s390x/cpumodel: fix segmentation fault when baselining models

Usually, when baselining two CPU models, whereby one of them has base CPU features disabled (e.g. z14-base,msa=off), we fallback to an older model that did not have these features in the base model. We always try to create a "sane" CPU model (as far as possible), and one part of it is that removing base features is no good and to be avoided.

Now, if we disable base features that were part of a z900, we're out of luck. We won't find a CPU model and QEMU will segfault. This is a scenario that should never happen in real life, but it can be used to crash QEMU.

So let's make something like this:

{ "execute": "query-cpu-model-baseline",
"arguments" : { "modela": { "name": "z14-base", "props": {"esan3" : false}},

                  "modelb": { "name": "z14"}} }

Produce:

{"return": {"model": {"name": "z900-base", "props": {"esan3": false}}}}

Instead of segfaulting.

This could of course be improved (e.g. to z14-base,esan3=false), however as this ususally won't happen, let's just avoid crashes.

Signed-off-by David Hildenbrand <[email protected]>

---
 target/s390x/cpu_models.c | 6 ++++++
 1 file changed, 6 insertions(+)

target/s390x/cpu_models.c +0 -0

index cfdbccf46d..13a5d4f095 100644

target/s390x/cpu_models.c +0 -0

     /* strip off features not part of the max model */
     bitmap_and(model.features, model.features, model.def->full_feat,
                S390_FEAT_MAX);

Quoted 37 lines · David Hildenbrand

Usually, when baselining two CPU models, whereby one of them has base CPU features disabled (e.g. z14-base,msa=off), we fallback to an older model that did not have these features in the base model. We always try to create a "sane" CPU model (as far as possible), and one part of it is that removing base features is no good and to be avoided.

Now, if we disable base features that were part of a z900, we're out of luck. We won't find a CPU model and QEMU will segfault. This is a scenario that should never happen in real life, but it can be used to crash QEMU.

So let's make something like this:

{ "execute": "query-cpu-model-baseline",
"arguments" : { "modela": { "name": "z14-base", "props": {"esan3" : false}},

                  "modelb": { "name": "z14"}} }

Produce:

{"return": {"model": {"name": "z900-base", "props": {"esan3": false}}}}

Instead of segfaulting.

This could of course be improved (e.g. to z14-base,esan3=false), however as this ususally won't happen, let's just avoid crashes.

Signed-off-by David Hildenbrand <[email protected]>

---
 target/s390x/cpu_models.c | 6 ++++++
 1 file changed, 6 insertions(+)

target/s390x/cpu_models.c +0 -0

index cfdbccf46d..13a5d4f095 100644
@@ -716,6 +716,12 @@ CpuModelBaselineInfo *arch_query_cpu_model_baseline(CpuModelInfo *infoa,
 

target/s390x/cpu_models.c CpuModelBaselineInfo *arch_query_cpu_model_baseline(CpuModelInfo *infoa, · line 724

Quoted 8 lines

target/s390x/cpu_models.c +6 -0

     model.def = s390_find_cpu_def(cpu_type, max_gen, max_gen_ga,
                                   model.features);
+
+    /* models without early base features (esan3) are bad - fallback to z900 */
+    if (!model.def) {
+        model.def = s390_find_cpu_def(0x2064, 7, 1, NULL);
+    }
+

Is there a way to not even return z900 but retuning an empty model (e.g. no model that matches) ?

Quoted 40 lines · Christian Borntraeger

Quoted 37 lines · David Hildenbrand

Usually, when baselining two CPU models, whereby one of them has base CPU features disabled (e.g. z14-base,msa=off), we fallback to an older model that did not have these features in the base model. We always try to create a "sane" CPU model (as far as possible), and one part of it is that removing base features is no good and to be avoided.

Now, if we disable base features that were part of a z900, we're out of luck. We won't find a CPU model and QEMU will segfault. This is a scenario that should never happen in real life, but it can be used to crash QEMU.

So let's make something like this:

{ "execute": "query-cpu-model-baseline",
"arguments" : { "modela": { "name": "z14-base", "props": {"esan3" : false}},

                  "modelb": { "name": "z14"}} }

Produce:

{"return": {"model": {"name": "z900-base", "props": {"esan3": false}}}}

Instead of segfaulting.

This could of course be improved (e.g. to z14-base,esan3=false), however as this ususally won't happen, let's just avoid crashes.

Signed-off-by David Hildenbrand <[email protected]>

---
 target/s390x/cpu_models.c | 6 ++++++
 1 file changed, 6 insertions(+)

target/s390x/cpu_models.c +0 -0

index cfdbccf46d..13a5d4f095 100644
@@ -716,6 +716,12 @@ CpuModelBaselineInfo *arch_query_cpu_model_baseline(CpuModelInfo *infoa,
 

Quoted 11 lines

target/s390x/cpu_models.c CpuModelBaselineInfo *arch_query_cpu_model_baseline(CpuModelInfo *infoa, · line 724

Quoted 8 lines

target/s390x/cpu_models.c +6 -0

     model.def = s390_find_cpu_def(cpu_type, max_gen, max_gen_ga,
                                   model.features);
+
+    /* models without early base features (esan3) are bad - fallback to z900 */
+    if (!model.def) {
+        model.def = s390_find_cpu_def(0x2064, 7, 1, NULL);
+    }
+

Is there a way to not even return z900 but retuning an empty model (e.g. no model that matches) ?

