYm14ZmA5D exDVuDCQ9lMWedSGZctI6Lgc0KSlwLTBQ1E1tD9texxhDhxgv7hbLXO6OJ05yOEcyr EUYOMHE4+1PmMLppNGvRa2PLzrXVcK5PMkmq6bHcZQaocK1diff5EocUwPrHearp1F 8cxS/vH1cKv7iZxrfSC1bWvbt1YVWiOvbEvchp2oV8Xv0p5SSwKphbMzMluX0/G/0v pCP6iOBmDUwJw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Andrey Drobyshev , =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , Michael Tokarev Subject: [Stable-11.1.3 22/73] hw/display/qxl: factor out qxl_guest_phys2virt() Date: Sat, 17 Oct 2026 23:25:40 +0300 Message-ID: <20261017202638.728621-22-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269525227158500 From: Andrey Drobyshev Split the GROUP_GUEST half of qxl_phys2virt() into the helper qxl_guest_phys2virt(). Also add a bool 'report_bug' param to the qxl_get_check_slot_offset() called from it: when it's false, a failing check just returns false without calling qxl_set_guest_bug(). All existing callers pass true, so there's no functional change. This is in preparation for a quiet caller that validates guest addresses which might be legitimately stale, when flagging a guest bug would be wrong. Message-ID: <20260825172051.435372-2-andrey.drobyshev@virtuozzo.com> Reviewed-by: Marc-Andr=C3=A9 Lureau Signed-off-by: Andrey Drobyshev (cherry picked from commit 050f5408bfcff56a65aed6d9ab81e35f4ba82631) Signed-off-by: Michael Tokarev diff --git a/hw/display/qxl.c b/hw/display/qxl.c index c4f547e88b..b6bc182fc2 100644 --- a/hw/display/qxl.c +++ b/hw/display/qxl.c @@ -1409,7 +1409,7 @@ static void qxl_reset_surfaces(PCIQXLDevice *d) /* can be also called from spice server thread context */ static bool qxl_get_check_slot_offset(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, uint32_t *s, uint64_t *o, - size_t size_requested) + size_t size_requested, bool report_b= ug) { uint64_t phys =3D le64_to_cpu(pqxl); uint32_t slot =3D (phys >> (64 - 8)) & 0xff; @@ -1417,42 +1417,55 @@ static bool qxl_get_check_slot_offset(PCIQXLDevice = *qxl, QXLPHYSICAL pqxl, uint64_t size_available; =20 if (slot >=3D NUM_MEMSLOTS) { - qxl_set_guest_bug(qxl, "slot too large %d >=3D %d", slot, - NUM_MEMSLOTS); + if (report_bug) { + qxl_set_guest_bug(qxl, "slot too large %d >=3D %d", slot, + NUM_MEMSLOTS); + } return false; } if (!qxl->guest_slots[slot].active) { - qxl_set_guest_bug(qxl, "inactive slot %d\n", slot); + if (report_bug) { + qxl_set_guest_bug(qxl, "inactive slot %d\n", slot); + } return false; } if (offset < qxl->guest_slots[slot].delta) { - qxl_set_guest_bug(qxl, - "slot %d offset %"PRIu64" < delta %"PRIu64"\n", - slot, offset, qxl->guest_slots[slot].delta); + if (report_bug) { + qxl_set_guest_bug(qxl, + "slot %d offset %"PRIu64" < delta %"PRIu64"\= n", + slot, offset, qxl->guest_slots[slot].delta); + } return false; } offset -=3D qxl->guest_slots[slot].delta; if (offset > qxl->guest_slots[slot].size) { - qxl_set_guest_bug(qxl, - "slot %d offset %"PRIu64" > size %"PRIu64"\n", - slot, offset, qxl->guest_slots[slot].size); + if (report_bug) { + qxl_set_guest_bug(qxl, + "slot %d offset %"PRIu64" > size %"PRIu64"\n= ", + slot, offset, qxl->guest_slots[slot].size); + } return false; } size_available =3D memory_region_size(qxl->guest_slots[slot].mr); if (qxl->guest_slots[slot].offset + offset >=3D size_available) { - qxl_set_guest_bug(qxl, - "slot %d offset %"PRIu64" > region size %"PRIu64= "\n", - slot, qxl->guest_slots[slot].offset + offset, - size_available); + if (report_bug) { + qxl_set_guest_bug(qxl, + "slot %d offset %"PRIu64" > region size %"PR= Iu64 + "\n", slot, + qxl->guest_slots[slot].offset + offset, + size_available); + } return false; } size_available -=3D qxl->guest_slots[slot].offset + offset; if (size_requested > size_available) { - qxl_set_guest_bug(qxl, - "slot %d offset %"PRIu64" size %zu: " - "overrun by %"PRIu64" bytes\n", - slot, offset, size_requested, - size_requested - size_available); + if (report_bug) { + qxl_set_guest_bug(qxl, + "slot %d offset %"PRIu64" size %zu: " + "overrun by %"PRIu64" bytes\n", + slot, offset, size_requested, + size_requested - size_available); + } return false; } =20 @@ -1462,25 +1475,31 @@ static bool qxl_get_check_slot_offset(PCIQXLDevice = *qxl, QXLPHYSICAL pqxl, } =20 /* can be also called from spice server thread context */ -void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, int group_id, - size_t size) +static void *qxl_guest_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, + size_t size, bool report_bug) { uint64_t offset; uint32_t slot; - void *ptr; + uint8_t *ptr; =20 + if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset, size, + report_bug)) { + return NULL; + } + ptr =3D memory_region_get_ram_ptr(qxl->guest_slots[slot].mr); + ptr +=3D qxl->guest_slots[slot].offset; + ptr +=3D offset; + return ptr; +} + +void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, int group_id, + size_t size) +{ switch (group_id) { case MEMSLOT_GROUP_HOST: - offset =3D le64_to_cpu(pqxl) & 0xffffffffffff; - return (void *)(intptr_t)offset; + return (void *)(intptr_t)(le64_to_cpu(pqxl) & 0xffffffffffff); case MEMSLOT_GROUP_GUEST: - if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset, size)) { - return NULL; - } - ptr =3D memory_region_get_ram_ptr(qxl->guest_slots[slot].mr); - ptr +=3D qxl->guest_slots[slot].offset; - ptr +=3D offset; - return ptr; + return qxl_guest_phys2virt(qxl, pqxl, size, true); } return NULL; } @@ -2003,7 +2022,7 @@ static void qxl_dirty_one_surface(PCIQXLDevice *qxl, = QXLPHYSICAL pqxl, bool rc; =20 size =3D (uint64_t)height * abs(stride); - rc =3D qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset, size); + rc =3D qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset, size, true= ); assert(rc =3D=3D true); trace_qxl_surfaces_dirty(qxl->id, offset, size); qxl_set_dirty(qxl->guest_slots[slot].mr, --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269460; cv=none; d=zohomail.com; s=zohoarc; b=mB6tyju8Ew2Ea7BtjhmdpGkQ+a+O2KCY/5CjK0Z9TtVpdgg1xOHgd/Y+nezznhyUd50c9bD0fxZ8mtfdHtk2ofFJWfJ1y/yOt3SMQoXUur9vIkvOUN1bid8YZhhj6q+Tm1FxdfpWcNbjdHm7kwoQGQ4Sos5cfe4YFsmCCAHiHnQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269460; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=QYC3b4kaGpaTs5HX0Wd6pj3m+1S2pR3ia1mKZH2eNJ8=; b=Rxjnhmzm22VJWfvVUM/kFIsu6LvMKCoY5OrBFzezQRCAgQzT0wS7kDgCQj6RZHmcnThApw6KpjodlovW/5dqStj0lHhj76l641ic6cJt9tabXI+++LIpUL8wLKbPlu/KQY6nRkL4Au90e6d2DK6SM/R9kuVB7xCuzruSbIdAtnA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269460843840.7879507341506; Sat, 17 Oct 2026 13:37:40 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB2R-0008Oz-Sr; Sat, 17 Oct 2026 16:29:56 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB1L-0006Si-RH; Sat, 17 Oct 2026 16:28:52 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB1J-00040N-4W; Sat, 17 Oct 2026 16:28:47 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 703B11DE753; Sat, 17 Oct 2026 23:27:27 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id B4724443429; Sat, 17 Oct 2026 23:27:26 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268847; bh=90l4FSbKSxO4aioR3FVx5nKY+NaGJtqLHUMex6TowdM=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=sNOu+OTCh9arLlvM0T0jfJ9WXMpVKlpks0nneZS8EvGPk46Sy+ndGrk/5m+Rt2GWl Ii1//fQ5sHtFiXuSr7nCSJthYrzNEwK1Cr5PN41OQUQdukMUktgd+fCSkHH9P1q+GO Y1xBTikmUOipzOdx8fscAWCS0WqHcJDX+hMYNXU/UCHDCsH9eUyqv4y6xQH7rS4ezL pinWOhYdaWaxtl7oP36t/Cx0JwWQJAzmrXfzIFTqD8xM+X9qLjDW2/oRobm28oEcXU TWmj4mEQUOqzN4ZcZjq5Lak3grEf6aSi6if6kGivp6AfH/ivBbxS7vooaqe3X3dTow /MA8mh9n7UxRg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Andrey Drobyshev , =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , Michael Tokarev Subject: [Stable-11.1.3 23/73] hw/display/qxl: validate replayed commands in qxl_post_load Date: Sat, 17 Oct 2026 23:25:41 +0300 Message-ID: <20261017202638.728621-23-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269461943158500 From: Andrey Drobyshev On incoming migration qxl_post_load() replays the tracked cursor and surface commands by handing their guest addresses straight to spice, without revalidating them. Those addresses were checked when the guest submitted them, but the guest may have freed or reused that memory before migration, so qxl's tracked pointer can be stale. spice-server then re-parses the command from that memory and, for a stale cursor, reads a garbage shape pointer -- aborting the target in memslot_get_virt() (again, spice-server function) and failing the migration. Validate each replayed command with qxl_guest_phys2virt(report_bug=3Dfalse) before adding it to the replay list, and for a cursor also validate the nested shape pointer. Commands that no longer resolve are skipped rather than replayed. report_bug is false so a stale pointer is not mistaken for a live guest error, which would needlessly disable a healthy guest's display. Message-ID: <20260825172051.435372-3-andrey.drobyshev@virtuozzo.com> Reviewed-by: Marc-Andr=C3=A9 Lureau Signed-off-by: Andrey Drobyshev (cherry picked from commit 95bc45193bbebcb11a45fa40c5642712cd4401bc) Signed-off-by: Michael Tokarev diff --git a/hw/display/qxl.c b/hw/display/qxl.c index b6bc182fc2..fb77f217b1 100644 --- a/hw/display/qxl.c +++ b/hw/display/qxl.c @@ -2390,6 +2390,37 @@ static void qxl_create_memslots(PCIQXLDevice *d) } } =20 +/* + * Validate a command tracked for loadvm replay before handing its guest + * address to spice-server. + */ +static bool qxl_loadvm_cmd_valid(PCIQXLDevice *d, QXLPHYSICAL data, + uint32_t type) +{ + switch (type) { + case QXL_CMD_SURFACE: + return qxl_guest_phys2virt(d, data, + sizeof(QXLSurfaceCmd), false) !=3D NULL; + + case QXL_CMD_CURSOR: { + QXLCursorCmd *cmd =3D qxl_guest_phys2virt(d, data, sizeof(QXLCurso= rCmd), + false); + + if (!cmd) { + return false; + } + if (le32_to_cpu(cmd->type) =3D=3D QXL_CURSOR_SET) { + return qxl_guest_phys2virt(d, le64_to_cpu(cmd->u.set.shape), + sizeof(QXLCursor), false) !=3D NULL; + } + return true; + } + + default: + g_assert_not_reached(); + } +} + static int qxl_post_load(void *opaque, int version) { PCIQXLDevice* d =3D opaque; @@ -2428,12 +2459,17 @@ static int qxl_post_load(void *opaque, int version) if (d->guest_surfaces.cmds[in] =3D=3D 0) { continue; } + if (!qxl_loadvm_cmd_valid(d, d->guest_surfaces.cmds[in], + QXL_CMD_SURFACE)) { + continue; + } cmds[out].cmd.data =3D d->guest_surfaces.cmds[in]; cmds[out].cmd.type =3D QXL_CMD_SURFACE; cmds[out].group_id =3D MEMSLOT_GROUP_GUEST; out++; } - if (d->guest_cursor) { + if (d->guest_cursor && + qxl_loadvm_cmd_valid(d, d->guest_cursor, QXL_CMD_CURSOR)) { cmds[out].cmd.data =3D d->guest_cursor; cmds[out].cmd.type =3D QXL_CMD_CURSOR; cmds[out].group_id =3D MEMSLOT_GROUP_GUEST; --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269365; cv=none; d=zohomail.com; s=zohoarc; b=bCEIFC56yYmg9z8hK0/GllR3BR0bhQ3lyhMWfbuCOK1C86x/0aN1maR2UILqxU2J90wRWjEHZL42COSdQSyAOfBW7nhCE8a/n7sQvWxgHR4TJzsh7rGTbBCHrOl+W1K2B5Jljr3GctoYn5aVLilriJXOZm9ZjnT9ikJEIMEznlo= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269365; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=mnfpbYVPSiNW53vdTBgBOL3inoeU+Ahkny+Im79PM1Y=; b=C73/RBk1ILf+S5NxMyctaEU3TI4dqj0efZBrh4vUkIwOQBvsr+IS6fLLN8bGxqY244Zly9iYtPVpCUSo1UtM5OW0CD88+5LAr1QzFeyxPMWCwAtVetJnbQcbSCxlE7ydUGPpv29TBZpaNLDlY2+PbGXEpMkce7sD0oxrEmY99TQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269365363777.388907225943; Sat, 17 Oct 2026 13:36:05 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB2X-0000a8-Da; Sat, 17 Oct 2026 16:30:01 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB1g-0006cC-4x; Sat, 17 Oct 2026 16:29:11 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB1e-00040Y-I7; Sat, 17 Oct 2026 16:29:07 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id A2B3A1DE754; Sat, 17 Oct 2026 23:27:28 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id A0DAF44342A; Sat, 17 Oct 2026 23:27:27 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268848; bh=1zHwW4WwoHU5qLd69mI83pMRaWYA96zbDsVK4o30ErU=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=sR+VLy1gV8oRb1UPo0aw0G/i9eqhzJm8TlL3cXQCSbQuklLflyRqJEZglhI1gUgdi 6ejEwWlICes3m786lsjOP68/I9h4CHQL2gYAVZ8RuQhJxV2GO5aNMoxz3U979qmq30 FL3CmJ0SeJgZFjHuY7icxyaKJ1C1BHhyH3n7TjfthvxmYsRHs+9I6PkSGwzvNKDATV 7vshaJymVK1n0s9zStxSNjDitWR8J5STz03ADIRWMU46SVqysB6vK53R8QUKIj0Atk +ZRftmHUQ2Ubr2uSYuur3Rw8Hs65WvhFYMEtZRtgX4ZMZmyZaWcpQKGlbQhVB/Y5z+ 4ykGgImuOKu5Q== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Andrey Drobyshev , =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , Michael Tokarev Subject: [Stable-11.1.3 24/73] hw/display/qxl: trace skipped stale loadvm commands Date: Sat, 17 Oct 2026 23:25:42 +0300 Message-ID: <20261017202638.728621-24-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269367257158500 From: Andrey Drobyshev Emit a trace event when qxl_post_load() drops a cursor or surface command whose guest address no longer resolves, so a migration that lands on a stale tracked pointer is visible instead of silent. Message-ID: <20260825172051.435372-4-andrey.drobyshev@virtuozzo.com> Reviewed-by: Marc-Andr=C3=A9 Lureau Signed-off-by: Andrey Drobyshev (cherry picked from commit 7e429d3624c4ad911af533e2f8f914b12f36dadc) Signed-off-by: Michael Tokarev diff --git a/hw/display/qxl.c b/hw/display/qxl.c index fb77f217b1..d5f9771f5a 100644 --- a/hw/display/qxl.c +++ b/hw/display/qxl.c @@ -2461,6 +2461,8 @@ static int qxl_post_load(void *opaque, int version) } if (!qxl_loadvm_cmd_valid(d, d->guest_surfaces.cmds[in], QXL_CMD_SURFACE)) { + trace_qxl_post_load_stale_cmd(d->id, "surface", + d->guest_surfaces.cmds[in]); continue; } cmds[out].cmd.data =3D d->guest_surfaces.cmds[in]; @@ -2468,12 +2470,15 @@ static int qxl_post_load(void *opaque, int version) cmds[out].group_id =3D MEMSLOT_GROUP_GUEST; out++; } - if (d->guest_cursor && - qxl_loadvm_cmd_valid(d, d->guest_cursor, QXL_CMD_CURSOR)) { - cmds[out].cmd.data =3D d->guest_cursor; - cmds[out].cmd.type =3D QXL_CMD_CURSOR; - cmds[out].group_id =3D MEMSLOT_GROUP_GUEST; - out++; + if (d->guest_cursor) { + if (qxl_loadvm_cmd_valid(d, d->guest_cursor, QXL_CMD_CURSOR)) { + cmds[out].cmd.data =3D d->guest_cursor; + cmds[out].cmd.type =3D QXL_CMD_CURSOR; + cmds[out].group_id =3D MEMSLOT_GROUP_GUEST; + out++; + } else { + trace_qxl_post_load_stale_cmd(d->id, "cursor", d->guest_cu= rsor); + } } qxl_spice_loadvm_commands(d, cmds, out); g_free(cmds); diff --git a/hw/display/trace-events b/hw/display/trace-events index 4bfc457fba..c5e7e42af2 100644 --- a/hw/display/trace-events +++ b/hw/display/trace-events @@ -82,6 +82,7 @@ qxl_io_unexpected_vga_mode(int qid, uint64_t addr, uint64= _t val, const char *des qxl_io_write(int qid, const char *mode, uint64_t addr, const char *aname, = uint64_t val, unsigned size, int async) "%d %s addr=3D%"PRIu64 " (%s) val= =3D%"PRIu64" size=3D%u async=3D%d" qxl_memslot_add_guest(int qid, uint32_t slot_id, uint64_t guest_start, uin= t64_t guest_end) "%d %u: guest phys 0x%"PRIx64 " - 0x%" PRIx64 qxl_post_load(int qid, const char *mode) "%d %s" +qxl_post_load_stale_cmd(int qid, const char *kind, uint64_t data) "%d skip= stale %s cmd 0x%"PRIx64 qxl_pre_load(int qid) "%d" qxl_pre_save(int qid) "%d" qxl_reset_surfaces(int qid) "%d" --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269193; cv=none; d=zohomail.com; s=zohoarc; b=i2GZNhcD4mQXAfASVMH7jJhAt7gScyILqwKOdbo7SXdUFWh//P040PfxfP6opBywLQRn3LbQV8pOiKt+/Lo7l6JhAPJ6T57jfmkFOlKpSo23IokSlFZoc1VtFA2Qb3JegiziVBPKhG6x8tU66DcxqOCimYdieMnAXuMAfUAA+Co= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269193; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=eGpsSGG9j4Jg1h5lntTLivs8SSU9zIQX/AcseLQWmlQ=; b=WO9lhmfbXjA2BXjf489i578f7/cRBnDTJx2/7cvqgBxetnqx4/acAplPMNa2CYcxmvxHq5+Tsn6UUXLbJhkNYOlhFlc8WXquHcCL7SsWa8A7Bqh/tBJsgpc9t/fO3pGPl/E5Y+T4t4hvJs/b1JfYSHfkVpaX8FQroSXIe6XlUHg= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269193561523.6260449336851; Sat, 17 Oct 2026 13:33:13 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB2V-0000Oe-FM; Sat, 17 Oct 2026 16:29:59 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB1n-0006hG-7Y; Sat, 17 Oct 2026 16:29:15 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB1i-00041E-FW; Sat, 17 Oct 2026 16:29:13 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id D3CC81DE755; Sat, 17 Oct 2026 23:27:29 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id D4AF844342B; Sat, 17 Oct 2026 23:27:28 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268849; bh=lVz8zWps2N/zWKLDoW+1L3mbLfbs78tIwDnPGFwcXi8=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=NUj4rhEsStcYQqFDXdodR5tV3NwtIbP7VTDgZCvTRgA/anu5GiHV1FJfX3Bzei7Cr kXAxET2UW95nY8QfrHKTTNksUAvhnl8icoJeLURWq1q0ClQFtirMs7IYcBu7rmPl30 jrrIeanLk80gcDozlIxhxJSTLjEBHgFhGqwhvSAbeSrdVxo7inTDu1l7jXixfygehm dhMYgu5BX0VZu5mmBNtqvtXUNHL+ZYwgqsPinGRX4IrgpQPAP8uaiQl0FnCDEPVaoX 7fQ96Zm0MdDGH3B1lrOF8B2sjwaI5DxlmSMZO9+jC+0p4GTxz9ffl4y3gA1aEb1xJz CUudF0+h/5bZA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, "Denis V. Lunev" , Eric Blake , Vladimir Sementsov-Ogievskiy , Michael Tokarev Subject: [Stable-11.1.3 25/73] block/nbd: clear reply.cookie when the reply is rejected Date: Sat, 17 Oct 2026 23:25:43 +0300 Message-ID: <20261017202638.728621-25-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269196099158500 Content-Type: text/plain; charset="utf-8" From: "Denis V. Lunev" nbd_receive_replies() reads a reply header into s->reply and, when the header turns out to be unusable, reports a channel error and returns without touching it. The cookie stays there until the request which owns the reply clears it, and until then the waiters are explicitly allowed to look at a cookie which is not theirs: if (s->reply.cookie !=3D 0) { ind2 =3D COOKIE_TO_INDEX(s->reply.cookie); assert(!s->requests[ind2].receiving); Two of the error paths leave a value chosen by the server behind: one returns before the cookie is validated at all, the other returns because that validation has failed. A waiter which picks such a cookie up turns it into an index which is not in requests[] and accesses the array out of bounds, at an offset the server controls. The reply is of no use to anybody at this point, so clear the cookie before the mutex is released and keep the invariant that a non-zero s->reply.cookie is always an index of a live request. Observing the stale cookie takes a second thread, which a multiqueue configuration provides. Within one AioContext there is no yield point between the failed read and the clearing done by the owner in nbd_co_receive_one_chunk(), so nothing else of this node runs in between. The parked waiters cannot see it either, as they are woken only after the cookie has been cleared. What can get in is a request entering nbd_receive_replies() afresh, one just sent or one back for its next reply chunk, because that path takes the mutex without looking at the state. Cc: Eric Blake Cc: Vladimir Sementsov-Ogievskiy Signed-off-by: Denis V. Lunev Reviewed-by: Vladimir Sementsov-Ogievskiy Message-ID: <20260820115228.587427-2-den@openvz.org> Signed-off-by: Vladimir Sementsov-Ogievskiy (cherry picked from commit 9998d225bb95c0baa17d51f760e46a51886ccfdf) Signed-off-by: Michael Tokarev diff --git a/block/nbd.c b/block/nbd.c index 5d231d5c4e..d9b776283f 100644 --- a/block/nbd.c +++ b/block/nbd.c @@ -466,20 +466,19 @@ static coroutine_fn int nbd_receive_replies(BDRVNBDSt= ate *s, uint64_t cookie, error_setg(errp, "server dropped connection"); } if (ret < 0) { - nbd_channel_error(s, ret); - return ret; + goto err; } if (nbd_reply_is_structured(&s->reply) && s->info.mode < NBD_MODE_STRUCTURED) { - nbd_channel_error(s, -EINVAL); + ret =3D -EINVAL; error_setg(errp, "unexpected structured reply"); - return -EINVAL; + goto err; } ind2 =3D COOKIE_TO_INDEX(s->reply.cookie); if (ind2 >=3D MAX_NBD_REQUESTS || !s->requests[ind2].coroutine) { - nbd_channel_error(s, -EINVAL); + ret =3D -EINVAL; error_setg(errp, "unexpected cookie value"); - return -EINVAL; + goto err; } if (s->reply.cookie =3D=3D cookie) { /* We are done */ @@ -487,6 +486,13 @@ static coroutine_fn int nbd_receive_replies(BDRVNBDSta= te *s, uint64_t cookie, } nbd_recv_coroutine_wake_one(&s->requests[ind2]); } + +err: + /* Waiters look at this cookie, so do not leave a rejected one behind.= */ + s->reply.cookie =3D 0; + nbd_channel_error(s, ret); + + return ret; } =20 static int coroutine_fn GRAPH_RDLOCK --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269032; cv=none; d=zohomail.com; s=zohoarc; b=FLgWSqTFiJzt3i4wSyVMxj6dLyIfCINXbYJRueQTbYOomgEK8gaFWsSYzho2RSKNMWvO3Zvj46Umu8S0gVVtbAiGK3ZwHWO1jBG7k+/qQRP9lmxH3Q1VsHTT0D+iq7v89zPzIe80jFM6famSAGWgkXyy28SvWv0BkWeXOSKoaOQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269032; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=jNYWZ/O2pS0lmoJtvEChOFS8Daga5zTBi6TRR6Ei1WQ=; b=WZppRBNz9l/jB56qwXOwhjeZXWuDf9VSSCzLcfaGoDn5kucTXAZ5JzdiBxYd8ID32gUA4mefjH1Kns7qigHrLxc/b23eZMaUlV1DYxJ0QmMebFKPKyTy4CQxNgPvF1UFhQT0pTo6gJ867PpAVB/FRiPhkXOGPxKYNI6uR14nzXY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269032254498.4497120443116; Sat, 17 Oct 2026 13:30:32 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB2b-0000uW-Rd; Sat, 17 Oct 2026 16:30:06 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB1l-0006f3-BK; Sat, 17 Oct 2026 16:29:15 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB1i-00041p-EZ; Sat, 17 Oct 2026 16:29:12 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id DA5EE1DE756; Sat, 17 Oct 2026 23:27:30 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 1071B44342C; Sat, 17 Oct 2026 23:27:29 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268850; bh=ssXstQFJQqCeotDgKaZFU6wQkt7iat7NMhOe6v/S63g=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=jzAK7p+lqh/G9r4QojsN8aETjUYvn6WN8MbINaJJ6dCYexXsx3yRnYpdqBrScoPG6 VnVXaPbTro2uog1/e9NBj0p20tKpYW1pk05cHzFTC+cHmkxyCl9aufhr+ANuey/WOA vD5i7t65HHC0do/sixmGl5f+0dZgAa+E2LWbGsbpk1UuBwqbuY/NW5oQHgq1vtl9TW 5qx3TU8cpOhxdgq7xv62ybr7ZA5Q58x3PsXP0fN0ZGndPpht9IxGE5IadS97099Iby zdqmBJQPdzxKd+D3bkgol5faaTTt2uEJDHYjqcAGWSPnp5uV0K5qtrRJ63MsHAtj5f lajbZPqiSUONw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, "Denis V. Lunev" , Eric Blake , Vladimir Sementsov-Ogievskiy , Michael Tokarev Subject: [Stable-11.1.3 26/73] block/nbd: never index requests[] with an unchecked cookie Date: Sat, 17 Oct 2026 23:25:44 +0300 Message-ID: <20261017202638.728621-26-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269034889158500 Content-Type: text/plain; charset="utf-8" From: "Denis V. Lunev" Cookies are converted into indices of s->requests[] in several places and the result is used right away, without any check: int i =3D COOKIE_TO_INDEX(cookie); ... return nbd_co_receive_offset_data_payload(s, s->requests[i].offset, COOKIE_TO_INDEX() subtracts one, so a zero cookie becomes an index of -1 and the access lands in front of the array. This is undefined and, depending on the type of the index and on what the compiler has put there, it can as well pass silently: at the site above i is signed, so even a plain i < MAX_NBD_REQUESTS check would happily let -1 through. Route every conversion through a helper which hands out the slot only for a cookie in range and owned by a request in flight, so that the check can not be forgotten again. The helper reports through an Error, as the one cookie which is not ours to trust, the one taken from the wire in nbd_receive_replies(), is a protocol error rather than an internal inconsistency and has to stay a channel error. Every other cookie is one we have issued and still own, so a bad value there is a bug in this file, which is what &error_abort spells out. The cookie of the reply in flight goes through the helper as well. It is not an unchecked value either: it has passed the check on the wire path, or it has been cleared by the previous commit. Cc: Eric Blake Cc: Vladimir Sementsov-Ogievskiy Signed-off-by: Denis V. Lunev Reviewed-by: Vladimir Sementsov-Ogievskiy Message-ID: <20260820115228.587427-3-den@openvz.org> Signed-off-by: Vladimir Sementsov-Ogievskiy (cherry picked from commit 75b0a993dacbd5f8579e8f8c228f9bae80541e42) Signed-off-by: Michael Tokarev diff --git a/block/nbd.c b/block/nbd.c index d9b776283f..d0a7097034 100644 --- a/block/nbd.c +++ b/block/nbd.c @@ -136,6 +136,19 @@ static void nbd_clear_bdrvstate(BlockDriverState *bs) s->x_dirty_bitmap =3D NULL; } =20 +static NBDClientRequest *nbd_request_by_cookie(BDRVNBDState *s, uint64_t c= ookie, + Error **errp) +{ + uint64_t ind =3D COOKIE_TO_INDEX(cookie); + + if (ind >=3D MAX_NBD_REQUESTS || !s->requests[ind].coroutine) { + error_setg(errp, "unexpected cookie value"); + return NULL; + } + + return &s->requests[ind]; +} + /* Called with s->receive_mutex taken. */ static bool coroutine_fn nbd_recv_coroutine_wake_one(NBDClientRequest *req) { @@ -422,7 +435,8 @@ static coroutine_fn int nbd_receive_replies(BDRVNBDStat= e *s, uint64_t cookie, Error **errp) { int ret; - uint64_t ind =3D COOKIE_TO_INDEX(cookie), ind2; + NBDClientRequest *req =3D nbd_request_by_cookie(s, cookie, &error_abor= t); + NBDClientRequest *owner; QEMU_LOCK_GUARD(&s->receive_mutex); =20 while (true) { @@ -437,10 +451,10 @@ static coroutine_fn int nbd_receive_replies(BDRVNBDSt= ate *s, uint64_t cookie, * woken by whoever set s->reply.cookie (or never wait in this * yield). So, we should not wake it here. */ - ind2 =3D COOKIE_TO_INDEX(s->reply.cookie); - assert(!s->requests[ind2].receiving); + owner =3D nbd_request_by_cookie(s, s->reply.cookie, &error_abo= rt); + assert(!owner->receiving); =20 - s->requests[ind].receiving =3D true; + req->receiving =3D true; qemu_co_mutex_unlock(&s->receive_mutex); =20 qemu_coroutine_yield(); @@ -454,7 +468,7 @@ static coroutine_fn int nbd_receive_replies(BDRVNBDStat= e *s, uint64_t cookie, */ =20 qemu_co_mutex_lock(&s->receive_mutex); - assert(!s->requests[ind].receiving); + assert(!req->receiving); continue; } =20 @@ -474,17 +488,16 @@ static coroutine_fn int nbd_receive_replies(BDRVNBDSt= ate *s, uint64_t cookie, error_setg(errp, "unexpected structured reply"); goto err; } - ind2 =3D COOKIE_TO_INDEX(s->reply.cookie); - if (ind2 >=3D MAX_NBD_REQUESTS || !s->requests[ind2].coroutine) { + owner =3D nbd_request_by_cookie(s, s->reply.cookie, errp); + if (!owner) { ret =3D -EINVAL; - error_setg(errp, "unexpected cookie value"); goto err; } if (s->reply.cookie =3D=3D cookie) { /* We are done */ return 0; } - nbd_recv_coroutine_wake_one(&s->requests[ind2]); + nbd_recv_coroutine_wake_one(owner); } =20 err: @@ -861,7 +874,6 @@ static coroutine_fn int nbd_co_do_receive_one_chunk( { ERRP_GUARD(); int ret; - int i =3D COOKIE_TO_INDEX(cookie); void *local_payload =3D NULL; NBDStructuredReplyChunk *chunk; =20 @@ -919,8 +931,9 @@ static coroutine_fn int nbd_co_do_receive_one_chunk( return -EINVAL; } =20 - return nbd_co_receive_offset_data_payload(s, s->requests[i].offset, - qiov, errp); + return nbd_co_receive_offset_data_payload( + s, nbd_request_by_cookie(s, cookie, &error_abort)->offset, + qiov, errp); } =20 if (nbd_reply_type_is_error(chunk->type)) { @@ -1067,7 +1080,7 @@ static bool coroutine_fn nbd_reply_chunk_iter_receive= (BDRVNBDState *s, =20 break_loop: qemu_mutex_lock(&s->requests_lock); - s->requests[COOKIE_TO_INDEX(cookie)].coroutine =3D NULL; + nbd_request_by_cookie(s, cookie, &error_abort)->coroutine =3D NULL; s->in_flight--; qemu_co_queue_next(&s->free_sema); qemu_mutex_unlock(&s->requests_lock); --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269215; cv=none; d=zohomail.com; s=zohoarc; b=H1P4Jrxk00JDx5pFRqj39XYYDwd3dgVNWMCLkw4gdr3hg2A5oanUvJrxpB3jiFRuYPny+FxBCq/RW1Kyj86HRGAYnWcT2nSFkWYEMvFdEiigaFB4SYLxjXEbEE4Pg8t7OuQmqtCbdSiWrJ9rZun0a3Ws/DQEGw/4kjSQNbt8Bt0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269215; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=sBVVnb86zlrrCHxXTCFUbeS8zKtJ7o83i4a8r6ZgDOk=; b=TcqpgZDO77Jf2fGFhOanMBcFahhaZRAlW13k8r9FGLhdDfbpZihfDjYSnRWWWqOrpBfDfhPg5+3bRQlxeZ2kfwIZ2a7sA2HzOCDs5OPECXcJX4xamcvfyc0XIr7uPK5umQetr1LbdPt6Dx4H7PaUlifeyW6G4lepNYZvy+VM7Vg= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269215477369.1531710983535; Sat, 17 Oct 2026 13:33:35 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB2h-0001Hh-Sk; Sat, 17 Oct 2026 16:30:12 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB1p-0006rL-5Z; Sat, 17 Oct 2026 16:29:17 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB1n-00042J-AC; Sat, 17 Oct 2026 16:29:16 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 2732A1DE757; Sat, 17 Oct 2026 23:27:32 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 1DB4B44342D; Sat, 17 Oct 2026 23:27:30 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268852; bh=9Qx3Fy74skyHOo6MXHmnmMoJ0echXzi6ce+mUeFoOTs=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=spyynmcQlaqvhxhJ0fYQqV+JWQB25iNFyWM51/PeRImJS9S0GcGtiTqFcmBI8Q6Tc LevFqdHH6sOUcXHIJUcDekxMs9/VB/sxLOuI68EO5j3pOMuehmmTX+CDZbpclwbZeQ Q7E4Bx7IR4F89Fp8RCPzJAgjnf2C1ZCQ2YcE+FYqNE0iJkB8tjM5xSOFcx85beGggr seMsC33Qz7YvZhrSBgjhsAMDRAeAlo2wUbYyqd7T0zXCimOm2lxm2n21T3lN+IwEtd ZeNAzXpDfELENN1UwKK2uH/2LOPbtCrTzuJlOdu5fXW2A2krYxVsZdA7JtfAtNIG3m C9hejJ8q9JYpA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, "Denis V. Lunev" , Eric Blake , Vladimir Sementsov-Ogievskiy , Michael Tokarev Subject: [Stable-11.1.3 27/73] block/nbd: clear reply.cookie under receive_mutex Date: Sat, 17 Oct 2026 23:25:45 +0300 Message-ID: <20261017202638.728621-27-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269216272158500 Content-Type: text/plain; charset="utf-8" From: "Denis V. Lunev" s->reply is documented as protected by s->receive_mutex, but the cookie is cleared without it once the owning request has consumed its chunk. A waiter in nbd_receive_replies() inspects the very same field under the mutex, and does so with two separate loads: if (s->reply.cookie !