From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807245; cv=none; d=zohomail.com; s=zohoarc; b=TZbhgQfiududwaDjJQHKgksouiQeOdfRSHFWHJTbT9x+mrLLHww8ukPl4aBr1aXpC6tL6noxE38/nblhdYEs0eBGalDJYdi/5DANf3M+j8kNuRrs/v1SmJn6k4CWYTk6ZmGh0qngAajsaP6Y0Pn9d4QfP4xwHijzi7PpVr3CNp8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807245; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=j/NlMXMRqAEDF6I8zKYZETzAAcc3FD5wpz7BWADfhzo=; b=QKf4/g57efS0zIicQZ4gA5bY+2juj1Zamus5/fHfxofLmQfFv0Q8D7bn3p453fRQFKdz8QW5AB3FOTyQdAjeDc4wBjET0m4C1u+yeB+wuhlWtTh+vnN9JEoqHgyhhg/0fyWO5SEuuwO9HJ1ozpUl6ty9nwyuep3cNdEUoZw8E3o= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807244712744.3593693573923; Sat, 11 Jul 2026 15:00:44 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifjm-0001SK-6m; Sat, 11 Jul 2026 17:59:54 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifjk-0001PR-Sg; Sat, 11 Jul 2026 17:59:52 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifjj-0007rl-EM; Sat, 11 Jul 2026 17:59:52 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 08D6C1C0A8C; Sun, 12 Jul 2026 00:59:40 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id B383A3EAF17; Sun, 12 Jul 2026 00:59:49 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 388B3132E5; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807180; bh=mxQo44oW2TcUekdfOsRYH+bIDJgehJBffN7GegaK4Ew=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=NH0W7I2znKSZ/bIwmJmydjR3Y8Y9G9riIIToa6knhuGM+09fFqg2K09XO5VeAPC/C bdGr+EppJbtSBrSZsGJD5V62TKde9ZOWMXk+LVQpqxPrcRebs2+nZwJPE3PVar3h6D C56v1szOgV/9cXfv8nI/vu/HkYxqqiIGQp1wSzD2p5Yn2yqgGSI4EILYeOH9kwQJ7U 2wmq+GVdrKI4GFHRk+RoldFUB2rI/GnWAx4ASp3wl2KsJXsuPBv4orWxrqQu7ioSgF eknE+a7GOXWXExLoqqkSiroRBXjn4hdjT7zjFSw+sWXC3lyHvbOAADWnWSV8D8hJu9 WGj9ZNpsXoxOQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Emmanuel Blot , Pierrick Bouvier , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-11.0.3 01/81] meson: build macOS signed binary as part of the default target Date: Sun, 12 Jul 2026 00:57:39 +0300 Message-ID: <20260711215904.3757-1-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807247225154100 From: Emmanuel Blot Signed-off-by: Emmanuel Blot Tested-by: Pierrick Bouvier Reviewed-by: Pierrick Bouvier Message-ID: <20260609-macos-default-signed-bin-v1-1-e013ccb5ccb7@meta.com> Signed-off-by: Philippe Mathieu-Daud=C3=A9 (cherry picked from commit eef29e060dccdb02934cffaf57bfb738bb5fac5f) Signed-off-by: Michael Tokarev diff --git a/meson.build b/meson.build index 51f5f2851a0..c55f601d68f 100644 --- a/meson.build +++ b/meson.build @@ -4471,6 +4471,7 @@ foreach target : target_dirs emulators +=3D {exe['name'] : custom_target(exe['name'], input: build_input, output: exe['name'], + build_by_default: true, command: [entitlement, '@OUTPUT@', '@INPUT@']) } =20 --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807218; cv=none; d=zohomail.com; s=zohoarc; b=YyqTOIVPKG9Kz4e179vNwNbWErTH6qtt5GxCustSn/6ncX89ozuS/Zwh/jeZ5+ZJDeZ7UBYECwfdJgXr84064tecS0sBeajQBi2Jyn4bmdXhGZaFqHm2nzdjXop+s7DvK3RFPNVlBQsgWq8rDYLg0/DlnoklfXQVBa0Orta2+vs= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807218; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=MWoTO5KQtGACluWdROqRtjEYYELwsX6xNMINKa/YQN0=; b=BzswkdvWSGeHdfA1yxC86C1pvvNrzCfkIsofWE80i0EuSfCivdyYOHu+ztpCChReK1eyOXA8v8UMtpGulwTz2NyAeoqVA8LMDIEzkoja8PsHI6hNRUfHttN3Yf2RaA8y9Q3eoKQ14KbHUiIkkVHLulPVraFNCmZdhLMnxiGyr0E= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807217212905.4314385016859; Sat, 11 Jul 2026 15:00:17 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifjn-0001UF-Lg; Sat, 11 Jul 2026 17:59:55 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifjl-0001SG-PF; Sat, 11 Jul 2026 17:59:53 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifjk-0007rn-71; Sat, 11 Jul 2026 17:59:53 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 12FAB1C0A8D; Sun, 12 Jul 2026 00:59:40 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id BE7AA3EAF18; Sun, 12 Jul 2026 00:59:49 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 3B43D132E7; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807180; bh=cRqFZhGYk+df7EhwaJgQoo4SDHPelSPyyPedQ0gNe6Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Z/dpPSWpyLFLg1pkNXJScQA7ehx5bFdnKluWHpeY+tdYNc7TrTCnHlMwWD2QAzMHo hc/sVkKvzYUeBN4jqDEtriO/uwrEARfWiqAi0v83gY8ob7WeSg7ouGbU8fDglElzQq oTGX4c8Sdo+asQWpSiMvRRjxI/q3XKZ3KoGCFIR+m/uQJD/jebN3UB5xHauOhG/HDQ +RBYeyEfTVdumjd3Z0KE/mJ5qV9uj2i7TakEw80kbWdlargVtZ5IZm6opiEboGhK6A 2Yz+VIR77VDGoTSAva3e9HOWJ/hgCn3sLUREl9dJDo14iPUSGGFzaU2TX9CW3y4Ft1 y91anzFZFTcCw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , Akihiko Odaki , Michael Tokarev Subject: [Stable-11.0.3 02/81] ui/gtk: fix bad widget realize on non-GFX VC Date: Sun, 12 Jul 2026 00:57:40 +0300 Message-ID: <20260711215904.3757-2-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807223085154100 From: Marc-Andr=C3=A9 Lureau The GTK VirtualConsole is a union, it may be .gfx or .vte depending on the type. Fixes: 565f85a9c2 ("ui/gtk: force realization of drawing area") Reviewed-by: Daniel P. Berrang=C3=A9 Reviewed-by: Akihiko Odaki Signed-off-by: Marc-Andr=C3=A9 Lureau Message-ID: <20260623-b4-ui-v4-1-4656aec3398d@redhat.com> (cherry picked from commit 27f6d5ba9c97f57d1c7ce67bc01ffe8df0e11c34) Signed-off-by: Michael Tokarev diff --git a/ui/gtk.c b/ui/gtk.c index 9ebe7e8df0d..c2443fab9ad 100644 --- a/ui/gtk.c +++ b/ui/gtk.c @@ -2574,7 +2574,9 @@ static void gtk_display_init(DisplayState *ds, Displa= yOptions *opts) if (!con) { break; } - gtk_widget_realize(s->vc[idx].gfx.drawing_area); + if (s->vc[idx].type =3D=3D GD_VC_GFX) { + gtk_widget_realize(s->vc[idx].gfx.drawing_area); + } } =20 if (opts->u.gtk.has_show_menubar && --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807210; cv=none; d=zohomail.com; s=zohoarc; b=dyrRYUuufi3yMKwp2t4o9dGE/as3X42pwi3tp7xPFOcoHn4PNfVQ3cYwxsRAmdwr0k7rU+MnqBSUoNPzgEAk/2hLG5Z+ttVZLgrWbKglTrSKUHGPZSPYif/IOrcT/dCC/hodyAPBDnMJX8tm3/dqEb1QqHJHnRCZu715Co6ce7E= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807210; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=XoZvHrygWUmrXDug/wvF/SnhyCJwj/bkGdkU0rkpRL0=; b=dth+GuniGJnqKa+Zepc0Pzya8UbA5LzBcjwrzRTgfZ8D7rCPLGPA6x6Zl8sFcuBaevZdWE/+pMBm/pUtbvSdluWi/+uLJkWEGDLh2U5ZqhttMReGOBQAExyKn0s6PGqMFfVPKewjP6co4BAWsEvio4r0OYhLfCq2bEPD9UVH6c8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807208849651.7178246224156; Sat, 11 Jul 2026 15:00:08 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifjp-0001Ve-A5; Sat, 11 Jul 2026 17:59:57 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifjo-0001Uu-0c; Sat, 11 Jul 2026 17:59:56 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifjm-0007sB-Ca; Sat, 11 Jul 2026 17:59:55 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 181241C0A8E; Sun, 12 Jul 2026 00:59:40 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id C38163EAF19; Sun, 12 Jul 2026 00:59:49 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 3DCF9132E9; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807180; bh=E+6M2++zhHXz9evVcOLfdVYmxUtwqBWe2V3SJ0PWycQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=xhwBAErkMZM2ePz3YL/m5Jt3MGo46R94Vp2cnZb3t1pGZnkD8GIwAUPv/X+hWeP3z hAYvLrMi8jph7/B00x1ZxYge/nM/CUjSotETr9/ut5DAq78XHA3X1G+lKyD9cWtXkf WzDORCKI3JhV0XbzOskJGdV8gt9TmMhm6r5PtEe3ZS1we+/GNA2X27MZ1e6cRTYpFg B1P5gLeIT0ygqUGfNWsBPGy2gIkhxX1knQX99/eJ/fF7EqnJqr9bh/4xjexjYNIJoI 5jYe5kgV4TihfVtPovBKoXl6lsr0PsO8o+3gNI08z79zyNnwAQuU6z89yJz6OyfIpc 23vlUbZSlnJ8w== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Christian Borntraeger , Eric Farman , Cornelia Huck , Michael Tokarev Subject: [Stable-11.0.3 03/81] s390x/kvm: clamp stsi 3.2.2 size Date: Sun, 12 Jul 2026 00:57:41 +0300 Message-ID: <20260711215904.3757-3-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807215660154100 Content-Type: text/plain; charset="utf-8" From: Christian Borntraeger The stsi 3.2.2 page is being prepared by the kvm module and the size is clamped by the kernel. As the memory is mapped in the guest, another guest VCPU could race and overwrite the count and messing up the move operation. For any out of bound count, fall back to the kernel buffer. Cc: qemu-stable@nongnu.org Signed-off-by: Christian Borntraeger Reviewed-by: Eric Farman Message-ID: <20260622092035.400959-1-borntraeger@linux.ibm.com> Signed-off-by: Cornelia Huck (cherry picked from commit a57e4612b61da20ddab196502c76b4dc05da1de8) Signed-off-by: Michael Tokarev diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c index 54d28e37d4d..6b6700f759c 100644 --- a/target/s390x/kvm/kvm.c +++ b/target/s390x/kvm/kvm.c @@ -1791,6 +1791,15 @@ static void insert_stsi_3_2_2(S390CPU *cpu, __u64 ad= dr, uint8_t ar) } else if (s390_cpu_virt_mem_read(cpu, addr, ar, &sysib, sizeof(sysib)= )) { return; } + + /* + * The memory was filled by the kernel but mapped into the guest. + * If something is fishy, do not touch the buffer. + */ + if (sysib.count =3D=3D 0 || sysib.count > ARRAY_SIZE(sysib.ext_names))= { + return; + } + /* Shift the stack of Extended Names to prepare for our own data */ memmove(&sysib.ext_names[1], &sysib.ext_names[0], sizeof(sysib.ext_names[0]) * (sysib.count - 1)); --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807250; cv=none; d=zohomail.com; s=zohoarc; b=JMlyT5H8wHDf3ntreaeIo2fhW3w5QpZv+bRHZEHmNapwP6Pz0vGRtfI6hkfJNtTOrvJtsxbC9Vt74jsa7XxxVKDE7gbnCn7v3Mmsq+7FvS/IXGRO+M97/zsQi+JQrx2+6W8BWwUPa7CJUe6InCSRa9S9o/rc0E8sPdX8jybYpFY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807250; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=3AOFfcFboytKuFGBcc6MBx5+blwGI5qiTfkAqJSawn4=; b=cWabocLSPEcB6tWpBXaiFUOFPp4PzoZLYJjdWEXwFlrivdAtbRQJijYN/nOky2LlMGroi0EmAGT8ov4QLsTzbDcQCic76pkZ6nU3WG+jfEkXpE3dPk1ImW3ch96LeGNlWBn1SctFBUbqezLA8ArnRzrcSk6iUC+IK/l8Guo+HmM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807250050401.9121596268784; Sat, 11 Jul 2026 15:00:50 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifjq-0001WU-6P; Sat, 11 Jul 2026 17:59:58 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifjp-0001VY-1j; Sat, 11 Jul 2026 17:59:57 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifjn-0007sL-7N; Sat, 11 Jul 2026 17:59:56 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 1EF081C0A8F; Sun, 12 Jul 2026 00:59:40 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id C98DE3EAF1A; Sun, 12 Jul 2026 00:59:49 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 400BC132EB; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807180; bh=hU82KUVs7r0uV1CuQQBBYe00HlzyamewboyrZdlPX8c=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=LUkSfxiTTIZeawfLRfQVMUo4sKPhes1wAkQdoCkYB/RBV9fjMb+cyiyjaZfENE51U 3wczN2sU4GdwpA8VVFaRRV2Tb5i3JvLSw0aT6GEx/L//XJwK0EpINxt8tki7wh7+d1 OY8Rvx1e09CnhTu3O9GMBirANFkoWdzKc8LbnGAmxCy3Hj0/CB64buboHEXXkDjssx v3d6Kho7aisCFa+NCJAgmppE2EmvtbdsC/iFpBjmxQg6kymcGwrv6Fx8eDUfwcL9Qa 1pHtcLOuK+7Bld+tKBC5QoCahQ2Ou1THm8OiQSuBfezlqaaELjInz//U+4KljqFyZ9 5/D6oDOba6LzA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Christian Schoenebeck , Michael Tokarev Subject: [Stable-11.0.3 04/81] hw/9pfs: add msize_limit transport callback Date: Sun, 12 Jul 2026 00:57:42 +0300 Message-ID: <20260711215904.3757-4-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807251334154100 Content-Type: text/plain; charset="utf-8" From: Christian Schoenebeck Add a new callback 'msize_limit' to the V9fsTransport structure. This allows each transport implementation to provide its theoretical maximum 'msize' value, which will be used to cap the negotiated msize during Tversion handshake. Link: https://lore.kernel.org/qemu-devel/7c4e53eb73c0580d7a321dbf3823ba5647= 652298.1781287774.git.qemu_oss@crudebyte.com Signed-off-by: Christian Schoenebeck (cherry picked from commit a1c0e5a73740566d4b9eac1f97f78b8ce470116a) Signed-off-by: Michael Tokarev diff --git a/hw/9pfs/9p.h b/hw/9pfs/9p.h index b2df659b0e8..d8f364fafdb 100644 --- a/hw/9pfs/9p.h +++ b/hw/9pfs/9p.h @@ -481,6 +481,7 @@ struct V9fsTransport { void (*init_out_iov_from_pdu)(V9fsPDU *pdu, struct iovec **piov, unsigned int *pniov, size_t size); void (*push_and_notify)(V9fsPDU *pdu); + size_t (*msize_limit)(V9fsState *s); }; =20 #endif --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807217; cv=none; d=zohomail.com; s=zohoarc; b=PNJA5EH3/fokgs8kjxaux6KoxzHm6OhxRsW6qSGCbKEv9qw8Ci62it8tSFokoUSIQNB8azBi3myHNq6x99T2dwd654XwTQEY+sT36Q2PIo9BfOCCxjph/65DhTMpWIRYPrsm93pKz/ZSa0uqGRzdMyEo9eMiSNgpUklJSslDDGg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807217; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=e6KbOhGI6IiKewAtfNZ7BnBX1OyMbrGP/aC0Ws+8mLM=; b=QStX5TBDyDiw1RdKYKriALREVHBxbgJwwIIuScjyE25hgyfEoji2MvuyBSzngdeiydzogIA/wykWix0i/AmDK3YoVYFedOUlwnxxOE/KGPL40Dnb2b4kfNgBGqj88PBhocwxfQxNA+IRM9JFt/y4DIkr60cqCqbv5l6UzvzW+Vk= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807217191687.8562981959166; Sat, 11 Jul 2026 15:00:17 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifjs-0001Xu-DQ; Sat, 11 Jul 2026 18:00:00 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifjr-0001XB-6p; Sat, 11 Jul 2026 17:59:59 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifjp-0007sk-Hz; Sat, 11 Jul 2026 17:59:58 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 243A11C0A90; Sun, 12 Jul 2026 00:59:40 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id CFDC13EAF1B; Sun, 12 Jul 2026 00:59:49 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 424E8132ED; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807180; bh=nLadK8CU1IlBdX5sCh3ocS52jE9QwG6PesNSG3zaltM=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=eZH8PncdO8CD7Mw0wouo8eKYDdM4NUvQ5IGQV6CmzHNQapmHF/63CRhwLsE+yXnbL T9Gxxe6sd0RpHwgyA1nugAq75DTtp/YA+lcG+mfCCr8+n9JJrC7GCrodGgq75aXCcc tYDSkBdChU5OqIAyBGSWJ8+wseN1GLXfbb887ZOv1H8ZevsgcnAKDx9vUriH+1w/Fo p0ZkTC//bXG8QImTh8BtirQft9DlftYmvwK/BYvdqTqFk7iL/KsqAwdNU3Is5KO9V2 pBAEvi0zres5SbQr4rjFyuoLqoJohrphjL9UAPtc+wuz3gCfNFWxSkQD5qXGcYwfW4 3K5mh24SsHgNg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Christian Schoenebeck , Michael Tokarev Subject: [Stable-11.0.3 05/81] 9pfs/virtio: implement msize_limit callback Date: Sun, 12 Jul 2026 00:57:43 +0300 Message-ID: <20260711215904.3757-5-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807221895154100 Content-Type: text/plain; charset="utf-8" From: Christian Schoenebeck Add and implement the msize_limit callback for the virtio transport. This new callback function provides the theoretical maximum 'msize' value supported by this virtio transport. The limit is calculated as (VIRTQUEUE_MAX_SIZE - 2) * 4096 bytes, where 2 virtio descriptors are lost exactly for: - 1 descriptor for the original request (typically being small) - 1 descriptor as indirect table pointer (when used), which just contains a pointer to the separate sglist containing the response's actual payload data And 4096 bytes are assumed as standard page size used by Linux 9p client. This results in a maximum 'msize' of 4186112 bytes. Theoretically Linux client could support a much larger size, e.g. by using multiple consecutive pages per sg entry / descriptor. However that's currently not the case and unlikely to change any time soon. And due to recent security issues, let's handle this limit conservatively until really necessary to be raised. Link: https://lore.kernel.org/qemu-devel/4c34426bc906e19423e7e2389c419c2e97= 2d9b9b.1781287774.git.qemu_oss@crudebyte.com Signed-off-by: Christian Schoenebeck (cherry picked from commit 4a1a2fa4d351ba85628064e4a2a9cbc0c72cdbd4) Signed-off-by: Michael Tokarev diff --git a/hw/9pfs/virtio-9p-device.c b/hw/9pfs/virtio-9p-device.c index 9f70e2338cd..8c5d86cb66a 100644 --- a/hw/9pfs/virtio-9p-device.c +++ b/hw/9pfs/virtio-9p-device.c @@ -192,12 +192,19 @@ static void virtio_init_out_iov_from_pdu(V9fsPDU *pdu= , struct iovec **piov, *pniov =3D elem->out_num; } =20 +static size_t virtio_9p_msize_limit(V9fsState *s) +{ + const size_t guestPageSize =3D 4096; + return (VIRTQUEUE_MAX_SIZE - 2) * guestPageSize; +} + static const V9fsTransport virtio_9p_transport =3D { .pdu_vmarshal =3D virtio_pdu_vmarshal, .pdu_vunmarshal =3D virtio_pdu_vunmarshal, .init_in_iov_from_pdu =3D virtio_init_in_iov_from_pdu, .init_out_iov_from_pdu =3D virtio_init_out_iov_from_pdu, .push_and_notify =3D virtio_9p_push_and_notify, + .msize_limit =3D virtio_9p_msize_limit, }; =20 static void virtio_9p_device_realize(DeviceState *dev, Error **errp) --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807563; cv=none; d=zohomail.com; s=zohoarc; b=e3KhPAiXxy5ipihhIlry1URteP7076O5Xf/uhc/u4d+qC/4k6162HidvOxWykWJ/8GsN407FxarChgmHNKUOj7zTMmCGwhOA6reFQ4bciUN5/06seX/FwJDMcRHn+p0iFzoRC2x21vAU90hae4dKqhycnspwP+jCqk11N1Zychk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807563; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=V3fNnX5HJFlPsCnOfjRePlan7q/Kz364GR5eyiNvhgY=; b=QdW0xfUguVQmxhRn/OHYtVlDKKqDjdoboofU4g41jO62YVpWGHISRHLSX0BCN1k3FO3jTsyADqhuFC1gZp75EvMe0aAPXea/oxyugywIxe5SneMeLgv9ysvUY7FXNvjTqXeZ/svoosQjxk6CJQwdjE2zqGK7UqZs/q39en3OA1w= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807563470385.39704838521743; Sat, 11 Jul 2026 15:06:03 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifju-0001ZT-20; Sat, 11 Jul 2026 18:00:02 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifjs-0001Xo-4k; Sat, 11 Jul 2026 18:00:00 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifjq-0007t5-Fj; Sat, 11 Jul 2026 17:59:59 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 295EF1C0A91; Sun, 12 Jul 2026 00:59:40 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id D4D133EAF1C; Sun, 12 Jul 2026 00:59:49 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 44A8F132EF; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807180; bh=e2VW6vmH7t+84sHdy5ff5CdzavXHV34+NrbC9Nnc0bo=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Hlxl1rGTWlHgRcgFFflvBcmqC3Da7Ir6GhLrhyk0pvFPHy2QDzNcYodcPelOgik7G H4O3WH3naIuHGCdt7fAgtUa91Q0sK6lQ+dpx9T9opGbcsjlZCYKxzQbaa9jlUhP2Vs 6+mFMNijA52E+iXyudmpZ1INq8sXLaugd5SEPSM6cHquJg9TXjTU9tO0nr3U/AHLO3 Jsu4HjrH58ipNcGH4LFlycQQS11Yb+4AHIOh5Hkbq0g9X+6F8/Asdiyij6EdeBzoR6 mKkP++SxxBC55yIu3MeFMvkJ64QrgDK4y/orucrPXSFjACZXhoIglRn8eHTlFmwGPk D05ZdsX3Y0m3A== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Christian Schoenebeck , Stefano Stabellini , Michael Tokarev Subject: [Stable-11.0.3 06/81] 9pfs/xen: implement msize_limit callback Date: Sun, 12 Jul 2026 00:57:44 +0300 Message-ID: <20260711215904.3757-6-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807565907154100 Content-Type: text/plain; charset="utf-8" From: Christian Schoenebeck Add and implement the msize_limit callback for the Xen transport. The limit is calculated using XEN_FLEX_RING_SIZE() based on the negotiated ring_order. For the theoretical maximum ring_order of 9, this results in a maximum 'msize' of 1048576 bytes (1 MiB). The minimum limit of all rings is picked, because multiple rings could theoretically have different ring_orders. Reviewed-by: Stefano Stabellini Link: https://lore.kernel.org/qemu-devel/9471786bc47b93e822f6c6233a83f2b9f6= 1e6c82.1781287774.git.qemu_oss@crudebyte.com Signed-off-by: Christian Schoenebeck (cherry picked from commit 815d1799c3d3d6cd058cb4634392ca5a34830450) Signed-off-by: Michael Tokarev diff --git a/hw/9pfs/xen-9p-backend.c b/hw/9pfs/xen-9p-backend.c index ca0fff5fa9b..e31124bcf51 100644 --- a/hw/9pfs/xen-9p-backend.c +++ b/hw/9pfs/xen-9p-backend.c @@ -250,12 +250,31 @@ static void xen_9pfs_push_and_notify(V9fsPDU *pdu) qemu_bh_schedule(ring->bh); } =20 +static size_t xen_9p_msize_limit(V9fsState *s) +{ + Xen9pfsDev *xen_9pfs =3D container_of(s, Xen9pfsDev, state); + size_t limit; + int i; + + if (!xen_9pfs->num_rings) { + return 0; + } + + limit =3D XEN_FLEX_RING_SIZE(xen_9pfs->rings[0].ring_order); + for (i =3D 1; i < xen_9pfs->num_rings; i++) { + limit =3D MIN(limit, XEN_FLEX_RING_SIZE(xen_9pfs->rings[i].ring_or= der)); + } + + return