An error would be an alternative.

Quoted 53 lines · David Hildenbrand

Quoted 51 lines · Christian Borntraeger

Quoted 36 lines · David Hildenbrand

Usually, when baselining two CPU models, whereby one of them has base CPU features disabled (e.g. z14-base,msa=off), we fallback to an older model that did not have these features in the base model. We always try to create a "sane" CPU model (as far as possible), and one part of it is that removing base features is no good and to be avoided.

Now, if we disable base features that were part of a z900, we're out of luck. We won't find a CPU model and QEMU will segfault. This is a scenario that should never happen in real life, but it can be used to crash QEMU.

So let's make something like this:

{ "execute": "query-cpu-model-baseline",
"arguments" : { "modela": { "name": "z14-base", "props": {"esan3" : false}},

                  "modelb": { "name": "z14"}} }

Produce:

{"return": {"model": {"name": "z900-base", "props": {"esan3": false}}}}

Instead of segfaulting.

This could of course be improved (e.g. to z14-base,esan3=false), however as this ususally won't happen, let's just avoid crashes.

Signed-off-by David Hildenbrand <[email protected]>

---
 target/s390x/cpu_models.c | 6 ++++++
 1 file changed, 6 insertions(+)

target/s390x/cpu_models.c +0 -0

index cfdbccf46d..13a5d4f095 100644

target/s390x/cpu_models.c CpuModelBaselineInfo *arch_query_cpu_model_baseline(CpuModelInfo *infoa, · line 724

Quoted 9 lines

target/s390x/cpu_models.c +6 -0

@@ -716,6 +716,12 @@ CpuModelBaselineInfo *arch_query_cpu_model_baseline(CpuModelInfo *infoa,
 
     model.def = s390_find_cpu_def(cpu_type, max_gen, max_gen_ga,
                                   model.features);
+
+    /* models without early base features (esan3) are bad - fallback to z900 */
+    if (!model.def) {
+        model.def = s390_find_cpu_def(0x2064, 7, 1, NULL);
+    }
+

Is there a way to not even return z900 but retuning an empty model (e.g. no model that matches) ?

Quoted 1 line

An error would be an alternative.

As N3 means new in zarch (and backported to ESA390 mode), there is no machine without N3. So I would prefer an error.

target/s390x/cpu_models.c +8 -0

index cfdbccf46d..604898a882 100644
@@ -716,6 +716,14 @@ CpuModelBaselineInfo
 *arch_query_cpu_model_baseline(CpuModelInfo *infoa,
 
     model.def = s390_find_cpu_def(cpu_type, max_gen, max_gen_ga,
                                   model.features);
+
+    /* models without early base features (esan3) are bad */
+    if (!model.def) {
+        error_setg(errp, "No compatible CPU model could be created as"
+                   " important base features are disabled");
+        return NULL;
+    }
+
     /* strip off features not part of the max model */
     bitmap_and(model.features, model.features, model.def->full_feat,

                S390_FEAT_MAX);

Quoted 40 lines · Christian Borntraeger

Quoted 37 lines · David Hildenbrand

Usually, when baselining two CPU models, whereby one of them has base CPU features disabled (e.g. z14-base,msa=off), we fallback to an older model that did not have these features in the base model. We always try to create a "sane" CPU model (as far as possible), and one part of it is that removing base features is no good and to be avoided.

Now, if we disable base features that were part of a z900, we're out of luck. We won't find a CPU model and QEMU will segfault. This is a scenario that should never happen in real life, but it can be used to crash QEMU.

So let's make something like this:

{ "execute": "query-cpu-model-baseline",
"arguments" : { "modela": { "name": "z14-base", "props": {"esan3" : false}},

                  "modelb": { "name": "z14"}} }

Produce:

{"return": {"model": {"name": "z900-base", "props": {"esan3": false}}}}

Instead of segfaulting.

This could of course be improved (e.g. to z14-base,esan3=false), however as this ususally won't happen, let's just avoid crashes.

Signed-off-by David Hildenbrand <[email protected]>

---
 target/s390x/cpu_models.c | 6 ++++++
 1 file changed, 6 insertions(+)

target/s390x/cpu_models.c +0 -0

index cfdbccf46d..13a5d4f095 100644
@@ -716,6 +716,12 @@ CpuModelBaselineInfo *arch_query_cpu_model_baseline(CpuModelInfo *infoa,
 

Quoted 11 lines

target/s390x/cpu_models.c CpuModelBaselineInfo *arch_query_cpu_model_baseline(CpuModelInfo *infoa, · line 724

Quoted 8 lines

target/s390x/cpu_models.c +6 -0

     model.def = s390_find_cpu_def(cpu_type, max_gen, max_gen_ga,
                                   model.features);
+
+    /* models without early base features (esan3) are bad - fallback to z900 */
+    if (!model.def) {
+        model.def = s390_find_cpu_def(0x2064, 7, 1, NULL);
+    }
+  

Is there a way to not even return z900 but retuning an empty model (e.g. no model that matches) ?

An error would be an alternative.