* Mon Dec 01 2025 Miroslav Rezanina <mrezanin@redhat.com> - 10.1.0-7

- kvm-pcie_sriov-Fix-broken-MMIO-accesses-from-SR-IOV-VFs.patch [RHEL-120115] - kvm-arm-fix-oob-access-in-compat-handling.patch [RHEL-130478] - Resolves: RHEL-120115 (The vf nic created using the IGB emulated nic can not obtain ip address ) - Resolves: RHEL-130478 (Migration from RHEL 10.2 to RHEL 10.1 with virt-rhel10.0.0 machine type fails on Grace)
2025-12-01 10:05:09 +01:00 · 2025-12-01 10:05:09 +01:00 · d306af9bc9
commit d306af9bc9
parent a73106dfcc
3 changed files with 234 additions and 1 deletions
--- a/kvm-arm-fix-oob-access-in-compat-handling.patch
+++ b/kvm-arm-fix-oob-access-in-compat-handling.patch
@ -0,0 +1,44 @@
+From c2c080f94d9107273650ebdaf50ca78e8cb2f866 Mon Sep 17 00:00:00 2001
+From: Sebastian Ott <sebott@redhat.com>
+Date: Tue, 25 Nov 2025 09:19:30 +0100
+Subject: [PATCH 2/2] arm: fix oob access in compat handling
+
+RH-Author: Sebastian Ott <sebott@redhat.com>
+RH-MergeRequest: 430: arm: fix oob access in compat handling
+RH-Jira: RHEL-130478
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Eric Auger <eric.auger@redhat.com>
+RH-Acked-by: Gavin Shan <gshan@redhat.com>
+RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
+RH-Commit: [1/1] 5d6ab0821b0ffce732862969f275aa50f6917bf1 (seott1/cos-qemu-kvm)
+
+Upstream: RHEL only
+Fixes: 58cba97a "hw/arm/virt: Use ACPI PCI hotplug by default from 10.2 onwards"
+
+Due to incorrect length information arm_acpi_pci_hp_disabled_compat[]
+was accessed out of bounds. This led to the weird side effect that the
+1st member of arm_rhel9_compat[] was applied to the virt-rhel10.0
+machine type causing migration failures. Fix the length.
+
+Signed-off-by: Sebastian Ott <sebott@redhat.com>
+---
+ hw/arm/virt.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/hw/arm/virt.c b/hw/arm/virt.c
+index e8e64fe7fe..1cfb386f64 100644
+--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
+@@ -102,7 +102,8 @@ static const size_t arm_virt_compat_len = G_N_ELEMENTS(arm_virt_compat);
+ GlobalProperty arm_acpi_pci_hp_disabled_compat[] = {
+     { TYPE_ACPI_GED, "acpi-pci-hotplug-with-bridge-support", "off" },
+ };
+-static const size_t arm_acpi_pci_hp_disabled_compat_len = G_N_ELEMENTS(arm_virt_compat);
+static const size_t arm_acpi_pci_hp_disabled_compat_len =
+    G_N_ELEMENTS(arm_acpi_pci_hp_disabled_compat);
+ 
+ /*
+  * RHEL9 kernels have pauth disabled while RHEL10 has it enabled,
+-- 
+2.47.3
+
--- a/kvm-pcie_sriov-Fix-broken-MMIO-accesses-from-SR-IOV-VFs.patch
+++ b/kvm-pcie_sriov-Fix-broken-MMIO-accesses-from-SR-IOV-VFs.patch
@ -0,0 +1,177 @@
+From 36d73722360db85d210bacef0c8386e5af031447 Mon Sep 17 00:00:00 2001
+From: Damien Bergamini <damien.bergamini@eviden.com>
+Date: Mon, 1 Sep 2025 15:14:23 +0000
+Subject: [PATCH 1/2] pcie_sriov: Fix broken MMIO accesses from SR-IOV VFs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Laurent Vivier <lvivier@redhat.com>
+RH-MergeRequest: 431: pcie_sriov: Fix broken MMIO accesses from SR-IOV VFs
+RH-Jira: RHEL-120115
+RH-Acked-by: Eric Auger <eric.auger@redhat.com>
+RH-Acked-by: Cédric Le Goater <clg@redhat.com>
+RH-Commit: [1/1] b6bb40d37376db589852cb07a915d6f0eae29f67 (lvivier/qemu-kvm-centos)
+
+JIRA: https://issues.redhat.com/browse/RHEL-120115
+
+Starting with commit cab1398a60eb, SR-IOV VFs are realized as soon as
+pcie_sriov_pf_init() is called.  Because pcie_sriov_pf_init() must be
+called before pcie_sriov_pf_init_vf_bar(), the VF BARs types won't be
+known when the VF realize function calls pcie_sriov_vf_register_bar().