limit; +} + static const V9fsTransport xen_9p_transport =3D { .pdu_vmarshal =3D xen_9pfs_pdu_vmarshal, .pdu_vunmarshal =3D xen_9pfs_pdu_vunmarshal, .init_in_iov_from_pdu =3D xen_9pfs_init_in_iov_from_pdu, .init_out_iov_from_pdu =3D xen_9pfs_init_out_iov_from_pdu, .push_and_notify =3D xen_9pfs_push_and_notify, + .msize_limit =3D xen_9p_msize_limit, }; =20 static int xen_9pfs_init(struct XenLegacyDevice *xendev) --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807272; cv=none; d=zohomail.com; s=zohoarc; b=jGoHH3E2E3tL9OrwCo18D7PqogCjn/GJRMOVj4VeGgUQBjaJhq2wGqZz2laqItELXHakxVQ4ZfSqBL7837PaR9FGRdgqdyQiE4wg7IuEEJFFSHPG99rXxPkxmbovZJiK9dd812R/o3jijDcg1bOIkrmtQMZRUv4IYhjOplLYac4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807272; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=nSI5JN7Rrjxyto+srymQ454Qo0IfICMJvXXbt3YuyHE=; b=eOdaj/b1UEJK7T1Lkl9IIaTEasy6RjK35lSKbDOoNqHYefanjM7oyZDB7v0JH9s/ksJ81CyRdEIffMya0tC3kxjFgn+w0Uan3CCGq4gXylaw6Wpr4C1jchAWmFS+azqPSYmCt6/2PQe8p6+/raUYXWQSAQhLb/1+le6Ptf88BO0= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807272391882.5919313902141; Sat, 11 Jul 2026 15:01:12 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifjw-0001bs-Cc; Sat, 11 Jul 2026 18:00:04 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifju-0001b4-JE; Sat, 11 Jul 2026 18:00:02 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifjs-0007th-Mk; Sat, 11 Jul 2026 18:00:02 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 2F3481C0A92; Sun, 12 Jul 2026 00:59:40 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id D9C693EAF1D; Sun, 12 Jul 2026 00:59:49 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 46F47132F1; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807180; bh=7HCgLPLyaFkVCZ6fDIicYxebjmhXEpesFF6yIleHWws=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=l8sS114+AK4v3ZAzyan9m4eVmAL12XJ9vf4zm8ilgax+dxGXUeLvqtcoFTaA7pWvT 76W/PivGGg/IyaMareOr/9gdMaJcgtm5ulgkIqkYF1lclnizVu2nXhtBC2JehWd+la vFKbaWg6ZnO7VWCgIhcmt0k5bDqYYqy9kGAWlLQsdT3efQvDRLSrVZmA7vEUsbDCkD 2dwg+7wtiRF+hq9Z/0VMDnDSarAMyT13dcsoujpKl71it5/ZitobNFV49NkyUjfJpb WxGOpXorjmbF+G7bz056iFoBHsdjNlHz6biG8caEt7f6Z5hTbo3OcyDE8jqkDq5D3J SBwF4i62bdToA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Christian Schoenebeck , Michael Tokarev Subject: [Stable-11.0.3 07/81] hw/9pfs: cap negotiated msize to transport limit Date: Sun, 12 Jul 2026 00:57:45 +0300 Message-ID: <20260711215904.3757-7-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807275599154100 Content-Type: text/plain; charset="utf-8" From: Christian Schoenebeck The 'msize' parameter negotiated during Tversion handshake can be arbitrarily large as requested by the guest. So far 9p server accepted any msize value suggested by guest, i.e. server did not cap it at all, no matter how large, as in practice the upper limit of msize is a client capability. But as subsequent's security patch shows, capping msize on server side makes sense as additional safety-net. Let's cap msize to transport's theoretical limit for msize, mainly to prevent a bad client from triggering excessive host memory allocations throughout the session. We intentionally don't cap msize to transport's current, real response buffer size, as the response buffer size may vary between individual requests. Link: https://lore.kernel.org/qemu-devel/2105e9a3578c6f751bb64af55c16dd953f= 393f20.1781287774.git.qemu_oss@crudebyte.com Signed-off-by: Christian Schoenebeck (cherry picked from commit bb5ab96e35a1b13a2485d239a44ff2d040e9b337) Signed-off-by: Michael Tokarev diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c index 936e4e9349c..0ccfd85ca2e 100644 --- a/hw/9pfs/9p.c +++ b/hw/9pfs/9p.c @@ -1469,6 +1469,16 @@ static void coroutine_fn v9fs_version(void *opaque) goto out; } =20 + /* cap msize to transport's theoretical limit */ + if (s->transport->msize_limit) { + size_t limit =3D s->transport->msize_limit(s); + if (s->msize > limit) { + s->msize =3D limit; + warn_report_once("9p: client msize capped to %zu (transport li= mit)", + limit); + } + } + /* 8192 is the default msize of Linux clients */ if (s->msize <=3D 8192 && !(s->ctx.export_flags & V9FS_NO_PERF_WARN)) { warn_report_once( --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807294; cv=none; d=zohomail.com; s=zohoarc; b=Rf+2LvBsDv+uY6Ah3TFXwog4kBTZi91bsz2cpp40u8VCP+ttzhZBNGhpWgx8DiNoWL97W2c2yAr5lfuen7tT+0e6ceTyTFKZfU/egcx/V6u5S1cgMAMTwUkmvuo6FRmTzGQGyYOW+Ao7eIPXVyAMEMcv1inQZNP40LKAEuh/frc= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807294; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=hRdGk4I5HpYIW9nIBQxcMRjhALJK1qHZPXHJocC7TGs=; b=m5GTC2uMsRDATbf+Fjg6PZPHB3LrsAEAo1QF1qO1KvM3NxCkDadNBXAsvYr8WujWND5dZWSELyJIh0R7Ewls/+blfpck7DQbUjVWhXpeulgz4XFtv6ZQJOBPoCTwMLCTqNojszb1hwx3YnDsXUzYm0ZNC9aMkKTWZB/TUc/kjRE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807294314253.61176159639808; Sat, 11 Jul 2026 15:01:34 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifjz-0001fh-GM; Sat, 11 Jul 2026 18:00:07 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifjv-0001bZ-DT; Sat, 11 Jul 2026 18:00:03 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifjt-0007u9-NO; Sat, 11 Jul 2026 18:00:03 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 33EFE1C0A93; Sun, 12 Jul 2026 00:59:40 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id DF6713EAF1E; Sun, 12 Jul 2026 00:59:49 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 49341132F3; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807180; bh=hsiOAVI1pxA6gsTTT3L+Qtz9jOIhe5gxKl4Fs1a8qgU=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=he50b1ylsyRDgnHpoEHSM2Dv3ca1G5/hvZJvmMSDOzGrsMu8f7DMpGvxpW5P7hq2h dVV7uKkfEYcHgQBE/0vdnIZbutmH7ZVSJBdE58vj5GdTTUv/lTE5Cy3KI9GG+nkQCZ OAffiLpTsV4WfB+X66r/OM0sM1KVWd/673DFiJWvGeoxqaiE83uaVasK6Mcycf+vkx bhDzZlrx6pJSu7Kp26gBelOl09d+tb+LSIyko3pborFv+EGE2REr+IXaMwGfDaOWp9 zQ342easLnIjJ4h72nkVh9bpFsYw4Cd3jkPe30s039w9yiGfp506jyu4BVk/rRrz+Y tWVPGE+iH+KNQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Christian Schoenebeck , Michael Tokarev Subject: [Stable-11.0.3 08/81] hw/9pfs: add response_buffer_size transport callback Date: Sun, 12 Jul 2026 00:57:46 +0300 Message-ID: <20260711215904.3757-8-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807296075154101 Content-Type: text/plain; charset="utf-8" From: Christian Schoenebeck Add a new callback to the V9fsTransport interface that allows each transport to provide the real size of its current response buffer. This is needed for subsequent safety guards that will limit generated responses appropriately before trying to allocate, generate, and send a response to guest. This is especially required for request handlers that need to allocate dynamic and potentially large host memory for generating a response. These safety guards are mandatory to counter bad clients that try to trick server by supplying response buffers being smaller than the previously negotiated msize value. Link: https://lore.kernel.org/qemu-devel/703ed8ce4401c4550ef2cd99f30ab80866= 5d6e85.1781287774.git.qemu_oss@crudebyte.com Signed-off-by: Christian Schoenebeck (cherry picked from commit 4b615eaa1be4a54fb677c302e1a86fe09a94aecd) Signed-off-by: Michael Tokarev diff --git a/hw/9pfs/9p.h b/hw/9pfs/9p.h index d8f364fafdb..1a309664f6e 100644 --- a/hw/9pfs/9p.h +++ b/hw/9pfs/9p.h @@ -482,6 +482,7 @@ struct V9fsTransport { unsigned int *pniov, size_t size); void (*push_and_notify)(V9fsPDU *pdu); size_t (*msize_limit)(V9fsState *s); + size_t (*response_buffer_size)(V9fsPDU *pdu); }; =20 #endif --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807264; cv=none; d=zohomail.com; s=zohoarc; b=Q3NY8jIz6aoPCBjSnRcaz/pKRAdUSDKuQL5nMAI5LKWETsx/js0IVPnWdFvWRGKOCdIjP3UKCP/yn9kySBryj6cLD+dDmfo4ioRiNVUTuGCvqCY4H+dTIiJ+ELDIx4dhnzWo5vkjrvptQlIgqDXgB5BkyTGBE4dzmZNGK9JbG7g= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807264; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=D0s6Sz5YiKZwc65zduWkL/TYeeScbR0pWFwRq6DGrT0=; b=QG4IrMuo0CCeTyg2ekm6+J1B5r9R8/6JbiI79zwkVaBIJy/GxDh9rtetQrmZwT4Ooc69Ka9t+8m5TCCTSB/XzkfhGXULmhN3PRR/57ZcfD6RWkdj/glhN9MrDJQFiySwDVnj76+vYFEQhxk/OOFhKz0fP9YJEQs7Occ4/O46wE4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807264628734.4668978292405; Sat, 11 Jul 2026 15:01:04 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifk0-0001jH-Vg; Sat, 11 Jul 2026 18:00:09 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifjy-0001f4-OJ; Sat, 11 Jul 2026 18:00:06 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifjw-0007ul-L3; Sat, 11 Jul 2026 18:00:06 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 3A12B1C0A94; Sun, 12 Jul 2026 00:59:40 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id E54CA3EAF1F; Sun, 12 Jul 2026 00:59:49 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 4B805132F5; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807180; bh=sDSprV+FPAcs6Amd77X282EZcz1S09lIO7RsVybcig4=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=LTwgGxNcjxCuQzZvAvjnkJRYuAXUNPNSUIp0SOpcF6DlfYn41CZtpE/lZ6LlpMHgm ivVuErjdr05l/zrZ8IXgoLrJUjtdWhWEikI+z5imLfrIAJGexnCHn5zE+s3SW7p9xi LoSLwYuVfMAsaempQ0SupOMfmh6X9JV6qSrRiLV0gVb15ieqw6g1YPdIF3YYeEafms PZ0eaQujBy3gSPgzzPV7dv6NGYjTRRHTqGPLb4KPLNUVooTwqZDlATEpqOJ/dWaAPI tvb9W0bZqNBB4wQxC3HFAlHJ8DYLt2k1KhijriI5fvS61yV+XaPlQNEDJPEfeuNXTi I2Rv9ATfa4Mpw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Christian Schoenebeck , Michael Tokarev Subject: [Stable-11.0.3 09/81] 9pfs/virtio: implement response_buffer_size callback Date: Sun, 12 Jul 2026 00:57:47 +0300 Message-ID: <20260711215904.3757-9-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807275191154100 Content-Type: text/plain; charset="utf-8" From: Christian Schoenebeck Add and implement the response_buffer_size callback for the virtio transport. Returns the actual current virtio response buffer size for the supplied PDU, which will be used as safety guard for limiting the response size when generating a 9p response. Link: https://lore.kernel.org/qemu-devel/5bbed2768f7a0da8fa2be183e75928c5d1= ef691d.1781287774.git.qemu_oss@crudebyte.com Signed-off-by: Christian Schoenebeck (cherry picked from commit 12bcbdca8ae9fcd5fec093e8ef5e70521e85e889) Signed-off-by: Michael Tokarev diff --git a/hw/9pfs/virtio-9p-device.c b/hw/9pfs/virtio-9p-device.c index 8c5d86cb66a..50dc93091d3 100644 --- a/hw/9pfs/virtio-9p-device.c +++ b/hw/9pfs/virtio-9p-device.c @@ -198,6 +198,15 @@ static size_t virtio_9p_msize_limit(V9fsState *s) return (VIRTQUEUE_MAX_SIZE - 2) * guestPageSize; } =20 +static size_t virtio_9p_response_buffer_size(V9fsPDU *pdu) +{ + V9fsState *s =3D pdu->s; + V9fsVirtioState *v =3D container_of(s, V9fsVirtioState, state); + VirtQueueElement *elem =3D v->elems[pdu->idx]; + + return iov_size(elem->in_sg, elem->in_num); +} + static const V9fsTransport virtio_9p_transport =3D { .pdu_vmarshal =3D virtio_pdu_vmarshal, .pdu_vunmarshal =3D virtio_pdu_vunmarshal, @@ -205,6 +214,7 @@ static const V9fsTransport virtio_9p_transport =3D { .init_out_iov_from_pdu =3D virtio_init_out_iov_from_pdu, .push_and_notify =3D virtio_9p_push_and_notify, .msize_limit =3D virtio_9p_msize_limit, + .response_buffer_size =3D virtio_9p_response_buffer_size, }; =20 static void virtio_9p_device_realize(DeviceState *dev, Error **errp) --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807252; cv=none; d=zohomail.com; s=zohoarc; b=Kp1QmDc8UCxiSeTnaYz/0LsLjTB8eME505q7mlOtgsS3znNrI4JXOgL1UpHAeoyrk6XpIjWHk5VQNwRzjroul9v0mOAhmMXXL3RRgHaXsbFnE3OG6NQ9OLH+6WSANzBnYJqQ6sSm2ajPGR4qU68w1hTjRyZNTaf59hQQj3DZE6Y= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807252; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=atPh/QI03a2eoVU6P6OfSZAw4loDh1glE7zpkno7ouo=; b=P/C5lQh2W6YRy81+N9ZvbEpnpMmagsjgd+HVp54SOS3hG5bDagCkI+RuYeK3C22gomn3XzyM9KVb6Eikl8c7ieWbm0afI4FPtx1wFtpoVVOAFClXMBQeLx/yifalwNR6exhfgBuYF8JcAs0+22vShRDHpkyxLVhMdgqJo3uRy7Y= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 17838072526651001.8526004224416; Sat, 11 Jul 2026 15:00:52 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifk2-0001ow-Na; Sat, 11 Jul 2026 18:00:11 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifjz-0001go-VY; Sat, 11 Jul 2026 18:00:08 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifjx-0007v0-CY; Sat, 11 Jul 2026 18:00:07 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 3FE7D1C0A95; Sun, 12 Jul 2026 00:59:40 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id EAF753EAF20; Sun, 12 Jul 2026 00:59:49 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 4DD15132F7; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807180; bh=SqgggJubRVStc1gNTX7oPIDEaPV3dUMrYIYtU+T0x+w=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=BdGxWPgEREx+H9LIntMa/jMUy0nr7DfHMBMTYhLJKhnYqn+mRvugHnoWpVJVTWmw4 gtaFJIsRhLXorkJLx1nG+gvFcpWIPSbfBLfMhFMcqs9AUQGq/BIsuuIu+C0LmtPUbA sXKtZy/ry2IC7E8IKR5J/ifvHW6g7quEGpXtMNrYdgABw7hXBPObHLvBKyg5FZZ0KR dkS97xuLV6EB0EB203/ifBzGPKffyO5xf3WakIdO70kJ8TQ6A1TTWmQjNd5sRHwaDs n3LtXZCMkDJQK57ZnGeMHy/TxEivbOBMGwv9o/T5YD+pPGFZgvErYIkGkyV5xCHtDo xNZt7hjZz9X0Q== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Christian Schoenebeck , Stefano Stabellini , Michael Tokarev Subject: [Stable-11.0.3 10/81] 9pfs/xen: implement response_buffer_size callback Date: Sun, 12 Jul 2026 00:57:48 +0300 Message-ID: <20260711215904.3757-10-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807256588154100 Content-Type: text/plain; charset="utf-8" From: Christian Schoenebeck Add and implement the response_buffer_size callback for the Xen transport. Returns the size of the response buffer from the rings in_sg, as limit for 9p server while generating a response for supplied PDU. We use a local iovec array variable in_sg[2] instead of ring->sg, as ring->sg is only allocated by init_in_iov_from_pdu() and init_out_iov_from_pdu() during request / response processing. response_buffer_size() however may be called before those allocators, which would dereference ring->sg as NULL pointer. The local array avoids this. Reviewed-by: Stefano Stabellini Link: https://lore.kernel.org/qemu-devel/3b139769eb1d3f9d91ee5281228e6467f9= a08b99.1781287774.git.qemu_oss@crudebyte.com Signed-off-by: Christian Schoenebeck (cherry picked from commit 69c8f5e6946f76a70b141a340c7aeb9d6a8e3c27) Signed-off-by: Michael Tokarev diff --git a/hw/9pfs/xen-9p-backend.c b/hw/9pfs/xen-9p-backend.c index e31124bcf51..24c90d97ec9 100644 --- a/hw/9pfs/xen-9p-backend.c +++ b/hw/9pfs/xen-9p-backend.c @@ -268,6 +268,17 @@ static size_t xen_9p_msize_limit(V9fsState *s) return limit; } =20 +static size_t xen_9pfs_response_buffer_size(V9fsPDU *pdu) +{ + Xen9pfsDev *priv =3D container_of(pdu->s, Xen9pfsDev, state); + Xen9pfsRing *ring =3D &priv->rings[pdu->tag % priv->num_rings]; + struct iovec in_sg[2]; + int num; + + xen_9pfs_in_sg(ring, in_sg, &num, pdu->idx, 0); + return iov_size(in_sg, num); +} + static const V9fsTransport xen_9p_transport =3D { .pdu_vmarshal =3D xen_9pfs_pdu_vmarshal, .pdu_vunmarshal =3D xen_9pfs_pdu_vunmarshal, @@ -275,6 +286,7 @@ static const V9fsTransport xen_9p_transport =3D { .init_out_iov_from_pdu =3D xen_9pfs_init_out_iov_from_pdu, .push_and_notify =3D xen_9pfs_push_and_notify, .msize_limit =3D xen_9p_msize_limit, + .response_buffer_size =3D xen_9pfs_response_buffer_size, }; =20 static int xen_9pfs_init(struct XenLegacyDevice *xendev) --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807237; cv=none; d=zohomail.com; s=zohoarc; b=RcAfrpHbMybwmc1WBMXLhsi0jGoKwABel2A4Cuy5a+RmkGdYSrvi/pljGq961wtswvR83hlw8+mMB7KMfz4mgfBje7ZlWOwsxnBU4Nvire9eVdc12N5gjye2WSRKcRHIR6V1VjJ3TjmDamqQ2+bU+AkXxvnc5x6BSRbzBvPR9pI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807237; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=qc08++xD/vz4Dgh5z1H2oVZop5Rn6PouD9OoOYz4Xx8=; b=QygjkYtt/I6RtrSLwIYlD5r32rZ7yRR/ZrJuHHSWiizRKoCP5U34eJ3mUDPx4eDpPXce7gCGWabu7y71E1QeF/YpKQAAtSPaAHdu0vvPsx82wEcfCU0mwP3SXHk9f/iPzfAFL5+dveqJ+BxuJGaAUsIWaAQYaIEoYXS2hClHEu4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807237982618.998307763902; Sat, 11 Jul 2026 15:00:37 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifk5-0001vC-Ka; Sat, 11 Jul 2026 18:00:13 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifk2-0001pI-Op; Sat, 11 Jul 2026 18:00:10 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifk0-0007wt-A6; Sat, 11 Jul 2026 18:00:10 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 46F121C0A96; Sun, 12 Jul 2026 00:59:40 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id F16753EAF21; Sun, 12 Jul 2026 00:59:49 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 502AA132F9; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807180; bh=RMgomUeEdUEzqvn2aH9betq9EEddO5YPPs/6+RySId4=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=HWgqu8lbRZmCFj9wkIg481jz1jgv265PqOl3K0RZmqtVIOxzPknj0FSoh+J1C5OV1 6WZdVEyfwjbYgPPhPLncHuZZQx+UwA4kIZrTQl+nNoefCXZ0z9cKZhNon3KKMcIZCq N0m+IlMwTA8ksErKw9aoiN38V+t8izNFIin+mvGId8dg7pI54ZN86Eb2Cl07133Zhe RKAMom9sEpbFpO47tl1ye4HQoAb/4X1W188kNa5jPu1n68TG8tYVSHK85OwHASpXQZ UynryXkTXJzLBYE6jhSiPiJKpzmBVBeOQEKBIuODkLG6ZQXq1L/91zdWJXxOI56SlN yzqcKemDSm6MQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Christian Schoenebeck , Feifan Qian , Stefano Stabellini , Michael Tokarev Subject: [Stable-11.0.3 11/81] hw/9pfs: cap Treaddir allocation (CVE-2026-9238) Date: Sun, 12 Jul 2026 00:57:49 +0300 Message-ID: <20260711215904.3757-11-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807239156154100 Content-Type: text/plain; charset="utf-8" From: Christian Schoenebeck Constrain max_count in v9fs_readdir() to transport's current, real response buffer size before calling v9fs_do_readdir() to prevent excessive host memory allocation for specific, crafted, huge directories (large amount of entries) by bad clients. Client may send a Treaddir request with a large 'count' parameter, and while the negotiated 'msize' provides some limit, it accounts for guest being somewhat faithful on the negotiated 'msize' value throughout the session. A bad guest client could have negotiated a large 'msize' but provide a small reply buffer for Treaddir request, causing QEMU to allocate host memory proportional to 'msize' before discovering the reply cannot fit. Possible consequence was a potential DoS by a priviliged guest, causing a disconnection of guest communication due to transport device being marked as "broken", however QEMU process would have continued to run with potentially giant host memory allocation, which might have negative impact on other services running on host. Fixes: CVE-2026-9238 Fixes: 2149675b195f ("9pfs: add new function v9fs_co_readdir_many()") Reported-by: Feifan Qian Reviewed-by: Stefano Stabellini Link: https://lore.kernel.org/qemu-devel/f81a387a2de4f2172fd5830c5654f49d78= 102254.1781287774.git.qemu_oss@crudebyte.com Signed-off-by: Christian Schoenebeck (cherry picked from commit 64c6c7e0df726055fac9ed12b30f712b115193f3) Signed-off-by: Michael Tokarev diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c index 0ccfd85ca2e..c76744d9a85 100644 --- a/hw/9pfs/9p.c +++ b/hw/9pfs/9p.c @@ -2665,6 +2665,7 @@ static void coroutine_fn v9fs_readdir(void *opaque) uint32_t max_count; V9fsPDU *pdu =3D opaque; V9fsState *s =3D pdu->s; + size_t max_resp_sz; =20 retval =3D pdu_unmarshal(pdu, offset, "dqd", &fid, &initial_offset, &max_count); @@ -2673,9 +2674,28 @@ static void coroutine_fn v9fs_readdir(void *opaque) } trace_v9fs_readdir(pdu->tag, pdu->id, fid, initial_offset, max_count); =20 + max_resp_sz =3D s->msize; + + /* + * Constrain max_count to transport's current, actual response buffer = size. + * A bad client might provide a response buffer < msize. + */ + if (s->transport->response_buffer_size) { + size_t buf_size =3D s->transport->response_buffer_size(pdu); + if (max_resp_sz > buf_size) { + max_resp_sz =3D buf_size; + } + } + /* Enough space for a R_readdir header: size[4] Rreaddir tag[2] count[= 4] */ - if (max_count > s->msize - 11) { - max_count =3D s->msize - 11; + if (max_resp_sz > 11) { + max_resp_sz -=3D 11; + } else { + max_resp_sz =3D 0; + } + + if (max_count > max_resp_sz) { + max_count =3D max_resp_sz; warn_report_once( "9p: bad client: T_readdir with count > msize - 11" ); --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807629; cv=none; d=zohomail.com; s=zohoarc; b=ICuIC1/ChvABj3UABQJ/zRpJAgUzSRXUPeT8sftgYI2+PzNlaCnUSME8H8V8SZ4e/SLY30WmAY9cqtuSMTJqOGwhD1d4heSpxt6dem9PCeZzBdsjHcyja5QC+syHc6QI+QnA2g35tK+vsirEkfFz35j56wgmD4fE8aXIdy3OWL0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807629; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=BvVHPeQ6QUNXqvg+NjKTMwgIaUteZyQlIq2RNrbRkss=; b=NhQU0WEcl/ihIJsg+r1y7UAH8jmTIo+gPV1JBuoqGos0abS7QTyyQojDvEG82tSXAg8WFHVXsFcY6pWTchK2vvLqw1sAOOS19h+rp23ekQTMPceu47evuxYEbZwxzkiKsLoglTELvUyQWL8Vfi3rYRghTvXZY1G2g/D6o28SFPs= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807629644738.980827526775; Sat, 11 Jul 2026 15:07:09 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifkX-0002Or-3Q; Sat, 11 Jul 2026 18:00:41 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifkN-0002CP-M0; Sat, 11 Jul 2026 18:00:35 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifkL-0007xO-JI; Sat, 11 Jul 2026 18:00:31 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 4C5171C0A97; Sun, 12 Jul 2026 00:59:40 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 036F83EAF22; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 52846132FB; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807180; bh=M4SKRLMhO/9EcyMAQ8+9gJB3i1e6BtatvFupzrmiIH4=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Df2/vuss3szQRNRZUE8KvPY6Zy5dWLQxO+QrQ3PHJx/c/Q8xgdgfRnQV4EhHXnuet WGfu9LGKeN1cZmwab0IoBwxBXio3rEnHwyKfyp5bkSyDdhZCnpf/PMZNngUYfAUmTe XpS1UUCqJ6QYYAATsuycsApPOqu5bCR9m6tT6I6bB5O6Ehu3iMgKgUcyRuSpV820n3 33/ts2j215YOS0d4K0PcpQCQwe0hYqIpvbHSs1VxWa1+3xrinKxm4OECgb9fBjWs8S X9tV6zalpWvO4eKJys4AaN9Hft2Fejs+Zr4Dx+uoltDlEwNXsSMQGJFqHakC4HPo8O VU3GprnhXJj6Q== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Christian Schoenebeck , Feifan Qian , Michael Tokarev Subject: [Stable-11.0.3 12/81] hw/9pfs: add xattr FID limit to prevent memory exhaustion Date: Sun, 12 Jul 2026 00:57:50 +0300 Message-ID: <20260711215904.3757-12-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807630768154100 Content-Type: text/plain; charset="utf-8" From: Christian Schoenebeck Add a limit on the number of simultaneously open xattr FIDs to prevent host memory exhaustion attacks. Each xattr FID contains a buffer for the xattr value, and without a limit, a malicious priviliged guest with direct communication access to 9p server could create a huge number of xattr FIDs until host memory is eventually exhausted. Fix this by: - add xattr_fid_limit to struct FsContext for the max. amount - add xattr_fid_count to struct FsContext for the current amount - init xattr_fid_limit with 1024 - init xattr_fid_count with 0 - add function xattr_fid_count_inc() to increment the count - add function xattr_fid_count_decr() to decrement the count - call xattr_fid_count_inc() in Txattrcreate handler - call xattr_fid_count_inc() in Txattrwalk handler - call xattr_fid_count_decr() when a xattr FID is freed Additionally: - reset the xattr FID counter in virtfs_reset() When the limit is reached then xattr_fid_count_inc() returns -ENOSPC and the request handler is aborted on its error path without turning the FID into an xattr type and without allocating memory for the xattr. The default value of 1024 was chosen, as (sane usage of) xattr requests in the 9p protocol are usually very short-lived, and even machines with 128 cores with very high xattr activity should have plenty of head room without ever hitting this limit. Fixes: 10b468bdc5 ("virtio-9p: Implement TXATTRCREATE") Fixes: CVE-2026-8348 Reported-by: Feifan Qian Link: https://lore.kernel.org/qemu-devel/eb3787869745d47234fb662600187bf773= e1ef8a.1781361555.git.qemu_oss@crudebyte.com Signed-off-by: Christian Schoenebeck (cherry picked from commit 693b296b176d1829b10855d9831bd2ad21b2cdcf) Signed-off-by: Michael Tokarev diff --git a/fsdev/file-op-9p.h b/fsdev/file-op-9p.h index e8d0661c4b5..454761d81d7 100644 --- a/fsdev/file-op-9p.h +++ b/fsdev/file-op-9p.h @@ -81,6 +81,11 @@ typedef struct ExtendedOps { =20 #define V9FS_SEC_MASK 0x0000003C =20 +/* + * Limits the maximum amount of simultaneously open xattr FIDs to prevent + * host memory exhaustion (as each xattr FID contains a xattr value buffer= ). + */ +#define V9FS_MAX_XATTR_DEFAULT 1024 =20 typedef struct FileOperations FileOperations; typedef struct XattrOperations XattrOperations; @@ -109,6 +114,10 @@ struct FsContext { void *private; mode_t fmode; mode_t dmode; + /* max. amount of simultaneously open xattr FIDs */ + uint32_t xattr_fid_limit; + /* current amount of open xattr FIDs */ + uint32_t xattr_fid_count; }; =20 struct V9fsPath { diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c index c76744d9a85..437588f9d5c 100644 --- a/hw/9pfs/9p.c +++ b/hw/9pfs/9p.c @@ -265,6 +265,31 @@ static size_t v9fs_string_size(V9fsString *str) return str->size; } =20 +static int xattr_fid_count_inc(V9fsPDU *pdu) +{ + V9fsState *s =3D pdu->s; + + if (s->ctx.xattr_fid_limit > 0 && + s->ctx.xattr_fid_count >=3D s->ctx.xattr_fid_limit) { + error_report_once("9pfs: xattr_fid_count limit exceeded " + "(configurable by option 'max_xattr')."); + return -ENOSPC; + } + s->ctx.xattr_fid_count++; + return 0; +} + +static void xattr_fid_count_decr(V9fsPDU *pdu) +{ + V9fsState *s =3D pdu->s; + + if (s->ctx.xattr_fid_count > 0) { + s->ctx.xattr_fid_count--; + } else { + error_report_once("9pfs: xattr_fid_count underflow detected"); + } +} + /* * returns 0 if fid got re-opened, 1 if not, < 0 on error */ @@ -397,6 +422,7 @@ static int coroutine_fn free_fid(V9fsPDU *pdu, V9fsFidS= tate *fidp) } } else if (fidp->fid_type =3D=3D P9_FID_XATTR) { retval =3D v9fs_xattr_fid_clunk(pdu, fidp); + xattr_fid_count_decr(pdu); } v9fs_path_free(&fidp->path); g_free(fidp); @@ -634,6 +660,14 @@ static void coroutine_fn virtfs_reset(V9fsPDU *pdu) fidp->clunked =3D true; put_fid(pdu, fidp); } + + /* + * Explicitly reset the xattr FID counter. + * + * free_fid() already decrements the counter for each P9_FID_XATTR, so= the + * counter should already be zero, hence this is just a defensive meas= ure. + */ + s->ctx.xattr_fid_count =3D 0; } =20 #define P9_QID_TYPE_DIR 0x80 @@ -4045,6 +4079,14 @@ static void coroutine_fn v9fs_xattrwalk(void *opaque) clunk_fid(s, xattr_fidp->fid); goto out; } + + /* Check xattr FID limit */ + err =3D xattr_fid_count_inc(pdu); + if (err < 0) { + clunk_fid(s, xattr_fidp->fid); + goto out; + } + /* * Read the xattr value */ @@ -4052,6 +4094,7 @@ static void coroutine_fn v9fs_xattrwalk(void *opaque) xattr_fidp->fid_type =3D P9_FID_XATTR; xattr_fidp->fs.xattr.xattrwalk_fid =3D true; xattr_fidp->fs.xattr.value =3D g_malloc0(size); + if (size) { err =3D v9fs_co_llistxattr(pdu, &xattr_fidp->path, xattr_fidp->fs.xattr.value, @@ -4078,6 +4121,14 @@ static void coroutine_fn v9fs_xattrwalk(void *opaque) clunk_fid(s, xattr_fidp->fid); goto out; } + + /* Check xattr FID limit */ + err =3D xattr_fid_count_inc(pdu); + if (err < 0) { + clunk_fid(s, xattr_fidp->fid); + goto out; + } + /* * Read the xattr value */ @@ -4085,6 +4136,7 @@ static void coroutine_fn v9fs_xattrwalk(void *opaque) xattr_fidp->fid_type =3D P9_FID_XATTR; xattr_fidp->fs.xattr.xattrwalk_fid =3D true; xattr_fidp->fs.xattr.value =3D g_malloc0(size); + if (size) { err =3D v9fs_co_lgetxattr(pdu, &xattr_fidp->path, &name, xattr_fidp->fs.xattr.value, @@ -4186,6 +4238,12 @@ static void coroutine_fn v9fs_xattrcreate(void *opaq= ue) goto out_put_fid; } =20 + /* Check xattr FID limit */ + err =3D xattr_fid_count_inc(pdu); + if (err < 0) { + goto out_put_fid; + } + /* Make the file fid point to xattr */ xattr_fidp =3D file_fidp; xattr_fidp->fid_type =3D P9_FID_XATTR; @@ -4447,6 +4505,10 @@ int v9fs_device_realize_common(V9fsState *s, const V= 9fsTransport *t, =20 s->reclaiming =3D false; =20 + /* init xattr FID limit */ + s->ctx.xattr_fid_limit =3D V9FS_MAX_XATTR_DEFAULT; + s->ctx.xattr_fid_count =3D 0; + rc =3D 0; out: if (rc) { --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807281; cv=none; d=zohomail.com; s=zohoarc; b=GvZY1HDUMwStgjZJcHqjTC42119lVdRVF1v+gkkMTHkc1PDue79cqj79FpcH0987I4NCBh6Mv+7f7yCuTipLJhsPbs7lIBjPHUdexttyp9ccm9pIvqt+k+6tkv97DXqQQ5Mwc00+t2aifqfL/D7TEMNmR9p4bYLZZhCRFumWuNE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807281; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=pyLV8nB9i9Fsy1VQyepr4aNgvss87S7QyAOA8fM0hko=; b=HydYSIBFw1mV95UYXfDVggAJU0c8K27GZ5C0EFnMQPRyGput58JEAQEttqo95PsfnABqbqyBHsQKpevyQIYBXvAseYPrzjfwlJo2EWX/KnW/roBbdtoB1vsslsNwneMJNi/OY//7f8q8Me4d6zwZgxrieD9Is7nDVKCBe8AotvU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807281973898.6916242923289; Sat, 11 Jul 2026 15:01:21 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifkW-0002Mn-PH; Sat, 11 Jul 2026 18:00:40 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifkQ-0002D2-7P; Sat, 11 Jul 2026 18:00:38 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifkO-0007y6-8L; Sat, 11 Jul 2026 18:00:33 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 50F831C0A98; Sun, 12 Jul 2026 00:59:40 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 087AC3EAF23; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 54D0A132FD; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807180; bh=32ly9JrxztZXfXdc+BkSY9lrMxJh2P7wCEom8Eu27FA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=PzcljL8B1XrfF9prI//dLoo+kZpMJ0Xb3o2l5oo/RlyzRTEljHd6Jyd7IzEMkyhz5 piJBgqze0vzWxnVUAKPVjS/tmmBWWfk7epN1BlG9zQ0boOPa3nUWsh9VJORvjr15RG tAgqRhPj8yKoLjczIaI4MKJohNOOFVNIvPpD1QZ9oQHcTRt7MMk6w0CRFraMGW5iKu Gc9YDovpG425TrEMDTGodhJge+zA2177at9iG0IG/knjUqJPRuk3mEydq2M66yi3Og TkIAp+HbxHtTZzGSW4QZRqm8CL4e0/0wbNmKj2pnUy1XueflHXDyGzTb9WdEcbznxI Alh9SVfNz3zDQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Christian Schoenebeck , Michael Tokarev Subject: [Stable-11.0.3 13/81] hw/9pfs: add max_xattr option Date: Sun, 12 Jul 2026 00:57:51 +0300 Message-ID: <20260711215904.3757-13-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807283852154100 Content-Type: text/plain; charset="utf-8" From: Christian Schoenebeck Previous patch introduced a limit of max. 1024 simultaneous xattr FIDs. This patch introduces an option "max_attr" that allows to override this limit, just for the case that some user might run into this limit for some reason, even if unlikely; or for reducing the limit further down (e.g. that default limit of 1024 would cap at max. 64 MiB host memory, at least on Linux hosts where the limit per xattr is 64k). This new "max_xattr" option can be specified with both -fsdev and -virtfs command line options, with the "local" and the "synth" fs drivers. The previous limit of 1024 is preserved as the default value. Link: https://lore.kernel.org/qemu-devel/b7631ac0d8dde0629bc7c4f2c4185d9f57= b962b4.1781361555.git.qemu_oss@crudebyte.com Signed-off-by: Christian Schoenebeck (cherry picked from commit e6116a81f04c48af9530d984d16ef4ed4346e865) Signed-off-by: Michael Tokarev diff --git a/fsdev/file-op-9p.h b/fsdev/file-op-9p.h index 454761d81d7..1d931144f40 100644 --- a/fsdev/file-op-9p.h +++ b/fsdev/file-op-9p.h @@ -101,6 +101,8 @@ typedef struct FsDriverEntry { FsThrottle fst; mode_t fmode; mode_t dmode; + /* temporary storage for parse_opts only */ + uint32_t max_xattr; } FsDriverEntry; =20 struct FsContext { diff --git a/fsdev/qemu-fsdev-opts.c b/fsdev/qemu-fsdev-opts.c index 07a18c6e48d..c2c1e83611b 100644 --- a/fsdev/qemu-fsdev-opts.c +++ b/fsdev/qemu-fsdev-opts.c @@ -46,6 +46,9 @@ static QemuOptsList qemu_fsdev_opts =3D { }, { .name =3D "dmode", .type =3D QEMU_OPT_NUMBER, + }, { + .name =3D "max_xattr", + .type =3D QEMU_OPT_NUMBER, }, =20 THROTTLE_OPTS, @@ -92,6 +95,9 @@ static QemuOptsList qemu_virtfs_opts =3D { }, { .name =3D "dmode", .type =3D QEMU_OPT_NUMBER, + }, { + .name =3D "max_xattr", + .type =3D QEMU_OPT_NUMBER, }, =20 { /*End of list */ } diff --git a/fsdev/qemu-fsdev.c b/fsdev/qemu-fsdev.c index 57877dad0a7..f97103cf442 100644 --- a/fsdev/qemu-fsdev.c +++ b/fsdev/qemu-fsdev.c @@ -45,7 +45,7 @@ typedef struct FsDriverListEntry { static QTAILQ_HEAD(, FsDriverListEntry) fsdriver_entries =3D QTAILQ_HEAD_INITIALIZER(fsdriver_entries); =20 -#define COMMON_FS_DRIVER_OPTIONS "id", "fsdriver", "readonly" +#define COMMON_FS_DRIVER_OPTIONS "id", "fsdriver", "readonly", "max_xattr" =20 static FsDriverTable FsDrivers[] =3D { { diff --git a/hw/9pfs/9p-local.c b/hw/9pfs/9p-local.c index aa48306b0ee..4708e170a42 100644 --- a/hw/9pfs/9p-local.c +++ b/hw/9pfs/9p-local.c @@ -1527,6 +1527,15 @@ static int local_parse_opts(QemuOpts *opts, FsDriver= Entry *fse, Error **errp) const char *path =3D qemu_opt_get(opts, "path"); const char *multidevs =3D qemu_opt_get(opts, "multidevs"); =20 + uint64_t val =3D qemu_opt_get_number(opts, "max_xattr", + V9FS_MAX_XATTR_DEFAULT); + if (val > UINT32_MAX) { + error_setg(errp, "max_xattr value '%s' too large", + qemu_opt_get(opts, "max_xattr")); + return -1; + } + fse->max_xattr =3D val; + if (!sec_model) { error_setg(errp, "security_model property not set"); error_append_security_model_hint(errp); diff --git a/hw/9pfs/9p-synth.c b/hw/9pfs/9p-synth.c index b3743f61696..322dc3bb690 100644 --- a/hw/9pfs/9p-synth.c +++ b/hw/9pfs/9p-synth.c @@ -25,6 +25,8 @@ #include "qemu/rcu_queue.h" #include "qemu/cutils.h" #include "system/qtest.h" +#include "qapi/error.h" +#include "qemu/option.h" =20 /* Root node for synth file system */ static V9fsSynthNode synth_root =3D { @@ -629,12 +631,27 @@ static int synth_init(FsContext *ctx, Error **errp) return 0; } =20 +static int synth_parse_opts(QemuOpts *opts, FsDriverEntry *fse, Error **er= rp) +{ + uint64_t val =3D qemu_opt_get_number(opts, "max_xattr", + V9FS_MAX_XATTR_DEFAULT); + if (val > UINT32_MAX) { + error_setg(errp, "max_xattr value '%s' too large", + qemu_opt_get(opts, "max_xattr")); + return -1; + } + fse->max_xattr =3D val; + + return 0; +} + static bool synth_has_valid_file_handle(int fid_type, V9fsFidOpenState *fs) { return false; } =20 FileOperations synth_ops =3D { + .parse_opts =3D synth_parse_opts, .init =3D synth_init, .lstat =3D synth_lstat, .readlink =3D synth_readlink, diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c index 437588f9d5c..1b064a27fc5 100644 --- a/hw/9pfs/9p.c +++ b/hw/9pfs/9p.c @@ -4505,8 +4505,8 @@ int v9fs_device_realize_common(V9fsState *s, const V9= fsTransport *t, =20 s->reclaiming =3D false; =20 - /* init xattr FID limit */ - s->ctx.xattr_fid_limit =3D V9FS_MAX_XATTR_DEFAULT; + /* init xattr FID limit from fsdev config */ + s->ctx.xattr_fid_limit =3D fse->max_xattr; s->ctx.xattr_fid_count =3D 0; =20 rc =3D 0; diff --git a/system/vl.c b/system/vl.c index 246623b3196..806327bd39a 100644 --- a/system/vl.c +++ b/system/vl.c @@ -3254,7 +3254,7 @@ void qemu_init(int argc, char **argv) QemuOpts *fsdev; QemuOpts *device; const char *writeout, *sock_fd, *socket, *path, *security_= model, - *multidevs; + *multidevs, *max_xattr_str; =20 olist =3D qemu_find_opts("virtfs"); if (!olist) { @@ -3318,6 +3318,11 @@ void qemu_init(int argc, char **argv) if (multidevs) { qemu_opt_set(fsdev, "multidevs", multidevs, &error_abo= rt); } + max_xattr_str =3D qemu_opt_get(opts, "max_xattr"); + if (max_xattr_str) { + qemu_opt_set(fsdev, "max_xattr", max_xattr_str, + &error_abort); + } device =3D qemu_opts_create(qemu_find_opts("device"), NULL= , 0, &error_abort); qemu_opt_set(device, "driver", "virtio-9p-pci", &error_abo= rt); --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807251; cv=none; d=zohomail.com; s=zohoarc; b=OqW9YDiLjEcPjkMIpxfd8QfnxtwWqTuWM48qvtwLW9jTLSPcBIJnEuEgFysYFyIvFAhehpG6syqZu+fuTB/SPHXb9ThFEVkM1O44bYOSKoOcaBYGv2Ua1vuqQvBuVaENUEuhwpXw5wa9HfU+PUFcUNMNYNlBuZsNbvQxc53V7ec= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807251; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=NDWNk+LVTkUDgES4BysoclDxSgeatl6OFksRY6O888M=; b=gZkbVBWnu/pp8CQ8vE4jnP1iH2DYTfdMpf7xuWh2ld+ordnxzg26wIo5vtOcUV3gwRzvQNO/Kh3UCGtbh9awg++xF7oOLOYvW8pgC8RKB08DiaXG7oFFcAYhdfryqIv9YdJlVwkpcNG9OkkT+mnqOOnP7MboKtSBgf2m75ktR14= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807251133935.8022867077372; Sat, 11 Jul 2026 15:00:51 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifkY-0002aj-Qd; Sat, 11 Jul 2026 18:00:43 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifkU-0002GV-Tr; Sat, 11 Jul 2026 18:00:39 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifkP-0008AI-5O; Sat, 11 Jul 2026 18:00:37 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 56FA51C0A99; Sun, 12 Jul 2026 00:59:40 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 0E6023EAF24; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 5719B132FF; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807180; bh=pxDuuSeHf+BpQIqipgqsZhUzVRlRReP9NdEJlc9meG4=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Ul0aZZw07fHIntxFY6yX9TQqwko+Ts4qJlZJvMfWdp9gcL7gB0Q+VQVuOTpXNaQfo OSkCh74/EuzYennND6C8opNOGvJanY88VbAl9yBKf5QTHpJddB1O7QBMU+3RXyzhY/ Mfzbi9wjw5dvjpJ3gOpM6x8NghAkl0ixajTRH28PoGL0FYRLbsOXw9yYX5as5VNEtx Y5nPmsLVinsLkDvX7b2nAMzOt2BA74EOPvNsW5Zo9YM1I2+BIs6zum18iZZ/TBf5+/ 3xjp6/Hr7Ft8TOF+DOe/jRzS+jOEGrd+4XOcZ76zFC1+dJKaijkMGp9tgTM0nla3Dz i60cYvRT6Ypag== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Christian Schoenebeck , Michael Tokarev Subject: [Stable-11.0.3 14/81] qemu-options: document 9pfs max_xattr option Date: Sun, 12 Jul 2026 00:57:52 +0300 Message-ID: <20260711215904.3757-14-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807253350154100 Content-Type: text/plain; charset="utf-8" From: Christian Schoenebeck Add documentation for the new "max_xattr" command line option of 9pfs server, introduced by the previous commit. Link: https://lore.kernel.org/qemu-devel/b5a1a6ba299a49183d0032d9e4cd5e009d= 4aae47.1781361555.git.qemu_oss@crudebyte.com Signed-off-by: Christian Schoenebeck (cherry picked from commit 44cb540d2d079ce2c785b130e163ab42b9e1a109) Signed-off-by: Michael Tokarev diff --git a/qemu-options.hx b/qemu-options.hx index 21972f83268..df6d841eeaf 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -1914,19 +1914,19 @@ ERST =20 DEF("fsdev", HAS_ARG, QEMU_OPTION_fsdev, "-fsdev local,id=3Did,path=3Dpath,security_model=3Dmapped-xattr|mapped= -file|passthrough|none\n" - " [,writeout=3Dimmediate][,readonly=3Don][,fmode=3Dfmode][,dmode=3Ddmo= de]\n" + " [,writeout=3Dimmediate][,readonly=3Don][,fmode=3Dfmode][,dmode=3Ddmo= de][,max_xattr=3Dmax]\n" " [[,throttling.bps-total=3Db]|[[,throttling.bps-read=3Dr][,throttling= .bps-write=3Dw]]]\n" " [[,throttling.iops-total=3Di]|[[,throttling.iops-read=3Dr][,throttli= ng.iops-write=3Dw]]]\n" " [[,throttling.bps-total-max=3Dbm]|[[,throttling.bps-read-max=3Drm][,= throttling.bps-write-max=3Dwm]]]\n" " [[,throttling.iops-total-max=3Dim]|[[,throttling.iops-read-max=3Dirm= ][,throttling.iops-write-max=3Diwm]]]\n" " [[,throttling.iops-size=3Dis]]\n" - "-fsdev synth,id=3Did\n", + "-fsdev synth,id=3Did[,max_xattr=3Dmax]\n", QEMU_ARCH_ALL) =20 SRST -``-fsdev local,id=3Did,path=3Dpath,security_model=3Dsecurity_model [,write= out=3Dwriteout][,readonly=3Don][,fmode=3Dfmode][,dmode=3Ddmode] [,throttlin= g.option=3Dvalue[,throttling.option=3Dvalue[,...]]]`` +``-fsdev local,id=3Did,path=3Dpath,security_model=3Dsecurity_model [,write= out=3Dwriteout][,readonly=3Don][,fmode=3Dfmode][,dmode=3Ddmode][,max_xattr= =3Dmax] [,throttling.option=3Dvalue[,throttling.option=3Dvalue[,...]]]