From nobody Sat Oct 24 00:32:24 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1790951217; cv=none; d=zohomail.com; s=zohoarc; b=c8tM8b6hg9ywk6GMnrpWM+9ueZ3LZNcBdEZz1ZtO7nKtPn72K7cFqpqY3/lJWnMYYjmaMNtTqzpHl1LExB7ZWPeqZIswHl0puy3p5XHD2pwUWBIAz9Ny2MjivH7fqQuCSGMJKiTL3btQ5u5QXbyaOBJsIhD38dDtaLYZq7joKiA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790951217; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=REmdsiGC4OC2z6yhQyCLNOFDoN9r5JK/S7S8IO+uUqo=; b=didkVxUMXz02a7+i5GERAHRidk22juoo/IWdvL+IUTj2C3Ou+FP7JlBzjl935EGgO0LBcsmJM+A0w9PqZ4cwgDFolwInVGFpeNo93KppbJWnQLx2QuXheEWxmjRs+EMfbFLIYIM7CPfIbA5Hn39iGE4OBfQiy8z1zxlf1COisGM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790951217096807.0545911163014; Fri, 2 Oct 2026 07:26:57 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xCeCy-0001Li-9G; Fri, 02 Oct 2026 10:25:56 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCeCk-0001DF-W8 for qemu-devel@nongnu.org; Fri, 02 Oct 2026 10:25:45 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCeCg-0001n2-TD for qemu-devel@nongnu.org; Fri, 02 Oct 2026 10:25:41 -0400 Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 692DZoA22997098; Fri, 2 Oct 2026 14:25:28 GMT Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gx5qrspcg-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Fri, 02 Oct 2026 14:25:28 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 692DHl8W1296353; Fri, 2 Oct 2026 14:25:27 GMT Received: from smtprelay01.wdc07v.mail.ibm.com ([172.16.1.68]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4h0q4pmjg0-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 02 Oct 2026 14:25:27 +0000 (GMT) Received: from smtpav03.wdc07v.mail.ibm.com (smtpav03.wdc07v.mail.ibm.com [10.39.53.230]) by smtprelay01.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 692EPQHs1573840 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 2 Oct 2026 14:25:26 GMT Received: from smtpav03.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A4EBC5805F; Fri, 2 Oct 2026 14:25:26 +0000 (GMT) Received: from smtpav03.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 326135806A; Fri, 2 Oct 2026 14:25:26 +0000 (GMT) Received: from sbct-3.pok.ibm.com (unknown [9.47.158.153]) by smtpav03.wdc07v.mail.ibm.com (Postfix) with ESMTP; Fri, 2 Oct 2026 14:25:26 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=REmdsiGC4OC2z6yhQ yCLNOFDoN9r5JK/S7S8IO+uUqo=; b=aldLNRYxHtHPBhmmzqN5bSAgUM7gnUKCG sn24a4VHYEhizEobFM2i4iOtZ+aha+A0fafRrZr6bYqdSfOBqPQIbp3RFbaVg1Ik DFbt5VFU087uXbuoXmUDRFFadgPkgPZ5Rb8a55PdVtf8PeRbuP4Mwz1HmKrBIs0e 7uvR0BIBZucq4UTzm5qLCZASLYvmiIAC5m5ZLEAjIUlZx/Ya8bKERK+RfNGlHaeP 6NwrQ1kykAdiDWO5Et42x6hom4WKjkNO6H5pYFWywtR+XWjG+CCgg+VJKA0SEMdd sYtZflxkvbjdkQcX0cZhRS0XBhSbi5gSCEQVEqnnd2gU303dbtH4A== From: Stefan Berger To: qemu-devel@nongnu.org Cc: armenon@redhat.com, marcandre.lureau@gmail.com, Stefan Berger Subject: [PATCH v3 01/10] tpm_util: Pass TPMVersion to function writing fatal error response Date: Fri, 2 Oct 2026 10:25:07 -0400 Message-ID: <20261002142516.2063735-2-stefanb@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261002142516.2063735-1-stefanb@linux.ibm.com> References: <20261002142516.2063735-1-stefanb@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Reinject: loops=2 maxloops=12 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDAyMDA1NiBTYWx0ZWRfX+/opWFXUFiQZ 1NxbFOGeUF5lSw6fA6nNMhQitHeaoocfetA61S/tqfWr0UTH8+op/QBTLUXlowcdC/vsatVAEAQ xsuFsqySJh6rKnpMf6hERatgHLL7dBVkCYhZI67kOiQQ9kJLtReHGPEgg/erfL4wjUm5ydnad6F pRg+5avGTwHnphgyEQVt7diuEWAlkGsNu+ZXCT2LoNAqbsuhml//q6CjKeLlB4OV7wQf87A5gcV 8L8T0WECkJodgnpnHizEowRhcnbWbDcGaWZ+H3SoR5qZ74BRA48JgMxvA8oTdqTrSGw4xbD7qsM 23D+wj7ypPbeigghkAhf7jQSRDSs1XkNT9VS9rpUkiBqTzoqcvMyC5u4WuNGvxUAxnaoZxJf9h2 OidhCk1tei8Oxsm+BYeMRoQumX05OW0p0bYGuXH0DUXXYFB/KkKYjTHQhsCNJkc5XMijgqgDLSX ARQDtZSaNza3OslPw8Q== X-Authority-Analysis: v=2.4 cv=SPbXx+vH c=1 sm=1 tr=0 ts=6abfbed8 cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=660iZSQnnn4A:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VnNF1IyMAAAA:8 a=ZdjYBk6P2T0J8aFbIr8A:9 X-Proofpoint-ORIG-GUID: e0-3_fsamjgoIHyeA4kHuRsNSikN0tKC X-Proofpoint-Spam-Info: AW1haW4tMjYxMDAyMDA1NiBTYWx0ZWRfXzvBRDB1YMULq G2oRGivw0f85mp0WmsIrWyEZR5p0eyz39eFMfKeToeZoz+Cq9hN4OnQuiNLJ0BQvhxuWxl7235Z lV8eOxbPl8JdhqUGSc1MLtCgVTi4kq4= X-Proofpoint-GUID: FHm8xMbdMO56FzqIJZn6S4QszDPGYF-R X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-02_04,2026-10-01_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 suspectscore=0 clxscore=1015 spamscore=0 lowpriorityscore=0 malwarescore=0 adultscore=0 bulkscore=0 impostorscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2610020056 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=stefanb@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1790951218357158500 Content-Type: text/plain; charset="utf-8" Have tpm_util_write_fatal_error_response write a TPM version specific error response with error code TPM_FAIL for a TPM 1.2 and TPM_RC_FAILURE for a TPM 2. Adjust the callers. Signed-off-by: Stefan Berger Reviewed-by: Arun Menon --- backends/tpm/tpm_emulator.c | 3 ++- backends/tpm/tpm_passthrough.c | 2 +- backends/tpm/tpm_util.c | 17 ++++++++++++++--- include/system/tpm_util.h | 3 ++- 4 files changed, 19 insertions(+), 6 deletions(-) diff --git a/backends/tpm/tpm_emulator.c b/backends/tpm/tpm_emulator.c index 95d2de2f48..16ae44c8d7 100644 --- a/backends/tpm/tpm_emulator.c +++ b/backends/tpm/tpm_emulator.c @@ -270,7 +270,8 @@ static void tpm_emulator_handle_request(TPMBackend *tb,= TPMBackendCmd *cmd, tpm_emulator_unix_tx_bufs(tpm_emu, cmd->in, cmd->in_len, cmd->out, cmd->out_len, &cmd->selftest_done, errp) < 0) { - tpm_util_write_fatal_error_response(cmd->out, cmd->out_len); + tpm_util_write_fatal_error_response(cmd->out, cmd->out_len, + TPM_EMULATOR(tb)->tpm_version); } } =20 diff --git a/backends/tpm/tpm_passthrough.c b/backends/tpm/tpm_passthrough.c index a9f35ab7d6..8a4f8183c7 100644 --- a/backends/tpm/tpm_passthrough.c +++ b/backends/tpm/tpm_passthrough.c @@ -118,7 +118,7 @@ static void tpm_passthrough_unix_tx_bufs(TPMPassthruSta= te *tpm_pt, =20 err_exit: if (ret < 0) { - tpm_util_write_fatal_error_response(out, out_len); + tpm_util_write_fatal_error_response(out, out_len, tpm_pt->tpm_vers= ion); } =20 tpm_pt->tpm_executing =3D false; diff --git a/backends/tpm/tpm_util.c b/backends/tpm/tpm_util.c index 264bff22a9..7019f7fd3e 100644 --- a/backends/tpm/tpm_util.c +++ b/backends/tpm/tpm_util.c @@ -87,12 +87,23 @@ const PropertyInfo qdev_prop_tpm =3D { /* * Write an error message in the given output buffer. */ -void tpm_util_write_fatal_error_response(uint8_t *out, uint32_t out_len) +void tpm_util_write_fatal_error_response(uint8_t *out, uint32_t out_len, + TPMVersion tpm_version) { if (out_len >=3D sizeof(struct tpm_resp_hdr)) { - tpm_cmd_set_tag(out, TPM_TAG_RSP_COMMAND); + switch (tpm_version) { + case TPM_VERSION_1_2: + tpm_cmd_set_tag(out, TPM_TAG_RSP_COMMAND); + tpm_cmd_set_error(out, TPM_FAIL); + break; + case TPM_VERSION_2_0: + tpm_cmd_set_tag(out, TPM2_ST_NO_SESSIONS); + tpm_cmd_set_error(out, TPM_RC_FAILURE); + break; + default: + g_assert_not_reached(); + } tpm_cmd_set_size(out, sizeof(struct tpm_resp_hdr)); - tpm_cmd_set_error(out, TPM_FAIL); } } =20 diff --git a/include/system/tpm_util.h b/include/system/tpm_util.h index 1858693225..3ab2fe693d 100644 --- a/include/system/tpm_util.h +++ b/include/system/tpm_util.h @@ -25,7 +25,8 @@ #include "system/tpm.h" #include "qemu/bswap.h" =20 -void tpm_util_write_fatal_error_response(uint8_t *out, uint32_t out_len); +void tpm_util_write_fatal_error_response(uint8_t *out, uint32_t out_len, + TPMVersion tpm_version); =20 bool tpm_util_is_selftest(const uint8_t *in, uint32_t in_len); =20 --=20 2.55.0 From nobody Sat Oct 24 00:32:24 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1790951200; cv=none; d=zohomail.com; s=zohoarc; b=VzD0unzoyVVg+Wv8CKguDReQhBhH2nGvJ13Q5VVgfjxGPyso8Zmj2F1x4QiAwbpahd4NSZbtx9KlEyQuUzABwGjMVX7/uqrisYoKKr6vvmp7dOHY2FTKtQOz99sOvEX+UAdz8gMfQoA61/YY7Cu10W+lZLgoFLAwI7KuBtjVwSY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790951200; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=IAH3COOHbUwd/msYhDNKJmyyzPJ13MIZ3bHbPT6lAfY=; b=ZwjzxgQoiCtt9Gv5MsAjCYGI6TcJfQLPvfsDHzpA2x5t62foxbQtx/B65dSb3RvKU1D5hZ/Q1rID9+4HTZL3qQZJ31R2ezZkyNml0cICPeVaEjzLHq43Qa2sL7fP+vHlf3ulacJV7Wt++FI4zPriP2L+QRp0NTulIUGGtkcXCVA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 17909512000151010.0592879299116; Fri, 2 Oct 2026 07:26:40 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xCeCt-0001IP-Su; Fri, 02 Oct 2026 10:25:51 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCeCh-0001CT-H7 for qemu-devel@nongnu.org; Fri, 02 Oct 2026 10:25:42 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCeCY-0001mu-IZ for qemu-devel@nongnu.org; Fri, 02 Oct 2026 10:25:32 -0400 Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 692DZVsS633776; Fri, 2 Oct 2026 14:25:28 GMT Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gx5ptr88a-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Fri, 02 Oct 2026 14:25:28 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 692DHWTS2540248; Fri, 2 Oct 2026 14:25:27 GMT Received: from smtprelay02.wdc07v.mail.ibm.com ([172.16.1.69]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4h1y2dk22g-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 02 Oct 2026 14:25:27 +0000 (GMT) Received: from smtpav03.wdc07v.mail.ibm.com (smtpav03.wdc07v.mail.ibm.com [10.39.53.230]) by smtprelay02.