+
+This breaks the memory regions of the VFs (for instance with igbvf):
+
+$ lspci
+...
+    Region 0: Memory at 281a00000 (64-bit, prefetchable) [virtual] [size=16K]
+    Region 3: Memory at 281a20000 (64-bit, prefetchable) [virtual] [size=16K]
+
+$ info mtree
+...
+address-space: pci_bridge_pci_mem
+  0000000000000000-ffffffffffffffff (prio 0, i/o): pci_bridge_pci
+    0000000081a00000-0000000081a03fff (prio 1, i/o): igbvf-mmio
+    0000000081a20000-0000000081a23fff (prio 1, i/o): igbvf-msix
+
+and causes MMIO accesses to fail:
+
+    Invalid write at addr 0x281A01520, size 4, region '(null)', reason: rejected
+    Invalid read at addr 0x281A00C40, size 4, region '(null)', reason: rejected
+
+To fix this, VF BARs are now registered with pci_register_bar() which
+has a type parameter and pcie_sriov_vf_register_bar() is removed.
+
+Fixes: cab1398a60eb ("pcie_sriov: Reuse SR-IOV VF device instances")
+Signed-off-by: Damien Bergamini <damien.bergamini@eviden.com>
+Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com>
+Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Message-ID: <20250901151314.1038020-1-clement.mathieu--drif@eviden.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+(cherry picked from commit 2e54e5fda779a7ba45578884276dca62462f7a06)
+Signed-off-by: Laurent Vivier <lvivier@redhat.com>
+---
+ docs/pcie_sriov.txt         |  5 ++---
+ hw/net/igbvf.c              |  6 ++++--
+ hw/nvme/ctrl.c              |  8 ++------
+ hw/pci/pci.c                |  3 ---
+ hw/pci/pcie_sriov.c         | 11 -----------
+ include/hw/pci/pcie_sriov.h |  4 ----
+ 6 files changed, 8 insertions(+), 29 deletions(-)
+
+diff --git a/docs/pcie_sriov.txt b/docs/pcie_sriov.txt
+index ab2142807f..00d7bd93fd 100644
+--- a/docs/pcie_sriov.txt
+++ b/docs/pcie_sriov.txt
+@@ -72,8 +72,7 @@ setting up a BAR for a VF.
+ 2) Similarly in the implementation of the virtual function, you need to
+    make it a PCI Express device and add a similar set of capabilities
+    except for the SR/IOV capability. Then you need to set up the VF BARs as
+-   subregions of the PFs SR/IOV VF BARs by calling
+-   pcie_sriov_vf_register_bar() instead of the normal pci_register_bar() call:
+   subregions of the PFs SR/IOV VF BARs by calling pci_register_bar():
+ 
+    pci_your_vf_dev_realize( ... )
+    {
+@@ -83,7 +82,7 @@ setting up a BAR for a VF.
+       pcie_ari_init(d, 0x100);
+       ...
+       memory_region_init(mr, ... )
+-      pcie_sriov_vf_register_bar(d, bar_nr, mr);
+      pci_register_bar(d, bar_nr, bar_type, mr);
+       ...