`` \=20 -``-fsdev synth,id=3Did[,readonly=3Don]`` +``-fsdev synth,id=3Did[,readonly=3Don][,max_xattr=3Dmax]`` Define a new file system device. Valid options are: =20 ``local`` @@ -2000,6 +2000,12 @@ SRST Let every is bytes of a request count as a new request for iops throttling purposes. =20 + ``max_xattr=3Dmax`` + Specifies the maximum number of concurrent xattr FIDs allowed for + this export. The default is 1024. Set to 0 for allowing an infinite + number of xattr FIDs. This limit prevents host memory exhaustion + attacks by capping the number of simultaneous xattr FIDs. + -fsdev option is used along with -device driver "virtio-9p-...". =20 ``-device virtio-9p-type,fsdev=3Did,mount_tag=3Dmount_tag`` @@ -2019,14 +2025,14 @@ ERST =20 DEF("virtfs", HAS_ARG, QEMU_OPTION_virtfs, "-virtfs local,path=3Dpath,mount_tag=3Dtag,security_model=3Dmapped-xat= tr|mapped-file|passthrough|none\n" - " [,id=3Did][,writeout=3Dimmediate][,readonly=3Don][,fmode=3Dfm= ode][,dmode=3Ddmode][,multidevs=3Dremap|forbid|warn]\n" - "-virtfs synth,mount_tag=3Dtag[,id=3Did][,readonly=3Don]\n", + " [,id=3Did][,writeout=3Dimmediate][,readonly=3Don][,fmode=3Dfm= ode][,dmode=3Ddmode][,multidevs=3Dremap|forbid|warn][,max_xattr=3Dmax]\n" + "-virtfs synth,mount_tag=3Dtag[,id=3Did][,readonly=3Don][,max_xattr=3D= max]\n", QEMU_ARCH_ALL) =20 SRST -``-virtfs local,path=3Dpath,mount_tag=3Dmount_tag ,security_model=3Dsecuri= ty_model[,writeout=3Dwriteout][,readonly=3Don] [,fmode=3Dfmode][,dmode=3Ddm= ode][,multidevs=3Dmultidevs]`` +``-virtfs local,path=3Dpath,mount_tag=3Dmount_tag ,security_model=3Dsecuri= ty_model[,writeout=3Dwriteout][,readonly=3Don] [,fmode=3Dfmode][,dmode=3Ddm= ode][,multidevs=3Dmultidevs][,max_xattr=3Dmax]`` \=20 -``-virtfs synth,mount_tag=3Dmount_tag`` +``-virtfs synth,mount_tag=3Dmount_tag[,max_xattr=3Dmax]`` Define a new virtual filesystem device and expose it to the guest using a virtio-9p-device (a.k.a. 9pfs), which essentially means that a certa= in directory on host is made directly accessible by guest as a pass-throu= gh @@ -2092,6 +2098,12 @@ SRST Specifies the tag name to be used by the guest to mount this export point. =20 + ``max_xattr=3Dmax`` + Specifies the maximum number of concurrent xattr FIDs allowed for + this export. The default is 1024. Set to 0 for allowing an infinite + number of xattr FIDs. This limit prevents host memory exhaustion + attacks by capping the number of simultaneous xattr FIDs. + ``multidevs=3Dremap|forbid|warn`` Specifies how to deal with multiple devices being shared with the same 9p export in order to avoid file ID collisions on guest. --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807293; cv=none; d=zohomail.com; s=zohoarc; b=ETPCjNJDHInfZzpwife5ExkGIGZFGZFB2Flq0MT6qmrT5P3/xduPyArR9QnynxE/upe3DFQQWl+Uf+sLTwcKptwSvXtby0RncAx2eVh3cKmOH6eBr5qyoKKz8lD2EYGo/MegnznC7o7qopemwJuf57u/gQqRLsC6LRxlJutLF9k= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807293; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=Ye8RQolanFO/iqbdbEUDWqrxDGD4qJI1+L4LbJwMSF0=; b=C00sSGcTTtzQxc1jcanFr5+28IXnKGzsIKLqoUUuDDpm2RTBa4OvypWbL4qecGXGdKgRnua7LRLlkROvnJ3cO8AvIXWvSSpn+hhcVugZupAgxu6SVul/T4bPXkhe5fLmx8StJiRQcOsK7IaHr7lrySZWawx6EAdMOVcGcb8v9aA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 178380729300017.161152519619122; Sat, 11 Jul 2026 15:01:33 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifka-0002gJ-FF; Sat, 11 Jul 2026 18:00:44 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifkX-0002Qk-Ga; Sat, 11 Jul 2026 18:00:41 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifkV-0008Af-2f; Sat, 11 Jul 2026 18:00:41 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 5D5DA1C0A9A; Sun, 12 Jul 2026 00:59:40 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 14BC83EAF25; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 5960713301; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807180; bh=/+WpNnVQ+IZvhaql9T8ymGudEPU9tsQcGKEBkw9XzRo=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=o6Qub/tacWylghJCyhk/X9xn1BioEDsqecxoIWYVq7BsfVv1h/leILilLGcRHTPVj 3kNNXmU8+YTct17Rhhz3Xdtk2bGnzvxD+sj3dA/nR3ffTtpdJRLHK1OcNNdkVaaTT4 w9JHmlx3gAwNbRSc3p3OnpJFgXArLJWvyGjgkkWMb2BV+8ZvPtyOp6ULOgpmgXGDVi 1UgaLaSfT1Uu9JHFyVvEK5y5HhEGxmQ/IV/KVk4ZQ6Wd/A8GF619wE7Vy05+MQKHFe FyWbyIOK42uATUPqE3e513E8sHAhfl9U+FgnSjHbgIBzhc1pUDBMIbQZy0NnNYkvmf vvmfNbjQiNCeA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Christian Schoenebeck , Michael Tokarev Subject: [Stable-11.0.3 15/81] tests/9p: add Tread / Rread test client functions Date: Sun, 12 Jul 2026 00:57:53 +0300 Message-ID: <20260711215904.3757-15-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807296115154100 Content-Type: text/plain; charset="utf-8" From: Christian Schoenebeck Add v9fs_tread() and v9fs_rread() functions to the 9P test client for reading files from 9pfs server in test cases. Link: https://lore.kernel.org/qemu-devel/049bdd1e66416f5200fb3d59d2da5e8ec1= 49926d.1781361555.git.qemu_oss@crudebyte.com Signed-off-by: Christian Schoenebeck (cherry picked from commit 54b8f64c422d0ed6d992387f0de419420cdb9fea) Signed-off-by: Michael Tokarev diff --git a/tests/qtest/libqos/virtio-9p-client.c b/tests/qtest/libqos/vir= tio-9p-client.c index af01d4c3458..b9785ef8cb7 100644 --- a/tests/qtest/libqos/virtio-9p-client.c +++ b/tests/qtest/libqos/virtio-9p-client.c @@ -241,6 +241,7 @@ static const char *rmessage_name(uint8_t id) id =3D=3D P9_RUNLINKAT ? "RUNLINKAT" : id =3D=3D P9_RFLUSH ? "RFLUSH" : id =3D=3D P9_RREADDIR ? "RREADDIR" : + id =3D=3D P9_RREAD ? "RREAD" : ""; } =20 @@ -1103,3 +1104,47 @@ void v9fs_runlinkat(P9Req *req) v9fs_req_recv(req, P9_RUNLINKAT); v9fs_req_free(req); } + +/* size[4] Tread tag[2] fid[4] offset[8] count[4] */ +TReadRes v9fs_tread(TReadOpt opt) +{ + P9Req *req; + uint32_t err; + + g_assert(opt.client); + + uint32_t body_size =3D 4 + 8 + 4; + + req =3D v9fs_req_init(opt.client, body_size, P9_TREAD, opt.tag); + v9fs_uint32_write(req, opt.fid); + v9fs_uint64_write(req, opt.offset); + v9fs_uint32_write(req, opt.count); + v9fs_req_send(req); + + if (!opt.requestOnly) { + v9fs_req_wait_for_reply(req, NULL); + if (opt.expectErr) { + v9fs_rlerror(req, &err); + g_assert_cmpint(err, =3D=3D, opt.expectErr); + } else { + v9fs_rread(req, opt.rread.count, opt.rread.data); + } + req =3D NULL; /* request was freed */ + } + + return (TReadRes) { + .req =3D req, + .count =3D opt.rread.count ? *opt.rread.count : 0 + }; +} + +/* size[4] Rread tag[2] count[4] data[count] */ +void v9fs_rread(P9Req *req, uint32_t *count, void *data) +{ + v9fs_req_recv(req, P9_RREAD); + v9fs_uint32_read(req, count); + if (data && *count > 0) { + v9fs_memread(req, data, *count); + } + v9fs_req_free(req); +} diff --git a/tests/qtest/libqos/virtio-9p-client.h b/tests/qtest/libqos/vir= tio-9p-client.h index e3221a31041..37f2517cff1 100644 --- a/tests/qtest/libqos/virtio-9p-client.h +++ b/tests/qtest/libqos/virtio-9p-client.h @@ -473,6 +473,37 @@ typedef struct TunlinkatRes { P9Req *req; } TunlinkatRes; =20 +/* options for 'Tread' 9p request */ +typedef struct TReadOpt { + /* 9P client being used (mandatory) */ + QVirtio9P *client; + /* user supplied tag number being returned with response (optional) */ + uint16_t tag; + /* file ID of file to read from (required) */ + uint32_t fid; + /* start position of read from beginning of file (optional) */ + uint64_t offset; + /* how many bytes to read (required) */ + uint32_t count; + /* data being received from 9p server as 'Rread' response (optional) */ + struct { + uint32_t *count; + void *data; + } rread; + /* only send Tread request but not wait for a reply? (optional) */ + bool requestOnly; + /* do we expect an Rlerror response, if yes which error code? (optiona= l) */ + uint32_t expectErr; +} TReadOpt; + +/* result of 'Tread' 9p request */ +typedef struct TReadRes { + /* if requestOnly was set: request object for further processing */ + P9Req *req; + /* amount of bytes read */ + uint32_t count; +} TReadRes; + void v9fs_set_allocator(QGuestAllocator *t_alloc); void v9fs_memwrite(P9Req *req, const void *addr, size_t len); void v9fs_memskip(P9Req *req, size_t len); @@ -524,5 +555,7 @@ TlinkRes v9fs_tlink(TlinkOpt); void v9fs_rlink(P9Req *req); TunlinkatRes v9fs_tunlinkat(TunlinkatOpt); void v9fs_runlinkat(P9Req *req); +TReadRes v9fs_tread(TReadOpt opt); +void v9fs_rread(P9Req *req, uint32_t *count, void *data); =20 #endif diff --git a/tests/qtest/virtio-9p-test.c b/tests/qtest/virtio-9p-test.c index 1c69d41e332..8ccec77e706 100644 --- a/tests/qtest/virtio-9p-test.c +++ b/tests/qtest/virtio-9p-test.c @@ -31,6 +31,7 @@ #define tsymlink(...) v9fs_tsymlink((TsymlinkOpt) __VA_ARGS__) #define tlink(...) v9fs_tlink((TlinkOpt) __VA_ARGS__) #define tunlinkat(...) v9fs_tunlinkat((TunlinkatOpt) __VA_ARGS__) +#define tread(...) v9fs_tread((TReadOpt) __VA_ARGS__) =20 static void pci_config(void *obj, void *data, QGuestAllocator *t_alloc) { --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807295; cv=none; d=zohomail.com; s=zohoarc; b=cLlWE43bUVaKydzua3ebYsDHKts/o29KSUCpHjakZCe0EJNEcV6SmmTOqOXxKXGKDIV4ZIw0K/3CVuf8Kyx1EI9+XYlTJBS2oT1sHGEXsHBrMNNU2ys2khQYQcUyaK26WWMothqTNOGrWPPGyrvmuyr1M9lxn09g+4QCiqpa6x0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807295; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=OTPcR1w3HLzlL0uaTy3JHyXkhVKNm6TjH4aXCNCphyw=; b=ldwrWOF3mA3hyOQ/Lok6OPIt+dNIp3ow3EdrF3rKUcXDk9XsThmlWxo3BEo1qyf5JsFvoj5kbtJhUYn+8a0cct53XZ3n4UMXImTP6dfDPKJZ9qNEVpl3U7VPI4h2oDCWJyXeR+qd5PvhdLv61Uag5I/ZifOaiQU00ITCmMWEJC4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807295848709.5464254925275; Sat, 11 Jul 2026 15:01:35 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifkc-0002rK-PD; Sat, 11 Jul 2026 18:00:46 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifkY-0002UX-D5; Sat, 11 Jul 2026 18:00:42 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifkW-0008BM-De; Sat, 11 Jul 2026 18:00:42 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 63F7D1C0A9B; Sun, 12 Jul 2026 00:59:40 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 1AC863EAF26; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 5BB5113303; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807180; bh=xA2Gopna+kxDiA387Lx+Wiz1oEVOGKXE6yw2AYBa9xk=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=AzcZ2V5ObcPuOnZIOP3Zm6/uTyRwVcYlcl/gJ04GrIEbzokqrcJlhUBLNa4GzbF6a n5SQkTaVT4I/+c95bkRwZA/JW44+eUezLB+/eGAKWekaeE2QS4GqLj6U8onB5hOjz/ AYLYekCU89g2U5LEqc8RQDFRilOBRNCN2jpJgDDEGqHR7gY1BGKpwqsFWUMFbe8wf7 Rv/pmq74NTle8jVKWNr3craRgXNlYD6X7Tfnn0caAS/DClTWBlxRFJUmJmNzKJC8Mq YNhOK5MSUkhFrpDhl+7TsY3NiRjzFBBpmLF8VXM+j7qwz+3iN8V7QlsnQ0BJRtSk3X fD81gzgfIuSTQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Christian Schoenebeck , Michael Tokarev Subject: [Stable-11.0.3 16/81] tests/9p: add Tclunk / Rclunk test client functions Date: Sun, 12 Jul 2026 00:57:54 +0300 Message-ID: <20260711215904.3757-16-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807297950154100 Content-Type: text/plain; charset="utf-8" From: Christian Schoenebeck Add v9fs_tclunk() and v9fs_rclunk() functions to the 9P test client for closing file handles (or "FIDs") in test cases. Link: https://lore.kernel.org/qemu-devel/d53f0337eb7f8525a14e394599d809ecf6= 805e5e.1781361555.git.qemu_oss@crudebyte.com Signed-off-by: Christian Schoenebeck (cherry picked from commit c46150530b3dd6370affa3422f2175ac4668836a) Signed-off-by: Michael Tokarev diff --git a/tests/qtest/libqos/virtio-9p-client.c b/tests/qtest/libqos/vir= tio-9p-client.c index b9785ef8cb7..83af6dab5d1 100644 --- a/tests/qtest/libqos/virtio-9p-client.c +++ b/tests/qtest/libqos/virtio-9p-client.c @@ -242,6 +242,7 @@ static const char *rmessage_name(uint8_t id) id =3D=3D P9_RFLUSH ? "RFLUSH" : id =3D=3D P9_RREADDIR ? "RREADDIR" : id =3D=3D P9_RREAD ? "RREAD" : + id =3D=3D P9_RCLUNK ? "RCLUNK" : ""; } =20 @@ -1148,3 +1149,36 @@ void v9fs_rread(P9Req *req, uint32_t *count, void *d= ata) } v9fs_req_free(req); } + +/* size[4] Tclunk tag[2] fid[4] */ +TClunkRes v9fs_tclunk(TClunkOpt opt) +{ + P9Req *req; + uint32_t err; + + g_assert(opt.client); + + req =3D v9fs_req_init(opt.client, 4, P9_TCLUNK, opt.tag); + v9fs_uint32_write(req, opt.fid); + v9fs_req_send(req); + + if (!opt.requestOnly) { + v9fs_req_wait_for_reply(req, NULL); + if (opt.expectErr) { + v9fs_rlerror(req, &err); + g_assert_cmpint(err, =3D=3D, opt.expectErr); + } else { + v9fs_rclunk(req); + } + req =3D NULL; /* request was freed */ + } + + return (TClunkRes) { .req =3D req }; +} + +/* size[4] Rclunk tag[2] */ +void v9fs_rclunk(P9Req *req) +{ + v9fs_req_recv(req, P9_RCLUNK); + v9fs_req_free(req); +} diff --git a/tests/qtest/libqos/virtio-9p-client.h b/tests/qtest/libqos/vir= tio-9p-client.h index 37f2517cff1..f7ef7f00679 100644 --- a/tests/qtest/libqos/virtio-9p-client.h +++ b/tests/qtest/libqos/virtio-9p-client.h @@ -504,6 +504,26 @@ typedef struct TReadRes { uint32_t count; } TReadRes; =20 +/* options for 'Tclunk' 9p request */ +typedef struct TClunkOpt { + /* 9P client being used (mandatory) */ + QVirtio9P *client; + /* user supplied tag number being returned with response (optional) */ + uint16_t tag; + /* file ID to clunk (required) */ + uint32_t fid; + /* only send Tclunk request but not wait for a reply? (optional) */ + bool requestOnly; + /* do we expect an Rlerror response, if yes which error code? (optiona= l) */ + uint32_t expectErr; +} TClunkOpt; + +/* result of 'Tclunk' 9p request */ +typedef struct TClunkRes { + /* if requestOnly was set: request object for further processing */ + P9Req *req; +} TClunkRes; + void v9fs_set_allocator(QGuestAllocator *t_alloc); void v9fs_memwrite(P9Req *req, const void *addr, size_t len); void v9fs_memskip(P9Req *req, size_t len); @@ -557,5 +577,7 @@ TunlinkatRes v9fs_tunlinkat(TunlinkatOpt); void v9fs_runlinkat(P9Req *req); TReadRes v9fs_tread(TReadOpt opt); void v9fs_rread(P9Req *req, uint32_t *count, void *data); +TClunkRes v9fs_tclunk(TClunkOpt opt); +void v9fs_rclunk(P9Req *req); =20 #endif diff --git a/tests/qtest/virtio-9p-test.c b/tests/qtest/virtio-9p-test.c index 8ccec77e706..099c5e0ca05 100644 --- a/tests/qtest/virtio-9p-test.c +++ b/tests/qtest/virtio-9p-test.c @@ -32,6 +32,7 @@ #define tlink(...) v9fs_tlink((TlinkOpt) __VA_ARGS__) #define tunlinkat(...) v9fs_tunlinkat((TunlinkatOpt) __VA_ARGS__) #define tread(...) v9fs_tread((TReadOpt) __VA_ARGS__) +#define tclunk(...) v9fs_tclunk((TClunkOpt) __VA_ARGS__) =20 static void pci_config(void *obj, void *data, QGuestAllocator *t_alloc) { --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807647; cv=none; d=zohomail.com; s=zohoarc; b=eRnmcnt2jUJ3m9iL8hTAHy6ntKfapfO/tn2Fom529VMJlEOonDyRa5BapRLtxb0f+AUvf1kyeyrBOxNVvMHak708F9CWV8sQwyXvFpQ6oLUgS2HS6PRDwt+Ibrv/TlkXCa3Yvvb2b6PGWqib0CPAvDC5/3I9wbSZh1cbAYnJ3Fs= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807647; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=QcxW2f4n9+ZROZdw5tXhkzTmobkJM02Kgg6X2fXtQMk=; b=bI6xO8KHs3M2HlgfpRX/poazW21OzEOEuwcBMirUiTdTs54LUtF7/t3iTrzqUGw83ztD5oSerLx2RHiJWYY4VKFCbuSWMhBNc0WwucJQma4igeqXNux4Y0sleN8mCqt1ofWe/P13oflBxKjtKajxzbmhZ9lg4h8B39Cu7vmMbYU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807647564319.42687304396645; Sat, 11 Jul 2026 15:07:27 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifkx-0003rq-Ae; Sat, 11 Jul 2026 18:01:07 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifku-0003jl-RE; Sat, 11 Jul 2026 18:01:04 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifkt-0008Bm-0j; Sat, 11 Jul 2026 18:01:04 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 6D9031C0A9C; Sun, 12 Jul 2026 00:59:40 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 2258E3EAF27; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 5DEE913305; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807180; bh=9UdAnkZwEqHrYu4VUtdYR8CUvmU8vYUaplzEWlVnJMU=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=onYuOlpPmmGOD9r/V5Qa0YTZTiegnFXycc33PIYqW7XfGhflAZIvX9FgYGBT8RttQ o7roEQeMQbRIA77tN+ql30C7/1vBMNRVXOtSH7vCMD2xctl53rL6hhCoAragbxr+ze ZKxdpPd/Hjhlay+KV1Z9ElfKmxn7823h/bMpDtlL8cpSpd+Txw3942uyT3hJf8KN22 4MHQJOuoKx3IQZPPVKciInybj5MjwOF9M8cFUP1drQ24wRi8cqQDwD9VryEjNn0oVT mnnz/6bioHWLJZ6tza5s5Gtb5NFSe+vOe55SWh6CPQAcMtV53tRTf1t2J+ZaCH96Df gFg8sev9Xclag== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Christian Schoenebeck , Michael Tokarev Subject: [Stable-11.0.3 17/81] tests/9p: add Txattrcreate / Rxattrcreate test client functions Date: Sun, 12 Jul 2026 00:57:55 +0300 Message-ID: <20260711215904.3757-17-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807648938154100 Content-Type: text/plain; charset="utf-8" From: Christian Schoenebeck Add v9fs_txattrcreate() and v9fs_rxattrcreate() functions to the 9P test client for testing creation of xattrs with 9pfs server. Link: https://lore.kernel.org/qemu-devel/5dbc5061dab1f7829fffc40bf89d7ff443= e4bcab.1781361555.git.qemu_oss@crudebyte.com Signed-off-by: Christian Schoenebeck (cherry picked from commit 7664feb26fef19caa4d72e07a9097fa625b593e5) Signed-off-by: Michael Tokarev diff --git a/tests/qtest/libqos/virtio-9p-client.c b/tests/qtest/libqos/vir= tio-9p-client.c index 83af6dab5d1..305b0dac63a 100644 --- a/tests/qtest/libqos/virtio-9p-client.c +++ b/tests/qtest/libqos/virtio-9p-client.c @@ -243,6 +243,7 @@ static const char *rmessage_name(uint8_t id) id =3D=3D P9_RREADDIR ? "RREADDIR" : id =3D=3D P9_RREAD ? "RREAD" : id =3D=3D P9_RCLUNK ? "RCLUNK" : + id =3D=3D P9_RXATTRCREATE ? "RXATTRCREATE" : ""; } =20 @@ -1182,3 +1183,47 @@ void v9fs_rclunk(P9Req *req) v9fs_req_recv(req, P9_RCLUNK); v9fs_req_free(req); } + +/* size[4] Txattrcreate tag[2] fid[4] name[s] attr_size[8] flags[4] */ +TXattrCreateRes v9fs_txattrcreate(TXattrCreateOpt opt) +{ + P9Req *req; + uint32_t err; + + g_assert(opt.client); + g_assert(opt.name); + + uint32_t body_size =3D 4 + 8 + 4; + uint16_t string_size =3D v9fs_string_size(opt.name); + + g_assert_cmpint(body_size, <=3D, UINT32_MAX - string_size); + body_size +=3D string_size; + + req =3D v9fs_req_init(opt.client, body_size, P9_TXATTRCREATE, opt.tag); + v9fs_uint32_write(req, opt.fid); + v9fs_string_write(req, opt.name); + v9fs_uint64_write(req, opt.size); + v9fs_uint32_write(req, opt.flags); + v9fs_req_send(req); + + err =3D 0; + if (!opt.requestOnly) { + v9fs_req_wait_for_reply(req, NULL); + if (opt.expectErr) { + v9fs_rlerror(req, &err); + g_assert_cmpint(err, =3D=3D, opt.expectErr); + } else { + v9fs_rxattrcreate(req); + } + req =3D NULL; /* request was freed */ + } + + return (TXattrCreateRes) { .req =3D req, .err =3D err }; +} + +/* size[4] Rxattrcreate tag[2] */ +void v9fs_rxattrcreate(P9Req *req) +{ + v9fs_req_recv(req, P9_RXATTRCREATE); + v9fs_req_free(req); +} diff --git a/tests/qtest/libqos/virtio-9p-client.h b/tests/qtest/libqos/vir= tio-9p-client.h index f7ef7f00679..c432b0daee4 100644 --- a/tests/qtest/libqos/virtio-9p-client.h +++ b/tests/qtest/libqos/virtio-9p-client.h @@ -524,6 +524,34 @@ typedef struct TClunkRes { P9Req *req; } TClunkRes; =20 +/* options for 'Txattrcreate' 9p request */ +typedef struct TXattrCreateOpt { + /* 9P client being used (mandatory) */ + QVirtio9P *client; + /* user supplied tag number being returned with response (optional) */ + uint16_t tag; + /* file ID to convert to xattr fid (required) */ + uint32_t fid; + /* name of the xattr (required) */ + const char *name; + /* size of the xattr value (required) */ + uint64_t size; + /* flags: P9_XATTR_CREATE or P9_XATTR_REPLACE (optional) */ + uint32_t flags; + /* only send Txattrcreate request but not wait for a reply? (optional)= */ + bool requestOnly; + /* do we expect an Rlerror response, if yes which error code? (optiona= l) */ + uint32_t expectErr; +} TXattrCreateOpt; + +/* result of 'Txattrcreate' 9p request */ +typedef struct TXattrCreateRes { + /* if requestOnly was set: request object for further processing */ + P9Req *req; + /* error code if Rlerror received */ + uint32_t err; +} TXattrCreateRes; + void v9fs_set_allocator(QGuestAllocator *t_alloc); void v9fs_memwrite(P9Req *req, const void *addr, size_t len); void v9fs_memskip(P9Req *req, size_t len); @@ -579,5 +607,7 @@ TReadRes