From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from DU2PR03CU002.outbound.protection.outlook.com (mail-northeuropeazon11021075.outbound.protection.outlook.com [52.101.65.75]) by lore.virtuozzo.com (Postfix) with ESMTPS id 825DD80A80 for ; Tue, 13 Oct 2026 15:28:15 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=X7+SJVhiJ7YK9i5+7RKSd7jdTBdVUlWhXXP6lmXT3vfsU6qCW3hcJD/we7kN2Md6rYshVy0J1X9ypiMQ3s19D3ToFMrKSP5kLtscs79kLFZO4i4uyvqavYzqVI+R2pB6zQCDkbmw//IUXSL2ARfv+zPPAFZWO7TLTXtiOYGvFQCmNsUbztrCpbDRDuFuCPA2BWP7gPfNMb4qUPgkqxRwUMw0vDu4fAhRyD+Ew6HBPlx0EDtS9WSl8veLuZr1y+uW8UfchJl7ukbmEfiAJexPgCm2ol0Y0U0jc5vhIOJBACw+t4jHrGsGVm/AGY+qFfrYG5/hmSDfOA9It++HyEPCvA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=VABTbEhGJQ+fgvo2XyiR/w06hntWfBw6h7SZEENNXsI=; b=eSNvR0G6tukz2btZrS0ZyvW1Ewx3aRyzEfW2vY9w4hxzCCIFW5ba6LMqndTJO4u1scRYz5A6xKdC1BerGnno+EPTYUEHk7OfhbaZJtK2HhdfHKLrJONw4vb+5gOWAc/dWrsLN6q6sZBYOgyZfi7q7BTREqulq7KVcqmBDirU162ZqposCC4tvM9QWkaJTKUrzMbWeWtol55GbKG+w+patQW1Z+tN4FK3HhMr1Hakdd7tFTF7w5p5dGYDE3JF4ZT+otBzkYd9zdjsbTZqIp7KXlDNPG6yIMhvFTRAjadHFBXUbb8s4V4rc5MVgMiAVr3du/Qws5dZ5HrRulk3Os7aWw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=VABTbEhGJQ+fgvo2XyiR/w06hntWfBw6h7SZEENNXsI=; b=ItClg3A4ka4cOOaE5TZAf3ecTDmFI3XKWmVu6/VoIP6TN2tNeghuLFsxep6DqNTlDorIgkLJRrCW9ZSCGYk8ScApRdWctsT81I3hqJTbPmmfg8gPp619YFQzSUPBf4dpIpvvanANs98w/o98+enejtA3a0Vg9OGRR7N034TelPKb1oN1c+afnoYTjeofrQXgzXkOGUCoWy+CjLv6VP7dGEg8tFewCP0010AmEOQUwEc0V0t/d3mQPh4Drkcmo/eq2ekGB40bZtp/hBjepHcDGh9QFO2IGbVbevxJQI1cVumow+xA9cIQgJx77yVPCHehGAINrBK2d+aH9ooascZxIQ== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by WA4PR08MB366192.eurprd08.prod.outlook.com (2603:10a6:1d0:30::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.522.12; Tue, 13 Oct 2026 15:28:12 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0522.008; Tue, 13 Oct 2026 15:28:12 +0000 From: Andrey Drobyshev Date: Tue, 13 Oct 2026 18:28:11 +0300 Subject: [PATCH QEMU HCI-8.1 v2 07/24] q35: Fix migration of SMRAM state Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20261013-vfio_v1-v2-7-433455c0a294@virtuozzo.com> References: <20261013-vfio_v1-v2-0-433455c0a294@virtuozzo.com> In-Reply-To: <20261013-vfio_v1-v2-0-433455c0a294@virtuozzo.com> To: svt-core@virtuozzo.com Cc: andrey.drobyshev@virtuozzo.com X-Mailer: b4 0.16.0 X-ClientProxiedBy: VI5PEPF00000939.AUTP296.PROD.OUTLOOK.COM (2603:10a6:808:1::833) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|WA4PR08MB366192:EE_ X-MS-Office365-Filtering-Correlation-Id: aeb89943-e98e-4e15-4ee2-08df293e979c X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-Transport-Rules-Loop: 1 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|376014|1800799024|366016|52116014|5113699003|6133799003|18002099003|22082099003|10067099003|261009223027099003|56012099006|38350700014; X-Microsoft-Antispam-Message-Info: /kCIxF5PUaQckvSixfRjudUu3HWsn71eQTPDZatRuiNFCUhsjLU1xe1L5W750PkLbg7cfpAAe5HP1drXY3kCAcxsEiU9WxWn6sQgPzOp+JphGhZvPYSzWSQZRWag3R1gdvs0CRlEXMrBQzVDf+b9hsYLpyR56+EmnVypbKbQLso6lZ/lBMRs862t5qTSuwlnSjLVHr1nHHyJK5xQuiePa236uoJWf1z69lOZrNxfC9HzdQ5Wes5ThmD92EhkNRmP7fOI/Y5qHXevVAKOtIs6+GkZ9/nwrVce3oArOTx2t1EaluAc7aUPOLPaPNNsKFCo48AVUWY9NHXnlSYFI67pbmTBJ11j0JPtqHoMspRwUJnXFlkhxoUeSHRq8jVX7dHELwFwt++XICTk/qF18Us1+eVHaIIPqhovV1nWRIDyLjvFCrwCFSbtr7b/f/upHdauoGbfaH7zRLV1f7UM075Wx4yTj/oRH2e6W6MWzkzCC0Ib6NyXTRV7KRa/s7Or+kjLuWQOYGQh+5KK42e5UwWtqAEc6H4KBXtgaFR3PuREvR0PoFWDYkVf7g0UgE0CGhUF2S/rvhgxCMrUpuEMJkUp2r1suRMsJOxfwQUVOvpXHmSK/Bp58FaYZHCVtUGAzwB8c4I476h4zXHPJZadISdHqbUt/bLdXb4nwecSgSuD7ck= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(376014)(1800799024)(366016)(52116014)(5113699003)(6133799003)(18002099003)(22082099003)(10067099003)(261009223027099003)(56012099006)(38350700014);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?ZFdDS3NQOHJrZlhabkF2a01GVHVvL0pJa3ZUamRLL2RWb2pFbFdIVmJuTjJG?= =?utf-8?B?QzF3K0VibllpMWcwckhlVmo5b0crTnBhc01Bc05JVW5OYVgvVTQrSWdJMDFY?= =?utf-8?B?QVR4eW5lVThCNVl0VFdIK1VWZmtMOFBiWEVuWmIrdkxNd01COUUxK0JyMEQ3?= =?utf-8?B?TnlobXNXTFNab3ZaMHE2aUJRVjgzSzNWUGNDN1ovQkpIZmlpU29uRW9MRFVp?= =?utf-8?B?YlR2QjM3MXRoV3V2N1hQeDVvWjdIL0ZpZU9nUmo1dkRDc01lUExjS0RsYzB5?= =?utf-8?B?bWxvK3lOY0lTcTVFakFzOUFUek9WN2pLMUNjb2NRdEtYTjg1Y0wwL2RlakRE?= =?utf-8?B?NG1sbzZncFJZVzcyTHp2VU1QZVcrem5PRktqcUFWRmE2cWI4Z2JmU2dNZHFs?= =?utf-8?B?NWs1akhSN2s3SHd1UUxrR3d0Q0g5WFA0aTlUbjhiMW1VZm1MWmFYSXVRZ3Fp?= =?utf-8?B?aVp0SWxQT1hWaWtPMjJlLzY5eDZ5Y0ZYMEt0ZUw4c0ZWdEd1RGpESkpvbjFY?= =?utf-8?B?bFRPOWJ6M1c4U2Z6bGJyTDJGbHVndVZKaGtTcGxzU3VuempSWnc1Y1Q1M0R6?= =?utf-8?B?QURDS3BYazdURXc0MU1ja0pFUTVTSjltQUZJcTd3MmVhbnRRZk9Za2hoZTZx?= =?utf-8?B?SnhFYkdERmc5YUp1Ky8xWUJ0azI3aVlZV3lNUnhoREFuN3FCNXNVTENTMlNa?= =?utf-8?B?am0zUWdoQjVKMC9jdGVKc2RVbE5hMXNRS3NGMDByVFMxNVpZMllpeEh5ODgy?= =?utf-8?B?bG1VTHR4NW1pYTdxMG5pclZzUktwWk5XTTV1Q0c0VUtBOEIzNUdHcHN3SHNQ?= =?utf-8?B?ajVuMUZoaHp2MEZqdmlleHVqUUlDU1RVbjVJL2VRWFJ3TU8yakFXeDNMU1Zh?= =?utf-8?B?UnRxL3hNbk0vVTRwUllPaDNxdWFoTldoaEJDSnVKbFJCbm1hOFVYc2RyOEFo?= =?utf-8?B?WW8zYmkxcDBwSVovZ1pBZS9iNUg4WDVTYWZzNVY0TWJoSm1lWlhTOGkxdkp3?= =?utf-8?B?T1RGcFUwNFRjRHNPSHhrbkt5djZmOVJsSTUvM2s4c0U4R3lYMUd6T0J3c1Yz?= =?utf-8?B?aTB5bGhxR3NvZHZMa1ovbXUrNjZFckJQekl1SnZEcTJkZEVWYnV2TkV5RFBM?= =?utf-8?B?RzFHWGxlM29BMUUzeHhGMVVRNnJTNTNhcE1jZ0dWNDJOcHBUQzhkZ0dkVGxa?= =?utf-8?B?by9BYU1LZUorRlJJZXMvdkdhb1R1ckxNa29oemljd2t1aU51aE82ZHI1ZEox?= =?utf-8?B?K0gwQmNMdERDdE9qU3BpZHc2bFNoTkx5NzRoL3VNWDJvaFl4ZmhYVTFoSzc4?= =?utf-8?B?RGxIMTRWdWpjU2x5bWowdS9jaHExRU1DUDF0OUdONjJzZDgzeUVYZFRCT0Fq?= =?utf-8?B?eUllZ1hxUTZaZ2pOV3R5VUlEYk1FalFEbFFuNU5XUTlvT0U4bjMxNzNvT1N1?= =?utf-8?B?R3BYQWQ2cThGWUxlSEVOVytDbStSWUVscjQ1L1kvRGRVZjdZUFFLVnU1Mmt5?= =?utf-8?B?VXVHNmJsenVRUlQ4bHdoVk5rWnBuWUp4K0s3TTNoSFJ2bVNNNXRET3NCbTNw?