+    }
+ 
+diff --git a/hw/net/igbvf.c b/hw/net/igbvf.c
+index 31d72c4977..9b0db8f841 100644
+--- a/hw/net/igbvf.c
+++ b/hw/net/igbvf.c
+@@ -251,10 +251,12 @@ static void igbvf_pci_realize(PCIDevice *dev, Error **errp)
+ 
+     memory_region_init_io(&s->mmio, OBJECT(dev), &mmio_ops, s, "igbvf-mmio",
+         IGBVF_MMIO_SIZE);
+-    pcie_sriov_vf_register_bar(dev, IGBVF_MMIO_BAR_IDX, &s->mmio);
+    pci_register_bar(dev, IGBVF_MMIO_BAR_IDX, PCI_BASE_ADDRESS_MEM_TYPE_64 |
+                     PCI_BASE_ADDRESS_MEM_PREFETCH, &s->mmio);
+ 
+     memory_region_init(&s->msix, OBJECT(dev), "igbvf-msix", IGBVF_MSIX_SIZE);
+-    pcie_sriov_vf_register_bar(dev, IGBVF_MSIX_BAR_IDX, &s->msix);
+    pci_register_bar(dev, IGBVF_MSIX_BAR_IDX, PCI_BASE_ADDRESS_MEM_TYPE_64 |
+                     PCI_BASE_ADDRESS_MEM_PREFETCH, &s->msix);
+ 
+     ret = msix_init(dev, IGBVF_MSIX_VEC_NUM, &s->msix, IGBVF_MSIX_BAR_IDX, 0,
+         &s->msix, IGBVF_MSIX_BAR_IDX, 0x2000, 0x70, errp);
+diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
+index f5ee6bf260..cd81f73997 100644
+--- a/hw/nvme/ctrl.c
+++ b/hw/nvme/ctrl.c
+@@ -8708,12 +8708,8 @@ static bool nvme_init_pci(NvmeCtrl *n, PCIDevice *pci_dev, Error **errp)
+                               msix_table_offset);
+         memory_region_add_subregion(&n->bar0, 0, &n->iomem);
+ 
+-        if (pci_is_vf(pci_dev)) {
+-            pcie_sriov_vf_register_bar(pci_dev, 0, &n->bar0);
+-        } else {
+-            pci_register_bar(pci_dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY |
+-                             PCI_BASE_ADDRESS_MEM_TYPE_64, &n->bar0);
+-        }
+        pci_register_bar(pci_dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY |
+                         PCI_BASE_ADDRESS_MEM_TYPE_64, &n->bar0);
+ 
+         ret = msix_init(pci_dev, nr_vectors,
+                         &n->bar0, 0, msix_table_offset,
+diff --git a/hw/pci/pci.c b/hw/pci/pci.c
+index 0012cc12e7..d2ebb066e1 100644
+--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
+@@ -1490,9 +1490,6 @@ void pci_register_bar(PCIDevice *pci_dev, int region_num,
+                         : pci_get_bus(pci_dev)->address_space_mem;
+ 
+     if (pci_is_vf(pci_dev)) {
+-        PCIDevice *pf = pci_dev->exp.sriov_vf.pf;
+-        assert(!pf || type == pf->exp.sriov_pf.vf_bar_type[region_num]);
+-
+         r->addr = pci_bar_address(pci_dev, region_num, r->type, r->size);
+         if (r->addr != PCI_BAR_UNMAPPED) {
+             memory_region_add_subregion_overlap(r->address_space,
+diff --git a/hw/pci/pcie_sriov.c b/hw/pci/pcie_sriov.c
+index cf1b5b5c05..c4f88f0975 100644
+--- a/hw/pci/pcie_sriov.c
+++ b/hw/pci/pcie_sriov.c
+@@ -246,17 +246,6 @@ void pcie_sriov_pf_init_vf_bar(PCIDevice *dev, int region_num,
+     dev->exp.sriov_pf.vf_bar_type[region_num] = type;
+ }
+ 
+-void pcie_sriov_vf_register_bar(PCIDevice *dev, int region_num,
+-                                MemoryRegion *memory)
+-{
+-    uint8_t type;
+-