v9fs_tread(TReadOpt opt); void v9fs_rread(P9Req *req, uint32_t *count, void *data); TClunkRes v9fs_tclunk(TClunkOpt opt); void v9fs_rclunk(P9Req *req); +TXattrCreateRes v9fs_txattrcreate(TXattrCreateOpt opt); +void v9fs_rxattrcreate(P9Req *req); =20 #endif diff --git a/tests/qtest/virtio-9p-test.c b/tests/qtest/virtio-9p-test.c index 099c5e0ca05..99a897b1585 100644 --- a/tests/qtest/virtio-9p-test.c +++ b/tests/qtest/virtio-9p-test.c @@ -33,6 +33,7 @@ #define tunlinkat(...) v9fs_tunlinkat((TunlinkatOpt) __VA_ARGS__) #define tread(...) v9fs_tread((TReadOpt) __VA_ARGS__) #define tclunk(...) v9fs_tclunk((TClunkOpt) __VA_ARGS__) +#define txattrcreate(...) v9fs_txattrcreate((TXattrCreateOpt) __VA_ARGS__) =20 static void pci_config(void *obj, void *data, QGuestAllocator *t_alloc) { --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807593; cv=none; d=zohomail.com; s=zohoarc; b=KlJyoRR0LOqjEl3mtX6npAEaFkx3Zy9FNfU7OeKql3TNmO7Q+V4iZZHxHZrki87EhCkmPXT07etEnf19EFBkpKOfU1kOiDgzVdcVadrmieRmOR13CxuXoJL7btxj/D3UFkE21pz30Ac5NuNaF3J3busXCzgXWQiy1HVZ4xlnAG0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807593; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=LLfj2WoueeW0u12HawcgO2inBpHVCoDJIGi8oa06quY=; b=CwTq+zQD2yUrOuZfaF+inJZl7luDEq1jciZB2zheQm4m6dN6g8Zpl2byhuHMY7PHbAYrOOQVgk04oOFd+8LUToxlC5vr5PjuGUp4GxujTjb/R1YYhp4ZW9WSld7WB3x2jhfGQjYajlPveaFRtcUeMR6goe+mffOntQ91W8ekDbM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807593418808.3791622337982; Sat, 11 Jul 2026 15:06:33 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifky-0003uw-AF; Sat, 11 Jul 2026 18:01:08 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifkv-0003mP-Ro; Sat, 11 Jul 2026 18:01:06 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifkt-0008Bw-Rq; Sat, 11 Jul 2026 18:01:05 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 7AC961C0A9D; Sun, 12 Jul 2026 00:59:40 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 324973EAF28; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 601F513307; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807180; bh=mgz9KPo36yVybz3BRKy7LOPgUWf/XYfzKKRqtf9ovaw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=ARYLCBjr5x8ZENIqs0z7Hp4qMTsEkay/JufTLDS8rXJx8akGkDShtULvhvO2O4DAN 1Qu8nNN+AJ2xAtBx2682B0WnJg/678EBFhc+5I/6OW3Oht2T2vmmGwpT822PDvHpZG mtV8KyQ3w4ilFcIUvYIFVod4IGiwEK7FcDjXQjl+4upIX25FMr+Y4D0x+FFPthH4QD 7uaZ/kEHuMgFn4Yq+qj7IaGGvkEu5Ww1pxf7O+zkgzas9Pu8bVRGdzYZJo7BJx0EfF LQkbro3IWBe7giy17/KmGAvo0FaXm8IMimAnXEVKcyRKFyO+WHG3a48zaTrRftKZqe DCjlNhOmpqcGw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Christian Schoenebeck , Michael Tokarev Subject: [Stable-11.0.3 18/81] hw/9pfs: enable xattr (mockup) support for synth fs driver Date: Sun, 12 Jul 2026 00:57:56 +0300 Message-ID: <20260711215904.3757-18-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807594308154100 Content-Type: text/plain; charset="utf-8" From: Christian Schoenebeck The synth backend is used for testing only. Enable xattr operations by making lsetxattr and lremovexattr callbacks to return success result. They are still actually not doing anything, they just pretend to be working to prevent 9pfs server from erroring out on xattr requests. This allows the subsequent test case patches to verify xattr FID limit enforcement. Link: https://lore.kernel.org/qemu-devel/9c1c7128135f3bd9c2f62a3f64bb730b6a= 94ec7a.1781361555.git.qemu_oss@crudebyte.com Signed-off-by: Christian Schoenebeck (cherry picked from commit 0e3085ddc7fb137b727829913c20ad9d08577bdb) Signed-off-by: Michael Tokarev diff --git a/hw/9pfs/9p-synth.c b/hw/9pfs/9p-synth.c index 322dc3bb690..4b0732e0936 100644 --- a/hw/9pfs/9p-synth.c +++ b/hw/9pfs/9p-synth.c @@ -477,15 +477,15 @@ static int synth_lsetxattr(FsContext *ctx, V9fsPath *= path, const char *name, void *value, size_t size, int flags) { - errno =3D ENOTSUP; - return -1; + /* pretend it worked */ + return 0; } =20 static int synth_lremovexattr(FsContext *ctx, V9fsPath *path, const char *name) { - errno =3D ENOTSUP; - return -1; + /* pretend it worked */ + return 0; } =20 static int synth_name_to_path(FsContext *ctx, V9fsPath *dir_path, --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807374; cv=none; d=zohomail.com; s=zohoarc; b=fUqCYmoXES5SoJyQChCmnnLG5Z+JmGs+xhnElUX/0jkukTXkfysn/dUaY3YFGSmANToVXOhv7Oa9zUwnVv1Ba5SvBtn371Ynx/qA+f4z36NL8+RtxpGuoc0pc7eraFsw+ffoBntMVYspABODzARx/KwFk/AVOnAv7d0SITBMTb4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807374; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=aJp7OV7eDepRwXByC4RKtMLRPHwiduhtcMPBAyN7C1c=; b=Qsg0zJUAYSv/LfHr8RcjTZsArNPI6JnwzJDxk4qTp3KI8/v3VuqiaNSiWbbl9Vzj3EejvAbRRkbW9fUdlxjm8XmRYuRlmoqQAyXVIuaWokTTUGrGFqREIZLRjaR93V8elJYBo2MtVFwJ/nUAY5zBsN17sCFuTMYYfry3datZFSg= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807374341227.34683976697897; Sat, 11 Jul 2026 15:02:54 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifl0-00042w-Ev; Sat, 11 Jul 2026 18:01:10 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifkx-0003uX-VS; Sat, 11 Jul 2026 18:01:07 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifkw-0008GD-9L; Sat, 11 Jul 2026 18:01:07 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 7FC041C0A9E; Sun, 12 Jul 2026 00:59:40 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 375AE3EAF29; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 6266113309; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807180; bh=N8fw3larQKBeYlCddhOQdJElfCUvvc4yPAFQsxc8eKg=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=ccxuQ5o75mnk1TKiQFXs/3yJ2x3Rm0aKN8spZUD+dKgz/j1zxH+v3vqUG1vykjO3S RZycMCO/Pzucmxpr90TOCrVzHQUlwHHziOPRUTTZiZjdMnWibTSbiq7WkJASfo46v+ /wREXSLHSomIaiIZVbm8jF3ID45dyiqa732nl7pyRfCRvQmp1YeU1bF+7Jwgp013Nb grlidIwfT5S5+fWoDyAiLiPXm+O26ws06IDoxtQ3Z1wKt2KLMSIKqteq2zrPW+7Mk8 g64PkqbxuNd9uiuXPj9f9b2D8iGll0wvluxxr17rGdN2jt+i055Yopxp5Mprc6xYXw Hd6xRXWCyae+w== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Christian Schoenebeck , Michael Tokarev Subject: [Stable-11.0.3 19/81] hw/9pfs: add xattr count query interface to fs synth driver Date: Sun, 12 Jul 2026 00:57:57 +0300 Message-ID: <20260711215904.3757-19-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807375044154100 Content-Type: text/plain; charset="utf-8" From: Christian Schoenebeck Add a synthetic "/stat/xattr_count" file path that, if being read by 9p client, returns the 9p server internal xattr FID counter to client. This allows to test and verify that the xattr FID limit is being enforced correctly. Link: https://lore.kernel.org/qemu-devel/357c20fc244c04dcbd36b13aa20a5c9b20= 34e9f0.1781361555.git.qemu_oss@crudebyte.com Signed-off-by: Christian Schoenebeck (cherry picked from commit 7e42d569a68aec6b0b6f1f068328c5c4ff20bc72) Signed-off-by: Michael Tokarev diff --git a/hw/9pfs/9p-synth.c b/hw/9pfs/9p-synth.c index 4b0732e0936..3b3654b2820 100644 --- a/hw/9pfs/9p-synth.c +++ b/hw/9pfs/9p-synth.c @@ -565,6 +565,19 @@ static ssize_t v9fs_synth_qtest_flush_write(void *buf,= int len, off_t offset, return 1; } =20 +/* transmits internal xattr counter to client */ +static ssize_t v9fs_synth_read_xattr_count(void *buf, int len, off_t offse= t, + void *arg) +{ + FsContext *ctx =3D arg; + size_t local_count =3D ctx->xattr_fid_count; + if (len < (int)sizeof(size_t)) { + return -ENOSPC; + } + memcpy(buf, &local_count, sizeof(size_t)); + return sizeof(size_t); +} + static int synth_init(FsContext *ctx, Error **errp) { QLIST_INIT(&synth_root.child); @@ -626,6 +639,19 @@ static int synth_init(FsContext *ctx, Error **errp) g_free(name); } } + + /* Directory for internal statistic queries */ + { + V9fsSynthNode *stat_dir =3D NULL; + ret =3D qemu_v9fs_synth_mkdir(NULL, 0755, "stat", &stat_dir); + assert(!ret); + + /* File for internal xattr count query */ + ret =3D qemu_v9fs_synth_add_file(stat_dir, 0444, "xattr_count", + v9fs_synth_read_xattr_count, + NULL, ctx); + assert(!ret); + } } =20 return 0; --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807427; cv=none; d=zohomail.com; s=zohoarc; b=VuvEJt/vHTaRiebKPbIdN8HnA6y/hyLFc0bikMrLxHC58/BGb7rAjZIIs+2OQMuxHIN+MaQaVDRlfNRzmyBeHEj2D097CwRvRT4Acwyrsh0KOpoF5S97QZpnB12qXraN8FZnlHwJogz7378T8OU+06yE0ETMEe9oRo6fTK8uEds= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807427; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=5vJx/IAQlcV9+23frDc3qdGXTL9nDOOnXC267XHImuY=; b=JXnF4vsst8E48vYStZTwyBtIU0sIOl/FVMPOchrQMwddReFnmwRvQo+F/BLi9ZQvpruzDLMc43Cd3oac6ZJicZdNvHdphGQlqmTEbZlxWcOr0GV1w5NvXlVggYNroZYBh9Y4Pax0yXp069a/LvBEmTPwTMBzmBiWk7Vt+sPRcDY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807427951143.12661312066928; Sat, 11 Jul 2026 15:03:47 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifl1-00046S-94; Sat, 11 Jul 2026 18:01:11 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifkz-0003x7-7S; Sat, 11 Jul 2026 18:01:09 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifkx-0008GV-C6; Sat, 11 Jul 2026 18:01:08 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 858041C0A9F; Sun, 12 Jul 2026 00:59:40 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 3C6AE3EAF2A; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 64AB61330B; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807180; bh=tKbQKlDOKGMFUfgf+hbmUB5/Y9LfVcWerKrcFBBY0gY=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=h016JflZobmKGlaUgL+znVy228BM1Wv1EUMtP8PX96NNQ4AJSrmQxomHKCSD5rwHE Mm4avxjcDkM3ybahfTFx7QRwxY29b3IQ28aZqF/+GDF/6UXqwr6rTYot2ja1K+nFmj wkT3aSDSlh3BmLc5hdCJN07x25IOT80lMDXs55fIWY7HJc6yfnIeTYV5FBoOJoICBC /qznQiHSvxf8m0qwdg+mhQ/P78dSwAWs7NpRtFkpq0bG5mAku33GXJAB6NHaZCgWC7 /eJ7KQh3BQ8gYeI9UNZnKwRDpJjJX4+ie4lRQfoFRlhY7WQhW0N2NiWcSIWrtri3sq k3y4MgZExwV3A== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Christian Schoenebeck , Michael Tokarev Subject: [Stable-11.0.3 20/81] tests/9p: increase P9_MAX_SIZE for test client Date: Sun, 12 Jul 2026 00:57:58 +0300 Message-ID: <20260711215904.3757-20-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807429839154100 Content-Type: text/plain; charset="utf-8" From: Christian Schoenebeck Increase the maximum 9P message size ('msize') of 9p test client from 4k to 32k to support larger messages. This is needed for the xattr tests being added with the subsequent patches which are going to transmit xattrs of size 8k. It would have also been possible to send them in multiple chunks, however let's not overcomplicate things. This new msize is still reasonable small compared to common msize values on production systems. Link: https://lore.kernel.org/qemu-devel/2dcb1243c80ea97d085af5171785850cf0= 12be36.1781361555.git.qemu_oss@crudebyte.com Signed-off-by: Christian Schoenebeck (cherry picked from commit df88255543667e7f14ac34d97e0ced142af18bdf) Signed-off-by: Michael Tokarev diff --git a/tests/qtest/libqos/virtio-9p-client.h b/tests/qtest/libqos/vir= tio-9p-client.h index c432b0daee4..4b043245034 100644 --- a/tests/qtest/libqos/virtio-9p-client.h +++ b/tests/qtest/libqos/virtio-9p-client.h @@ -21,7 +21,8 @@ #include "qgraph.h" #include "tests/qtest/libqtest-single.h" =20 -#define P9_MAX_SIZE 4096 /* Max size of a T-message or R-message */ +/* Max size of a T-message or R-message */ +#define P9_MAX_SIZE (32 * 1024) =20 typedef struct { QTestState *qts; --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807442; cv=none; d=zohomail.com; s=zohoarc; b=TMLujR7rgXIZVmZZDaGLkLPBuQoJ4AeJMZ04EoWyUGgGKX+S+CDDGF1U+XpJrB3Q1LHwUyxd+ceGJauchTuYD/nzBvqVtpxLA7yAzFyrCDc8TzGZoX+BYeHtmkZ4Me93cEpc/HpI+Bp745l5r168mUXVglLWVzB498LcrKTKr04= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807442; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=Tz50hIUdu0L+MYHqYN6GmvXwyD2hEkuyNZaAZlzlo5o=; b=dHs3O3yAH3G9SnlZKUx2akdUy3ZAQP+ZFbjVtEd4SXd6IsKyMASfVzvgnJlLN9e6KlvlODVafg4q9RH15FhripH2Z5o/2OlrjhPiSq9rwkHz6BuZrHwslWrw8RCmI+Y+NBl1vKoaY3p/9Hzz/Vpp8M57EwfviAJIW0pyeDpzOTQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807442500914.1046999994322; Sat, 11 Jul 2026 15:04:02 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifl3-0004Je-Hm; Sat, 11 Jul 2026 18:01:13 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifl1-00048L-EX; Sat, 11 Jul 2026 18:01:11 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifkz-0008Gr-EP; Sat, 11 Jul 2026 18:01:11 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 8BDD11C0AA0; Sun, 12 Jul 2026 00:59:40 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 424CC3EAF2B; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 670D91330D; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807180; bh=zubOijMCLi0QNYNubzThb5FX/Xsi0gKQolCwoOQOe9M=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Wd7ygo2n7wy/++kdlB4Zq82Uz6lK406Fgc6uiTQVt8y539kA1uGVC1L3u/BdiXtbE FtyC4Ys/WSAxH9oLUuQti5Nx53O00Fha8Lsh87EBreFH/+tZ111ML1s1SswXO5QoQG 5F8VRxAgn7elEm4kkVmSYOIx4qrJNIHCTS4PjAev1Dk167nhvdpA5C2ybaxhLdNVt6 OrQzye55KddXRgyFo26Dx8t95u1Yo2E4cX6JUTZsTFOIttxDIieTfYH0mdSMceiHwS C9fLeqEqG0OX1hboGSFnzoEBSjuBdGbaZTnzeXwQfW1o5CoWMTtKRXpf73hUUUh5ol zSbUGmR6SEiYA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Christian Schoenebeck , Michael Tokarev Subject: [Stable-11.0.3 21/81] tests/9p: add virtio_9p_add_synth_driver_args() test client function Date: Sun, 12 Jul 2026 00:57:59 +0300 Message-ID: <20260711215904.3757-21-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807444106154100 Content-Type: text/plain; charset="utf-8" From: Christian Schoenebeck Add virtio_9p_add_synth_driver_args() to allow appending custom QEMU options for individual 9p synth tests. Link: https://lore.kernel.org/qemu-devel/7fe3eca5d17292464676b68d0513052564= cd432a.1781361555.git.qemu_oss@crudebyte.com Signed-off-by: Christian Schoenebeck (cherry picked from commit 84525ece6817f4e9760a1d484cab01123a546e92) Signed-off-by: Michael Tokarev diff --git a/tests/qtest/libqos/virtio-9p.c b/tests/qtest/libqos/virtio-9p.c index 186fcc1141a..823756de8c4 100644 --- a/tests/qtest/libqos/virtio-9p.c +++ b/tests/qtest/libqos/virtio-9p.c @@ -228,6 +228,12 @@ static void regex_replace(GString *haystack, const cha= r *pattern, g_string_assign(haystack, s); } =20 +void virtio_9p_add_synth_driver_args(GString *cmd_line, const char *args) +{ + /* append passed args to '-fsdev ...' group */ + regex_replace(cmd_line, "(-fsdev \\w[^ ]*)", "\\1,%s", args); +} + void virtio_9p_assign_local_driver(GString *cmd_line, const char *args) { g_assert_nonnull(local_test_path); diff --git a/tests/qtest/libqos/virtio-9p.h b/tests/qtest/libqos/virtio-9p.h index 480727120ea..e7efeef7a1d 100644 --- a/tests/qtest/libqos/virtio-9p.h +++ b/tests/qtest/libqos/virtio-9p.h @@ -44,6 +44,12 @@ struct QVirtio9PDevice { QVirtio9P v9p; }; =20 +/** + * Add required test specific args to the QEMU command line for the 9pfs + * 'synth' fs driver. + */ +void virtio_9p_add_synth_driver_args(GString *cmd_line, const char *args); + /** * Creates the directory for the 9pfs 'local' filesystem driver to access. */ --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807442; cv=none; d=zohomail.com; s=zohoarc; b=dsiKKz3L8ZY/BI14JjWpy7xV8tHmtKB9y6LJEehbOaNyJS+MaMN46Td/yBYetd54+cQ16y+0082vLvezyM/cSoyuPs+IeBIFT4JFhwUGWqCqPXrn7Kj/qPNAHGskD0CvIwYDSIkrCsFKp7d+xsL8SwAstHN/fxAqvGYkBA/3WZw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807442; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=zD9kerGqXitem+Kw5XF5RUxvhYojgT9hzpIjjTDvfuc=; b=IocjCwLesQeOOBdudOr9kEI0i7KLxUqsTRIm/lswGQxqgUt3S8Jq5xCw9g8ossbj/aS7O48LKDD3CZsExTVWAWZBthh4C4YLVQYCLJrYsRAAG7kvpGtdwvizRDhwNP2ybH+RWbxRqjC7VVDS3VjM8czQdHMKiIUToMntRwA3wU4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 178380744250058.47155257595955; Sat, 11 Jul 2026 15:04:02 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wiflQ-0005OR-En; Sat, 11 Jul 2026 18:01:36 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wiflN-0005D8-GT; Sat, 11 Jul 2026 18:01:33 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wiflK-0008HD-Qt; Sat, 11 Jul 2026 18:01:33 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 9106D1C0AA1; Sun, 12 Jul 2026 00:59:40 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 484A23EAF2C; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 696681330F; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807180; bh=PFSQ/7vX2y7H4HQEySioG3foCoRS2y7XNBKbzrGsGT8=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=X57HvbAsLoP4qGXqd8fh1XCUzNUqfrAstdnAq/6Y9SMeDrzbsAcik3SjzGXWbYEb/ DMgGOYVGxSXXG3jQWmBpk+2nF25BDZc1TMOBnBgFtCK4Xf4aIsu+VD2MTmwYTVKfsQ SPBZVT5qOoC/Quku3P0N1AUg982YRghhiiK0XG+INq9WYeQp/Q2MnYF2ejWqMz5fqK hhtEA281uBwFrVvAtbHUDMLO+l2ocswS3wKmz50ydKvXybwLj2c7CCEvyo0MwYgCNI h/nIt7ynISn6iQOKAoZrbZmEzP2SSGmj8z+6HGY1h86joymCBzYyYp/ztwGVKEf9dn mP7bs5OV+ft9w== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Christian Schoenebeck , Michael Tokarev Subject: [Stable-11.0.3 22/81] tests/9p: add 3 xattr FID limit test cases (synth fs driver) Date: Sun, 12 Jul 2026 00:58:00 +0300 Message-ID: <20260711215904.3757-22-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807444140154100 Content-Type: text/plain; charset="utf-8" From: Christian Schoenebeck Add 3 test cases to verify correct xattr FID limit enforcement of 9pfs server. - 1. test with default max_xattr=3D1024 - 2. test with custom max_xattr=3D100 - 3. test with unlimited max_xattr=3D0 These are tests using the synth driver. Advantage: by using the synth driver the tests cannot only check when the xattr FID limit kicks in (server would return an Rlerror response with ENOSPC), but can also validate the current 9p server internal xattr FID counter at any moment. This is a slow test (may take several seconds) and therefore registered as "slow" test and not running by default. Use -m slow to run this test. Link: https://lore.kernel.org/qemu-devel/540c51faa074d9dd736bbf2170084a1228= 8e23ef.1781361555.git.qemu_oss@crudebyte.com Signed-off-by: Christian Schoenebeck (cherry picked from commit 0e1085819e444365bc3160f7b1adae3843b2da79) Signed-off-by: Michael Tokarev diff --git a/tests/qtest/virtio-9p-test.c b/tests/qtest/virtio-9p-test.c index 99a897b1585..2e88429dfa1 100644 --- a/tests/qtest/virtio-9p-test.c +++ b/tests/qtest/virtio-9p-test.c @@ -35,6 +35,15 @@ #define tclunk(...) v9fs_tclunk((TClunkOpt) __VA_ARGS__) #define txattrcreate(...) v9fs_txattrcreate((TXattrCreateOpt) __VA_ARGS__) =20 +/* + * xattr size to be used for xattr tests + * + * 64k is the max. xattr size supported by the Linux kernel, However btrfs + * for instance supports only 16219 bytes. So let's be conservative and + * just use 8k for the xattr tests. + */ +#define TEST_XATTR_SIZE (8 * 1024) + static void pci_config(void *obj, void *data, QGuestAllocator *t_alloc) { QVirtio9P *v9p =3D obj; @@ -107,6 +116,42 @@ static bool fs_dirents_contain_name(struct V9fsDirent = *e, const char* name) return false; } =20 +/* + * Returns the current internal xattr FID count (works with synth driver o= nly). + */ +static size_t get_xattr_count(QVirtio9P *v9p) +{ + uint16_t nwqid; + v9fs_qid *wqid; + const char *xattr_count_path[] =3D { "stat", "xattr_count" }; + size_t xattr_count; + uint32_t bytes_read; + + /* walk to /stat/xattr_count file */ + uint32_t fid =3D twalk({ + .client =3D v9p, .fid =3D 0, + .nwname =3D 2, .wnames =3D (char **)xattr_count_path, + .rwalk =3D { .nwqid =3D &nwqid, .wqid =3D &wqid } + }).newfid; + + /* open for read */ + tlopen({ + .client =3D v9p, .fid =3D fid, .flags =3D O_RDONLY, + .rlopen =3D { .qid =3D NULL, .iounit =3D NULL } + }); + + /* read the internal xattr FID count */ + tread({ + .client =3D v9p, .fid =3D fid, .offset =3D 0, .count =3D sizeof(xa= ttr_count), + .rread =3D { .count =3D &bytes_read, .data =3D &xattr_count } + }); + + /* cleanup */ + tclunk({ .client =3D v9p, .fid =3D fid }); + + return xattr_count; +} + /* basic readdir test where reply fits into a single response message */ static void fs_readdir(void *obj, void *data, QGuestAllocator *t_alloc) { @@ -248,6 +293,108 @@ static void do_readdir_split(QVirtio9P *v9p, uint32_t= count) g_free(wnames[0]); } =20 +/* + * Test 9p server's xattr FID count limit enforcement. + * + * Shared test code for both 'synth' and 'local' driver to verify correct + * behaviour of 9p server enforcing preconfigured xattr FID count limit + * correctly. + * + * @v9p: 9pfs client + * + * @max_xattr: max. allowed xattr FIDs, or -1 for infinite + * + * @check_counter: whether to verify 9p server internal xattr FID counter + * (only works with 'synth' fs driver) + */ +static void do_xattr_limit(QVirtio9P *v9p, int max_xattr, bool check_count= er) +{ + size_t count; + int i; + int limit =3D (max_xattr !