=3D 0) { ind2 =3D COOKIE_TO_INDEX(s->reply.cookie); assert(!s->requests[ind2].receiving); Nothing keeps those two loads consistent. If the owner clears the cookie in between, the second one reads 0, COOKIE_TO_INDEX() turns it into an index of -1, and s->requests[] is accessed out of bounds: Assertion `!s->requests[ind2].receiving' failed. (gdb) p cookie $1 =3D 8 (gdb) p s->reply.cookie $2 =3D 0 (gdb) p &((NBDClientRequest *)s->requests)[-1].receiving $3 =3D (_Bool *) 0x5555558416c0 (gdb) p &s->in_flight $4 =3D (unsigned int *) 0x5555558416c0 (gdb) p s->in_flight $5 =3D 8 The cookie we wait for is 8, yet reply.cookie reads 0 one line after it was found non-zero, so the index is -1. requests[-1].receiving lands on in_flight, which is non-zero while requests are outstanding, and that is what the assertion trips over. Hitting this requires two coroutines of one NBD node to run in different threads, as there is no yield point between the two loads for the owner to squeeze into. A multiqueue configuration provides exactly that, with the virtqueues of one disk spread over several iothreads. Note that a compiler is free to merge the two loads into one, in which case the race is invisible, so builds with reduced optimization are much more likely to trip over it. Accessing s->reply without the mutex is fine for the coroutine that owns the reply: a non-zero cookie makes the field private to it. Releasing that ownership is not, as it races with the waiters which are explicitly allowed to look at the cookie. Clear it under the mutex, in the same critical section as the wakeup, and make nbd_recv_coroutines_wake() caller-locked, as CoMutex is not recursive. It has a single caller. The added acquisition cannot block behind the header read in nbd_receive_replies(), because that path is only reachable with reply.cookie =3D=3D 0 while we still own a non-zero cookie. Merging the clear with the wakeup also keeps a newcomer from starting a header read in between, which would stall this already completed request for the duration of that read. There is no cookie to own when we get here after an error, and then a newcomer can indeed be inside that read. It does not hold us for long either, as the channel has been shut down before the error was reported, so the read it sits in returns right away. Fixes: 4ddb5d2fde ("block/nbd: drop connection_co") Cc: Eric Blake Cc: Vladimir Sementsov-Ogievskiy Signed-off-by: Denis V. Lunev Reviewed-by: Vladimir Sementsov-Ogievskiy Message-ID: <20260820115228.587427-4-den@openvz.org> Signed-off-by: Vladimir Sementsov-Ogievskiy (cherry picked from commit cd3be3bd96c0e86f683c210a2c8f46b7da161807) Signed-off-by: Michael Tokarev diff --git a/block/nbd.c b/block/nbd.c index d0a7097034..e5e16722ba 100644 --- a/block/nbd.c +++ b/block/nbd.c @@ -161,11 +161,11 @@ static bool coroutine_fn nbd_recv_coroutine_wake_one(= NBDClientRequest *req) return false; } =20 +/* Called with s->receive_mutex taken. */ static void coroutine_fn nbd_recv_coroutines_wake(BDRVNBDState *s) { int i; =20 - QEMU_LOCK_GUARD(&s->receive_mutex); for (i =3D 0; i < MAX_NBD_REQUESTS; i++) { if (nbd_recv_coroutine_wake_one(&s->requests[i])) { return; @@ -974,9 +974,11 @@ static coroutine_fn int nbd_co_receive_one_chunk( /* For assert at loop start in nbd_connection_entry */ *reply =3D s->reply; } - s->reply.cookie =3D 0; =20 - nbd_recv_coroutines_wake(s); + WITH_QEMU_LOCK_GUARD(&s->receive_mutex) { + s->reply.cookie =3D 0; + nbd_recv_coroutines_wake(s); + } =20 return ret; } --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269388; cv=none; d=zohomail.com; s=zohoarc; b=mk+OciE0zOOy2sgrMOEVlX2DSraTCuyCcQ4hXoAF7o975+1cgZI4MxBbVp+JujlZYFC5G5f/c9rvYxKB4xTL6r5+6LT/Hczqde/uDQ238AW1Nxksia4rEpz6hwb6bj+ud94yLtTUBctEmpZCffy39gfFzemPUNMBbB2dxttX6To= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269388; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=yXX59SJ6rW9js7nj7F8WrDjLCsM0o9qbW5LPs/UNEfQ=; b=CqWqGlTJ+QazzYyQce0UfFjCuRjpinXKK8xRQMkR4YmYgorQhkiUPtOV/LVbXQUPemG+tlb7f9kNZJ1CcGgkrSiAfx9q/7gpr+EeN5yn1aSnSv04YAmJCCh6gwnXgK2ilpWAiyQs1LWdz8lMHDlS0aAUK8uUMxI+MH8iGc9gJT8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269388916241.4514359139598; Sat, 17 Oct 2026 13:36:28 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB2h-0001GY-LV; Sat, 17 Oct 2026 16:30:12 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB1q-00071Y-DY; Sat, 17 Oct 2026 16:29:18 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB1o-00042a-NU; Sat, 17 Oct 2026 16:29:18 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 3CB261DE758; Sat, 17 Oct 2026 23:27:33 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 58DF544342E; Sat, 17 Oct 2026 23:27:32 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268853; bh=wPsrWatmoA/1V6fJpVX6golZ+SsMNq4g1M/06nLMaFk=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=RBCiG70tWSW75X3hcspa7f1q4zYN2rOVOB5MzAYnmcxB3mp7Sb7sMN4svnYDN4Cwf tvldlNg77RUb9n2oaiZimbW64fJKLZJ22vPTog5/ZNMPxDWl7DrkKzImgTNNMJO1li 7nI2wcdFUm7dBKR/mzKk+dR+X3wTaSkHYx1DttREnaBZm44u/qFMaI4uv3awHtTofV JiHRYue1uMStw1+aYdu9fYM/7BzwYv1/cyTaIpNbuBuBXRrEye05cDLxdC7fdmUr3J QaGdMW9uDYKSXuIrnY5XJN8zTIUH/kD/vKDQXVyRilkpUCJy1qjJVn2BuPA840g/0z As1AoLotrshyQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Daniel Paziyski , Klaus Jensen , Michael Tokarev Subject: [Stable-11.1.3 28/73] hw/nvme: fix assertion failure on sr-iov capable nvme controller removal Date: Sat, 17 Oct 2026 23:25:46 +0300 Message-ID: <20261017202638.728621-28-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269390472158500 Content-Type: text/plain; charset="utf-8" From: Daniel Paziyski In a nvme subsystem, the ctrls array maps controller IDs to nvme controller= s. The value of the array elements can either be NULL (no controller present f= or this ID), SUBSYS_SLOT_RSVD, or any other value, representing a pointer to t= he nvme controller structure. The SUBSYS_SLOT_RSVD value is special: when a nvme controller physical func= tion is being created and is reserving the controller IDs for its virtual functi= ons, it indicates that the slot is soon going to be filled by its corresponding virtual function when it is realized, and on virtual function removal, it m= eans that its controller has been removed. When the physical function is being removed, it goes through its list of secondary controllers (virtual functions), ensures that their slots have the SUBSYS_SLOT_RSVD values, and then frees up the controller IDs by setting the NULL value. This traversal occurs before the virtual functions are destroye= d, causing an assertion failure because the slots contain as values the pointe= rs to the secondary controllers. Destroy the virtual functions (and therefore, the secondary controllers) af= ter they are offlined in the nvme_ctrl_reset call of the physical function, but before releasing the controller IDs of the secondary controllers in nvme_subsys_unregister_ctrl. QEMU command line (boot with a hotunplug-aware OS, such as Linux): qemu-system-x86_64 -M q35 -device pcie-root-port,id=3Drp -monitor stdio= \ -device nvme-subsys,id=3Dsubsys0 \ -device nvme,subsys=3Dsubsys0,serial=3Dctrl0,sriov_max_vfs=3D1,\ sriov_vq_flexible=3D2,sriov_vi_flexible=3D1,max_ioqpairs=3D4,msix_qsize=3D2= ,bus=3Drp,id=3Dctrl0 In the QEMU monitor: device_del ctrl0 Message in stderr: qemu-system-x86_64: ../hw/nvme/subsys.c:49: nvme_subsys_unreserve_cntlids: = Assertion `subsys->ctrls[cntlid] =3D=3D SUBSYS_SLOT_RSVD' failed. Cc: qemu-stable@nongnu.org Fixes: 44c2c09488db ("hw/nvme: Add support for SR-IOV") Signed-off-by: Daniel Paziyski Reviewed-by: Klaus Jensen Signed-off-by: Klaus Jensen (cherry picked from commit 90fcba23c526f3417953429832d0a97be4389fdb) Signed-off-by: Michael Tokarev diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c index 4893cf7e74..3040cb1760 100644 --- a/hw/nvme/ctrl.c +++ b/hw/nvme/ctrl.c @@ -9702,6 +9702,10 @@ static void nvme_exit(PCIDevice *pci_dev) } } =20 + if (!pci_is_vf(pci_dev) && n->params.sriov_max_vfs) { + pcie_sriov_pf_exit(pci_dev); + } + nvme_subsys_unregister_ctrl(n->subsys, n); =20 g_free(n->cq); @@ -9726,10 +9730,6 @@ static void nvme_exit(PCIDevice *pci_dev) host_memory_backend_set_mapped(n->pmr.dev, false); } =20 - if (!pci_is_vf(pci_dev) && n->params.sriov_max_vfs) { - pcie_sriov_pf_exit(pci_dev); - } - if (n->params.msix_exclusive_bar && !pci_is_vf(pci_dev)) { msix_uninit_exclusive_bar(pci_dev); } else { --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269193; cv=none; d=zohomail.com; s=zohoarc; b=UXqSwvH+usCPKkHip3U7L98d6JmYzmCDqQeYZi5GRu7DaqVb87KLhlWgrbpd6/a0arrMwNNv5XgvIURfx0HJclTfdW7GDlbqbE1Owwkxc0UszUoLmmUFzMKitnx8lVLVY86/OqOTuKl0Zw1vZ4RuYQAfyFDIBRq+25DiafRcIQk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269193; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=FszP8Z5viQTM3KnV3eUOSE4srefDzH/lSaY36nUTpJw=; b=JEZ7RpdyQt6Jvk54VoQ0FHyPdmThD1eUJutud/Up/DeXd9xWkzZXIhrINZosYHs5WEDxgF/CWuk95+JReh5GzjEbcChcum6xhCctbMjjF8Mhxgfyy/I2+umTQqlM55w2W4Lu+4+axoW7mXe9ITjWwcn/oEnuktw9xb14N4kK02o= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269193166940.9478086026855; Sat, 17 Oct 2026 13:33:13 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB2p-0001hH-2w; Sat, 17 Oct 2026 16:30:19 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB2C-00086O-EW; Sat, 17 Oct 2026 16:29:46 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB2A-000433-Qn; Sat, 17 Oct 2026 16:29:40 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 2AF241DE759; Sat, 17 Oct 2026 23:27:34 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 6E7E744342F; Sat, 17 Oct 2026 23:27:33 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268854; bh=9NDgEE8t1v7348s0DR+seIO037vmOXrzLG9QZtTV99Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=dbRhlK6dYItAcimqmMqROK9gqnX/ms02kqLSkFzggSNbRuUu9DE93dx+Iodw1r9yV jUJpXfF3V2GwkUtTnD3oWJwfjK6jqoN7pgmk7yEp4FvYFA2HsSF+cGAJHqJ/1xkc1h uTDXtsob/DTKAK1CaZZZQu6jNpABZU0O4wHyl1iwsBe2IWxNGv2A6d5wqT6qgj/fDC Pu6g8qRyEuOGSTV2Si6Vgwil/RP/gmxpSgL6PcIsI591+k6imqWvBDEKVKWkD08D/2 yitX3DzJAkmY/JxRJxmpMz+fMjqemjVCtWhsV8iBYufaA9OjwGxh2HWySnHLFtei8+ RqaT7JxEw0yJg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Daniel Paziyski , Klaus Jensen , Michael Tokarev Subject: [Stable-11.1.3 29/73] hw/nvme: fix memory leak on sr-iov capable nvme controller removal Date: Sat, 17 Oct 2026 23:25:47 +0300 Message-ID: <20261017202638.728621-29-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269193836158500 Content-Type: text/plain; charset="utf-8" From: Daniel Paziyski If a nvme controller is SR-IOV capable, its list of secondary controllers (virtual functions) is stored in the sec_ctrl_list dynamically allocated array, located in the NvmeCtrl struct. Free the secondary controller list after destroying the virtual functions a= nd freeing their controller IDs. QEMU command line (boot with a hotunplug-aware OS, such as Linux): qemu-system-x86_64 -M q35 -device pcie-root-port,id=3Drp -monitor stdio= \ -device nvme-subsys,id=3Dsubsys0 \ -device nvme,subsys=3Dsubsys0,serial=3Dctrl0,sriov_max_vfs=3D1,\ sriov_vq_flexible=3D2,sriov_vi_flexible=3D1,max_ioqpairs=3D4,msix_qsize=3D2= ,bus=3Drp,id=3Dctrl0 In the QEMU monitor: device_del ctrl0 quit ASAN splat: =3D=3D78982=3D=3DERROR: LeakSanitizer: detected memory leaks Direct leak of 32 byte(s) in 1 object(s) allocated from: #0 0x7fcbab32bea9 in calloc (/usr/lib/libasan.so.8+0x12bea9) (BuildId: = 7f2845989b820f536270e19ec47df085ae89a675) #1 0x7fcbaa2a34b2 in g_malloc0 (/usr/lib/libglib-2.0.so.0+0x694b2) (Bui= ldId: cb17d184459352a7985a010f1cd3acef4a4f90d8) #2 0x559c531fff4b in nvme_subsys_register_ctrl ../hw/nvme/subsys.c:65 #3 0x559c531d715e in nvme_init_subsys ../hw/nvme/ctrl.c:9582 #4 0x559c531d7a7d in nvme_realize ../hw/nvme/ctrl.c:9637 #5 0x559c5323c0da in pci_qdev_realize ../hw/pci/pci.c:2316 #6 0x559c54001e88 in device_set_realized ../hw/core/qdev.c:514 #7 0x559c5402462e in property_set_bool ../qom/object.c:2484 #8 0x559c5401dbd2 in object_property_set ../qom/object.c:1548 #9 0x559c5402b76c in object_property_set_qobject ../qom/qom-qobject.c:28 #10 0x559c5401e24c in object_property_set_bool ../qom/object.c:1618 #11 0x559c53fffd77 in qdev_realize ../hw/core/qdev.c:277 #12 0x559c53934166 in qdev_device_add_from_qdict ../system/qdev-monitor= .c:740 #13 0x559c53934272 in qdev_device_add ../system/qdev-monitor.c:758 #14 0x559c538867c8 in device_init_func ../system/vl.c:1217 #15 0x559c5487236a in qemu_opts_foreach ../util/qemu-option.c:1148 #16 0x559c53891205 in qemu_create_cli_devices ../system/vl.c:2762 #17 0x559c53891968 in qmp_x_exit_preconfig ../system/vl.c:2822 #18 0x559c53898108 in qemu_init ../system/vl.c:3862 #19 0x559c545efabf in main ../system/main.c:71 #20 0x7fcba7627780 (/usr/lib/libc.so.6+0x27780) (BuildId: 1fa174a830ce= f40a5b2388add4318ee2795f573e) #21 0x7fcba76278b8 in __libc_start_main (/usr/lib/libc.so.6+0x278b8) (B= uildId: 1fa174a830cef40a5b2388add4318ee2795f573e) #22 0x559c524df1f4 in _start (BuildId: 35402cb4fc46114b7a4102258726bbde= c82cd9bc) Cc: qemu-stable@nongnu.org Fixes: c6159d0e384f ("hw/nvme: Allocate sec-ctrl-list as a dynamic array") Signed-off-by: Daniel Paziyski Reviewed-by: Klaus Jensen Signed-off-by: Klaus Jensen (cherry picked from commit 6ee626e34979eae2d3e2318b00f0c340a474dd23) Signed-off-by: Michael Tokarev diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c index 3040cb1760..76ff92c9eb 100644 --- a/hw/nvme/ctrl.c +++ b/hw/nvme/ctrl.c @@ -9708,6 +9708,10 @@ static void nvme_exit(PCIDevice *pci_dev) =20 nvme_subsys_unregister_ctrl(n->subsys, n); =20 + if (!pci_is_vf(pci_dev) && n->params.sriov_max_vfs) { + g_free(n->sec_ctrl_list); + } + g_free(n->cq); g_free(n->sq); g_free(n->aer_reqs); --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269075; cv=none; d=zohomail.com; s=zohoarc; b=TAhF1rzoxn+Qxx5GIXHwIAWylp8Y54nRefNrlfn8P5x3pDo94R3Gotmj0k2gOid5g1JCRDZAx9SONrEGov6J3m0vXsKbDx2bHspMhiwGckIALR3ukULiO+xxacGgAeQ5Cb7pepIYLLPgOKTIGN3pDm4EoT5hJPCz9Qe0p9ZOSCw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269075; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=X5oCJ0/v2dL+KNnmARsiDUXUcpjJ4x/+l0nya65J1mU=; b=JILEXHMWpsXeKNl3mRHWiI2pgRJ5t+T0nQxA32nxA8oWj1TR3p5Fw657q7TlQV73RtlmLqfZpXmIkWnNdWTvuhMREVk3XDLeBIo6u34Fg4Iip3dSLHnyrN08WicchEKoarD3WWM3aCjWZ9iWJxOUiLgFhv2wP1o0PmsJh7+tBnQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269075657809.11722877618; Sat, 17 Oct 2026 13:31:15 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB2q-0001l7-HL; Sat, 17 Oct 2026 16:30:20 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB2D-000879-R4; Sat, 17 Oct 2026 16:29:47 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB2B-00043Y-Tf; Sat, 17 Oct 2026 16:29:41 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 76C121DE75A; Sat, 17 Oct 2026 23:27:35 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 5D626443430; Sat, 17 Oct 2026 23:27:34 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268855; bh=vs4q4+dnsHZ4gThLVN7SNRSHjlqUmrqJTENefJWFLQg=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=I9/ptCAoBs7lrjWnohjvgWpAgdOaep3BITcYs3v2ahQgKN/oPhF2NI2d5gXGE6jSN bLnFEgzu/jvW2DWFrqlWVCEdMVeOIFOpT8zvWUPvzU+Y9rSQt7KWdn2rWjQJKGEK+3 +8ehR7w8netq1kb0iQhFRWAikWbICeWjL5MNau9vw4j+R6liYQW5QZXRWfpr28XLVt Tpw3Nb4r6xvMvl3fdI/OP3SbWnGebI/iq5Z5ByYfDcyqv9s/FemTOlpt8fPlGy6YWT XfSSinX+HA6Waly+FkMwiCY8ZT6c9JVMM6GMcrHXWdryIMJzstsLFF2Wi96HSzJCFy VpkMW5SR6yIGw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, y zhou , =?UTF-8?q?Alex=20Benn=C3=A9e?= , Pierrick Bouvier , Alexandre Iooss , Michael Tokarev Subject: [Stable-11.1.3 30/73] plugins: fix register handle encoding to reserve NULL as invalid Date: Sat, 17 Oct 2026 23:25:48 +0300 Message-ID: <20261017202638.728621-30-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269077593158500 From: y zhou The opaque register handles returned by qemu_plugin_get_registers() are currently encoded as: handle =3D (gdb_reg << 1) | read_only_bit For the first core register of every target -- gdb_reg 0, not read-only -- this encodes to GINT_TO_POINTER(0), i.e. NULL. That is x86_64 "rax", aarch64 "x0" and ppc "r0", among others. A NULL handle is indistinguishable from an invalid one, so any plugin that defensively checks its handles silently loses access to the first core register (where the Linux syscall number lives on x86_64, for example). Passing NULL to qemu_plugin_write_register() instead of being rejected silently writes register 0. Restore the invariant that NULL is never a valid handle by keeping an offset on the gdb register number, as was already done before the read-only property was packed into the handle (see v10.0.0, where handles were encoded as GINT_TO_POINTER(gdb_reg + 1)): handle =3D ((gdb_reg + 1) << 1) | read_only_bit Also assert in tests/tcg/plugins/registers.c that every descriptor carries a non-NULL handle: the current test passes the handles straight to read/write without checking them, and a handle encoding that maps a valid register to NULL goes unnoticed for that reason. Found while writing a system-mode syscall tracing plugin, which could read neither the syscall number on x86_64 nor the first argument on aarch64 (both handles came back NULL). Auditing every GINT_TO_POINTER/GPOINTER_TO_INT site in the tree shows this is the only place where a valid entity encodes to NULL. Fixes: 55327b85ce32c ("plugins: prohibit writing to read-only registers") Signed-off-by: y zhou Cc: Alex Benn=C3=A9e Cc: Pierrick Bouvier Cc: Alexandre Iooss Cc: qemu-stable@nongnu.org Reviewed-by: Pierrick Bouvier Link: https://lore.kernel.org/qemu-devel/20261005181817.403766-1-pierrick.b= ouvier@oss.qualcomm.com Signed-off-by: Pierrick Bouvier (cherry picked from commit 46a8b8b378259a4ddb4bc4b79f88eba7640ad899) Signed-off-by: Michael Tokarev diff --git a/plugins/api.c b/plugins/api.c index eb982f9aad..0d02a4f7ad 100644 --- a/plugins/api.c +++ b/plugins/api.c @@ -453,7 +453,7 @@ static GArray *create_register_handles(GArray *gdbstub_= regs) desc.is_readonly =3D true; plugin_ro_bit =3D 1; } - desc.handle =3D GINT_TO_POINTER((grd->gdb_reg << 1) | plugin_ro_bi= t); + desc.handle =3D GINT_TO_POINTER(((grd->gdb_reg + 1) << 1) | plugin= _ro_bit); desc.feature =3D g_intern_string(grd->feature_name); g_array_append_val(find_data, desc); } @@ -478,7 +478,7 @@ bool qemu_plugin_read_register(struct qemu_plugin_regis= ter *reg, return false; } =20 - return (gdb_read_register(current_cpu, buf, GPOINTER_TO_INT(reg) >> 1)= > 0); + return (gdb_read_register(current_cpu, buf, (GPOINTER_TO_INT(reg) >> 1= ) - 1) > 0); } =20 bool qemu_plugin_write_register(struct qemu_plugin_register *reg, @@ -495,7 +495,8 @@ bool qemu_plugin_write_register(struct qemu_plugin_regi= ster *reg, return false; } =20 - return (gdb_write_register(current_cpu, buf->data, GPOINTER_TO_INT(reg= ) >> 1) > 0); + return (gdb_write_register(current_cpu, buf->data, + (GPOINTER_TO_INT(reg) >> 1) - 1) > 0); } =20 void qemu_plugin_set_pc(uint64_t vaddr) diff --git a/tests/tcg/plugins/registers.c b/tests/tcg/plugins/registers.c index 0e41734435..02058fe8a8 100644 --- a/tests/tcg/plugins/registers.c +++ b/tests/tcg/plugins/registers.c @@ -29,6 +29,14 @@ static void vcpu_init_cb(unsigned int vcpu_index, void *= userdata) qemu_plugin_reg_descriptor *reg_desc =3D NULL; bool success =3D false; =20 + /* NULL must never be a valid register handle */ + for (size_t i =3D 0; i < regs->len; i++) { + qemu_plugin_reg_descriptor *desc =3D + &g_array_index(regs, qemu_plugin_reg_descriptor, i); + + g_assert(desc->handle !=3D NULL); + } + /* Make sure we can read and write a register not marked as readonly */ for (size_t i =3D 0; i < regs->len; i++) { reg_desc =3D &g_array_index(regs, qemu_plugin_reg_descriptor, i); --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269459; cv=none; d=zohomail.com; s=zohoarc; b=T2pFNdhZRs7SLEDC1MN7kjzCgxIm3pw1X3vzXsHY/LhYPqcP5iEhnh5H8Pqe3ipqgfrP2aWqABc1HsTjrY5ktl+HE4Au0H4EuiX6aMi5MvciP+T9f2Z/H5B3gjDsNg9ZX/eVm9jqlq/R7rrx2wGKg/1dZMBEFTinxdlf1GRJBYQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269459; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=Uq8nyzLLK4dC0AWo4oCvzdwih5riiW3lFXloLLf9Z+4=; b=oDdRsLC7VZJHG0i1198aUGiugErTiRX9RQwhxqymtm1gUlHIgTFG5zwz3j5oe9mNvQyGgoIsVKh2YjejDBanRoUUx45SoAxfkTSZ7gGD88CcnwqyweBlp5O7LKFm3BeWBS6kaEfJRe4p6nywdz5w4nGro+JN8gq/SqFBbuTFZqs= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269459582185.54809418250306; Sat, 17 Oct 2026 13:37:39 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB2n-0001cI-Gj; Sat, 17 Oct 2026 16:30:17 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB2F-00087U-G6; Sat, 17 Oct 2026 16:29:48 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB2D-00045J-Q5; Sat, 17 Oct 2026 16:29:43 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 9B4AB1DE75B; Sat, 17 Oct 2026 23:27:36 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id AD47D443431; Sat, 17 Oct 2026 23:27:35 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268856; bh=KrG1b4APP6QPHE6ELPpAwTWi5YrV4AhaQMaoKa0pOUY=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=ZKXWRQNw45WAFL/3Tti0ra0zOMYbZjsYn1I8qhIpkMLyqBscnAjTjBENamF+GiZdt TxGY5/Mlbf8rRb88qIhHyMNEWHQ5kTHprdI6Q4beR5G6rORCMpljIHvTgyp+Gk5TxF 5TziG2Lb61nJSVlJMJWr13edOV9y+41Ei3GFWjuRwrzOewyC65HG4wSX8Ym9JnEwnJ nQAuM7laIGz+h+var5TjDVa7OGm507hPuJW/kbBMfxilPerruTceekyFWkFwyvolSs K3UOm8MiFX+LFuueH0sbqFYfCcjhxkD9EvQLjbw8EYddOZsP/Q4exsbnxUTkQB92mn SfIs/6LBxTJOw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, =?UTF-8?q?Jakub=20Lipov=C3=BD?= , Paolo Bonzini , Michael Tokarev Subject: [Stable-11.1.3 31/73] target/i386/tcg: raise #GP(0) on null SS load with RPL != CPL Date: Sat, 17 Oct 2026 23:25:49 +0300 Message-ID: <20261017202638.728621-31-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269461894158500 From: Jakub Lipov=C3=BD In 64-bit mode, loading a null selector into SS raises #GP(0) if CPL =3D 3, or if CPL < 3 and CPL !=3D RPL. helper_load_seg() only implemented the first case: the null-selector path never examined the selector's RPL, so a null selector with non-zero RPL (such as 0x0003) loaded successfully at CPL < 3. This was caught by test_sreg() in kvm-unit-tests x86/emulator64.c, which additionally fails its subsequent non-null check because the wrongly succeeded load leaves 3 in SS. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/4204 Cc: qemu-stable@nongnu.org Signed-off-by: Jakub Lipov=C3=BD Link: https://lore.kernel.org/r/20260818164414.245189-1-lipovyjakub@tillia.= cz Signed-off-by: Paolo Bonzini (cherry picked from commit 8d496d8f9fcea2199f6dc32f700d13b1d9ed3358) Signed-off-by: Michael Tokarev diff --git a/target/i386/tcg/seg_helper.c b/target/i386/tcg/seg_helper.c index 6d424349a5..cad19f9ca6 100644 --- a/target/i386/tcg/seg_helper.c +++ b/target/i386/tcg/seg_helper.c @@ -1411,11 +1411,12 @@ void helper_load_seg(CPUX86State *env, int seg_reg,= int selector) =20 selector &=3D 0xffff; cpl =3D env->hflags & HF_CPL_MASK; + rpl =3D selector & 3; if ((selector & 0xfffc) =3D=3D 0) { /* null selector case */ if (seg_reg =3D=3D R_SS #ifdef TARGET_X86_64 - && (!(env->hflags & HF_CS64_MASK) || cpl =3D=3D 3) + && (!(env->hflags & HF_CS64_MASK) || cpl =3D=3D 3 || cpl !=3D = rpl) #endif ) { raise_exception_err_ra(env, EXCP0D_GPF, 0, GETPC()); @@ -1439,7 +1440,6 @@ void helper_load_seg(CPUX86State *env, int seg_reg, i= nt selector) if (!(e2 & DESC_S_MASK)) { raise_exception_err_ra(env, EXCP0D_GPF, selector & 0xfffc, GET= PC()); } - rpl =3D selector & 3; dpl =3D (e2 >> DESC_DPL_SHIFT) & 3; if (seg_reg =3D=3D R_SS) { /* must be writable segment */ --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269285; cv=none; d=zohomail.com; s=zohoarc; b=PdyMETkuYfnkXB1ZZ1YgDKYnANGKJ655BzAyxuJrzm9sAj+jfrTM0AOflCRrBQTlcL/HX4YPYh+hsaB9+437l/7HN6A40NspEz+MAlQ5UKINBqVzZYk7S0MVggvW3x6oHBOa/SWidk91GwGm7mfFqwb244HM7TsDrk7s08FU7E4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269285; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=ENxz/h1gZ6NQuhSMWAnYJ4ft9bLYx2B/Nt8+YRRQapU=; b=ZOy9h+QVHgcGfiU4lKBAegaJdRgl9gpLxNXynOM0L/JUzvUAJNgqTAskM3aoE1RlnyG8bhFtzTRb9mAoynN2EpYGPpwUjSHe4kIpyuJLKvJWYAaU0AAg1u0Eeu87zHhpqF9pzPMXg9IdXSnNzFkksvfRR4Fgrm++iEdbB49EDPQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269285440517.1198329809446; Sat, 17 Oct 2026 13:34:45 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB2o-0001fo-EA; Sat, 17 Oct 2026 16:30:19 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB2H-00088W-2e; Sat, 17 Oct 2026 16:29:50 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB2F-00045V-Ed; Sat, 17 Oct 2026 16:29:44 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id E29021DE75E; Sat, 17 Oct 2026 23:27:37 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id CCA57443432; Sat, 17 Oct 2026 23:27:36 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268857; bh=mpHODwz6+bwjv1g0zbMEYxQSTqZPXb1z90BducaUvS4=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=kGoTxA1a9ugSIDa9mhu1SrMePeRGdIjYk+X9oR2eB9gqPfPBgYoyPykaBBMJ19Rkk W5hq7899Fn+GMaslHA+VlaPn2FSJjznbpeCqpxTVC0y1dv5peU/aNDjmCO4Qy3d/Mg O8IW5PpJ0OOj0RPAaUyCy8FI6PiYxZ2NHlV2+XPJj37JGWLNVVrPVPWi6jPayzz0i8 B/DlqPhZ8Yh80l88ymr3cIIfW2LtMRhhemNSm7yQpT1fY+d8eAdmbzpq177HRv0fs1 6/UPqPL/q7GZufWdGLvpub6HUkTzuDUrRQbNUCq2+jZkhe7Vwg7SGb9eQSVlkdMOp5 WVHbSppDxpybQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Yanfei Xu , Yuxuan Li , Paolo Bonzini , Michael Tokarev Subject: [Stable-11.1.3 32/73] target/i386: Migrate error code only with an exception Date: Sat, 17 Oct 2026 23:25:50 +0300 Message-ID: <20261017202638.728621-32-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269287621158500 Content-Type: text/plain; charset="utf-8" From: Yanfei Xu An exception that carries an error code must retain it across migration. Otherwise the destination reinjects it with error_code 0, which can make the guest panic. Do not suppress this required state for old machine types; an incompatible destination should abort migration instead. The chance of stopping a vCPU while an exception is pending or injected is extremely low, so the cpu/error_code subsection should rarely be needed. It is currently emitted much more often because KVM does not clear has_error_code and error_code after completing exception injection. Require a valid exception_nr before sending the subsection. This filters stale KVM state while preserving the error code for a real exception. Fixes: 1b80f1009d ("target/i386: add compat for migrating error code") Cc: qemu-stable@nongnu.org Reported-by: Yuxuan Li Signed-off-by: Yanfei Xu Message-Id: <20260914113817.2212058-1-yanfei.xu@bytedance.com> Signed-off-by: Paolo Bonzini (cherry picked from commit fb024800d6ddfbc1aea926fbbd43fed6b8676510) Signed-off-by: Michael Tokarev diff --git a/hw/i386/pc.c b/hw/i386/pc.c index f064aa2b3e..862b4a45b4 100644 --- a/hw/i386/pc.c +++ b/hw/i386/pc.c @@ -82,7 +82,6 @@ const size_t pc_compat_10_2_len =3D G_N_ELEMENTS(pc_compa= t_10_2); =20 GlobalProperty pc_compat_10_1[] =3D { { "mch", "extended-tseg-mbytes", "16" }, - { TYPE_X86_CPU, "x-migrate-error-code", "false" }, }; const size_t pc_compat_10_1_len =3D G_N_ELEMENTS(pc_compat_10_1); =20 diff --git a/target/i386/cpu.c b/target/i386/cpu.c index 5805d33ab9..2adc8c1b65 100644 --- a/target/i386/cpu.c +++ b/target/i386/cpu.c @@ -10819,7 +10819,6 @@ static const Property x86_cpu_properties[] =3D { DEFINE_PROP_BOOL("tcg-cpuid", X86CPU, expose_tcg, true), DEFINE_PROP_BOOL("x-migrate-smi-count", X86CPU, migrate_smi_count, true), - DEFINE_PROP_BOOL("x-migrate-error-code", X86CPU, migrate_error_code, t= rue), /* * lecacy_cache defaults to true unless the CPU model provides its * own cache information (see x86_cpu_load_def()). diff --git a/target/i386/cpu.h b/target/i386/cpu.h index e6a197602d..04ab0c84a3 100644 --- a/target/i386/cpu.h +++ b/target/i386/cpu.h @@ -2367,7 +2367,6 @@ struct ArchCPU { bool expose_tcg; bool migratable; bool migrate_smi_count; - bool migrate_error_code; uint32_t apic_id; =20 /* Enables publishing of TSC increment and Local APIC bus frequencies = to diff --git a/target/i386/machine.c b/target/i386/machine.c index df0e0c178e..b7d2103b6c 100644 --- a/target/i386/machine.c +++ b/target/i386/machine.c @@ -465,7 +465,7 @@ static bool cpu_errcode_needed(void *opaque) { X86CPU *cpu =3D opaque; =20 - return cpu->env.has_error_code !=3D 0 && cpu->migrate_error_code; + return cpu->env.exception_nr !=3D -1 && cpu->env.has_error_code !=3D 0; } =20 static const VMStateDescription vmstate_error_code =3D { --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269036; cv=none; d=zohomail.com; s=zohoarc; b=i+8LKtgb0J29HvkvqcJjL1LoVgc7lXpX18g+q29PKKuDpoW29CiXZnzt6LyIl4mYSTxwE0ZJ4jQtG2matIuD3GuFhD4VrxnKiFAxybHFSfkh+2kpyG+RXzwLWnUBYnVRrsk3GQLZHE3DBUmLufrU/VGjiMh1DX7H/KLNgdZR2/U= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269036; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=01fqtNDPQPOSVZQQwTlo+4pZ7T8sAB64cKMP2yAVhi8=; b=fPBqQ8yWiz3RR/acL94uZ3oIm5pCnmeyoLM2oXCa+cXYMfCdS589xYKa+gQpGU0udInh4a90Sv/D3iaQaR4W+VUSAmuPWClSqwyOPPn/BNj5+rnRZ0lPI2Xdq9UMW6bdQFSLDcM2vb0v9dOMGAiGlhc2ukNI5J7qrAnExtpbEls= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269036984634.343139609193; Sat, 17 Oct 2026 13:30:36 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB2y-0002Ks-2C; Sat, 17 Oct 2026 16:30:28 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB2d-00015W-0p; Sat, 17 Oct 2026 16:30:07 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB2b-00045g-18; Sat, 17 Oct 2026 16:30:06 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id D3E481DE75F; Sat, 17 Oct 2026 23:27:38 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 213CF443433; Sat, 17 Oct 2026 23:27:38 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268858; bh=fSGSx8+sMifZVc8DXLLOrWvCeChwcb9AWdbXfn6wqg0=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=qZH/xL8c3PRqQln6VFe7tbShefT7/iXSx6qlN7t8R2iKg5Rm7d530oJDrmhkL8+PX Hk5zniRr0lBWnGAlTTVOXcwn4yl3E0i1g46PKVVO79FBZ9j+zAX1jp2Re7DSRzAHJa 3SCrNtzLv4PYqSi3TKDFHnbX62OXzOap2264rcVuU9qgd/FUWIHBYjTbpwzHncJtBl KpxyG+lyCiVbZNfcMPE3j2dljv5A1gahBjVdofzxbn3uMzLSvx8y6OwVk+FJ1Zpmpz +0cMzaxWscO4XQGjIo1+CJOLSELScMmRUAb3pm064rDEYSMishOuf6LdVs43zhkoqR 24LYCb3USt0iA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Simon Scherer , Paolo Bonzini , Michael Tokarev Subject: [Stable-11.1.3 33/73] target/i386: clear C1 for all x87 compare instructions Date: Sat, 17 Oct 2026 23:25:51 +0300 Message-ID: <20261017202638.728621-33-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269038687158500 Content-Type: text/plain; charset="utf-8" From: Simon Scherer The SDM specifies that FCOM/FCOMP/FCOMPP/FUCOM/FUCOMP/FUCOMPP/FICOM/FICOMP/ FCOMI/FCOMIP/FUCOMI/FUCOMIP unconditionally clear C1 in the FPU status word, regardless of the comparison result. helper_fcom_ST0_FT0/helper_fucom_ST0_FT0 only cleared C3, C2, C0 (mask 0x4500) before OR-ing in the comparison result, leaving C1 (bit 9) at whatever value it already had. FICOM/FICOMP dispatch through the same helpers after converting their integer operand, so they inherited the same bug. helper_fcomi_ST0_FT0/helper_fucomi_ST0_FT0 never touched the FPU status word at all, so C1 was left untouched by those too. This patch clears C1 explicitly in all four helpers, adding the clear into the existing fpus mask for fcom/fucom since fcom_ccval never sets bit 9. For fcomi/fucomi add a new separate clear. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4378 Signed-off-by: Simon Scherer Link: https://lore.kernel.org/r/20260828082235.128360-1-scherer.simon89@gma= il.com Signed-off-by: Paolo Bonzini (cherry picked from commit 6802a4b2391936ccb2ea0f76851bd1a43413b0b5) Signed-off-by: Michael Tokarev diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c index 58e46d8f5f..2149f4b1d2 100644 --- a/target/i386/tcg/fpu_helper.c +++ b/target/i386/tcg/fpu_helper.c @@ -538,7 +538,8 @@ void helper_fcom_ST0_FT0(CPUX86State *env) FloatRelation ret; =20 ret =3D floatx80_compare(ST0, FT0, &env->fp_status); - env->fpus =3D (env->fpus & ~0x4500) | fcom_ccval[ret + 1]; + /* C1 is unconditionally cleared to 0 */ + env->fpus =3D (env->fpus & ~0x4700) | fcom_ccval[ret + 1]; merge_exception_flags(env, old_flags); } =20 @@ -548,7 +549,8 @@ void helper_fucom_ST0_FT0(CPUX86State *env) FloatRelation ret; =20 ret =3D floatx80_compare_quiet(ST0, FT0, &env->fp_status); - env->fpus =3D (env->fpus & ~0x4500) | fcom_ccval[ret + 1]; + /* C1 is unconditionally cleared to 0 */ + env->fpus =3D (env->fpus & ~0x4700) | fcom_ccval[ret + 1]; merge_exception_flags(env, old_flags); } =20 @@ -563,6 +565,8 @@ void helper_fcomi_ST0_FT0(CPUX86State *env) /* OF, SF, and AF are unconditionally cleared to 0 */ CC_SRC =3D fcomi_ccval[ret + 1]; CC_OP =3D CC_OP_EFLAGS; + /* C1 is unconditionally cleared to 0 */ + env->fpus &=3D ~0x0200; merge_exception_flags(env, old_flags); } =20 @@ -575,6 +579,8 @@ void helper_fucomi_ST0_FT0(CPUX86State *env) /* OF, SF, and AF are unconditionally cleared to 0 */ CC_SRC =3D fcomi_ccval[ret + 1]; CC_OP =3D CC_OP_EFLAGS; + /* C1 is unconditionally cleared to 0 */ + env->fpus &=3D ~0x0200; merge_exception_flags(env, old_flags); } =20 --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269094; cv=none; d=zohomail.com; s=zohoarc; b=GMSI/F2TedB6dKv5AIrgCWDcLtAqtZcZdrm3HBDqOiarV/DrxySmFYSL5cJUAHQEcRFrPZcJVtEQzaMrY5+Aa+kBDJ2ahXRJx/0txLHSfPriKZADKYtgZGgJnl2Y8057qPHJ45irSjMSbWu4n7AW81czVYIJGO1VQ6JZkV08VT0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269094; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=qv9BuPaNIHJ2sdUe0aeNwGRWvppOyDu0qQhb0ahR2MQ=; b=QctCDpS6K85cyV9XLpk1vARpdm6rhYRA7GRgRT477vN9CBBBBZq8cPd2RkzQaXO0XvK+zYNVU40Y6G18tMchFOPaBQxxauzPI3urT89K9aIDiFjCOMlwRmw3316AtoHSWfF69yQOm/DWCEW7n4ZGW6B4mR0+YEFqLe7fp+Ruz7s= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269094018939.6236777241281; Sat, 17 Oct 2026 13:31:34 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB2u-00024n-Sp; Sat, 17 Oct 2026 16:30:25 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB2e-0001AH-Hh; Sat, 17 Oct 2026 16:30:08 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB2c-00045p-KB; Sat, 17 Oct 2026 16:30:08 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 0C4A51DE760; Sat, 17 Oct 2026 23:27:40 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 21AF5443434; Sat, 17 Oct 2026 23:27:38 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268860; bh=kSy8qByZo5EpHZO7ddzsJPghDf9UBDQl6HJfLiE4c6g=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=w2TT3chkvHTnjPaRiNfEAWVPwV0debw/BgQG93SYhIEeeaHneVykn5WOzmA/ydowI gUOYXfjcM1//b2s2UcxGLWTdHX7hEOXBLM34bPk6XVlZvWvm4nj4hDufQkX1XcYWR6 1VTtOPOplSIJtWHO1lRSXjXNQCFsCE2KdcnBrmhTsWJGm/m3lVzdPrkzOr4LnPeoiZ Mp+cRpJnKpzlhuCCQ+nL72mFnsOTVAxn7unU19HQOiEnm+Rvdqr3jZz1YKQBPX5b4y DaQaRF+1whN3N1vKkZ83lFiLCA9zG8fMMxVA8jCKpH/3TIIGP9oFk4jf4ffilAvN4i guSCH0PLRVcJw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Simon Scherer , Paolo Bonzini , Michael Tokarev Subject: [Stable-11.1.3 34/73] target/i386: Don't clear C1 for FCOMI/FCOMIP/FUCOMI/FUCOMIP Date: Sat, 17 Oct 2026 23:25:52 +0300 Message-ID: <20261017202638.728621-34-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269095763158500 Content-Type: text/plain; charset="utf-8" From: Simon Scherer Commit 6802a4b23919 ("target/i386: clear C1 for all x87 compare instructions") added an unconditional C1 clear to helper_fcomi_ST0_FT0() and helper_fucomi_ST0_FT0(), based on the SDM listing "C1 Set to 0" under FPU Flags Affected for FCOMI/FCOMIP/FUCOMI/FUCOMIP. Testing on real x86-64 Intel and AMD hardware shows these instructions leave C1 unchanged, unlike FCOM/FUCOM/FICOM. The SDM text appears to have been carried over from the FCOM/FUCOM description. Revert that part of the commit. The FCOM/FUCOM/FICOM changes are kept. Fixes: 6802a4b23919 ("target/i386: clear C1 for all x87 compare instruction= s") Signed-off-by: Simon Scherer Link: https://lore.kernel.org/r/20260911105811.16854-1-scherer.simon89@gmai= l.com Signed-off-by: Paolo Bonzini (cherry picked from commit 6d5fb14d36a6d11e88f04878021b2d99ce6c07e9) Signed-off-by: Michael Tokarev diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c index 2149f4b1d2..62f1c110e2 100644 --- a/target/i386/tcg/fpu_helper.c +++ b/target/i386/tcg/fpu_helper.c @@ -565,8 +565,6 @@ void helper_fcomi_ST0_FT0(CPUX86State *env) /* OF, SF, and AF are unconditionally cleared to 0 */ CC_SRC =3D fcomi_ccval[ret + 1]; CC_OP =3D CC_OP_EFLAGS; - /* C1 is unconditionally cleared to 0 */ - env->fpus &=3D ~0x0200; merge_exception_flags(env, old_flags); } =20 @@ -579,8 +577,6 @@ void helper_fucomi_ST0_FT0(CPUX86State *env) /* OF, SF, and AF are unconditionally cleared to 0 */ CC_SRC =3D fcomi_ccval[ret + 1]; CC_OP =3D CC_OP_EFLAGS; - /* C1 is unconditionally cleared to 0 */ - env->fpus &=3D ~0x0200; merge_exception_flags(env, old_flags); } =20 --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269051; cv=none; d=zohomail.com; s=zohoarc; b=HqiIh2VGHoNF3YM4n69o3vt+OllYuqFA0G/TACH6BXA71AOnUssgoOOZ7V6dh1zUcA8b/5LUeVxSEnM5cpNu8MER0KlQNqB72PxVUT8c9fZ/D27jZZaeKD2NC74pl+IBVZX9hSqsRx/ZHWC9Zjw/vKlmbsJG523gbGaicppqQTA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269051; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=s6D1Fd4nfvn9JAArMe01XL2yHBBczla/yGnGwOdfyEM=; b=fEqdKpq4mrHPmh8xgh1JUFlIZTY2K7LuKaKXsp7DVzPw/BWPXxJrHV72t1/vXMvzoFL82mKz1Uz0ly/V8HocaNPKa72OMpv5u9kGmTGz+PthAF299JrZORFVwwxcZWC78kHtywnaIO8uDfcqJ5X4rnaHKYTaSUwpuW0yzBQPps4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269051308372.8172875880199; Sat, 17 Oct 2026 13:30:51 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB35-0002nY-PH; Sat, 17 Oct 2026 16:30:38 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB2g-0001FQ-H9; Sat, 17 Oct 2026 16:30:10 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB2e-0004LJ-IM; Sat, 17 Oct 2026 16:30:10 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 1249C1DE761; Sat, 17 Oct 2026 23:27:41 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 3DCFC443435; Sat, 17 Oct 2026 23:27:40 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268861; bh=w6xqnxLBSVo6lOldPIc/C34Vg/LntVbPmhyW420qdmo=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=qNf4XuT72f8MWI6y/FlYnzU8rttNh+JHEIpEkXisexkshgEdc9g/Krqeg8NuU+ySN r6asQ1Q0Tx+ifWiRm4KzYFua/14nCFEmlt34aSQARfBfw79PEAcr5TXM1ncvgxQ0Y7 aAbvaHSVDlwKIjIruLRyYpM37GxNz6jkVa5RSu6Jfs0/Prj8Onh52U2GomLJUjWklM MccoR54a6sESauP1HJoJ4a+suDV/GTj8XQV58DKRtKnFU+oBATHMXxYN3yUl/u+GOf k0netgfh2ReasR0ZUtuxGCGe8yP+Z+KLr3sAwAtBODvQM1Vj7uQzBFgd4FQ7ODlhBP aqvGl+B6qlbSw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Maxim Levitsky , Jordy Zomer , Paolo Bonzini , Michael Tokarev Subject: [Stable-11.1.3 35/73] system: fix buffer overflow in tdx_parse_panic_message Date: Sat, 17 Oct 2026 23:25:53 +0300 Message-ID: <20261017202638.728621-35-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269052929158500 Content-Type: text/plain; charset="utf-8" From: Maxim Levitsky tdx_parse_panic_message has code that detects if the guest supplied message contains some unprintable characters and in this case prints a hex = dump. The code has a bug: it allocates 3 bytes for 'sprintf("%02x ")', but sprintf in this case actually writes at least 