= =?utf-8?B?MHd2c3JCbm1MY2V3Q1N1VWhHRm10enlMejBPQ3BHMUcxS0pmaUMvMkdPN2d1?= =?utf-8?B?UEZUTUJoUDdWRnZoZEoybzFWb1grSUY4YTQvS0tZWjRrK1BzRFRSRXZsZkJ6?= =?utf-8?B?WUhwZUN4N2J0Rm4wbWg4bUxLbytQNWxQSG9pdnJ3VmdWWEYreVFKc3pzYVM5?= =?utf-8?B?K2UwOHVBeXJ3UFYxZTZuZjEzZlZjR3ZFcnpqWTVvVHRiUFo3blREMjlIRHVZ?= =?utf-8?B?VG9oN0N0NlROMk0vaFdXSE9wekUzaS9Udk94VGdmY1R1NGJTMWhVaG0zN1hI?= =?utf-8?B?YjFTeHlEdVhMdFdkU0ZoTWZodWxIQmwyYlhjd1B6c3V6VEJHMmozOC9INVps?= =?utf-8?B?VnhmTldzejFkc09ZQldFRG5lZ3NHdmlwWDAyZ3VMUEEvK29YZVJKWU1IZkd5?= =?utf-8?B?RU80S1ZrQUhER3NIRTQrU2hqcVVnTk4vVmNUdkRSVTF1N0d4aklkTTMwaWg0?= =?utf-8?B?b1h5ek1GdWt2K1gyTjVsWlJPOHRJcWVISmJsODBOUzNDdDlsSWhVbmlORzBB?= =?utf-8?B?L3l6WHlsdGp6NW1aVWZ4VDJNYjVIRnRSbWtIbCtkb3MvRmN4d04zT01sZDdi?= =?utf-8?B?V1MxR2R5dXY4dGZObVVhKy9aNS9COHdWUnhNWUdROXlSelFmR2RrM0d0VC91?= =?utf-8?B?Z0ZsRzl2cTZMU1NOOENsamE5aW1Bb1IzS3NpWHlMeS83QkhLQ3Q4cE1jQ05l?= =?utf-8?B?dGNNeWk4SXIwd1M4eUIvL1BuK2JaRlJTbmgxQXFIZThpUkg2ZnNrOEl5VE9U?= =?utf-8?Q?kwRFfXMMz6GW7sVo=3D?= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: aeb89943-e98e-4e15-4ee2-08df293e979c X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Oct 2026 15:28:12.0152 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: c3MgE2jjH6zABmpe8naEfIEnBa+lNl7kathcDUMAA2KMcyZTsZ1rWrYgmiwBC3n6x5LNYtOqpNYL8GtkH4NqCJPioDpbgjXHNZzIks1GcVo= X-MS-Exchange-Transport-CrossTenantHeadersStamped: WA4PR08MB366192 From: Igor Mammedov When migrating, dst QEMU by default has SMRAM unlocked, and since wmask is not migrated, the migrated value of MCH_HOST_BRIDGE_F_SMBASE in config space fall to prey of mch_update_smbase_smram() ... if (pd->wmask[MCH_HOST_BRIDGE_F_SMBASE] == 0xff) { *reg = 0x00; and is getting cleared and leads to unlocked smram on dst even if on source it's been locked. As Andrey has pointed out [1], we should derive wmask from config and not other way around. Drop offending chunk and resync wmask based on MCH_HOST_BRIDGE_F_SMBASE register value. That would preserve the register during migration and set smram regions into corresponding state. What that changes is: that it would let guest write junk values in register (with no apparent effect) until it's stumbles upon reserved 0x1 [|] 0x2 values, at which point it would be only possible to lock register and trigger switch to SMRAM blackhole in CPU AS. While at it, fix up test by removing junk discard before negotiation hunk. PS2: Instead of adding a dedicated post_load handler for it, reuse mch_update->mch_update_smbase_smram call chain that is called on write/reset/post_load to be consistent with how we handle mch registers. PS3: for prosterity here is erro message Andrey got due to this bug: qemu: vfio_container_dma_map(0x..., 0x0, 0xa0000, 0x....) = -22 (Invalid argument) qemu: hardware error: vfio: DMA mapping failed, unable to continue 