=3D -1) ? max_xattr : V9FS_MAX_XATTR_DEFAULT= + 100; + g_autofree uint32_t *fids =3D g_new0(uint32_t, limit); + uint32_t err_fid =3D 0; + const char *file_path[] =3D { QTEST_V9FS_SYNTH_WRITE_FILE }; + g_autofree uint8_t *xattr_data =3D g_malloc(TEST_XATTR_SIZE); + + if (!g_test_slow()) { + g_test_skip("This is a slow test, run with -m slow"); + return; + } + + /* prepare xattr data with 'X' characters */ + memset(xattr_data, 'X', TEST_XATTR_SIZE); + + tattach({ .client =3D v9p }); + + /* create max. amount of permitted xattrs */ + for (i =3D 0; i < limit; i++) { + /* walk to create a new fid */ + fids[i] =3D twalk({ + .client =3D v9p, .fid =3D 0, + .nwname =3D 1, .wnames =3D (char **) file_path + }).newfid; + + /* create new xattr fid */ + txattrcreate({ + .client =3D v9p, .fid =3D fids[i], .name =3D "user.test", + .size =3D TEST_XATTR_SIZE, .flags =3D 0 + }); + + /* transfer the xattr data */ + twrite({ + .client =3D v9p, .fid =3D fids[i], .offset =3D 0, + .count =3D TEST_XATTR_SIZE, .data =3D xattr_data + }); + + /* verify server internal xattr counter */ + if (check_counter) { + count =3D get_xattr_count(v9p); + g_assert_cmpuint(count, =3D=3D, (i + 1)); + } + + /* avoid virtio descriptor exhaustion */ + qvirtqueue_reset_pool(v9p->vq); + } + + /* if xattrs are limited, the next xattr should fail */ + if (max_xattr !=3D -1) { + /* walk to create another fid */ + err_fid =3D twalk({ + .client =3D v9p, .fid =3D 0, + .nwname =3D 1, .wnames =3D (char **) file_path + }).newfid; + + /* try to create one more xattr fid - should fail */ + txattrcreate({ + .client =3D v9p, .fid =3D err_fid, .name =3D "user.test_exceed= ", + .size =3D TEST_XATTR_SIZE, .flags =3D 0, + .expectErr =3D ENOSPC + }); + + /* verify internal xattr counter hasn't changed */ + if (check_counter) { + count =3D get_xattr_count(v9p); + g_assert_cmpuint(count, =3D=3D, limit); + } + } + + /* clunk all fids (should decrement xattr counter) */ + for (i =3D 0; i < limit; i++) { + tclunk({ .client =3D v9p, .fid =3D fids[i] }); + qvirtqueue_reset_pool(v9p->vq); + } + if (err_fid) { + tclunk({ .client =3D v9p, .fid =3D err_fid }); + } + + /* verify internal xattr counter is zero */ + if (check_counter) { + count =3D get_xattr_count(v9p); + g_assert_cmpuint(count, =3D=3D, 0); + } +} + static void fs_walk_no_slash(void *obj, void *data, QGuestAllocator *t_all= oc) { QVirtio9P *v9p =3D obj; @@ -508,6 +655,27 @@ static void fs_readdir_split_512(void *obj, void *data, do_readdir_split(obj, 512); } =20 +static void fs_synth_xattr_limit_default(void *obj, void *data, + QGuestAllocator *t_alloc) +{ + v9fs_set_allocator(t_alloc); + do_xattr_limit(obj, V9FS_MAX_XATTR_DEFAULT, true); +} + +static void fs_synth_xattr_limit_custom(void *obj, void *data, + QGuestAllocator *t_alloc) +{ + v9fs_set_allocator(t_alloc); + do_xattr_limit(obj, 100, true); +} + +static void fs_synth_xattr_limit_unlimited(void *obj, void *data, + QGuestAllocator *t_alloc) +{ + v9fs_set_allocator(t_alloc); + do_xattr_limit(obj, -1, true); +} + =20 /* tests using the 9pfs 'local' fs driver */ =20 @@ -822,6 +990,18 @@ static void fs_deep_absolute_path(void *obj, void *dat= a, g_string_free(path, TRUE); } =20 +static void *synth_max_xattr_custom_opt(GString *cmd_line, void *arg) +{ + virtio_9p_add_synth_driver_args(cmd_line, "max_xattr=3D100"); + return arg; +} + +static void *synth_max_xattr_unlimited_opt(GString *cmd_line, void *arg) +{ + virtio_9p_add_synth_driver_args(cmd_line, "max_xattr=3D0"); + return arg; +} + static void cleanup_9p_local_driver(void *data) { /* remove previously created test dir when test is completed */ @@ -872,7 +1052,14 @@ static void register_virtio_9p_test(void) fs_readdir_split_256, &opts); qos_add_test("synth/readdir/split_128", "virtio-9p", fs_readdir_split_128, &opts); - + qos_add_test("synth/xattr_limit/default", "virtio-9p", + fs_synth_xattr_limit_default, &opts); + opts.before =3D synth_max_xattr_custom_opt; + qos_add_test("synth/xattr_limit/custom", "virtio-9p", + fs_synth_xattr_limit_custom, &opts); + opts.before =3D synth_max_xattr_unlimited_opt; + qos_add_test("synth/xattr_limit/unlimited", "virtio-9p", + fs_synth_xattr_limit_unlimited, &opts); =20 /* 9pfs test cases using the 'local' filesystem driver */ opts.before =3D assign_9p_local_driver; --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807507; cv=none; d=zohomail.com; s=zohoarc; b=RRcHmXVs2+ltts9Jk8wivYY3IpmP2INwl23+z3JbqGZOYo5L/j3NPTdZCSJVTGtdRwKcADH0eIQAGl4HQtla7wb6ERelzBbJa7DlBYUbhX1Ap0Ktqc9b7hEa4i80Bq9TyMheKvNRVD44OEngUzhQq+RGpAMLS+Gp5kujsa3mwCI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807507; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=g2HtB2oR0eU1FscjYw/d53hxY4R8ldlAO0tFsrbbcmA=; b=C9ogycmKwBd12xWNGA+iuF/TqmvkpCjL9AEO3AMRb9EhoYLXmq2QmMck9jhDlktd3YtiYBYcnUF8stPD2tqWwkH9wBjJALmAxhMF4qLy3ICnwK8y/LgcfdGIwT0Bb5DAeYs1TvF2Evul5riUugjtg1e9S+swabe5aD8Br2I/OZA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807507118673.4910965914978; Sat, 11 Jul 2026 15:05:07 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wiflR-0005R2-4Y; Sat, 11 Jul 2026 18:01:37 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wiflO-0005KI-Ve; Sat, 11 Jul 2026 18:01:35 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wiflM-0008HW-UV; Sat, 11 Jul 2026 18:01:34 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 9676A1C0AA2; Sun, 12 Jul 2026 00:59:40 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 4DFEA3EAF2D; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 6BA5313311; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807180; bh=QONICYvc3aooVcn8WP9NviLmeUnqTcw8CveB6thepP8=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=oqrJU71ytJBS+mXzsNqpqa3oH9CMyeKi/sGDBYrzTgWkOGYbKNudl/ErYxcaAoEDN emPI42cP6m+YsbeHCTIHtPlcRp6qI9CAZBoY+yTL6PGjmpsLcLr5S7nhOXYxMleF3+ JxLQ6nAvUc/r4J9rK83yoC658BlFPEbjom6Z43gqDF5CDWYnmbEBqvJKKw2LENr2ql Hr2n+AzL2p+B9TCH26x9VAWB8rOfwg2s8ZWNvlaLeRdE/YWRUnL8n5s44M17NOYrO9 T73QPo5d58qAQ3Yb+B3LIl67sy8rXVe+2bTfp9Wy6zK5px7BS53PPs/z4Lw5HcdlLs gg7ogeUXt1b2A== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Christian Schoenebeck , Michael Tokarev Subject: [Stable-11.0.3 23/81] tests/9p: add 3 xattr FID limit test cases (local fs driver) Date: Sun, 12 Jul 2026 00:58:01 +0300 Message-ID: <20260711215904.3757-23-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807509263154100 Content-Type: text/plain; charset="utf-8" From: Christian Schoenebeck Analogue to the previously added 3 synth tests, add (similar) 3 test cases using the "local" fs driver to verify correct xattr FID limit enforcement of 9pfs server with a real filesystem. These 3 new local tests use the shared test code of the previously added 3 synth tests. The only difference is that the local fs driver does not expose the current internal xattr FID counter, so we can't verify this with the local tests. This is a slow test (may take several seconds) and therefore registered as "slow" test and not running by default. Use -m slow to run this test. Link: https://lore.kernel.org/qemu-devel/d23fa874df4f474ee7cbe738a35c148342= 6057f0.1781361555.git.qemu_oss@crudebyte.com Signed-off-by: Christian Schoenebeck (cherry picked from commit 04a62cdfe873d07a5f264d03372bfc34bbcdddf0) Signed-off-by: Michael Tokarev diff --git a/tests/qtest/virtio-9p-test.c b/tests/qtest/virtio-9p-test.c index 2e88429dfa1..cfd3c02da45 100644 --- a/tests/qtest/virtio-9p-test.c +++ b/tests/qtest/virtio-9p-test.c @@ -395,6 +395,19 @@ static void do_xattr_limit(QVirtio9P *v9p, int max_xat= tr, bool check_counter) } } =20 +static void do_local_xattr_limit(QVirtio9P *v9p, int max_xattr) +{ + g_autofree char *test_file =3D virtio_9p_test_path("WRITE"); + + /* + * this file must be created for the test to work with the 'local' fs = driver + */ + g_file_set_contents(test_file, "", 0, NULL); + + /* the actual test code shared with the 'synth' fs driver tests */ + do_xattr_limit(v9p, max_xattr, false); +} + static void fs_walk_no_slash(void *obj, void *data, QGuestAllocator *t_all= oc) { QVirtio9P *v9p =3D obj; @@ -990,6 +1003,27 @@ static void fs_deep_absolute_path(void *obj, void *da= ta, g_string_free(path, TRUE); } =20 +static void fs_local_xattr_limit_default(void *obj, void *data, + QGuestAllocator *t_alloc) +{ + v9fs_set_allocator(t_alloc); + do_local_xattr_limit(obj, V9FS_MAX_XATTR_DEFAULT); +} + +static void fs_local_xattr_limit_custom(void *obj, void *data, + QGuestAllocator *t_alloc) +{ + v9fs_set_allocator(t_alloc); + do_local_xattr_limit(obj, 100); +} + +static void fs_local_xattr_limit_unlimited(void *obj, void *data, + QGuestAllocator *t_alloc) +{ + v9fs_set_allocator(t_alloc); + do_local_xattr_limit(obj, -1); +} + static void *synth_max_xattr_custom_opt(GString *cmd_line, void *arg) { virtio_9p_add_synth_driver_args(cmd_line, "max_xattr=3D100"); @@ -1008,20 +1042,42 @@ static void cleanup_9p_local_driver(void *data) virtio_9p_remove_local_test_dir(); } =20 -static void *assign_9p_local_driver(GString *cmd_line, void *arg) +static void assign_9p_local_driver_with_args(GString *cmd_line, + const char *extra_opts) { /* make sure test dir for the 'local' tests exists */ virtio_9p_create_local_test_dir(); =20 - virtio_9p_assign_local_driver(cmd_line, "security_model=3Dmapped-xattr= "); + g_autofree char *opts =3D + (extra_opts) ? + g_strdup_printf("security_model=3Dmapped-xattr,%s", extra_opts= ) : + g_strdup("security_model=3Dmapped-xattr"); + + virtio_9p_assign_local_driver(cmd_line, opts); =20 g_test_queue_destroy(cleanup_9p_local_driver, NULL); +} + +static void *assign_9p_local_driver(GString *cmd_line, void *arg) +{ + assign_9p_local_driver_with_args(cmd_line, NULL); return arg; } =20 -static void register_virtio_9p_test(void) +static void *local_max_xattr_custom_opt(GString *cmd_line, void *arg) { + assign_9p_local_driver_with_args(cmd_line, "max_xattr=3D100"); + return arg; +} =20 +static void *local_max_xattr_unlimited_opt(GString *cmd_line, void *arg) +{ + assign_9p_local_driver_with_args(cmd_line, "max_xattr=3D0"); + return arg; +} + +static void register_virtio_9p_test(void) +{ QOSGraphTestOptions opts =3D { }; =20 @@ -1078,6 +1134,14 @@ static void register_virtio_9p_test(void) &opts); qos_add_test("local/deep_absolute_path", "virtio-9p", fs_deep_absolute_path, &opts); + qos_add_test("local/xattr_limit/default", "virtio-9p", + fs_local_xattr_limit_default, &opts); + opts.before =3D local_max_xattr_custom_opt; + qos_add_test("local/xattr_limit/custom", "virtio-9p", + fs_local_xattr_limit_custom, &opts); + opts.before =3D local_max_xattr_unlimited_opt; + qos_add_test("local/xattr_limit/unlimited", "virtio-9p", + fs_local_xattr_limit_unlimited, &opts); } =20 libqos_init(register_virtio_9p_test); --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807407; cv=none; d=zohomail.com; s=zohoarc; b=dolVhHZYjklYvGdbLIaLYcDz+vEydzeC49uaLr6TT9v/WetrmYhamKZTmS7COFrNEtReScgOVbgdIE/ueeJipgdo0lBDVZ+Xb56Ke9GoUfl2BG6A0p3d7oC8pW7wrlSFPVXyA5puGYxTF3S0pqckXO8FrCyS6zluJbvyeCje6g4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807407; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=Ds6vyHht1tdJAfZzPDPPNzM0UncvulweZNxGhDz8oN8=; b=nzVWthk3eqqLRLvz7ybutajDKvwTLhHntz1aekcJJBq49baVY/syXtbhQa7E034/FC1yihnVWtTD+2X3M/O+IvnlrekmZs1L4KZthIxHPcg3ER7SKLt4Doe2Nrl2Ry7F4YqgRVVKFcUwJsnErurMM+cykS9XkHVOfeCnh+PW6dk= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807407260723.9774015068276; Sat, 11 Jul 2026 15:03:27 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wiflS-0005Va-LO; Sat, 11 Jul 2026 18:01:38 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wiflR-0005Rd-21; Sat, 11 Jul 2026 18:01:37 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wiflP-0008Ja-3H; Sat, 11 Jul 2026 18:01:36 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 9C4F31C0AA3; Sun, 12 Jul 2026 00:59:40 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 52F463EAF2E; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 6DEC113313; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807180; bh=kKwU2/gwY4uoL79RTPGfSUbSgRquyUwaMfK6S4tVAVk=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=H/aXOd6lmwNwbnXFRYESE7G7/3+rAhO/vEI7Avb0/duvsVD5ZX3PKHYVpAp7rhkeC JhRwlDfjl+flhropilnUiznByKIEJtItW0qqcNnFt5XrxwR6ORtcyN/vUd6Rcmt7QM QGKikfIRbUP1EbmK8XiObuDf2GYrCDovNmPjzH+E+Oq1xAQtTlnJ0oEFe4uhXcscN5 KBG+srML7qqqqe8UB/yOL4ymc1Ewh62jZTS0iiruLq/b8HpCm3M8sBmCqhsu8lNB3+ uhgNsB8bedVxUhYHNhfz1yDun6HtbE15ers6WMlAyYXipCqKRy8f7mDiv2GVHAlbcU IJhR+f5CTRD4Q== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Christian Schoenebeck , Feifan Qian , Michael Tokarev Subject: [Stable-11.0.3 24/81] hw/9pfs: fix invalid union access by v9fs_co_fsync() Date: Sun, 12 Jul 2026 00:58:02 +0300 Message-ID: <20260711215904.3757-24-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807409551154100 Content-Type: text/plain; charset="utf-8" From: Christian Schoenebeck The individual FID types (P9_FID_NONE, P9_FID_FILE, P9_FID_DIR, P9_FID_XATT= R) share union V9fsFidOpenState with FID-type specific fields. Accessing any of the union fields must comply with the FID-type to avoid undefined behaviour or information disclosure. Fix this in v9fs_fsync() and v9fs_wstat() by checking if FID has a valid fi= le descriptor before calling v9fs_co_fsync(). Fixes: 10b468bdc533 ("virtio-9p: Implement TXATTRCREATE") Reported-by: Feifan Qian Link: https://lore.kernel.org/qemu-devel/b583e29d5a0776e41263732c93ac9f0da0= a6016d.1781621428.git.qemu_oss@crudebyte.com Signed-off-by: Christian Schoenebeck (cherry picked from commit 32cae47c332f88241632905e0a3abcbb35b019c3) Signed-off-by: Michael Tokarev diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c index 1b064a27fc5..162cd6e6486 100644 --- a/hw/9pfs/9p.c +++ b/hw/9pfs/9p.c @@ -2291,10 +2291,15 @@ static void coroutine_fn v9fs_fsync(void *opaque) err =3D -ENOENT; goto out_nofid; } + if (!fid_has_valid_file_handle(pdu->s, fidp)) { + err =3D -EBADF; + goto out; + } err =3D v9fs_co_fsync(pdu, fidp, datasync); if (!err) { err =3D offset; } +out: put_fid(pdu, fidp); out_nofid: pdu_complete(pdu, err); @@ -3648,6 +3653,10 @@ static void coroutine_fn v9fs_wstat(void *opaque) } /* do we need to sync the file? */ if (donttouch_stat(&v9stat)) { + if (!fid_has_valid_file_handle(s, fidp)) { + err =3D -EBADF; + goto out; + } err =3D v9fs_co_fsync(pdu, fidp, 0); goto out; } --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807491; cv=none; d=zohomail.com; s=zohoarc; b=IhVvli7iXKV5lP7j0kmRs5I5C/M0Tset2PlEQQF3N31TcE5YVDgwSZE2OlmtIMIcw4/6hQrT7dKEezf9dzEwOevnbzJ/B7goBrypfP8jNS0ZOedSFptXsTyugLW++2CtU9wFySjN0iVXZymA4vaa3BIyjVDSR1I5vZAaSdDJaQ8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807491; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=/mArPKCh1pXMGC5rTJIY9XFNl4F+4etZRNv/tgmbBjo=; b=jet6ZaClYrJ8aS/1HIobe2a7icSYPTmFUSbVM+x/vvRTyua7dsg8d6J47dUGx+IPKm5iZBHtLbGkndpcy88N0v+GbSOusD/HfCJEtQtMfKQ5ludsAr5wsPafO8E7DINFrRPJWa0hwrIAFkPlvHv4RAenDIz0ozb9RnWwt7a4RaU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807491947637.1389417980191; Sat, 11 Jul 2026 15:04:51 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wiflT-0005YA-QR; Sat, 11 Jul 2026 18:01:39 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wiflS-0005VO-Cj; Sat, 11 Jul 2026 18:01:38 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wiflQ-0008Jw-KW; Sat, 11 Jul 2026 18:01:38 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id A3BBB1C0AA4; Sun, 12 Jul 2026 00:59:40 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 59E123EAF2F; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 7025E13315; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807180; bh=ZFfgkNxlWufqHUICXktaiqzClipERZQRiCv3/dePY2M=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=d61ww69yuhtqmsZpmYANj1f08zQUnxRW4KQtlJbwxMVdvZc4CGmfY/6rFmTi0KJip CNrHMN6fMQFHs/TBeOCni5yUkh8N4fKWqxUl3z+hzyDOOQJKnGpZDan4DSKgYcQNF5 5t+skWX9s+W7/UDIJCB1aStu2PaVPFDaPgLvst/QWP8P2jjsqcg22t+szJGzzThuJ2 QZIDnK+xB6iKNYMYCgRfrtuLUxKR0Mp7OQraHFHzI1AUurS6jDn7Zh41XwiIyWuIaB roRAhZ70yUKVzsy/gjGxgSwi7dlf1e9jrHAmJF0YgGbDeEL7OCi8k4vuLKWqsofNLT DaOdp0vUIeKnA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Christian Schoenebeck , Michael Tokarev Subject: [Stable-11.0.3 25/81] hw/9pfs: fix invalid union access by v9fs_co_fstat() Date: Sun, 12 Jul 2026 00:58:03 +0300 Message-ID: <20260711215904.3757-25-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807494854154100 Content-Type: text/plain; charset="utf-8" From: Christian Schoenebeck The individual FID types (P9_FID_NONE, P9_FID_FILE, P9_FID_DIR, P9_FID_XATT= R) share union V9fsFidOpenState with FID-type specific fields. Accessing any of the union fields must comply with the FID-type to avoid undefined behaviour or information disclosure. Fix this in v9fs_lock() and v9fs_getlock() by checking if FID has a valid file descriptor before calling v9fs_co_fstat(). Fixes: 10b468bdc533 ("virtio-9p: Implement TXATTRCREATE") Link: https://lore.kernel.org/qemu-devel/4b33cd1aaa2551efda220a6f651e3660d2= 7f4746.1781621428.git.qemu_oss@crudebyte.com Signed-off-by: Christian Schoenebeck (cherry picked from commit c3aa2491cd2cd89e2f484d32f323ee447e782984) Signed-off-by: Michael Tokarev diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c index 162cd6e6486..85565a014e3 100644 --- a/hw/9pfs/9p.c +++ b/hw/9pfs/9p.c @@ -3925,6 +3925,10 @@ static void coroutine_fn v9fs_lock(void *opaque) err =3D -ENOENT; goto out_nofid; } + if (!fid_has_valid_file_handle(pdu->s, fidp)) { + err =3D -EBADF; + goto out; + } err =3D v9fs_co_fstat(pdu, fidp, &stbuf); if (err < 0) { goto out; @@ -3970,6 +3974,10 @@ static void coroutine_fn v9fs_getlock(void *opaque) err =3D -ENOENT; goto out_nofid; } + if (!fid_has_valid_file_handle(pdu->s, fidp)) { + err =3D -EBADF; + goto out; + } err =3D v9fs_co_fstat(pdu, fidp, &stbuf); if (err < 0) { goto out; --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807647; cv=none; d=zohomail.com; s=zohoarc; b=BTxbp/V/mACs3UAgOHxCcFvG2a4D7qv+EvmEaICsMyAs13LSCmHHXmd+enLcmS5bDnAmEoWBS/tVL4NtmkQKpYSXKpe699BZyB2XtLBwq2al9bB7H3V/4KPTBTMnd8nzk26T1Q6G1xrmD42ZZjj1tlkMPFy1M5TjX+uTTa5Oqcw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807647; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=1+iq0fONQHKLOpPClXcbb3qlfXmQjRPE8PNyNGAh3iw=; b=V0MMxlzBJItP4d6JAs1DJz6A4zZgKuHZiZvHDLei0yoSOibdpor8vUrzJl0FZzed7mkBFcGlDQARo+XN7xQ7QQmggBo/keFWaS9snj9L4PC35D7O2gbjOsQniZCMwlJWfizY3i3x0mN2onqnx8NJ0PtlRgJw/xoQO1ln+e/Biuc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807647590821.4580904024882; Sat, 11 Jul 2026 15:07:27 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wiflv-0006uI-6i; Sat, 11 Jul 2026 18:02:07 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wiflt-0006r9-29; Sat, 11 Jul 2026 18:02:05 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wiflm-0008KK-Kl; Sat, 11 Jul 2026 18:02:04 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id A99321C0AA5; Sun, 12 Jul 2026 00:59:40 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 60AD93EAF30; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 7257013317; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807180; bh=nlwJLEgIZohsUuXj8fvaTL3TA7wDnojjwiNrHTniPRw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Noqmqo/jRySHM5kP5L1mUz13yzEgRS8cOfy/XeszkfmJy5mth+ppA4lZ4OsGYZLgR