target/riscv: Add mseccfg to VMStateDescription
Currently, the Machine Security Configuration Register (mseccfg) was missing from the live migration state. This omission causes the register to be reset to zero on the destination host after migration. Fixed by adding vmstate_mseccfg subsection This vulnerability was discovered and reported by SpecHunter, an AI-driven architecture specification analysis tool. Link: https://github.com/yizishun/rv-isa-sec/blob/a22e4459cd026ae970791dfbd9cfe5d110fbd46b/output/riscv-isa-manual/pr-1879/qemu.txt#L121 Signed-off-by: Zishun Yi <vulab@iscas.ac.cn> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20260511124828.3210477-1-vulab@iscas.ac.cn> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Zishun Yi committed
May 11, 2026 at 20:48 UTC
eccb1d6940256668109dc6dc42450ced9f324134
1 file changed
+20
target/riscv/machine.c
+20
@@ -423,6 +423,25 @@ static const VMStateDescription vmstate_sstc = {
423
}
424
};
425
426
+static bool mseccfg_needed(void *opaque)
427
+{
428
+ RISCVCPU *cpu = opaque;
429
+
430
+ return cpu->cfg.ext_smepmp || cpu->cfg.ext_zkr
431
+ || cpu->cfg.ext_smmpm || cpu->cfg.ext_zicfilp;
432
+}
433
+
434
+static const VMStateDescription vmstate_mseccfg = {
435
+ .name = "cpu/mseccfg",
436
+ .version_id = 1,
437
+ .minimum_version_id = 1,
438
+ .needed = mseccfg_needed,
439
+ .fields = (const VMStateField[]) {
440
+ VMSTATE_UINTTL(env.mseccfg, RISCVCPU),
441
+ VMSTATE_END_OF_LIST()
442
+ }
443
+};
444
+
445
const VMStateDescription vmstate_riscv_cpu = {
446
.name = "cpu",
447
.version_id = 11,
@@ -499,6 +518,7 @@ const VMStateDescription vmstate_riscv_cpu = {
518
&vmstate_ssp,
519
&vmstate_ctr,
520
&vmstate_sstc,
521
+ &vmstate_mseccfg,
522
NULL
523
}
524
};