1) https://patchew.org/QEMU/20251203180851.6390-1-arbn@yandex-team.com/ andrey.drobyshev: This commit is cherry-picked as-is, with no modifications, from the upstream commit 66cf169e29b0. Fixes: f404220e279c ("q35: implement 128K SMRAM at default SMBASE address") Reported-by: Andrey Ryabinin Signed-off-by: Igor Mammedov Reviewed-by: Andrey Ryabinin Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Message-Id: <20251211165454.288476-1-imammedo@redhat.com> --- hw/pci-host/q35.c | 25 +++++++++++-------------- tests/qtest/q35-test.c | 6 ------ 2 files changed, 11 insertions(+), 20 deletions(-) diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c index a708758d361..946342ba585 100644 --- a/hw/pci-host/q35.c +++ b/hw/pci-host/q35.c @@ -432,30 +432,27 @@ static void mch_update_smbase_smram(MCHPCIState *mch) } if (*reg == MCH_HOST_BRIDGE_F_SMBASE_QUERY) { - pd->wmask[MCH_HOST_BRIDGE_F_SMBASE] = - MCH_HOST_BRIDGE_F_SMBASE_LCK; + pd->wmask[MCH_HOST_BRIDGE_F_SMBASE] = MCH_HOST_BRIDGE_F_SMBASE_LCK; *reg = MCH_HOST_BRIDGE_F_SMBASE_IN_RAM; return; } /* - * default/reset state, discard written value - * which will disable SMRAM balackhole at SMBASE + * reg value can come from register write/reset/migration source, + * update wmask to be in sync with it regardless of source */ - if (pd->wmask[MCH_HOST_BRIDGE_F_SMBASE] == 0xff) { - *reg = 0x00; + if (*reg == MCH_HOST_BRIDGE_F_SMBASE_IN_RAM) { + pd->wmask[MCH_HOST_BRIDGE_F_SMBASE] = MCH_HOST_BRIDGE_F_SMBASE_LCK; + return; } - - memory_region_transaction_begin(); if (*reg & MCH_HOST_BRIDGE_F_SMBASE_LCK) { - /* disable all writes */ - pd->wmask[MCH_HOST_BRIDGE_F_SMBASE] &= - ~MCH_HOST_BRIDGE_F_SMBASE_LCK; + /* lock register at 0x2 and disable all writes */ + pd->wmask[MCH_HOST_BRIDGE_F_SMBASE] = 0; *reg = MCH_HOST_BRIDGE_F_SMBASE_LCK; - lck = true; - } else { - lck = false; } + + lck = *reg & MCH_HOST_BRIDGE_F_SMBASE_LCK; + memory_region_transaction_begin(); memory_region_set_enabled(&mch->smbase_blackhole, lck); memory_region_set_enabled(&mch->smbase_window, lck); memory_region_transaction_commit(); diff --git a/tests/qtest/q35-test.c b/tests/qtest/q35-test.c index 62fff49fc89..4e3a4457f62 100644 --- a/tests/qtest/q35-test.c +++ b/tests/qtest/q35-test.c @@ -206,12 +206,6 @@ static void test_smram_smbase_lock(void) qtest_writeb(qts, SMBASE, SMRAM_TEST_PATTERN); g_assert_cmpint(qtest_readb(qts, SMBASE), ==, SMRAM_TEST_PATTERN); - /* check that writing junk to 0x9c before before negotiating is ignored */ - for (i = 0; i < 0xff; i++) { - qpci_config_writeb(pcidev, MCH_HOST_BRIDGE_F_SMBASE, i); - g_assert(qpci_config_readb(pcidev, MCH_HOST_BRIDGE_F_SMBASE) == 0); - } - /* enable SMRAM at SMBASE */ qpci_config_writeb(pcidev, MCH_HOST_BRIDGE_F_SMBASE, 0xff); g_assert(qpci_config_readb(pcidev, MCH_HOST_BRIDGE_F_SMBASE) == 0x01); -- 2.47.1