From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: <010701a1a1bde613-7f2f7414-7f02-4196-9fb1-c055a0d6cd10-000000@eu-central-1.amazonses.com> Received: from DUZPR83CU001.outbound.protection.outlook.com (mail-northeuropeazon11022136.outbound.protection.outlook.com [52.101.66.136]) by lore.virtuozzo.com (Postfix) with ESMTPS id BCF388045D for ; Tue, 3 Nov 2026 14:09:03 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Ht75Mz8kqDDeSz/1YooeY4mtX5Lq96YnQ2b+8HQ24ZSNxoGnb02Q0weeLQW8ihLtHsknpTGjO1SAryEyvHy7/NP9HR7DFjMqDkMwprWXAtEZDo5Tei9snqlEhAt1RkxROZMvYs+m8UcOa4RPaalR7XHR3zTWdidATVkVTTC0HN97XZHtIwfn5eul52CAbuqZg/Xk6MCvLwS2rGrutNIvprgFBR+9rLyNKpy18C92yX1usT6bpwpZ837ocgrIK/Cxpi4g+cFT0r0Y1njkRK+zN5Q3BRMrjbC0PqPUMThv61Tvqc/iPilHRJM95Z4c1H9JOAD7npFziJmLd5mfNAA9sg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=FORqLGS2orUNwgMvRtvHK7D72WfqQyGxz8zkXxZ5G0o=; b=Sfv3wA5bxz5g9jDFAJb9cL+w87P7CKH64ewYyLzY9fYXNyz0kRJhHM1MQAV5DkrGkiMA5//1Y0i3QQPdT8wEXVHSUj49RXTFIyANrWQJneIRULZOphlnuXGGkcG2HzfywI8fxrqpUHIWqk/0gCx6ibI53BcibH+wPMUqPpKjOP8LuVSjw1mjBdLbL0K0jEGfZNfQNhpbaKEdXQ+1LI0Gfi3pFUhywyro3rgzGmrd1h7177YM8GohweW6eNOU1wHFhbzJ2Q+cxvaf/ODQOZeZfXME+Gmt4AW78yXi4qlNeF9pSIcQNKzA71TgypygTP5BHjI95RfzGbdIgX1TipseNg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 69.169.224.6) smtp.rcpttodomain=virtuozzo.com smtp.mailfrom=eu-central-1.amazonses.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=sashiko.virtuozzo.com; dkim=pass (signature was verified) header.d=sashiko.virtuozzo.com; dkim=pass (signature was verified) header.d=amazonses.com; arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.onmicrosoft.com; s=selector2-virtuozzo-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=FORqLGS2orUNwgMvRtvHK7D72WfqQyGxz8zkXxZ5G0o=; b=fVuwIXFLGQ+80FUq9Wq1pZdSLmqT33BbUIzk/3yezTztxOl+ZJ2Dcw67W+K4uemnKhQWvvj/DKpbIQ5ExFmI4n3xWvkPoJhtO1LUflBc93RSja/igHVohdPCv4Zy2ou6/smdIBPvtHGI2g9RLRDtRJAgnHol0ccqNfxBAN6CFiU= Received: from AS8P251CA0007.EURP251.PROD.OUTLOOK.COM (2603:10a6:20b:2f2::7) by AMDPR08MB11305.eurprd08.prod.outlook.com (2603:10a6:20b:716::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.569.12; Tue, 3 Nov 2026 14:09:00 +0000 Received: from ZR1PEPF0000E45F.eurprd04.prod.outlook.com (2603:10a6:20b:2f2:cafe::4f) by AS8P251CA0007.outlook.office365.com (2603:10a6:20b:2f2::7) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.592.8 via Frontend Transport; Tue, 3 Nov 2026 14:09:00 +0000 Authentication-Results: mx.microsoft.com 1; spf=pass (sender IP is 69.169.224.6) smtp.mailfrom=eu-central-1.amazonses.com; dkim=pass (signature was verified) header.d=sashiko.virtuozzo.com;dkim=pass (signature was verified) header.d=amazonses.com;dmarc=pass action=none header.from=sashiko.virtuozzo.com; Received-SPF: Pass (protection.outlook.com: domain of eu-central-1.amazonses.com designates 69.169.224.6 as permitted sender) receiver=protection.outlook.com; client-ip=69.169.224.6; helo=b224-6.smtp-out.eu-central-1.amazonses.com; pr=C Received: from b224-6.smtp-out.eu-central-1.amazonses.com (69.169.224.6) by ZR1PEPF0000E45F.mail.protection.outlook.com (10.167.241.55) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.592.5 via Frontend Transport; Tue, 3 Nov 2026 14:09:00 