Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/2195074/?format=api
{ "id": 2195074, "url": "http://patchwork.ozlabs.org/api/patches/2195074/?format=api", "web_url": "http://patchwork.ozlabs.org/project/qemu-devel/patch/20260210121657.69363-9-mjt@tls.msk.ru/", "project": { "id": 14, "url": "http://patchwork.ozlabs.org/api/projects/14/?format=api", "name": "QEMU Development", "link_name": "qemu-devel", "list_id": "qemu-devel.nongnu.org", "list_email": "qemu-devel@nongnu.org", "web_url": "", "scm_url": "", "webscm_url": "", "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20260210121657.69363-9-mjt@tls.msk.ru>", "list_archive_url": null, "date": "2026-02-10T12:16:42", "name": "[Stable-10.0.8,78/85] q35: Fix migration of SMRAM state", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "c9964cf55ec4a8f38eecf2a58bbb53630c3b6727", "submitter": { "id": 183, "url": "http://patchwork.ozlabs.org/api/people/183/?format=api", "name": "Michael Tokarev", "email": "mjt@tls.msk.ru" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/qemu-devel/patch/20260210121657.69363-9-mjt@tls.msk.ru/mbox/", "series": [ { "id": 491663, "url": "http://patchwork.ozlabs.org/api/series/491663/?format=api", "web_url": "http://patchwork.ozlabs.org/project/qemu-devel/list/?series=491663", "date": "2026-02-10T12:16:40", "name": "Patch Round-up for stable 10.0.8, freeze on 2026-02-10 (frozen)", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/491663/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2195074/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2195074/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org>", "X-Original-To": "incoming@patchwork.ozlabs.org", "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org\n (client-ip=209.51.188.17; helo=lists.gnu.org;\n envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org;\n receiver=patchwork.ozlabs.org)", "Received": [ "from lists.gnu.org (lists.gnu.org [209.51.188.17])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4f9LLW3n7wz1xwN\n\tfor <incoming@patchwork.ozlabs.org>; Tue, 10 Feb 2026 23:22:59 +1100 (AEDT)", "from localhost ([::1] helo=lists1p.gnu.org)\n\tby lists.gnu.org with esmtp (Exim 4.90_1)\n\t(envelope-from <qemu-devel-bounces@nongnu.org>)\n\tid 1vpmjk-0003cd-3S; Tue, 10 Feb 2026 07:21:00 -0500", "from eggs.gnu.org ([2001:470:142:3::10])\n by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from <mjt@tls.msk.ru>)\n id 1vpmih-0000P5-0V; Tue, 10 Feb 2026 07:19:55 -0500", "from isrv.corpit.ru ([212.248.84.144])\n by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from <mjt@tls.msk.ru>)\n id 1vpmie-0001pW-Es; Tue, 10 Feb 2026 07:19:54 -0500", "from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2])\n by isrv.corpit.ru (Postfix) with ESMTP id DFB30187DE2;\n Tue, 10 Feb 2026 15:16:17 +0300 (MSK)", "from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146])\n by tsrv.corpit.ru (Postfix) with ESMTP id 7C6E2360CF6;\n Tue, 10 Feb 2026 15:17:13 +0300 (MSK)" ], "From": "Michael Tokarev <mjt@tls.msk.ru>", "To": "qemu-devel@nongnu.org", "Cc": "qemu-stable@nongnu.org, Igor Mammedov <imammedo@redhat.com>,\n Andrey Ryabinin <arbn@yandex-team.com>,\n \"Michael S. Tsirkin\" <mst@redhat.com>, Michael Tokarev <mjt@tls.msk.ru>", "Subject": "[Stable-10.0.8 78/85] q35: Fix migration of SMRAM state", "Date": "Tue, 10 Feb 2026 15:16:42 +0300", "Message-ID": "<20260210121657.69363-9-mjt@tls.msk.ru>", "X-Mailer": "git-send-email 2.47.3", "In-Reply-To": "<qemu-stable-10.0.8-20260210151548@cover.tls.msk.ru>", "References": "<qemu-stable-10.0.8-20260210151548@cover.tls.msk.ru>", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit", "Received-SPF": "pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru;\n helo=isrv.corpit.ru", "X-Spam_score_int": "-2", "X-Spam_score": "-0.3", "X-Spam_bar": "/", "X-Spam_report": "(-0.3 / 5.0 requ) BAYES_00=-1.9,\n RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001,\n SPF_HELO_NONE=0.001, SPF_PASS=-0.001,\n URIBL_SBL=1.623 autolearn=no autolearn_force=no", "X-Spam_action": "no action", "X-BeenThere": "qemu-devel@nongnu.org", "X-Mailman-Version": "2.1.29", "Precedence": "list", "List-Id": "qemu development <qemu-devel.nongnu.org>", "List-Unsubscribe": "<https://lists.nongnu.org/mailman/options/qemu-devel>,\n <mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>", "List-Archive": "<https://lists.nongnu.org/archive/html/qemu-devel>", "List-Post": "<mailto:qemu-devel@nongnu.org>", "List-Help": "<mailto:qemu-devel-request@nongnu.org?subject=help>", "List-Subscribe": "<https://lists.nongnu.org/mailman/listinfo/qemu-devel>,\n <mailto:qemu-devel-request@nongnu.org?subject=subscribe>", "Errors-To": "qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org", "Sender": "qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org" }, "content": "From: Igor Mammedov <imammedo@redhat.com>\n\nWhen migrating, dst QEMU by default has SMRAM unlocked,\nand since wmask is not migrated, the migrated value of\nMCH_HOST_BRIDGE_F_SMBASE in config space fall to prey of\n\n mch_update_smbase_smram()\n ...