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 692EPRRv21103134 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 2 Oct 2026 14:25:27 GMT Received: from smtpav03.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 6032858054; Fri, 2 Oct 2026 14:25:27 +0000 (GMT) Received: from smtpav03.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C81375805A; Fri, 2 Oct 2026 14:25:26 +0000 (GMT) Received: from sbct-3.pok.ibm.com (unknown [9.47.158.153]) by smtpav03.wdc07v.mail.ibm.com (Postfix) with ESMTP; Fri, 2 Oct 2026 14:25:26 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=pp1; bh=IAH3CO OHbUwd/msYhDNKJmyyzPJ13MIZ3bHbPT6lAfY=; b=M+kM8grPB4oZjtdCyONYiw IZE2aMeuOL9pS6Vhq//I4Eh8dYpl3B7DDnrFm+nh233Lid6QBzQnBYQIDEO9seLO cnBgYPDMFL5VyYdRQABySQy8U+SO/cnw5MC7g3FKlStjrQ0L/ZTFhTjKpTlJjfrO jGBvqKqXVAjV9SsfZFFz8FpQXKSzZxdAesxbzgHr/cL5fU1bQHn7nhRINQ97MZt/ aWalnswmwkcYZIFfO5YobfwNW4r1D9BMc1mi1jZ0puLQR05MyDEGIlS7BvmPt2Cy CFPX5IivNVhUkcMAIuWRYAbQZYTE7KRWgCNHP6LUCgPA5uurMRGiseNFhs5PZXIw == From: Stefan Berger To: qemu-devel@nongnu.org Cc: armenon@redhat.com, marcandre.lureau@gmail.com, Stefan Berger , =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= Subject: [PATCH v3 02/10] tpm_emulator: Reject TPM responses whose size is too small Date: Fri, 2 Oct 2026 10:25:08 -0400 Message-ID: <20261002142516.2063735-3-stefanb@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261002142516.2063735-1-stefanb@linux.ibm.com> References: <20261002142516.2063735-1-stefanb@linux.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Reinject: loops=2 maxloops=12 X-Proofpoint-ORIG-GUID: j4L7tDteqKsLjmWeeZqdXE5iqz942pup X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDAyMDA1NiBTYWx0ZWRfX3MV0215qqZMl LRLGWlaSTezq/c5LxRDGoV8uHyRxnUQWex/5iZiLe3ZiDZnN0AgFXpoOQsupXr2dYOlfduCtxTx C6rrgf9PhX4fT2/vWj8gQKR/Jx6Ul9l1sOb5f5Zn1dpjU4npdVnUin6bi6sMRWqeirf0/8zfO2h JX0B6ProlgivaB1QF88VfMCjybg4O5dokC2xYNMamMo5+d1wNHwYKrbQRFPDuSmVcpDj8a3lpy1 EF7hCL9A/4XS5jaKffRpD8ue+bZSyKe6aBgIrMbyU6wN5WJj70seLJvA9eRZW3lZb3XvDIlvO0i HVyPRhkYHzl3h+WrTs5lIcxly3xmxwhco222JSdU6N/q/1hopDmHbKVKyMBTd+m7eddgu32XUoL PHGzDVWoP45aPDkVT25j4Oz/AxzdGSqNPgSqVpZ1Qu1IL9xea1EpqD0KI65PzYjyCWzpQ0Ttojo qFYqGPzKsLtZK+mtOmw== X-Proofpoint-Spam-Info: AW1haW4tMjYxMDAyMDA1NiBTYWx0ZWRfX0Y37e4MDXg2i 9nFciaJBni3qcw7jx388u3Mge/JrNOU251u0Lf4bGNevbwrKa5+atVa0caWe5LHrLrGfDLt1DHs R50j7bCOMfvHtwh2dTbD90P1KZZHPY4= X-Authority-Analysis: v=2.4 cv=EY5d0/mC c=1 sm=1 tr=0 ts=6abfbed8 cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=IkcTkHD0fZMA:10 a=660iZSQnnn4A:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=20KFwNOVAAAA:8 a=VnNF1IyMAAAA:8 a=luQVlvl-W8lCxKXVFxcA:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 X-Proofpoint-GUID: dT8jJM8wrhDZcQbO_40_iEpTJVzkdaMf X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-02_04,2026-10-01_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 priorityscore=1501 suspectscore=0 adultscore=0 clxscore=1015 malwarescore=0 impostorscore=0 spamscore=0 lowpriorityscore=0 bulkscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2610020056 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=stefanb@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1790951202227158500 Reject a response from the TPM emulator whose size field indicates that the response is smaller than the size of the header. Reviewed-by: Marc-Andr=C3=A9 Lureau Signed-off-by: Stefan Berger --- backends/tpm/tpm_emulator.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/backends/tpm/tpm_emulator.c b/backends/tpm/tpm_emulator.c index 16ae44c8d7..9c95b4d878 100644 --- a/backends/tpm/tpm_emulator.c +++ b/backends/tpm/tpm_emulator.c @@ -202,13 +202,13 @@ static int tpm_emulator_unix_tx_bufs(TPMEmulator *tpm= _emu, * size) */ to_read =3D tpm_cmd_get_size(out); - if (to_read > out_len) { + if (to_read > out_len || to_read < sizeof(struct tpm_resp_hdr)) { if (qio_channel_shutdown(tpm_emu->data_ioc, QIO_CHANNEL_SHUTDOWN_B= OTH, &local_err) < 0) { error_report_err(local_err); } error_setg(errp, "tpm-emulator: Disconnected after receiving " - "unacceptable large response (%u > %u)", + "unacceptable response size (%u max: %u)", to_read, out_len); return -1; } --=20 2.55.0 From nobody Sat Oct 24 00:32:24 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1790951229; cv=none; d=zohomail.com; s=zohoarc; b=LFHtH2FXqrsk+d/ex7Apl54EffE+VFBI6v/ogrdZRRIBZM34g9lJ3yLoND1DhpTaKckrGij1Gpe1K6zYaotXkdMUmt6ythDsBeecE/xho8IsLQuhmdBDAaNr9uxOA1LYT8UsyI2jWgTUZCvtGmQc7EKvQlxdSw2xPd2eHcUTvIQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790951229; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=DxcENW3KcCsWxsl4uaYUZg4pvpzJWSU7O7BBPrbv1Ng=; b=G+IXIEWHgjUyktm8dC0dp1sFoayBOq6Us/PttGSX+cwPSVARx3snbGZ+7j9xBwscNLSPYH00ghabclRm+LxfGlnhA1EYq1AeGlSqSbJe2bxloiighNIl2L271ZRjAy7u05/Cri+bsqH3mQMJxvQ3Pb76LCzMUma2/8wdXA5ibCQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790951229454473.74699691429; Fri, 2 Oct 2026 07:27:09 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xCeCt-0001H9-8x; Fri, 02 Oct 2026 10:25:51 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCeCh-0001CV-HE for qemu-devel@nongnu.org; Fri, 02 Oct 2026 10:25:42 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCeCZ-0001nA-3H for qemu-devel@nongnu.org; Fri, 02 Oct 2026 10:25:33 -0400 Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 692DZahb3589883; Fri, 2 Oct 2026 14:25:30 GMT Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gx4feraxw-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Fri, 02 Oct 2026 14:25:29 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 692DHV6S1296239; Fri, 2 Oct 2026 14:25:28 GMT Received: from smtprelay03.wdc07v.mail.ibm.com ([172.16.1.70]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4h0q4pmjg5-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 02 Oct 2026 14:25:28 +0000 (GMT) Received: from smtpav03.wdc07v.mail.ibm.com (smtpav03.wdc07v.mail.ibm.com [10.39.53.230]) by smtprelay03.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 692EOhbZ54722904 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 2 Oct 2026 14:24:43 GMT Received: from smtpav03.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 1BF4E5805D; Fri, 2 Oct 2026 14:25:28 +0000 (GMT) Received: from smtpav03.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 83DB65805A; Fri, 2 Oct 2026 14:25:27 +0000 (GMT) Received: from sbct-3.pok.ibm.com (unknown [9.47.158.153]) by smtpav03.wdc07v.mail.ibm.com (Postfix) with ESMTP; Fri, 2 Oct 2026 14:25:27 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=pp1; bh=DxcENW 3KcCsWxsl4uaYUZg4pvpzJWSU7O7BBPrbv1Ng=; b=Mwae8Tp+KwAbheHreKMa6u TfiFlMHen3PXyugNhta0UcN/6QGuZfjTvyC5zrKR1DKIxFe35VGX5nKAIPRZNL+2 4FJGH0UvTq+jeQohl+yBnbUBwfO62e6kiyTjBMhEfw+CL3zTzsrp6Xua6HKUK+f5 7Fy4BbouCB5qLdWen4iygJn1fhjfthxEI1bbkT/vKt4OM1pRDElkwgSmJ9Pn7hJH mrAO2anG1G75i1BCZ58dX4svMdY9nnLtIJbheVxtw2w/7eisn4pgvRq4ox3BqiQE uu8uHLTAlrfd2+gfrLd60SKD0zoarBPcOSpfqNqNFsO6HUhDdDDJzfVR3BrAdxHA == From: Stefan Berger To: qemu-devel@nongnu.org Cc: armenon@redhat.com, marcandre.lureau@gmail.com, Stefan Berger , =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= Subject: [PATCH v3 03/10] tpm_emulator: Reject sending commands smaller than the request header Date: Fri, 2 Oct 2026 10:25:09 -0400 Message-ID: <20261002142516.2063735-4-stefanb@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261002142516.2063735-1-stefanb@linux.ibm.com> References: <20261002142516.2063735-1-stefanb@linux.