+-    assert(dev->exp.sriov_vf.pf);
+-    type = dev->exp.sriov_vf.pf->exp.sriov_pf.vf_bar_type[region_num];
+-
+-    return pci_register_bar(dev, region_num, type, memory);
+-}
+-
+ static gint compare_vf_devfns(gconstpointer a, gconstpointer b)
+ {
+     return (*(PCIDevice **)a)->devfn - (*(PCIDevice **)b)->devfn;
+diff --git a/include/hw/pci/pcie_sriov.h b/include/hw/pci/pcie_sriov.h
+index aeaa38cf34..b0ea6a62c7 100644
+--- a/include/hw/pci/pcie_sriov.h
+++ b/include/hw/pci/pcie_sriov.h
+@@ -37,10 +37,6 @@ void pcie_sriov_pf_exit(PCIDevice *dev);
+ void pcie_sriov_pf_init_vf_bar(PCIDevice *dev, int region_num,
+                                uint8_t type, dma_addr_t size);
+ 
+-/* Instantiate a bar for a VF */
+-void pcie_sriov_vf_register_bar(PCIDevice *dev, int region_num,
+-                                MemoryRegion *memory);
+-
+ /**
+  * pcie_sriov_pf_init_from_user_created_vfs() - Initialize PF with user-created
+  *                                              VFs, adding ARI to PF
+-- 
+2.47.3
+
--- a/qemu-kvm.spec
+++ b/qemu-kvm.spec
@ -143,7 +143,7 @@ Obsoletes: %{name}-block-ssh <= %{epoch}:%{version}                    \
 Summary: QEMU is a machine emulator and virtualizer
 Name: qemu-kvm
 Version: 10.1.0
-Release: 6%{?rcrel}%{?dist}%{?cc_suffix}
+Release: 7%{?rcrel}%{?dist}%{?cc_suffix}
 # Epoch because we pushed a qemu-1.0 package. AIUI this can't ever be dropped
 # Epoch 15 used for RHEL 8
 # Epoch 17 used for RHEL 9 (due to release versioning offset in RHEL 8.5)
@ -265,6 +265,10 @@ Patch54: kvm-ram-block-attributes-Unify-the-retrieval-of-the-bloc.patch
 Patch55: kvm-hw-s390x-Fix-a-possible-crash-with-passed-through-vi.patch
 # For RHEL-130704 - [rhel10] Fix the typo under vfio-pci device's enable-migration option 
 Patch56: kvm-Fix-the-typo-of-vfio-pci-device-s-enable-migration-o.patch
+# For RHEL-120115 - The vf nic created using the IGB emulated nic can not obtain ip address 
+Patch57: kvm-pcie_sriov-Fix-broken-MMIO-accesses-from-SR-IOV-VFs.patch
+# For RHEL-130478 - Migration from RHEL 10.2 to RHEL 10.1 with virt-rhel10.0.0 machine type fails on Grace
+Patch58: kvm-arm-fix-oob-access-in-compat-handling.patch

 %if %{have_clang}
 BuildRequires: clang
@ -1344,6 +1348,14 @@ useradd -r -u 107 -g qemu -G kvm -d / -s /sbin/nologin \
 %endif

 %changelog
+* Mon Dec 01 2025 Miroslav Rezanina <mrezanin@redhat.com> - 10.1.0-7
+- kvm-pcie_sriov-Fix-broken-MMIO-accesses-from-SR-IOV-VFs.patch [RHEL-120115]
+- kvm-arm-fix-oob-access-in-compat-handling.patch [RHEL-130478]
+- Resolves: RHEL-120115
+  (The vf nic created using the IGB emulated nic can not obtain ip address )
+- Resolves: RHEL-130478
+  (Migration from RHEL 10.2 to RHEL 10.1 with virt-rhel10.0.0 machine type fails on Grace)
+
 * Tue Nov 25 2025 Miroslav Rezanina <mrezanin@redhat.com> - 10.1.0-6
 - kvm-ram-block-attributes-fix-interaction-with-hugetlb-me.patch [RHEL-126708]
 - kvm-ram-block-attributes-Unify-the-retrieval-of-the-bloc.patch [RHEL-126708]