[Qemu-devel] [PULL for-3.0 0/1] s390x bugfix for rc2

[Qemu-devel] [PULL for-3.0 0/1] s390x bugfix for rc2

[Cornelia Huck]

The following changes since commit ea6abffa8a08d832feb759d359d5b935e3087cf7:

  Update version for v3.0.0-rc1 release (2018-07-17 18:15:19 +0100)

are available in the Git repository at:

  git://github.com/cohuck/qemu tags/s390x-20180719

for you to fetch changes up to 677ff32db12bcd1bca3a3df733d2478896d6df96:

  s390x/cpumodel: fix segmentation fault when baselining models (2018-07-18 14:20:02 +0200)

----------------------------------------------------------------
don't segfault when trying to baseline an odd cpu model

----------------------------------------------------------------

David Hildenbrand (1):
  s390x/cpumodel: fix segmentation fault when baselining models

 target/s390x/cpu_models.c | 8 ++++++++
 1 file changed, 8 insertions(+)

-- 
2.14.4

[Qemu-devel] [PULL for-3.0 1/1] s390x/cpumodel: fix segmentation fault when baselining models

[Cornelia Huck]

From: David Hildenbrand <david@redhat.com>

Usually, when baselining two CPU models, whereby one of them has base
CPU features disabled (e.g. z14-base,msa=off), we fallback to an older
model that did not have these features in the base model. We always try to
create a "sane" CPU model (as far as possible), and one part of it is that
removing base features is no good and to be avoided.

Now, if we disable base features that were part of a z900, we're out of
luck. We won't find a CPU model and QEMU will segfault. This is a
scenario that should never happen in real life, but it can be used to
crash QEMU.

So let's properly report an error if we baseline e.g.:

{ "execute": "query-cpu-model-baseline",
  "arguments" : { "modela": { "name": "z14-base", "props": {"esan3" : false}},
                  "modelb": { "name": "z14"}} }

Instead of segfaulting.

Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <20180718092330.19465-1-david@redhat.com>
Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
---
 target/s390x/cpu_models.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c
index cfdbccf46d..604898a882 100644
--- a/target/s390x/cpu_models.c
+++ b/target/s390x/cpu_models.c
@@ -716,6 +716,14 @@ CpuModelBaselineInfo *arch_query_cpu_model_baseline(CpuModelInfo *infoa,
 
     model.def = s390_find_cpu_def(cpu_type, max_gen, max_gen_ga,
                                   model.features);
+
+    /* models without early base features (esan3) are bad */
+    if (!model.def) {
+        error_setg(errp, "No compatible CPU model could be created as"
+                   " important base features are disabled");
+        return NULL;
+    }
+
     /* strip off features not part of the max model */
     bitmap_and(model.features, model.features, model.def->full_feat,
                S390_FEAT_MAX);
-- 
2.14.4

Re: [Qemu-devel] [PULL for-3.0 0/1] s390x bugfix for rc2

[Peter Maydell]

On 19 July 2018 at 12:42, Cornelia Huck <cohuck@redhat.com> wrote:
> The following changes since commit ea6abffa8a08d832feb759d359d5b935e3087cf7:
>
>   Update version for v3.0.0-rc1 release (2018-07-17 18:15:19 +0100)
>
> are available in the Git repository at:
>
>   git://github.com/cohuck/qemu tags/s390x-20180719
>
> for you to fetch changes up to 677ff32db12bcd1bca3a3df733d2478896d6df96:
>
>   s390x/cpumodel: fix segmentation fault when baselining models (2018-07-18 14:20:02 +0200)
>
> ----------------------------------------------------------------
> don't segfault when trying to baseline an odd cpu model
>
> ----------------------------------------------------------------
>
> David Hildenbrand (1):
>   s390x/cpumodel: fix segmentation fault when baselining models
>
>  target/s390x/cpu_models.c | 8 ++++++++
>  1 file changed, 8 insertions(+)

Applied, thanks.

-- PMM