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=23yjbh4k34hwzfubhuiim7m4inbd3ick; d=sashiko.virtuozzo.com; t=1793714939; h=Message-ID:From:Subject:To:Cc:In-Reply-To:References:Content-Type:Content-Transfer-Encoding:Date; bh=yNtkBvy0F/qNOAsoKFG7YyGWfIvOzw3c1u0C5xPv+P0=; b=EbLIZK7QjkdVkq09/ZWh3A+YEEzFnyI4RXRfM6OafQ/+1rkn0i5j1MuOs6Z5pBt7 E3KWRA9h3iCpCdWvoUc76kqJUUc3rHMvDxj/rag6zsiSBe26HhXMrLH3x0+rUWpVsoW +HX29HDO/1RKkprwzno3FNxoYSDOREd7DL6IaydrbKEJA6DYfsf4wk7dXpZe3XB66QQ L/BwacMhw7UiMdXPopWD2Z/z+z5Te7EBmy1QmPWli29QugF4Ac9PGJTuFuSIn3K2org +50ZbKrCpyPsy1XHrbFIJVIgj/OpXKZ6HFZuBTCzbZ2O5MWpXa4zi6tHACeM/g3vUnI h+XegZRjnQ== DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=qftdzk2dqsatjnlrq4r5brjbihpfcrsh; d=amazonses.com; t=1793714939; h=Message-ID:From:Subject:To:Cc:In-Reply-To:References:Content-Type:Content-Transfer-Encoding:Date:Feedback-ID; bh=yNtkBvy0F/qNOAsoKFG7YyGWfIvOzw3c1u0C5xPv+P0=; b=VhSgom6hPW6+60u0Pz87YiaFgoPaaSTBX+kVanZaMB3xGG4v8rfdkXxe9j5+62ag SQzb54kKqOMgp1eKXqlQRgWqSQeZJhKUDzS/KkOyhbAJice0RZNCxBJceEG2wkFwlq9 aKMN4sJjAMTsPffAWWu9TZwzLWllQNG19Fqn0VHc= Message-ID: <010701a1a1bde613-7f2f7414-7f02-4196-9fb1-c055a0d6cd10-000000@eu-central-1.amazonses.com> From: no-reply@sashiko.virtuozzo.com Subject: Re: [PATCH QEMU HCI-8.1 v7 15/35] q35: Fix migration of SMRAM state To: Andrey Drobyshev , svt-core@virtuozzo.com Cc: andrey.drobyshev@virtuozzo.com In-Reply-To: <20261103-vfio_v1-v7-15-4467fdccbbe6@virtuozzo.com> References: <20261103-vfio_v1-v7-0-4467fdccbbe6@virtuozzo.com> <20261103-vfio_v1-v7-15-4467fdccbbe6@virtuozzo.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Tue, 3 Nov 2026 14:08:59 +0000 Feedback-ID: ::1.eu-central-1.2wRQJBpg9g1fGRYexx3dUuYGS25Bux+2TEOx72/m6U4=:AmazonSES X-SES-Outgoing: 2026.11.03-69.169.224.6 X-EOPAttributedMessage: 0 X-EOPTenantAttributedMessage: 0bc7f26d-0264-416e-a6fc-8352af79c58f:0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: ZR1PEPF0000E45F:EE_|AMDPR08MB11305:EE_ MIME-Version: 1.0 X-MS-Office365-Filtering-Correlation-Id: d988e5d8-ab0c-457e-b49d-08df39b40222 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr X-MS-Exchange-AtpMessageProperties: SA List-Id: svt-core@virtuozzo.com X-MS-Exchange-Transport-Rules-Loop: 1 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|704161411799003|61400799027|48200799018|9140799003|376014|32142699015|5063699009|261021121427099003|4143699003|56012099006|261028144727099003|261026140227099003|261022105027099003|261026121527099003|261009223027099003|10067099003|16102099003|55112099003|18002099003|22082099003|261102123227099003|5113699003|4113699003|6133799003|13003099007; X-Microsoft-Antispam-Message-Info: mPthW1owwPEEaaHxUUZEr/1zfzX6Pvfpw3GjtYz4VG2uIurwjTabxhR0Wjz9vE60L82s+/0R444zTveMTGO6jSam/TfgYDlDDa2Z9cR+O32GIWfXvKnglcPfzcGFHmwfuwUV3CvoOglWXhC+oSprhvqfC5u7QAI6+UbDStIJLSZ3C9v1r0iLPkr3t5Q3iAnYoG9c38oPZDh4lNGTTOgMZH3NhAfGX4vZFES636gbMsTqEgsdh7MSijtz6ghoJH0OpsK9c6eFAgSEbQjAiRekkY/5U8K7acLgY8LkmA9DfeAJ+2o0TBWfwUUQdNij6VdhRrE1cetMFGyECQsklwCJW3mcqKUxkc5O9hZA78yrYL0ardOJf0zeSbOB3LZs8iIMMDQ0fGw+2+k1JQ2YIqSwAbNKQM6O80yhndKnduFnC3FnXgutb5BeCaRCYfufjcqfQ3t936KtbizkhvRDnQUpgkDozvANiIItMEJy7habA/TIxZIyesb8zLnTbC11+SEA7QDt1I2h0lv5bgmoDcRA1ok6f+aul85hphN6Wjmc02Myv5P8ANsp4O0em5W8snY8qaetCoQvDn9qi7eNZ5T9K7ShHe7CTB/KSMWrCgpHIZ+zEIEXVLfXjEwKH4ImpAJTiVanscxGIxnhlfDKMGCMwRc8+cXqa0xqc/eXlKZpR1gTe6AYhP7tHfqgnSj910U3f09thInu2TRiiJWEeQ3lPDaBl53m4mYtZmw6khOYowB1FyfMdKaEp9XNehcsSxuU/Y2mVHYuiWOCRoSyxesbq4Pf+d3Hcw3fR+TTC5fpmjuySvoeBtJr+9nkJWHumqCG3lnB/QiPhjpu8/9TC/p8WF8OEklFxK/T1aEBr3jKztZCk0Q68cit2x22QsEucEPv