uyhQeJV+0C8YfpEgHtYYTL+d95G5iHOu53B2IN8GhLzNTkl3eb7QCuTWU4bawUGL+3 ZV0+JmxkntR3btk4wYALGJhPhyPD4gYEfKsmKCYAA3At2C3jXEWTn12W30sJJRBHZg pB2rNUbI/zVVfdhGh61q7ZWbwKvDzmpNdXkS8N0jJ+RNpnAqQHHW2YNbNOH1GWFN9U H1vUwWdqo0dNSG5mmkDDEpmMOzCFHX97VwOIewSs0KWIOEaEOJsTx2LjKL0dgWk5Up HUlYp07Y2cCAA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Christian Schoenebeck , Michael Tokarev Subject: [Stable-11.0.3 26/81] hw/9pfs/local: harden local_fid_fd() on FID types Date: Sun, 12 Jul 2026 00:58:04 +0300 Message-ID: <20260711215904.3757-26-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807648954154100 Content-Type: text/plain; charset="utf-8" From: Christian Schoenebeck local_fid_fd() returns fs->fd for any FID type that is not P9_FID_DIR. Since P9_FID_XATTR and P9_FID_NONE share union V9fsFidOpenState, calling local_fid_fd() on these types misinterprets xattr state as a file descriptor, potentially leading to undefined behaviour or information disclosure. Even though we are catching these FID type mismatches on protocol level in 9p.c already, previous patches proofed this to be error prone. So let's add another safety layer in local_fid_fd() that would return -1 if the FID type would not possess a valid file descriptor, to prevent wrong file descriptors from reaching fs backend calls. Link: https://lore.kernel.org/qemu-devel/531f6b81bc1bf1a48c3d4afaa60a65db10= 511041.1781621428.git.qemu_oss@crudebyte.com Signed-off-by: Christian Schoenebeck (cherry picked from commit 75893c058b21d87d1ec66bbd4e8bf84e1fd616d1) Signed-off-by: Michael Tokarev diff --git a/hw/9pfs/9p-local.c b/hw/9pfs/9p-local.c index 4708e170a42..ee592b62f81 100644 --- a/hw/9pfs/9p-local.c +++ b/hw/9pfs/9p-local.c @@ -775,8 +775,11 @@ static int local_fid_fd(int fid_type, V9fsFidOpenState= *fs) { if (fid_type =3D=3D P9_FID_DIR) { return dirfd(fs->dir.stream); - } else { + } else if (fid_type =3D=3D P9_FID_FILE) { return fs->fd; + } else { + errno =3D EBADF; + return -1; } } =20 --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807622; cv=none; d=zohomail.com; s=zohoarc; b=ALbbgf6G4ZmjfQww07q9FdZjp1Zzpiz9GSkPbHErJlzqxQ8KGK2dE/RFn5D4JZsf+vYoU2f6qBjFoBWZwyl8NKvYFNTE5m0ibjvBRslkvBxTSVKmpOwJhvVXvaNWRqoodS2IdCju+aepJUXaAKDvbEFsPuLGiI0Fbg0iVB8XVYo= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807622; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=COAyUWWaPyzPyDSFxIn5prQzD0FKKwwTpWDm5tXAJfI=; b=f+kEUhxWWdJGR5xmMsjFK9zIauEgrQFmM446Con4bsCeMCtMbPH3RpAAosX4X0VzAnK4rKxryyavaujLGBo0g6/pmXSFzlhPjVIXKd1bgMUVZIKzlWXaP+d3FB+CYl8oUrD1Vb1iFUrkIpxPrwWVx2E5h4YfQ4e5JOtArmBZmfI= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807622733446.19941132170743; Sat, 11 Jul 2026 15:07:02 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wiflx-0006vJ-9t; Sat, 11 Jul 2026 18:02:09 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wiflu-0006rz-Ak; Sat, 11 Jul 2026 18:02:06 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wiflo-0008Ke-3Y; Sat, 11 Jul 2026 18:02:06 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id B190D1C0AA6; Sun, 12 Jul 2026 00:59:40 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 68DC03EAF31; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 74B7F13319; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807180; bh=27p8mXYMM4XTshDOy58mBtIzoX97mUrxGvNlTsfj4oc=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=hciuUNa8NCqhZ1ObEeWmEwLTwPlEEvXczofFNWCTQAcY+xBfLTy56BoyYHikG5z0j zrb+AhXmhML18A8tFMuT37AVfk2f9tvrR9hkq3RiOfBGo+9Ee2RHH/szcp2OJiJuJ3 hQZzER4pSlZBlkbNUaVTje5XXpxa1fLEH8DPfOtfg4wa6zTlq5EghLR38M6Vby6DXS hJazufsrrbLAvMpKCSdOjMoNR04La8cvGwgqMYzTwPBwbhpDnOkHTVZV1B4sK4caK5 2t+9FXPF2jJoJoVbCMOMwFgMgLuVPaXOkOscSGRFQbVEom6OMdqUfhPcmuyYxGVJ6T deRJ6xwAFWnhw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Inochi Amaoto , Alistair Francis , Michael Tokarev Subject: [Stable-11.0.3 27/81] target/riscv: Check PMP before updating PTE Date: Sun, 12 Jul 2026 00:58:05 +0300 Message-ID: <20260711215904.3757-27-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807624688154100 Content-Type: text/plain; charset="utf-8" From: Inochi Amaoto According to the RISC-V spec, the PTE update is a supervisor write operations, and it should also follow the CPU PMP configuration like the PTE read. Cc: qemu-stable@nongnu.org Signed-off-by: Inochi Amaoto Reviewed-by: Alistair Francis Message-ID: <20260622113402.563196-1-inochiama@gmail.com> Signed-off-by: Alistair Francis (cherry picked from commit fa2cf7488379d9b14041a7bcd76867c9bdad2b5e) Signed-off-by: Michael Tokarev diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c index 665d0f71818..c74b04f5b2f 100644 --- a/target/riscv/cpu_helper.c +++ b/target/riscv/cpu_helper.c @@ -1601,10 +1601,18 @@ static int get_physical_address(CPURISCVState *env,= hwaddr *physical, =20 /* Page table updates need to be atomic with MTTCG enabled */ if (updated_pte !=3D pte && !is_debug) { + int pmp_prot, pmp_ret; + if (!adue) { return TRANSLATE_FAIL; } =20 + pmp_ret =3D get_physical_address_pmp(env, &pmp_prot, pte_addr, + sxlen_bytes, MMU_DATA_STORE, PR= V_S); + if (pmp_ret !=3D TRANSLATE_SUCCESS) { + return TRANSLATE_PMP_FAIL; + } + /* * - if accessed or dirty bits need updating, and the PTE is * in RAM, then we do so atomically with a compare and swap. --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807543; cv=none; d=zohomail.com; s=zohoarc; b=AlTAvYpTbW/ReIP1wTI79pWLjUPgT3ym/uT+G4PBFKJXoBsw/Kdt5ts4/8hR8VD5s9djxaBuYm8MF72ltRPKT4Ld5JgV252T3FHFsYdLcGq8VW8v+uOQx3vtpnllDKX9yQ3TYUPaE9rngp6AigZw7t029qq1i0rFCkHdtK0HqHo= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807543; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=2duz4KA/ZwChGTC3Lol7SYQoxeLk7g6C0GwHt4wNNAA=; b=FSg6kgNTCuwQ35/dNnFzS8s0J38j1Yixy3sv+CsKhOAU+gQXc5ga7lYpWhUHJRQgO/bJ4b0aLcWFJeS2MPZ6fzIBppIRFttVHUFGHwCWU7TGZ67WH7oKa2znEoY4DeNgORoNsooAkK/bO04YoaNs23N7/a84AgbbDD4eNSBVI7k= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807543503890.7304224781558; Sat, 11 Jul 2026 15:05:43 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifm2-0006ww-7d; Sat, 11 Jul 2026 18:02:14 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wiflw-0006vE-JX; Sat, 11 Jul 2026 18:02:08 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wiflu-0008Pe-NX; Sat, 11 Jul 2026 18:02:08 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id B83CA1C0AA7; Sun, 12 Jul 2026 00:59:40 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 6E6F13EAF32; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 770681331B; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807180; bh=sFnbhFAt2NV0+WNlIM3EzmZ0jn2inTcjmky3GCs8cOU=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=ZTrWkRHyciY5UzYgGJqfEJeYRt1ObFCzJiyQtp7YFL/Cz5947ZAlYGE6zuxsNC81R teYu57ECJvrz1Qftt0dFtEuzMPrSv8ir9ieXxbVukSFGbWmDmjdHxxfRx6l3TPGCI9 PjbbHUiGB3c8QgK3ISZqIZC5MXI6TeGqvexiCEMxbEGIl69LDGxVso72t3RtBEaxvi uZ4hsn8lyJP7y8sBoik75Gy8BYhLFPSgopmxpAXuecRQF3ccrdozzrveLzLZHfXcet UVwrFQLeRdCVHusPreQomkFRxRJJUqv7rJlXjHD9XsmNZS4RxRcjiOyE0q+bx2TOpK bCqLcZpHsXRxQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Qingwei Hu , Nutty Liu , Sunil V L , Alistair Francis , Michael Tokarev Subject: [Stable-11.0.3 28/81] hw/riscv/virt-acpi-build: Fix RINTC PLIC context ID for KVM Date: Sun, 12 Jul 2026 00:58:06 +0300 Message-ID: <20260711215904.3757-28-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807545619154100 Content-Type: text/plain; charset="utf-8" From: Qingwei Hu Each RISC-V MADT RINTC entry contains an External Interrupt Controller ID field. On the virt machine without AIA, this field identifies the S-mode PLIC context associated with the hart. TCG virt has both M-mode and S-mode PLIC contexts, so the S-mode context ID is odd and 2 * local_cpu_id + 1 is correct. KVM virt exposes only S-mode PLIC contexts, and those contexts are numbered contiguously from 0. Reporting the TCG context ID for KVM makes the guest enable a different PLIC context from the one used by QEMU. With ACPI enabled, this can leave PCI INTx interrupts pending in QEMU while the guest-programmed PLIC context remains disabled. A virtio-blk root disk can then stall during boot because its first interrupt is never delivered. Use local_cpu_id for KVM and keep the existing odd S-mode context ID for TCG. Fixes: d641da6ed43 ("hw/riscv/virt-acpi-build.c: Add PLIC in MADT") Signed-off-by: Qingwei Hu Reviewed-by: Nutty Liu Reviewed-by: Sunil V L Message-ID: <20260604120017.398890-1-qingwei.hu@bytedance.com> Signed-off-by: Alistair Francis (cherry picked from commit fdfcd98f6656b0cf425475bd8ce7f4c08adf8ca6) Signed-off-by: Michael Tokarev diff --git a/hw/riscv/virt-acpi-build.c b/hw/riscv/virt-acpi-build.c index fd6ca5dbc4f..504a93025bf 100644 --- a/hw/riscv/virt-acpi-build.c +++ b/hw/riscv/virt-acpi-build.c @@ -100,6 +100,8 @@ static void riscv_acpi_madt_add_rintc(uint32_t uid, build_append_int_noprefix(entry, ACPI_BUILD_INTC_ID( arch_ids->cpus[uid].props.node_id, + kvm_enabled() ? + local_cpu_id : 2 * local_cpu_id + 1), 4); } else { --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807469; cv=none; d=zohomail.com; s=zohoarc; b=co+FQwZnjKYHpxNv1tHiyNxeiJAHa6TPyB23z3fYnHBzB3cjeVn+/QIsteJoJojvYCfDLTRGj5MGsryDXInwbwPAV7Hvjn33FdLJ+JsDKjY8pR7XVz5o1zgFuj8WN+D2DNpQPYQZv/hKCFhhD+4u1TFuNO6i0itbARy4Qku8zrc= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807469; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=ij0ZrO8sRIzT8w+sbWgpA+oEsa9Tpa0+kW088TQCBFk=; b=cLia+S+QpcV+64ExfPFg6JZdwP3mKyDYKIoIMuRviv5NrqKSbxEGuDX5gx7Jqm0YpsJk4eqPBQlFD2nLY/RVQy/8Ock49smpiWp4rmSeGfP3aoz2gsSqZhYihm99XQGOoL1CGQLGDEk3HFxjZXhBVM7wV4DiW9SrP2+vW63np/U= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807469720444.4586982456731; Sat, 11 Jul 2026 15:04:29 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifmH-0006yD-2w; Sat, 11 Jul 2026 18:02:31 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wiflx-0006w5-LK; Sat, 11 Jul 2026 18:02:09 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wiflv-0008QN-TI; Sat, 11 Jul 2026 18:02:09 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id BE5291C0AA8; Sun, 12 Jul 2026 00:59:40 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 7530E3EAF33; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 7B3531331D; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807180; bh=bgD0VM6AM50Vd6jB3em1zGjC4SlfPpGE69p3UfF72yo=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=IDm3lgvK4IboV+pfPVEXP43Ab1/+N8cv3mQTwPsGgiJoeBrxJEcBpU0n+Ku/Y5vsG f8XZYy5Eug8j68hov05BdIcARy6C9hV4u482LMekvC6QhPZOGoILtK1XNKtuzQHJ5t 8AueF6NyKXrsDCj6R4fRQ1mpJ9ppWKr5I1ZCpW4D3ZZcYQHqVCQSTOB2vxcNec+JYf ZYJD7XGe+xGkrH4h1XV1nQKKyp9+iRrgxOplLXsPYHd+YhxvCaNSUZQRNtgPxmolZX fcIRWyaO/VIVmLVA+B4Vy/6PtynIww/gEjwhEKmBoc3RXPrMay3PDvL6x84ljTt0o7 cjiwcexQH7lvw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, ZhengXiang Qin , Daniel Henrique Barboza , Alistair Francis , Michael Tokarev Subject: [Stable-11.0.3 29/81] target/riscv: avoid abort when reading vtype before env->xl is set Date: Sun, 12 Jul 2026 00:58:07 +0300 Message-ID: <20260711215904.3757-29-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807472540154100 Content-Type: text/plain; charset="utf-8" From: ZhengXiang Qin TCG plugins may read registers from the vcpu_init_cb() callback. For vtype, this reaches read_vtype() before env->xl has been initialized. In that case read_vtype() currently hits g_assert_not_reached() because env->xl is zero. Fall back to the CPU's maximum XLEN only for this early-init case. Fixes: 638181a180bd ("core/cpu-common: initialise plugin state before threa= d creation") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3545 Signed-off-by: ZhengXiang Qin Reviewed-by: Daniel Henrique Barboza Message-ID: Signed-off-by: Alistair Francis (cherry picked from commit 46d96da1309869af6261d1997623b7a5212814d8) Signed-off-by: Michael Tokarev diff --git a/target/riscv/csr.c b/target/riscv/csr.c index 60dba08b99c..c8f510709ae 100644 --- a/target/riscv/csr.c +++ b/target/riscv/csr.c @@ -919,7 +919,16 @@ static RISCVException read_vtype(CPURISCVState *env, i= nt csrno, target_ulong *val) { uint64_t vill; - switch (env->xl) { + int xl =3D env->xl; + /* + * TCG plugins can read registers before env->xl is initialized. + * Fall back to the CPU's maximum XLEN in that early-init case. + */ + if (xl =3D=3D 0) { + xl =3D riscv_cpu_mxl(env); + } + + switch (xl) { case MXL_RV32: vill =3D (uint32_t)env->vill << 31; break; --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807439; cv=none; d=zohomail.com; s=zohoarc; b=npwQFhulgGH2dRO8o6dKHSBKhQes6orBqu/ZcFSDtXmteRNm6G1MxS4X0sjhNiDTEVxqNZl963AFxsUfQYVLPO4XV+AQ5tJPNm7GnTr/0rQ7ej0Fk20ngVPHHACy4cc7MEecNir5KwAobePw4wMrMzWU/F+9HcJxBtGYR/qRqho= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807439; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=mS3+g/wh9WNQU/spidMfeO7RzLLrhEy3Zm10SsTkZ3w=; b=KwHLkF4bGq5IyR1HrId1ZSXR6lznyLRmdI6rN1fMPJHnWGEop19gONVkOSzQXYyIpF4526/hnAqJMsU4kyHxlCdLTJTdFDDOdo2D8wm2NXYYLEEJ4mQkkhFHCxgwz+q/ZGAD2rPmXlwDkCiiJiSwYlmLjDxAxWS59IcZFKBtghw= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807439222339.96964060025346; Sat, 11 Jul 2026 15:03:59 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifmm-0007FP-Rk; Sat, 11 Jul 2026 18:03:01 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wiflz-0006xB-Qe; Sat, 11 Jul 2026 18:02:14 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifly-0008Qi-5F; Sat, 11 Jul 2026 18:02:11 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id C32CD1C0AA9; Sun, 12 Jul 2026 00:59:40 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 7ABC93EAF34; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 7DE8A1331F; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807180; bh=wSNU6e7WpFXFiBVayG3OBCpB8wb0GuSFcimKi/wmiyw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=O3ldSQ5d9qx+lun8d2JBW5MAnSVZVmJuJQlt+w3sb5K3yOdyeXrNscWrazTH6Mf+W 3JGrksTHw9cmqF7tbNfxcF0lC30ZrxMBo6I6ILbmpIf8ReI1HxGh4+YwpFvbbmycjP C6qA5px3ucQ39lsQ/Bnpnv/ZzSqzq6P59M43jf5HLY5RJGLuy18eluouduAE/ek8vs S27t1sPq/v4ATf2gLrYS/gFkwCH4m/B0Q7ceWok82W82EGhxl2YhYLY3POPI3kErMb Rx11NiCs34lVzToZtXrFZ4so12mw44DiA17t0goA7JHVy+Ke1YBIBtTBbDAEKsz1ck hWXjPcZMu652w== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, SeungJu Cheon , Daniel Henrique Barboza , Alistair Francis , Michael Tokarev Subject: [Stable-11.0.3 30/81] target/riscv: Apply UXL WARL handling to vsstatus Date: Sun, 12 Jul 2026 00:58:08 +0300 Message-ID: <20260711215904.3757-30-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807442111154100 Content-Type: text/plain; charset="utf-8" From: SeungJu Cheon write_mstatus() already handles the reserved UXL value by writing a legal value instead. Apply the same handling when writing vsstatus so that reserved UXL values follow the same WARL behavior. Factor the common logic into a local helper riscv_write_uxl() and use it for both mstatus and vsstatus. Suggested-by: Daniel Henrique Barboza Fixes: f310df58bd2 ("target/riscv: Enable uxl field write") Signed-off-by: SeungJu Cheon Reviewed-by: Daniel Henrique Barboza Message-ID: <20260625081521.595683-1-suunj1331@gmail.com> Signed-off-by: Alistair Francis (cherry picked from commit dcd028517749835a618bb1fe8dca32d82318e1c1) Signed-off-by: Michael Tokarev diff --git a/target/riscv/csr.c b/target/riscv/csr.c index c8f510709ae..24c1f94ced0 100644 --- a/target/riscv/csr.c +++ b/target/riscv/csr.c @@ -1991,6 +1991,20 @@ static target_ulong legalize_mpp(CPURISCVState *env,= target_ulong old_mpp, return val; } =20 +static uint64_t riscv_write_uxl(CPURISCVState *env, uint64_t val, + uint64_t field) +{ + RISCVMXL xl =3D riscv_cpu_mxl(env); + uint64_t uxl =3D get_field(val, field); + + if (uxl =3D=3D MXL_RV128) { + uxl =3D xl =3D=3D MXL_RV128 ? MXL_RV64 : xl; + val =3D set_field(val, field, uxl); + } + + return val; +} + static RISCVException write_mstatus(CPURISCVState *env, int csrno, target_ulong val, uintptr_t ra) { @@ -2037,17 +2051,8 @@ static RISCVException write_mstatus(CPURISCVState *e= nv, int csrno, =20 if (xl !=3D MXL_RV32 || env->debugger) { if ((val & MSTATUS64_UXL) !=3D 0) { - uint64_t uxl =3D val & MSTATUS64_UXL >> 32; mask |=3D MSTATUS64_UXL; - - /* - * uxl =3D 3 is reserved so write the current xl instead. - * In case xl =3D MXL_RV128 (3) write MXL_RV64. - */ - if (uxl =3D=3D 3) { - uxl =3D xl =3D=3D MXL_RV128 ? MXL_RV64 : xl; - val =3D deposit64(val, 32, 2, uxl); - } + val =3D riscv_write_uxl(env, val, MSTATUS64_UXL); } } =20 @@ -5155,6 +5160,8 @@ static RISCVException write_vsstatus(CPURISCVState *e= nv, int csrno, uint64_t mask =3D (target_ulong)-1; if ((val & VSSTATUS64_UXL) =3D=3D 0) { mask &=3D ~VSSTATUS64_UXL; + } else { + val =3D riscv_write_uxl(env, val, VSSTATUS64_UXL); } if ((env->henvcfg & HENVCFG_DTE)) { if ((val & SSTATUS_SDT) !=3D 0) { --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807552; cv=none; d=zohomail.com; s=zohoarc; b=ZHNjkGz3PNQIwrd424kLoEIsIlIGUYsuCHHXdvX4VdRCMOwLjhBPPeq41ThO/J89H5HEqyYNDLs98ESc2sYTfqxfDC+n54CHScmIO3tSuWD9ca0HrcP12mTFibe5boj0plBm0g9iB43i967lxh3iRd3hCVVhta5YEwgYePhw9T8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807552; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=seu58t1ehWWVcdNpWYCB9h7ZAVYdjaYQvKCvhZHlvpw=; b=XXNhq7jHc9rGipfD8/2T6vrbpwwHycLgC88uYgz9EOziRVrrXAvG9VIyOTE7y8cECAMa0iLbvlgb5Y+WhTKxoAtUXJo37FS7G3zQ5bthiDUr46mxeXyLx2GkwDao6Ie8kEtboQxbM7+xPSc94TCkKfTDg3HFeGa2bxoHN4QUpXQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807552721557.3476438134293; Sat, 11 Jul 2026 15:05:52 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifms-0007KQ-Ex; Sat, 11 Jul 2026 18:03:08 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifmT-000757-Ft; Sat, 11 Jul 2026 18:02:48 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifmJ-0008R1-4i; Sat, 11 Jul 2026 18:02:41 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id C99871C0AAA; Sun, 12 Jul 2026 00:59:40 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 809153EAF35; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 8066A13321; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807180; bh=CfSexboYRS/1Z1iCe1umkDb7DPBvt9e8icLwEcVCMdQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=ly8JmmzEQyzeawAgJhwofXBEwoH19uD17rap+usXnK0d6TyJrlqW0Gb2gu6ahW/ll xZfJlCCwnmqmmWExec83uTNq0WmCoHRzbNP2HIQKMnYWDMdqfJJqiZn3c8JDl6UdjC WuGagA6lChiPQBWobYYrEM6N/BRjBIQieJJo0nEEJAhtswgAEEKhKtLFvRhXjImJhl j5mCTKtdhtHND5pjHD8+OrQFpGQv8Q6FjWuKub1TYLwe+kFJn+86UgF+jTOUoYuB2S DSk45SsKaB4aqJ5ipPCFQcYYFxiRsTj22SnPURikOlXi7tTQDDlLNUSFNhazTeEQu+ gxA6EUbCyKIbg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Daniel Henrique Barboza , Alistair Francis , Nutty Liu , Michael Tokarev Subject: [Stable-11.0.3 31/81] hw/riscv/riscv-iommu.c: always fault with SADE=0 and A=0 Date: Sun, 12 Jul 2026 00:58:09 +0300 Message-ID: <20260711215904.3757-31-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807553635154100 Content-Type: text/plain; charset="utf-8" From: Daniel Henrique Barboza riscv-iommu spec: "If SADE is 1, the IOMMU updates A and D bits in first-stage PTEs atomically. If SADE is 0, the IOMMU causes a page-fault corresponding to the original access type if the A bit is 0 or if the memory access is a store and the D bit is 0.". Note that SADE=3D0 and A=3D0 will always cause a fault regardless of the original access type. Right now we're faulting in this case just for reads. Fixes: 0c54acb8243d ("hw/riscv: add RISC-V IOMMU base emulation") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3551 Signed-off-by: Daniel Henrique Barboza Acked-by: Alistair Francis Reviewed-by: Nutty Liu Message-ID: <20260630211044.82894-1-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis (cherry picked from commit 64ce9ac18757d79f3b5b337f7bcbdd0dabef3ce1) Signed-off-by: Michael Tokarev diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c index 917a9690810..b2e2ee486e9 100644 --- a/hw/riscv/riscv-iommu.c +++ b/hw/riscv/riscv-iommu.c @@ -470,7 +470,7 @@ static int riscv_iommu_spa_fetch(RISCVIOMMUState *s, RI= SCVIOMMUContext *ctx, break; /* Read access check failed */ } else if ((iotlb->perm & IOMMU_WO) && !