diff --git a/kvm-arm-fix-oob-access-in-compat-handling.patch b/kvm-arm-fix-oob-access-in-compat-handling.patch new file mode 100644 index 0000000..f27f68b --- /dev/null +++ b/kvm-arm-fix-oob-access-in-compat-handling.patch @@ -0,0 +1,44 @@ +From c2c080f94d9107273650ebdaf50ca78e8cb2f866 Mon Sep 17 00:00:00 2001 +From: Sebastian Ott +Date: Tue, 25 Nov 2025 09:19:30 +0100 +Subject: [PATCH 2/2] arm: fix oob access in compat handling + +RH-Author: Sebastian Ott +RH-MergeRequest: 430: arm: fix oob access in compat handling +RH-Jira: RHEL-130478 +RH-Acked-by: Cornelia Huck +RH-Acked-by: Eric Auger +RH-Acked-by: Gavin Shan +RH-Acked-by: Igor Mammedov +RH-Commit: [1/1] 5d6ab0821b0ffce732862969f275aa50f6917bf1 (seott1/cos-qemu-kvm) + +Upstream: RHEL only +Fixes: 58cba97a "hw/arm/virt: Use ACPI PCI hotplug by default from 10.2 onwards" + +Due to incorrect length information arm_acpi_pci_hp_disabled_compat[] +was accessed out of bounds. This led to the weird side effect that the +1st member of arm_rhel9_compat[] was applied to the virt-rhel10.0 +machine type causing migration failures. Fix the length. + +Signed-off-by: Sebastian Ott +--- + hw/arm/virt.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/hw/arm/virt.c b/hw/arm/virt.c +index e8e64fe7fe..1cfb386f64 100644 +--- a/hw/arm/virt.c ++++ b/hw/arm/virt.c +@@ -102,7 +102,8 @@ static const size_t arm_virt_compat_len = G_N_ELEMENTS(arm_virt_compat); + GlobalProperty arm_acpi_pci_hp_disabled_compat[] = { + { TYPE_ACPI_GED, "acpi-pci-hotplug-with-bridge-support", "off" }, + }; +-static const size_t arm_acpi_pci_hp_disabled_compat_len = G_N_ELEMENTS(arm_virt_compat); ++static const size_t arm_acpi_pci_hp_disabled_compat_len = ++ G_N_ELEMENTS(arm_acpi_pci_hp_disabled_compat); + + /* + * RHEL9 kernels have pauth disabled while RHEL10 has it enabled, +-- +2.47.3 + diff --git a/kvm-pcie_sriov-Fix-broken-MMIO-accesses-from-SR-IOV-VFs.patch b/kvm-pcie_sriov-Fix-broken-MMIO-accesses-from-SR-IOV-VFs.patch new file mode 100644 index 0000000..4e87061 --- /dev/null +++ b/kvm-pcie_sriov-Fix-broken-MMIO-accesses-from-SR-IOV-VFs.patch @@ -0,0 +1,177 @@ +From 36d73722360db85d210bacef0c8386e5af031447 Mon Sep 17 00:00:00 2001 +From: Damien Bergamini +Date: Mon, 1 Sep 2025 15:14:23 +0000 +Subject: [PATCH 1/2] pcie_sriov: Fix broken MMIO accesses from SR-IOV VFs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +RH-Author: Laurent Vivier +RH-MergeRequest: 431: pcie_sriov: Fix broken MMIO accesses from SR-IOV VFs +RH-Jira: RHEL-120115 +RH-Acked-by: Eric Auger +RH-Acked-by: Cédric Le Goater +RH-Commit: [1/1] b6bb40d37376db589852cb07a915d6f0eae29f67 (lvivier/qemu-kvm-centos) + +JIRA: https://issues.redhat.com/browse/RHEL-120115 + +Starting with commit cab1398a60eb, SR-IOV VFs are realized as soon as +pcie_sriov_pf_init() is called. Because pcie_sriov_pf_init() must be +called before pcie_sriov_pf_init_vf_bar(), the VF BARs types won't be +known when the VF realize function calls pcie_sriov_vf_register_bar(). + +This breaks the memory regions of the VFs (for instance with igbvf): + +$ lspci +... + Region 0: Memory at 281a00000 (64-bit, prefetchable) [virtual] [size=16K] + Region 3: Memory at 281a20000 (64-bit, prefetchable) [virtual] [size=16K] + +$ info mtree +... +address-space: pci_bridge_pci_mem + 0000000000000000-ffffffffffffffff (prio 0, i/o): pci_bridge_pci + 0000000081a00000-0000000081a03fff (prio 1, i/o): igbvf-mmio + 0000000081a20000-0000000081a23fff (prio 1, i/o): igbvf-msix + +and causes MMIO accesses to fail: + + Invalid write at addr 0x281A01520, size 4, region '(null)', reason: rejected + Invalid read at addr 0x281A00C40, size 4, region '(null)', reason: rejected + +To fix this, VF BARs are now registered with pci_register_bar() which +has a type parameter and pcie_sriov_vf_register_bar() is removed. + +Fixes: cab1398a60eb ("pcie_sriov: Reuse SR-IOV VF device instances") +Signed-off-by: Damien Bergamini +Signed-off-by: Clement Mathieu--Drif +Reviewed-by: Akihiko Odaki +Reviewed-by: Michael S. Tsirkin +Message-ID: <20250901151314.1038020-1-clement.mathieu--drif@eviden.com> +Signed-off-by: Michael S. Tsirkin +(cherry picked from commit 2e54e5fda779a7ba45578884276dca62462f7a06) +Signed-off-by: Laurent Vivier +--- + docs/pcie_sriov.txt | 5 ++--- + hw/net/igbvf.c | 6 ++++-- + hw/nvme/ctrl.c | 8 ++------ + hw/pci/pci.c | 3 --- + hw/pci/pcie_sriov.c | 11 ----------- + include/hw/pci/pcie_sriov.h | 4 ---- + 6 files changed, 8 insertions(+), 29 deletions(-) + +diff --git a/docs/pcie_sriov.txt b/docs/pcie_sriov.txt +index ab2142807f..00d7bd93fd 100644 +--- a/docs/pcie_sriov.txt ++++ b/docs/pcie_sriov.txt +@@ -72,8 +72,7 @@ setting up a BAR for a VF. + 2) Similarly in the implementation of the virtual function, you need to + make it a PCI Express device and add a similar set of capabilities + except for the SR/IOV capability. Then you need to set up the VF BARs as +- subregions of the PFs SR/IOV VF BARs by calling +- pcie_sriov_vf_register_bar() instead of the normal pci_register_bar() call: ++ subregions of the PFs SR/IOV VF BARs by calling pci_register_bar(): + + pci_your_vf_dev_realize( ... ) + { +@@ -83,7 +82,7 @@ setting up a BAR for a VF. + pcie_ari_init(d, 0x100); + ... + memory_region_init(mr, ... ) +- pcie_sriov_vf_register_bar(d, bar_nr, mr); ++ pci_register_bar(d, bar_nr, bar_type, mr); + ... + } + +diff --git a/hw/net/igbvf.c b/hw/net/igbvf.c +index 31d72c4977..9b0db8f841 100644 +--- a/hw/net/igbvf.c ++++ b/hw/net/igbvf.c +@@ -251,10 +251,12 @@ static void igbvf_pci_realize(PCIDevice *dev, Error **errp) + + memory_region_init_io(&s->mmio, OBJECT(dev), &mmio_ops, s, "igbvf-mmio", + IGBVF_MMIO_SIZE); +- pcie_sriov_vf_register_bar(dev, IGBVF_MMIO_BAR_IDX, &s->mmio); ++ pci_register_bar(dev, IGBVF_MMIO_BAR_IDX, PCI_BASE_ADDRESS_MEM_TYPE_64 | ++ PCI_BASE_ADDRESS_MEM_PREFETCH, &s->mmio); + + memory_region_init(&s->msix, OBJECT(dev), "igbvf-msix", IGBVF_MSIX_SIZE); +- pcie_sriov_vf_register_bar(dev, IGBVF_MSIX_BAR_IDX, &s->msix); ++ pci_register_bar(dev, IGBVF_MSIX_BAR_IDX, PCI_BASE_ADDRESS_MEM_TYPE_64 | ++ PCI_BASE_ADDRESS_MEM_PREFETCH, &s->msix); + + ret = msix_init(dev, IGBVF_MSIX_VEC_NUM, &s->msix, IGBVF_MSIX_BAR_IDX, 0, + &s->msix, IGBVF_MSIX_BAR_IDX, 0x2000, 0x70, errp); +diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c +index f5ee6bf260..cd81f73997 100644 +--- a/hw/nvme/ctrl.c ++++ b/hw/nvme/ctrl.c +@@ -8708,12 +8708,8 @@ static bool nvme_init_pci(NvmeCtrl *n, PCIDevice *pci_dev, Error **errp) + msix_table_offset); + memory_region_add_subregion(&n->bar0, 0, &n->iomem); + +- if (pci_is_vf(pci_dev)) { +- pcie_sriov_vf_register_bar(pci_dev, 0, &n->bar0); +- } else { +- pci_register_bar(pci_dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY | +- PCI_BASE_ADDRESS_MEM_TYPE_64, &n->bar0); +- } ++ pci_register_bar(pci_dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY | ++ PCI_BASE_ADDRESS_MEM_TYPE_64, &n->bar0); + + ret = msix_init(pci_dev, nr_vectors, + &n->bar0, 0, msix_table_offset, +diff --git a/hw/pci/pci.c b/hw/pci/pci.c +index 0012cc12e7..d2ebb066e1 100644 +--- a/hw/pci/pci.c ++++ b/hw/pci/pci.c +@@ -1490,9 +1490,6 @@ void pci_register_bar(PCIDevice *pci_dev, int