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Reinject: loops=2 maxloops=12 X-Authority-Analysis: v=2.4 cv=FYWiV5+6 c=1 sm=1 tr=0 ts=6abfbed9 cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=IkcTkHD0fZMA:10 a=660iZSQnnn4A:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=20KFwNOVAAAA:8 a=VnNF1IyMAAAA:8 a=-V7DfVYgi2RuJlZc1c0A:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 X-Proofpoint-Spam-Info: AW1haW4tMjYxMDAyMDA1NiBTYWx0ZWRfXzDTa61AmL75n CSstE658E1snKp+TLJOrxZYH/h+15qsY88HY56J5UeZaFYleNfxCR4dl57SVyI4yzaJ9GIBF4Pd rkrEQfjO2Szd/K69KqWx1k39isr6v0c= X-Proofpoint-ORIG-GUID: ksNSpIFnR1oppl-ADKkfRs2dXn7KIJLV X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDAyMDA1NiBTYWx0ZWRfX5anQ7rKEV1h6 XUcAt2HUloE1JufAmY1fdygYfNyoc8nxzy+Mm21VSTQEWbwqlk0gPlvH6snyAieLph6cPwZCsIb qDI3xZWHa3u4S+4D/X7oDnk5jjS+WXSTXd6r+ZyZw5ZLLw9foXfBMEWUN9qrqJqZuttqLjRHtf9 cpaqJhkB0Ir9PelzG3SJAJMVgdxbc2IrT5LizpkSlg2ihaFznbLLJdWoOXTosoAJXdk3RzP3sAw RZinJGAz7U9xfuJ2WQYOPF8e/bpnJyujuw0XvzPd+064hd3Gz08myE9wye1XmW4c7EhHEv/5ijv 0YlLo9ck6kjHnvkmOtmtgkPwvIcAx564JjM3ReVKmeU0Trj8al0BhUvbRgLo9br5ffwszUfdyhf qDexNS8EJ9lvjkmaGEjdktUaembSn/UuNL1I6qQxvU4s47gXVBLX1VWWH8qZVkMtB46P7NCifWf wcQRh0gbeT78Q9J66zw== X-Proofpoint-GUID: dwC0ugkrcNvxH7Dn3HUgHRt5EofjhXDp X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-02_04,2026-10-01_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 clxscore=1015 impostorscore=0 spamscore=0 phishscore=0 priorityscore=1501 malwarescore=0 bulkscore=0 lowpriorityscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2610020056 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=stefanb@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1790951230479158501 Reject any TPM request from being sent to the TPM emulator that is shorter than the size of the request header. Fixes: f4ede81eed29 ("tpm: Added support for TPM emulator") Reviewed-by: Marc-Andr=C3=A9 Lureau Signed-off-by: Stefan Berger --- backends/tpm/tpm_emulator.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/backends/tpm/tpm_emulator.c b/backends/tpm/tpm_emulator.c index 9c95b4d878..0c9e32f36a 100644 --- a/backends/tpm/tpm_emulator.c +++ b/backends/tpm/tpm_emulator.c @@ -181,6 +181,11 @@ static int tpm_emulator_unix_tx_bufs(TPMEmulator *tpm_= emu, uint32_t to_read; ssize_t ret; =20 + if (in_len < sizeof(struct tpm_req_hdr)) { + error_setg(errp, "tpm-emulator: invalid request size %u", in_len); + return -1; + } + if (selftest_done) { *selftest_done =3D false; is_selftest =3D tpm_util_is_selftest(in, in_len); --=20 2.55.0 From nobody Sat Oct 24 00:32:24 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1790951183; cv=none; d=zohomail.com; s=zohoarc; b=AP/rpJ6nFCgE/KXRcZlARk7RumQ29Rd50SdozHh6Duv+M+yU3DNyCMWhQAoDjrY710uRTrq9ULGgd8r2PC9hno00A6H9UlNTNOJuo0tx7HuJOCN4PlFijPI7WXzHqg+nRn6ciFqwtsyUoZBpLABXkFLZtZ1k//FReNVJaEg3BZw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790951183; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=VDXyzNsErWqBFruawXP7XM2kGjXa4HH5YRBaOWJo1WM=; b=F8fm+Vb4Fl+nC/X1vUfXqYX4x4dLQF9WIcpDt62XhPJzrEtpkUAMjYO5FHF7iNgxvnuPh5Ns5xGFI81V+VhJD4Gvz8FmUh+LnoSaOIqcJjYsIOZN62hXX6sfZyuHnyAUvk44I5LAfzpPtweI1w7qazJcQRRG7ZcG3fWhm1SIv2U= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790951183420423.7532687627033; Fri, 2 Oct 2026 07:26:23 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xCeCs-0001Fh-Km; Fri, 02 Oct 2026 10:25:50 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCeCj-0001Ca-4P for qemu-devel@nongnu.org; Fri, 02 Oct 2026 10:25:42 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCeCg-0001nG-TS for qemu-devel@nongnu.org; Fri, 02 Oct 2026 10:25:40 -0400 Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 692DZpFR673468; Fri, 2 Oct 2026 14:25:30 GMT Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gx5j5supc-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Fri, 02 Oct 2026 14:25:30 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 692DHaYF2575955; Fri, 2 Oct 2026 14:25:29 GMT Received: from smtprelay03.wdc07v.mail.ibm.com ([172.16.1.70]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4h21nu2f0k-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 02 Oct 2026 14:25:29 +0000 (GMT) Received: from smtpav03.wdc07v.mail.ibm.com (smtpav03.wdc07v.mail.ibm.com [10.39.53.230]) by smtprelay03.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 692EOirj54722912 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 2 Oct 2026 14:24:44 GMT Received: from smtpav03.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id CCD2B58054; Fri, 2 Oct 2026 14:25:28 +0000 (GMT) Received: from smtpav03.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 3FFE75805D; Fri, 2 Oct 2026 14:25:28 +0000 (GMT) Received: from sbct-3.pok.ibm.com (unknown [9.47.158.153]) by smtpav03.wdc07v.mail.ibm.com (Postfix) with ESMTP; Fri, 2 Oct 2026 14:25:28 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=pp1; bh=VDXyzN sErWqBFruawXP7XM2kGjXa4HH5YRBaOWJo1WM=; b=UV51X/GveQHKwCMYvKWRM+ Bj6+ybJPXAKdm64clH/ufs86xyT+SbL8I7pKHnDVeqVoSDMo1AejaQ/1InetDXzb kLEaFhltdL8L1vrfeNvZv8MIwtD2uYj85A7kSMsvgkSkudrdl4s8Ne9TWCZbP2oZ hgWTAG462L/7oFxR96t+/kAC9ds7pcP8HliZ7iUTtUPsIYzQhijTutX/SwvaBbub uTJJLloM4vQPQwYfdZzOIuEjQ9JyzqyhbWpwrCPHs5h83x6dvvQM/qxXCXnZYFNS nDRksQbv+kFhPd988BBICR6RMvm+UQIFRw2q5ucTkdd02nyOKVmYDFszd9yGa+4Q == From: Stefan Berger To: qemu-devel@nongnu.org Cc: armenon@redhat.com, marcandre.lureau@gmail.com, Stefan Berger , =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= Subject: [PATCH v3 04/10] hw/tpm: tis: Only read from response buffer if rw_offset < len Date: Fri, 2 Oct 2026 10:25:10 -0400 Message-ID: <20261002142516.2063735-5-stefanb@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261002142516.2063735-1-stefanb@linux.ibm.com> References: <20261002142516.2063735-1-stefanb@linux.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Reinject: loops=2 maxloops=12 X-Proofpoint-Spam-Info: AW1haW4tMjYxMDAyMDA1NiBTYWx0ZWRfXwHupXreCAnSo 4rZRzs3XglXs0jib1adagVsxN8QGHu8xEmGIr8GWqujNFButs8DwV+0Uohkccw3Q9qM0ZG7NPFH NhUWzLPbQP05/phFV3lQ+Cw2HHkbN1E= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDAyMDA1NiBTYWx0ZWRfX5Vmj8/Onom9B Ngsif0zP0evQo5JIL+r5wADu6yutWPjnlqVucaO5fQ3lYMOYBqGgeQaq0XK20R7N/qB1JzVK64z kMFW8kCQFOMS5cwjMVSDZjmPfITNcYsypwJxYUdaAGp5Esdhif4Jt8JzYk3u2uphXYFcEwVuWG1 fhSS6N8VTIjhysPW4Ifwg0KpY5YOcnhtIPlncn0OWAp3mH5rYCh/Vuz8WDHylX4nlLsJAbmMyWg 7ycSZOSWnu5+oF9Eh96BlpLD2E36hlpx4yL88kAyat7GH02r0otiz6aF/PsULW5QkXxlz64U4IM P+/TayVusXzX00Kz18Nt0IfRBKSF9+JOhqzqJ2sF4mOD1fIJLr+nt45cp6Ppp7EHPEIsDaxF9YZ LwLNP4/ujVERrWo0qQ0/RRQ7gBHUa28X4fSjQI6XhGE7uuo3dAPqVKS7MyO9mPGBupBG2gaxGfE N1AG7UJYb9YhDp4QoUQ== X-Proofpoint-GUID: eGv9fUZsvCmIbvWs9bXXmVjeUk-_ohMr X-Authority-Analysis: v=2.4 cv=RKcmjIi+ c=1 sm=1 tr=0 ts=6abfbeda cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=IkcTkHD0fZMA:10 a=660iZSQnnn4A:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=20KFwNOVAAAA:8 a=VnNF1IyMAAAA:8 a=vkKK9v0PSp4LbjciNHkA:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 X-Proofpoint-ORIG-GUID: ZZHV606sVgVnwUoIPA_5Liza2E0Ooa8P X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-02_04,2026-10-01_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 priorityscore=1501 spamscore=0 bulkscore=0 impostorscore=0 adultscore=0 lowpriorityscore=0 suspectscore=0 malwarescore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2610020056 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=stefanb@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1790951184389158500 Only read a byte from the response buffer, if the rw_offset < len. Reviewed-by: Marc-Andr=C3=A9 Lureau Signed-off-by: Stefan Berger --- hw/tpm/tpm_tis_common.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/hw/tpm/tpm_tis_common.c b/hw/tpm/tpm_tis_common.c index a134d5c205..4ba228116b 100644 --- a/hw/tpm/tpm_tis_common.c +++ b/hw/tpm/tpm_tis_common.c @@ -273,13 +273,15 @@ static uint32_t tpm_tis_data_read(TPMState *s, uint8_= t locty) len =3D MIN(tpm_cmd_get_size(&s->buffer), s->be_buffer_size); =20 - ret =3D s->buffer[s->rw_offset++]; + if (s->rw_offset < len) { + ret =3D s->buffer[s->rw_offset++]; + trace_tpm_tis_data_read(ret, s->rw_offset - 1); + } if (s->rw_offset >=3D len) { /* got last byte */ tpm_tis_sts_set(&s->loc[locty], TPM_TIS_STS_VALID); tpm_tis_raise_irq(s, locty, TPM_TIS_INT_STS_VALID); } - trace_tpm_tis_data_read(ret, s->rw_offset - 1); } =20 return ret; --=20 2.55.0 From nobody Sat Oct 24 00:32:24 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1790951183; cv=none; d=zohomail.com; s=zohoarc; b=Q7L8oRo3m1JotmSVb4Iq8o2ghFC1WwVwBs380u+kfS+qCSLZYZRb1anOHOzwGCvnGKxykkWRlD1KTtd6QPZSdpY9mdqA9iVkn4FLZXiVtHyh7Ot5lQWi0I6O7HsFU3VJLmD2dc3A5dkgVKcT4G3wnLM6MTseCTqgEds+iyKyoXQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790951183; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=1Zu1y3yKbCvTd2/B224uu1gg8Wk2aY3rdA49zALZhvY=; b=AhL5T5XT44ebHWzZVcF0BKSOcZ4BFIeDSXv1PJYDyw38XjdLDNMSu7+HfTRfFyKSppUWS/7XhPF9atUULjBfVjEgMNIUFfs+QVvf+IvuS8FeRyLyyVfdmCPG9C+3rkppavqqV354X3G6NATSxCCOU2bUDSwsZ/JUSR9+EduMENs= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790951183067616.1959227217576; Fri, 2 Oct 2026 07:26:23 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xCeCt-0001H8-7m; Fri, 02 Oct 2026 10:25:51 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCeCj-0001CZ-3m for qemu-devel@nongnu.org; Fri, 02 Oct 2026 10:25:42 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCeCg-0001nE-TD for qemu-devel@nongnu.org; Fri, 02 Oct 2026 10:25:40 -0400 Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 692DZTIM633763; Fri, 2 Oct 2026 14:25:30 GMT Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gx5ptr88h-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Fri, 02 Oct 2026 14:25:30 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 692DHVoT2540243; Fri, 2 Oct 2026 14:25:29 GMT Received: from smtprelay04.wdc07v.mail.ibm.com ([172.16.1.71]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4h1y2dk22j-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 02 Oct 2026 14:25:29 +0000 (GMT) Received: from smtpav03.wdc07v.mail.ibm.com (smtpav03.wdc07v.mail.ibm.com [10.39.53.230]) by smtprelay04.