X-Forefront-Antispam-Report: CIP:69.169.224.6;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:b224-6.smtp-out.eu-central-1.amazonses.com;PTR:b224-6.smtp-out.eu-central-1.amazonses.com;CAT:NONE;SFS:(13230040)(704161411799003)(61400799027)(48200799018)(9140799003)(376014)(32142699015)(5063699009)(261021121427099003)(4143699003)(56012099006)(261028144727099003)(261026140227099003)(261022105027099003)(261026121527099003)(261009223027099003)(10067099003)(16102099003)(55112099003)(18002099003)(22082099003)(261102123227099003)(5113699003)(4113699003)(6133799003)(13003099007);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: v3IyEjQ6qEnl0axgkh7ownQcsGY9MapP36kiZGkmCYFoPZ0NGnZXjeqYCQU++qUtfWGM7B0mfi2caVLyvSFjKzi/TLzWEDH1e6rPBlsNadI/yMESmGH+rhgCfZ7rH9lyq7Ayl3pCqGMLgGT7OwZauSx/o9H68EOEt1tGyVAWjXSngi2ZVy5yqw6/OmKFJNhZuuaMwm3IUmih0MSZzw+ucO1IfP06lTHzqxBA3Nl4+J+6y2q/BzgoGDFgzJsO3dyoO0NV25SSPa1a9T3mVDNLtojo9sp79abZ1T/iWdHs2PiUB+8NVtdnjz7HbkBJyEqzzHQtVao6lX8bmaNiiTFlIsMX70GZ3a0wQkO84xUNefBzV5Oq3yVoh8v5CKaK+jQCGUa+BCnP10x7QNsluo2Bn7sYVjm3Y4d9LXsfyUbNEiutD3KNrFmGTu2CHyl2PC4L X-ExternalRecipientOutboundConnectors: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Nov 2026 14:09:00.1968 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: d988e5d8-ab0c-457e-b49d-08df39b40222 X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-AuthSource: ZR1PEPF0000E45F.eurprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: AMDPR08MB11305 Thank you for your contribution! Sashiko AI review found 2 potential issue(= s) to consider: - [Medium] q35: mch_update_smbase_smram() skips region resync when SMBASE r= eg is 0x01 - [Low] q35: SMBASE register accepts junk, direct 0x01 and lock writes with= out 0xff negotiation -- commit 1956c6383a778aa029b7ffec3205e273dc1764cf Author: Igor Mammedov q35: Fix migration of SMRAM state This commit stops mch_update_smbase_smram() from clearing the migrated SMBASE register value. wmask is now derived from the register value, so a locked state survives migration. The test hunk that checked junk writes before negotiation is removed. Link: https://patchew.org/QEMU/20251203180851.6390-1-arbn@yandex-team.com/ > diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c > --- a/hw/pci-host/q35.c > +++ b/hw/pci-host/q35.c [ ... ] > @@ -432,30 +432,27 @@ static void mch_update_smbase_smram(MCHPCIState *mc= h) > } > =20 > if (*reg =3D=3D MCH_HOST_BRIDGE_F_SMBASE_QUERY) { > - pd->wmask[MCH_HOST_BRIDGE_F_SMBASE] =3D > - MCH_HOST_BRIDGE_F_SMBASE_LCK; > + pd->wmask[MCH_HOST_BRIDGE_F_SMBASE] =3D MCH_HOST_BRIDGE_F_SMBASE= _LCK; > *reg =3D MCH_HOST_BRIDGE_F_SMBASE_IN_RAM; > return; > } > =20 > - /* > - * default/reset state, discard written value > - * which will disable SMRAM balackhole at SMBASE > - */ > - if (pd->wmask[MCH_HOST_BRIDGE_F_SMBASE] =3D=3D 0xff) { > - *reg =3D 0x00; > + /* > + * reg value can come from register write/reset/migration source, > + * update wmask to be in sync with it regardless of source > + */ > + if (*reg =3D=3D MCH_HOST_BRIDGE_F_SMBASE_IN_RAM) { > + pd->wmask[MCH_HOST_BRIDGE_F_SMBASE] =3D MCH_HOST_BRIDGE_F_SMBASE= _LCK; > + return; > } [Severity: Medium] Can this early return leave the SMBASE regions enabled when the register becomes 0x01? The return skips the memory_region_set_enabled() calls for smbase_blackhole and smbase_window. Before the patch, a value