region_num, + : pci_get_bus(pci_dev)->address_space_mem; + + if (pci_is_vf(pci_dev)) { +- PCIDevice *pf = pci_dev->exp.sriov_vf.pf; +- assert(!pf || type == pf->exp.sriov_pf.vf_bar_type[region_num]); +- + r->addr = pci_bar_address(pci_dev, region_num, r->type, r->size); + if (r->addr != PCI_BAR_UNMAPPED) { + memory_region_add_subregion_overlap(r->address_space, +diff --git a/hw/pci/pcie_sriov.c b/hw/pci/pcie_sriov.c +index cf1b5b5c05..c4f88f0975 100644 +--- a/hw/pci/pcie_sriov.c ++++ b/hw/pci/pcie_sriov.c +@@ -246,17 +246,6 @@ void pcie_sriov_pf_init_vf_bar(PCIDevice *dev, int region_num, + dev->exp.sriov_pf.vf_bar_type[region_num] = type; + } + +-void pcie_sriov_vf_register_bar(PCIDevice *dev, int region_num, +- MemoryRegion *memory) +-{ +- uint8_t type; +- +- assert(dev->exp.sriov_vf.pf); +- type = dev->exp.sriov_vf.pf->exp.sriov_pf.vf_bar_type[region_num]; +- +- return pci_register_bar(dev, region_num, type, memory); +-} +- + static gint compare_vf_devfns(gconstpointer a, gconstpointer b) + { + return (*(PCIDevice **)a)->devfn - (*(PCIDevice **)b)->devfn; +diff --git a/include/hw/pci/pcie_sriov.h b/include/hw/pci/pcie_sriov.h +index aeaa38cf34..b0ea6a62c7 100644 +--- a/include/hw/pci/pcie_sriov.h ++++ b/include/hw/pci/pcie_sriov.h +@@ -37,10 +37,6 @@ void pcie_sriov_pf_exit(PCIDevice *dev); + void pcie_sriov_pf_init_vf_bar(PCIDevice *dev, int region_num, + uint8_t type, dma_addr_t size); + +-/* Instantiate a bar for a VF */ +-void pcie_sriov_vf_register_bar(PCIDevice *dev, int region_num, +- MemoryRegion *memory); +- + /** + * pcie_sriov_pf_init_from_user_created_vfs() - Initialize PF with user-created + * VFs, adding ARI to PF +-- +2.47.3 + diff --git a/qemu-kvm.spec b/qemu-kvm.spec index 508e984..cc00775 100644 --- a/qemu-kvm.spec +++ b/qemu-kvm.spec @@ -143,7 +143,7 @@ Obsoletes: %{name}-block-ssh <= %{epoch}:%{version} \ Summary: QEMU is a machine emulator and virtualizer Name: qemu-kvm Version: 10.1.0 -Release: 6%{?rcrel}%{?dist}%{?cc_suffix} +Release: 7%{?rcrel}%{?dist}%{?cc_suffix} # Epoch because we pushed a qemu-1.0 package. AIUI this can't ever be dropped # Epoch 15 used for RHEL 8 # Epoch 17 used for RHEL 9 (due to release versioning offset in RHEL 8.5) @@ -265,6 +265,10 @@ Patch54: kvm-ram-block-attributes-Unify-the-retrieval-of-the-bloc.patch Patch55: kvm-hw-s390x-Fix-a-possible-crash-with-passed-through-vi.patch # For RHEL-130704 - [rhel10] Fix the typo under vfio-pci device's enable-migration option Patch56: kvm-Fix-the-typo-of-vfio-pci-device-s-enable-migration-o.patch +# For RHEL-120115 - The vf nic created using the IGB emulated nic can not obtain ip address +Patch57: kvm-pcie_sriov-Fix-broken-MMIO-accesses-from-SR-IOV-VFs.patch +# For RHEL-130478 - Migration from RHEL 10.2 to RHEL 10.1 with virt-rhel10.0.0 machine type fails on Grace +Patch58: kvm-arm-fix-oob-access-in-compat-handling.patch %if %{have_clang} BuildRequires: clang @@ -1344,6 +1348,14 @@ useradd -r -u 107 -g qemu -G kvm -d / -s /sbin/nologin \ %endif %changelog +* Mon Dec 01 2025 Miroslav Rezanina - 10.1.0-7 +- kvm-pcie_sriov-Fix-broken-MMIO-accesses-from-SR-IOV-VFs.patch [RHEL-120115] +- kvm-arm-fix-oob-access-in-compat-handling.patch [RHEL-130478] +- Resolves: RHEL-120115 + (The vf nic created using the IGB emulated nic can not obtain ip address ) +- Resolves: RHEL-130478 + (Migration from RHEL 10.2 to RHEL 10.1 with virt-rhel10.0.0 machine type fails on Grace) + * Tue Nov 25 2025 Miroslav Rezanina - 10.1.0-6 - kvm-ram-block-attributes-fix-interaction-with-hugetlb-me.patch [RHEL-126708] - kvm-ram-block-attributes-Unify-the-retrieval-of-the-bloc.patch [RHEL-126708]