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 692EPTG264291082 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 2 Oct 2026 14:25:29 GMT Received: from smtpav03.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 88A5458054; Fri, 2 Oct 2026 14:25:29 +0000 (GMT) Received: from smtpav03.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id F05B75805C; Fri, 2 Oct 2026 14:25:28 +0000 (GMT) Received: from sbct-3.pok.ibm.com (unknown [9.47.158.153]) by smtpav03.wdc07v.mail.ibm.com (Postfix) with ESMTP; Fri, 2 Oct 2026 14:25:28 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=pp1; bh=1Zu1y3 yKbCvTd2/B224uu1gg8Wk2aY3rdA49zALZhvY=; b=EJKAWkowC0SI03/ultFAuA V4+JEcOBbeDPMkYgDUSOgY/c42GUEJtaZX2Gw8PFCjZDEMR42ORLzOfeeYY3i2GA 3MGQ2tfqinceuh2JzUf7XbjB1OfhGddU6OyjGoaTmtlHQDblFfMkiNcZfxpbTYi1 FP+YcG9uEb0LM4FGm4EVq1IXyO6+DxTne8wHVOJYR4+JLTgL71B4H34BRwNuH+il g/3xJqMxcdyoDjxYYvOPjDPFTLYxeU8XahsPYVwxMUeyRmhxJckI5zwtfwSG3Xkc Ru4YRAn7Ekv80Tz+/Wa8F9EWPlGK1bRcMawCxpFhNEAAejKMLRrsLHpyrvXfuM8g == From: Stefan Berger To: qemu-devel@nongnu.org Cc: armenon@redhat.com, marcandre.lureau@gmail.com, Stefan Berger , =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= Subject: [PATCH v3 05/10] hw/tpm: tis: Use uint32_t for len to avoid truncating size of command Date: Fri, 2 Oct 2026 10:25:11 -0400 Message-ID: <20261002142516.2063735-6-stefanb@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261002142516.2063735-1-stefanb@linux.ibm.com> References: <20261002142516.2063735-1-stefanb@linux.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Reinject: loops=2 maxloops=12 X-Proofpoint-ORIG-GUID: ETrEaUlEUNGqdcwFx5EvKfqNwA1fhuML X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDAyMDA1NiBTYWx0ZWRfX2djwlg9V1kUN FYKbAeKspqbyDZOv2su4wnJpMm2M5Dy5yNNBN630YTzSMtf1hcqFc7wa3R/a0P4wYDYVfmJzmBz 1yrBT011a8JfDPclkCWcRQkITffXg8ARhzi1+q6xeQlpj/SN7A0bXqGxfJPAT12ahTXfKYqH2Gf IUpO+SarB1BUdGeoQ4Q+usENB2vLdNZ2az5A6Vd5VB4a3bTEEFoteBLrPp0qEz3+FljZ8SfKtOM az7Q5xmoWacpNF6RiUbGLVOObTLDdhXPIe4y9OaJInDISx/lEAL9pvc5CHPzaCiM/3RtVcPAgNA PCDmQkshibEVvKYileiqGzc9FHGMSpwGezuwIjVcyqgXQYKDxRZrYdgt6lgX+GDavKr3b75mN8d BoTeyS0mBtus+1x3gB3H4ovczN6bMGZ0xIh1r2acIIp6hIwUNdBrC7LsmHM9ng+cZhkzGB642Ef amUSt2EF8x0Xd6YLqKQ== X-Proofpoint-Spam-Info: AW1haW4tMjYxMDAyMDA1NiBTYWx0ZWRfXyQZdqZ7eXwBT ZMHPfaOTNGxSBKUanfj/8Z3DWIf1bWgAzaz+oT6TWL2UmGeGulmB2VadiBgkn2SqbgehJPbcckc sH/f1+gW31DXPOpb3N9kz8d0iKG3T/c= X-Authority-Analysis: v=2.4 cv=EY5d0/mC c=1 sm=1 tr=0 ts=6abfbeda cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=RY3EVia8NYhRY2h5:21 a=IkcTkHD0fZMA:10 a=660iZSQnnn4A:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=20KFwNOVAAAA:8 a=VnNF1IyMAAAA:8 a=k5BCUbyaT9HKcZ68nHAA:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 a=zZCYzV9kfG8A:10 X-Proofpoint-GUID: u2OE2ctOGS3uWMIxpfQAwDreJZxNH0pU X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-02_04,2026-10-01_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 priorityscore=1501 suspectscore=0 adultscore=0 clxscore=1015 malwarescore=0 impostorscore=0 spamscore=0 lowpriorityscore=0 bulkscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2610020056 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=stefanb@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1790951184385158500 To avoid truncating the uint32_t return value from tpm_cmd_get_size() declare len as uint32_t rather than uint16_t. Reviewed-by: Marc-Andr=C3=A9 Lureau Signed-off-by: Stefan Berger --- hw/tpm/tpm_tis_common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/tpm/tpm_tis_common.c b/hw/tpm/tpm_tis_common.c index 4ba228116b..8fa1bee771 100644 --- a/hw/tpm/tpm_tis_common.c +++ b/hw/tpm/tpm_tis_common.c @@ -481,7 +481,7 @@ static void tpm_tis_mmio_write(void *opaque, hwaddr add= r, uint8_t locty =3D tpm_tis_locality_from_addr(addr); uint8_t active_locty, l; int c, set_new_locty =3D 1; - uint16_t len; + uint32_t len; uint32_t mask =3D (size =3D=3D 1) ? 0xff : ((size =3D=3D 2) ? 0xffff := ~0); =20 trace_tpm_tis_mmio_write(size, addr, val); --=20 2.55.0 From nobody Sat Oct 24 00:32:24 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1790951246; cv=none; d=zohomail.com; s=zohoarc; b=Pmsl5JOFBIQCRKl/j6GbsCBRnQwVYH764Ww8LAmhhx/bcpOlwe1t2YH9kJ10OH/cV9IEkkaiipMzOXMr6TzZ2lu+U+7kyjPWJvSBbbVM2UYrefmq7lbSPxiAC5lEFrTZexQ8+qmkYl3NA4T/simmRAYc9bdoZ7nfxHF6Zkhjm1A= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790951246; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=r2kp705iSlmanjcpoa52cTcw54Vr97ibiWZGUoIXRpg=; b=jg6roqNc3uzfBeHXQJPPjNgwvVmI+PXshQfVCiRVV/PA3pnnXGSwv6DB9jOui3pM565CVN2jrrfZRKJ5xAu4ofolgrOqG5RQvgfEuo+a9wRLwr/wi3S7oRE4jtLz0kXugWRKj3wytDtBPoUGgzwVFaNvHgEDlfaJ9kj6XS/o/KM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790951246399641.4995507813915; Fri, 2 Oct 2026 07:27:26 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xCeCv-0001JQ-8G; Fri, 02 Oct 2026 10:25:53 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCeCl-0001DL-0N for qemu-devel@nongnu.org; Fri, 02 Oct 2026 10:25:45 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCeCh-0001nW-88 for qemu-devel@nongnu.org; Fri, 02 Oct 2026 10:25:42 -0400 Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 692DZWuK673075; Fri, 2 Oct 2026 14:25:32 GMT Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gx5j5supj-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Fri, 02 Oct 2026 14:25:31 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 692DHV961296242; Fri, 2 Oct 2026 14:25:30 GMT Received: from smtprelay02.dal12v.mail.ibm.com ([172.16.1.4]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4h0q4pmjgd-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 02 Oct 2026 14:25:30 +0000 (GMT) Received: from smtpav03.wdc07v.mail.ibm.com (smtpav03.wdc07v.mail.ibm.com [10.39.53.230]) by smtprelay02.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 692EPUxH30474496 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 2 Oct 2026 14:25:30 GMT Received: from smtpav03.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 454D05805D; Fri, 2 Oct 2026 14:25:30 +0000 (GMT) Received: from smtpav03.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id AC7A95805A; Fri, 2 Oct 2026 14:25:29 +0000 (GMT) Received: from sbct-3.pok.ibm.com (unknown [9.47.158.153]) by smtpav03.wdc07v.mail.ibm.com (Postfix) with ESMTP; Fri, 2 Oct 2026 14:25:29 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=pp1; bh=r2kp70 5iSlmanjcpoa52cTcw54Vr97ibiWZGUoIXRpg=; b=VPrnF6wKC8d49Bt8+/w/9X ppzFhhi0TaWuUERxHUvnyewslZeJQLlCo8rDPav03EJZzxdkXXmttXOz+NE5joTB RbB/fzARLTpHC0xgVHYuEKko5Gac+wS/7+8FrtGP5HwFwTPALNESh8iXLTOzSeYG yprvOreXhBOUBiSo2o1kaSZWFs5tOeF+ug/I+33jnxyxoDPFrfkeX+R32wf+OPml GRhAVcBeRSLNiivfVQ6VLsACbHnOUlzCf0nih1wqTOvYoyNTmhrbPJoayCkbMspf zIRuJ1ryRaorfD3CQtcCX3LIxJt2AO0ZSVj/QdVyD7ishHwSAdSkEUDAT6dBGqpQ == From: Stefan Berger To: qemu-devel@nongnu.org Cc: armenon@redhat.com, marcandre.lureau@gmail.com, Stefan Berger , =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= Subject: [PATCH v3 06/10] hw/tpm: crb: Do not clear internal buffers when backend is busy Date: Fri, 2 Oct 2026 10:25:12 -0400 Message-ID: <20261002142516.2063735-7-stefanb@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261002142516.2063735-1-stefanb@linux.ibm.com> References: <20261002142516.2063735-1-stefanb@linux.