[Qemu-devel] [PULL 0/2] x86 fixes for -rc3

[Qemu-devel] [PULL 0/2] x86 fixes for -rc3

[Eduardo Habkost]

The following changes since commit d522fba24478474911b0e6e488b6d1dcf1af54f8:

  Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20181126' into staging (2018-11-26 13:58:46 +0000)

are available in the Git repository at:

  git://github.com/ehabkost/qemu.git tags/x86-for-3.1-pull-request

for you to fetch changes up to 30a759b61a9247378a9cb84fbe4e437ae66e0461:

  hw/hyperv: fix NULL dereference with pure-kvm SynIC (2018-11-26 14:14:38 -0200)

----------------------------------------------------------------
x86 fixes for -rc3

* Fix SynIC crash
* Fix x86 crash on MSR code on AMD hosts

----------------------------------------------------------------

Bandan Das (1):
  kvm: Use KVM_GET_MSR_INDEX_LIST for MSR_IA32_ARCH_CAPABILITIES support

Roman Kagan (1):
  hw/hyperv: fix NULL dereference with pure-kvm SynIC

 hw/hyperv/hyperv.c |  6 +++++-
 target/i386/kvm.c  | 15 +++++++--------
 2 files changed, 12 insertions(+), 9 deletions(-)

-- 
2.18.0.rc1.1.g3f1ff2140

[Qemu-devel] [PULL 1/2] kvm: Use KVM_GET_MSR_INDEX_LIST for MSR_IA32_ARCH_CAPABILITIES support

[Eduardo Habkost]

From: Bandan Das <bsd@redhat.com>

When writing to guest's MSR_IA32_ARCH_CAPABILITIES, check whether it's
supported in the guest using the KVM_GET_MSR_INDEX_LIST ioctl.

Fixes: d86f963694df27f11b3681ffd225c9362de1b634
Suggested-by: Eduardo Habkost <ehabkost@redhat.com>
Tested-by: balducci@units.it
Signed-off-by: Bandan Das <bsd@redhat.com>
Message-Id: <jpg4lc4iiav.fsf_-_@linux.bootlegged.copy>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
---
 target/i386/kvm.c | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/target/i386/kvm.c b/target/i386/kvm.c
index f524e7d929..3d6739a2b2 100644
--- a/target/i386/kvm.c
+++ b/target/i386/kvm.c
@@ -95,6 +95,7 @@ static bool has_msr_xss;
 static bool has_msr_spec_ctrl;
 static bool has_msr_virt_ssbd;
 static bool has_msr_smi_count;
+static bool has_msr_arch_capabs;
 
 static uint32_t has_architectural_pmu_version;
 static uint32_t num_architectural_pmu_gp_counters;
@@ -1481,6 +1482,9 @@ static int kvm_get_supported_msrs(KVMState *s)
                 case MSR_VIRT_SSBD:
                     has_msr_virt_ssbd = true;
                     break;
+                case MSR_IA32_ARCH_CAPABILITIES:
+                    has_msr_arch_capabs = true;
+                    break;
                 }
             }
         }
@@ -2002,14 +2006,9 @@ static int kvm_put_msrs(X86CPU *cpu, int level)
 #endif
 
     /* If host supports feature MSR, write down. */
-    if (kvm_feature_msrs) {
-        int i;
-        for (i = 0; i < kvm_feature_msrs->nmsrs; i++)
-            if (kvm_feature_msrs->indices[i] == MSR_IA32_ARCH_CAPABILITIES) {
-                kvm_msr_entry_add(cpu, MSR_IA32_ARCH_CAPABILITIES,
-                              env->features[FEAT_ARCH_CAPABILITIES]);
-                break;
-            }
+    if (has_msr_arch_capabs) {
+        kvm_msr_entry_add(cpu, MSR_IA32_ARCH_CAPABILITIES,
+                          env->features[FEAT_ARCH_CAPABILITIES]);
     }
 
     /*
-- 
2.18.0.rc1.1.g3f1ff2140

[Qemu-devel] [PULL 2/2] hw/hyperv: fix NULL dereference with pure-kvm SynIC

[Eduardo Habkost]

From: Roman Kagan <rkagan@virtuozzo.com>

When started in compat configuration of SynIC, e.g.

qemu-system-x86_64 -machine pc-i440fx-2.10,accel=kvm \
 -cpu host,-vmx,hv-relaxed,hv_spinlocks=0x1fff,hv-vpindex,hv-synic

or explicitly

qemu-system-x86_64 -enable-kvm -cpu host,hv-synic,x-hv-synic-kvm-only=on

QEMU crashes in hyperv_synic_reset() trying to access the non-present
qobject for SynIC.

Add the missing check for NULL.

Reported-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Reported-by: Igor Mammedov <imammedo@redhat.com>
Fixes: 9b4cf107b09d18ac30f46fd1c4de8585ccba030c
Fixes: 4a93722f9c279184e95b1e1ad775c01deec05065
Signed-off-by: Roman Kagan <rkagan@virtuozzo.com>
Message-Id: <20181126152836.25379-1-rkagan@virtuozzo.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
---
 hw/hyperv/hyperv.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/hw/hyperv/hyperv.c b/hw/hyperv/hyperv.c
index a28e7249d8..8758635227 100644
--- a/hw/hyperv/hyperv.c
+++ b/hw/hyperv/hyperv.c
@@ -136,7 +136,11 @@ void hyperv_synic_add(CPUState *cs)
 
 void hyperv_synic_reset(CPUState *cs)
 {
-    device_reset(DEVICE(get_synic(cs)));
+    SynICState *synic = get_synic(cs);
+
+    if (synic) {
+        device_reset(DEVICE(synic));
+    }
 }
 
 static const TypeInfo synic_type_info = {
-- 
2.18.0.rc1.1.g3f1ff2140

Re: [Qemu-devel] [PULL 0/2] x86 fixes for -rc3

[Peter Maydell]

On Mon, 26 Nov 2018 at 20:59, Eduardo Habkost <ehabkost@redhat.com> wrote:
>
> The following changes since commit d522fba24478474911b0e6e488b6d1dcf1af54f8:
>
>   Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20181126' into staging (2018-11-26 13:58:46 +0000)
>
> are available in the Git repository at:
>
>   git://github.com/ehabkost/qemu.git tags/x86-for-3.1-pull-request
>
> for you to fetch changes up to 30a759b61a9247378a9cb84fbe4e437ae66e0461:
>
>   hw/hyperv: fix NULL dereference with pure-kvm SynIC (2018-11-26 14:14:38 -0200)
>
> ----------------------------------------------------------------
> x86 fixes for -rc3
>
> * Fix SynIC crash
> * Fix x86 crash on MSR code on AMD hosts
>
> ----------------------------------------------------------------


Applied, thanks.

-- PMM