\n if (pd->wmask[MCH_HOST_BRIDGE_F_SMBASE] == 0xff) {\n *reg = 0x00;\n\nand is getting cleared and leads to unlocked smram\non dst even if on source it's been locked.\n\nAs Andrey has pointed out [1], we should derive wmask\nfrom config and not other way around.\n\nDrop offending chunk and resync wmask based on MCH_HOST_BRIDGE_F_SMBASE\nregister value. That would preserve the register during\nmigration and set smram regions into corresponding state.\n\nWhat that changes is:\nthat it would let guest write junk values in register\n(with no apparent effect) until it's stumbles upon\nreserved 0x1 [|] 0x2 values, at which point it\nwould be only possible to lock register and trigger\nswitch to SMRAM blackhole in CPU AS.\n\nWhile at it, fix up test by removing junk discard before negotiation hunk.\n\nPS2:\nInstead of adding a dedicated post_load handler for it,\nreuse mch_update->mch_update_smbase_smram call chain\nthat is called on write/reset/post_load to be consistent\nwith how we handle mch registers.\n\nPS3:\nfor prosterity here is erro message Andrey got due to this bug:\n qemu: vfio_container_dma_map(0x..., 0x0, 0xa0000, 0x....) = -22 (Invalid argument)\n qemu: hardware error: vfio: DMA mapping failed, unable to continue\n\n1) https://patchew.org/QEMU/20251203180851.6390-1-arbn@yandex-team.com/\n\nFixes: f404220e279c (\"q35: implement 128K SMRAM at default SMBASE address\")\nReported-by: Andrey Ryabinin <arbn@yandex-team.com>\nSigned-off-by: Igor Mammedov <imammedo@redhat.com>\nReviewed-by: Andrey Ryabinin <arbn@yandex-team.com>\nReviewed-by: Michael S. Tsirkin <mst@redhat.com>\nSigned-off-by: Michael S. Tsirkin <mst@redhat.com>\nMessage-Id: <20251211165454.288476-1-imammedo@redhat.com>\n(cherry picked from commit 66cf169e29b06dca104c5a229fba0da4ce33599c)\nSigned-off-by: Michael Tokarev <mjt@tls.msk.ru>", "diff": "diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c\nindex 06be3d77cb..133b775444 100644\n--- a/hw/pci-host/q35.c\n+++ b/hw/pci-host/q35.c\n@@ -432,30 +432,27 @@ static void mch_update_smbase_smram(MCHPCIState *mch)\n }\n \n if (*reg == MCH_HOST_BRIDGE_F_SMBASE_QUERY) {\n- pd->wmask[MCH_HOST_BRIDGE_F_SMBASE] =\n- MCH_HOST_BRIDGE_F_SMBASE_LCK;\n+ pd->wmask[MCH_HOST_BRIDGE_F_SMBASE] = MCH_HOST_BRIDGE_F_SMBASE_LCK;\n *reg = MCH_HOST_BRIDGE_F_SMBASE_IN_RAM;\n return;\n }\n \n /*\n- * default/reset state, discard written value\n- * which will disable SMRAM balackhole at SMBASE\n+ * reg value can come from register write/reset/migration source,\n+ * update wmask to be in sync with it regardless of source\n */\n- if (pd->wmask[MCH_HOST_BRIDGE_F_SMBASE] == 0xff) {\n- *reg = 0x00;\n+ if (*reg == MCH_HOST_BRIDGE_F_SMBASE_IN_RAM) {\n+ pd->wmask[MCH_HOST_BRIDGE_F_SMBASE] = MCH_HOST_BRIDGE_F_SMBASE_LCK;\n+ return;\n }\n-\n- memory_region_transaction_begin();\n if (*reg & MCH_HOST_BRIDGE_F_SMBASE_LCK) {\n- /* disable all writes */\n- pd->wmask[MCH_HOST_BRIDGE_F_SMBASE] &=\n- ~MCH_HOST_BRIDGE_F_SMBASE_LCK;\n+ /* lock register at 0x2 and disable all writes */\n+ pd->wmask[MCH_HOST_BRIDGE_F_SMBASE] = 0;\n *reg = MCH_HOST_BRIDGE_F_SMBASE_LCK;\n- lck = true;\n- } else {\n- lck = false;\n }\n+\n+ lck = *reg & MCH_HOST_BRIDGE_F_SMBASE_LCK;\n+ memory_region_transaction_begin();\n memory_region_set_enabled(&mch->smbase_blackhole, lck);\n memory_region_set_enabled(&mch->smbase_window, lck);\n memory_region_transaction_commit();\ndiff --git a/tests/qtest/q35-test.c b/tests/qtest/q35-test.c\nindex 75d4078b79..9050860366 100644\n--- a/tests/qtest/q35-test.c\n+++ b/tests/qtest/q35-test.c\n@@ -206,12 +206,6 @@ static void test_smram_smbase_lock(void)\n qtest_writeb(qts, SMBASE, SMRAM_TEST_PATTERN);\n g_assert_cmpint(qtest_readb(qts, SMBASE), ==, SMRAM_TEST_PATTERN);\n \n- /* check that writing junk to 0x9c before before negotiating is ignored */\n- for (i = 0; i < 0xff; i++) {\n- qpci_config_writeb(pcidev, MCH_HOST_BRIDGE_F_SMBASE, i);\n- g_assert(qpci_config_readb(pcidev, MCH_HOST_BRIDGE_F_SMBASE) == 0);\n- }\n-\n /* enable SMRAM at SMBASE */\n qpci_config_writeb(pcidev, MCH_HOST_BRIDGE_F_SMBASE, 0xff);\n g_assert(qpci_config_readb(pcidev, MCH_HOST_BRIDGE_F_SMBASE) == 0x01);\n", "prefixes": [ "Stable-10.0.8", "78/85" ] }