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Reinject: loops=2 maxloops=12 X-Proofpoint-Spam-Info: AW1haW4tMjYxMDAyMDA1NiBTYWx0ZWRfXyPTzcoqNP1mH RHOrl2aiRBC/0HTQj8TcNle+1tRnR4ncsCTImlfHjIdgygUr2Jx+JOgt34cRPFueTDklHWxmDhY ds9G3Qedm/x3qqYvjwC5d6Zo0tvhJRU= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDAyMDA1NiBTYWx0ZWRfXx2LcwcKKNrSp GKacFipB+jqLdw9SKcApAASDP/s+kb+h+YNi/1Nz1SYXLbYQdoNX/hUY7sjJqDiwry1f22gNBfH CgAmhqk9ubRdx/92QF/b2A5OnxB3jNpoQnoC+qJzuSkYGa021O8xncQHU+QrkeiHcT9kDHEf533 PTWmjjjfIytyK7WfDoRpPBFsCFYtu3fpYBKkiQLihvSoLiSxpKfFP8LBmH+swojQPvqBSGWkCfN du2+VRkvTnluOqW6hHSmvSyw9SotC90FqhVCHui8nRyVfOQNFiliSXSFjdYUldHRDqsuO2V0hdE wcnfO4xB9N+CaYxR/UJ+TDbnfwMM+vrqeM51zQ5wFl23pxzmt7V9pb+nihsjVKYLC8l1JhC1HI/ YxASWq8PjsXSgqX23PU2Xa3R7KUdWTPQKnRKnkvaAmgAGt1HQKwK/6Sc3oZHNU+VhiBjnXv6wJ/ e4Qq1rG/Uvey+n1b3bQ== X-Proofpoint-GUID: 5RB9i7ASl4RzZlqp_dA9NyEzd2ZyaAWt X-Authority-Analysis: v=2.4 cv=RKcmjIi+ c=1 sm=1 tr=0 ts=6abfbedb cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=IkcTkHD0fZMA:10 a=660iZSQnnn4A:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=20KFwNOVAAAA:8 a=VnNF1IyMAAAA:8 a=BuBLyuNp-ztxktVGuZUA:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 X-Proofpoint-ORIG-GUID: l-RBSxYXUUl19nFU-KiTws-VrOrk8Hs0 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-02_04,2026-10-01_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 priorityscore=1501 spamscore=0 bulkscore=0 impostorscore=0 adultscore=0 lowpriorityscore=0 suspectscore=0 malwarescore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2610020056 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=stefanb@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1790951248431158500 While the backend (thread) is accessing the request and response buffers, do not clear those buffers upon a command cancellation. Also, per CRB spec the TPM is expected to either return a normal command response (command could not be cancelled) or an error response indicating TPM_RC_CANCELED. So the response buffer must be able to receive a response as normal. Fixes: 29315d22b259 ("hw/tpm: Add internal buffer state for chunking") Reviewed-by: Marc-Andr=C3=A9 Lureau Signed-off-by: Stefan Berger Reviewed-by: Arun Menon --- hw/tpm/tpm_crb.c | 1 - 1 file changed, 1 deletion(-) diff --git a/hw/tpm/tpm_crb.c b/hw/tpm/tpm_crb.c index 54fa2042b5..daf451aa56 100644 --- a/hw/tpm/tpm_crb.c +++ b/hw/tpm/tpm_crb.c @@ -219,7 +219,6 @@ static void tpm_crb_mmio_write(void *opaque, hwaddr add= r, if (s->regs[R_CRB_CTRL_START] & CRB_START_INVOKE) { tpm_backend_cancel_cmd(s->tpmbe); } - tpm_crb_clear_internal_buffers(s); } break; case A_CRB_CTRL_START: --=20 2.55.0 From nobody Sat Oct 24 00:32:24 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1790951235; cv=none; d=zohomail.com; s=zohoarc; b=mpSMc2jinCySMBohxL73QUXjedSFnYnwMuTJwDUuaqwYKzjPOHiysHRRr4M4yC7pDRwIaUFbJCR7JvfvMqa+YCLdk6U5R1IgZCwOQlmwNaINotltdpmI+uNO8k2H/QsvGhzY4ejYzlTPI084ygY8sVwvq8yffaE18j2wiM6d9ck= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790951235; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=ROOO5NKCSiNljmuUDbAB9x7mgWY9IsxGocVjRNhfZvs=; b=dGkl6tgCbmR+UXzy53IczNCmqzddnVInXWIt1AWZI77S6X8fXp8+1jV5S6nkipH1UcrfSWJQFJ/qlWxCDY9UYKp3NnydzIORfkJuv1HzKgbaf8yU9EvaHrr+4WwgVhmlcdiqxN1uyR64gVqnL1hTI6U7793/AB/5RvEiyif5v4M= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790951235915580.3490608594511; Fri, 2 Oct 2026 07:27:15 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xCeCx-0001LE-5e; Fri, 02 Oct 2026 10:25:55 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCeCl-0001DX-2L for qemu-devel@nongnu.org; Fri, 02 Oct 2026 10:25:45 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCeCh-0001nb-8j for qemu-devel@nongnu.org; Fri, 02 Oct 2026 10:25:42 -0400 Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 692DZTil673031; Fri, 2 Oct 2026 14:25:33 GMT Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gx5j5supn-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Fri, 02 Oct 2026 14:25:32 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 692DHiK52576808; Fri, 2 Oct 2026 14:25:31 GMT Received: from smtprelay03.dal12v.mail.ibm.com ([172.16.1.5]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4h1xk13617-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 02 Oct 2026 14:25:31 +0000 (GMT) Received: from smtpav03.wdc07v.mail.ibm.com (smtpav03.wdc07v.mail.ibm.com [10.39.53.230]) by smtprelay03.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 692EPVUZ33554946 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 2 Oct 2026 14:25:31 GMT Received: from smtpav03.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id EC6FB5805D; Fri, 2 Oct 2026 14:25:30 +0000 (GMT) Received: from smtpav03.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 693425805A; Fri, 2 Oct 2026 14:25:30 +0000 (GMT) Received: from sbct-3.pok.ibm.com (unknown [9.47.158.153]) by smtpav03.wdc07v.mail.ibm.com (Postfix) with ESMTP; Fri, 2 Oct 2026 14:25:30 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=pp1; bh=ROOO5N KCSiNljmuUDbAB9x7mgWY9IsxGocVjRNhfZvs=; b=UURF7ZTnJ8qH+YMe3BnpEf bJ21lcRgVrpbxIATSGx1b8lXWHyM9FhxSRbLctQW63XLjGUCDSLldq6HLOq67uz0 VjZVmiHNiqEFVP8RV3HOKDgs8kXrn2DuYqAo8+FjSDJxXtGHoQCbif+PJQlVnx13 um6E4ZTpVIvLJ7qX0f0pEyNPJ0jreHKP/UZ5qezH7iWcEABiPSVi0aNQWxe2or7w Ajddx6rQ3UriJD5XbmOfdWnjRzRpjRQxER1btbOv/mXneBAIy49RBMwlYIif9qwo wCGuS6Mu7pJpNmeFjC3+zAEF1/5kf5vhuTQBqcwDk7TdqF6/JhHKppDQOH8uYzMw == From: Stefan Berger To: qemu-devel@nongnu.org Cc: armenon@redhat.com, marcandre.lureau@gmail.com, Stefan Berger , =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= Subject: [PATCH v3 07/10] hw/tpm: crb: Avoid potential integer underflow Date: Fri, 2 Oct 2026 10:25:13 -0400 Message-ID: <20261002142516.2063735-8-stefanb@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261002142516.2063735-1-stefanb@linux.ibm.com> References: <20261002142516.2063735-1-stefanb@linux.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Reinject: loops=2 maxloops=12 X-Proofpoint-Spam-Info: AW1haW4tMjYxMDAyMDA1NiBTYWx0ZWRfXyjVv14EEVBqB GlALleOBKqYCYqpil6+UCpg6ou4sO8KEeZubGSE4Va+J0Sz9MILjAldp0OHjtDVwz/v1Vb3khca alWl02vCbr5030z+VULK2soqDE3SeNk= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDAyMDA1NiBTYWx0ZWRfX63pH6NUszOx+ gEN4xhbZUX6fN5y0YW0eeyS+38x9H5oeJVAI74SGZ8W2+Kn9LR4WibfJfDeeRyPw/taYCN3U6bo omcV4+QosYBGVKTqwwvTtOYv76G4C15ocM9PzURuaqtTQrYamUq7GVS1x+aknUCp0LBgVJ7jNCM jgrrRiPhsz7wim/7kQ+aUYKfiXUso77Z+scxmhg+mJVp7JkV249n1QfN+ovcmTAb7nDfqSv3v8v TiFAyLrRzeKRZ+LJNioTSv985Exp+C3/aoHNHvQuoTviqj5WVIHDBYzsJB0YNOpXB8spwJFxujS zua2cXQ5vOtA69X7PHEBj8PtOQxdkUhxZRR4NRhAAoWhzU4KQ9ENPGxPmD4pxQNbF3i3e5A7DUq ecQTs/G0+c4OqSl3oHeG0S3qiAn3H3WbyLHTJH8/Fs+QwTp51SJWbzw02pKq9FEWt2h29aa/7km CX6to5KxfyXlKV2Mlvw== X-Proofpoint-GUID: tilbrhVEZursCGA1bZHyhZbndZ9hMjAM X-Authority-Analysis: v=2.4 cv=RKcmjIi+ c=1 sm=1 tr=0 ts=6abfbedc cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=IkcTkHD0fZMA:10 a=660iZSQnnn4A:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=iQ6ETzBq9ecOQQE5vZCe:22 a=20KFwNOVAAAA:8 a=VnNF1IyMAAAA:8 a=c1_1-GllvHXUlFLDVV0A:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 X-Proofpoint-ORIG-GUID: jvcQqFV0JHhNz7NR28C3YkcVfwcUV8WO X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-02_04,2026-10-01_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 priorityscore=1501 spamscore=0 bulkscore=0 impostorscore=0 adultscore=0 lowpriorityscore=0 suspectscore=0 malwarescore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2610020056 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=stefanb@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1790951236469158500 Avoid a potential integer underflow in tpm_crb_fill_command_response that could occur if s->response_offset > s->response_buffer->len and the function's call sites were to change. tpm_crb_fill_command_response currently has 3 callers that either test that 's->response_offset < s->response_buffer->len' is true or ensure that s->response_offset =3D 0 and s->response_buffer->len >=3D 0. Therefore, the integer underflow cannot currently occur. In the worst case the subtraction would lead to a '0'. Reviewed-by: Marc-Andr=C3=A9 Lureau Signed-off-by: Stefan Berger --- hw/tpm/tpm_crb.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/hw/tpm/tpm_crb.c b/hw/tpm/tpm_crb.c index daf451aa56..cd46b2e888 100644 --- a/hw/tpm/tpm_crb.c +++ b/hw/tpm/tpm_crb.c @@ -180,10 +180,17 @@ static void tpm_crb_fill_command_response(CRBState *s) * to the linux guest in chunks by writing it back to MMIO region. */ void *mem =3D memory_region_get_ram_ptr(&s->cmdmem); - uint32_t remaining =3D s->response_buffer->len - s->response_offset; - uint32_t to_copy =3D MIN(CRB_CTRL_CMD_SIZE, remaining); + uint32_t remaining =3D 0; + uint32_t to_copy; =20 - memcpy(mem, s->response_buffer->data + s->response_offset, to_copy); + if (s->response_offset < s->response_buffer->len) { + remaining =3D s->response_buffer->len - s->response_offset; + } + to_copy =3D MIN(CRB_CTRL_CMD_SIZE, remaining); + + if (to_copy) { + memcpy(mem, s->response_buffer->data + s->response_offset, to_copy= ); + } =20 if (to_copy < CRB_CTRL_CMD_SIZE) { memset((guint8 *)mem + to_copy, 0, CRB_CTRL_CMD_SIZE - to_copy); --=20 2.55.0 From nobody Sat Oct 24 00:32:24 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1790951248; cv=none; d=zohomail.com; s=zohoarc; b=YKbCie5hpnYP0HOf2oTP1yPFmkhrUeijt0pFM1tYv/igyHaV2UiKV6f5LlVoQgxd4svwBiuk038phwpHxGRntgt+c9Jted/9cwkQw2+Y1a96XlwYKfWDuQBP+Pzkpubrht57UvPPmrA/vkTnruR5I9oYNhB599j57stjylvAzoY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790951248; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=ejSz+8qsil+oPW+VE9qbDsELOhWiD1+FFDWueBABIYk=; b=O3JMinppdMyGKvBIWGq1GDO+okPHnv4Yyk2thw+C2goDWxjqUMP18dJOqW5zsS/u3G/eVh3qFGPDwSdTCvZ1kqF87E4UEtJGU60QfB9cR3LammziFDlaTdcuTLe6iogw0cIa9K0yCZ+E3dqLvCPa1lzP49MPfQp4KX11B9B+/q4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790951248826573.1351471585363; Fri, 