4 bytes, because it adds = the NULL terminator, or even 9 bytes if the char type is signed and the MSB is set. To fix this, just use qemu_hexdump_line instead. Reported-by: Jordy Zomer Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3905 Signed-off-by: Maxim Levitsky Link: https://lore.kernel.org/r/20260923004553.100732-1-mlevitsk@redhat.com Signed-off-by: Paolo Bonzini (cherry picked from commit b7f51182c08123eda612db553e2cded6e536ff49) Signed-off-by: Michael Tokarev diff --git a/system/runstate.c b/system/runstate.c index 08acf801b0..3c8693ccf3 100644 --- a/system/runstate.c +++ b/system/runstate.c @@ -50,6 +50,7 @@ #include "qemu/sockets.h" #include "qemu/timer.h" #include "qemu/thread.h" +#include "qemu/cutils.h" #include "qom/object.h" #include "qom/object_interfaces.h" #include "system/cpus.h" @@ -606,10 +607,9 @@ static void qemu_system_wakeup(void) } } =20 -static char *tdx_parse_panic_message(char *message) +static GString *tdx_parse_panic_message(char *message) { bool printable =3D false; - char *buf =3D NULL; int len =3D 0, i; =20 /* @@ -630,32 +630,11 @@ static char *tdx_parse_panic_message(char *message) } } =20 - if (len =3D=3D 0) { - buf =3D g_malloc(1); - buf[0] =3D '\0'; + if (printable) { + return g_string_new(message); } else { - if (!printable) { - /* 3 =3D length of "%02x " */ - buf =3D g_malloc(len * 3); - for (i =3D 0; i < len; i++) { - if (message[i] =3D=3D '\0') { - break; - } else { - sprintf(buf + 3 * i, "%02x ", message[i]); - } - } - if (i > 0) { - /* replace the last ' '(space) to NULL */ - buf[i * 3 - 1] =3D '\0'; - } else { - buf[0] =3D '\0'; - } - } else { - buf =3D g_strdup(message); - } + return qemu_hexdump_line(NULL, message, len, 1, 0); } - - return buf; } =20 void qemu_system_guest_panicked(GuestPanicInformation *info) @@ -700,12 +679,11 @@ void qemu_system_guest_panicked(GuestPanicInformation= *info) info->u.s390.psw_mask, info->u.s390.psw_addr); } else if (info->type =3D=3D GUEST_PANIC_INFORMATION_TYPE_TDX) { - char *message =3D tdx_parse_panic_message(info->u.tdx.message); + g_autoptr(GString) message =3D tdx_parse_panic_message(info->u= .tdx.message); qemu_log_mask(LOG_GUEST_ERROR, "\nTDX guest reports fatal error." " error code: 0x%" PRIx32 " error message:\"%s\"= \n", - info->u.tdx.error_code, message); - g_free(message); + info->u.tdx.error_code, message->str); if (info->u.tdx.has_gpa) { qemu_log_mask(LOG_GUEST_ERROR, "Additional error informati= on " "can be found at gpa page: 0x%" PRIx64 "\n", --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269202; cv=none; d=zohomail.com; s=zohoarc; b=AohaRrjyUz324EMFjoUyvOwQ/sFU6JY2kfBUdGrq3zb67gL+vI25x7S5rBZ9ZWVwaWCtvqgbxK00YRJmn3R09RKPkpOUkpv9KhWPXBUPWU7Wl3K2tt87K5R6051eqf2hhUJKjysIKteWMKodIdYoC2eP0YQl1nLu6HvxAIA8HCs= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269202; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=Z4nVC3TvWhuA0E58c+l69iBK5TVpwwypfptIPCYg+vE=; b=G5WaQHFN+JkGtaguiOUYvt4jsYuGErG6nUpY9v+llTc0PlnmJxo4I2Oa0qgJSnaitDABpHQRCzK+f/yck08e9q6QbXEurnYOjQrqOXfEXod77pHEuUr01ZfhxXFpzgLunN0KhCp2A5oDhXYNbJmCgiEscJ7K+VSKoNwAxRbGEuA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269202519850.2842929859816; Sat, 17 Oct 2026 13:33:22 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB3Q-00037c-JX; Sat, 17 Oct 2026 16:30:57 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB2i-0001Kn-5E; Sat, 17 Oct 2026 16:30:12 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB2g-0004Mc-1D; Sat, 17 Oct 2026 16:30:11 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 18BA01DE762; Sat, 17 Oct 2026 23:27:42 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 42FC1443436; Sat, 17 Oct 2026 23:27:41 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268862; bh=L20tvfnemR1NKG9kainYFOPkVI+ydc38FOPDGUdgSvw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Mh5UAOSo0OU6QGCpzRy3jxD9TP/CRtrjRDnAV9JAXIpfyR83Aw2+Wpu8znEk78Jgy 5p0FHBYbRs6s7XyqRLfZ8xLLvWzIT7ee3t/y5pblspAuWzNhJyR+54ryUhEQQI1I4M hhd7EMJnd3aFdd1VxP5S5OgAWi8HD5QzHKSEQEZuloezIx4RKmiO/PvBUAz+5MNrmR 9fCHa9SbQ+8rpK6KWK26lwh4A69nnpMcR5+jwQFXCb6yyKVObUeMvf0im+apcAu5eH KVMuSpvjT0Qsv+GoJdTgEYbcf/l5KaTcTTnTQjxjsQVyV8wf+b3e5ZMDnmbxUNWKJ3 ocKIxTJR8pW3w== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Maxim Levitsky , "Vulnerability Report" , Paolo Bonzini , Michael Tokarev Subject: [Stable-11.1.3 36/73] accel/kvm: protect kvm_resample_fd_list with a mutex Date: Sat, 17 Oct 2026 23:25:54 +0300 Message-ID: <20261017202638.728621-36-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269204043158500 Content-Type: text/plain; charset="utf-8" From: Maxim Levitsky Legacy PCI INTx interrupts are level triggered and can, in theory, be share= d. Upon receiving such an interrupt, VFIO kernel driver masks it in a generic = way, using INTX_DISABLE bit in the PCI config space. It then waits for the guest to signal completion (EOI) of the interrupt, upon which VFIO re-enables the interrupt. The completion is signaled with another eventfd. For split irqchip mode, KVM doesn't have a notion of EOI on IOAPIC level. Instead it signals EOI with a userspace VM exit, KVM_EXIT_IOAPIC_EOI. Upon receiving this VM exit, Qemu manually signals the above-mentioned even= tfd. The problem that this patch resolves is that QEMU keeps these eventfds in a linked list without any locking to prevent the list from being corrupted = by concurrent access. Such use is possible and guest triggerable if the guest rapidly toggles INTX mode of a VFIO device and at the same time signals EOI with an arbitra= ry vector. Fix this by protecting this list (kvm_resample_fd_list) with a mutex. This patch was only compile tested. Reported-by: "Vulnerability Report" Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3942 Signed-off-by: Maxim Levitsky Link: https://lore.kernel.org/r/20260923004651.101197-1-mlevitsk@redhat.com Signed-off-by: Paolo Bonzini (cherry picked from commit 0f98b46846eb04791f5f4c992d3441c8a8b48872) Signed-off-by: Michael Tokarev diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c index 83cbd120a8..da3afdc68d 100644 --- a/accel/kvm/kvm-all.c +++ b/accel/kvm/kvm-all.c @@ -146,6 +146,7 @@ typedef struct KVMResampleFd KVMResampleFd; static QLIST_HEAD(, KVMResampleFd) kvm_resample_fd_list =3D QLIST_HEAD_INITIALIZER(kvm_resample_fd_list); =20 +static QemuMutex kvm_resample_fd_list_lock; static QemuMutex kml_slots_lock; =20 #define kvm_slots_lock() qemu_mutex_lock(&kml_slots_lock) @@ -157,6 +158,8 @@ static inline void kvm_resample_fd_remove(int gsi) { KVMResampleFd *rfd; =20 + qemu_mutex_lock(&kvm_resample_fd_list_lock); + QLIST_FOREACH(rfd, &kvm_resample_fd_list, node) { if (rfd->gsi =3D=3D gsi) { QLIST_REMOVE(rfd, node); @@ -164,6 +167,8 @@ static inline void kvm_resample_fd_remove(int gsi) break; } } + + qemu_mutex_unlock(&kvm_resample_fd_list_lock); } =20 static inline void kvm_resample_fd_insert(int gsi, EventNotifier *event) @@ -173,20 +178,26 @@ static inline void kvm_resample_fd_insert(int gsi, Ev= entNotifier *event) rfd->gsi =3D gsi; rfd->resample_event =3D event; =20 + qemu_mutex_lock(&kvm_resample_fd_list_lock); QLIST_INSERT_HEAD(&kvm_resample_fd_list, rfd, node); + qemu_mutex_unlock(&kvm_resample_fd_list_lock); } =20 void kvm_resample_fd_notify(int gsi) { KVMResampleFd *rfd; =20 + qemu_mutex_lock(&kvm_resample_fd_list_lock); + QLIST_FOREACH(rfd, &kvm_resample_fd_list, node) { if (rfd->gsi =3D=3D gsi) { event_notifier_set(rfd->resample_event); trace_kvm_resample_fd_notify(gsi); - return; + break; } } + + qemu_mutex_unlock(&kvm_resample_fd_list_lock); } =20 /** @@ -2910,6 +2921,7 @@ static int kvm_init(AccelState *as, MachineState *ms) int type; =20 qemu_mutex_init(&kml_slots_lock); + qemu_mutex_init(&kvm_resample_fd_list_lock); =20 /* * On systems where the kernel can support different base page diff --git a/hw/intc/ioapic.c b/hw/intc/ioapic.c index 1b3f1e824a..1932b14642 100644 --- a/hw/intc/ioapic.c +++ b/hw/intc/ioapic.c @@ -248,7 +248,6 @@ void ioapic_eoi_broadcast(int vector) continue; } =20 -#ifdef CONFIG_KVM /* * When IOAPIC is in the userspace while APIC is still in * the kernel (i.e., split irqchip), we have a trick to @@ -264,8 +263,9 @@ void ioapic_eoi_broadcast(int vector) * operations below because we don't know whether there're * emulated devices that are using/sharing the same IRQ. */ - kvm_resample_fd_notify(n); -#endif + if (kvm_enabled()) { + kvm_resample_fd_notify(n); + } =20 if (!(entry & IOAPIC_LVT_REMOTE_IRR)) { continue; --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269497; cv=none; d=zohomail.com; s=zohoarc; b=VRIpw7/QwbNaQ8yCOEgfbZ5D0pBg1B0OhQ6OQkj16RyqiYVUL28nqSTJefM4pOa6weO2eqWWxNf5NTLuZA4pLRTnHjCTkPKO9h9kkha3Qliq75DUTuZPSrpjbt4oE5uDW1dbpt3I6cMK43UNEsWRBfEe1Mm3FZntZNFEwWsYOPk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269497; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=gR1aFBzhguv1hVEpq1jMYmrptdQNnRF2vHu1+hNqHtc=; b=BFh6A8aZlOMF1r9i5tMhomu9Cz46tEcRCOcwNUk5J0AsfDsubTKAm2tds8/OZMRZwXMW1FATCg8ssqUpkjLBS1p0WLS0oOw51X9Fjmq+955caqxjeMsVv8AKVeQrKKRjloER+F7rG7zP5qDKvJMf6cAPzciuSgVCz3b++oAN9eY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 179226949780170.34390310368804; Sat, 17 Oct 2026 13:38:17 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB3R-0003FQ-ID; Sat, 17 Oct 2026 16:30:57 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB2j-0001PJ-V7; Sat, 17 Oct 2026 16:30:14 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB2i-0004Mv-2o; Sat, 17 Oct 2026 16:30:13 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 30BB51DE763; Sat, 17 Oct 2026 23:27:43 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 4AAEC443437; Sat, 17 Oct 2026 23:27:42 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268863; bh=RRSkN6dmkYkm6sMTLPdZFn+BI7d5/T+OeuYo4GeinyE=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=cTYcHVovotm+BGO0DR87mMYbY5pHNgLOOaGywLIt0VBUYMeRMQJgSViwEdTdOzrXA qlkkKMGtbhefKSl1DSy9DzuOc6jA7ayuWlLCiKipkzY7K2rOm5BvU9eXTpPCm3nIz/ ubAbotW8ndJM1mGQSFAe/2MJ/L8b07HawLKwBzaSIXaLsqedu9plTs2Dza1y9Z8EVX eyXr3+HI0i5/JZdzOmTWr1q13L1ALMLZbKAs/z+YemiPeyPHV88XDRwyfoYB/1KXph BYgxjR/9SmUo4ulWRpFcNwQMJV/qchR01L7vHZFpqeH0d1efxgSZIsQ91o3gR/Fgd9 YPRn2tBr6kNpw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Maxim Levitsky , Paolo Bonzini , Michael Tokarev Subject: [Stable-11.1.3 37/73] accel/kvm: coalesced mmio: check lenght of the MMIO write entry Date: Sat, 17 Oct 2026 23:25:55 +0300 Message-ID: <20261017202638.728621-37-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269498744158500 Content-Type: text/plain; charset="utf-8" From: Maxim Levitsky KVM's coalesced mmio ring buffer has entries that contain deffered MMIO writes. Each such entry contains the length, an 8 byte value and a guest address. While the length value comes from the kernel, it is still possible for an attacker to corrupt the length field using another exploit. The attacker can then invoke kvm_flush_coalesced_mmio_buffer, which blindly trusts the length and can be used to inflict further damage. Add a sanity check on the length field to prevent this. This patch was only compile tested. Reported by: "Labs, STAR" Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3863 Signed-off-by: Maxim Levitsky Link: https://lore.kernel.org/r/20260923004631.100997-1-mlevitsk@redhat.com Signed-off-by: Paolo Bonzini (cherry picked from commit 12916d64b78ec5dd0171e607ad2ffcc34537f3cf) Signed-off-by: Michael Tokarev diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c index da3afdc68d..5433a223e3 100644 --- a/accel/kvm/kvm-all.c +++ b/accel/kvm/kvm-all.c @@ -3185,9 +3185,15 @@ void kvm_flush_coalesced_mmio_buffer(void) const AddressSpace *as; =20 ent =3D &ring->coalesced_mmio[ring->first]; - as =3D ent->pio =3D=3D 1 ? &address_space_io : &address_space_= memory; - address_space_write(as, ent->phys_addr, MEMTXATTRS_UNSPECIFIED, - ent->data, ent->len); + if (ent->len > sizeof(ent->data)) { + warn_report("coalesced MMIO entry has invalid len %u", + ent->len); + } else { + as =3D ent->pio =3D=3D 1 ? &address_space_io : &address_sp= ace_memory; + address_space_write(as, ent->phys_addr, MEMTXATTRS_UNSPECI= FIED, + ent->data, ent->len); + } + smp_wmb(); ring->first =3D (ring->first + 1) % KVM_COALESCED_MMIO_MAX; } --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269192; cv=none; d=zohomail.com; s=zohoarc; b=cJHGncC4nYWD4ZjN/DxowpW3gUmmkhuQ7sgZ7tIhkyiDJRQIHpLLtB6S0AcUyz14yAeslKOZPkRsB8Drz2+dZP9CBZ1OxQARsFq04cIWBZw46okaXJIuIW9MeFR3u+RDI+2IF5ZPGGLBExmmW5aqkFFv1AkNveXYrBIjCocA78A= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269192; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=42Ojtury0c+wE+IAX2nlrYwxzp1DzEqbkGFL3g2Vcc4=; b=KIii/N97nqf4IrNq0GAmXQZYKQclM95uzwJM6BdvBzuUdan/yOsfdpIibVJYO7gXdeQzkgVuK1syFB2k1Wb+41R/M5/69NEL2qhrZ1gL3bY8eV4Uf2EVP6cbe6qVHR4bfkeQ1xmRn8Ckxz9IfK4p+RMhivEkBCJVZjwmnjXuiBM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269192128433.6304665046381; Sat, 17 Oct 2026 13:33:12 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB4U-0003xT-U1; Sat, 17 Oct 2026 16:32:13 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB37-0002yT-9L; Sat, 17 Oct 2026 16:30:39 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB34-0004Nb-NK; Sat, 17 Oct 2026 16:30:36 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 5A97E1DE764; Sat, 17 Oct 2026 23:27:44 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 6287B443438; Sat, 17 Oct 2026 23:27:43 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268864; bh=CvLwwi4uvgQSvPkmItryGMf44tdYIJRG1Qv8MSrgFZ0=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Aas7y+MJqmBR+udfR4/y4hhubeT7PRUDc7xVaUU7Nr0ymhRfbhjdSJdWY8gOMFmty 2EPe2Tn4sauHjMPON+UKIiVBQ0XY+JgFCSZGOJ0Mb9Jz+dmqlUFZ81rXCYB1VejGTF QV9AQEMcLCZbyyygi8kwA/XnanoA4OVEpk5joDQKplt0AuYn7DgtILyTtY/8Px5Nkn tm+XYuKrNaczQJTnHpz5IlcBiz9TFNi09qmb7pPlmYFl7YkQP+sD5/X0pjQmD6l+lS wXPW5dfof/kgvFfv5YNCVRxnIdWFXNRlclMSB1bKIly9C0BNZyMwLV4LvAz9KuME4K Aa5Es65F4vQWQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Paolo Bonzini , Andrey Polivoda , Michael Tokarev Subject: [Stable-11.1.3 38/73] target/i386/tcg: ignore VEX.L for unary scalar instructions Date: Sat, 17 Oct 2026 23:25:56 +0300 Message-ID: <20261017202638.728621-38-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269193693158500 Content-Type: text/plain; charset="utf-8" From: Paolo Bonzini According to both Volume 2 of Intel 64 and IA-32 Architectures Software Developer's Manual and Volume 4 of AMD64 Architecture Programmer's Manual, VEX.L is a "don't care" bit for `VROUNDSS`, `VROUNDSD`, `VMOVSS`, `VMOVSD`. Currently, QEMU handles VEX.L with these instructions differently: - In the VMOVSS and VMOVSD case, VEX.L allows to select the register size (XMM or YMM), leading to differences between QEMU and the real hardware. - In `gen_VROUNDSS()` and `gen_VROUNDSD()`, there is an assert which checks that `s->vex_l` is not set. When either instruction is encountered with V= EX.L bit set, the QEMU process crashes with an assertion failure. These behaviors deviate from real hardware, and in VROUNDSS/VROUNDSD case, it also allows unprivileged guest userspace to crash the QEMU process itsel= f. Instead, always handle the instructions as if VEX.L=3D0. Reported-by: Andrey Polivoda Signed-off-by: Paolo Bonzini (cherry picked from commit a5b4837a253ed3944dd7d4419c52830079e221ec) Signed-off-by: Michael Tokarev diff --git a/target/i386/tcg/decode-new.c.inc b/target/i386/tcg/decode-new.= c.inc index da41c97e57..ebd2905cf4 100644 --- a/target/i386/tcg/decode-new.c.inc +++ b/target/i386/tcg/decode-new.c.inc @@ -260,6 +260,7 @@ #define svm(a) .intercept =3D SVM_EXIT_##a, .has_intercept =3D true, =20 #define avx2_256 .vex_special =3D X86_VEX_AVX2_256, +#define vex_lig .vex_special =3D X86_VEX_LIG, =20 #define P_00 1 #define P_66 (1 << PREFIX_DATA) @@ -996,8 +997,8 @@ static const X86OpEntry opcodes_0F3A[256] =3D { * For other unary operations such as VSQRTSx this is hidden by the "R= EPScalar" * value of vex_special, because the table lists the operand types of = VSQRTPx. */ - [0x0a] =3D X86_OP_ENTRY4(VROUNDSS, V,x, H,x, W,ss, vex3 cpuid(SSE41= ) p_66), - [0x0b] =3D X86_OP_ENTRY4(VROUNDSD, V,x, H,x, W,sd, vex3 cpuid(SSE41= ) p_66), + [0x0a] =3D X86_OP_ENTRY4(VROUNDSS, V,x, H,x, W,ss, vex3 vex_lig cpu= id(SSE41) p_66), + [0x0b] =3D X86_OP_ENTRY4(VROUNDSD, V,x, H,x, W,sd, vex3 vex_lig cpu= id(SSE41) p_66), [0x0c] =3D X86_OP_ENTRY4(VBLENDPS, V,x, H,x, W,x, vex4 cpuid(SSE4= 1) p_66), [0x0d] =3D X86_OP_ENTRY4(VBLENDPD, V,x, H,x, W,x, vex4 cpuid(SSE4= 1) p_66), [0x0e] =3D X86_OP_ENTRY4(VPBLENDW, V,x, H,x, W,x, vex4 cpuid(SSE4= 1) avx2_256 p_66), @@ -1053,8 +1054,8 @@ static void decode_0F10(DisasContext *s, CPUX86State = *env, X86OpEntry *entry, ui static const X86OpEntry opcodes_0F10_mem[4] =3D { X86_OP_ENTRY3(MOVDQ, V,x, None,None, W,x, vex4_unal), /* MO= VUPS */ X86_OP_ENTRY3(MOVDQ, V,x, None,None, W,x, vex4_unal), /* MO= VUPD */ - X86_OP_ENTRY3(VMOVSS_ld, V,x, H,x, M,ss, vex5), - X86_OP_ENTRY3(VMOVSD_ld, V,x, H,x, M,sd, vex5), + X86_OP_ENTRY3(VMOVSS_ld, V,x, H,x, M,ss, vex5 vex_lig), + X86_OP_ENTRY3(VMOVSD_ld, V,x, H,x, M,sd, vex5 vex_lig), }; =20 if ((get_modrm(s, env) >> 6) =3D=3D 3) { @@ -1076,8 +1077,8 @@ static void decode_0F11(DisasContext *s, CPUX86State = *env, X86OpEntry *entry, ui static const X86OpEntry opcodes_0F11_mem[4] =3D { X86_OP_ENTRY3(MOVDQ, W,x, None,None, V,x, vex4_unal), /* MOV= UPS */ X86_OP_ENTRY3(MOVDQ, W,x, None,None, V,x, vex4_unal), /* MOV= UPD */ - X86_OP_ENTRY3(VMOVSS_st, M,ss, None,None, V,x, vex5), - X86_OP_ENTRY3(VMOVLPx_st, M,sd, None,None, V,x, vex5), /* MOVSD */ + X86_OP_ENTRY3(VMOVSS_st, M,ss, None,None, V,x, vex5 vex_lig), + X86_OP_ENTRY3(VMOVLPx_st, M,sd, None,None, V,x, vex5 vex_lig), /* = MOVSD */ }; =20 if ((get_modrm(s, env) >> 6) =3D=3D 3) { @@ -2611,6 +2612,10 @@ static bool validate_vex(DisasContext *s, X86Decoded= Insn *decode) case X86_VEX_None: break; =20 + case X86_VEX_LIG: + s->vex_l =3D 0; + break; + case X86_VEX_REPScalar: /* * Instructions which differ between 00/66 and F2/F3 in the diff --git a/target/i386/tcg/decode-new.h b/target/i386/tcg/decode-new.h index 9282296900..25f7d2215e 100644 --- a/target/i386/tcg/decode-new.h +++ b/target/i386/tcg/decode-new.h @@ -263,6 +263,12 @@ typedef enum X86VEXSpecial { * operands, and thus handled by decode_op_size. */ X86_VEX_AVX2_256, + + /* + * Instructions that do not care about VEX.L; used for scalar operands= , because + * they *should* be used only with VEX.L=3D0 but may accept VEX.L=3D1 = on some machines. + */ + X86_VEX_LIG, } X86VEXSpecial; =20 =20 --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269373; cv=none; d=zohomail.com; s=zohoarc; b=FC7eAzo2YtNgXmiwB7Oes/3motgUCwPssrmJrC26/TdcYwU4Ivh2U0Bqn//2DexSBY9MiKCymooVXB1yhpyKL+xBIcNvmJ0u28AhElLexf3fdFwAcVrUPZQGG6gnHEc3R00W6XblfXh+oyuwA8eoTazTQ96bxGnvHBZEpXwS0VY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269373; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=DBobcP5HApr5x5wURBGvXVWE8fvuGb27slbTtfWwRfM=; b=SFxqMav/Gdy71Q/h1cpHEsY4oXUYjV86BJITXFM5MPJWPeHd6uSg6ad/8/QGKfPZvCgamrprCoMojHB2D0oFYNrJXqTzC51qor+pYqOWhRAXopujmwxAUpxqFJtZYRq4/uWITJTqDMfBcoPiPGY5Jl9fLrIkKVHzq8RYNBrmqts= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269373325581.2807757828115; Sat, 17 Oct 2026 13:36:13 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB4r-0004D6-4D; Sat, 17 Oct 2026 16:32:25 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB37-0002yV-CJ; Sat, 17 Oct 2026 16:30:39 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB35-0004No-Gl; Sat, 17 Oct 2026 16:30:37 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 4914A1DE765; Sat, 17 Oct 2026 23:27:45 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 8C286443439; Sat, 17 Oct 2026 23:27:44 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268865; bh=1H9UvdKFQ1LlgD4r2/lAWiiBPAGHHtfueMIQAT2Nk2E=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=ScO1i+Zj65pTovx7RqFctienyZJia74jm3IeQu38Y7y25NWLiSi00LcVLlCiWaTxU jGfcM8n/KBE/AVUG6FDX1a+oItasMUnDWb8euHifS5XibkVCNFFXZa5i9F6x+jd3Rr RPaQms7WcQwWnu4Tq0HOiYGY+9suCHtXyXTCTZ7K1VwrB1EdCjDM6Thi2btqQKDUlN HoprVeUDVUFBSCARgSlLePpvFRceVkarHoAK6Ns8rN1FSKsEfrQ8cOxhvWgC3d0NmE tghLpYjulNQB/oBoX3MKgNjWMh+vqQX/620rP9GyidPnFDW4T/P+69DMRIqXy1WlwH +nd1KTkjh5a3g== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Tommaso Califano , =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , Michael Tokarev Subject: [Stable-11.1.3 39/73] hw/usb: Fix USB MTP Use-After-Free in usb_mtp_deletefn List Iteration Date: Sat, 17 Oct 2026 23:25:57 +0300 Message-ID: <20261017202638.728621-39-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269374127158500 From: Tommaso Califano In QEMU's USB MTP (Media Transfer Protocol) device emulation, the usb_mtp_d= eletefn() function in hw/usb/dev-mtp.c iterates over a child object list using QLIST_= FOREACH while the recursive call may free the current element. After the free, the = macro reads the le_next field from freed memory to advance the iterator. Replace QLIST_FOREACH with QLIST_FOREACH_SAFE, which saves the next pointer= before the iteration body executes. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3991 Signed-off-by: Tommaso Califano Reviewed-by: Daniel P. Berrang=C3=A9 Signed-off-by: Daniel P. Berrang=C3=A9 (cherry picked from commit d198957674b3c2cf8b9437ba91304cc421b219bb) Signed-off-by: Michael Tokarev diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c index 1d8cfd32dc..c2d36a73cf 100644 --- a/hw/usb/dev-mtp.c +++ b/hw/usb/dev-mtp.c @@ -1152,7 +1152,7 @@ enum { =20 static int usb_mtp_deletefn(MTPState *s, MTPObject *o, uint32_t trans) { - MTPObject *iter, *iter2; + MTPObject *iter, *iter2, *iter2_next; int ret =3D 0; =20 /* @@ -1161,7 +1161,7 @@ static int usb_mtp_deletefn(MTPState *s, MTPObject *o= , uint32_t trans) =20 QLIST_FOREACH(iter, &o->children, list) { if (iter->format =3D=3D FMT_ASSOCIATION) { - QLIST_FOREACH(iter2, &iter->children, list) { + QLIST_FOREACH_SAFE(iter2, &iter->children, list, iter2_next) { ret |=3D usb_mtp_deletefn(s, iter2, trans); } } --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269619; cv=none; d=zohomail.com; s=zohoarc; b=mb1NmfDs/06C9cfzNdZrtXSz5kd55zUdqYkilZKdLJo0ACMZHBizOq6dB4j4lh6jZSvzgSllNDgI3D15VnvAIgEoGX0uOMpvxlvGOiLMzDEaDwJvsXyRUAkcLYzQyqK6MNzIPp8wwjCZSWXUI3aQnC454SiETmECweP/2bPyli4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269619; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=DSF8oiaRBtvsl69ULM5DaKV7mKAFxplCE+/uxGDFCjY=; b=VCS32g0ZqCd3k9YGYy2qlCT6m1ETIRpfHb34HmmLnUX2J2nsbU5HiDH9x52XrUAs4STRulHO5nhE7tIuIZtKoL3Iab+oa0mRtgarh2d4Qhzb8pZ/8vkTzXjFmxcbMkbEGG0fMQ+Sue5S8F5Tiz1WHPPq61NwwLuPfva+JqIvucQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269619812375.8818615827872; Sat, 17 Oct 2026 13:40:19 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB4s-0004SY-TV; Sat, 17 Oct 2026 16:32:27 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB3A-00030O-Ln; Sat, 17 Oct 2026 16:30:45 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB38-0004Pu-R0; Sat, 17 Oct 2026 16:30:40 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 52F151DE766; Sat, 17 Oct 2026 23:27:46 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 7CDB644343A; Sat, 17 Oct 2026 23:27:45 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268866; bh=nwB1xdWBMGqqpv7SNHt7/wunBA6PBNFhA4PvMJQvvQ0=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=T8MudmmTli/0n4SlndRIaAQniURKOKdQ4rQbQVFt+ovFZK3L99cjiPcraILClULGO U++77UqueYgMEGSMVdbC+dXV5l3sGqGXlZ/zoCKCWZXcWpRBhCRQTIDgopDAIcz4Z/ iRqJrR4htwTpNCL0hPbq0LzPX4xZGvseSQFKW3v9maEQ0yBhgFbl3WiOp/DTOB2RB3 gnao0ZsLisau1ga6EGdVts7tEBVjCEck62LRT+MntXO+lN8RsXb6ZDoTNBg1fgrWRD sFPsfc+yavy7B0ML1rS+pVuougY5qIVGj0jA3//ofANRL8otAKLpD38kgPYT5lKTdE BSllfr5V0PTbg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-11.1.3 40/73] io: prevent unbounded read of websocket data from client Date: Sat, 17 Oct 2026 23:25:58 +0300 Message-ID: <20261017202638.728621-40-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269621148158500 From: Daniel P. Berrang=C3=A9 The QIOChannelWebsock class wraps an underlying QIOChannel instance, providing a websocket server handshake and packet encoding/decoding. When a watch is added to QIOChannelWebsock, this in turn creates a watch on the underlying QIOChannel that is always monitoring G_IO_IN, as long as the 'encinput' buffer has space. When this watch fires, it reads data off the wire into 'encinput' and then decodes as much of 'encinput' as possible into the 'rawinput' buffer. The qio_channel_websock_set_watch method checks to see that 'encinput' does not exceed a max limit, but fails to check that 'rawinput' size. Since any data read into 'encinput', can usually be immediately decoded into 'rawinput', the 'encinput' size check is largely a no-op, and so 'rawinput' will grow without bound. This is readily seen with the chardev socket backend if enabling websockets, connecting a client that sends data, while not running any guest OS to consume data from the chardev via a virtual serial port. The qio_channel_websock_read_wire() method will also unconditionally read more data into 'encinput' if it has less than 4k present, which is then decoded into 'rawinput'. IOW, if qio_channel_websock_read_wire() is triggered for lots of small reads, it will be reading and decoding more data to 'rawinput' than is consumed. Skip reading more data if 'rawinput' is already at its max size. Reported-by: Aisle Research Fixes: CVE-2026-101291 Fixes: 2d1d0e70cf3e ("io: add QIOChannelWebsock class") Reviewed-by: Marc-Andr=C3=A9 Lureau Reviewed-by: Philippe Mathieu-Daud=C3=A9 Signed-off-by: Daniel P. Berrang=C3=A9 (cherry picked from commit 4668899d66159dd611cd6432f880d9610ce12771) Signed-off-by: Michael Tokarev diff --git a/io/channel-websock.c b/io/channel-websock.c index 461abcae48..646cd45be2 100644 --- a/io/channel-websock.c +++ b/io/channel-websock.c @@ -970,7 +970,8 @@ static ssize_t qio_channel_websock_read_wire(QIOChannel= Websock *ioc, { ssize_t ret; =20 - if (ioc->encinput.offset < 4096) { + if (ioc->encinput.offset < 4096 && + ioc->rawinput.offset < QIO_CHANNEL_WEBSOCK_MAX_BUFFER) { size_t want =3D 4096 - ioc->encinput.offset; =20 buffer_reserve(&ioc->encinput, want); @@ -1091,6 +1092,7 @@ static void qio_channel_websock_set_watch(QIOChannelW= ebsock *ioc) cond |=3D G_IO_OUT; } if (ioc->encinput.offset < QIO_CHANNEL_WEBSOCK_MAX_BUFFER && + ioc->rawinput.offset < QIO_CHANNEL_WEBSOCK_MAX_BUFFER && !ioc->io_eof) { cond |=3D G_IO_IN; } --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269520; cv=none; d=zohomail.com; s=zohoarc; b=iN5zQmML47MjsaU1Ro/22Bg2JKznkjhuNHhkguPNiW16/i5gI3a1wIPTEipfNnc0e9ih9nFTs3dCmOS6FvxQVC1LcX3auNYB4OD077ztBRzm85qUuLUUO+C0fWOEeUodA8oBYLwRKWYeOG3N7KhyzerqSTgy1JzzIGpLhANciL0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269520; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=dY7XOAubEigO8WLY6g5pTnmWXQMElTnwu35o6F8pAJQ=; b=TqeMrAQpevrgfKjJSoN+jnX4jU0zq1RWT6xK9MaO6eXW4cgaEB46EM77XMMzPHOpio2OrzwS5H5zQwhPBkZT/eEXN0Pz8qOPBxlBsnFaTqz0R3/YHM5UXK/T/qX0TYScOoQVNeg+HyZA5V28AwRcwYzn7hx9l3oquDvWXhgYIsk= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269520209738.4415617048726; Sat, 17 Oct 2026 13:38:40 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB5V-0005SQ-H0; Sat, 17 Oct 2026 16:33:05 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB3A-00032V-Rh; Sat, 17 Oct 2026 16:30:46 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB38-0004Py-VH; Sat, 17 Oct 2026 16:30:40 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id C308D1DE767; Sat, 17 Oct 2026 23:27:47 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 83C5644343B; Sat, 17 Oct 2026 23:27:46 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268867; bh=n9ggVkRFD36M05i6I5ZiDf0rZoJ6NrBRyPhT6tS0uYk=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=bvhtm5l2VC3YIwc7jmiwtyRMpNCkZStTlcMtbApRV9ogtdunI1MpR+9UZXNrxJMtE zhs2SwfEtEr3D/h/2s3HOjRKHWnVK0AtA5DzhSJV6mx8veNHahVaeDFX4zWOCxII7D EN0J93eadHDWb8dqGF8KH3Wk7x2pzqOKTx8XuRuDSLJiIn8z6WnfdFP5UTX6IaJCV2 Su+MW2iKFmt5gF5pmVQcd2ULuZzDvw2JNTSoEh474RUCL2rAQ06SIIqKtc3xk5zFcP QmHP7obVqR7siPeoCpAPBfWiO9SJ5+oUyjxH87/IzO1y9vVG8vZ8svEHaA2rHT10hk 8mH8Q38KDKLVA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, "Denis V. Lunev" , Kevin Wolf , Hanna Reitz , Alberto Garcia , Michael Tokarev Subject: [Stable-11.1.3 41/73] block/throttle-groups: fix crash when enabling I/O limits on a busy disk Date: Sat, 17 Oct 2026 23:25:59 +0300 Message-ID: <20261017202638.728621-41-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269521124158500 Content-Type: text/plain; charset="utf-8" From: "Denis V. Lunev" throttle_group_register_tgm() stores tgm->throttle_state before it takes tg->lock, so the I/O path can see a member whose group still has NULL tokens[] and an empty member list. A request in an iothread then reaches throttle_group_co_io_limits_intercept(), wins tg->lock ahead of the registering thread, and next_throttle_token() passes the NULL token to throttle_group_next_tgm(), which dereferences it: throttle_group_next_tgm (tgm=3D0x0) at block/throttle-groups.c:185 next_throttle_token (tgm=3D..., direction=3DTHROTTLE_READ) throttle_group_co_io_limits_intercept (tgm=3D..., bytes=3D8192, ...) blk_co_do_preadv_part (blk=3D..., offset=3D..., bytes=3D8192, ...) blk_aio_read_entry (opaque=3D...) coroutine_trampoline (i0=3D..., i1=3D...) blk_io_limits_enable() does not drain the BlockBackend, unlike its disable counterpart, so nothing keeps requests away while the group is built. A guest probing a disk that libvirt has just attached, at the moment the QoS settings for it are applied, is enough to hit this. Publish tgm->throttle_state with a release store once the member is linked into the group and its timers exist, and read it with an acquire load on the two unlocked I/O paths. A request that sees the new pointer then also sees a fully built group. Cc: Kevin Wolf Cc: Hanna Reitz Cc: Alberto Garcia Signed-off-by: Denis V. Lunev Message-ID: <20260908145554.3215221-2-den@openvz.org> Reviewed-by: Kevin Wolf Acked-by: Alberto Garcia Signed-off-by: Kevin Wolf (cherry picked from commit 429bf66a1f235847af89f7ef91d71b9c47b73892) Signed-off-by: Michael Tokarev diff --git a/block/block-backend.c b/block/block-backend.c index 37ba7e9fc4..5e59bac1a3 100644 --- a/block/block-backend.c +++ b/block/block-backend.c @@ -1338,6 +1338,7 @@ blk_co_do_preadv_part(BlockBackend *blk, int64_t offs= et, int64_t bytes, QEMUIOVector *qiov, size_t qiov_offset, BdrvRequestFlags flags) { + ThrottleGroupMember *tgm =3D &blk->public.throttle_group_member; int ret; BlockDriverState *bs; IO_CODE(); @@ -1357,9 +1358,8 @@ blk_co_do_preadv_part(BlockBackend *blk, int64_t offs= et, int64_t bytes, bdrv_inc_in_flight(bs); =20 /* throttling disk I/O */ - if (blk->public.throttle_group_member.throttle_state) { - throttle_group_co_io_limits_intercept(&blk->public.throttle_group_= member, - bytes, THROTTLE_READ); + if (qatomic_load_acquire(&tgm->throttle_state)) { + throttle_group_co_io_limits_intercept(tgm, bytes, THROTTLE_READ); } =20 ret =3D bdrv_co_preadv_part(blk->root, offset, bytes, qiov, qiov_offse= t, @@ -1413,6 +1413,7 @@ blk_co_do_pwritev_part(BlockBackend *blk, int64_t off= set, int64_t bytes, QEMUIOVector *qiov, size_t qiov_offset, BdrvRequestFlags flags) { + ThrottleGroupMember *tgm =3D &blk->public.throttle_group_member; int ret; BlockDriverState *bs; IO_CODE(); @@ -1431,9 +1432,8 @@ blk_co_do_pwritev_part(BlockBackend *blk, int64_t off= set, int64_t bytes, =20 bdrv_inc_in_flight(bs); /* throttling disk I/O */ - if (blk->public.throttle_group_member.throttle_state) { - throttle_group_co_io_limits_intercept(&blk->public.throttle_group_= member, - bytes, THROTTLE_WRITE); + if (qatomic_load_acquire(&tgm->throttle_state)) { + throttle_group_co_io_limits_intercept(tgm, bytes, THROTTLE_WRITE); } =20 if (!blk->enable_write_cache) { diff --git a/block/throttle-groups.c b/block/throttle-groups.c index 805e47270c..faf74a969d 100644 --- a/block/throttle-groups.c +++ b/block/throttle-groups.c @@ -581,7 +581,6 @@ void throttle_group_register_tgm(ThrottleGroupMember *t= gm, ThrottleState *ts =3D throttle_group_incref(groupname); ThrottleGroup *tg =3D container_of(ts, ThrottleGroup, ts); =20 - tgm->throttle_state =3D ts; tgm->aio_context =3D ctx; qatomic_set(&tgm->restart_pending, 0); =20 @@ -602,6 +601,9 @@ void throttle_group_register_tgm(ThrottleGroupMember *t= gm, read_timer_cb, write_timer_cb, tgm); + + /* The I/O path reads this without tg->lock, so publish it last */ + qatomic_store_release(&tgm->throttle_state, ts); } =20 /* Unregister a ThrottleGroupMember from its group, removing it from the l= ist, --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269370; cv=none; d=zohomail.com; s=zohoarc; b=KUZEDMKKL2CfZVrsojbo1QeOAHncxofbKawjRS/qZr0JfdrQbiBaT3rYj/CxeIJxAC04ev3+2xWRwN9dw1sFSA1Q0ZaSgrzca740a/rjC5vt1kL9ULWFBLrsxz/dYxjs4BT/kN+yej+eafyehN9UCoQFK7bSyDc1djHD3O1woio= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269370; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=AJHXF7CJJ0YFe/udqaQ2xOu3x8yT+E71L3Cx4ERfre0=; b=fnRaN3GSKkDriSjLptEtX0aNdYc5fg7ONZauPXaruRTISg5sFyLk/jSb0FadKokifCPwPTHBLxgpVTZ0ZDkwDdps8xBzVPVGToimRLUgbwntPuSh/9leIh5LnEyzHYs1vhP8Tu3JiMiQqK9zpwf1Wj8b7w0TxZeM8MbCTJ+XXmM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269370317506.3704152885301; Sat, 17 Oct 2026 13:36:10 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB4w-0004mM-Mw; Sat, 17 Oct 2026 16:32:30 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB3D-00034Z-QR; Sat, 17 Oct 2026 16:30:51 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB3C-0004QN-1V; Sat, 17 Oct 2026 16:30:43 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id C915F1DE768; Sat, 17 Oct 2026 23:27:48 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 18C2D44343C; Sat, 17 Oct 2026 23:27:47 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268868; bh=OgsVklhjDNXPnxKmHk392UVfmei76G0ZLO49VF26qg8=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=hUe8TAdrlqx7EAQ3OR7i/UfqWXMsTnd5klansv2J8PamSGbTfdfxkeQVEE3ryHGeA aQJHM5H3cVbgO4/PCOVVBsB+lkrpMg4mPqL86uPTkKuvu3+XPc3cKuSuYObjuCbne7 JAzHlU56fISW5xy6IxAnWoUdCnWE44tKRIUG76AkBaJXxjUChGuhXqQf5Pj8cejjzM KyZBc3wiz19cTKaQ/9UXvfdzlzPgmbrNHmLmnnW8F2TVuhesOhdg0LlypNPmNiak1O RwzFB5mJynyM7r5PqfHSzgjKgnRzNjz3A6fi1VG1Vm7SmUxGKPUUlWuyWybK1IWyq8 2dG9F4dEk+LXA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, "Denis V. Lunev" , Stefan Hajnoczi , Michael Tokarev Subject: [Stable-11.1.3 42/73] iotests: cover inactivating a read-only node Date: Sat, 17 Oct 2026 23:26:00 +0300 Message-ID: <20261017202638.728621-42-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269372159158500 Content-Type: text/plain; charset="utf-8" From: "Denis V. Lunev" A driver which writes something out on .bdrv_inactivate has nothing to write for a node it can not write to, and has to answer such a request with success rather than with the error its refused write produces. The test inactivates nodes in several ways and never a read-only one, so nothing caught that. Add a read-only node and take it through a deactivation and back. The case is generic, as every driver implementing the handler has to answer the same way. Cc: Stefan Hajnoczi Signed-off-by: Denis V. Lunev (cherry picked from commit 2910b995f6c8afd3eaa950e24432a0e044274ac5) Signed-off-by: Michael Tokarev diff --git a/tests/qemu-iotests/tests/inactive-node-nbd b/tests/qemu-iotest= s/tests/inactive-node-nbd index 664157bfd0..24242265b1 100755 --- a/tests/qemu-iotests/tests/inactive-node-nbd +++ b/tests/qemu-iotests/tests/inactive-node-nbd @@ -47,6 +47,7 @@ def node_is_active(_vm, node_name): return node['active'] =20 with iotests.FilePath('disk.img') as path, \ + iotests.FilePath('ro.img') as ro_path, \ iotests.FilePath('snap.qcow2') as snap_path, \ iotests.FilePath('snap2.qcow2') as snap2_path, \ iotests.FilePath('target.img') as target_path, \ @@ -58,6 +59,7 @@ with iotests.FilePath('disk.img') as path, \ iotests.log('Preparing disk...') iotests.qemu_img_create('-f', iotests.imgfmt, path, img_size) iotests.qemu_img_create('-f', iotests.imgfmt, target_path, img_size) + iotests.qemu_img_create('-f', iotests.imgfmt, ro_path, img_size) =20 iotests.qemu_img_create('-f', 'qcow2', '-b', path, '-F', iotests.imgfm= t, snap_path) @@ -70,6 +72,9 @@ with iotests.FilePath('disk.img') as path, \ 'active=3Doff') vm.add_blockdev(f'file,node-name=3Dtarget-file,filename=3D{target_path= }') vm.add_blockdev(f'{iotests.imgfmt},file=3Dtarget-file,node-name=3Dtarg= et-fmt') + vm.add_blockdev(f'file,node-name=3Dro-file,filename=3D{ro_path},read-o= nly=3Don') + vm.add_blockdev(f'{iotests.imgfmt},file=3Dro-file,node-name=3Dro-fmt,' + 'read-only=3Don') vm.add_blockdev(f'file,node-name=3Dsnap-file,filename=3D{snap_path}') vm.add_blockdev(f'file,node-name=3Dsnap2-file,filename=3D{snap2_path}') =20 @@ -289,6 +294,15 @@ with iotests.FilePath('disk.img') as path, \ iotests.log(qemu_io.cmd('map'), filters=3D[filter_qemu_io]) qemu_io.close() =20 + iotests.log('\n=3D=3D=3D Inactivating a read-only node =3D=3D=3D') + + # A driver which writes something out on inactivation has nothing to + # write for a node it can not write to, and must not fail the request + vm.qmp_log('blockdev-set-active', node_name=3D'ro-fmt', active=3DFalse) + iotests.log('ro-fmt active: %s' % node_is_active(vm, 'ro-fmt')) + vm.qmp_log('blockdev-set-active', node_name=3D'ro-fmt', active=3DTrue) + iotests.log('ro-fmt active: %s' % node_is_active(vm, 'ro-fmt')) + iotests.log('\n=3D=3D=3D Resuming VM activates all images =3D=3D=3D') vm.qmp_log('cont') =20 diff --git a/tests/qemu-iotests/tests/inactive-node-nbd.out b/tests/qemu-io= tests/tests/inactive-node-nbd.out index a458b4fc05..3c43020053 100644 --- a/tests/qemu-iotests/tests/inactive-node-nbd.out +++ b/tests/qemu-iotests/tests/inactive-node-nbd.out @@ -227,6 +227,14 @@ discard failed: Operation not permitted qemu-io: Failed to get allocation status: Operation not permitted =20 =20 +=3D=3D=3D Inactivating a read-only node =3D=3D=3D +{"execute": "blockdev-set-active", "arguments": {"active": false, "node-na= me": "ro-fmt"}} +{"return": {}} +ro-fmt active: False +{"execute": "blockdev-set-active", "arguments": {"active": true, "node-nam= e": "ro-fmt"}} +{"return": {}} +ro-fmt active: True + =3D=3D=3D Resuming VM activates all images =3D=3D=3D {"execute": "cont", "arguments": {}} {"return": {}} --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269565; cv=none; d=zohomail.com; s=zohoarc; b=ADltAsE+YoZiCoFy1gTwsXzxUq4R6gtoCKF8c8sbGEIA4QiHKAbRMHODTfVZOZ2w0W+eqOftITiiiy+1tywH9EzNeF39Pbc51mvLrS7TaMC6yx2WeB35k3ywcTED8jVCSxxqIkwuut7gBL8s6rSlmwmI8OEls58mgzgeY7nbwas= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269565; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=zcR5mGI/f2DrY+r9Z1hIVpoZ9ijXaR9t/MYfoW7N+Og=; b=O6Gfj03nCCvipodBKHxhdLWGziP675oCQC92GKaHqN0iCiiTeSomFkKFMHRO/Haws+n6ZpQsxXcoN8Cib/tmR5poQ8XkUO8uYlF8Q1X8ZPD9hi/0Bqr59sfJbkqxr+1Tr74E+pAqXz0/5ujEnZRWTF8r8T0s/pRq8Xwb1dYr4zI= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269565182838.4154189840256; Sat, 17 Oct 2026 13:39:25 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB52-00050b-LO; Sat, 17 Oct 2026 16:32:48 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB3Y-0003Qw-8L; Sat, 17 Oct 2026 16:31:09 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB3W-0004QS-A6; Sat, 17 Oct 2026 16:31:04 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id CEBF11DE769; Sat, 17 Oct 2026 23:27:49 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 0790444343D; Sat, 17 Oct 2026 23:27:48 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268869; bh=T9z8T1gpQIEuWmR14yqYEY/a+QPXaJdnyRekXUMSJoA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=N6LP6Od84LqaR6bmkFUQ6hDyvC2dlv4Z2WadmEmXS3w/hQ/gIJDAzvGL49zqPL0UE ishM+Sx4Uk3lAjKIRHASht3ROYwcfxq2hiz9ARmfXeiD+Sw9lMsfyk1PkoxaOGXlUZ mGPiKDGH/uwXAQkrW5uNEn2LyWYeIfT7cmKYRM+Txpiu+ULx1ZebKsVW9XImwe51U9 R+xQea+xbJ6JpFLsGzelPYaG/PlP4WS8BasgsS6NPQi+FSpvfrxOzAx5CgJTtd/4YH It5UthVQpoagO7bPr1mD62r+jg0KJ4I/Cz5j6mjwOQdjqvRHkvTYR9ycjPjDkZetz2 3V4s2p7Jkjleg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, "Denis V. Lunev" , Fiona Ebner , Kevin Wolf , Michael Tokarev Subject: [Stable-11.1.3 43/73] block: fix bdrv_next() skipping monitor-owned nodes Date: Sat, 17 Oct 2026 23:26:01 +0300 Message-ID: <20261017202638.728621-43-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269566273158500 Content-Type: text/plain; charset="utf-8" From: "Denis V. Lunev" it->bs is the cursor into monitor_bdrv_states for the second phase of bdrv_next(), so it has to be NULL when that phase starts. Commit f6d38c9f6d made the first phase store the node it returns there, to unreference the right one when the graph changes underneath. The cursor is now left pointing at the last BlockBackend root, so the second phase resumes from there instead of from the head of the list and never returns a node added before it. A skipped node drops out of the vm_stop and migration handover paths: not flushed, not inactivated, not snapshotted. bdrv_inactivate_all() still reports success, so the node keeps its image lock and the migration target cannot open the image. Only detached nodes are hit in practice, as these callers also recurse into children. Reset the cursor when the second phase starts. old_bs is taken at the top of the function, so f6d38c9f6d keeps working. Cc: qemu-stable@nongnu.org Fixes: f6d38c9f6d ("block-backend: fix edge case in bdrv_next() where BDS a= ssociated to BB changes") Signed-off-by: Denis V. Lunev Cc: Fiona Ebner Cc: Kevin Wolf Message-ID: <20260828222005.2888213-1-den@openvz.org> Reviewed-by: Fiona Ebner Tested-by: Fiona Ebner Reviewed-by: Kevin Wolf Signed-off-by: Kevin Wolf (cherry picked from commit 8daaf8d3b1c5f2ef98e526e036277083bc5fe34b) Signed-off-by: Michael Tokarev diff --git a/block/block-backend.c b/block/block-backend.c index 5e59bac1a3..ab837fac92 100644 --- a/block/block-backend.c +++ b/block/block-backend.c @@ -625,6 +625,7 @@ BlockDriverState *bdrv_next(BdrvNextIterator *it) return bs; } it->phase =3D BDRV_NEXT_MONITOR_OWNED; + it->bs =3D NULL; } =20 /* Then return the monitor-owned BDSes without a BB attached. Ignore a= ll diff --git a/tests/qemu-iotests/tests/inactive-node-nbd b/tests/qemu-iotest= s/tests/inactive-node-nbd index 24242265b1..bb6ee5c75a 100755 --- a/tests/qemu-iotests/tests/inactive-node-nbd +++ b/tests/qemu-iotests/tests/inactive-node-nbd @@ -48,6 +48,7 @@ def node_is_active(_vm, node_name): =20 with iotests.FilePath('disk.img') as path, \ iotests.FilePath('ro.img') as ro_path, \ + iotests.FilePath('detached.img') as detached_path, \ iotests.FilePath('snap.qcow2') as snap_path, \ iotests.FilePath('snap2.qcow2') as snap2_path, \ iotests.FilePath('target.img') as target_path, \ @@ -60,6 +61,7 @@ with iotests.FilePath('disk.img') as path, \ iotests.qemu_img_create('-f', iotests.imgfmt, path, img_size) iotests.qemu_img_create('-f', iotests.imgfmt, target_path, img_size) iotests.qemu_img_create('-f', iotests.imgfmt, ro_path, img_size) + iotests.qemu_img_create('-f', iotests.imgfmt, detached_path, img_size) =20 iotests.qemu_img_create('-f', 'qcow2', '-b', path, '-F', iotests.imgfm= t, snap_path) @@ -70,6 +72,9 @@ with iotests.FilePath('disk.img') as path, \ vm.add_blockdev(f'file,node-name=3Ddisk-file,filename=3D{path}') vm.add_blockdev(f'{iotests.imgfmt},file=3Ddisk-file,node-name=3Ddisk-f= mt,' 'active=3Doff') + vm.add_blockdev(f'file,node-name=3Ddetached-file,filename=3D{detached_= path}') + vm.add_blockdev(f'{iotests.imgfmt},file=3Ddetached-file,' + 'node-name=3Ddetached-fmt') vm.add_blockdev(f'file,node-name=3Dtarget-file,filename=3D{target_path= }') vm.add_blockdev(f'{iotests.imgfmt},file=3Dtarget-file,node-name=3Dtarg= et-fmt') vm.add_blockdev(f'file,node-name=3Dro-file,filename=3D{ro_path},read-o= nly=3Don') @@ -311,6 +316,17 @@ with iotests.FilePath('disk.img') as path, \ iotests.log('snap2-fmt active: %s' % node_is_active(vm, 'snap2-fmt')) iotests.log('target-fmt active: %s' % node_is_active(vm, 'target-fmt')) =20 + iotests.log('\n=3D=3D=3D Inactivating all nodes at once =3D=3D=3D') + + # detached-fmt has no parent and no BlockBackend, so nothing can reach= it + # by recursion. It is only inactivated if bdrv_next() actually returns= it. + vm.qmp_log('stop') + vm.qmp_log('blockdev-set-active', active=3DFalse) + + iotests.log('detached-fmt active: %s' % node_is_active(vm, 'detached-f= mt')) + iotests.log('detached-file active: %s' + % node_is_active(vm, 'detached-file')) + iotests.log('\nShutting down...') vm.shutdown() log =3D vm.get_log() diff --git a/tests/qemu-iotests/tests/inactive-node-nbd.out b/tests/qemu-io= tests/tests/inactive-node-nbd.out index 3c43020053..28b1322554 100644 --- a/tests/qemu-iotests/tests/inactive-node-nbd.out +++ b/tests/qemu-iotests/tests/inactive-node-nbd.out @@ -243,5 +243,13 @@ snap-fmt active: True snap2-fmt active: True target-fmt active: True =20 +=3D=3D=3D Inactivating all nodes at once =3D=3D=3D +{"execute": "stop", "arguments": {}} +{"return": {}} +{"execute": "blockdev-set-active", "arguments": {"active": false}} +{"return": {}} +detached-fmt active: False +detached-file active: False + Shutting down... =20 --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269544; cv=none; d=zohomail.com; s=zohoarc; b=hfyrJa4WpJhTewp+laf19mnAdKW4dCLIVPBQjJ6v+9qgwVgONbArt23XQ/PnwwCHeywAMYnoFuvcYLL79QPUaf2X/Kzkz1euHK8nekfnCChndHd8gYn/wHoy66hRtbvgL1bWd46YYWoaF0OTQfNjsBo6UGMd1KSeSRbcMPS5YA4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269544; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=uMVrbICrKTEMBgMxW2dHMuDDsufmIe4wZf/Nx3uG4ts=; b=lnQ90B59xfLoMBxz1CBvwZEbc/Un3xj380MqTXPXkyNgsB1uXq53wvDmCIusgRRG2PoozYOMSziJomO3NzviaZ069zpV6yW6x36kfhrQFMoHBA49BQ2Y3pKiu9r7HMwOJew3zo/tbM8wnKCjiXUUpfxV4Kxj/bJR8VdLGnz6ZQI= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269544817608.9106946938805; Sat, 17 Oct 2026 13:39:04 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB4v-0004b4-9H; Sat, 17 Oct 2026 16:32:29 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB3b-0003RV-FG; Sat, 17 Oct 2026 16:31:11 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB3Z-0004Qs-JL; Sat, 17 Oct 2026 16:31:07 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 902231DE76A; Sat, 17 Oct 2026 23:27:51 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 3D88944343E; Sat, 17 Oct 2026 23:27:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268871; bh=PWtl38TnxT/y+FQhj3emjXxsiygqWkfHDoqX9IZ/2zU=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=fzt2SWjpE4SbWivT4xHPnTWXCc4qm266hIMWzRtY1Za4B5H8HU/g1YRmGdhjtJqG5 jMvQC7K1YmNhxJAc4R2FHtIH4EEir4HeLvVuMEejJzH/t0l759L5HqIUuZPpgMImGn JLikItnnTdPEEwtgYaU3YjySJRuwv18iAdbno8zu5dn+/2GJwx+z2HKkSQiwcaKlla P+4zNEU5gu9Of9n/GqPMLgQhb+TgTUEYvGevvA0EY1RVwRJCIPtR8eCF2rZd0DWCsH SE1hEcv/7jgrWcOoFFd/Ch7HDIV21C9AYcum/vFE6t3nuljXPkz6qnc7FOrejjuHeS 7voY2JR1nsVZw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Stefan Hajnoczi , Eric Biggers , Ben Chaney , Kevin Wolf , Michael Tokarev Subject: [Stable-11.1.3 44/73] file-posix: add statx(STATX_DIOALIGN) support Date: Sat, 17 Oct 2026 23:26:02 +0300 Message-ID: <20261017202638.728621-44-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269545636158500 Content-Type: text/plain; charset="utf-8" From: Stefan Hajnoczi Linux v6.1 commit 825cf206ed51 ("statx: add direct I/O alignment information") added an interface to fetch O_DIRECT alignment values for block devices and file systems. Prefer STATX_DIOALIGN to older interfaces and probing, but keep them as fallbacks in case STATX_DIOALIGN cannot provide the information. STATX_DIOALIGN support as of Linux 6.1: - btrfs: no - ext4: yes - XFS: yes - block devices: yes - dm-crypt: yes This change fixes #1290 ("IO alignment probing delivers incorrect results on Linux when used with e.g. dm-crypt") on Linux host kernel version 6.1 or later by avoiding the problematic probing code in raw_probe_alignment(). It would be nice to fix the probing code but I have not been able to reproduce it. Stable/LTS distros ship Linux 6.1+, so the number of users without STATX_DIOALIGN is becoming small. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/1290 Cc: Eric Biggers Signed-off-by: Stefan Hajnoczi Message-ID: <20260922154351.226540-1-stefanha@redhat.com> Reviewed-by: Ben Chaney Reviewed-by: Kevin Wolf Signed-off-by: Kevin Wolf (cherry picked from commit 196a50b0902b0951ce331212f7bcf109de832b5f) Signed-off-by: Michael Tokarev diff --git a/block/file-posix.c b/block/file-posix.c index 3c985da94f..90c086f1f8 100644 --- a/block/file-posix.c +++ b/block/file-posix.c @@ -426,28 +426,48 @@ static void raw_probe_alignment(BlockDriverState *bs,= int fd, Error **errp) =20 bs->bl.request_alignment =3D 0; s->buf_align =3D 0; - /* Let's try to use the logical blocksize for the alignment. */ - if (probe_logical_blocksize(fd, &bs->bl.request_alignment) < 0) { - bs->bl.request_alignment =3D 0; - } =20 -#ifdef __linux__ +#if defined(__linux__) && defined(STATX_DIOALIGN) + struct statx stx; + /* - * The XFS ioctl definitions are shipped in extra packages that might - * not always be available. Since we just need the XFS_IOC_DIOINFO ioc= tl - * here, we simply use our own definition instead: + * Linux 6.1 introduced an interface for both block devices and file + * systems. The system call returns with the STATX_DIOALIGN bit cleared + * when the information is unavailable. */ - struct xfs_dioattr { - uint32_t d_mem; - uint32_t d_miniosz; - uint32_t d_maxiosz; - } da; - if (ioctl(fd, _IOR('X', 30, struct xfs_dioattr), &da) >=3D 0) { - bs->bl.request_alignment =3D da.d_miniosz; - /* The kernel returns wrong information for d_mem */ - /* s->buf_align =3D da.d_mem; */ + if (statx(fd, "", AT_EMPTY_PATH, STATX_DIOALIGN, &stx) =3D=3D 0 && + (stx.stx_mask & STATX_DIOALIGN)) { + bs->bl.request_alignment =3D stx.stx_dio_offset_align; + s->buf_align =3D stx.stx_dio_mem_align; + } +#endif /* defined(__linux__) && defined(STATX_DIOALIGN) */ + +#ifdef __linux__ + if (!bs->bl.request_alignment) { + /* + * The XFS ioctl definitions are shipped in extra packages that mi= ght + * not always be available. Since we just need the XFS_IOC_DIOINFO= ioctl + * here, we simply use our own definition instead: + */ + struct xfs_dioattr { + uint32_t d_mem; + uint32_t d_miniosz; + uint32_t d_maxiosz; + } da; + if (ioctl(fd, _IOR('X', 30, struct xfs_dioattr), &da) >=3D 0) { + bs->bl.request_alignment =3D da.d_miniosz; + /* The kernel returns wrong information for d_mem */ + /* s->buf_align =3D da.d_mem; */ + } + } +#endif /* __linux__ */ + + /* Let's try to use the logical blocksize for the alignment. */ + if (!bs->bl.request_alignment) { + if (probe_logical_blocksize(fd, &bs->bl.request_alignment) < 0) { + bs->bl.request_alignment =3D 0; + } } -#endif =20 /* * If we could not get the sizes so far, we can only guess them. First= try --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269269; cv=none; d=zohomail.com; s=zohoarc; b=n0OsmXrV6pkUzP1ViRM5V3cHDP/2gY4NBvuFa8BJlUhJyPuLcgSypvB9oHpuktrYiO3sFLASe2DIOa6HleFIfOV94UPE5dq1xO5GVebK4e+ZcXKDNfs0HGgx8ft7Qmeb/1ANQPGwd9g9jNNiIZpl5qhL12bg4kKnYM195NhraZo= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269269; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=hha4ORtJ8Xft62A+NGIOncFKpY4vS9p5vfgJ+/SBgOA=; b=CV1nNCyN1WcY9/JXPbTpEXBLz8PXxypa0oqc0q0+M8Gynp0Ldndh8zteWoYbCNwqo+neiospmI2WZ2THcYm+7TwzOo6VSscT3+c0bd98QhwyeQ+PBjKLLsMn6BbUgTiwI+LougfaylJhmG9RL2A7JkXcNVp0Lx7rrCGFtozUxbs= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269269633127.009257736314; Sat, 17 Oct 2026 13:34:29 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB5S-0005LJ-5Q; Sat, 17 Oct 2026 16:33:02 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB3b-0003RW-Q5; Sat, 17 Oct 2026 16:31:13 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB3Z-0004VM-Ns; Sat, 17 Oct 2026 16:31:07 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id B05351DE76B; Sat, 17 Oct 2026 23:27:52 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id C2EA744343F; Sat, 17 Oct 2026 23:27:51 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268872; bh=Ty0WGoM3aAosY55JIlBDUv6MO9fpFcFW0udf45XpbJA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=vcLV7NWHRpzOTaIcEp4C9OX6DwwhD5xtxVK7UT6QK/xJEzmSUQivR4cpJK058kAti JMkQhagbvnkB7Epw/i/VP92De+avw01624mBvQWsX894c8ZiUlHUPHJaZC9An4ezal 5lE+yOCpUwbbcZNPYD/RftU07i6Vc8gbEFxW7QcQdy1DszeMuVv8MCoLutWBSfCgzb AAYCL7jxzBryocioNeO2lXC6plKLoFOS42ARmhkXvlMzsQ51Pcq+RyBwEYXTxG/yk1 cytwI8m2K/cYVjaXwTAZ+XWwR3AstKlvib4w454eszvkXMryNzlZNK6I+JlN5qhyKI OV/sxjXIi+f8w== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, "Denis V. Lunev" , Andrey Drobyshev , Kevin Wolf , Hanna Reitz , Michael Tokarev Subject: [Stable-11.1.3 45/73] qcow2: do not clear the dirty bit when reopening a read-only node Date: Sat, 17 Oct 2026 23:26:03 +0300 Message-ID: <20261017202638.728621-45-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269271390158500 Content-Type: text/plain; charset="utf-8" From: "Denis V. Lunev" qcow2_reopen_prepare() clears the dirty bit whenever the node is reopened read-only, with an unguarded header write. A read-only node can still be dirty, inherited from an earlier writable session, and it holds no BLK_PERM_WRITE to resolve that. A read-only to read-only reopen of a dirty image therefore fails outright: $ qemu-io -r -f qcow2 dirty.qcow2 <<< $'reopen -r\nquit' qemu-io: failed while preparing to reopen image 'dirty.qcow2' Where the file node below is writable the write is not refused early, and bdrv_co_write_req_prepare() aborts on its BLK_PERM_WRITE assertion instead. Clear it only for a node that is writable now, the predicate qcow2_do_open() already uses for the repair. bdrv_is_writable() also excludes an inactive node, whose header must not be touched either. Signed-off-by: Denis V. Lunev Reviewed-by: Andrey Drobyshev CC: Kevin Wolf CC: Hanna Reitz CC: Andrey Drobyshev Cc: qemu-stable@nongnu.org Message-ID: <20260824133729.1141990-2-den@openvz.org> Reviewed-by: Kevin Wolf Signed-off-by: Kevin Wolf (cherry picked from commit af28b65fae6fcbc22efdbcd4d71b37fd0c8adf89) Signed-off-by: Michael Tokarev diff --git a/block/qcow2.c b/block/qcow2.c index 7292dd036c..1543255eba 100644 --- a/block/qcow2.c +++ b/block/qcow2.c @@ -2102,9 +2102,11 @@ qcow2_reopen_prepare(BDRVReopenState *state,BlockReo= penQueue *queue, goto fail; } =20 - ret =3D qcow2_mark_clean(state->bs); - if (ret < 0) { - goto fail; + if (bdrv_is_writable(state->bs)) { + ret =3D qcow2_mark_clean(state->bs); + if (ret < 0) { + goto fail; + } } } =20 diff --git a/tests/qemu-iotests/039 b/tests/qemu-iotests/039 index 94a8bfe754..3d0c073d65 100755 --- a/tests/qemu-iotests/039 +++ b/tests/qemu-iotests/039 @@ -95,6 +95,40 @@ $QEMU_IMG info --image-opts \ # The dirty bit must still be set: this open never wrote any guest data _qcow2_dump_header | grep incompatible_features =20 +echo +echo "=3D=3D Read-only reopen must not clear the dirty bit =3D=3D" + +# A read-only node cannot write the header, and must keep the dirty bit +$QEMU_IO -r -c "reopen -r" -c "read -P 0x5a 0 512" "$TEST_IMG" \ + | _filter_qemu_io + +# The dirty bit must still be set +_qcow2_dump_header | grep incompatible_features + +echo +echo "=3D=3D Read-only reopen must not write through a writable file node = =3D=3D" + +# The write the header update needs is refused by the permission system +echo "{'execute': 'qmp_capabilities'} + {'execute': 'blockdev-reopen', + 'arguments': {'options': [{'node-name': 'drive', + 'driver': 'qcow2', + 'read-only': true, + 'file': 'prot'}]}} + {'execute': 'quit'}" \ + | $QEMU -qmp stdio -nographic -nodefaults \ + -blockdev "{'node-name': 'prot', + 'driver': 'file', + 'filename': '$TEST_IMG'}" \ + -blockdev "{'node-name': 'drive', + 'driver': 'qcow2', + 'file': 'prot', + 'read-only': true}" \ + | _filter_qmp + +# The dirty bit must still be set +_qcow2_dump_header | grep incompatible_features + echo echo "=3D=3D Repairing the image file must succeed =3D=3D" =20 @@ -108,6 +142,22 @@ echo "=3D=3D Data should still be accessible after rep= air =3D=3D" =20 $QEMU_IO -c "read -P 0x5a 0 512" "$TEST_IMG" | _filter_qemu_io =20 +echo +echo "=3D=3D A read-write to read-only reopen must clear the dirty bit =3D= =3D" + +_make_test_img -o "compat=3D1.1,lazy_refcounts=3Don" $size + +# The kill keeps the close from clearing the bit, so the header shows what +# the reopen did with it +_NO_VALGRIND \ +$QEMU_IO -c "write -P 0x5a 0 512" \ + -c "reopen -r" \ + -c "sigraise $(kill -l KILL)" "$TEST_IMG" 2>&1 \ + | _filter_qemu_io + +# The dirty bit must not be set +_qcow2_dump_header | grep incompatible_features + echo echo "=3D=3D Opening a dirty image read/write should repair it =3D=3D" =20 diff --git a/tests/qemu-iotests/039.out b/tests/qemu-iotests/039.out index c66361128f..ce8ee57721 100644 --- a/tests/qemu-iotests/039.out +++ b/tests/qemu-iotests/039.out @@ -27,6 +27,19 @@ incompatible_features [0] =3D=3D Read-only open must not crash on close =3D=3D incompatible_features [0] =20 +=3D=3D Read-only reopen must not clear the dirty bit =3D=3D +read 512/512 bytes at offset 0 +512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) +incompatible_features [0] + +=3D=3D Read-only reopen must not write through a writable file node =3D=3D +QMP_VERSION +{"return": {}} +{"return": {}} +{"timestamp": {"seconds": TIMESTAMP, "microseconds": TIMESTAMP}, "event"= : "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}} +{"return": {}} +incompatible_features [0] + =3D=3D Repairing the image file must succeed =3D=3D ERROR cluster 5 refcount=3D0 reference=3D1 Rebuilding refcount structure @@ -45,6 +58,13 @@ incompatible_features [] read 512/512 bytes at offset 0 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) =20 +=3D=3D A read-write to read-only reopen must clear the dirty bit =3D=3D +Formatting 'TEST_DIR/t.IMGFMT', fmt=3DIMGFMT size=3D134217728 +wrote 512/512 bytes at offset 0 +512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) +./common.rc: Killed ( VALGRIND_QEMU=3D"${VALGRIND_QEMU_IO}" _qemu_proc_exe= c "${VALGRIND_LOGFILE}" "$QEMU_IO_PROG" $QEMU_IO_ARGS "$@" ) +incompatible_features [] + =3D=3D Opening a dirty image read/write should repair it =3D=3D Formatting 'TEST_DIR/t.IMGFMT', fmt=3DIMGFMT size=3D134217728 wrote 512/512 bytes at offset 0 --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269617; cv=none; d=zohomail.com; s=zohoarc; b=IrgJi61hAvTRzHD2KeFPWYbI9N52cEkSrMA8o9QMatliPMEkXElQD19c5pvpUO0QPaexQZJuZshOzmDhg4f7TEFwcYRj7peWnzYFa9Z6m1lEFGf5C/CtA7UtMMDHmsLWXAx0HcGb80/RM87EwBhf0FIKJwJSCAO1HVtdhLtdhEg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269617; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=M7+0bWlBvnY2dYgMWCyjXRZhCUaYaxwAqJ3PsAw4ZU8=; b=ekaBHywjMDmjuhL66oWu6QaBZ9LhtBWWMJeOzg+5p4fA1N+nBeakTO3ZDiPbrXzTwumEBV8rXk0VLS0GMBusg4KCRyTDPptxWm1T4rEgQy5mlxdFr7JEDg4fAxL4tJ0px+XMcWOfJW9gLBRdQFLTftPzKRdKUU90HPkWdT2oTEo= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269617172480.5226773490434; Sat, 17 Oct 2026 13:40:17 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB5X-0005Y4-JP; Sat, 17 Oct 2026 16:33:08 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB3e-0003Rr-OW; Sat, 17 Oct 2026 16:31:14 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB3c-0004VZ-Tv; Sat, 17 Oct 2026 16:31:10 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 0ACC71DE76C; Sat, 17 Oct 2026 23:27:54 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id E392B443440; Sat, 17 Oct 2026 23:27:52 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268874; bh=M6KdwVpWdOu9X6qiFCVuIA5zPQmkk5QVPgRjN7msLP8=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=NK880zlbJpWkqCbUhdyrZp7nagBT9xDl764btUYhDm1FmeyMXQagMTG4noXr/wAfP qbsZk5qyQQEY7bpaS/mpVIOZjzl1TOyXsZOH7geQr1WhATc69h9j4rpL+E9ZZMHut0 obqdXnuVu8vm0Mn9kXAGzboboxzwn7XVcTZlNrv8Ky3jsLJbhbMy/mPJvXIbJPLdKz ehttdyx6Jx4rAZh2xtnT6Iap2pQYmK2l6gZfwG4GvxH8GL3POkHbblIAjd78i4jkUr Ic9bk0vTL3bYzUlp0VoR0gcMwj5Yastsi1seUe0MnTyezFseS6A4duIRxaxlt9yYrS wrJutzsFHCX0w== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, "Denis V. Lunev" , Andrey Drobyshev , Kevin Wolf , Hanna Reitz , Michael Tokarev Subject: [Stable-11.1.3 46/73] block: reject a reopen of an unusable node instead of crashing Date: Sat, 17 Oct 2026 23:26:04 +0300 Message-ID: <20261017202638.728621-46-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269619161158500 Content-Type: text/plain; charset="utf-8" From: "Denis V. Lunev" qcow2_signal_corruption() drops bs->drv, so a node can lose its driver at any time and a reopen has to expect that. Both ends of the path assume otherwise: $ qemu-io -c "read 0 64k" -c "reopen -r" corrupt.qcow2 qcow2: Marking image as corrupt: Cluster allocation offset 0x1200 unaligned (L2 offset: 0x40000, L2 index: 0); ... Segmentation fault bdrv_reopen_queue_child() dereferences bs->drv while descending into the children the node opened itself, and bdrv_reopen_prepare() asserts on it. commit_clean() reopens the base of a commit job back to read-only, so a base which goes corrupt under the job arrives here too. There is nothing to reopen for such a node, so stop descending into its children and let bdrv_reopen_prepare() report what every caller of bdrv_reopen() already handles. bdrv_reopen_commit() and bdrv_reopen_abort() keep their assertion, only a prepared entry reaches them. Signed-off-by: Denis V. Lunev Reviewed-by: Andrey Drobyshev CC: Kevin Wolf CC: Hanna Reitz CC: Andrey Drobyshev Cc: qemu-stable@nongnu.org Message-ID: <20260824133729.1141990-3-den@openvz.org> Reviewed-by: Kevin Wolf Signed-off-by: Kevin Wolf (cherry picked from commit efe98c2a0932c09ada26b8afac3606a66f561933) (Mjt: fixup iotest output accross v11.1.0-800-g3c0c7bfeba92 "qemu-io: propagate errors through Error API instead of printf") Signed-off-by: Michael Tokarev diff --git a/block.c b/block.c index f0a6042e61..e39f15816a 100644 --- a/block.c +++ b/block.c @@ -4486,6 +4486,11 @@ bdrv_reopen_queue_child(BlockReopenQueue *bs_queue, = BlockDriverState *bs, !qdict_haskey(options, "backing.driver"); } =20 + /* An unusable node is rejected by bdrv_reopen_prepare(), do not desce= nd */ + if (!bs->drv) { + return bs_queue; + } + QLIST_FOREACH(child, &bs->children, next) { QDict *new_child_options =3D NULL; bool child_keep_old =3D keep_old_opts; @@ -4881,9 +4886,16 @@ bdrv_reopen_prepare(BDRVReopenState *reopen_state, B= lockReopenQueue *queue, bool drv_prepared =3D false; =20 assert(reopen_state !=3D NULL); - assert(reopen_state->bs->drv !=3D NULL); GLOBAL_STATE_CODE(); + drv =3D reopen_state->bs->drv; + if (drv =3D=3D NULL) { + GRAPH_RDLOCK_GUARD_MAINLOOP(); + + error_setg(errp, "Block node '%s' has no driver left to reopen", + bdrv_get_device_or_node_name(reopen_state->bs)); + return -ENOMEDIUM; + } =20 /* This function and each driver's bdrv_reopen_prepare() remove * entries from reopen_state->options as they are processed, so diff --git a/tests/qemu-iotests/060 b/tests/qemu-iotests/060 index 5cd21a6f68..ce49fc34ec 100755 --- a/tests/qemu-iotests/060 +++ b/tests/qemu-iotests/060 @@ -486,6 +486,36 @@ echo # Image should not have been marked corrupt _img_info --format-specific | grep 'corrupt:' =20 +echo +echo "=3D=3D=3D Testing the reopen of an image corrupted at runtime =3D=3D= =3D" +echo + +_make_test_img 64M +poke_file "$TEST_IMG" "$l1_offset" "\x00\x00\x00\x00\x2a\x2a\x2a\x2a" + +# The read leaves the node unusable, the reopen must report that +echo "{'execute': 'qmp_capabilities'} + {'execute': 'human-monitor-command', + 'arguments': {'command-line': 'qemu-io drive \"read 0 512\"'}} + {'execute': 'blockdev-reopen', + 'arguments': {'options': [{'node-name': 'drive', + 'driver': 'qcow2', + 'read-only': true, + 'file': { + 'driver': 'file', + 'filename': '$TEST_IMG' + }}]}} + {'execute': 'quit'}" \ + | $QEMU -qmp stdio -nographic -nodefaults \ + -blockdev "{'node-name': 'drive', + 'driver': 'qcow2', + 'file': { + 'driver': 'file', + 'filename': '$TEST_IMG' + }}" \ + 2>&1 \ + | _filter_qmp | _filter_qemu_io + # success, all done echo "*** done" rm -f $seq.full diff --git a/tests/qemu-iotests/060.out b/tests/qemu-iotests/060.out index a37bf446e9..ad1912a43b 100644 --- a/tests/qemu-iotests/060.out +++ b/tests/qemu-iotests/060.out @@ -436,4 +436,17 @@ qcow2: Image is corrupt: L2 table offset 0x2a2a2a00 un= aligned (L1 index: 0); fur {"return": {}} =20 corrupt: false + +=3D=3D=3D Testing the reopen of an image corrupted at runtime =3D=3D=3D + +Formatting 'TEST_DIR/t.IMGFMT', fmt=3DIMGFMT size=3D67108864 +QMP_VERSION +{"return": {}} +qcow2: Marking image as corrupt: L2 table offset 0x2a2a2a00 unaligned (L1 = index: 0); further corruption events will be suppressed +{"timestamp": {"seconds": TIMESTAMP, "microseconds": TIMESTAMP}, "event"= : "BLOCK_IMAGE_CORRUPTED", "data": {"device": "", "msg": "L2 table offset 0= x2a2a2a00 unaligned (L1 index: 0)", "node-name": "drive", "fatal": true}} +read failed: Input/output error +{"return": ""} +{"error": {"class": "GenericError", "desc": "Block node 'drive' has no dri= ver left to reopen"}} +{"timestamp": {"seconds": TIMESTAMP, "microseconds": TIMESTAMP}, "event"= : "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}} +{"return": {}} *** done --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269406; cv=none; d=zohomail.com; s=zohoarc; b=YeEP4W5vf4oOnXYatCrFXJk+Md7H+JAbeFH0BpAwZaYTwWM7cF88XIdU+0UcDmaCZLgAT+pZ0XcEQmfnoD/3ee+a5QDauuKZcnhmRE7jUeN8WacToUjJOaFy3z44xQTKfa9OZmpMGTKWcnFL5uTgeboL+nEq/pr+YB2ucTNsHIM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269406; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=9RoyCoyfO0LH5Ja/U+UT0xqudWrjXHDZvA6XbNmzgK0=; b=H+nugtw9ZbzlOT9vXBObA51aySQTghzuef7F4HZjGbgeb2qc5THV51/Zb1XTEz0qM/myNxBC8GUK/6nRlQI8zWgnWh2qmGow7nIH9HoxqLqZivRlnSNXJk1nyzaGtLE5CeGHpfPXJXVodcCrrVECiT4J9qQC6c26FFQmpePLrJ4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269406163521.3588346839928; Sat, 17 Oct 2026 13:36:46 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB5h-0006Hj-3g; Sat, 17 Oct 2026 16:33:17 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB41-0003gM-Ld; Sat, 17 Oct 2026 16:31:33 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB3x-0004Vf-9w; Sat, 17 Oct 2026 16:31:33 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 13F7A1DE76D; Sat, 17 Oct 2026 23:27:55 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 3C388443441; Sat, 17 Oct 2026 23:27:54 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268875; bh=Dalxrd3xckpwgOTagu+FIHl3jO6x8LNVk5hI6XgBJYs=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=unItHl6lYSsN7wSO0pF13h4ceL6oVvv2M6lSiMs5LDniVo/Ai8rT2VX0ffs8pIL/i ZkenQT7s5HykWcaJZNv0i5aEd2iWwTdLOcnJNTXv/HKhZXPEvb1kayT2F3Y+/Z15JD O4NCmgkTWWcRNd+lWf6ZLo2tCbK3aDZCSieBDxZnyXkqI85GLNg3IrlCv3DWerZPNb IdCI9WxtOSSazZphCst/VZ+uaR/fMTGKrj8jqtoWsXEdp/fS8NQKjTgAfVEXMSbv/m HuZ2trKGQK2me4l98sKAYrFV4hnduGB17edYC66mPHi4WI8tYDALvltON97g1766tx a+gqmPQGTUyRQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Kevin Wolf , Michael Tokarev Subject: [Stable-11.1.3 47/73] block: Fix corruption from broken RMW atomicity Date: Sat, 17 Oct 2026 23:26:05 +0300 Message-ID: <20261017202638.728621-47-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269406826158500 Content-Type: text/plain; charset="utf-8" From: Kevin Wolf When emulating 512 byte sector devices on top of 4k native host storage, QEMU performs a read-modify-write cycle for misaligned write requests. These requests are marked as serialising so that any other writes to the same 4k block will have to wait and can't overwrite the block in the middle, which would make the RMW write back stale data. In principle, this mechanism works fine, but there is a race condition in the implementation: bdrv_find_conflicting_request() assumes that req->waiting_for =3D=3D NULL means that the request is the active owner of the data blocks it touches and everyone else has to wait for this request. However, there is a window between tracked_request_begin() and bdrv_wait_serialising_requests_locked() where any new request has req->waiting_for =3D=3D NULL even if it conflicts with an already running serialising request. So at this point, we have seemingly two active owners at the same time until the new request checks for conflicts. For a third request coming in, this isn't a problem, it just might wait for a little longer than necessary. However, if the original RMW request calls bdrv_wait_serialising_requests_locked() again (which it does in bdrv_aligned_pwritev() -> bdrv_co_write_req_prepare() before writing back the RMW buffer), it will now wait on the other request that snuck in, which is fatal and makes the RMW buffer stale. This scenario causes data corruption. Fix this by checking for conflicts already in tracked_request_begin() while holding the bs->reqs_lock mutex, so that the race window is closed and req->waiting_for =3D=3D NULL really has the intended meaning. For good measure, add an active_owner boolean that is set when a request is marked serialising and has completed waiting for other requests, and assert that it is not set when waiting for another request, so that in the case of another bug, we'd crash instead of causing data corruption. Cc: qemu-stable@nongnu.org Buglink: https://redhat.atlassian.net/browse/RHEL-272836 Signed-off-by: Kevin Wolf Message-ID: <20261002132135.93345-2-kwolf@redhat.com> Signed-off-by: Kevin Wolf (cherry picked from commit 0bd5a1b3d60cca595e19bb73eec83307259be671) Signed-off-by: Michael Tokarev diff --git a/block/io.c b/block/io.c index a916b236c3..bd562d472f 100644 --- a/block/io.c +++ b/block/io.c @@ -50,6 +50,9 @@ static int coroutine_fn bdrv_co_do_pwrite_zeroes(BlockDriverState *bs, int64_t offset, int64_t bytes, BdrvRequestFlags flags); =20 +static void coroutine_fn +bdrv_wait_serialising_requests_locked(BdrvTrackedRequest *self); + static void GRAPH_RDLOCK bdrv_parent_drained_begin(BlockDriverState *bs, BdrvChild *ignore) { @@ -616,6 +619,7 @@ static void coroutine_fn tracked_request_begin(BdrvTrac= kedRequest *req, .type =3D type, .co =3D qemu_coroutine_self(), .serialising =3D false, + .active_owner =3D false, .overlap_offset =3D offset, .overlap_bytes =3D bytes, }; @@ -624,6 +628,15 @@ static void coroutine_fn tracked_request_begin(BdrvTra= ckedRequest *req, =20 qemu_mutex_lock(&bs->reqs_lock); QLIST_INSERT_HEAD(&bs->tracked_requests, req, list); + + /* + * Set .waiting_for while we're holding the lock, otherwise we'd open = a race + * window where another request in the middle of its RMW cycle starts + * waiting for us, leading to potential data corruption if this request + * overwrites a block the RMW request has already read. + */ + bdrv_wait_serialising_requests_locked(req); + qemu_mutex_unlock(&bs->reqs_lock); } =20 @@ -684,6 +697,15 @@ bdrv_wait_serialising_requests_locked(BdrvTrackedReque= st *self) BdrvTrackedRequest *req; =20 while ((req =3D bdrv_find_conflicting_request(self))) { + /* + * If this request is the active owner of the data blocks it acces= ses, + * no other conflicting request may exist; other requests have to = wait + * for this one, not the other way around. If this condition is + * violated, RMW operations may be interrupted in the middle, oper= ate on + * stale data and introduce data corruption. + */ + assert(!self->active_owner); + self->waiting_for =3D req; qemu_co_queue_wait(&req->wait_queue, &self->bs->reqs_lock); self->waiting_for =3D NULL; @@ -803,6 +825,7 @@ void coroutine_fn bdrv_make_request_serialising(BdrvTra= ckedRequest *req, =20 tracked_request_set_serialising(req, align); bdrv_wait_serialising_requests_locked(req); + req->active_owner =3D true; =20 qemu_mutex_unlock(&req->bs->reqs_lock); } diff --git a/include/block/block_int-common.h b/include/block/block_int-com= mon.h index 147c08155f..46428b034d 100644 --- a/include/block/block_int-common.h +++ b/include/block/block_int-common.h @@ -80,6 +80,7 @@ typedef struct BdrvTrackedRequest { enum BdrvTrackedRequestType type; =20 bool serialising; + bool active_owner; int64_t overlap_offset; int64_t overlap_bytes; =20 --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269246; cv=none; d=zohomail.com; s=zohoarc; b=MEIObInT1CTsrx9XIZ7Pj1Ncb4PftYa8Io9efGKCH43gfncxivgOdqUb+oPou8aQs1F7tjyD2dcSFF36GrM/+Qjk7xGzGVCPkf/qOVFMFbMMlXTKfE/xAg3EeffAlne5RUsCTOZeHcTcd9s0e+G623xQeWC/qZCrrlhkyU1QZz8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269246; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=Me+m/p4b4pAsm7FeBO8Spu3H+/IvteFnVfVpAgI+cbc=; b=QALY0SN9Tu/1en+ZiEtWPqlFDWpK0GhsE/pUQST44lAFsuPHBWpuu4T8ODsdGvrsbdq1ouHK6qDHFcKtAoa736PCaE7EkkdiuZLsx2ahxsNv713XuZwaYsUsjYXCe0DLdBiwTIbNr2MX03YFXSjDc/yvQrWZ+mW1m7Ds1iJM7DA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269246500859.6900979533298; Sat, 17 Oct 2026 13:34:06 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB5b-0005oM-9u; Sat, 17 Oct 2026 16:33:12 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB41-0003gN-QS; Sat, 17 Oct 2026 16:31:33 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB40-0004Vs-7z; Sat, 17 Oct 2026 16:31:33 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id DEA891DE76E; Sat, 17 Oct 2026 23:27:55 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 459DF443442; Sat, 17 Oct 2026 23:27:55 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268875; bh=c5FB3Z9mPgJ0DDjDmosuyvD1bfcisQ05WjB0zOFBFDM=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=sP6nCtGj5ZaH6iekzUr284BGb4CoMlDnzYT/zasP/QwD49Qj158Xb+f0hcIvKnDYB 8oYFkXifBb6cGtX91bydcgNOPiKTWvH2GkwAUvk83SpKkFSn2j4swcjWbKULuLSNWQ wXAl6T7aosd/BGDh5HRaY/+ELuZxkjz9zLYZO0zw5v1edQPRL9wVMcu5LgzhaOCIRv Wt65UATBDkghUKarpjWWlLNpZyJ88h8YF3fRMocztl3qMLyQVnhz0QOpiZC4ySbBVO 35CaNIz6pMB04AMIIWy8nyY5OdZqEUvPjD2GWhqw+8WuD9s3NR8SnNVlo27xZC0KOj 495w/Es+Q3qCw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Kevin Wolf , Michael Tokarev Subject: [Stable-11.1.3 48/73] block: Remove now redundant bdrv_wait_serialising_requests() calls Date: Sat, 17 Oct 2026 23:26:06 +0300 Message-ID: <20261017202638.728621-48-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269246891158500 Content-Type: text/plain; charset="utf-8" From: Kevin Wolf All callers of bdrv_wait_serialising_requests() (as opposed to bdrv_wait_serialising_requests_locked()) are just duplicating the check that tracked_request_begin() already performs now. After removing them, bdrv_wait_serialising_requests() has no callers left and can go as well. Signed-off-by: Kevin Wolf Message-ID: <20261002132135.93345-3-kwolf@redhat.com> Signed-off-by: Kevin Wolf (cherry picked from commit cf4f672c11d663f87462cfd99a92124b30804e99) Signed-off-by: Michael Tokarev diff --git a/block/io.c b/block/io.c index bd562d472f..1c05dd106d 100644 --- a/block/io.c +++ b/block/io.c @@ -802,20 +802,6 @@ void bdrv_dec_in_flight(BlockDriverState *bs) bdrv_wakeup(bs); } =20 -static void coroutine_fn -bdrv_wait_serialising_requests(BdrvTrackedRequest *self) -{ - BlockDriverState *bs =3D self->bs; - - if (!qatomic_read(&bs->serialising_in_flight)) { - return; - } - - qemu_mutex_lock(&bs->reqs_lock); - bdrv_wait_serialising_requests_locked(self); - qemu_mutex_unlock(&bs->reqs_lock); -} - void coroutine_fn bdrv_make_request_serialising(BdrvTrackedRequest *req, uint64_t align) { @@ -1383,8 +1369,6 @@ bdrv_aligned_preadv(BdrvChild *child, BdrvTrackedRequ= est *req, * it ensures that the CoR read and write operations are atomic and * guest writes cannot interleave between them. */ bdrv_make_request_serialising(req, bdrv_get_cluster_size(bs)); - } else { - bdrv_wait_serialising_requests(req); } =20 if (flags & BDRV_REQ_COPY_ON_READ) { @@ -2021,8 +2005,6 @@ bdrv_co_write_req_prepare(BdrvChild *child, int64_t o= ffset, int64_t bytes, } =20 bdrv_wait_serialising_requests_locked(req); - } else { - bdrv_wait_serialising_requests(req); } =20 assert(req->overlap_offset <=3D offset); @@ -3530,7 +3512,6 @@ static int coroutine_fn GRAPH_RDLOCK bdrv_co_copy_ran= ge_internal( =20 /* BDRV_REQ_SERIALISING is only for write operation */ assert(!(read_flags & BDRV_REQ_SERIALISING)); - bdrv_wait_serialising_requests(&req); =20 ret =3D src->bs->drv->bdrv_co_copy_range_from(src->bs, src, src_offset, --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269615; cv=none; d=zohomail.com; s=zohoarc; b=HmvLi6TlzMShHAAL3xUBlEEbckgGCDQMqPo2b71BdCHSqcfBRZImYkf304NuWAqtK4jOXZ7P750J5/Oin0agIOH0LKV3XiAy/o0QCvSv/TrpXKR9+C4wV8KIxEOfEi473sonVVIVxPXdBMTNTUI4rEgPx5qaaRd3U7Dika0FhMs= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269615; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=qsbSRjenO4PgX5NiIs6ryRuE6V/uhfsND/yn6AmamAY=; b=FoZ8NEPVpdxuoZY2bhtTXxqapHIIKye+tK69N7HZi7X6mMvyeqmxWEDdop2pN8tfuoWO99nYevquDbrbkwS9/FWft6stZ3VEFTnEJ/lYC+lGwAaFo5oK8lVXSikHegGG4JwlHerj8zt1ViNsAduIXsAVhSLzd2x0lf7Lui+nk0M= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269615463168.25822762305722; Sat, 17 Oct 2026 13:40:15 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB6X-00004q-AX; Sat, 17 Oct 2026 16:34:09 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB45-0003iY-Bo; Sat, 17 Oct 2026 16:31:37 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB43-0004WS-AT; Sat, 17 Oct 2026 16:31:37 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id E64AE1DE76F; Sat, 17 Oct 2026 23:27:56 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 1BC59443443; Sat, 17 Oct 2026 23:27:56 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268876; bh=36nKkE72KvI9/Nlyu/MCAbWEQJl1GLh+2mG6EJFmwxU=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=X49SJURJQuHLMOlxxk0hR02LG9rWORE/HCD0YsHA4okDwv1qUj8lctG4UBrp9Vbdk t6Vr9KcbjhB+WIjFkH3jVnckn814L5si7Zph7uPkZCw8eF8rYQNlvvAuDsrPkIfdMc rALaQc9gsaemwxqWiepVoNFUa713+DgcOcTnREIJrEmS0cSH7R1uACyaY/if8aAbxI 8eLXXId26CjaIUlx+wRqt0s56hxSJbruWXFOZrUuWqvMhzt1K9Jzmc29yQhEaQvLUT C1vIMeSiy9NMffuL+dP6fPEdClGVw4v3V1z3rbZTMKawUrqil4YpV4pCDM0eSdCIsH A/OwZ49cwQ6sA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , Peter Xu , Juraj Marcin , Michael Tokarev Subject: [Stable-11.1.3 49/73] io: cork TLS writes to avoid small TLS records Date: Sat, 17 Oct 2026 23:26:07 +0300 Message-ID: <20261017202638.728621-49-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269617120158500 From: Daniel P. Berrang=C3=A9 The migration code caches vmstate/ram writes into an iovec and flushes this periodically. The total amount of data to sent may be 100's of KB, but split across many iovec, each of which is potentially quite small. The QIOChannelTLS receives the iovec, but since GNUTLS cannot accept iovec data, it iterates calling send for each element. As a result of the migration data pattern, this results in GNUTLS putting lots of small TLS records on the wire. This has shown writes alternate between about 4k and 30 bytes in some tests. This is triggering the nagle algorithm on migration-test for many of the TLS test cases, resulting in a "go slow" for I/O that eventually hits the migration timeout configured by the test. Not every contributor reports seeing the "go slow" but for those who do see it, it hits >=3D 95% of the time for at least one of the migration TLS test cases run by 'make check'. While we could disable the nagle algorithm (and multifd channels already do this), that would stil result in lots of small TLS records hitting the wire which is not good for throughput. The migration code flushes in batches because it wants large writes for high throughput. To achieve this we must tell GNUTLS to encrypt data but not immediately sent TLS records by "corking" its output. Once the complete iovec has been written to GNUTLS, it can be uncorked allowing it to hit the wire. There is added complexity with uncorking on non-blocking channels as not all encrypted data can be sent at once. qio_channel_write() will return what was sent, but some data might remain pending inside GNUTLS buffers. A later call to qio_channel_write() will provide the same plain text data buffers that have already been cached. Thus the code must attempt to uncork GNUTLS again to clear pending data and then deduct the equivalent amount of plain text. Overall this corking action fixes the test suite timeouts, but more importantly, it also improves the performance of TLS protection migrations in the real world. Tests with one workload show at 36% increase in throughput. Reviewed-by: Peter Xu Tested-by: Juraj Marcin Signed-off-by: Daniel P. Berrang=C3=A9 (cherry picked from commit 99a8b5a0dda91e3cdabbf3fec47a504197af63c7) Signed-off-by: Michael Tokarev diff --git a/crypto/tlssession.c b/crypto/tlssession.c index 314e3e96ba..b343d1a595 100644 --- a/crypto/tlssession.c +++ b/crypto/tlssession.c @@ -513,6 +513,39 @@ qcrypto_tls_session_read(QCryptoTLSSession *session, } =20 =20 +void qcrypto_tls_session_write_cork(QCryptoTLSSession *sess) +{ + gnutls_record_cork(sess->handle); +} + + +ssize_t qcrypto_tls_session_write_uncork(QCryptoTLSSession *sess, + Error **errp) +{ + int ret; + ret =3D gnutls_record_uncork(sess->handle, 0); + if (ret =3D=3D GNUTLS_E_AGAIN || + ret =3D=3D GNUTLS_E_INTERRUPTED) { + ret =3D gnutls_record_check_corked(sess->handle); + if (ret < 0) { + error_setg(errp, + "Cannot query pending TLS output: %s", + gnutls_strerror(ret)); + return -1; + } + + return ret; + } else if (ret < 0) { + error_setg(errp, + "Cannot uncork TLS output: %s", + gnutls_strerror(ret)); + return -1; + } + + return 0; +} + + size_t qcrypto_tls_session_check_pending(QCryptoTLSSession *session) { @@ -757,4 +790,16 @@ qcrypto_tls_session_get_peer_name(QCryptoTLSSession *s= ess) return NULL; } =20 +void qcrypto_tls_session_write_cork(QCryptoTLSSession *sess) +{ +} + + +ssize_t qcrypto_tls_session_write_uncork(QCryptoTLSSession *sess, + Error **errp) +{ + error_setg(errp, "TLS requires GNUTLS support"); + return -1; +} + #endif diff --git a/include/crypto/tlssession.h b/include/crypto/tlssession.h index 28e419681e..5415503eba 100644 --- a/include/crypto/tlssession.h +++ b/include/crypto/tlssession.h @@ -208,6 +208,31 @@ typedef ssize_t (*QCryptoTLSSessionReadFunc)(void *buf, void *opaque, Error **errp); =20 +/** + * qcrypto_tls_session_write_cork: + * @sess: the TLS session object + * + * Causes future qcrypto_tls_session_write() calls to encrypt + * and queue data, without sending on the wire. + */ +void qcrypto_tls_session_write_cork(QCryptoTLSSession *sess); + +/** + * qcrypto_tls_session_write_uncork: + * @sess: the TLS session object + * @errp: pointer to a NULL-initialized error object + * + * Attempt to send previously queued data. If the underlying + * stream is non-blocking, then only a subset of data (if any) + * may be written. To process outstanding data, this method + * must be called again until it returns 0. + * + * Returns: the number of bytes remaining to be sent, + * or -1 on error. + */ +ssize_t qcrypto_tls_session_write_uncork(QCryptoTLSSession *sess, + Error **errp); + /** * qcrypto_tls_session_set_callbacks: * @sess: the TLS session object diff --git a/include/io/channel-tls.h b/include/io/channel-tls.h index 7e9023570d..9e9b00c034 100644 --- a/include/io/channel-tls.h +++ b/include/io/channel-tls.h @@ -50,6 +50,7 @@ struct QIOChannelTLS { QIOChannelShutdown shutdown; guint hs_ioc_tag; guint bye_ioc_tag; + size_t corked; }; =20 /** diff --git a/io/channel-tls.c b/io/channel-tls.c index 31ec4d236d..05317ed5a3 100644 --- a/io/channel-tls.c +++ b/io/channel-tls.c @@ -21,6 +21,7 @@ #include "qemu/osdep.h" #include "qapi/error.h" #include "qemu/module.h" +#include "qemu/iov.h" #include "io/channel-tls.h" #include "trace.h" #include "qemu/atomic.h" @@ -448,12 +449,24 @@ static ssize_t qio_channel_tls_writev(QIOChannel *ioc, QIOChannelTLS *tioc =3D QIO_CHANNEL_TLS(ioc); size_t i; ssize_t done =3D 0; + ssize_t remain; + g_autofree struct iovec *tmpiov =3D NULL; + size_t ntmpiov =3D 0; =20 - for (i =3D 0 ; i < niov ; i++) { - ssize_t ret =3D qcrypto_tls_session_write(tioc->session, - iov[i].iov_base, - iov[i].iov_len, - errp); + /* + * The previous write encrypted all the data, but some + * was not able to be sent on the wire when uncorked, + * so we returned a short write. The encrypted data + * will still be cached by GNUTLS and the session will + * be in a corked state. + * + * This write call will be trying to write the remaining + * plain text data again, but we must avoid sending that + * into GNUTLS. Instead flush the previously encrypted + * pending data. + */ + while (tioc->corked) { + ssize_t ret =3D qcrypto_tls_session_write_uncork(tioc->session, er= rp); if (ret =3D=3D QCRYPTO_TLS_SESSION_ERR_BLOCK) { if (done) { return done; @@ -463,12 +476,74 @@ static ssize_t qio_channel_tls_writev(QIOChannel *ioc, } else if (ret < 0) { return -1; } + done +=3D (tioc->corked - ret); + tioc->corked =3D ret; + } + + /* + * If we flushed pending data, we must discard an + * equivalent amount of plain text data from this + * write call, and then process what's left over, + * if any. + */ + if (done) { + ssize_t total =3D iov_size(iov, niov); + if (done =3D=3D total) { + return done; + } + + tmpiov =3D g_new0(struct iovec, niov); + ntmpiov =3D iov_copy(tmpiov, niov, iov, niov, + done, total - done); + + iov =3D tmpiov; + niov =3D ntmpiov; + } + + /* + * At this point we should ony be processing "new" + * data, not seen by a previous write call so we + * send to GNUTLS as normal. + */ + qcrypto_tls_session_write_cork(tioc->session); + for (i =3D 0 ; i < niov ; i++) { + ssize_t ret =3D qcrypto_tls_session_write(tioc->session, + iov[i].iov_base, + iov[i].iov_len, + errp); + if (ret =3D=3D QCRYPTO_TLS_SESSION_ERR_BLOCK) { + error_setg(errp, "Unexpected TLS blocking I/O while corked"); + return -1; + } else if (ret < 0) { + return -1; + } done +=3D ret; if (ret < iov[i].iov_len) { break; } } - return done; + + /* + * On non-blocking sockets, uncorking may not succeed + * in sending all encrypted data, so we have to check + * what was actually sent to see if GNUTLS remains in + * the corked state with pending data. + */ + remain =3D qcrypto_tls_session_write_uncork(tioc->session, errp); + if (remain < 0) { + return -1; + } else if (remain) { + tioc->corked =3D remain; + } + /* + * done =3D=3D what we sent to GNUTLS for encryption & sending + * remain =3D=3D subset of 'done' that was encrypted but not sent + */ + if (done && (remain =3D=3D done)) { + return QIO_CHANNEL_ERR_BLOCK; + } else { + return done - remain; + } } =20 static int qio_channel_tls_set_blocking(QIOChannel *ioc, --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269497; cv=none; d=zohomail.com; s=zohoarc; b=ZL5yzbGjovof6lGZPLqwt1/jpdxvAzDesjh89VkQp/ve6kNJ5WCrh4eDdApYBen4/3fi5h6g8KAnj2Bi1UoM9cwySCuQpy6fWgG7+HSbXqddbghWixxDEu+KFPKdbWk0FzEc7PWYY+vkYJ73D8sB/KzxWsIgS10Fic+Mxk9nNWA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269497; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=tHSutU/hMRucVoMSyshmY3UcEMgv8gIR5uNXxa13gk0=; b=QOA1N55XQ5gxP9TDdFnTH7ReobTxmze8u9F6DBSJsvuBRS9D/wBV/uICZfoYfBdFS8erA91bGc39EbQNapszjKu9aL8KJT8lWB6uYsOy+XnSr5kolVkAz8rWeGqJB51viLovJoHHPjp6EoWeMQP2Kz63QyTFSpqSjIWqtcNBh0M= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269497808388.9716098219128; Sat, 17 Oct 2026 13:38:17 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB5y-00073H-3v; Sat, 17 Oct 2026 16:33:36 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB44-0003iT-V1; Sat, 17 Oct 2026 16:31:37 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB43-0004WV-Ah; Sat, 17 Oct 2026 16:31:36 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 226C61DE770; Sat, 17 Oct 2026 23:27:58 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 240B9443444; Sat, 17 Oct 2026 23:27:57 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268878; bh=Yg1IL7YqpvXC+nby5VBGDMk9CnEPTbbgMQJYXxnF2LU=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Vrl1ypUi3NDZLOx35wbwQ0duWqalzRmNDJTvOTP/+bevBtzbRAwhacUIgarFQ9Boz TpRVHI0onITiTUAlZXHDFjQ7VEbdOOyujTDFcUOSL1yjXbSAUDT1eKrjRKUflDlZOG TpIVsyMp3wMwSWKAOLD0hwSbwEayTA2lJCDvC4EWMQAqi2+uoOukRPz9azloDgTAy3 m63TVl9gFQG0pQcXJttyT2kO+TVX7MksCevze5O2aWpUST/QsQAyrsEc44rKY0Ybi1 2tzc+w+KyHC8N43F0TH2MxJ8/0yfW6UiFDh5qes+zFd9RsuShQf7zeKc5Cowtv8DzU 6czDGMdcK45EQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Stefan Berger , =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , Michael Tokarev Subject: [Stable-11.1.3 50/73] tpm_emulator: Reject sending commands smaller than the request header Date: Sat, 17 Oct 2026 23:26:08 +0300 Message-ID: <20261017202638.728621-50-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269498620158500 From: Stefan Berger Reject any TPM request from being sent to the TPM emulator that is shorter than the size of the request header. Fixes: f4ede81eed29 ("tpm: Added support for TPM emulator") Reviewed-by: Marc-Andr=C3=A9 Lureau Link: https://lore.kernel.org/qemu-devel/20261002142516.2063735-4-stefanb@l= inux.ibm.com Signed-off-by: Stefan Berger (cherry picked from commit 6728170d2d081d8aad46807bc5e64520650f2795) Signed-off-by: Michael Tokarev diff --git a/backends/tpm/tpm_emulator.c b/backends/tpm/tpm_emulator.c index 95d2de2f48..5581f690e4 100644 --- a/backends/tpm/tpm_emulator.c +++ b/backends/tpm/tpm_emulator.c @@ -181,6 +181,11 @@ static int tpm_emulator_unix_tx_bufs(TPMEmulator *tpm_= emu, uint32_t to_read; ssize_t ret; =20 + if (in_len < sizeof(struct tpm_req_hdr)) { + error_setg(errp, "tpm-emulator: invalid request size %u", in_len); + return -1; + } + if (selftest_done) { *selftest_done =3D false; is_selftest =3D tpm_util_is_selftest(in, in_len); --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269261; cv=none; d=zohomail.com; s=zohoarc; b=NUsw2+Mh/7UtKHUokpGmi33EIAMGn23caKonrkQd2qRndVX6P7tXQDHIRRL1IGtuK/myb/re6KxUv0VreOVtWTpxQBJ41i5ijL97tNEOauYAYqyLyG2M1FzpXjX6OQS+hcuN9l1QjcpZlOG/iK8TS7902tiyShSm2HFvawGN/7Q= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269261; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=9Y0NN9Bb3MYF1IzE5R3FVBui2nvZf2RoQYwF1MWBFyE=; b=FdUaRoOkAOr/qsVncVta7h2K3nJ8CyoXGPsuSKpAOdcRQbrC599oNgcHY5McQv9BGfjZJzZ+UklHqqXsrfVp+T93xEPxHIGSJtvpOAmECbgtbUGQWPOJ9j072raqvGxQBLnBSI0zzJh8pGtIg8vrGDQqna6XqiT5sqnMXqYMtyc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 179226926190751.444709769448764; Sat, 17 Oct 2026 13:34:21 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB5i-0006Qd-30; Sat, 17 Oct 2026 16:33:18 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB49-0003oQ-7u; Sat, 17 Oct 2026 16:31:43 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB46-0004Ww-Ew; Sat, 17 Oct 2026 16:31:40 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 6413D1DE771; Sat, 17 Oct 2026 23:27:59 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 61DF9443445; Sat, 17 Oct 2026 23:27:58 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268879; bh=7AfG7+RNL0V6vOz1vQPPug5lsrdDIr+Zd/HFDbU6mRI=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=xqBfo6WK9Ng5h24mKHZ92KwHCH0u6UWcDI4sudVEd8YM10l0M02EP/FQusmHwvMHk xgyW120MwNDjWs7ufkc00dpYzZ2SC/vzKQvMGMd3RAPeBIPMaMrnUAzxd6SDxTHErm LeToH7rfJhlNH9djE3PvqJNO15GpSZwVVLank36ruD5yDU187liYTllrYnjvLhguOA 5kv3BppCYEfQnOltgwU4xBn1d+UkjiUPo35bSwLZF7k4+p7YSSMRbG0GeTufbXNiks niPYXgQfcNhHjvKkCOgKBLDLfOjcEgi2p/VLEkLZw+thidprQ5wW9neJZ4cko5H3NY /W5DmNTkIKdgg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Stefan Berger , =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , Arun Menon , Michael Tokarev Subject: [Stable-11.1.3 51/73] hw/tpm: crb: Do not clear internal buffers when backend is busy Date: Sat, 17 Oct 2026 23:26:09 +0300 Message-ID: <20261017202638.728621-51-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269263083158500 From: Stefan Berger While the backend (thread) is accessing the request and response buffers, do not clear those buffers upon a command cancellation. Also, per CRB spec the TPM is expected to either return a normal command response (command could not be cancelled) or an error response indicating TPM_RC_CANCELED. So the response buffer must be able to receive a response as normal. Fixes: 29315d22b259 ("hw/tpm: Add internal buffer state for chunking") Reviewed-by: Marc-Andr=C3=A9 Lureau Reviewed-by: Arun Menon Link: https://lore.kernel.org/qemu-devel/20261002142516.2063735-7-stefanb@l= inux.ibm.com Signed-off-by: Stefan Berger (cherry picked from commit 9b206e52655044da7f639c193a6ff3cec21baa02) Signed-off-by: Michael Tokarev diff --git a/hw/tpm/tpm_crb.c b/hw/tpm/tpm_crb.c index 54fa2042b5..daf451aa56 100644 --- a/hw/tpm/tpm_crb.c +++ b/hw/tpm/tpm_crb.c @@ -219,7 +219,6 @@ static void tpm_crb_mmio_write(void *opaque, hwaddr add= r, if (s->regs[R_CRB_CTRL_START] & CRB_START_INVOKE) { tpm_backend_cancel_cmd(s->tpmbe); } - tpm_crb_clear_internal_buffers(s); } break; case A_CRB_CTRL_START: --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269466; cv=none; d=zohomail.com; s=zohoarc; b=Q73FXDEj+wSmhGQn0NtZUD2hGPh5gaYGDMiS7lpD30zEjq6m4az41VadlU3qSnDgA6bQqp+IdA/6JRMH1dWvWGsE4sGFENiOnk3xW0okjtqrul2528EIiepgnL8CPwKMtvbCs/PpmeFdLCSdqBb9RlAC9gijdU3g897AnzyxyBE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269466; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=ySTUnTH5H/uoeuP8tthIvxwPbXYSPqwI6UzD33I9pPE=; b=U43OKXZxjqsxGR5pQWz2D5X47T/OL2SnvTOUtIMquoi+9xFoM4QRVskKZN5mcTDV+gL0fUghklG9T658u4M5h0Vx1WAHsccbBFWR2o4D/cXfr5hsfg4QbdcIvCSckGuNWwL12C2nnlo6hg22hnyoIrf82GScJQ1VjXUVzX8ugmI= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269466395436.17225805864643; Sat, 17 Oct 2026 13:37:46 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB6H-0007gw-8J; Sat, 17 Oct 2026 16:33:57 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB4V-00046a-3g; Sat, 17 Oct 2026 16:32:12 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB4S-0004X3-2l; Sat, 17 Oct 2026 16:32:01 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 53D1A1DE772; Sat, 17 Oct 2026 23:28:00 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 965E1443446; Sat, 17 Oct 2026 23:27:59 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268880; bh=hkwaHLCbqA7jNmpW0lit0Xcyd/8SKKHfNeNt/64r/lQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=XHkt9NIxP6J0h4DOSyfnFlV6r9Vu4ljBqUmOIDz1UlCrHuHtk539EujPuazuN1eOo mqbsjBhZw/FTbHEW1oYs7zrXDhDiy5VpRhihPGgtD9zdGltJyLUCxIJLk30AtyB3Cw +ES8C3srBR5aw0ZAmucG9r+lCDBi9AHj1906Cg996p9HmV+d2TnttQ8LQKqkelfjQG S2IHJiPqJ0mrA7RZNii2YZx3DbRYvzIdmQGkBj4YyPNtKtWoU3HcUHPOGR7RZjIRTe y7d3eBo28PDdBvLFtS4X9W3A1xW1SCni7uhsXR+4slzMmpYHwdh/NjBPd8TZ8LdaU7 p4eq63m1Hq9jA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-11.1.3 52/73] hw/display/vga: fix OOB writes after external surface resize Date: Sat, 17 Oct 2026 23:26:10 +0300 Message-ID: <20261017202638.728621-52-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269468059158500 From: Marc-Andr=C3=A9 Lureau virtio-vga has two renderers (VGA core and virtio-gpu) sharing a single QemuConsole, with no invalidation protocol between them. When virtio-gpu replaces the surface (SET_SCANOUT) or destroys it (reset via qemu_console_set_surface(con, NULL)), the VGA renderer's cached geometry (last_scr_width, last_height, last_depth, etc.) is never cleared: vga_common_reset() does not run during a virtio-gpu reset. The text draw path was fixed by 418396be80 (CVE-2026-77913), but vga_draw_blank() and vga_draw_graphic() still trust stale cache against a foreign surface: vga_draw_blank() uses last_scr_width/height to memset the display surface. When the surface has been replaced by a smaller one (e.g. after a text-to-graphics mode switch, or a virtio-gpu reset installing a 16x16 placeholder), the memset writes past the surface buffer. Use the actual surface dimensions for the memset bounds instead of the cached last_scr values. vga_draw_graphic() decides whether to recreate the DisplaySurface based solely on VGA register state (line_offset, width, height, depth, byteswap, allocated). When virtio-gpu replaces the surface with a smaller one, the predicate sees no change and the drawing loop writes a full VGA-geometry frame into the undersized surface. Add surface dimension checks to the predicate so that a foreign surface whose size does not match the VGA geometry triggers a resize before drawing. Ideally the two renderers could coordinate through a console-level invalidation callback, but these defensive checks are needed regardless as a safety net against any path that replaces the surface. Fixes: CVE-2026-97889 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4579 Reported-by: david korczynski (@david1766) Reviewed-by: Philippe Mathieu-Daud=C3=A9 Signed-off-by: Marc-Andr=C3=A9 Lureau Message-ID: <20261001104112.2167807-2-marcandre.lureau@redhat.com> (cherry picked from commit 35164929cfa33b9f5001de72c0f3e37e9a4612c2) Signed-off-by: Michael Tokarev diff --git a/hw/display/vga.c b/hw/display/vga.c index cb0e28b79b..b9b8c52941 100644 --- a/hw/display/vga.c +++ b/hw/display/vga.c @@ -1641,7 +1641,9 @@ static void vga_draw_graphic(VGACommonState *s, int f= ull_update) height !=3D s->last_height || s->last_depth !=3D depth || s->last_byteswap !=3D byteswap || - allocate_surface !=3D surface_is_allocated(surface)) { + allocate_surface !=3D surface_is_allocated(surface) || + disp_width !=3D surface_width(surface) || + height !=3D surface_height(surface)) { /* display parameters changed -> need new display surface */ s->last_scr_width =3D disp_width; s->last_scr_height =3D height; @@ -1789,9 +1791,9 @@ static void vga_draw_blank(VGACommonState *s, int ful= l_update) qemu_console_set_surface(s->con, surface); } =20 - w =3D s->last_scr_width * surface_bytes_per_pixel(surface); + w =3D surface_width(surface) * surface_bytes_per_pixel(surface); d =3D surface_data(surface); - for(i =3D 0; i < s->last_scr_height; i++) { + for (i =3D 0; i < surface_height(surface); i++) { memset(d, 0, w); d +=3D surface_stride(surface); } --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269584; cv=none; d=zohomail.com; s=zohoarc; b=HqrUkaLk+DgQAtvu5m/zoQ74Z3lmBlLTMnQt0cXhnKLqmJLdJKHefrPHoQqWrCNIOz44zUGfCtDooQPNVle6loJUwXzYSP4m9gl60m5u4ZtrD9q8lvtp1BWceJye1FEifD6HmPfDThXV6pSXoOIe5zFMvsSMNQb7xGTssqqBZvc= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269584; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=YQPTsYhnO6JwgU5pprmolGlsOgzUmp7txHqEhLD+Auw=; b=EBeXLrfwhWYps6Js1WlswzKlHY3jU6lITnG50AveI3+2CMOQQpSoBsYkAfCyAXKqwO/Jxkq1g9zPWsi2/GU2RR0RP+jbziC86/U9uRg6FIbsGz89qieuoKkQ2FVRCDvUyt2N7wA7I1ygZmStOnxupe1IuaL7Ag9pA1/LYHe0nbU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269584476209.99375593108402; Sat, 17 Oct 2026 13:39:44 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB6P-0007ph-T8; Sat, 17 Oct 2026 16:34:02 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB4Y-00046q-8o; Sat, 17 Oct 2026 16:32:12 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB4V-0004Xh-SK; Sat, 17 Oct 2026 16:32:06 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 65D471DE773; Sat, 17 Oct 2026 23:28:01 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 8C5EE443447; Sat, 17 Oct 2026 23:28:00 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268881; bh=UrXTE5BaIuAnGRluAn2NzCAIcxhE3i68oCLLihba3nU=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=usSsokeizNHfHS9/lBYa157NUjUgfxv8FPcvwdLP6IqkVyDoUP7yTEpLJGwmNfBdU evsKml+ii1LCumV93Vf4iRlw3DPbNnIktN7d633dEerKPXZQOQq9yczYqkg1DMhPcD CKlEbx5j4u+WzvWw/P6TWwREMQibfmGthKDHUKDjUwPZQwpf6xCotHpXrtZO6ct6JB TQdgwSmZz2ohz9TFzmMiMIoYn68rjJiVSQVtDyOzevQUFEkXcNmcdE+WLXA59Gervx Egpjq3A3CwSEPyqONQLzGqszLIVO9J9BBz8Dh/nyNtGLRyYchpIm6wA9yj4+FQi3Cg 628zQut6ub9EA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Dominic P , Richard Henderson , Michael Tokarev Subject: [Stable-11.1.3 53/73] tcg/optimize: Do not derive s_mask from rotated s_mask Date: Sat, 17 Oct 2026 23:26:11 +0300 Message-ID: <20261017202638.728621-53-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269586521158500 Content-Type: text/plain; charset="utf-8" From: Dominic P fold_shift computes s_mask for a rotate by a constant by rotating the input s_mask. The result is not a sign mask. For TCG_TYPE_I32, fold_masks_zosa_int then ORs in INT32_MIN, which can make it look like one: after sextract_i32 x,0,8 (s_mask ...ffffff80), rotr_i32 by 1 gives 0x7fffffc0, which becomes ...ffffffc0. A following sextract_i32 0,8 is then folded to a mov. rotl_i32 by 31 fails the same way. ARM, qemu-arm exits 255 instead of 7 (correct with -one-insn-per-tb): ldr r1, [r2] @ *r2 =3D=3D 3 sxtb r1, r1 ror r1, r1, #1 sxtb r1, r1 @ dropped cmp r1, #0 movle r0, #255 movgt r0, #7 i386, the same with rotl_i32: movsbl %al, %eax roll $31, %eax movsbl %al, %eax # dropped Handle rotates like the logical right shift and let fold_masks_zo recompute s_mask from z_mask and o_mask. Cc: qemu-stable@nongnu.org Fixes: 93a967fbb57 ("tcg/optimize: Propagate sign info for shifting") Signed-off-by: Dominic P Signed-off-by: Richard Henderson Message-ID: <20260930185124.3036980-2-gcc@gcc.dp11.uk> (cherry picked from commit d228536a5142cdd4b28e4feda74fa4859290787f) Signed-off-by: Michael Tokarev diff --git a/tcg/optimize.c b/tcg/optimize.c index 2dc6e32b53..cc5488ae85 100644 --- a/tcg/optimize.c +++ b/tcg/optimize.c @@ -2659,17 +2659,26 @@ static bool fold_shift(OptContext *ctx, TCGOp *op) z_mask =3D do_constant_folding(op->opc, ctx->type, z_mask, sh); o_mask =3D do_constant_folding(op->opc, ctx->type, o_mask, sh); =20 - if (op->opc =3D=3D INDEX_op_shr) { + switch (op->opc) { + case INDEX_op_shr: + case INDEX_op_rotl: + case INDEX_op_rotr: /* - * Logical right shift will force the sign bit zero. + * Logical right shift will force the sign bit zero, and + * a rotate may move bits unrelated to the sign into it. * Don't bother computing s_mask and let fold_masks * recompute from z_mask. */ return fold_masks_zo(ctx, op, z_mask, o_mask); - } =20 - s_mask =3D do_constant_folding(op->opc, ctx->type, s_mask, sh); - return fold_masks_zos(ctx, op, z_mask, o_mask, s_mask); + case INDEX_op_sar: + case INDEX_op_shl: + s_mask =3D do_constant_folding(op->opc, ctx->type, s_mask, sh); + return fold_masks_zos(ctx, op, z_mask, o_mask, s_mask); + + default: + g_assert_not_reached(); + } } =20 switch (op->opc) { --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269265; cv=none; d=zohomail.com; s=zohoarc; b=CaMy7sCnQFvBput/rZy1X8lfEago6EPFQNAmyU+bUQwwluM2n26Xd7KhXMIUClobrJ+o+sxmRKGdqgp5WzhmEdkd0iZb/UFsw0KBj9bV4NWJx01EAPMoUuY576G4ZTqwfx7d4THlBHG1H5HUEIvWXlhOye68VJoWJRzeiaGCqXU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269265; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=2f/0vQqkKYn3YmW2HOG7hibJOPiLxrxTRMrLqFM40xk=; b=DRwGbnKfNM0Zm8TxEjLO8Sc+M8QweV+7MzOD7KuHqg0dLsqL3RGhJu01iQenVeycd6mmlOQF/AgEWTb3fnkO/yBHlxedstxN0XLv6ZDpBVQe1lmujjPBl531YAdM7qcHaccYIPcHo1jwH++ZNoswlgOKTfx6afZs3vsTJDbSLs4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269265078642.4352948460692; Sat, 17 Oct 2026 13:34:25 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB5i-0006QH-19; Sat, 17 Oct 2026 16:33:18 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB4Y-00046v-Nf; Sat, 17 Oct 2026 16:32:12 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB4X-0004ZB-3S; Sat, 17 Oct 2026 16:32:06 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id D0CA91DE774; Sat, 17 Oct 2026 23:28:02 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id CA556443448; Sat, 17 Oct 2026 23:28:01 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268882; bh=TWBxVKz82Up+sx4uZne6YUeNc6ojmMAxAlQXgNEi9Ds=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=g4Iej4Qt/Th8oLhSfcN2jG84H8CUPU811covLqSmiPBMJXmlL143qXPT09a8uYMDz 