of 0x01 fell through and disabled both regions. The path is mch_post_load()->mch_update()->mch_update_smbase_smram(). On a live COLO secondary, no reset precedes it: migration/colo.c:colo_incoming_thread() ret =3D qemu_load_device_state(fb); Consider this sequence: - The secondary holds reg=3D0x02 with both regions enabled. - The primary reboots, and the guest renegotiates to 0x01 within one checkpoint interval. - The next checkpoint loads 0x01. post_load then sets wmask and returns, so the regions stay enabled while the register reads 0x01 (negotiated, not locked). Guest-visible SMRAM at SMBASE then disagrees with the register. Should the IN_RAM branch also disable the two regions before returning? The snapshot-load path is not affected, because load_snapshot() calls qemu_system_reset() before qemu_loadvm_state(). A fresh incoming migration is also not affected, because the regions start disabled. > - > - memory_region_transaction_begin(); > if (*reg & MCH_HOST_BRIDGE_F_SMBASE_LCK) { > - /* disable all writes */ > - pd->wmask[MCH_HOST_BRIDGE_F_SMBASE] &=3D > - ~MCH_HOST_BRIDGE_F_SMBASE_LCK; > + /* lock register at 0x2 and disable all writes */ > + pd->wmask[MCH_HOST_BRIDGE_F_SMBASE] =3D 0; > *reg =3D MCH_HOST_BRIDGE_F_SMBASE_LCK; > - lck =3D true; > - } else { > - lck =3D false; > } [Severity: Low] Is it intended that mch_update_smbase_smram() no longer has a "not yet negotiated" state? In the reset state (reg=3D0, wmask=3D0xff), a guest config write to the SMB= ASE register now behaves differently, via mch_write_config()->mch_update(): - A value with bit 0x2 set, such as 0x03 or 0x06, takes the "*reg & MCH_HOST_BRIDGE_F_SMBASE_LCK" branch. It sets wmask to 0, stores 0x02, and enables smbase_blackhole and smbase_window. The guest never saw the 0x01 reply. - A write of exactly 0x01 takes the IN_RAM branch and sets wmask to MCH_HOST_BRIDGE_F_SMBASE_LCK without a prior 0xff query. - Other values, such as 0x04, are stored and read back instead of reading 0. The commit message mentions the last case ("let guest write junk values"). It does not mention the first two. Could the commit message describe the lock-without-negotiation and direct 0x01 cases as well? > diff --git a/tests/qtest/q35-test.c b/tests/qtest/q35-test.c > --- a/tests/qtest/q35-test.c > +++ b/tests/qtest/q35-test.c [ ... ] > @@ -206,12 +206,6 @@ static void test_smram_smbase_lock(void) > qtest_writeb(qts, SMBASE, SMRAM_TEST_PATTERN); > g_assert_cmpint(qtest_readb(qts, SMBASE), =3D=3D, SMRAM_TEST_PATTERN= ); > =20 > - /* check that writing junk to 0x9c before before negotiating is igno= red */ > - for (i =3D 0; i < 0xff; i++) { > - qpci_config_writeb(pcidev, MCH_HOST_BRIDGE_F_SMBASE, i); > - g_assert(qpci_config_readb(pcidev, MCH_HOST_BRIDGE_F_SMBASE) =3D= =3D 0); > - } > - > /* enable SMRAM at SMBASE */ > qpci_config_writeb(pcidev, MCH_HOST_BRIDGE_F_SMBASE, 0xff); > g_assert(qpci_config_readb(pcidev, MCH_HOST_BRIDGE_F_SMBASE) =3D=3D = 0x01); [Severity: Low] This isn't a bug, but the removed junk-write check is not replaced by any test of the new behavior. Would it be worth adding coverage for the new pre-negotiation write semantics and for the migrated register state (locked and negotiated) in test_smram_smbase_lock()? --=20 Sashiko AI review =C2=B7 https://sashiko.vzint.dev/#/patchset/20261103-vfio= _v1-v7-0-4467fdccbbe6@virtuozzo.com?part=3D15