2 Oct 2026 07:27:28 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xCeCv-0001Ja-C2; Fri, 02 Oct 2026 10:25:53 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCeCl-0001Do-Fb for qemu-devel@nongnu.org; Fri, 02 Oct 2026 10:25:46 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCeCh-0001nm-90 for qemu-devel@nongnu.org; Fri, 02 Oct 2026 10:25:43 -0400 Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 692DZitM628989; Fri, 2 Oct 2026 14:25:33 GMT Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gx5s5smkt-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Fri, 02 Oct 2026 14:25:32 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 692DHae41296300; Fri, 2 Oct 2026 14:25:32 GMT Received: from smtprelay03.dal12v.mail.ibm.com ([172.16.1.5]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4h0q4pmjgh-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 02 Oct 2026 14:25:32 +0000 (GMT) Received: from smtpav03.wdc07v.mail.ibm.com (smtpav03.wdc07v.mail.ibm.com [10.39.53.230]) by smtprelay03.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 692EPVcq27460126 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 2 Oct 2026 14:25:31 GMT Received: from smtpav03.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8DB0F5805D; Fri, 2 Oct 2026 14:25:31 +0000 (GMT) Received: from smtpav03.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 1BC725805A; Fri, 2 Oct 2026 14:25:31 +0000 (GMT) Received: from sbct-3.pok.ibm.com (unknown [9.47.158.153]) by smtpav03.wdc07v.mail.ibm.com (Postfix) with ESMTP; Fri, 2 Oct 2026 14:25:31 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=ejSz+8qsil+oPW+VE 9qbDsELOhWiD1+FFDWueBABIYk=; b=F8vTe73lbeVSqulvShpT87mWtPUkTYoPo FwJcuKbtyFKBRnoIA6evpMr2LGnYbMafkbxIjRg0WvYRjiI9xWMJGQmgzLnHUY+2 yoSlzRyxWJTjU5BPts2VTOoC+I+yHY8Q+aUSGNjO2YJRAelf/P18JVh8d7CtbUML hOF5BFTBsyWM0PrsL4XTT51XhSIN4xeTQknrkRHxtge6aQitZge6B2/VhkXjYKRX XMiLHjLibUIPPVtQNH5w/p0pifrU6NMpETDcP/4uz8lLt2fmpPvsjCI36vdmh8KV buVJXmRzCISwYWeE497M119idWHt5jgcuGLodiYq74Ut++9zeFIgQ== From: Stefan Berger To: qemu-devel@nongnu.org Cc: armenon@redhat.com, marcandre.lureau@gmail.com, Stefan Berger Subject: [PATCH v3 08/10] hw/tpm: crb: Implement tpm_ppi_uninit and use it in tpm_crb_unrealize Date: Fri, 2 Oct 2026 10:25:14 -0400 Message-ID: <20261002142516.2063735-9-stefanb@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261002142516.2063735-1-stefanb@linux.ibm.com> References: <20261002142516.2063735-1-stefanb@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Reinject: loops=2 maxloops=12 X-Proofpoint-Spam-Info: AW1haW4tMjYxMDAyMDA1NiBTYWx0ZWRfX+Hfh3NqOQm6S +6q1ztad/agcaJgfys5XNBk401leCDflLWVuOiO1D+28/QduCE7dRy1zul4oJc7NmqVbYazzAEN SCqLIUh0N5S5O1ybdVwQYzocgYNHYQ4= X-Authority-Analysis: v=2.4 cv=HJ5WhYtv c=1 sm=1 tr=0 ts=6abfbedd cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=660iZSQnnn4A:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VnNF1IyMAAAA:8 a=RjRD9IDzg1SnJ7wAG4QA:9 X-Proofpoint-GUID: mhXUfCZxH-UzRpRP-PDKW84--WDQUeIN X-Proofpoint-ORIG-GUID: aBcih26-I_Sym-DAVR_md3T2k7_uCumJ X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDAyMDA1NiBTYWx0ZWRfX8O4EcxH70YJB PBOPtEjU+uqKLYtfkVO/Pq6oOSalOgO5aYkKRcNOqsMhzgY05bzWgs4CLxXsIDTwvH61mUlW2CU BGFiTnkuOS/ojZ7YdAX+vySTjbgb1wyKscPkNilORfXMW6Bs56RN7uHtS7d8+TxRqEQdk+oek80 eQmteVcwI9V4V2CYKa92MMyK/Lc9zVswGwglOPWwzDGtSCfm2n6MkDckPsEHa0SymNMWcS/fPbm BSjfrQe9dEg7OdJ7oizkYGVY6Jh41F4Qr11kx9CckbwgJkG9R2P8gkgEjfG1QAFHCXZ7CcGGapN 1JyRC2FjTzN2BJDK9rpFCV3IRCkP1WyLIKPGz3z/OQ8USNS2yveZ26tB31i4l94JTZywssJexc/ GyZ4plqXwPzRpj19Bo49ewD/9iAr0YMUYeT0lgoOaK+9XobofM42MNpFv9TQZS7fKZUjjSnxUCF 9O/kPNhxToaiQo57p+w== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-02_04,2026-10-01_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 suspectscore=0 bulkscore=0 clxscore=1015 lowpriorityscore=0 spamscore=0 impostorscore=0 phishscore=0 priorityscore=1501 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2610020056 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=stefanb@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1790951250431158500 Content-Type: text/plain; charset="utf-8" Implement tpm_ppi_uninit and use it for proper teardown of the PPI in tpm_crb_unrealize. Signed-off-by: Stefan Berger --- hw/tpm/tpm_crb.c | 3 +++ hw/tpm/tpm_ppi.c | 10 ++++++++++ hw/tpm/tpm_ppi.h | 10 ++++++++++ 3 files changed, 23 insertions(+) diff --git a/hw/tpm/tpm_crb.c b/hw/tpm/tpm_crb.c index cd46b2e888..5c50a79936 100644 --- a/hw/tpm/tpm_crb.c +++ b/hw/tpm/tpm_crb.c @@ -16,6 +16,7 @@ =20 #include "qemu/osdep.h" =20 +#include "qemu/memalign.h" #include "qemu/module.h" #include "qemu/error-report.h" #include "qapi/error.h" @@ -527,6 +528,8 @@ static void tpm_crb_unrealize(DeviceState *dev) if (s->migration_blocker) { migrate_del_blocker(&s->migration_blocker); } + + tpm_ppi_uninit(&s->ppi, get_system_memory(), OBJECT(s)); } =20 static void tpm_crb_class_init(ObjectClass *klass, const void *data) diff --git a/hw/tpm/tpm_ppi.c b/hw/tpm/tpm_ppi.c index f0c34291dc..35baa083f2 100644 --- a/hw/tpm/tpm_ppi.c +++ b/hw/tpm/tpm_ppi.c @@ -57,3 +57,13 @@ void tpm_ppi_init(TPMPPI *tpmppi, MemoryRegion *m, =20 memory_region_add_subregion(m, addr, &tpmppi->ram); } + +void tpm_ppi_uninit(TPMPPI *tpmppi, MemoryRegion *m, Object *obj) +{ + memory_region_del_subregion(m, &tpmppi->ram); + + vmstate_unregister_ram(&tpmppi->ram, DEVICE(obj)); + + qemu_vfree(tpmppi->buf); + tpmppi->buf =3D NULL; +} diff --git a/hw/tpm/tpm_ppi.h b/hw/tpm/tpm_ppi.h index 88f316ee95..c173889033 100644 --- a/hw/tpm/tpm_ppi.h +++ b/hw/tpm/tpm_ppi.h @@ -32,6 +32,16 @@ typedef struct TPMPPI { void tpm_ppi_init(TPMPPI *tpmppi, MemoryRegion *m, hwaddr addr, Object *obj); =20 +/** + * tpm_ppi_uninit: + * @tpmppi: a TPMPPI + * @m: the address-space / MemoryRegion to use + * @obj: the owner object + * + * Function to unregister the TPM PPI region. + */ +void tpm_ppi_uninit(TPMPPI *tpmppi, MemoryRegion *m, Object *obj); + /** * tpm_ppi_reset: * @tpmppi: a TPMPPI --=20 2.55.0 From nobody Sat Oct 24 00:32:24 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1790951248; cv=none; d=zohomail.com; s=zohoarc; b=O871kILxJlsLERXuFnRm1jx3pbKjS6iea+ofnmaJE5lgzrNpnLbjOOtkUH8LmN/JbkwWA87VK56gzadpt6yORjloR0FyaNgGf38XqfzAED34FZfWwjcGMSvLzGsotrV8M12xwK48vbyYEk+QeJijQ2p6CVscA+Sk9bKs5/ahgEo= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790951248; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=sZKogFJa6AUDwgSE484CT5caV1Jkx5tu2rgE4muZP5Q=; b=aJUJNkBl0cd0rcJwETdKTq8B9OChvy6j9SmxVQTdHp4WI0CDZDg4LyOIqWP1ecELYbsCmD1zEtRBaFxIUlVO1Kyhs+XpD5emz1yFjJEnsWPBM0SXDFhuFvlzpwYF0v0gmNlkiZQwjp/dJ8FuumMu47zbwsFO69vtug0jnFZsa6I= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790951248825649.5038554557659; Fri, 2 Oct 2026 07:27:28 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xCeCv-0001Ko-UT; Fri, 02 Oct 2026 10:25:53 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCeCl-0001DS-2B for qemu-devel@nongnu.org; Fri, 02 Oct 2026 10:25:45 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCeCh-0001nj-9R for qemu-devel@nongnu.org; Fri, 02 Oct 2026 10:25:41 -0400 Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 692DZYH2468470; Fri, 2 Oct 2026 14:25:34 GMT Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gx3fkrpjh-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Fri, 02 Oct 2026 14:25:33 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 692DWVR42562920; Fri, 2 Oct 2026 14:25:33 GMT Received: from smtprelay04.dal12v.mail.ibm.com ([172.16.1.6]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4h0xcsk4fv-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 02 Oct 2026 14:25:33 +0000 (GMT) Received: from smtpav03.wdc07v.mail.ibm.com (smtpav03.wdc07v.mail.ibm.com [10.39.53.230]) by smtprelay04.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 692EPWSW27787800 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 2 Oct 2026 14:25:32 GMT Received: from smtpav03.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 4014C5805A; Fri, 2 Oct 2026 14:25:32 +0000 (GMT) Received: from smtpav03.