0IHfG+Y77zxEpOcupjObLKDIBwag3WNq9UoZGKTw6tsvdYECk2PSojj0VorAZn3w44 ysbv3ULyBZYdPmrbz1XgzKa0/lJuZ67F09G2viOilKotS+uzdRSmazyJ+riDOKhjNB 51A0uqxii3fniqr6IgQsS9bmNT4H+XJa6ZSFrptP9gs7P+pvNytkuFV39oDon0PC1K wlQSmWvPYY8h+/kA3vaLP1bJ6vKg0WRW1sflmwRivHH5WfJQqgcWodCYcgCiqlmCNx mSpXsXuj8MNFA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Dominic P , Richard Henderson , Michael Tokarev Subject: [Stable-11.1.3 54/73] tests/tcg: Add tests for sign extension after rotate Date: Sat, 17 Oct 2026 23:26:12 +0300 Message-ID: <20261017202638.728621-54-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269267145158500 Content-Type: text/plain; charset="utf-8" From: Dominic P Cover the rotr_i32 (ARM ror) and rotl_i32 (i386 roll) forms fixed by the previous patch. Both tests fail without it. Signed-off-by: Dominic P Signed-off-by: Richard Henderson Message-ID: <20260930185124.3036980-3-gcc@gcc.dp11.uk> (cherry picked from commit f9ca6b19acb1b935e7abc920410c993b059a8b4d) (Mjt: back-port across Makefile=3D>meson conversion for tests) Signed-off-by: Michael Tokarev diff --git a/tests/tcg/arm/Makefile.target b/tests/tcg/arm/Makefile.target index 51a3ed76a8..1e5b32ccfe 100644 --- a/tests/tcg/arm/Makefile.target +++ b/tests/tcg/arm/Makefile.target @@ -34,6 +34,9 @@ pcalign-a32: CFLAGS+=3D-marm =20 ARM_TESTS +=3D issue4448 =20 +ARM_TESTS +=3D test-arm-opt-ror +test-arm-opt-ror: CFLAGS+=3D-marm + ifeq ($(CONFIG_ARM_COMPATIBLE_SEMIHOSTING),y) =20 # Semihosting smoke test for linux-user diff --git a/tests/tcg/arm/test-arm-opt-ror.c b/tests/tcg/arm/test-arm-opt-= ror.c new file mode 100644 index 0000000000..2579168a13 --- /dev/null +++ b/tests/tcg/arm/test-arm-opt-ror.c @@ -0,0 +1,21 @@ +/* SPDX-License-Identifier: GPL-2.0-or-later */ +/* Regression test for tcg optimize vs sign bit repetitions after rotate. = */ + +#include + +int main(void) +{ + /* Load from memory so that TCG does not see a constant. */ + volatile int v =3D 3; + int x =3D v, gt; + + asm("sxtb %1, %1\n\t" + "ror %1, %1, #1\n\t" + "sxtb %1, %1\n\t" + "cmp %1, #0\n\t" + "movle %0, #0\n\t" + "movgt %0, #1" + : "=3Dr"(gt), "+r"(x) : : "cc"); + assert(gt); + return 0; +} diff --git a/tests/tcg/i386/test-i386-opt-rol.c b/tests/tcg/i386/test-i386-= opt-rol.c new file mode 100644 index 0000000000..e0393147e1 --- /dev/null +++ b/tests/tcg/i386/test-i386-opt-rol.c @@ -0,0 +1,21 @@ +/* SPDX-License-Identifier: GPL-2.0-or-later */ +/* Regression test for tcg optimize vs sign bit repetitions after rotate. = */ + +#include + +int main(void) +{ + /* Load from memory so that TCG does not see a constant. */ + volatile int v =3D 3; + int x =3D v; + char test; + + asm("movsbl %b1, %1\n\t" + "roll $31, %1\n\t" + "movsbl %b1, %1\n\t" + "testl %1, %1\n\t" + "setg %0" + : "=3Dq"(test), "+q"(x)); + assert(test); + return 0; +} --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269294; cv=none; d=zohomail.com; s=zohoarc; b=JVZcza63ya0ge5LInew0hSGmiwilImobX8GHkHH2vP8Hi4tskWiQGbhPsZbYQB8TEomp3k2I+xhJPOyE5qcInkDRvKCmoido7jEcOIKKQqnyhChr1GX9hhh5XoE8OTJTrcpzb+f54qLV/Uj2qUm5Ax8/jE2KU3jEQMghg0opLqE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269294; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=HErowyBA4IvKMUrn0ZvgFhvNSPmz2zqGVTPCsN9A9wY=; b=BJeFuuOUBfNT/4dL+PYp4OBskQh/dANE63dEVK9x9F/0Nde3SLfAKzWORqnGxzAmBS/2T6Kc1rQwxx5RxNjA4G/iMhJDroV4c3L2jcjBbPMpqLIOzaMFAJ3cYYDNTU2YlBGPpQx+WwgrE+lqSDYZkHYmpuMrW8eMJ6PcmxxJrV0= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269294679427.24899084848164; Sat, 17 Oct 2026 13:34:54 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB5r-0006mI-I9; Sat, 17 Oct 2026 16:33:29 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB4c-00047q-Vf; Sat, 17 Oct 2026 16:32:14 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB4Z-0004ZP-Pt; Sat, 17 Oct 2026 16:32:10 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id C18D21DE775; Sat, 17 Oct 2026 23:28:03 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 0E846443449; Sat, 17 Oct 2026 23:28:02 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268883; bh=BZ7RBmb5WhcAgkBggiI5IidmdW4xw8utdBJQ/DY1vsw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=nPHdMxT1pLJ7J6YXAn1q67NXDayEho6/+gYzYgSt0mcAVK7TO62cW5vsFxGH4gK8Y svgmjoW5clr/hKnhc2Hhmw/hiv8EJls4sQJ9BbrF1tbt/rB9NVZ38vgqSUT6ZjHJio 3jklw5DcCPHqhfY0SY6wqy2S5rCoruJWkPVmVcYVZOmyQIg4E3XSuch8B4lgUJOqPm NjEqzSFJVZE+vSvdFiQiA6/N31DmtMBIiGfzoTCesrhC3F4navZqh8xhLjrMeQGZuI REQr4Z9YdxkBdTu98c+ylM8v8LdshcYBdMCMl7VOzOuPPh71ytAtlkOkOnTYgLC463 8FWHVeCzhpOsw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Artemii Mashanov , Paolo Bonzini , Michael Tokarev Subject: [Stable-11.1.3 55/73] target/i386/tcg: zero FXSAVE FOP and reserved slot bytes Date: Sat, 17 Oct 2026 23:26:13 +0300 Message-ID: <20261017202638.728621-55-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269295800158500 Content-Type: text/plain; charset="utf-8" From: Artemii Mashanov TCG's do_xsave_fpu() omitted writing the FOP field and the reserved bytes (10..15) of each x87 register slot. Those parts of the destination buffer retained their previous contents. The reserved bytes of all eight slots are zeroed. TCG does not yet track the actual FOP value, this patch stores a fixed zero instead. Add a regression test in tests/tcg/x86_64/fxsave.c. It fills the FXSAVE area with 0xcc, executes FNINIT and FXSAVE64, then verifies that FOP and all reserved slot bytes are zero. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3522 Signed-off-by: Artemii Mashanov Link: https://lore.kernel.org/r/20260826171655.117679-1-ralerrdirsardx@gmai= l.com Signed-off-by: Paolo Bonzini (cherry picked from commit 0dd9fb43ea221260969be449b596e7252abbca80) (Mjt: fixup for make=3D>meson test conversion) Signed-off-by: Michael Tokarev diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c index 62f1c110e2..470061e2c4 100644 --- a/target/i386/tcg/fpu_helper.c +++ b/target/i386/tcg/fpu_helper.c @@ -2617,6 +2617,7 @@ static void do_xsave_fpu(X86Access *ac, target_ulong = ptr) access_stw(ac, ptr + XO(legacy.fcw), env->fpuc); access_stw(ac, ptr + XO(legacy.fsw), fpus); access_stw(ac, ptr + XO(legacy.ftw), fptag ^ 0xff); + access_stw(ac, ptr + XO(legacy.fpop), 0); =20 /* In 32-bit mode this is eip, sel, dp, sel. In 64-bit mode this is rip, rdp. @@ -2629,6 +2630,8 @@ static void do_xsave_fpu(X86Access *ac, target_ulong = ptr) for (i =3D 0; i < 8; i++) { floatx80 tmp =3D ST(i); do_fstt(ac, addr, tmp); + access_stw(ac, addr + 10, 0); + access_stl(ac, addr + 12, 0); addr +=3D 16; } } diff --git a/tests/tcg/x86_64/Makefile.target b/tests/tcg/x86_64/Makefile.t= arget index c48767fef8..0f8f48b1a5 100644 --- a/tests/tcg/x86_64/Makefile.target +++ b/tests/tcg/x86_64/Makefile.target @@ -20,6 +20,7 @@ X86_64_TESTS +=3D test-1648 X86_64_TESTS +=3D test-2175 X86_64_TESTS +=3D cross-modifying-code X86_64_TESTS +=3D fma +X86_64_TESTS +=3D fxsave TESTS=3D$(MULTIARCH_TESTS) $(X86_64_TESTS) test-x86_64 else TESTS=3D$(MULTIARCH_TESTS) diff --git a/tests/tcg/x86_64/fxsave.c b/tests/tcg/x86_64/fxsave.c new file mode 100644 index 0000000000..d08a4e8a0e --- /dev/null +++ b/tests/tcg/x86_64/fxsave.c @@ -0,0 +1,66 @@ +/* + * SPDX-License-Identifier: GPL-2.0-or-later + * See https://gitlab.com/qemu-project/qemu/-/issues/3522 + */ + +#include +#include +#include + +#define FXSAVE_FOP_OFFSET 6 +#define FXSAVE_X87_OFFSET 32 +#define FXSAVE_SLOT_SIZE 16 +#define FXSAVE_RESERVED_START 10 +#define FXSAVE_NUM_SLOTS 8 + +struct fxsave_area { + uint8_t raw[512]; +} __attribute__((aligned(16))); + +_Static_assert(sizeof(struct fxsave_area) =3D=3D 512, + "FXSAVE area must be exactly 512 bytes"); + +static uint16_t u16_le(const uint8_t *p) +{ + uint16_t v; + memcpy(&v, p, sizeof(v)); + return v; +} + +int main(void) +{ + struct fxsave_area area; + uint16_t fop; + + memset(&area, 0xcc, sizeof(area)); + + __asm__ volatile( + "fninit\n\t" + "fxsave64 %0" + : "+m" (area) + : + : "memory" + ); + + fop =3D u16_le(&area.raw[FXSAVE_FOP_OFFSET]); + if (fop !=3D 0) { + fprintf(stderr, "FOP: expected 0, got 0x%04x\n", (unsigned)fop); + return 1; + } + + for (int slot =3D 0; slot < FXSAVE_NUM_SLOTS; slot++) { + int base =3D FXSAVE_X87_OFFSET + slot * FXSAVE_SLOT_SIZE; + for (int b =3D FXSAVE_RESERVED_START; b < FXSAVE_SLOT_SIZE; b++) { + uint8_t val =3D area.raw[base + b]; + if (val !=3D 0) { + fprintf(stderr, + "Slot %d byte %d (offset %d): expected 0x00, " + "got 0x%02x\n", + slot, b, base + b, (unsigned)val); + return 1; + } + } + } + + return 0; +} --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269608; cv=none; d=zohomail.com; s=zohoarc; b=X4VdwdopvxuyP6/UukrjFbJ0SIIwUWaqMh5LJQjjiBk2GG9UzLNEx0GUnr41TbGkey8Q15Q48ixPS7HHJlNskWh0rbpFxXDrOWooAm5wp/XrQ48rGIQCS6Lzhx1wVegcwOSNSXTgASZp2xcg/J7OWf96q/820x3kAPGd7ceeUe0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269608; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=H82xPZwSTfw2NXRzuGeCG8C19AYu0CGTOT8r78PFYus=; b=lbFWza2KnlrANXDiZbeBncyKP5/BoxREg08GgYe3iE7NJn8MZ4z5kvWyMq6NGDv7W7o6iCQaoNC+MzmldLwVA6QcVfBlnNj3m6BSyX2eDelU6spGI2BipAIGTLoWggszinehb+105GhUwTKaJBc/FYok5O2aKjN6F2+IrHlKbgs= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269608211182.10438152630945; Sat, 17 Oct 2026 13:40:08 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB6R-00081K-Pf; Sat, 17 Oct 2026 16:34:03 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB4c-00047p-V5; Sat, 17 Oct 2026 16:32:14 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB4a-0004ZV-84; Sat, 17 Oct 2026 16:32:10 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id D74771DE777; Sat, 17 Oct 2026 23:28:04 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id F30AF44344A; Sat, 17 Oct 2026 23:28:03 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268884; bh=xQYA0PFq+WmdIJJq6hxPRWeeYXMKl/vubCd2Y+gkCEU=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=GjeUwV3eHyvLqOqe7syZw6RpY7nxGfMwJs9bzERn2vc7XY5olQ51HO7OwC9ZQx9q8 kgi0jRHDb8AL3DR63z7tVFPrrkEnv7VpvPpYLlSfiBXThEkJiIsXM+MndB3VMxF+Aq Uno4oVAE/w6VJ8jeMliuN/D2YDOdU99Si4VwYrUi3a+2CwKLTVJ370gR/+BlzAXlkF j+ByUT/an3PxjqISjJ1OFdoZfMsqzdJkrfczSGkn6nVhpz9JI8aN8jjss/5KV5E1Rv xCmevpaqZhi/4RDTo99+H1A9ZSm1U3/DCgNco4nDt3rtuA93/8mNkE7zgGAQT3GN16 FYrOfG3ndi0Ug== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Artemii Mashanov , Paolo Bonzini , Michael Tokarev Subject: [Stable-11.1.3 56/73] target/i386: fix immediate stack adjustment for RET and RETF Date: Sat, 17 Oct 2026 23:26:14 +0300 Message-ID: <20261017202638.728621-56-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269608896158500 Content-Type: text/plain; charset="utf-8" From: Artemii Mashanov The imm16 operand of RET and RETF specifies an unsigned 16-bit count of additional bytes to release from the stack. Previously, gen_RET() and gen_RETF() stored this operand in an int16_t. For example, 0xcaf5 was interpreted as -13579 instead of 51957. Use uint16_t for the adjustment in both functions to preserve the immediate's unsigned value. Tested locally with near and far returns in both 32-bit and 64-bit modes. Each combination covered the form without an immediate and immediate values 0x0000, 0x0001, 0x7fff, 0x8000, 0xcaf5, and 0xffff. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2599 Signed-off-by: Artemii Mashanov Link: https://lore.kernel.org/r/20260924200420.21068-1-ralerrdirsardx@gmail= .com Signed-off-by: Paolo Bonzini (cherry picked from commit 21b6c3e5bccfc07d2719f6de27c40df5af283748) Signed-off-by: Michael Tokarev diff --git a/target/i386/tcg/emit.c.inc b/target/i386/tcg/emit.c.inc index 473f415766..0c35403ebc 100644 --- a/target/i386/tcg/emit.c.inc +++ b/target/i386/tcg/emit.c.inc @@ -3598,7 +3598,7 @@ static void gen_RDxxBASE(DisasContext *s, X86DecodedI= nsn *decode) =20 static void gen_RET(DisasContext *s, X86DecodedInsn *decode) { - int16_t adjust =3D decode->e.op1 =3D=3D X86_TYPE_I ? decode->immediate= : 0; + uint16_t adjust =3D decode->e.op1 =3D=3D X86_TYPE_I ? decode->immediat= e : 0; =20 MemOp ot =3D gen_pop_T0(s); gen_stack_update(s, adjust + (1 << ot)); @@ -3609,7 +3609,7 @@ static void gen_RET(DisasContext *s, X86DecodedInsn *= decode) =20 static void gen_RETF(DisasContext *s, X86DecodedInsn *decode) { - int16_t adjust =3D decode->e.op1 =3D=3D X86_TYPE_I ? decode->immediate= : 0; + uint16_t adjust =3D decode->e.op1 =3D=3D X86_TYPE_I ? decode->immediat= e : 0; =20 if (!PE(s) || VM86(s)) { gen_lea_ss_ofs(s, s->A0, cpu_regs[R_ESP], 0); --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269576; cv=none; d=zohomail.com; s=zohoarc; b=XFq7HBusN1fschaGteR3qfpEIDAqSTGlFOb+z01HrvvmUg5xxI4wNsE67MCBnXB+ECtoUHCkKw785nFQlNO6uzs32IwjKmdumcnUucBFEmkyKxRwhzqA2ylroYrI06s5Ln1fcSM2WJ+/IWqbjmPW3Wc753HvG2SdgOyv/+VbBmc= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269576; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=8SOl/KxvlzrQP9yWkgSeHJBYCEJgSOb1CdhvE0XPSMs=; b=Qc7f/ifmYHltofJHNXwu/GnxPDggFqLFfDJt9KZxDPCLHz+OOTKt5BRp8gs2cvsaKIuoJppWw+PiuzwX6eNklya/eM5Hv1TmSTMEi1qwImVeApwZS5y+MDRQfn8B25na3S+Jdwuny+r5rHkfJZW6NY+lDigHmwc0FDTG04bMfBI= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269576584341.31103440863376; Sat, 17 Oct 2026 13:39:36 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB6K-0007jP-TT; Sat, 17 Oct 2026 16:33:58 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB50-00054b-VX; Sat, 17 Oct 2026 16:32:43 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB4y-0004Zp-EG; Sat, 17 Oct 2026 16:32:34 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 1ED781DE778; Sat, 17 Oct 2026 23:28:06 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 3162B44344B; Sat, 17 Oct 2026 23:28:05 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268886; bh=/hjim3sGpvPu2nrQDft9ddD+RnfP1NBkRSf+ev50goA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=aa5gRF93PeaQUbheXqdhCp05CvqnJ33ViQwRjR0FftjDuJvuPu9FGPeNrQzCsPq/6 mWBhJrRfbIXW29WlXmEc28WVd/ZG9Ci1hptLZQJdatTqc2RqRo3e9cZzuOoN0mmlMH IiqrYOy1WrDV9EbjNSitkvl3u6nlwU5ZScrD7No8E5iV+G7gPfgiy7pDUYXTGvRd5x Reo/u7kqjsEEqkCTtkGHOjbOwRJRzZhWHiXkJ6SiNOsWB/fzjq9NAVO9wTymHOpX+g JqEE9zUk1rh8tfM72O46rZALKaSjwle8VOR33SLSc9eO/YXXh4Is2dPPbxqHzs+hRM tichjA1jCuCBw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Aurelien Jarno , Richard Henderson , Michael Tokarev Subject: [Stable-11.1.3 57/73] tcg/riscv64: Remove vector min/max ops with immediates Date: Sat, 17 Oct 2026 23:26:15 +0300 Message-ID: <20261017202638.728621-57-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269578215158500 Content-Type: text/plain; charset="utf-8" From: Aurelien Jarno RVV 1.0 only defines vmin, vminu, vmax and vmaxu instructions for the vector-vector and vector-scalar case, not the for vector-immediate case. Remove the immediate variant from TCG code generation. Fixes: 1631f19b04fe ("tcg/riscv: Implement vector min/max ops") Signed-off-by: Aurelien Jarno Reviewed-by: Richard Henderson Signed-off-by: Richard Henderson Message-ID: <20261008181611.3015838-1-aurelien@aurel32.net> (cherry picked from commit 306d9ab85fdbbc626c067777cea70dccec22dae9) Signed-off-by: Michael Tokarev diff --git a/tcg/riscv64/tcg-target.c.inc b/tcg/riscv64/tcg-target.c.inc index 86baf5a213..9e9c1e9622 100644 --- a/tcg/riscv64/tcg-target.c.inc +++ b/tcg/riscv64/tcg-target.c.inc @@ -299,13 +299,9 @@ typedef enum { OPC_VSSUBU_VI =3D 0x88000057 | V_OPIVI, =20 OPC_VMAX_VV =3D 0x1c000057 | V_OPIVV, - OPC_VMAX_VI =3D 0x1c000057 | V_OPIVI, OPC_VMAXU_VV =3D 0x18000057 | V_OPIVV, - OPC_VMAXU_VI =3D 0x18000057 | V_OPIVI, OPC_VMIN_VV =3D 0x14000057 | V_OPIVV, - OPC_VMIN_VI =3D 0x14000057 | V_OPIVI, OPC_VMINU_VV =3D 0x10000057 | V_OPIVV, - OPC_VMINU_VI =3D 0x10000057 | V_OPIVI, =20 OPC_VMSEQ_VV =3D 0x60000057 | V_OPIVV, OPC_VMSEQ_VI =3D 0x60000057 | V_OPIVI, @@ -2731,19 +2727,19 @@ static void tcg_out_vec_op(TCGContext *s, TCGOpcode= opc, break; case INDEX_op_smax_vec: set_vtype_len_sew(s, type, vece); - tcg_out_opc_vv_vi(s, OPC_VMAX_VV, OPC_VMAX_VI, a0, a1, a2, c2); + tcg_out_opc_vv(s, OPC_VMAX_VV, a0, a1, a2); break; case INDEX_op_smin_vec: set_vtype_len_sew(s, type, vece); - tcg_out_opc_vv_vi(s, OPC_VMIN_VV, OPC_VMIN_VI, a0, a1, a2, c2); + tcg_out_opc_vv(s, OPC_VMIN_VV, a0, a1, a2); break; case INDEX_op_umax_vec: set_vtype_len_sew(s, type, vece); - tcg_out_opc_vv_vi(s, OPC_VMAXU_VV, OPC_VMAXU_VI, a0, a1, a2, c2); + tcg_out_opc_vv(s, OPC_VMAXU_VV, a0, a1, a2); break; case INDEX_op_umin_vec: set_vtype_len_sew(s, type, vece); - tcg_out_opc_vv_vi(s, OPC_VMINU_VV, OPC_VMINU_VI, a0, a1, a2, c2); + tcg_out_opc_vv(s, OPC_VMINU_VV, a0, a1, a2); break; case INDEX_op_shls_vec: set_vtype_len_sew(s, type, vece); @@ -2895,10 +2891,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsign= ed flags) case INDEX_op_sssub_vec: case INDEX_op_usadd_vec: case INDEX_op_ussub_vec: - case INDEX_op_smax_vec: - case INDEX_op_smin_vec: - case INDEX_op_umax_vec: - case INDEX_op_umin_vec: return C_O1_I2(v, v, vK); case INDEX_op_sub_vec: return C_O1_I2(v, vK, v); @@ -2908,6 +2900,10 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsign= ed flags) case INDEX_op_sarv_vec: case INDEX_op_rotlv_vec: case INDEX_op_rotrv_vec: + case INDEX_op_smax_vec: + case INDEX_op_smin_vec: + case INDEX_op_umax_vec: + case INDEX_op_umin_vec: return C_O1_I2(v, v, v); case INDEX_op_shls_vec: case INDEX_op_shrs_vec: --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269449; cv=none; d=zohomail.com; s=zohoarc; b=Xf+yFNuAuxMT+QHa06xVGKX0PJkprjJuzewXYw/r1vsMqAKuG1X4ItNbp23Un4t7CPrCmpirzbAYmM0R+wYfFCxB9wudZLiXFmzvWbOlyXYpgApDhzNecoZ5MTe0PO+28WCy4U1/gHv+w6sLndioWZjqdHzfsqDvqIZuQQ0Q7Bg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269449; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=nj5poVbDEM6wWOM1t9DlVe1RYLN0Is1hYfEOLiHgcds=; b=TE+5YTh9lq5tBksV+J6vi4u/LaS8I15GKddwDTzWMZ2S5B5tE1vKDe56X9rdyZxDtHC/46HIC9dA6eMnx6oGgA2B0ox/xYUHg1FQExr26oxLpHe19O39RPzsady07XK4ZejrXzzqlGXevDFmBqjqOIer0BERCVe70reGjYeHG0I= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269449949608.9667440402478; Sat, 17 Oct 2026 13:37:29 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB6j-0000Pv-8U; Sat, 17 Oct 2026 16:34:21 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB51-00054e-1P; Sat, 17 Oct 2026 16:32:43 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB4y-0004Zq-DR; Sat, 17 Oct 2026 16:32:34 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 430C61DE779; Sat, 17 Oct 2026 23:28:07 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 50C6544344C; Sat, 17 Oct 2026 23:28:06 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268887; bh=L9B8d1Hu+c8ihlJHBjp15OqI98nKpqYwbkty3L3XrcM=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=p6nX8FLkgPh/uqSZR28sszpXRkhWmqNg9OqvfgOXfrsIzU9PyLkCYN4Dp2WrSRHgN KaL6Xo0yPfvvrEayEeG9bmk2CDzIgciO3QMhKNCHOLy6aVR4a1cMpnh5BgNMvveGCO aCOa+vasKYITq0nmOshHHx2x+WxYvgqOKUzAPXaXKHVdi+RpXzXWIv2kBMh7wGMG6b 3228FkobIRbk8crGOju/9J35pmzMsXxVq9QIrRNf4jy38Tqdh1/9STkiislAIfJ/h+ 40jlkgEJIwn8VJIUDeHLLj+x7u5pkuC+OyiVCfg6HsVM9npIX3SkE2sama+ZB4SNWB 3z84pS9LNU+4g== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Fuad Tabba , Itaru Kitayama , Gustavo Romero , Peter Maydell , Michael Tokarev Subject: [Stable-11.1.3 58/73] target/arm: Clear TTBR[5:0] from a 52-bit table base address Date: Sat, 17 Oct 2026 23:26:16 +0300 Message-ID: <20261017202638.728621-58-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269451808158500 Content-Type: text/plain; charset="utf-8" From: Fuad Tabba get_phys_addr_lpae() can read the first descriptor of a walk from the wrong address. This happens with a 52-bit OA when the initial lookup table has fewer than eight entries and its base address has bit 51 set, or bit 50 for a two-entry table. The walk then faults or translates through whatever that address holds. VTTBR walks for stage 2 take the same path. For example, the 16KB granule with a 48-bit VA has a two-entry level 0 (FEAT_LPA2). The 64KB granule with a 44-bit VA has a four-entry level 1 (FEAT_LPA). KVM's page_fault_test hangs on this in its 16KB, 52-bit PA guest mode under TCG, as reported on kvmarm. With a 52-bit OA, TTBR[5:2] hold bits [51:48] of the base address. Such a table is 64-byte aligned (R_KBLCR), so bits [5:0] of the base address are zero. get_phys_addr_lpae() ORs TTBR[5:2] into bits [51:48], but then clears only the bits in indexmask. For these tables indexmask covers fewer than six bits, so TTBR[5] stays in the address, and TTBR[4] too for a two-entry table. Clear TTBR[5:0] when forming a 52-bit table base address. Cc: qemu-stable@nongnu.org Fixes: 7a928f43d872 ("target/arm: Implement FEAT_LPA") Reported-by: Itaru Kitayama Reviewed-by: Gustavo Romero Signed-off-by: Fuad Tabba Message-id: 20261009115728.1299384-2-fuad.tabba@linux.dev Link: https://lore.kernel.org/kvmarm/B4C0AC3E-6A4F-4A7B-B7BC-81207539115E@l= inux.dev/ Signed-off-by: Fuad Tabba Reviewed-by: Peter Maydell Signed-off-by: Peter Maydell (cherry picked from commit 0dedeff9328d4d458dc849176e9bd4582b2b2bd8) Signed-off-by: Michael Tokarev diff --git a/target/arm/ptw.c b/target/arm/ptw.c index 663a4862a4..f1f8f5cdc0 100644 --- a/target/arm/ptw.c +++ b/target/arm/ptw.c @@ -2107,13 +2107,16 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1= Translate *ptw, descaddr =3D extract64(ttbr, 0, 48); =20 /* - * For FEAT_LPA and PS=3D6, bits [51:48] of descaddr are in [5:2] of T= TBR. + * With a 52-bit OA (FEAT_LPA or FEAT_LPA2), bits [51:48] of descaddr = are + * in [5:2] of TTBR, and bits [5:0] of the base address are zero: a ta= ble + * under 64 bytes is still 64-byte aligned (R_KBLCR). * * Otherwise, if the base address is out of range, raise AddressSizeFa= ult. * In the pseudocode, this is !IsZero(baseregister<47:outputsize>), * but we've just cleared the bits above 47, so simplify the test. */ if (outputsize > 48) { + descaddr &=3D ~MAKE_64BIT_MASK(0, 6); descaddr |=3D extract64(ttbr, 2, 4) << 48; } else if (descaddr >> outputsize) { level =3D 0; --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269622; cv=none; d=zohomail.com; s=zohoarc; b=Ip4nS6EXFYdX/qR5/fyjMrDgWhf97eZf6S9UvTpHz2RX9+Ubq2lgCqrjK0IfUql+Id5LagCGsIvEXxswhAFCvTOVlZhZJhx186wYwGwPiSai3xLpIBpN81DFRK1iyVLuflt/hgp7subfAtDnfsF9/weln3T6KK5M4E3lH+xK5wk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269622; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=qgTwBAiEdEvQSTA7K3YzO328NeciqjupDChD/mHk9fg=; b=WJ3XnDOcmQfbbh2Dr6s9GyRGF+aaJDt0+P5hgjbmlFAHI0hgHExFCwAPG0dCMmqeny4vkJOFm06rJjnXFujnoqp2ylNQWqIwVrniEiA++6lEu1J4xDIJLMAHTLmSH1b3kch8V6h/Irj1Pes/qe76rfCPxFR6YKJB24mE/A1UCcU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269622727845.011741692635; Sat, 17 Oct 2026 13:40:22 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB6s-0000jl-5q; Sat, 17 Oct 2026 16:34:30 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB56-00059g-J9; Sat, 17 Oct 2026 16:32:47 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB52-0004bC-Ee; Sat, 17 Oct 2026 16:32:38 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 5DD8C1DE77A; Sat, 17 Oct 2026 23:28:08 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 74A6E44344D; Sat, 17 Oct 2026 23:28:07 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268888; bh=wbO0jCxWd4ZwNU4HiubblS0ITDO+2nTSKnTM3UG8NIY=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=H63ZaTsLr7/Uj40TOBIHcwOIK46yVbfe/vZ+bbE8Ec6zld+GAr2RCa4Aob6BRb84E l9aDdA378tU01Yb6OuRWFlbqJXL6EguNa0EvxSePJPsGrcxvRpzIboLyPn69EAkVcK XTFylAcjK4e3cQBUDyLO9UD+64z+27CZ0rrJtz8ap4WAd/bVllwdHWV4+BbEmnJmIw WChHK1I+zAG1BtU5L0fYm6qfjgmv3ALTcfikOj+SdMGQ5BZ5LVKW+Xef8ra41bam11 tImgS9vzGLrlDN39B0xw0ML6UZkuy+VLNZuR+laxXFo9hRpeUQkv8260JeuqUzcoOd v0VcTWmmJtcbA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Fuad Tabba , Gustavo Romero , Peter Maydell , Michael Tokarev Subject: [Stable-11.1.3 59/73] tests/tcg/aarch64: Add a test for a two-entry 52-bit TTBR table Date: Sat, 17 Oct 2026 23:26:17 +0300 Message-ID: <20261017202638.728621-59-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269623267158500 Content-Type: text/plain; charset="utf-8" From: Fuad Tabba Add a test checking that, with a 52-bit OA, TTBR[4] of a two-entry level 0 table is taken only as base address bit 50, not also as bit 4. Reviewed-by: Gustavo Romero Signed-off-by: Fuad Tabba Message-id: 20261009115728.1299384-3-fuad.tabba@linux.dev Signed-off-by: Peter Maydell (cherry picked from commit bb79850255c885fa91e6c095b4e0d967ce6c98ca) (Mjt: adjust test for before make=3D>meson conversion) Signed-off-by: Michael Tokarev diff --git a/tests/tcg/aarch64/Makefile.softmmu-target b/tests/tcg/aarch64/= Makefile.softmmu-target index 4b92a2ffe4..2e90c9e532 100644 --- a/tests/tcg/aarch64/Makefile.softmmu-target +++ b/tests/tcg/aarch64/Makefile.softmmu-target @@ -85,6 +85,8 @@ run-gpc3-test: QEMU_OPTS=3D$(QEMU_EL3_MACHINE) $(QEMU_EL3= _BASE_ARGS) -kernel =20 run-wfxt: QEMU_OPTS=3D-M virt,virtualization=3Don,gic-version=3D2 -cpu max= -smp 1 -semihosting-config enable=3Don,arg=3D2 -kernel =20 +run-ttbr-baddr: QEMU_OPTS=3D-M virt,virtualization=3Don -cpu max -semihost= ing-config enable=3Don,arg=3D2 -kernel + # Simple Record/Replay Test .PHONY: memory-record run-memory-record: memory-record memory diff --git a/tests/tcg/aarch64/system/ttbr-baddr.c b/tests/tcg/aarch64/syst= em/ttbr-baddr.c new file mode 100644 index 0000000000..b29c9e1ab0 --- /dev/null +++ b/tests/tcg/aarch64/system/ttbr-baddr.c @@ -0,0 +1,153 @@ +/* + * TTBR base address with a 52-bit layout and a small initial lookup table + * + * With a 52-bit OA, walk a two-entry level 0 table through an IPA with + * bit 50 set, which stage 2 maps back onto the table, so the walk + * succeeds only if TTBR[4] is cleared from bit 4 of the base address. + * + * Copyright (c) 2026 Google LLC + * Author: Fuad Tabba + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#include +#include + +/* from Linux's include/linux/stringify.h */ +#define __stringify_1(x...) #x +#define __stringify(x...) __stringify_1(x) + +#define read_sysreg(r) ({ \ + uint64_t __val; \ + asm volatile("mrs %0, " __stringify(r) : "=3Dr" (__val)); \ + __val; \ +}) + +#define write_sysreg(r, v) do { \ + uint64_t __val =3D (uint64_t)(v); \ + asm volatile("msr " __stringify(r) ", %x0" \ + : : "rZ" (__val)); \ +} while (0) + +/* + * kernel.ld links the test at 1GB, so the tables below lie within the + * blocks mapped at RAM_BASE. + */ +#define RAM_BASE 0x40000000UL +#define HIGH_IPA (1UL << 50) +#define TEST_VA (0xffff000000000000UL | RAM_BASE) + +/* + * Stage 1: 16KB granule, 48-bit VA, so level 0 has two entries. + * Stage 2: 64KB granule, 52-bit IPA, mapping RAM at its own address and + * again at HIGH_IPA. + */ +static uint64_t s1_l0[2048] __attribute__((aligned(16384))); +static uint64_t s1_l1[2048] __attribute__((aligned(16384))); +static uint64_t s1_l2[2048] __attribute__((aligned(16384))); +static uint64_t s2_l1[1024] __attribute__((aligned(65536))); +static uint64_t s2_l2[8192] __attribute__((aligned(65536))); +static uint64_t s2_l2_high[8192] __attribute__((aligned(65536))); + +#define TCR_T0SZ(x) ((uint64_t)(x) << 0) +#define TCR_T1SZ(x) ((uint64_t)(x) << 16) +#define TCR_TG0_16K (2UL << 14) +#define TCR_TG1_16K (1UL << 30) +#define TCR_IPS_52 (6UL << 32) +#define TCR_DS (1UL << 59) + +#define VTCR_T0SZ(x) ((uint64_t)(x) << 0) +#define VTCR_SL0_L1 (2UL << 6) +#define VTCR_TG0_64K (1UL << 14) +#define VTCR_PS_52 (6UL << 16) +#define VTCR_RES1 (1UL << 31) + +#define HCR_VM (1UL << 0) +#define HCR_RW (1UL << 31) + +#define PAR_F (1UL << 0) +#define PAR_PA(par) ((par) & 0xfffffffff000UL) +#define S2_BLOCK ((1 << 10) | (3 << 6) | (0xf << 2) | 1) + +static void tlb_flush(void) +{ + asm volatile("dsb sy; tlbi alle1; dsb sy; isb" : : : "memory"); +} + +static uint64_t at(uint64_t ttbr1) +{ + uint64_t par; + + write_sysreg(ttbr1_el1, ttbr1); + tlb_flush(); + asm volatile("at s12e1r, %1; isb; mrs %0, par_el1" + : "=3Dr" (par) : "r" (TEST_VA)); + return par; +} + +static void setup_tables(void) +{ + /* Stage 1: TEST_VA -> RAM_BASE, 32MB block, AF */ + s1_l0[0] =3D (uint64_t)s1_l1 | 3; + s1_l1[0] =3D (uint64_t)s1_l2 | 3; + s1_l2[(RAM_BASE >> 25) & 0x7ff] =3D RAM_BASE | (1 << 10) | 1; + + /* Stage 2: 512MB blocks at RAM_BASE and HIGH_IPA | RAM_BASE, AF, RW */ + s2_l1[0] =3D (uint64_t)s2_l2 | 3; + s2_l1[HIGH_IPA >> 42] =3D (uint64_t)s2_l2_high | 3; + s2_l2[RAM_BASE >> 29] =3D RAM_BASE | S2_BLOCK; + s2_l2_high[RAM_BASE >> 29] =3D RAM_BASE | S2_BLOCK; +} + +static int check(const char *name, uint64_t par) +{ + int ok =3D !(par & PAR_F) && PAR_PA(par) =3D=3D RAM_BASE; + + ml_printf("%s: PAR_EL1=3D%lx %s\n", name, par, ok ? "ok" : "FAIL"); + return !ok; +} + +int main(void) +{ + uint64_t mmfr0 =3D read_sysreg(id_aa64mmfr0_el1); + uint64_t tcr =3D TCR_T0SZ(16) | TCR_T1SZ(16) | TCR_TG0_16K | TCR_TG1_1= 6K | + TCR_DS; + uint64_t base =3D (uint64_t)s1_l0; + int ret =3D 0; + + ml_printf("TTBR base address test\n"); + + /* + * PARange 52 bits (FEAT_LPA) and TGran16 with 52-bit addresses + * (FEAT_LPA2) + */ + if ((mmfr0 & 0xf) !=3D 6 || ((mmfr0 >> 20) & 0xf) !=3D 2) { + ml_printf("SKIP: no 52-bit PA or no FEAT_LPA2 with 16KB\n"); + return ret; + } + + /* + * The test runs at EL2 (arg=3D2) and walks the EL1&0 regime with AT, = so + * the EL1 MMU settings below only affect those walks. + */ + setup_tables(); + write_sysreg(mair_el1, 0xff); + write_sysreg(sctlr_el1, read_sysreg(sctlr_el1) | 1); + + /* + * 52-bit OA: TTBR[4] is base address bit 50, so with it set the + * level 0 table is at IPA HIGH_IPA | s1_l0. Stage 2 maps that IPA + * onto s1_l0 (through s2_l2_high), so the walk succeeds only if + * TTBR[4] does not also offset the two-entry table by 0x10. + */ + write_sysreg(vtcr_el2, VTCR_T0SZ(12) | VTCR_SL0_L1 | VTCR_TG0_64K | + VTCR_PS_52 | VTCR_RES1); + write_sysreg(vttbr_el2, (uint64_t)s2_l1); + write_sysreg(hcr_el2, HCR_RW | HCR_VM); + write_sysreg(tcr_el1, tcr | TCR_IPS_52); + ret |=3D check("ips52", at(base)); + ret |=3D check("ips52 ttbr[4]", at(base | (1 << 4))); + + return ret; +} --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269285; cv=none; d=zohomail.com; s=zohoarc; b=BK+SDXay66MqcHU6P9dt+Dlg941Ges3j34GBIHytPHzSMEmDDNYT5uG81r6yhkw66ZpHvFtPXRSOtVaTfFK7sEA8+BQqalTsRoyiSDgpdYSGQ56K1YyH/nWCNNMXq2o/RXqThBgk1TWNdCkedEUj2vste12B6NXiUfF/6hn5W4M= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269285; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=WkWjdJV0BcWl1qpAbX+ROUerBgf3A0GX1dG6EbQV1oc=; b=I5AbD0aEREkFafCphtd9wT4IUKQ7CGyud/YkianrmIAicTCtqkeMQeYhb9bIv7XWcKqCbRgj/sVfnillHBeyrJF/BoQFdqULwHkofEevu/7DYhITCvUiWdcZ8uOPbkzRQWKOeK91AUYnWOIchZX4ovEstbzPZXhEP7kEvg1Sc+8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269285533832.6091419722811; Sat, 17 Oct 2026 13:34:45 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB6R-000812-Pz; Sat, 17 Oct 2026 16:34:03 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB56-00059f-Iw; Sat, 17 Oct 2026 16:32:47 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB52-0004bD-EI; Sat, 17 Oct 2026 16:32:37 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id C6FD41DE77B; Sat, 17 Oct 2026 23:28:09 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id A636444344E; Sat, 17 Oct 2026 23:28:08 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268889; bh=VKUnSP4MIXl2/yGJYq9auI1KCGTNRfkDaSvnnfePFpI=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=fcA/7kZbIRrEL4SxkQpmJriwqgXeAJLqm7R3QpWXirffgMZoRwFdqVXs8Cwahi7Z1 Ax7WoyMt8pJDfTgCuNNE2c/+PtKT2JzN/YI6oe7nInjnnVfa+rHPTMKX9p9EWJXHTs 6g5ST2b9CLJk7dgfpXDsdg4X5xYWYpOPs1BD0QzclPLFryBNWr6lNawpFsK1Wl4jkp ocKb4uhEVp6LyhhWS9k8md8wP4sjwcqHXiFgd3eq/3JdnBS531vXwMGV/5Rd+YMjq8 UrnOGPnahFpQHDPKr+vPjcNanMJx+TOwR+V67dhIvI89MxNNxCJrFasBgYBZSEjtP1 2L2jAQtyztkug== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Fuad Tabba , Gustavo Romero , Peter Maydell , Michael Tokarev Subject: [Stable-11.1.3 60/73] target/arm: Use the 52-bit TTBR base address layout when TCR.DS is set Date: Sat, 17 Oct 2026 23:26:18 +0300 Message-ID: <20261017202638.728621-60-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269287610158500 Content-Type: text/plain; charset="utf-8" From: Fuad Tabba With TCR.DS set, TTBR[5:2] hold bits [51:48] of the translation table base address, whatever the OA size. If the effective OA size is below 52 bits, setting any of them is a level 0 Address size fault (AArch64_S1TTBaseAddress(), AArch64_S1Walk()). get_phys_addr_lpae() uses the 52-bit layout only when the OA size is over 48 bits. With TCR.DS set and an IPS of 48 bits, it takes TTBR[5:2] as base address bits [5:2] instead. A guest that sets them gets no fault: the walk either succeeds with TTBR[5:2] ignored, or reads its first descriptor from the wrong address. VTTBR walks with VTCR.DS take the same path. Use the 52-bit layout whenever TCR.DS is set, and check the whole base address against the OA size. Fixes: ef56c2425e5f ("target/arm: Implement FEAT_LPA2") Cc: qemu-stable@nongnu.org Reviewed-by: Gustavo Romero Signed-off-by: Fuad Tabba Message-id: 20261009115728.1299384-4-fuad.tabba@linux.dev Reviewed-by: Peter Maydell Signed-off-by: Peter Maydell (cherry picked from commit 2c372119465e14f26c094bdcca58e4b1fca84afd) Signed-off-by: Michael Tokarev diff --git a/target/arm/ptw.c b/target/arm/ptw.c index f1f8f5cdc0..ce256fc87c 100644 --- a/target/arm/ptw.c +++ b/target/arm/ptw.c @@ -2107,18 +2107,21 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1= Translate *ptw, descaddr =3D extract64(ttbr, 0, 48); =20 /* - * With a 52-bit OA (FEAT_LPA or FEAT_LPA2), bits [51:48] of descaddr = are - * in [5:2] of TTBR, and bits [5:0] of the base address are zero: a ta= ble - * under 64 bytes is still 64-byte aligned (R_KBLCR). + * With a 52-bit OA (FEAT_LPA or FEAT_LPA2), or with TCR.DS set at any= OA + * size, bits [51:48] of descaddr are in [5:2] of TTBR, and bits [5:0]= of + * the base address are zero: a table under 64 bytes is still 64-byte + * aligned (R_KBLCR). * - * Otherwise, if the base address is out of range, raise AddressSizeFa= ult. - * In the pseudocode, this is !IsZero(baseregister<47:outputsize>), - * but we've just cleared the bits above 47, so simplify the test. + * If the base address is out of range, raise AddressSizeFault. + * In the pseudocode, this is !IsZero(address) + * in AArch64_OAOutOfRange(), but descaddr has no bits set above 51, + * so simplify the test. */ - if (outputsize > 48) { + if (outputsize > 48 || param.ds) { descaddr &=3D ~MAKE_64BIT_MASK(0, 6); descaddr |=3D extract64(ttbr, 2, 4) << 48; - } else if (descaddr >> outputsize) { + } + if (descaddr >> outputsize) { level =3D 0; fi->type =3D ARMFault_AddressSize; goto do_fault; --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269615; cv=none; d=zohomail.com; s=zohoarc; b=aQSoGgVQ5e8/KsuNjjNpOlVwMVD0AAxAgMxftPbjdqjgvTVUSOlJVue3W6FZ4a82UfnbegErBxdYPh9rWilYyAC94RIijexQpKyymyvNXg2XXHTifNU0mL8w6OxnMF3JBeP0OjSUv7oqEfM73IBY04OZA1EtnS8ij+UvSI+gQrw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269615; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=6noHXjYX8cwCpWPuUXF8bqKUKYwjH/owly41OxbYc9o=; b=HSeYBw9uAFXCZVeIB4b2WbkGWNbnDoqqJWmd1G6O8qHaR9Orr0lh0Lci0neDnqNTRfM5br/euFQIkAW/yUyQ6zmJ4TZniml/JAJzNsupO+k3D33mxi+54SerCEWAHb0gU5v0XWQeCN6Rjb56VKGW/5p7Jswp1STnGvUQU+wjNdo= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269615880845.9474507917746; Sat, 17 Oct 2026 13:40:15 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB6t-0000sx-O9; Sat, 17 Oct 2026 16:34:32 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB5V-0005VH-Go; Sat, 17 Oct 2026 16:33:05 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB5S-0004be-Jw; Sat, 17 Oct 2026 16:33:05 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 0BCD81DE77C; Sat, 17 Oct 2026 23:28:11 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 069D244344F; Sat, 17 Oct 2026 23:28:09 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268891; bh=FXzr5fLZUvw+pZqQK2VFOPfwNcrD8X1apSacBXHdOXI=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=gtbXGoR9+8clWQtcOpLLz/H4W1qVV/RKKN7WYOYTCTlQMSrKdiUL3lcYN7OdgW/U6 T8999Ts3KO78NB1ziT1DzXegFNVAgx7T5wX0uDYgaDuEQMHNfn9Cj244WvLTA9M+Pn QRRIXc0pCPg0MwpY6vmBc1oRZsSJqq9jxmQTUa8+eiafvFMuzTSoRd8Ng+v1BNRwJ7 IkwY1QjUCL0BJ+1VNhxu9Tl2GPiquHKheTUAXOs0jf43KPF1KGmCcRpzEaZKd43dzr gWq/MNTnlMpyAue0OahEOP8bYha3asVTs9raJliPWGH9JKqjuUsmDIjb/ICy01n359 CuqRgUlPLrwQQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Fuad Tabba , Gustavo Romero , Peter Maydell , Michael Tokarev Subject: [Stable-11.1.3 61/73] tests/tcg/aarch64: Test the TTBR layout with TCR.DS and a 48-bit OA Date: Sat, 17 Oct 2026 23:26:19 +0300 Message-ID: <20261017202638.728621-61-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269617026158500 Content-Type: text/plain; charset="utf-8" From: Fuad Tabba Extend the TTBR base address test to check that, with TCR.DS or VTCR.DS and a 48-bit OA, setting TTBR[5:2] is a level 0 Address size fault. Reviewed-by: Gustavo Romero Signed-off-by: Fuad Tabba Message-id: 20261009115728.1299384-5-fuad.tabba@linux.dev Signed-off-by: Peter Maydell (cherry picked from commit 2579771a28a200cba27d843fbda549def09f421d) Signed-off-by: Michael Tokarev diff --git a/tests/tcg/aarch64/system/ttbr-baddr.c b/tests/tcg/aarch64/syst= em/ttbr-baddr.c index b29c9e1ab0..20a240410d 100644 --- a/tests/tcg/aarch64/system/ttbr-baddr.c +++ b/tests/tcg/aarch64/system/ttbr-baddr.c @@ -4,6 +4,8 @@ * With a 52-bit OA, walk a two-entry level 0 table through an IPA with * bit 50 set, which stage 2 maps back onto the table, so the walk * succeeds only if TTBR[4] is cleared from bit 4 of the base address. + * With TCR.DS or VTCR.DS and a 48-bit OA, check that setting TTBR[5:2] + * is a level 0 Address size fault. * * Copyright (c) 2026 Google LLC * Author: Fuad Tabba @@ -42,10 +44,13 @@ * Stage 1: 16KB granule, 48-bit VA, so level 0 has two entries. * Stage 2: 64KB granule, 52-bit IPA, mapping RAM at its own address and * again at HIGH_IPA. + * Stage 2 with VTCR.DS: 16KB granule, 47-bit IPA, mapping RAM flat. */ static uint64_t s1_l0[2048] __attribute__((aligned(16384))); static uint64_t s1_l1[2048] __attribute__((aligned(16384))); static uint64_t s1_l2[2048] __attribute__((aligned(16384))); +static uint64_t s2ds_l1[2048] __attribute__((aligned(16384))); +static uint64_t s2ds_l2[2048] __attribute__((aligned(16384))); static uint64_t s2_l1[1024] __attribute__((aligned(65536))); static uint64_t s2_l2[8192] __attribute__((aligned(65536))); static uint64_t s2_l2_high[8192] __attribute__((aligned(65536))); @@ -54,20 +59,27 @@ static uint64_t s2_l2_high[8192] __attribute__((aligned= (65536))); #define TCR_T1SZ(x) ((uint64_t)(x) << 16) #define TCR_TG0_16K (2UL << 14) #define TCR_TG1_16K (1UL << 30) +#define TCR_IPS_48 (5UL << 32) #define TCR_IPS_52 (6UL << 32) #define TCR_DS (1UL << 59) =20 #define VTCR_T0SZ(x) ((uint64_t)(x) << 0) #define VTCR_SL0_L1 (2UL << 6) +#define VTCR_TG0_16K (2UL << 14) #define VTCR_TG0_64K (1UL << 14) +#define VTCR_PS_48 (5UL << 16) #define VTCR_PS_52 (6UL << 16) #define VTCR_RES1 (1UL << 31) +#define VTCR_DS (1UL << 32) =20 #define HCR_VM (1UL << 0) #define HCR_RW (1UL << 31) =20 #define PAR_F (1UL << 0) +#define PAR_FST(par) (((par) >> 1) & 0x3f) #define PAR_PA(par) ((par) & 0xfffffffff000UL) +#define FST_ADDR_SIZE_L0 0x00 + #define S2_BLOCK ((1 << 10) | (3 << 6) | (0xf << 2) | 1) =20 static void tlb_flush(void) @@ -86,6 +98,17 @@ static uint64_t at(uint64_t ttbr1) return par; } =20 +static uint64_t at_s1(uint64_t ttbr1) +{ + uint64_t par; + + write_sysreg(ttbr1_el1, ttbr1); + tlb_flush(); + asm volatile("at s1e1r, %1; isb; mrs %0, par_el1" + : "=3Dr" (par) : "r" (TEST_VA)); + return par; +} + static void setup_tables(void) { /* Stage 1: TEST_VA -> RAM_BASE, 32MB block, AF */ @@ -93,6 +116,10 @@ static void setup_tables(void) s1_l1[0] =3D (uint64_t)s1_l2 | 3; s1_l2[(RAM_BASE >> 25) & 0x7ff] =3D RAM_BASE | (1 << 10) | 1; =20 + /* Stage 2 with VTCR.DS: RAM_BASE -> RAM_BASE, 32MB block, AF, RW */ + s2ds_l1[0] =3D (uint64_t)s2ds_l2 | 3; + s2ds_l2[(RAM_BASE >> 25) & 0x7ff] =3D RAM_BASE | S2_BLOCK; + /* Stage 2: 512MB blocks at RAM_BASE and HIGH_IPA | RAM_BASE, AF, RW */ s2_l1[0] =3D (uint64_t)s2_l2 | 3; s2_l1[HIGH_IPA >> 42] =3D (uint64_t)s2_l2_high | 3; @@ -108,6 +135,15 @@ static int check(const char *name, uint64_t par) return !ok; } =20 +/* A level 0 Address size fault */ +static int check_fault(const char *name, uint64_t par) +{ + int ok =3D (par & PAR_F) && PAR_FST(par) =3D=3D FST_ADDR_SIZE_L0; + + ml_printf("%s: PAR_EL1=3D%lx %s\n", name, par, ok ? "ok" : "FAIL"); + return !ok; +} + int main(void) { uint64_t mmfr0 =3D read_sysreg(id_aa64mmfr0_el1); @@ -135,6 +171,25 @@ int main(void) write_sysreg(mair_el1, 0xff); write_sysreg(sctlr_el1, read_sysreg(sctlr_el1) | 1); =20 + /* + * TCR.DS with a 48-bit OA: TTBR[5:2] are base address bits [51:48], + * so setting any of them is a level 0 Address size fault. + */ + write_sysreg(hcr_el2, HCR_RW); + write_sysreg(tcr_el1, tcr | TCR_IPS_48); + ret |=3D check("ips48", at_s1(base)); + ret |=3D check_fault("ips48 ttbr[2]", at_s1(base | (1 << 2))); + ret |=3D check_fault("ips48 ttbr[4]", at_s1(base | (1 << 4))); + + /* The same for VTTBR, with VTCR.DS and a 48-bit PS */ + write_sysreg(vtcr_el2, VTCR_T0SZ(17) | VTCR_SL0_L1 | VTCR_TG0_16K | + VTCR_PS_48 | VTCR_RES1 | VTCR_DS); + write_sysreg(hcr_el2, HCR_RW | HCR_VM); + write_sysreg(vttbr_el2, (uint64_t)s2ds_l1); + ret |=3D check("ps48", at(base)); + write_sysreg(vttbr_el2, (uint64_t)s2ds_l1 | (1 << 2)); + ret |=3D check_fault("ps48 vttbr[2]", at(base)); + /* * 52-bit OA: TTBR[4] is base address bit 50, so with it set the * level 0 table is at IPA HIGH_IPA | s1_l0. Stage 2 maps that IPA --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269469; cv=none; d=zohomail.com; s=zohoarc; b=P6Sa4qEKKxIJJNEjkP5FGV79CbrZNnvC85jK0OgOli3IQIWHhTADJpw0uUIdUg5Y31pETW0PnrlVUsZ6eZXqwO2edXmFHwm785ZpI0e7PEInE3YCh/mqKMPFUIGQLxHTt2kH8SEFoKXiuyzGTTXi3tKLKQqoPWm5Hvz7OfUpMwQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269469; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=h0iDRsR5MTb60le0e7lxaxmMmvWi8pJMpZjoJaJV7Eg=; b=YDKeme0W43zOU4PyaDhe3qWhYUZeew8IDEMXLXktK/XvCMy0q65bSURednSlJ0oJAqU+jsMTBPNbiH7NNY5yG1SawFJML+t/h8Yf35a3VrBDjc87ZqmDCNIDtZmvVG2Z+KqTb6yzaNpJ6ZHYUhFZx71Svx4HSA42cAcX6mvCAXQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 179226946965354.00403041551647; Sat, 17 Oct 2026 13:37:49 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB6p-0000ZY-BM; Sat, 17 Oct 2026 16:34:27 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB5C-0005AX-4F; Sat, 17 Oct 2026 16:32:51 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB58-0004bf-Fp; Sat, 17 Oct 2026 16:32:44 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 423141DE77E; Sat, 17 Oct 2026 23:28:12 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 3DC1D443450; Sat, 17 Oct 2026 23:28:11 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268892; bh=QDknTqFWnf6b2BAv6o+ny85Dh9cvCNbAvYkxns1YwtA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=FRgZR72XaRShrfuRqfIQqKa8YFuoxyDx4tauarWQY1HxnED9Fao7gDMt9ZUmlEE0h RaQFvhgNCRinMgfeytRf9llJ7lFv6R6507w8tAVEMp+RrMf70MKm7RI1FU9BW+F2fW cWwzuthmxb+J7+PrSvGJpKv6oxo+cRAR+t9EFR+tlVUAfP6L/48+aBPCLxbZtcl3dO vAcgIoSH4ArQG85xILlfvtUvXQcdmemirgBCWszLQ2UBRVwPF7HnMH1fCYNqvb1XJu vQnAqENAI5F0hxkuYj8mGeoHiLA4bubg5+aHvW5ZwjCKhidaldT/VUmQgLC/a8s4XE DxjaH/YOO6dUw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Jim MacArthur , Michael Tokarev Subject: [Stable-11.1.3 62/73] hw/intc/arm_gicv5: Make IRS_IDR0 reads return actual value, not 0 Date: Sat, 17 Oct 2026 23:26:20 +0300 Message-ID: <20261017202638.728621-62-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269470075158500 From: Peter Maydell IN the code for handling reads of IRS_IDR0, we carefully construct the correct value starting with cs->irs_idr0 and adjusting it. However, we never actually write the final value into *data, so the guest will always see zero. We didn't notice this before, because Linux happens to not care about this register value except to check for the presence of virtualization. Cc: qemu-stable@nongnu.org Fixes: 405ad2e76f13254 ("hw/intc/arm_gicv5: Implement IRS ID regs") Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daud=C3=A9 Reviewed-by: Jim MacArthur Message-id: 20261008092327.4036856-1-peter.maydell@linaro.org (cherry picked from commit 37f2ab559305f1f95dff9435c1e959a7a4a3f988) Signed-off-by: Michael Tokarev diff --git a/hw/intc/arm_gicv5.c b/hw/intc/arm_gicv5.c index 08878193df..ebfb0878af 100644 --- a/hw/intc/arm_gicv5.c +++ b/hw/intc/arm_gicv5.c @@ -1433,6 +1433,7 @@ static bool config_readl(GICv5 *s, GICv5Domain domain= , hwaddr offset, /* ...which means VIRT_ONE_N is also RES0 */ v &=3D ~R_IRS_IDR0_VIRT_ONE_N_MASK; } + *data =3D v; return true; =20 case A_IRS_IDR1: --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269568; cv=none; d=zohomail.com; s=zohoarc; b=Zy0U258L97gvGokg9kzRrwifnm9zV6qZy28zR3nPgLFHHVeE4YxVtZtDzm+xys2VQTEqwi7ziRqcBuiHvS/gcp03THHpbSsOh0SPz9EpgYliQnx9Un/NEH2NVrc382DI8+O8RVoQRbcccK4zoyh9iW2M5zljfUh3GKwMgFQ2Nig= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269568; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=R2G8NOR6TfAaC1x7a5H73awwSw/f9jkIii09jtJnrdk=; b=N91eiKZpnoBprAL+qtKZG7dfJmfpv6irrNWL9W6Tr6C36dANA7wmLA+Myx0C1pw/RusrfFD6rwHrKkjfakYw8TGXEGPfyOHF528CiaWXKx5hhpDDvh0vKW6KK7gH8+zIc0G1EDB/3c18YAC04+/sF1jCUb0mzgHWr3ViYR/zRdc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269568985404.68878449632723; Sat, 17 Oct 2026 13:39:28 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB79-0002VX-Hf; Sat, 17 Oct 2026 16:34:47 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB5Z-0005l5-Nc; Sat, 17 Oct 2026 16:33:09 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB5X-0004bz-Ld; Sat, 17 Oct 2026 16:33:09 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id AC9D51DE77F; Sat, 17 Oct 2026 23:28:13 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 8E9B9443451; Sat, 17 Oct 2026 23:28:12 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268893; bh=hIHywtbUhj0ylWeXACvYLsl62EhfvI5bfzg5tTlaYiM=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=roCT70pqwr8ePbcKL4owuocRc0zqOde8Bn9tvs1hdEOOD+dWqT7Mc6b0DpxCZe934 dfYm8n4Lf6cdNHfDHET7srhlKS0/7SQWSUvmvJeEbzXE9RgIc9jC+hX0jfavAbn9s+ g5LwaqnWpBbH5/QyuP3VmA/tkQJ/j/vih5EfjJcHWtpgnhcdn/lDMjdu2Lsy3PUFFv 9V2NE9trNtwO/vBaQOUxs3K9o51258our2HZcLrsSG/hsaAuWmwscvOYYPEVduwfdk p7SyZwsMiNVvelOfRwVe5bL51xoTHKujYYM0fO6/mV1aL/hiBkpormV11WLjXv3uHP ScYVqtca+00Jw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, imaginos , Alistair Francis , Michael Tokarev Subject: [Stable-11.1.3 63/73] target/riscv: check G-stage write permission for VS-stage A/D updates Date: Sat, 17 Oct 2026 23:26:21 +0300 Message-ID: <20261017202638.728621-63-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269570079158500 Content-Type: text/plain; charset="utf-8" From: imaginos During a two-stage (VS-stage + G-stage) page-table walk with hardware A/D updating enabled (Svadu / menvcfg.ADUE), a store that reaches a VS-stage leaf PTE whose accessed or dirty bit is clear triggers a hardware write-back of those bits into the PTE. That write-back is an implicit store to the PTE's guest-physical address, so it must be permitted by G-stage. Fix this by re-running the G-stage translation of the guest PTE's address with store semantics. get_physical_address() then also checks that G-stage permits the guest PTE to be written, and raises a guest-page store fault when it does not. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3426 Signed-off-by: imaginos Reviewed-by: Alistair Francis Message-ID: <20260705140508.17692-1-imaginos32@gmail.com> Signed-off-by: Alistair Francis (cherry picked from commit 366b4fba0fae0d9425b230e06c38842d72273d88) Signed-off-by: Michael Tokarev diff --git a/target/riscv/tcg/cpu_helper.c b/target/riscv/tcg/cpu_helper.c index 07d9222652..6115f65adb 100644 --- a/target/riscv/tcg/cpu_helper.c +++ b/target/riscv/tcg/cpu_helper.c @@ -1133,6 +1133,7 @@ static int get_physical_address(CPURISCVState *env, h= waddr *physical, int ptshift; target_ulong pte; hwaddr pte_addr; + hwaddr pte_gpa =3D 0; const hwaddr base_root =3D base; const bool be =3D mo_endian_env(env) =3D=3D MO_BE; int i; @@ -1170,6 +1171,7 @@ static int get_physical_address(CPURISCVState *env, h= waddr *physical, } =20 pte_addr =3D vbase + idx * ptesize; + pte_gpa =3D base + idx * ptesize; } else { pte_addr =3D base + idx * ptesize; } @@ -1424,6 +1426,28 @@ static int get_physical_address(CPURISCVState *env, = hwaddr *physical, return TRANSLATE_FAIL; } =20 + /* + * The implicit store that writes updated A/D bits back to a VS-st= age + * (first-stage) PTE must itself be permitted by G-stage. Re-run t= he + * second-stage translation of the PTE's guest-physical address wi= th + * store semantics. If G-stage denies write, raise G-stage store f= ault + * against the PTE address. + */ + if (two_stage && first_stage) { + int gpa_prot; + hwaddr gpa_paddr; + int gpa_ret =3D get_physical_address(env, &gpa_paddr, &gpa_pro= t, + pte_gpa, NULL, MMU_DATA_STO= RE, + MMUIdx_U, false, true, + is_debug, false); + if (gpa_ret !=3D TRANSLATE_SUCCESS) { + if (fault_pte_addr) { + *fault_pte_addr =3D pte_gpa >> 2; + } + return TRANSLATE_G_STAGE_FAIL; + } + } + pmp_ret =3D get_physical_address_pmp(env, &pmp_prot, pte_addr, sxlen_bytes, MMU_DATA_STORE, PR= V_S); if (pmp_ret !=3D TRANSLATE_SUCCESS) { @@ -2114,6 +2138,10 @@ void riscv_cpu_do_interrupt(CPUState *cs) * doing VS-stage page table walk. */ tinst =3D (riscv_cpu_xlen(env) =3D=3D 32) ? 0x00002000 : 0= x00003000; + + if (cause =3D=3D RISCV_EXCP_STORE_GUEST_AMO_ACCESS_FAULT) { + tinst |=3D 0x20; + } } else { /* * The "Addr. Offset" field in transformed instruction is --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269344; cv=none; d=zohomail.com; s=zohoarc; b=DDVfwIE5gAQsYVc+hlM0IctUnsAKxk7dzsFCFuXZaIz2NdTfvgGcrPTqtpLgzcUHpziYJdrB6HUOo3/QuNUKJOTOYLfW2bMtIEwshVFHzhbmSQOYKeUIWLu49IyCk/enEPPdwTY9qOu0X7UHyUyNRknE4reG8qnhRa9dcRozcwA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269344; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=OMwBJiuh5VPRus5D5m9fYHe7wcPsKVP36DvrRCm2YMs=; b=V4g4hqBQOIjS9HjvY9qGGC9wnqHQnPjiSegXkvyk4K3Etr095HkqdeuLQTYFxXQB76ZKA/TkMrCOYRadGXHYPOV7Qjv2xaCr1jfvnTP0+Q7d5C6TE3F+elRxLo59PCYzfVoinJ415Bqyw60Qi5YBiszhdqgC1oY/oVPPtbXjLR0= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269344895616.8691197446378; Sat, 17 Oct 2026 13:35:44 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB6b-0000BW-B6; Sat, 17 Oct 2026 16:34:15 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB5Z-0005j6-7F; Sat, 17 Oct 2026 16:33:09 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB5W-0004de-Qy; Sat, 17 Oct 2026 16:33:08 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id A14481DE780; Sat, 17 Oct 2026 23:28:15 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id E465B443452; Sat, 17 Oct 2026 23:28:13 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268895; bh=HvVxrMWANmmigS6XJMKkjruHYgespJRHf5h4WfPbtPM=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Z39CWz93LSm0geGtHsHQNmmDOiOoA/wNLSBMndlCv0ZK4mE6wAkeBf97avTNova7o wNQ625IllXd5sLE4Q1Pn8buTBfByYUyvfiwp5QEECU4NXMn6GPeOGDBIPYjl2ciy4Q yyzTLHQPJinNIVDw3tCcb1nCWjKmMi0xxnUUF50r7bU3NLeagtWw8mlCIvmjnRay+Q 6OkBz9/ji4ZNcKlkzmfMkD8ucTGPiD2zrj0FzMUuI54rAZs4vZZxfPGnWz9ft+qMlj ICJy2bjuuSIgGADAcjbaeE1A9LEwEmUUL8auJAGuA9oYpSFsv/tfSPtoAExqvRzGf6 orm6MvCBjGYFg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Mayuresh Chitale , Daniel Henrique Barboza , Gong Shuai , TianCheng TANG , Alistair Francis , Michael Tokarev Subject: [Stable-11.1.3 64/73] target/riscv: Restore LCOFI handling in interrupt CSRs Date: Sat, 17 Oct 2026 23:26:22 +0300 Message-ID: <20261017202638.728621-64-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269346973158500 Content-Type: text/plain; charset="utf-8" From: Mayuresh Chitale Commit 27f9566dcd98 dropped bits 13-15 from the LOCAL_INTERRUPTS macro and hence also from individual masks such as all_ints, sip_writable_mask etc. As a result, even with sscofpmf and ssaia enabled, the LCOFI never got delivered to the host OS and guest OS respectively. Add back bit 13 in all the affected masks, but gate it on Sscofpmf being implemented. For the virtual interrupt paths, i.e., mvip/mvien, hvip/hvien/vsip/vsie registers, bit 13 is additionally gated on Smaia and Ssaia respectively. Bits 14, 15 can be added when those interrupt sources get defined. Cc: qemu-stable@nongnu.org Fixes: 27f9566dcd98 ("target/riscv: Update the local interrupt mask") Reviewed-by: Daniel Henrique Barboza Suggested-by: Gong Shuai Suggested-by: TianCheng TANG Signed-off-by: Mayuresh Chitale Message-ID: <20260921145334.419651-1-mayuresh.chitale@oss.qualcomm.com> Signed-off-by: Alistair Francis (cherry picked from commit 7f9ab1dc6c6e0f855e0b098b3d8f404e760a1df5) Signed-off-by: Michael Tokarev diff --git a/target/riscv/tcg/csr.c b/target/riscv/tcg/csr.c index a4cd126999..b24a3448a5 100644 --- a/target/riscv/tcg/csr.c +++ b/target/riscv/tcg/csr.c @@ -1815,7 +1815,7 @@ static RISCVException write_stimecmph(CPURISCVState *= env, int csrno, #define LOCAL_INTERRUPTS (~0xFFFFULL) =20 static const uint64_t delegable_ints =3D - S_MODE_INTERRUPTS | VS_MODE_INTERRUPTS | MIP_LCOFIP; + S_MODE_INTERRUPTS | VS_MODE_INTERRUPTS; static const uint64_t vs_delegable_ints =3D (VS_MODE_INTERRUPTS | LOCAL_INTERRUPTS) & ~MIP_LCOFIP; static const uint64_t all_ints =3D M_MODE_INTERRUPTS | S_MODE_INTERRUPTS | @@ -1877,6 +1877,42 @@ static const uint64_t hvien_writable_mask =3D LOCAL_= INTERRUPTS; =20 static const uint64_t vsip_writable_mask =3D MIP_VSSIP | LOCAL_INTERRUPTS; =20 +/* + * Selects the extensions that need to be checked when accessing various + * interrupt registers. + */ +typedef enum { + /* Accessing mideleg, mie, mip, and alias paths */ + AIA_NONE, + /* Accessing mvien, mvip non-alias path */ + AIA_SMAIA, + /* Accessing hvien, hvip, vsie, vsip paths */ + AIA_SSAIA, +} AIAExt; + +/* + * This function can be extended later to configure mask for standard local + * interrupt bits 14 and 15, once those get defined in the Priv Spec. + */ +static uint64_t std_impl_intr_mask(CPURISCVState *env, AIAExt ext) +{ + const RISCVCPUConfig *cfg =3D riscv_cpu_cfg(env); + + if (ext =3D=3D AIA_SMAIA && !cfg->ext_smaia) { + return 0; + } + + if (ext =3D=3D AIA_SSAIA && !cfg->ext_ssaia) { + return 0; + } + + if (!cfg->ext_sscofpmf) { + return 0; + } + + return MIP_LCOFIP; +} + /* Machine Information Registers */ static RISCVException read_zero(CPURISCVState *env, int csrno, target_ulong *val) @@ -2245,8 +2281,10 @@ static RISCVException rmw_mideleg64(CPURISCVState *e= nv, int csrno, uint64_t *ret_val, uint64_t new_val, uint64_t wr_mask) { + uint64_t std_mask =3D std_impl_intr_mask(env, AIA_NONE); uint64_t mask =3D wr_mask & delegable_ints; =20 + mask |=3D wr_mask & std_mask; if (ret_val) { *ret_val =3D env->mideleg; } @@ -2296,8 +2334,10 @@ static RISCVException rmw_mie64(CPURISCVState *env, = int csrno, uint64_t *ret_val, uint64_t new_val, uint64_t wr_mask) { + uint64_t std_mask =3D std_impl_intr_mask(env, AIA_NONE); uint64_t mask =3D wr_mask & all_ints; =20 + mask |=3D wr_mask & std_mask; if (ret_val) { *ret_val =3D env->mie; } @@ -2346,8 +2386,10 @@ static RISCVException rmw_mvien64(CPURISCVState *env= , int csrno, uint64_t *ret_val, uint64_t new_val, uint64_t wr_mask) { + uint64_t std_mask =3D std_impl_intr_mask(env, AIA_SMAIA); uint64_t mask =3D wr_mask & mvien_writable_mask; =20 + mask |=3D wr_mask & std_mask; if (ret_val) { *ret_val =3D env->mvien; } @@ -3780,9 +3822,12 @@ static RISCVException rmw_mip64(CPURISCVState *env, = int csrno, uint64_t *ret_val, uint64_t new_val, uint64_t wr_mask) { + uint64_t std_mask =3D std_impl_intr_mask(env, AIA_NONE); uint64_t old_mip, mask =3D wr_mask & delegable_ints; uint32_t gin; =20 + mask |=3D wr_mask & std_mask; + /* * When mvien[9]=3D1, mip.SEIP is read-only and reflects only * the external interrupt signal from the interrupt controller. @@ -3896,9 +3941,12 @@ static RISCVException rmw_mvip64(CPURISCVState *env,= int csrno, * alias_mask denotes the bits that come from mip nalias_mask denotes= bits * that come from hvip. */ - uint64_t alias_mask =3D ((S_MODE_INTERRUPTS | LOCAL_INTERRUPTS) & + AIAExt intr_virt =3D ((csrno =3D=3D CSR_MVIP) || (csrno =3D=3D CSR_MVI= PH)) ? + AIA_SMAIA : AIA_NONE; + uint64_t std_mask =3D std_impl_intr_mask(env, intr_virt); + uint64_t alias_mask =3D ((S_MODE_INTERRUPTS | std_mask | LOCAL_INTERRU= PTS) & (env->mideleg | ~env->mvien)) | MIP_STIP; - uint64_t nalias_mask =3D (S_MODE_INTERRUPTS | LOCAL_INTERRUPTS) & + uint64_t nalias_mask =3D (S_MODE_INTERRUPTS | std_mask | LOCAL_INTERRU= PTS) & (~env->mideleg & env->mvien); uint64_t wr_mask_mvip; uint64_t wr_mask_mip; @@ -3927,8 +3975,8 @@ static RISCVException rmw_mvip64(CPURISCVState *env, = int csrno, alias_mask &=3D ~MIP_STIP; } =20 - wr_mask_mip =3D wr_mask & alias_mask & mvip_writable_mask; - wr_mask_mvip =3D wr_mask & nalias_mask & mvip_writable_mask; + wr_mask_mip =3D wr_mask & alias_mask & (mvip_writable_mask | std_mask); + wr_mask_mvip =3D wr_mask & nalias_mask & (mvip_writable_mask | std_mas= k); =20 /* * For bits set in alias_mask, mvip needs to be alias of mip, so forwa= rd @@ -4061,9 +4109,11 @@ static RISCVException rmw_vsie64(CPURISCVState *env,= int csrno, uint64_t *ret_val, uint64_t new_val, uint64_t wr_mask) { - uint64_t alias_mask =3D (LOCAL_INTERRUPTS | VS_MODE_INTERRUPTS) & - env->hideleg; - uint64_t nalias_mask =3D LOCAL_INTERRUPTS & (~env->hideleg & env->hvie= n); + uint64_t std_mask =3D std_impl_intr_mask(env, AIA_SSAIA); + uint64_t alias_mask =3D (LOCAL_INTERRUPTS | VS_MODE_INTERRUPTS | + std_mask) & env->hideleg; + uint64_t nalias_mask =3D (LOCAL_INTERRUPTS | std_mask) & + (~env->hideleg & env->hvien); uint64_t rval, rval_vs, vsbits; uint64_t wr_mask_vsie; uint64_t wr_mask_mie; @@ -4131,9 +4181,11 @@ static RISCVException rmw_sie64(CPURISCVState *env, = int csrno, uint64_t *ret_val, uint64_t new_val, uint64_t wr_mask) { - uint64_t nalias_mask =3D (S_MODE_INTERRUPTS | LOCAL_INTERRUPTS) & + uint64_t std_mask =3D std_impl_intr_mask(env, AIA_NONE); + uint64_t nalias_mask =3D (S_MODE_INTERRUPTS | std_mask | LOCAL_INTERRU= PTS) & (~env->mideleg & env->mvien); - uint64_t alias_mask =3D (S_MODE_INTERRUPTS | LOCAL_INTERRUPTS) & env->= mideleg; + uint64_t alias_mask =3D (S_MODE_INTERRUPTS | std_mask | LOCAL_INTERRUP= TS) & + env->mideleg; uint64_t sie_mask =3D wr_mask & nalias_mask; RISCVException ret; =20 @@ -4316,6 +4368,7 @@ static RISCVException rmw_vsip64(CPURISCVState *env, = int csrno, uint64_t new_val, uint64_t wr_mask) { RISCVException ret; + uint64_t std_mask =3D std_impl_intr_mask(env, AIA_SSAIA); uint64_t rval, mask =3D env->hideleg & VS_MODE_INTERRUPTS; uint64_t vsbits; =20 @@ -4331,7 +4384,7 @@ static RISCVException rmw_vsip64(CPURISCVState *env, = int csrno, wr_mask |=3D vsbits << 1; =20 ret =3D rmw_hvip64(env, csrno, &rval, new_val, - wr_mask & mask & vsip_writable_mask); + wr_mask & mask & (vsip_writable_mask | std_mask)); if (ret_val) { rval &=3D mask; vsbits =3D rval & VS_MODE_INTERRUPTS; @@ -4378,7 +4431,9 @@ static RISCVException rmw_sip64(CPURISCVState *env, i= nt csrno, uint64_t new_val, uint64_t wr_mask) { RISCVException ret; - uint64_t mask =3D (env->mideleg | env->mvien) & sip_writable_mask; + uint64_t std_mask =3D std_impl_intr_mask(env, AIA_NONE); + uint64_t mask =3D (env->mideleg | env->mvien) & + (sip_writable_mask | std_mask); =20 if (env->virt_enabled) { if (env->hvictl & HVICTL_VTI) { @@ -4391,7 +4446,7 @@ static RISCVException rmw_sip64(CPURISCVState *env, i= nt csrno, =20 if (ret_val) { *ret_val &=3D (env->mideleg | env->mvien) & - (S_MODE_INTERRUPTS | LOCAL_INTERRUPTS); + (S_MODE_INTERRUPTS | std_mask | LOCAL_INTERRUPTS); } =20 return ret; @@ -4733,7 +4788,9 @@ static RISCVException rmw_hvien64(CPURISCVState *env,= int csrno, uint64_t new_val, uint64_t wr_mask) { uint64_t mask =3D wr_mask & hvien_writable_mask; + uint64_t std_mask =3D std_impl_intr_mask(env, AIA_SSAIA); =20 + mask |=3D wr_mask & std_mask; if (ret_val) { *ret_val =3D env->hvien; } @@ -4857,6 +4914,7 @@ static RISCVException rmw_hvip64(CPURISCVState *env, = int csrno, */ uint64_t alias_mask =3D (env->hideleg | ~env->hvien) | VS_MODE_INTERRU= PTS; uint64_t nalias_mask =3D (~env->hideleg & env->hvien); + uint64_t std_mask =3D std_impl_intr_mask(env, AIA_SSAIA); uint64_t wr_mask_hvip; uint64_t wr_mask_mip; =20 @@ -4878,8 +4936,8 @@ static RISCVException rmw_hvip64(CPURISCVState *env, = int csrno, alias_mask &=3D (env->hideleg | env->hvien); } =20 - wr_mask_hvip =3D wr_mask & nalias_mask & hvip_writable_mask; - wr_mask_mip =3D wr_mask & alias_mask & hvip_writable_mask; + wr_mask_hvip =3D wr_mask & nalias_mask & (hvip_writable_mask | std_mas= k); + wr_mask_mip =3D wr_mask & alias_mask & (hvip_writable_mask | std_mask); =20 /* Aliased bits, bits 10, 6, 2 need to come from mip. */ ret =3D rmw_mip64(env, csrno, &ret_mip, new_val, wr_mask_mip); --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269500; cv=none; d=zohomail.com; s=zohoarc; b=Mz//5yXLcwJ1lEvwjFG3vRnVlxkAHpJqYf9X3ym5UOjWeG8phA+yx4TANgXm/f6V1hC5str9nsB9seLtf/5MkQywYKi4mFZqShAfaOXXs+wNtBQQ4l42L6bZG4x9b8ZQNr6Cgowmz1DHAd0S5PJYeTQdvM7ah+eWf4YTyXPX4H8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269500; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=g/jXb0zKE8y0l+7U80na8jmbnNiRzjes4uXWNRRAidM=; b=Ip3pwHKhWYMvWti2lPoBJl0t0l5/JHUEJ4nwLEW36hDVBMhAREV1fF1e7AuYbRIVq3yJOsJ4ZyNDknf88UX7bqXjGhKdSQOhqYioGCRgDHANxwnNZ8pjx9fELz+uTJyIkQeBASQi6TqRF5IMZ2euEv/h+wS4wpVaFqE7/juh9y4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269500160373.84939019438696; Sat, 17 Oct 2026 13:38:20 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB8P-0003hJ-8m; Sat, 17 Oct 2026 16:36:05 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB5c-0005zZ-V4; Sat, 17 Oct 2026 16:33:13 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB5a-0004fo-Jn; Sat, 17 Oct 2026 16:33:12 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id F00EB1DE781; Sat, 17 Oct 2026 23:28:16 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id D500A443453; Sat, 17 Oct 2026 23:28:15 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268896; bh=DNPHh3io7ZD8CDPnReh1hN/Cr7slVWjKLtu0D3+BLSM=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=f9it+4S8lEqbm2/ilzh1Aab2etpQ2Ldno55bVjUjocMGvBQ1HyRHcV2TtpyaaQX2c 9JjltjZmqB/BpuTNuGGNrA5KBimaNGnDov76FgBhSRZF77+g6p23sN3ElEiFpvJJg1 xtIvLpnwVjZIbHh+YO0Z5yPVl19/3b4TxK9+knBkYl68VIL+Bc20f3r25EnTuYmvv2 kATur9E2NhSkUdJsYZQFw+A6IjXeaEXE60Ytv95hrnh5V8DaGdZr7c2Aqg+ktr77ev 3skj6FiBsArAA8WY0/jW3H+yoE0njBwn4+osD04lsHl/YBudqgFR+J0c+RKP20gosU ZXZ/1kE4CXLUQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Zephyr Li , Daniel Henrique Barboza , Alistair Francis , Michael Tokarev Subject: [Stable-11.1.3 65/73] target/riscv: stop translating after WFI Date: Sat, 17 Oct 2026 23:26:23 +0300 Message-ID: <20261017202638.728621-65-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269500702158500 Content-Type: text/plain; charset="utf-8" From: Zephyr Li helper_wfi() never returns to translated code: it either raises an exception or exits the CPU loop after marking the CPU as halted. However, trans_wfi() leaves the translation state as DISAS_NEXT, so instructions following WFI can be included in the same TB. With icount enabled, this makes the following instruction part of the TB's instruction count when WFI exits, causing minstret to be incremented once too many. Set DISAS_NORETURN after emitting the helper. Add a TCG test for both reported cases: WFI waking for a locally enabled pending interrupt with mstatus.MIE clear, and WFI taking a timer interrupt. Cc: qemu-stable@nongnu.org Fixes: 55c2a12cbcd3 ("RISC-V TCG Code Generation") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4230 Signed-off-by: Zephyr Li Reviewed-by: Daniel Henrique Barboza Message-ID: <20260910025324.54990-1-fritchleybohrer@gmail.com> Signed-off-by: Alistair Francis (cherry picked from commit 410166b550ccacdc46065af00e68cea4d60efb65) (Mjt: adjust test to before make=3D>meson conversion) Signed-off-by: Michael Tokarev diff --git a/target/riscv/tcg/insn_trans/trans_privileged.c.inc b/target/ri= scv/tcg/insn_trans/trans_privileged.c.inc index a8eaccef67..ebbbb01179 100644 --- a/target/riscv/tcg/insn_trans/trans_privileged.c.inc +++ b/target/riscv/tcg/insn_trans/trans_privileged.c.inc @@ -145,6 +145,7 @@ static bool trans_wfi(DisasContext *ctx, arg_wfi *a) decode_save_opc(ctx, 0); gen_update_pc(ctx, ctx->cur_insn_len); gen_helper_wfi(tcg_env); + ctx->base.is_jmp =3D DISAS_NORETURN; return true; #else return false; diff --git a/tests/tcg/riscv64/Makefile.softmmu-target b/tests/tcg/riscv64/= Makefile.softmmu-target index 42038ce3b4..2de0433cfc 100644 --- a/tests/tcg/riscv64/Makefile.softmmu-target +++ b/tests/tcg/riscv64/Makefile.softmmu-target @@ -28,6 +28,10 @@ EXTRA_RUNS +=3D run-test-minstret-ecall run-test-minstret-ecall: test-minstret-ecall $(call run-test, $<, $(QEMU) -icount shift=3D1 $(QEMU_OPTS)$<) =20 +EXTRA_RUNS +=3D run-test-minstret-wfi +run-test-minstret-wfi: test-minstret-wfi + $(call run-test, $<, $(QEMU) -icount shift=3D1 $(QEMU_OPTS)$<) + EXTRA_RUNS +=3D run-plugin-doubletrap run-plugin-doubletrap: doubletrap $(call run-test, $<, \ diff --git a/tests/tcg/riscv64/test-minstret-wfi.S b/tests/tcg/riscv64/test= -minstret-wfi.S new file mode 100644 index 0000000000..0fd0158d5b --- /dev/null +++ b/tests/tcg/riscv64/test-minstret-wfi.S @@ -0,0 +1,100 @@ +/* SPDX-License-Identifier: GPL-2.0-or-later */ + + .option norvc + + .text + .global _start +_start: + lla t0, trap + csrw mtvec, t0 + li s3, 0 + + /* + * A pending, locally enabled interrupt wakes WFI even with MIE + * clear. + */ + li t0, 0x8 /* MIE_MSIE */ + csrw mie, t0 + csrci mstatus, 0x8 /* MSTATUS_MIE */ + li t0, 0x2000000 /* MSIP0 */ + li t1, 1 + sw t1, 0(t0) + + /* + * The first CSR read and WFI retire before the second read obtains s1, + * so the expected difference is two. + */ + csrr s0, minstret + wfi + csrr s1, minstret + sub s1, s1, s0 + li t1, 2 + beq s1, t1, 1f + ori s3, s3, 1 +1: + + /* Clear the software interrupt before testing the trap path. */ + sw zero, 0(t0) + csrw mie, zero + + /* Schedule a timer interrupt far enough ahead to reach WFI first. */ + li t0, 0x200bff8 /* MTIME */ + ld t1, 0(t0) + addi t1, t1, 100 + li t0, 0x2004000 /* MTIMECMP0 */ + sd t1, 0(t0) + li t0, 0x80 /* MIE_MTIE */ + csrw mie, t0 + csrsi mstatus, 0x8 /* MSTATUS_MIE */ + + /* + * The first CSR read and WFI retire before the trap handler obtains s1, + * so the expected difference is again two. + */ + li s2, 1 + csrr s0, minstret + wfi + beqz s2, 1f + ori s3, s3, 2 +1: + bnez s3, fail + li a0, 0 + j _exit + +fail: + mv a0, s3 + +_exit: + lla a1, semiargs + li t0, 0x20026 /* ADP_Stopped_ApplicationExit */ + sd t0, 0(a1) + sd a0, 8(a1) + li a0, 0x20 /* TARGET_SYS_EXIT_EXTENDED */ + + /* Semihosting call sequence */ + .balign 16 + slli zero, zero, 0x1f + ebreak + srai zero, zero, 0x7 + j . + + .balign 4 +trap: + /* Read minstret before retiring an instruction in the handler. */ + csrr s1, minstret + sub s1, s1, s0 + addi s1, s1, -2 + snez s2, s1 + + /* Disable the timer interrupt before returning past WFI. */ + li t0, 0x2004000 /* MTIMECMP0 */ + li t1, -1 + sd t1, 0(t0) + li t0, 0x80 /* MIE_MTIE */ + csrc mie, t0 + mret + + .data + .balign 16 +semiargs: + .space 16 --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269596; cv=none; d=zohomail.com; s=zohoarc; b=Z/BsgmP0X2FsfeDx3xuu5XkXSogBU70iOMvZk/j7DdfHGwkB09MKPrlYtiVneO/WHlMqZh+ltLrlu08fB3UtXplQ3Hriy/asypjWbECN/tc/6cYtZfMrj0By9eqlNwLtHWV3gtSoEI8drEU9eahMmeiqDEYYAb5h1x3qE8YLMx8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269596; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=MrYqeu0bssche7OD45yPqhZj9riAJp49hNhLVaoAVUY=; b=dJ9XWSRn2lVu6mvbLJLSF4aZU1fPAbw4yNC+BQV+RB0CH0qdJjkiPDwBWQUM4CGIi774NsgbNukT+UNvu70qSCb0W0ATL5KU5vqXOPT/WlveyfSaRWc4VPipsIYol7ySsnHQvhRuHpn4VQpgLJ1PKoCpCY2Haou8oSJw+9q/Bbc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269596249454.6123631422844; Sat, 17 Oct 2026 13:39:56 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB8R-0003uw-Ps; Sat, 17 Oct 2026 16:36:07 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB5c-0005ze-W3; Sat, 17 Oct 2026 16:33:13 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB5b-0004fw-4u; Sat, 17 Oct 2026 16:33:12 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 50E4A1DE782; Sat, 17 Oct 2026 23:28:18 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 47ACD443454; Sat, 17 Oct 2026 23:28:17 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268898; bh=BKue2WHSpcivGWnAhTOmzx/HoMPTLxX3emKeYFdciXw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=aRkJryH+pJQ9paaFeE8+e1p0QXN7TxZZRPc2u6xGRf5ufsxUBCqehSbPp1/2FTHSH hK0aBuR4WliIeUaMo4cWyQ+fakLk9KKh4Xwl7ct0Nz1iUxXK/NJkhatSgF1/QOTUln STisihbhuxCiTY3+kN0r7EUdZ7rFEgpSxY37jJiJ55AjUlH520ccW13GivxktRMsV3 wT4b9CjEVGeEjvGwIvzAU7NeR6FpujmmSHmdYONhpNkLswnIVRtTuZ6W1auHc0zS/t D73SkUSdv/cnnNwa4HAym7zbBsDIwP/VQuHroiI6W7n52bwG+mf95Nf5tfwR1/BJjQ gk8JVvt8VS3hw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, "Christian S. Lima" , Daniel Henrique Barboza , Alistair Francis , Michael Tokarev Subject: [Stable-11.1.3 66/73] targetriscv: svinval instructions raise virtual instruction exception Date: Sat, 17 Oct 2026 23:26:24 +0300 Message-ID: <20261017202638.728621-66-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269596599158500 Content-Type: text/plain; charset="utf-8" From: "Christian S. Lima" The risc v privileged specification requires hinval.vvma, hinval.gvma, sfence.w.inval and sfence.inval.ir should raise a virtual instruction exception when executed in the vu-mode. This patch add the check to raise the virtual instruction exception when is in the vu-mode. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3621 Signed-off-by: Christian S. Lima Reviewed-by: Daniel Henrique Barboza Message-ID: <20260911201323.37757-1-christianslima@proton.me> Signed-off-by: Alistair Francis (cherry picked from commit 55a3524a892603a84f26a7d889ac19be98016dd2) Signed-off-by: Michael Tokarev diff --git a/target/riscv/tcg/insn_trans/trans_svinval.c.inc b/target/riscv= /tcg/insn_trans/trans_svinval.c.inc index 4614c1489c..1341beba2f 100644 --- a/target/riscv/tcg/insn_trans/trans_svinval.c.inc +++ b/target/riscv/tcg/insn_trans/trans_svinval.c.inc @@ -25,6 +25,9 @@ /* Test if priv level is M or S. */ #define REQUIRE_PRIV_MS(ctx) do { \ if (ctx->priv =3D=3D PRV_U) { \ + if (ctx->virt_enabled) { \ + ctx->virt_inst_excp =3D true; \ + } \ return false; \ } \ } while (0) diff --git a/target/riscv/tcg/insn_trans/trans_xthead.c.inc b/target/riscv/= tcg/insn_trans/trans_xthead.c.inc index f4e3051000..ea4b169422 100644 --- a/target/riscv/tcg/insn_trans/trans_xthead.c.inc +++ b/target/riscv/tcg/insn_trans/trans_xthead.c.inc @@ -267,11 +267,13 @@ static bool trans_th_tst(DisasContext *ctx, arg_th_ts= t *a) #define REQUIRE_PRIV_MSU(ctx) =20 /* Test if priv level is M or S. */ -#define REQUIRE_PRIV_MS(ctx) \ -do { \ - if (ctx->priv =3D=3D PRV_U) { \ - return false; \ - } \ +#define REQUIRE_PRIV_MS(ctx) do { \ + if (ctx->priv =3D=3D PRV_U) { \ + if (ctx->virt_enabled) { \ + ctx->virt_inst_excp =3D true; \ + } \ + return false; \ + } \ } while (0) =20 #define NOP_PRIVCHECK(insn, extcheck, privcheck) \ --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269407; cv=none; d=zohomail.com; s=zohoarc; b=O2q5OgbEW0QZ4f4gX0e07Ff86u2paymfHZl7Q+3t4u510b744aCe+0bAodjSQfCE9mdtvGCg0AXyJZ69y/AoF49C36CHtHCe2Emdq7g0M05/Yn30I2BxSqeMD0R5qepNQi2olgNhC6dTRXPu/lAxxLFKPOUikz3NqlZ0n79BQgg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269407; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=NP4nbBlmaH1/bGsMXP7sGwojXtD+da/9OZG+3OEC4t4=; b=nolLoz3UC8oaJt8P0XFEETOpYLfgMCMwptt/Dc2NzBsQ87ekc1RkRcBseTu4rJzxmidcyzGeGSOp9B95Vyc8SFTbByvrHBaB4Z80HAGpdv9GzrAVDuApqoe6W5eItuCryiav9lXHEj7jMTWneIVaJFihDnrsDlgoy/NT0vmaqUE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269407326998.29903056386; Sat, 17 Oct 2026 13:36:47 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB8Z-0004oR-Jp; Sat, 17 Oct 2026 16:36:15 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB60-0007CK-IA; Sat, 17 Oct 2026 16:33:38 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB5y-0004hW-OQ; Sat, 17 Oct 2026 16:33:36 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 64ADB1DE783; Sat, 17 Oct 2026 23:28:19 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 86B71443455; Sat, 17 Oct 2026 23:28:18 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268899; bh=0vz3JjyOyVXzcyGZDNmzXnomvFWB7T9+ag5ndgoLWAk=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=MOdR9hU5VwEadwJymLgDP7eVH0SlGDMkaPZOkngfAIPPY5RiBY+vdp0KCrH1EmcXu YKaYNyAGTIHHQUj9KQ3lDvL23/4n2gCu6rHMsbtiFmqLxVdbXuxqVt0NzgIw36md85 nvWwoChFco/Nyw6FI+yjZsMLK8ZUpmHEoYuqUpTyMvSYcHu/DpI1ZjoGtKIwo399T3 94cI1ZDVkcIBwnE+3De5exBMUqjTuupIvKCTSLBSxVWVFURaS7+7J0eTFVBSTm5bqM F/MdLPhMv7+wUSEcPjOuHYby790GN3BPMZb00xHbRexG8VOoURpGQIQzdrclQukmzy /NyUqcn5KE3Dg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Xie Bo , Daniel Henrique Barboza , Alistair Francis , Michael Tokarev Subject: [Stable-11.1.3 67/73] target/riscv/kvm: Preserve FCSR across migration Date: Sat, 17 Oct 2026 23:26:25 +0300 Message-ID: <20261017202638.728621-67-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269408841158500 Content-Type: text/plain; charset="utf-8" From: Xie Bo kvm_riscv_get_regs_fp() and kvm_riscv_put_regs_fp() handle f0-f31 but not FCSR. KVM exposes FCSR as a separate 32-bit register in both the F and D register groups, so frm and fflags are lost after migration. Read and write FCSR together with the FP registers and save it in a KVM-only subsection. Older streams do not contain the subsection; in that case the destination keeps its reset value. Fixes: 937f0b45120b ("target/riscv: Implement kvm_arch_get_registers") Fixes: 9997cc1e19d1 ("target/riscv: Implement kvm_arch_put_registers") Signed-off-by: Xie Bo Cc: qemu-stable@nongnu.org Reviewed-by: Daniel Henrique Barboza Message-ID: <20260831074106.1798671-2-xb@ultrarisc.com> Signed-off-by: Alistair Francis (cherry picked from commit e52de6b65f5fa584209a8c147d6170d8370ffdee) Signed-off-by: Michael Tokarev diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h index e980b5964d..592cbf3e71 100644 --- a/target/riscv/cpu.h +++ b/target/riscv/cpu.h @@ -532,6 +532,9 @@ struct CPUArchState { hwaddr fdt_addr; =20 #ifdef CONFIG_KVM + /* KVM floating-point state */ + uint32_t kvm_fcsr; + /* kvm timer */ bool kvm_timer_dirty; uint64_t kvm_timer_time; diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c index cc5655d46d..45e12216ac 100644 --- a/target/riscv/kvm/kvm-cpu.c +++ b/target/riscv/kvm/kvm-cpu.c @@ -111,6 +111,14 @@ static uint64_t kvm_riscv_vector_reg_id(RISCVCPU *cpu, =20 #define RISCV_FP_D_REG(idx) KVM_RISCV_REG_ID_U64(KVM_REG_RISCV_FP_D, idx) =20 +#define RISCV_FP_F_FCSR_REG \ + KVM_RISCV_REG_ID_U32(KVM_REG_RISCV_FP_F, \ + KVM_REG_RISCV_FP_F_REG(fcsr)) + +#define RISCV_FP_D_FCSR_REG \ + KVM_RISCV_REG_ID_U32(KVM_REG_RISCV_FP_D, \ + KVM_REG_RISCV_FP_D_REG(fcsr)) + #define RISCV_VECTOR_CSR_REG(name) \ KVM_RISCV_REG_ID_ULONG(KVM_REG_RISCV_VECTOR, \ KVM_REG_RISCV_VECTOR_CSR_REG(name)) @@ -743,7 +751,8 @@ static int kvm_riscv_get_regs_fp(CPUState *cs) } env->fpr[i] =3D reg; } - return ret; + return kvm_get_one_reg(cs, RISCV_FP_D_FCSR_REG, + &env->kvm_fcsr); } =20 if (riscv_has_ext(env, RVF)) { @@ -755,7 +764,8 @@ static int kvm_riscv_get_regs_fp(CPUState *cs) } env->fpr[i] =3D reg; } - return ret; + return kvm_get_one_reg(cs, RISCV_FP_F_FCSR_REG, + &env->kvm_fcsr); } =20 return ret; @@ -776,7 +786,8 @@ static int kvm_riscv_put_regs_fp(CPUState *cs) return ret; } } - return ret; + return kvm_set_one_reg(cs, RISCV_FP_D_FCSR_REG, + &env->kvm_fcsr); } =20 if (riscv_has_ext(env, RVF)) { @@ -788,7 +799,8 @@ static int kvm_riscv_put_regs_fp(CPUState *cs) return ret; } } - return ret; + return kvm_set_one_reg(cs, RISCV_FP_F_FCSR_REG, + &env->kvm_fcsr); } =20 return ret; diff --git a/target/riscv/machine.c b/target/riscv/machine.c index 31c49ca3e6..2685338901 100644 --- a/target/riscv/machine.c +++ b/target/riscv/machine.c @@ -198,6 +198,32 @@ static const VMStateDescription vmstate_rv128 =3D { }; =20 #ifdef CONFIG_KVM +static bool kvm_fcsr_needed(void *opaque) +{ + RISCVCPU *cpu =3D opaque; + CPURISCVState *env =3D &cpu->env; + + return kvm_enabled() && + (riscv_has_ext(env, RVF) || riscv_has_ext(env, RVD)); +} + +static int kvm_fcsr_post_load(void *opaque, int version_id) +{ + return kvm_enabled() ? 0 : -ENOTSUP; +} + +static const VMStateDescription vmstate_kvm_fcsr =3D { + .name =3D "cpu/kvm-fcsr", + .version_id =3D 1, + .minimum_version_id =3D 1, + .needed =3D kvm_fcsr_needed, + .post_load =3D kvm_fcsr_post_load, + .fields =3D (const VMStateField[]) { + VMSTATE_UINT32(env.kvm_fcsr, RISCVCPU), + VMSTATE_END_OF_LIST() + } +}; + static bool kvmtimer_needed(void *opaque) { return kvm_enabled(); @@ -565,6 +591,7 @@ const VMStateDescription vmstate_riscv_cpu =3D { &vmstate_pointermasking, &vmstate_rv128, #ifdef CONFIG_KVM + &vmstate_kvm_fcsr, &vmstate_kvmtimer, &vmstate_kvm_mp_state, #endif --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269531; cv=none; d=zohomail.com; s=zohoarc; b=GKllt1TsiO8NQl0gHlsre8DTusqzVfWTNgy0bVeQTkZCpshqItlpsgw9pdBFZXefudwFB7/FTnbXgFuCKOJ1SkRHtrGiIchWFPoHgbbqLVV9uXHNkEZEzrtYNrFYXcuRpnsl/RSoIfIAz7CocU3puVd/Yg9IQnDeevnoiA3gOOg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269531; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=X1/74VRljtsNn+MdXWua/8w2a57Wpd9PSWxOErdQPY4=; b=nSgPOirBPvO5V2XM3XabalU6LBqZJbsAwJuUSE2TskrMSm/F2TYQ+lSudZsrdTn7k3zmXSILIs9idGg3OAxlkIM5oaaBlXjO5HlnKZ+6MHlsFM1ZDqRurV7ET6A3adWp5IzIeqmmbixlyUeVPoZdkDpieRs2eUvApUkgZqfB0do= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 17922695316519.351173596688113; Sat, 17 Oct 2026 13:38:51 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB6z-0001L5-Bx; Sat, 17 Oct 2026 16:34:37 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB60-0007CM-I2; Sat, 17 Oct 2026 16:33:38 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB5y-0004hY-Fd; Sat, 17 Oct 2026 16:33:36 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id DB21D1DE784; Sat, 17 Oct 2026 23:28:20 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 9C518443456; Sat, 17 Oct 2026 23:28:19 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268900; bh=rLbfHVTP+cmsfgjneSQ/zxI6yD/5xhE6J4NzTt0BkHg=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=itLXvYFen5jl+EqZM+yTFvQKw/WhwX9LcmOBi3avxe6vGVWmU1mb5YlK3rlQhZi6Y iNURxhumrhNrAQyF6sD4nyIv5d+8eAFfP49QeLG7MSgxIdqpxnZw7A2DSv5tJbDonA psisePdtuLof2jGCfkuqMXPiQ3++jKaqy8xLDTRgE7oXjlsWATJVtg7ouzZvjYEEwR 8V+EUcM83OGV+IXn4jIyeFYzJjXcCi7DvGKdmggVYhNJmIu+z2TDn/EPny1Muw5Y62 Nl1zt56kP44ruVy2Hq5LjOgmEbruRjz8g78tmPeyFrw4Tq2cWnaEcEE8aiWoxychHk CslC8MURg/9wg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Xie Bo , Daniel Henrique Barboza , Alistair Francis , Michael Tokarev Subject: [Stable-11.1.3 68/73] target/riscv/kvm: Reject migration with a different timer frequency Date: Sat, 17 Oct 2026 23:26:26 +0300 Message-ID: <20261017202638.728621-68-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269533442158500 Content-Type: text/plain; charset="utf-8" From: Xie Bo The timer frequency check is currently in kvm_riscv_put_regs_timer() and guarded by migration_is_running(). That condition is false on the incoming side, and the source frequency is not part of the migration stream, so migration between hosts with different frequencies completes. Add the source frequency to a KVM-only subsection. Its post_load checks the destination frequency before the timer registers are restored and rejects a mismatch. When loading an older stream without the subsection, skip the check and retain the old behavior. Fixes: 27abe66f31ef ("target/riscv: Add kvm_riscv_get/put_regs_timer") Signed-off-by: Xie Bo Cc: qemu-stable@nongnu.org Reviewed-by: Daniel Henrique Barboza Message-ID: <20260831074106.1798671-3-xb@ultrarisc.com> Signed-off-by: Alistair Francis (cherry picked from commit 0f9adcab46c08246f21c290bd0a9382c5b02bd6c) Signed-off-by: Michael Tokarev diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h index 592cbf3e71..a583f80b58 100644 --- a/target/riscv/cpu.h +++ b/target/riscv/cpu.h @@ -541,6 +541,7 @@ struct CPUArchState { uint64_t kvm_timer_compare; uint64_t kvm_timer_state; uint64_t kvm_timer_frequency; + bool kvm_timer_frequency_loaded; =20 /* KVM multiprocessor state */ uint32_t kvm_mp_state; diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c index 45e12216ac..aa19c69dd3 100644 --- a/target/riscv/kvm/kvm-cpu.c +++ b/target/riscv/kvm/kvm-cpu.c @@ -45,7 +45,6 @@ #include "kvm_riscv.h" #include "sbi_ecall_interface.h" #include "chardev/char-fe.h" -#include "migration/misc.h" #include "system/runstate.h" #include "hw/riscv/numa.h" =20 @@ -822,9 +821,34 @@ static void kvm_riscv_get_regs_timer(CPUState *cs) env->kvm_timer_dirty =3D true; } =20 +int kvm_riscv_check_timer_frequency(RISCVCPU *cpu) +{ + CPUState *cs =3D CPU(cpu); + CPURISCVState *env =3D &cpu->env; + int ret; + uint64_t frequency; + + if (!env->kvm_timer_frequency_loaded) { + return 0; + } + + ret =3D kvm_get_one_reg(cs, RISCV_TIMER_REG(frequency), &frequency); + if (ret) { + return ret; + } + + if (frequency !=3D env->kvm_timer_frequency) { + error_report("KVM timer frequency mismatch: source %" PRIu64 + " Hz, destination %" PRIu64 " Hz", + env->kvm_timer_frequency, frequency); + return -EINVAL; + } + + return 0; +} + static void kvm_riscv_put_regs_timer(CPUState *cs) { - uint64_t reg; CPURISCVState *env =3D &RISCV_CPU(cs)->env; =20 if (!env->kvm_timer_dirty) { @@ -844,18 +868,6 @@ static void kvm_riscv_put_regs_timer(CPUState *cs) KVM_RISCV_SET_TIMER(cs, state, env->kvm_timer_state); } =20 - /* - * For now, migration will not work between Hosts with different timer - * frequency. Therefore, we should check whether they are the same here - * during the migration. - */ - if (migration_is_running()) { - KVM_RISCV_GET_TIMER(cs, frequency, reg); - if (reg !=3D env->kvm_timer_frequency) { - error_report("Dst Hosts timer frequency !=3D Src Hosts"); - } - } - env->kvm_timer_dirty =3D false; } =20 diff --git a/target/riscv/kvm/kvm_riscv.h b/target/riscv/kvm/kvm_riscv.h index 61eaa12443..0e27ce8bf3 100644 --- a/target/riscv/kvm/kvm_riscv.h +++ b/target/riscv/kvm/kvm_riscv.h @@ -29,6 +29,7 @@ void kvm_riscv_aia_create(MachineState *machine, uint64_t= group_shift, uint64_t guest_num); void riscv_kvm_aplic_request(void *opaque, int irq, int level); bool kvm_riscv_has_mp_state(void); +int kvm_riscv_check_timer_frequency(RISCVCPU *cpu); void riscv_kvm_cpu_finalize_features(RISCVCPU *cpu, Error **errp); uint64_t kvm_riscv_get_timebase_frequency(RISCVCPU *cpu); =20 diff --git a/target/riscv/machine.c b/target/riscv/machine.c index 2685338901..14a50f1d33 100644 --- a/target/riscv/machine.c +++ b/target/riscv/machine.c @@ -198,6 +198,35 @@ static const VMStateDescription vmstate_rv128 =3D { }; =20 #ifdef CONFIG_KVM +static bool kvm_timer_frequency_needed(void *opaque) +{ + return kvm_enabled(); +} + +static int kvm_timer_frequency_post_load(void *opaque, int version_id) +{ + RISCVCPU *cpu =3D opaque; + + if (!kvm_enabled()) { + return -ENOTSUP; + } + + cpu->env.kvm_timer_frequency_loaded =3D true; + return kvm_riscv_check_timer_frequency(cpu); +} + +static const VMStateDescription vmstate_kvm_timer_frequency =3D { + .name =3D "cpu/kvm-timer-frequency", + .version_id =3D 1, + .minimum_version_id =3D 1, + .needed =3D kvm_timer_frequency_needed, + .post_load =3D kvm_timer_frequency_post_load, + .fields =3D (const VMStateField[]) { + VMSTATE_UINT64(env.kvm_timer_frequency, RISCVCPU), + VMSTATE_END_OF_LIST() + } +}; + static bool kvm_fcsr_needed(void *opaque) { RISCVCPU *cpu =3D opaque; @@ -256,6 +285,7 @@ static int riscv_cpu_kvm_pre_load(void *opaque) { RISCVCPU *cpu =3D opaque; =20 + cpu->env.kvm_timer_frequency_loaded =3D false; cpu->env.kvm_mp_state_loaded =3D false; return 0; } @@ -592,6 +622,7 @@ const VMStateDescription vmstate_riscv_cpu =3D { &vmstate_rv128, #ifdef CONFIG_KVM &vmstate_kvm_fcsr, + &vmstate_kvm_timer_frequency, &vmstate_kvmtimer, &vmstate_kvm_mp_state, #endif --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269371; cv=none; d=zohomail.com; s=zohoarc; b=TPxCapQN38h3mA8waQTXsbtAohzXE7kvtCPhhncIWE+XaQq0cAGfWOpZ3TiyEXJP8vGvHKgu3at3bL4c8KW5YOtJPNCakIyxmq06tC2b91ngwnbZ5GBPpybSLaEzU5vBGrkqzb0KUpZiaOGYoBw/xi5eghveVhMHTLmaL3nk1mU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269371; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=U9Y5mh1aLcIjjjsP/cZAKc1RbgfW6LpmspII9XGIWn4=; b=K3ad6hLKEZQMEKi21PfYd0FT20t8ubhIF1iJdVXbxQRGKqeQZkrZLxq/2G3Y1gJDj9LUV597xWaefTt6hEFu/McFlYpKBIpTulSl8pDxP7gGk9Pn0W0UhV22kyITzBWt7M4G36wjDel6VSAldMFNfTlTKSSDFfEd3s2ZzTadacc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269371868374.57652709519357; Sat, 17 Oct 2026 13:36:11 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB71-0001fZ-Sj; Sat, 17 Oct 2026 16:34:40 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB63-0007DQ-Gw; Sat, 17 Oct 2026 16:33:40 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB61-0004is-VU; Sat, 17 Oct 2026 16:33:39 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 25DAF1DE786; Sat, 17 Oct 2026 23:28:22 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 44310443457; Sat, 17 Oct 2026 23:28:21 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268902; bh=1QFUAT0Ks7/wzkVRF8wGIcYv/akZSw5nk46VFWm/oTk=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=H+CWwalz4sqwu018I26DT20RQceG3xGeyMPhAZxRYyfG3DSEnvlvxvphAkUuYf18G xQcvGQja/umYTiVT1dBIuXhxczCLXTRdDhQqHcQAMA8qCxGJRpOj47awll/72bHBcP DtGq8MvLz5aHJtBcnsLZAXVewx2SuGeJg70rCyeBkZYaoiJX0Crf4ZJ5PXbiRRNVau 8NyJJ2OoKbqBAgj/7iw5o24VwH6D5P6tCkLzIHRvpSv3QkWXnnk7BIg4hxPe27bsEK unU6uvaEXRuYDyjFL2oJSCxPaCEaHy8MeI6izU/ruqU6selCnrx/9IFWJbUlZbRYtd ttc02AUX5S6BQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Xie Bo , Daniel Henrique Barboza , Alistair Francis , Michael Tokarev Subject: [Stable-11.1.3 69/73] target/riscv/kvm: Preserve VCSR across migration Date: Sat, 17 Oct 2026 23:26:27 +0300 Message-ID: <20261017202638.728621-69-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269372219158500 Content-Type: text/plain; charset="utf-8" From: Xie Bo The vector state sync handles vstart, vl and vtype, but leaves vcsr behind. vxrm and vxsat in the migration stream are therefore stale, and the destination does not restore the values held by KVM. Read vcsr when collecting vector state and split it into vxrm and vxsat. Rebuild it from those fields when writing vector state back. Fixes: 3ca78c0689d5 ("target/riscv/kvm: add RVV and Vector CSR regs") Cc: qemu-stable@nongnu.org Signed-off-by: Xie Bo Reviewed-by: Daniel Henrique Barboza Message-ID: <20260831074106.1798671-4-xb@ultrarisc.com> Signed-off-by: Alistair Francis (cherry picked from commit f20acdba2a960689cc7adb179e96b0441cb83e25) Signed-off-by: Michael Tokarev diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c index aa19c69dd3..0a27744d6b 100644 --- a/target/riscv/kvm/kvm-cpu.c +++ b/target/riscv/kvm/kvm-cpu.c @@ -910,6 +910,13 @@ static int kvm_riscv_get_regs_vector(CPUState *cs) } env->vtype =3D reg; =20 + ret =3D kvm_get_one_reg(cs, RISCV_VECTOR_CSR_REG(vcsr), ®); + if (ret) { + return ret; + } + env->vxrm =3D (reg & VCSR_VXRM) >> VCSR_VXRM_SHIFT; + env->vxsat =3D (reg & VCSR_VXSAT) >> VCSR_VXSAT_SHIFT; + if (kvm_v_vlenb.supported) { ret =3D kvm_get_one_reg(cs, RISCV_VECTOR_CSR_REG(vlenb), ®); if (ret) { @@ -966,6 +973,13 @@ static int kvm_riscv_put_regs_vector(CPUState *cs) return ret; } =20 + reg =3D (env->vxrm << VCSR_VXRM_SHIFT) | + (env->vxsat << VCSR_VXSAT_SHIFT); + ret =3D kvm_set_one_reg(cs, RISCV_VECTOR_CSR_REG(vcsr), ®); + if (ret) { + return ret; + } + if (kvm_v_vlenb.supported) { reg =3D cpu->cfg.vlenb; ret =3D kvm_set_one_reg(cs, RISCV_VECTOR_CSR_REG(vlenb), ®); --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269509; cv=none; d=zohomail.com; s=zohoarc; b=Si+HpajJxR8VN6N3O58bOaX9m3a1Hxe6ItAq3o5122HssTuAtS+VXxjNofOrUxQk+ocKAUiNluyVF8cZaZmDl7mcOLtnSezHoxkTF/rRAivtCXVm1LPT1laetq682nV5pGByr8BCBJDxvM8h830Ex7zLg1U4gjyIpP1kIfa6Zds= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269509; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=2jKPh+uC1yVT1EVDiGsqDA33zexiXQLe4Y86+bwk1yc=; b=Afz9im6/s56xUwKkXRw9lQpBiQXOoHyKTavsNZilYirR0Ox2l7rT4vz4cBX+9GqX9Y3TGsX4qtMUyeUeEjJ0Vxzo4ijEhwAiYpz3UiteOGpPpVinc0j+P8Rg7SMv7HO5FbQZeuDlCIF1V6L4nBfrHZ+PMsZeP/QRYaIG22QS0TA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269509531138.9446519296323; Sat, 17 Oct 2026 13:38:29 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB8b-00057c-Fw; Sat, 17 Oct 2026 16:36:17 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB63-0007DO-F2; Sat, 17 Oct 2026 16:33:40 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB62-0004it-0r; Sat, 17 Oct 2026 16:33:39 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 7FD171DE787; Sat, 17 Oct 2026 23:28:23 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 5841E443458; Sat, 17 Oct 2026 23:28:22 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268903; bh=4rQas78o2qic6KfRrpeVcUvakhKjmJVQYpZLa5rIvQE=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=fyUm5mynEDPHNjKuTWYPipK+tTkaPBhy+wpTQHrC1NzL+wB5/Q560rn2xGiclDzWz U7IGKFUkztT2qicis1YxV6y94rUB9ajQqW/EAfwlBPFX+1NRKcLPe7t66fjGkJgQS4 QXwpBiyCa+LdJzsGkG0R95iiH2fOT0L0swl1haTOf+kYrxcsJJZFuggTOSUKF+IW8d vz6YNM7YNKRrR2jtp5mPpBTiKttN2QgVSwhksECVaNh5SN9T2u64xrwAhrOLV+P1N0 eoZPGw4iZqK1vcxW5/+RamVChzmGN5k3zPzSTB56Pq1U8LRZ84aGJLIFtAwfMZuZ9T 1FhNn+aVpt6yw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Rick Richard , Daniel Henrique Barboza , Alistair Francis , Michael Tokarev Subject: [Stable-11.1.3 70/73] tests/qtest/bios-tables-test: Allow changes to riscv64 virt SPCR Date: Sat, 17 Oct 2026 23:26:28 +0300 Message-ID: <20261017202638.728621-70-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269510845158500 Content-Type: text/plain; charset="utf-8" From: Rick Richard Allow changes to the riscv64 virt board SPCR -- we are going to fix an error in the UART description there. Signed-off-by: Rick Richard Reviewed-by: Daniel Henrique Barboza Message-ID: <20261005104008.214588-2-rick@sloservers.com> Cc: qemu-stable@nongnu.org Signed-off-by: Alistair Francis (cherry picked from commit ba280c351011618d2e7f9c3773fb4cdf109e40f6) Signed-off-by: Michael Tokarev diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios= -tables-test-allowed-diff.h index dfb8523c8b..aae973048a 100644 --- a/tests/qtest/bios-tables-test-allowed-diff.h +++ b/tests/qtest/bios-tables-test-allowed-diff.h @@ -1 +1,2 @@ /* List of comma-separated changed AML files to ignore */ +"tests/data/acpi/riscv64/virt/SPCR", --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269450; cv=none; d=zohomail.com; s=zohoarc; b=P5Ijvl85a4N2kGNR4fvaUYcU0TxdVl/ZKOCz8KX3A+nkpt2nAk1dp4YxP4TZG1+5XF/AqBl97dwFTSShIzbYcTe+4ifi2f4iDZP3q9cLfo3GOqJG+unzQdC7VzKjyhnbeQJS12jMQb394Bn867i2t+QboXSMFwTfeolYYbs/KJM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269450; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=tJ3W6OZvCvJiB1DwS6VQF8A7raC/ggqIqY826Ydtj4Y=; b=epbaFGZ6MCt7D/dx1TOxMmJBUpEO4h198r2YMdoRELc3r08E9ck5kn+KluvZQt/ET3EvhfSxNRs/AFtmaqPZjgMwx/2gFnxkV1ootMYsbP+Tm/9PCwxmzDppjFId7ZO1CE7lZSgLB3onS8aeaCaT5GwwZKyDwbjHBwmH9fCKjLw= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 179226945027133.54703349885483; Sat, 17 Oct 2026 13:37:30 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB74-0001wA-GL; Sat, 17 Oct 2026 16:34:42 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB66-0007NG-Iu; Sat, 17 Oct 2026 16:33:42 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB65-0004jE-0D; Sat, 17 Oct 2026 16:33:42 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 18AD71DE788; Sat, 17 Oct 2026 23:28:25 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id BB098443459; Sat, 17 Oct 2026 23:28:23 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268905; bh=3La8O217d/gdcCxqbkLIFDHF7mCZGs4qh1z2HSADoAI=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=rmtT8Kfb39Rp9JJ5zk0ozQ3yGFnL/hX/07dYweXQ45DkgVicy9QSazFgvtw3sV3bx 9NGOqn3ibivXeeYeJpLZrrWt7tbzHeAHj1xkDf+bJbRofo+7MlmIYPGMYd4/nEOrl7 w1qj217w3iEFC/UXVM65lGtoAwHhK94SdLsxDvJxyZlEPrTsKeVpgSI6lzsA5Y9zsJ i2krwyQzFZyY+9MgXG7mhM9wGIxL2iSwqvGrZviGR/p8nI9gkK5HEKAfbZHabe/LuG xrEniPhVZ+pzLQMeeJt3V+Ceg/dXuAEn/Du1kwlUtVY3RM6kOOIy3IH2dcy26IsKxE O+4lUuSB3FN7Q== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Rick Richard , Daniel Henrique Barboza , Alistair Francis , Michael Tokarev Subject: [Stable-11.1.3 71/73] hw/riscv/virt-acpi-build: Fix the UART register width in SPCR Date: Sat, 17 Oct 2026 23:26:29 +0300 Message-ID: <20261017202638.728621-71-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269451976158500 Content-Type: text/plain; charset="utf-8" From: Rick Richard The riscv virt board uses a 16550 UART with an 8-bit register stride, but the SPCR table reports 32, which looks to have been copied from arm virt, whose PL011 has a 32-bit stride. Change it to the correct stride for a 16550. Fixes: 3e6f1e61b4 ("hw/riscv/virt-acpi-build.c: Generate SPCR table") Signed-off-by: Rick Richard Reviewed-by: Daniel Henrique Barboza Message-ID: <20261005104008.214588-3-rick@sloservers.com> Cc: qemu-stable@nongnu.org Signed-off-by: Alistair Francis (cherry picked from commit ee23f530e99d1091f31585dd0ca1b948d4873939) Signed-off-by: Michael Tokarev diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c index 59c454f4f9..95aeb1f3a1 100644 --- a/hw/riscv/virt-acpi-build.c +++ b/hw/riscv/virt-acpi-build.c @@ -246,7 +246,7 @@ spcr_setup(GArray *table_data, BIOSLinker *linker, RISC= VVirtState *s) AcpiSpcrData serial =3D { .interface_type =3D 0x12, /* 16550 compatible */ .base_addr.id =3D AML_AS_SYSTEM_MEMORY, - .base_addr.width =3D 32, + .base_addr.width =3D 8, .base_addr.offset =3D 0, .base_addr.size =3D 1, .base_addr.addr =3D s->memmap[VIRT_UART0].base, --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269375; cv=none; d=zohomail.com; s=zohoarc; b=f/8vEEnu3A+m+/tcJp/vphX6V51KVOFiypEvnRAuOtLGCei/ogJMJKFYRjjMCBQVt98i+SWa6PRosInNdKjArcwRMbXXCO2MBnxoOv0KjYqyM7CzKw7KLlw9zPC3WrXre+F9rqBoX0RA187Q7pA+TVX6xEvo4KGMS6vJTa4xkuY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269375; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=2L5hnbtduTSHKRtLWTuKM9KEvaDcXqCOaydNK2mYFZM=; b=oHDLRQwriC2mHe8w4JjXMEip8dwNvR/NDaBCZsAQubv385Ln1yM5q1WuUvEmtHgY0y0f0j+Ib573xucT336LK7bOf0OEOA80WyhWik3z0+ENPW7vaTkqspoUlH/usdh/pb4XS/6/rTmB34LHgT0jP7r6Y/hiG69ta1v2XrbZ2dA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792269375408973.0058835522806; Sat, 17 Oct 2026 13:36:15 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB78-0002T6-Lm; Sat, 17 Oct 2026 16:34:46 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB6Q-0007zm-QB; Sat, 17 Oct 2026 16:34:02 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB6P-0004jG-2Y; Sat, 17 Oct 2026 16:34:02 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 81DF31DE789; Sat, 17 Oct 2026 23:28:26 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id 5C8E144345A; Sat, 17 Oct 2026 23:28:25 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268906; bh=qRvolJ5qa/tOZOHlXgDhJ4v57RaF5JF67FPon2iMbWw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=nddUsQAuQJYrXwdYwx4PbpgLVuvhS5WDFn4ADgAU1PQHs1s5ga6uIL5kqgTeAKU6Q km12aQSU+6P8ffR+QENe0j27Zl0+nC1NPVTrbduVL9qPUfFD7GzA/rAMtoRxgoV+NG SGredi++cQgl/lkldXYEclV64BH/w5A5Fdto/yhWwR4hfUkLKsyAUMdt8VbX3+6gbD mFj/uBaaUSxHyGVyAspFK5rH4etoe6zwsUIUNm/GN6ScmpC2GyNs3kkAytyEYIVPpy ihDYAfJn2aafXuRAfMW/gWsKvCA0DmLelYT6EP8DV+C6KBDO4CMl8d8wEVInzdc6cL gTdBja2YrCxkw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Rick Richard , Daniel Henrique Barboza , Alistair Francis , Michael Tokarev Subject: [Stable-11.1.3 72/73] tests/qtest/bios-tables-test: Update riscv64 virt SPCR golden reference Date: Sat, 17 Oct 2026 23:26:30 +0300 Message-ID: <20261017202638.728621-72-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269376242158500 Content-Type: text/plain; charset="utf-8" From: Rick Richard Update the riscv64 virt SPCR golden reference file to have the fix for the UART register width. Diffs from iasl: @@ -1,58 +1,58 @@ /* * Intel ACPI Component Architecture * AML/ASL+ Disassembler version 20230628 (64-bit version) * Copyright (c) 2000 - 2023 Intel Corporation * * Disassembly of tests/data/acpi/riscv64/virt/SPCR, Sat Oct 3 08:44:51 2= 026 * * ACPI Data Table [SPCR] * * Format: [HexOffset DecimalOffset ByteLength] FieldName : FieldValue (i= n hex) */ [000h 0000 004h] Signature : "SPCR" [Serial Port Cons= ole Redirection Table] [004h 0004 004h] Table Length : 0000005A [008h 0008 001h] Revision : 04 -[009h 0009 001h] Checksum : 13 +[009h 0009 001h] Checksum : 2B [00Ah 0010 006h] Oem ID : "BOCHS " [010h 0016 008h] Oem Table ID : "BXPC " [018h 0024 004h] Oem Revision : 00000001 [01Ch 0028 004h] Asl Compiler ID : "BXPC" [020h 0032 004h] Asl Compiler Revision : 00000001 [024h 0036 001h] Interface Type : 12 [025h 0037 003h] Reserved : 000000 [028h 0040 00Ch] Serial Port Register : [Generic Address Structure] [028h 0040 001h] Space ID : 00 [SystemMemory] -[029h 0041 001h] Bit Width : 20 +[029h 0041 001h] Bit Width : 08 [02Ah 0042 001h] Bit Offset : 00 [02Bh 0043 001h] Encoded Access Width : 01 [Byte Access:8] [02Ch 0044 008h] Address : 0000000010000000 [034h 0052 001h] Interrupt Type : 10 [035h 0053 001h] PCAT-compatible IRQ : 00 [036h 0054 004h] Interrupt : 0000000A [03Ah 0058 001h] Baud Rate : 07 [03Bh 0059 001h] Parity : 00 [03Ch 0060 001h] Stop Bits : 01 [03Dh 0061 001h] Flow Control : 00 [03Eh 0062 001h] Terminal Type : 03 [04Ch 0076 001h] Reserved : 00 [040h 0064 002h] PCI Device ID : FFFF [042h 0066 002h] PCI Vendor ID : FFFF [044h 0068 001h] PCI Bus : 00 [045h 0069 001h] PCI Device : 00 [046h 0070 001h] PCI Function : 00 [047h 0071 004h] PCI Flags : 00000000 [04Bh 0075 001h] PCI Segment : 00 [04Ch 0076 004h] Reserved : 00000000 Raw Table Data: Length 90 (0x5A) - 0000: 53 50 43 52 5A 00 00 00 04 13 42 4F 43 48 53 20 // SPCRZ.....BO= CHS + 0000: 53 50 43 52 5A 00 00 00 04 2B 42 4F 43 48 53 20 // SPCRZ....+BO= CHS 0010: 42 58 50 43 20 20 20 20 01 00 00 00 42 58 50 43 // BXPC ....= BXPC - 0020: 01 00 00 00 12 00 00 00 00 20 00 01 00 00 00 10 // ......... ..= .... + 0020: 01 00 00 00 12 00 00 00 00 08 00 01 00 00 00 10 // ............= .... 0030: 00 00 00 00 10 00 0A 00 00 00 07 00 01 00 03 00 // ............= .... 0040: FF FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 // ............= .... 0050: 00 00 00 00 02 00 58 00 2E 00 // ......X... Signed-off-by: Rick Richard Reviewed-by: Daniel Henrique Barboza Message-ID: <20261005104008.214588-4-rick@sloservers.com> Cc: qemu-stable@nongnu.org Signed-off-by: Alistair Francis (cherry picked from commit 71041ce05c95fe47fd24175bb2b974bb14f3d029) Signed-off-by: Michael Tokarev diff --git a/tests/data/acpi/riscv64/virt/SPCR b/tests/data/acpi/riscv64/vi= rt/SPCR index 59d2c8f7f2..6003c230b1 100644 Binary files a/tests/data/acpi/riscv64/virt/SPCR and b/tests/data/acpi/risc= v64/virt/SPCR differ diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios= -tables-test-allowed-diff.h index aae973048a..dfb8523c8b 100644 --- a/tests/qtest/bios-tables-test-allowed-diff.h +++ b/tests/qtest/bios-tables-test-allowed-diff.h @@ -1,2 +1 @@ /* List of comma-separated changed AML files to ignore */ -"tests/data/acpi/riscv64/virt/SPCR", --=20 2.47.3 From nobody Sat Oct 24 15:41:33 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1792269474; cv=none; d=zohomail.com; s=zohoarc; b=NfiCfKsQSUQ2/pVD65GxZ9g+br3daasxpRd+JHB5ar13/2MfkLjtcTMH3y129x2TOkU72WwMhkePAkCOXMsMOGqCkcxrLBFwjmFuH3scJYTWvpVCVE//a8aaiIEgu+O+kBSKn1VybPYoxCJGZvh1Gx/6Zx5mwf9jhLyUwy9Rdw8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792269474; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=bvk1yT32CLXXBTlThLPJ/7tMpdUyVgDcdYleCJ3ibNM=; b=VIqa18LBo6ddbmuFMyMg4kjzZrSD9actFI93mJf3PIbYoK+DN3jAAvITn7zk5PvepziFJauDsvdUAtCEMAOQI2rv0TCnbW2jeW+yJRBwt0GtQ2Xt7Xbb4s2fCBGl3qz7e1qtN5FZLXBMPwOwY6b2WHyi8iMfjd7YaIMWCdBX6V4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 17922694748121004.4363151525539; Sat, 17 Oct 2026 13:37:54 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIB8O-0003ae-Rb; Sat, 17 Oct 2026 16:36:05 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB6T-0008NQ-OA; Sat, 17 Oct 2026 16:34:06 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIB6S-0004jd-0I; Sat, 17 Oct 2026 16:34:05 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id D3D691DE78A; Sat, 17 Oct 2026 23:28:27 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id E080944345B; Sat, 17 Oct 2026 23:28:26 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1792268907; bh=ysuUAH0hzUmMmYIYi6wZp/+zDmPbz/HAW6uwi0NnuwU=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=B+E7HB9LBYL6c6S+DMFgC33UDJ7/VTviM6FxPeKqJKWyj9gAdKNPOo+VVr1LEeaO+ 2ZfYTJc0abhZRwdU0PSaRENVzueatMMUwY1nBQlKEvkIUJyKEkUn2phQPwMXEk9Qf9 fXUrErNE4DeNiMR+RrMLR7MDCjt9CA0vQvZ0IHeDSGEsDZTGcTpDiIjq5UnXhua5Hq VhoIs67Oyo4Mmj2oT6STE+4pIdqOTURLvY06+hcp+39s78arSTOcXAx/IAOu5yqomA QHwBVIWgXqWRX3ZKY7d5ETq6nCvr667Bv1mXPLEEwwMYJrNtRC7GaB1zgVScSI/GAB fCacFKMy3neCA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, dodochicha , Alistair Francis , Michael Tokarev Subject: [Stable-11.1.3 73/73] target/riscv: Check Svnapot PTE before updating A/D bits Date: Sat, 17 Oct 2026 23:26:31 +0300 Message-ID: <20261017202638.728621-73-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1792269476188158500 Content-Type: text/plain; charset="utf-8" From: dodochicha Reserved Svnapot PTE encodings must raise a page fault without modifying the PTE. Currently the A/D bits may be updated before the Svnapot encoding is validated. Move the Svnapot validation before the A/D update so reserved PTEs fault without changing the PTE. Cc: qemu-stable@nongnu.org Signed-off-by: dodochicha Message-ID: <20261005115916.21196-1-kevincheng60303@gmail.com> Reviewed-by: Alistair Francis Signed-off-by: Alistair Francis (cherry picked from commit cb82463fa9bf46d90e6a1779bb20aff2bf76a1a7) Signed-off-by: Michael Tokarev diff --git a/target/riscv/tcg/cpu_helper.c b/target/riscv/tcg/cpu_helper.c index 6115f65adb..8f1c84f05f 100644 --- a/target/riscv/tcg/cpu_helper.c +++ b/target/riscv/tcg/cpu_helper.c @@ -1405,6 +1405,13 @@ static int get_physical_address(CPURISCVState *env, = hwaddr *physical, return sstack_page ? TRANSLATE_PMP_FAIL : TRANSLATE_FAIL; } =20 + if (riscv_cpu_cfg(env)->ext_svnapot && (pte & PTE_N)) { + napot_bits =3D ctzl(ppn) + 1; + if ((i !=3D (levels - 1)) || (napot_bits !=3D 4)) { + return TRANSLATE_FAIL; + } + } + target_ulong updated_pte =3D pte; =20 /* @@ -1497,13 +1504,6 @@ static int get_physical_address(CPURISCVState *env, = hwaddr *physical, /* For superpage mappings, make a fake leaf PTE for the TLB's benefit.= */ target_ulong vpn =3D addr >> PGSHIFT; =20 - if (riscv_cpu_cfg(env)->ext_svnapot && (pte & PTE_N)) { - napot_bits =3D ctzl(ppn) + 1; - if ((i !=3D (levels - 1)) || (napot_bits !=3D 4)) { - return TRANSLATE_FAIL; - } - } - napot_mask =3D (1 << napot_bits) - 1; *physical =3D (((ppn & ~napot_mask) | (vpn & napot_mask) | (vpn & (((target_ulong)1 << ptshift) - 1)) --=20 2.47.3