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id B1A085805C; Fri, 2 Oct 2026 14:25:31 +0000 (GMT) Received: from sbct-3.pok.ibm.com (unknown [9.47.158.153]) by smtpav03.wdc07v.mail.ibm.com (Postfix) with ESMTP; Fri, 2 Oct 2026 14:25:31 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=pp1; bh=sZKogF Ja6AUDwgSE484CT5caV1Jkx5tu2rgE4muZP5Q=; b=oJQiWJgaAHyz6xczMJ926Y r7vXs3fD/MqYTHDN6F+g4LV4jXvnZOTvdUd8/JFULpi94CBwJdbrtXaZJ/3bwFnN beI40nxyKUfLoxeGVE3gmYcfXG23OHKYYYvrFX5320ElONqpSY+tIHANBPg52/bb UVPjGhCE/eBWEPOOXm6wHefkDk6ILVqLr+2Q35j0Us8+fjdZWLuI1ppOiJpoHZXS J87q0ysmAOJCCOSxcb4AW3mUBSDoahVwcOMeW6u1LcN1rDmWCbeDRM1HG5TkEDRX IE/EDzTD6MkGI00zyPVyoC5o2YOU2wN8p8JbXpK16WDI8X5nHz7ly/qF526GkUpg == From: Stefan Berger To: qemu-devel@nongnu.org Cc: armenon@redhat.com, marcandre.lureau@gmail.com, Stefan Berger , =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= Subject: [PATCH v3 09/10] hw/tpm: crb: Consider response_buffer->len of received response Date: Fri, 2 Oct 2026 10:25:15 -0400 Message-ID: <20261002142516.2063735-10-stefanb@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261002142516.2063735-1-stefanb@linux.ibm.com> References: <20261002142516.2063735-1-stefanb@linux.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Reinject: loops=2 maxloops=12 X-Proofpoint-ORIG-GUID: o-Gl0B9pMQTDnVda9Szf6ORUUE19UfJR X-Proofpoint-GUID: IFlCjQkwL_Vw5dP7O9x1Y25zm8scnFj0 X-Proofpoint-Spam-Info: AW1haW4tMjYxMDAyMDA1NiBTYWx0ZWRfX08oDQPa1NSYd jbhuPp4v19rsy07ICa1rVXj5FgJzcSA04DYO7Jjyc0MipUS3Cm7quHHU7ntQGC+oWZgGcBjgDHb 0xpgmfcY77QV+CuK8gla58pZoc5c3BA= X-Authority-Analysis: v=2.4 cv=Vv62kO2n c=1 sm=1 tr=0 ts=6abfbede cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=IkcTkHD0fZMA:10 a=660iZSQnnn4A:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=20KFwNOVAAAA:8 a=VnNF1IyMAAAA:8 a=rD1lyLEvv5Bxigb_1PMA:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDAyMDA1NiBTYWx0ZWRfX+7sVKoPLTUxD ZvAYjdk4nkyEHtVdJEM4o7IsUBYWwhOeLksFvYW5IrU9yWBOJR//60y9UugSunhVkueeyoEUHdj gUaBefGkgTIEZyHj9bo6tyL5S+FPjH0VV0tZbmkd41Hy/1AnZl8TezGPzWeSowU1szxSEu6CLFM 9EEcjEBeK6hr85zhM7amZdWojMn8JVVlL+4JpMMxe3PL5qcQ5J1eblDLWF2ijO8D2dq4yKUnZJ3 euLgewkCnBI5t1Tu/BcKAsu5/tV52rMiYxhnFp7QDQAn+lWfGNPRVLQLx98ojfS5oc7T+ZyN/gj uLBujlTrOe70fAXMN+C0j1Epfs8byuN6GlLYmA9wQxPFxeUF1sixH+8KxgYJ6OIobSwLMfNLe6a 0ORWYWv0C40rnZGbl8aIlnc6XmpOyhYDvl/+e5FFVPQKoAbU822Kpnm54DNxgmKg6RRfgqtewtl LG7CTu9Ue0DkXYnT3Ag== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-02_04,2026-10-01_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 spamscore=0 phishscore=0 bulkscore=0 adultscore=0 priorityscore=1501 malwarescore=0 clxscore=1015 lowpriorityscore=0 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2610020056 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=stefanb@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1790951250455158501 When the CRB receives a TPM reponse from the backend, then reject responses that are shorter than the TPM_HEADER_SIZE. When determining the size of the reponse, also consider the length of the response_buffer as being possibly shorter than the negotiated backend buffer size or the size indicated in the response itself. Fixes: 2a660ad67d15 ("hw/tpm: Implement TPM CRB chunking logic") Reviewed-by: Marc-Andr=C3=A9 Lureau Signed-off-by: Stefan Berger --- hw/tpm/tpm_crb.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/hw/tpm/tpm_crb.c b/hw/tpm/tpm_crb.c index 5c50a79936..78db220520 100644 --- a/hw/tpm/tpm_crb.c +++ b/hw/tpm/tpm_crb.c @@ -323,13 +323,15 @@ static void tpm_crb_request_completed(TPMIf *ti, int = ret) CRBState *s =3D CRB(ti); =20 ARRAY_FIELD_DP32(s->regs, CRB_CTRL_START, Start, 0); - if (ret !=3D 0) { + if (ret !=3D 0 || s->response_buffer->len < TPM_HEADER_SIZE) { ARRAY_FIELD_DP32(s->regs, CRB_CTRL_STS, tpmSts, 1); /* fatal error */ tpm_crb_clear_internal_buffers(s); } else { uint32_t actual_resp_size =3D tpm_cmd_get_size(s->response_buffer-= >data); uint32_t total_resp_size =3D MIN(actual_resp_size, s->be_buffer_si= ze); + + total_resp_size =3D MIN(total_resp_size, s->response_buffer->len); g_byte_array_set_size(s->response_buffer, total_resp_size); s->response_offset =3D 0; } --=20 2.55.0 From nobody Sat Oct 24 00:32:24 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1790951247; cv=none; d=zohomail.com; s=zohoarc; b=G1nFYf9xxHwwNe7CYSXiLe1wAtKE+Od6YYaTrwOmvYH3p2N08QEVx2xgIbCoiGzuxgTnTd13etbBNUMedaCKKUzxSFWRyRu9yOjULFpndZIGUutlqPQLv547GGbHYIFJc97zyWF7/8+6hC/jXBRxXkKYPJ1HC1lzX/vH7VUi8UU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790951247; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=wvKNC68fB/4KCoF9RcZ6H/26rnYyA4+27dfgr9SNgKI=; b=BmQOQ4yNwMZ22OD+XaY6rVoSx6OkUm+zPWwK/3AEEHDIesBhWleRpAEArRqgbwANw69pRxQGowwiI36NlkI4WalE64OnFCNtlP7/g40VaDiEtBCGm5CR2jFJGJ53dcf1xBhrFMQgLjplk5+U/lpTnc4HrO8XnBbC5iRfufK/Cw4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790951247816957.8768697225189; Fri, 2 Oct 2026 07:27:27 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xCeCx-0001LD-5d; Fri, 02 Oct 2026 10:25:55 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCeCm-0001Du-Bp for qemu-devel@nongnu.org; Fri, 02 Oct 2026 10:25:46 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xCeCh-0001np-9X for qemu-devel@nongnu.org; Fri, 02 Oct 2026 10:25:43 -0400 Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 692DZe6v628960; Fri, 2 Oct 2026 14:25:34 GMT Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4gx5s5smky-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Fri, 02 Oct 2026 14:25:34 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 692DHeNk2575972; Fri, 2 Oct 2026 14:25:33 GMT Received: from smtprelay04.dal12v.mail.ibm.com ([172.16.1.6]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4h21nu2f0x-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 02 Oct 2026 14:25:33 +0000 (GMT) Received: from smtpav03.wdc07v.mail.ibm.com (smtpav03.wdc07v.mail.ibm.com [10.39.53.230]) by smtprelay04.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 692EPXu227394770 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 2 Oct 2026 14:25:33 GMT Received: from smtpav03.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id E753A5805A; Fri, 2 Oct 2026 14:25:32 +0000 (GMT) Received: from smtpav03.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 6485E5805C; Fri, 2 Oct 2026 14:25:32 +0000 (GMT) Received: from sbct-3.pok.ibm.com (unknown [9.47.158.153]) by smtpav03.wdc07v.mail.ibm.com (Postfix) with ESMTP; Fri, 2 Oct 2026 14:25:32 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=pp1; bh=wvKNC6 8fB/4KCoF9RcZ6H/26rnYyA4+27dfgr9SNgKI=; b=WJ1ajd79Ffqjy0Tej7Obda 44f/cMogkC2HEj0scELh70QXLFvA85Ly9PYAPBNSb6kAP8+8WQdFeSOTlO58uFGR DdA9VCYbNEV7Yl4Q7J5nKmK/tRVmHBYLoYVl8W35gcMUEImUaaBAndMPrWMxHS8h FteSdlBX7MtmvVlqD1zffx21Ihnb63iY28dQTT0m6Mc+rdNh+Vr+/KVoSjI/kLQZ 4q0jDroL4FqEMa9eOMwPvfAA0ZmYwLi5Zoc4995AsqleCYTFemxvovH/lWtewZCf jenmjgZHjBC6VGnT8rM127LTj5PzaRywhrUq39HEu34c/XaS1jd7lfO1HV5lD33w == From: Stefan Berger To: qemu-devel@nongnu.org Cc: armenon@redhat.com, marcandre.lureau@gmail.com, Stefan Berger , =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= Subject: [PATCH v3 10/10] tests: Add tests with commands with bad length Date: Fri, 2 Oct 2026 10:25:16 -0400 Message-ID: <20261002142516.2063735-11-stefanb@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261002142516.2063735-1-stefanb@linux.ibm.com> References: <20261002142516.2063735-1-stefanb@linux.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Reinject: loops=2 maxloops=12 X-Proofpoint-Spam-Info: AW1haW4tMjYxMDAyMDA1NiBTYWx0ZWRfX9903EnvWh2wO 1XY6P2szqcMVdu8hX3Yd2nghNP5Mwz4W7xLrSGbkM9KKSeJtgzksDyeF61/U2jKqNVyvSXi+mFX 2tKlc3Vy12dc1AhDCNKTcK2vWpbfhSU= X-Authority-Analysis: v=2.4 cv=HJ5WhYtv c=1 sm=1 tr=0 ts=6abfbede cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=IkcTkHD0fZMA:10 a=660iZSQnnn4A:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=20KFwNOVAAAA:8 a=VnNF1IyMAAAA:8 a=rfWPa_Qpybt_VECXH-MA:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 X-Proofpoint-GUID: Oi8t_ogBFlOfWQC6p09YdCtCCM8n5D-2 X-Proofpoint-ORIG-GUID: w-CLc9YKulV6oh1Ng8yMkDO1utyZEiGZ X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDAyMDA1NiBTYWx0ZWRfX06GPa+ygvRi4 NGbczkI1/Bj44VS9n8OA1s5LmbSDJevuUTzXKH9fMk+a0VZ53JdhQh8c7YlmJgYL3QedhqIry1Y rOisX7Ge6hZn2YmDUPBZ7ZNHHpDFcQd7dnnpNlRc+vnZP45bea8MJzu2MEDrXgEPSDb4eSV2p0i qMntYfBGYjP7SHxpRdvLB7QH0mGaMb7u7g3teAHymDo51GqbQ2/EHLuu2JSev2hRdcEJzEkJedo jBNhuAkNZe6JJJocO87+zpJr9M26OM387lsqgFGA83VLl4FpRhBJwf2XEEzqzNkvzZewgF6mVNE NohXVZKuOWeXY7Xhq8TxF5Z6HmB9Obc7FfNLjTmXQJkZUyPg+HFLixw9XWlQTzkxoYUDWneCG0u Y75RhAqZFfpeGfZAoqzKZmkFPRvMWiEj2TVNvMSHdq+Sw7D3gkilutHpkbyCWo+fDX/TCalUS2e mHUBjOAC5GqwcLCA8Ew== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-02_04,2026-10-01_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 suspectscore=0 bulkscore=0 clxscore=1015 lowpriorityscore=0 spamscore=0 impostorscore=0 phishscore=0 priorityscore=1501 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2610020056 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=stefanb@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1790951248581158500 Add two test cases with commands with bad length: - Send a command that indicates a very large size (0x10000 bytes) to the TPM. This will only work with the CRB interface since the TIS wants to receive all the bytes indicated by the command header. - Send a command that indicates that its size is only 9 bytes, which is too short to be valid since the command header alone is 10 bytes. This test only works with the TIS. The CRB silently rejects commands that are shorter than the command header. Reviewed-by: Marc-Andr=C3=A9 Lureau Signed-off-by: Stefan Berger --- tests/qtest/tpm-crb-swtpm-test.c | 10 +++++ tests/qtest/tpm-tests.c | 56 +++++++++++++++++++++++++ tests/qtest/tpm-tests.h | 8 ++++ tests/qtest/tpm-tis-device-swtpm-test.c | 10 +++++ tests/qtest/tpm-tis-swtpm-test.c | 10 +++++ tests/qtest/tpm-util.c | 55 ++++++++++++++++++++++++ tests/qtest/tpm-util.h | 3 ++ 7 files changed, 152 insertions(+) diff --git a/tests/qtest/tpm-crb-swtpm-test.c b/tests/qtest/tpm-crb-swtpm-t= est.c index 050c7b0c1f..0e83a5325f 100644 --- a/tests/qtest/tpm-crb-swtpm-test.c +++ b/tests/qtest/tpm-crb-swtpm-test.c @@ -33,6 +33,14 @@ static void tpm_crb_swtpm_test(const void *data) "tpm-crb", NULL); } =20 +static void tpm_crb_short_write_swtpm_test(const void *data) +{ + const TestState *ts =3D data; + + tpm_test_short_write_swtpm_test(ts->src_tpm_path, tpm_util_crb_transfe= r, + "tpm-crb", NULL); +} + static void tpm_crb_chunk_swtpm_test(const void *data) { const TestState *ts =3D data; @@ -62,6 +70,8 @@ int main(int argc, char **argv) g_test_init(&argc, &argv, NULL); =20 qtest_add_data_func("/tpm/crb-swtpm/test", &ts, tpm_crb_swtpm_test); + qtest_add_data_func("/tpm/crb-short-write-swtpm/test", &ts, + tpm_crb_short_write_swtpm_test); qtest_add_data_func("/tpm/crb-chunk-swtpm/test", &ts, tpm_crb_chunk_swtpm_test); qtest_add_data_func("/tpm/crb-swtpm-migration/test", &ts, diff --git a/tests/qtest/tpm-tests.c b/tests/qtest/tpm-tests.c index 1b4f932b0c..74b22c43aa 100644 --- a/tests/qtest/tpm-tests.c +++ b/tests/qtest/tpm-tests.c @@ -79,6 +79,62 @@ void tpm_test_swtpm_test(const char *src_tpm_path, tx_fu= nc *tx, qapi_free_SocketAddress(addr); } =20 +/* Setup the TPM and send a command by calling a passed function */ +static void +tpm_test_simple_cmd_swtpm_test(const char *src_tpm_path, tx_func *tx, + const char *ifmodel, + const char *machine_options, + void (*test_func)(QTestState *, tx_func)) +{ + char *args =3D NULL; + QTestState *s; + SocketAddress *addr =3D NULL; + gboolean succ; + GPid swtpm_pid; + GError *error =3D NULL; + + if (tpm_test_swtpm_skip()) { + return; + } + + succ =3D tpm_util_swtpm_start(src_tpm_path, &swtpm_pid, &addr, &error); + g_assert_true(succ); + + args =3D g_strdup_printf( + "%s " + "-chardev socket,id=3Dchr,path=3D%s " + "-tpmdev emulator,id=3Dtpm0,chardev=3Dchr " + "-device %s,tpmdev=3Dtpm0", + machine_options ? : "", addr->u.q_unix.path, ifmodel); + + s =3D qtest_start(args); + g_free(args); + + test_func(s, tx); + + qtest_end(); + tpm_util_swtpm_kill(swtpm_pid); + + g_unlink(addr->u.q_unix.path); + qapi_free_SocketAddress(addr); +} + +void tpm_test_short_write_swtpm_test(const char *src_tpm_path, tx_func *tx, + const char *ifmodel, + const char *machine_options) +{ + tpm_test_simple_cmd_swtpm_test(src_tpm_path, tx, ifmodel, machine_opti= ons, + tpm_util_short_write); +} + +void tpm_test_too_short_cmd_swtpm_test(const char *src_tpm_path, tx_func *= tx, + const char *ifmodel, + const char *machine_options) +{ + tpm_test_simple_cmd_swtpm_test(src_tpm_path, tx, ifmodel, machine_opti= ons, + tpm_util_too_short_cmd); +} + void tpm_test_swtpm_migration_test(const char *src_tpm_path, const char *dst_tpm_path, const char *uri, tx_func *tx, diff --git a/tests/qtest/tpm-tests.h b/tests/qtest/tpm-tests.h index 07ba60d26e..7684abf8f4 100644 --- a/tests/qtest/tpm-tests.h +++ b/tests/qtest/tpm-tests.h @@ -18,6 +18,14 @@ void tpm_test_swtpm_test(const char *src_tpm_path, tx_func *tx, const char *ifmodel, const char *machine_options); =20 +void tpm_test_short_write_swtpm_test(const char *src_tpm_path, tx_func *tx, + const char *ifmodel, + const char *machine_options); + +void tpm_test_too_short_cmd_swtpm_test(const char *src_tpm_path, tx_func *= tx, + const char *ifmodel, + const char *machine_options); + void tpm_test_swtpm_migration_test(const char *src_tpm_path, const char *dst_tpm_path, const char *uri, tx_func *tx, diff --git a/tests/qtest/tpm-tis-device-swtpm-test.c b/tests/qtest/tpm-tis-= device-swtpm-test.c index 517a077005..48a7389306 100644 --- a/tests/qtest/tpm-tis-device-swtpm-test.c +++ b/tests/qtest/tpm-tis-device-swtpm-test.c @@ -38,6 +38,14 @@ static void tpm_tis_swtpm_test(const void *data) "tpm-tis-device", MACHINE_OPTIONS); } =20 +static void tpm_tis_too_short_cmd_swtpm_test(const void *data) +{ + const TestState *ts =3D data; + + tpm_test_too_short_cmd_swtpm_test(ts->src_tpm_path, tpm_tis_transfer, + "tpm-tis-device", MACHINE_OPTIONS); +} + static void tpm_tis_swtpm_migration_test(const void *data) { const TestState *ts =3D data; @@ -62,6 +70,8 @@ int main(int argc, char **argv) g_test_init(&argc, &argv, NULL); =20 qtest_add_data_func("/tpm/tis-swtpm/test", &ts, tpm_tis_swtpm_test); + qtest_add_data_func("/tpm/tis-too-short-cmd-swtpm/test", &ts, + tpm_tis_too_short_cmd_swtpm_test); qtest_add_data_func("/tpm/tis-swtpm-migration/test", &ts, tpm_tis_swtpm_migration_test); ret =3D g_test_run(); diff --git a/tests/qtest/tpm-tis-swtpm-test.c b/tests/qtest/tpm-tis-swtpm-t= est.c index 105e42e21d..14b4cbce21 100644 --- a/tests/qtest/tpm-tis-swtpm-test.c +++ b/tests/qtest/tpm-tis-swtpm-test.c @@ -36,6 +36,14 @@ static void tpm_tis_swtpm_test(const void *data) "tpm-tis", NULL); } =20 +static void tpm_tis_too_short_cmd_swtpm_test(const void *data) +{ + const TestState *ts =3D data; + + tpm_test_too_short_cmd_swtpm_test(ts->src_tpm_path, tpm_tis_transfer, + "tpm-tis", NULL); +} + static void tpm_tis_swtpm_migration_test(const void *data) { const TestState *ts =3D data; @@ -57,6 +65,8 @@ int main(int argc, char **argv) g_test_init(&argc, &argv, NULL); =20 qtest_add_data_func("/tpm/tis-swtpm/test", &ts, tpm_tis_swtpm_test); + qtest_add_data_func("/tpm/tis-too-short-cmd-swtpm/test", &ts, + tpm_tis_too_short_cmd_swtpm_test); qtest_add_data_func("/tpm/tis-swtpm-migration/test", &ts, tpm_tis_swtpm_migration_test); ret =3D g_test_run(); diff --git a/tests/qtest/tpm-util.c b/tests/qtest/tpm-util.c index 151002ea24..d2042ed5df 100644 --- a/tests/qtest/tpm-util.c +++ b/tests/qtest/tpm-util.c @@ -194,6 +194,61 @@ void tpm_util_pcrread(QTestState *s, tx_func *tx, &exp_resp[14], exp_resp_size - 14); } =20 +/* + * Write a TPM command with too large length indicator + * The CRB will send the command to the TPM. + * The TIS will never send the command since it wants to receive the numbe= r of + * bytes indicate in the command. + */ +void tpm_util_short_write(QTestState *s, tx_func *tx) +{ + unsigned char buffer[1024] =3D { 0 }; + static const unsigned char tpm_bad_command[] =3D { + 0x80, 0x01, + 0x00, 0x01, 0x00, 0x00, /* length =3D 0x10000 */ + 0x00, 0x00, 0x01, 0x7e, + 0x00, 0x00, 0x00, 0x01, 0x00, 0x0b, 0x03, 0x00, 0x04, 0x00 + }; + + tx(s, tpm_bad_command, sizeof(tpm_bad_command), buffer, sizeof(buffer)= ); + + static const unsigned char tpm_error_resp[] =3D { + 0x80, 0x01, + 0x00, 0x00, 0x00, 0x0a, + 0x00, 0x00, 0x01, 0x42, /* TPM_RC_COMMAND_SIZE */ + }; + + g_assert_cmpmem(buffer, sizeof(tpm_error_resp), + tpm_error_resp, sizeof(tpm_error_resp)); +} + +/* + * Write a TPM command that is shorter than the header. + * The CRB will not send this command. + * The TIS will send the command to the backend (needs to be at least + * 6 bytes). + */ +void tpm_util_too_short_cmd(QTestState *s, tx_func *tx) +{ + unsigned char buffer[1024] =3D { 0 }; + static const unsigned char tpm_bad_command[] =3D { + 0x80, 0x01, + 0x00, 0x00, 0x00, 0x09, /* 9 bytes command is too short */ + 0x00, 0x00, 0x01, + }; + + tx(s, tpm_bad_command, sizeof(tpm_bad_command), buffer, sizeof(buffer)= ); + + static const unsigned char tpm_error_resp[] =3D { + 0x80, 0x01, + 0x00, 0x00, 0x00, 0x0a, + 0x00, 0x00, 0x01, 0x01, /* TPM_RC_FAILURE from tpm_emulator.c */ + }; + + g_assert_cmpmem(buffer, sizeof(tpm_error_resp), + tpm_error_resp, sizeof(tpm_error_resp)); +} + bool tpm_util_swtpm_has_tpm2(void) { bool has_tpm2 =3D false; diff --git a/tests/qtest/tpm-util.h b/tests/qtest/tpm-util.h index 681544e7d8..70c2fc09c6 100644 --- a/tests/qtest/tpm-util.h +++ b/tests/qtest/tpm-util.h @@ -38,6 +38,9 @@ void tpm_util_pcrextend(QTestState *s, tx_func *tx); void tpm_util_pcrread(QTestState *s, tx_func *tx, const unsigned char *exp_resp, size_t exp_resp_size); =20 +void tpm_util_short_write(QTestState *s, tx_func *tx); +void tpm_util_too_short_cmd(QTestState *s, tx_func *tx); + bool tpm_util_swtpm_has_tpm2(void); =20 gboolean tpm_util_swtpm_start(const char *path, GPid *pid, --=20 2.55.0