(pte & PTE_W)) { break; /* Write access check failed */ - } else if ((iotlb->perm & IOMMU_RO) && !ade && !(pte & PTE_A)) { + } else if (!ade && !(pte & PTE_A)) { break; /* Access bit not set */ } else if ((iotlb->perm & IOMMU_WO) && !ade && !(pte & PTE_D)) { break; /* Dirty bit not set */ --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807429; cv=none; d=zohomail.com; s=zohoarc; b=AONWvuJsKitrXWj/FmHB/DbMYMa55A181b46tv/LRf1daKyfxcAGeY5nthyrd2m3h16/5a8lR4yipA4LFxW31+oxDQLNtwlBSraVULxrexaOrngS9MdvThIaL+YEuvBxIrVK0WAv3uy+AvkSGJ+z7nChZZEdQvTAjgHR19JR2YA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807429; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=zudyS5t9Dszi50xDVFML5qeCvFY/KAdcnpXSXlprbd4=; b=njkPvomfF0pobFB1SWJP159yCP6RRE8r8ScjTTjk8LYjbQGz6bOtcPTGppuMUsXnMskpwvRTd9c2/e8QAsZy/A2AAT/T4Gv5/MA7TBYeCBholccRJFhcz3/yOpA8nURD8JV1am3mr70O46/u5FJHgsG3ga1w2Nbx6SsOeItkofw= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807429555545.9740218934198; Sat, 11 Jul 2026 15:03:49 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifmm-0007Bq-IZ; Sat, 11 Jul 2026 18:03:00 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifmU-000759-Gd; Sat, 11 Jul 2026 18:02:48 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifmL-0008RN-9x; Sat, 11 Jul 2026 18:02:41 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id D051F1C0AAB; Sun, 12 Jul 2026 00:59:40 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 86F8A3EAF36; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 82C4813323; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807180; bh=lqu+kprOeII3+eEnwuEAvOlbZGnBz2nwZfl6x19HGcM=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=tVCifyZO0GmhP/IbKb34Qv2MBCGQ4SguKsHW60HonSb95vEI82VUci/t6JU1aCQc8 WAvfEONwL0XNw5TJGp8v13YUVB4Rh3s454tsOZsew/KJaC+HfHnaDPZxfHe2WxmEBU AWWEmMIwxrfTMbuXGjEmSkRqpc8L5p+pbvVQKk58Fv5Ydqi6iE4qL41xle3F3fEEoH JwFSjcXm6hK29NYWPOVx64tRNpy3Eb2sNK2qofKIfi0DpVKtLSEwhOXkHYufOEb5K3 39ZckbMEyqpg7agzesDHUJMidQDnqygqApGJ++WXnjngSE2vMB6iFmSJ/UntQSXgFQ FiQ/X73eeePog== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Laurent Vivier , "Michael S. Tsirkin" , Michael Tokarev Subject: [Stable-11.0.3 32/81] hw/char/virtio-serial-bus: fix guest-triggerable OOM in control_out() Date: Sun, 12 Jul 2026 00:58:10 +0300 Message-ID: <20260711215904.3757-32-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807431901154100 Content-Type: text/plain; charset="utf-8" From: Laurent Vivier A malicious guest can craft virtqueue descriptors with arbitrary lengths. control_out() calls iov_size() on the guest-supplied scatter-gather list and passes the result directly to g_malloc(), allowing a guest to force QEMU to attempt multi-gigabyte allocations and crash the host process. Fix this by copying at most sizeof(struct virtio_console_control) into a stack-local variable instead of allocating a buffer sized by the guest. handle_control_message() only accesses the fixed-size id, event, and value fields, so no data beyond the struct was ever needed. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3585 Signed-off-by: Laurent Vivier Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Message-ID: <20260622161144.2883799-1-lvivier@redhat.com> (cherry picked from commit 36b37f8494800ed9c5d4b6ef03924bd1636cb810) Signed-off-by: Michael Tokarev diff --git a/hw/char/virtio-serial-bus.c b/hw/char/virtio-serial-bus.c index cd234dc6db1..c1973f0248f 100644 --- a/hw/char/virtio-serial-bus.c +++ b/hw/char/virtio-serial-bus.c @@ -344,22 +344,16 @@ void virtio_serial_throttle_port(VirtIOSerialPort *po= rt, bool throttle) } =20 /* Guest wants to notify us of some event */ -static void handle_control_message(VirtIOSerial *vser, void *buf, size_t l= en) +static void handle_control_message(VirtIOSerial *vser, + struct virtio_console_control *gcpkt) { VirtIODevice *vdev =3D VIRTIO_DEVICE(vser); struct VirtIOSerialPort *port; VirtIOSerialPortClass *vsc; - struct virtio_console_control cpkt, *gcpkt; + struct virtio_console_control cpkt; uint8_t *buffer; size_t buffer_len; =20 - gcpkt =3D buf; - - if (len < sizeof(cpkt)) { - /* The guest sent an invalid control packet */ - return; - } - cpkt.event =3D virtio_lduw_p(vdev, &gcpkt->event); cpkt.value =3D virtio_lduw_p(vdev, &gcpkt->value); =20 @@ -457,41 +451,27 @@ static void control_in(VirtIODevice *vdev, VirtQueue = *vq) =20 static void control_out(VirtIODevice *vdev, VirtQueue *vq) { + struct virtio_console_control cpkt; VirtQueueElement *elem; VirtIOSerial *vser; - uint8_t *buf; size_t len; =20 vser =3D VIRTIO_SERIAL(vdev); =20 - len =3D 0; - buf =3D NULL; for (;;) { - size_t cur_len; - elem =3D virtqueue_pop(vq, sizeof(VirtQueueElement)); if (!elem) { break; } =20 - cur_len =3D iov_size(elem->out_sg, elem->out_num); - /* - * Allocate a new buf only if we didn't have one previously or - * if the size of the buf differs - */ - if (cur_len > len) { - g_free(buf); - - buf =3D g_malloc(cur_len); - len =3D cur_len; + len =3D iov_to_buf(elem->out_sg, elem->out_num, 0, &cpkt, sizeof(c= pkt)); + if (len =3D=3D sizeof(cpkt)) { + handle_control_message(vser, &cpkt); } - iov_to_buf(elem->out_sg, elem->out_num, 0, buf, cur_len); =20 - handle_control_message(vser, buf, cur_len); virtqueue_push(vq, elem, 0); g_free(elem); } - g_free(buf); virtio_notify(vdev, vq); } =20 --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807682; cv=none; d=zohomail.com; s=zohoarc; b=Ku9JdWCnlmUeUwxwC8CK7b2NWOro75dh4oJ7phNkgf41dFb84t0j4P+r2rS1tkm1XCOqkEGBw3MyFytiQ+pHZfa3OOudaFcqPOXbBqujXYh/BsRsu5kUWHhK4W3UCd3Ki11GBywOKhXXO8N0/sXOSWxJBAWXXkCUo4+JbcVlp2o= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807682; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=Jt17RFftt0Kd1FeWIW2v1X2vOqXi66j01vvb4ontpLU=; b=BSaNk5syrC+xxtowdfVK5V7RDN4nS2lbp31oMoKPM/0t4hYtkbUTb+l8qduhRctNpxU3npdGtEfdpdBiUEx03mgDrVZeJCkucuZ3PvO+9Ow3gmXTIlIQcO+uz71ZrmBjLFU6ddgQL+/n0eOdOVyWgcMeDrB/GgmAT9quxOaiVmI= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807682885574.6689352764613; Sat, 11 Jul 2026 15:08:02 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifn0-0007SY-Hh; Sat, 11 Jul 2026 18:03:16 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifmb-00077M-6l; Sat, 11 Jul 2026 18:02:52 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifmU-0008SY-UA; Sat, 11 Jul 2026 18:02:47 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id D69E41C0AAC; Sun, 12 Jul 2026 00:59:40 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 8C8E03EAF37; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 853D913325; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807180; bh=fYD8Ier1c5QbI/U/nrPzBD2gUia+2eLE+0NOE8uWsVk=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=PbXu9BgpUP9x0zOzqIWzzUWH9VZDuDyvmZFGnwjmUf6cuQrbrv99GYLDezCSN7rnJ QQPazoRKs4f3TvZ/1zrYKDtWgJ7OYKjEoOXgLqq0hfQUmiGFf2An2hrh/rMQ1w6qWN u1rk3U7tMgiuYvHxDop0pvWujpOTNat6p3agp9vMv2YYgVwUmPmTMdA1OpKC10McHD hUKKoVxqvLX1QNsoa9sDZAgHSLpFm6vuY6EUuuNBfIGW7eQ4oZDK+U0gM9RuRUTA6J vGWQmG0oHsuf5EuYYCmOK5fFAdxjmk+0tMwGDy6rp1qkk2l4LKp1g0RbXkYC2barXf VA3LwIeA9dqCw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Junjie Cao , "Michael S. Tsirkin" , Michael Tokarev Subject: [Stable-11.0.3 33/81] virtio-net: validate RSS indirections_len in post_load Date: Sun, 12 Jul 2026 00:58:11 +0300 Message-ID: <20260711215904.3757-33-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807685411154100 From: Junjie Cao virtio_net_handle_rss() enforces that indirections_len is a non-zero power of two no larger than VIRTIO_NET_RSS_MAX_TABLE_LEN, but virtio_net_rss_post_load() applies none of these checks to values restored from the migration stream. A corrupted save file or crafted migration stream can set indirections_len to 0. Even if it also clears redirect, virtio_load() calls set_features_nocheck() after the device vmstate (including the RSS subsection and its post_load) has already been loaded, re-deriving redirect from the negotiated guest features. When VIRTIO_NET_F_RSS was negotiated, redirect is set back to true regardless of the migration stream value. The receive path then computes hash & (indirections_len - 1) /* wraps to 0xFFFFFFFF via int promotio= n */ and uses the result to index into indirections_table, which was not allocated by the VMState loader when the element count is zero (see vmstate_handle_alloc()), resulting in a NULL pointer dereference that crashes QEMU: #0 virtio_net_process_rss ../hw/net/virtio-net.c:1901 #1 virtio_net_receive_rcu ../hw/net/virtio-net.c:1921 #2 virtio_net_do_receive ../hw/net/virtio-net.c:2061 #3 nc_sendv_compat ../net/net.c:823 #4 qemu_deliver_packet_iov ../net/net.c:870 The RSS subsection is only loaded when rss_data.enabled is true (via virtio_net_rss_needed()), and the command path always produces indirections_len in {1, 2, 4, =E2=80=A6, 128}, so an unconditional check cannot reject a legitimate migration stream. Factor the validation into virtio_net_rss_indirections_len_valid() and call it from both virtio_net_handle_rss() and virtio_net_rss_post_load(). Fixes: e41b711485e5 ("virtio-net: add migration support for RSS and hash re= port") Cc: qemu-stable@nongnu.org Signed-off-by: Junjie Cao Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Message-ID: <20260324060100.1997-1-junjie.cao@intel.com> (cherry picked from commit 32a90850e1e4222091df07b4b46d5f46a8b90d24) Signed-off-by: Michael Tokarev diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c index 2a5d642a647..f0e3beb2903 100644 --- a/hw/net/virtio-net.c +++ b/hw/net/virtio-net.c @@ -1374,6 +1374,11 @@ static void virtio_net_unload_ebpf(VirtIONet *n) ebpf_rss_unload(&n->ebpf_rss); } =20 +static bool virtio_net_rss_indirections_len_valid(uint16_t len) +{ + return is_power_of_2(len) && len <=3D VIRTIO_NET_RSS_MAX_TABLE_LEN; +} + static uint16_t virtio_net_handle_rss(VirtIONet *n, struct iovec *iov, unsigned int iov_cnt, @@ -1411,14 +1416,9 @@ static uint16_t virtio_net_handle_rss(VirtIONet *n, if (!do_rss) { n->rss_data.indirections_len =3D 0; } - if (n->rss_data.indirections_len >=3D VIRTIO_NET_RSS_MAX_TABLE_LEN) { - err_msg =3D "Too large indirection table"; - err_value =3D n->rss_data.indirections_len; - goto error; - } n->rss_data.indirections_len++; - if (!is_power_of_2(n->rss_data.indirections_len)) { - err_msg =3D "Invalid size of indirection table"; + if (!virtio_net_rss_indirections_len_valid(n->rss_data.indirections_le= n)) { + err_msg =3D "Invalid indirection table length"; err_value =3D n->rss_data.indirections_len; goto error; } @@ -3427,6 +3427,13 @@ static int virtio_net_rss_post_load(void *opaque, in= t version_id) n->rss_data.supported_hash_types =3D VIRTIO_NET_RSS_SUPPORTED_HASH= ES; } =20 + if (!virtio_net_rss_indirections_len_valid(n->rss_data.indirections_le= n)) { + error_report("virtio-net: saved image has invalid RSS " + "indirections_len: %u", + n->rss_data.indirections_len); + return -EINVAL; + } + return 0; } =20 --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807469; cv=none; d=zohomail.com; s=zohoarc; b=ZKIa4AsO7brjTTJNQCezGCq3k2648UtAvOy47AUmul5CFu6PvdKxz9KzZvz6kdZgM7Cne6b8oxhCwQmFJy2gPaNWEeqwZuaS98qlkj0KDFT3L1qUADvCqLXlFkFkEYfuHl06oAciJEy7H5I4MoyWUbIcMyTbZCG5VfPqe+VYNFI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807469; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=+4WmdFGi7Nan6zItwHhQQe4Pb3w8FXK/N4aXK1T9Eto=; b=Tclix5y6Z3qiA8O73PhFJt3JbGjSZ9bReXxsC9RN0SBbgp0CcmPonR2M9XRTruEacRNTuMnNP8Ld5jlJUMgLm34Wvx6XL7a+Ux2zv+hSXaLrIJE969UCic5/7SnayrO9l7wPymBwIoBFVNNT0tfATlYg24yts6ZPJ2KpfH2Em+k= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807469094903.5574232552725; Sat, 11 Jul 2026 15:04:29 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifmw-0007PG-Hm; Sat, 11 Jul 2026 18:03:10 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifmd-00077Q-3H; Sat, 11 Jul 2026 18:02:52 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifmb-0008Si-8h; Sat, 11 Jul 2026 18:02:50 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id DBA6F1C0AAD; Sun, 12 Jul 2026 00:59:40 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 91D0C3EAF38; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 87A1713327; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807180; bh=N6CrWlcueapDe57i8B21TJMFx1p1nROoiikxrxvS2aY=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=RLiFjxvdyMOuyfSXZNQDIYmAdTA3rMQWavHK4ZEXI8y2z7xN+hQtvrj6Xk1DLlrko 0YxvPDoUKqUiiLI4SjQZAmr0ZMkfW4JrX+xBgtAQ8qm6SMuZlyK3i2opawUcq/Xp8q scP/lHjp21BZXj4mzRPZRAz54HwiyO7j1FTgWkpftMe7KOJXgsNk0qxk67cQXVeRno iZ610ERfSkb4dGzkBr5lR2yojcJlnDCDbuqKg7HzhDZzXlvCgdRJZ+jFrLGcN43979 I3omPS67wHaQuDH44z9SdG4YQiFAtkq0qZ7+AEEcBWdSOnzkZdPa7HX0zgWNp7ZC5S SsIhA3asgeqcA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Feifan Qian , Peter Maydell , Michael Tokarev Subject: [Stable-11.0.3 34/81] hw/net/fsl_etsec: validate FCB offsets in process_tx_fcb() Date: Sun, 12 Jul 2026 00:58:12 +0300 Message-ID: <20260711215904.3757-34-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807470435154100 Content-Type: text/plain; charset="utf-8" From: Feifan Qian The TX Frame Control Block (FCB) is prepended to a TX frame when BD_TX_TOEUN is set. It contains two guest-controlled u8 offset fields that process_tx_fcb() uses to locate L3/L4 headers within the frame buffer: l3_header_offset =3D FCB byte 3 (0..255) l4_header_offset =3D FCB byte 2 (0..255) These offsets are applied without any bounds check. When the UDP-no-CTU branch is taken, the function writes zero to l4_header[6] and l4_header[7]. With both offsets set to 0xFF the write target is: tx_buffer + 8 + 255 + 255 + 6/7 =3D tx_buffer + 525 A malicious guest can therefore corrupt up to 509 bytes of heap memory beyond a minimally-sized (16 B) TX frame. Fix: reject the frame and log a guest error when the minimum required buffer length 8 (FCB) + l3_header_offset + l4_header_offset + 8 exceeds tx_buffer_len. Move the l3_header and l4_header pointer declarations past the new guard so that out-of-bounds pointers are never materialised. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3517 Signed-off-by: Feifan Qian Reviewed-by: Peter Maydell Signed-off-by: Peter Maydell (cherry picked from commit bc22c7e4187a619bf9ff7776288b588322e9ee41) Signed-off-by: Michael Tokarev diff --git a/hw/net/fsl_etsec/rings.c b/hw/net/fsl_etsec/rings.c index 22660c32b84..e60303f52cf 100644 --- a/hw/net/fsl_etsec/rings.c +++ b/hw/net/fsl_etsec/rings.c @@ -176,15 +176,30 @@ static void tx_padding_and_crc(eTSEC *etsec, uint32_t= min_frame_len) static void process_tx_fcb(eTSEC *etsec) { uint8_t flags =3D (uint8_t)(*etsec->tx_buffer); - /* L3 header offset from start of frame */ + /* L3 header offset from start of frame (FCB byte 3) */ uint8_t l3_header_offset =3D (uint8_t)*(etsec->tx_buffer + 3); - /* L4 header offset from start of L3 header */ + /* L4 header offset from start of L3 header (FCB byte 2) */ uint8_t l4_header_offset =3D (uint8_t)*(etsec->tx_buffer + 2); + uint8_t *l3_header; + uint8_t *l4_header; + int csum =3D 0; + + /* + * Validate FCB header offsets before pointer arithmetic. The highest + * byte accessed is l4_header[7], at offset + * 8 (FCB size) + l3_header_offset + l4_header_offset + 7 + * from tx_buffer. Drop the frame if this exceeds the buffer length. + */ + if (etsec->tx_buffer_len < 8u + l3_header_offset + l4_header_offset + = 8u) { + qemu_log_mask(LOG_GUEST_ERROR, + "eTSEC: FCB offsets exceed frame length, dropping\n"= ); + return; + } + /* L3 header */ - uint8_t *l3_header =3D etsec->tx_buffer + 8 + l3_header_offset; + l3_header =3D etsec->tx_buffer + 8 + l3_header_offset; /* L4 header */ - uint8_t *l4_header =3D l3_header + l4_header_offset; - int csum =3D 0; + l4_header =3D l3_header + l4_header_offset; =20 /* if packet is IP4 and IP checksum is requested */ if (flags & FCB_TX_IP && flags & FCB_TX_CIP) { --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807605; cv=none; d=zohomail.com; s=zohoarc; b=n2DwPitkbZNPiz6uRXjRlYaHJ+7YspQbWeZNbEdxGfLfULK8FrrjGR4Gx0eCB0jSVyC2gupxu8jt2F/zGZIQB3vK7cb0Fn2s6LH/uBB6w17412mKpIJRXw5Lk9RDL3RrKZsKyPxIH6leNwsO9kcApfjCFYTSGNYpBM4ao7blLQE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807605; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=1qW+ZmDKtHEiA9VweKsi1Yu+YMm8eENoIoZT1NztUjc=; b=kq3GDXdm6/4ksgw4HXcQneZisoPOX6Z3/yHRHNPwLSFENrC1KLNxuqkkqVOeuZpYVZlCXk/bHgQsq8mB+rHzEVOlQsSbgJegciLTn2A8RuYXhosLDQx2G/n7lVVNUl4ZNjV/xyyoe27M19X/rZBTwF5FrPYfXec6+crkWri0Au4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807605851558.9200449728799; Sat, 11 Jul 2026 15:06:45 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifmn-0007HR-Ct; Sat, 11 Jul 2026 18:03:02 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifme-00077b-6q; Sat, 11 Jul 2026 18:02:53 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifmc-0008TK-Km; Sat, 11 Jul 2026 18:02:51 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id E3D0B1C0AAE; Sun, 12 Jul 2026 00:59:40 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 98C353EAF39; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 89F8B13329; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807180; bh=3RD5JNOkSPrWlHNEmA/+dJRj4CoMpMAytqA+nPxw8uA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=wBP3KE+yLd8eolA8NCcPdUUjrYz92P5129QQmtSIygRqmtyB1lAskK1uSd5mp+xIT xvagADwqLHNAytlJFSrQjVh+0LSzy7Uk5TA3Vj9CcL821+WhDloJFYJevjWjrXiwuP SeWVw56QgVNfoSVIniy09j3+VYRV62KHal2vbl6OFYjgP5hftkpZlS7P9YO4dVzrRO X/cU18+n/WEAPQB6Ap5y4GGV11y8ktOD05FJ/VjZx+4e8hYaa71NgNgT2Wjt8UwgPl KOIhvJsSjasrQoKBVD8ocsxnSWRky/PcJyRlLsUDb1TJNi4K8YseJsluboswzI9a+R kUeQAi/eXIoIQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Oliver Upton , Richard Henderson , Peter Maydell , Michael Tokarev Subject: [Stable-11.0.3 35/81] target/arm: Only evaluate SCR_EL3.PIEN if ARM_FEATURE_EL3 is present Date: Sun, 12 Jul 2026 00:58:13 +0300 Message-ID: <20260711215904.3757-35-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807608463154100 Content-Type: text/plain; charset="utf-8" From: Oliver Upton Running KVM with (as of writing, out-of-tree) support for FEAT_S2PIE on -cpu max gets stuck in an infinite loop of stage-2 permission faults due to the PTW incorrectly using an effective value of 0 for S2PIR_EL2. Similar to how S1PIE is handled, only use the IMPLEMENTATION SPECIFIC value of 0 for S2PIR_EL2 if EL3 is implemented and PIEN=3D0. Cc: qemu-stable@nongnu.org Fixes: a811c5dafb ("target/arm: Implement get_S2prot_indirect") Reviewed-by: Richard Henderson Signed-off-by: Oliver Upton Message-id: 20260626231738.947317-1-oupton@kernel.org [PMM: removed hardcoded tab] Signed-off-by: Peter Maydell (cherry picked from commit d77a93ca4b53da18ce01c5b7678e0eb435851919) Signed-off-by: Michael Tokarev diff --git a/target/arm/ptw.c b/target/arm/ptw.c index 7b993bb5b39..df98cf87aaf 100644 --- a/target/arm/ptw.c +++ b/target/arm/ptw.c @@ -1392,9 +1392,14 @@ static int get_S2prot_indirect(CPUARMState *env, Get= PhysAddrResult *result, PAGE_READ | PAGE_WRITE }, }; =20 - uint64_t pir =3D (env->cp15.scr_el3 & SCR_PIEN ? env->cp15.s2pir_el2 := 0); - int s2pi =3D extract64(pir, pi_index * 4, 4); + uint64_t pir =3D env->cp15.s2pir_el2; + int s2pi; =20 + if (arm_feature(env, ARM_FEATURE_EL3) && !(env->cp15.scr_el3 & SCR_PIE= N)) { + pir =3D 0; + } + + s2pi =3D extract64(pir, pi_index * 4, 4); result->f.prot =3D perm_table[s2pi][2]; return perm_table[s2pi][s1_is_el0]; } --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807467; cv=none; d=zohomail.com; s=zohoarc; b=MJqVGSMWO90FVPwT69vw+x7ol1FFqAtwkM68IWuMG5g++B3UrXSEq0iTP3E3NU8zdqKRvHNH4ii6CceJhfynJkQsINytVjabNYT6biF84OxkCovkv+AFFrU1GQ5FL9qaxxvo89EFFXIyFgPC6x3LeeFERbsKnxJepUT+y8wTET4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807467; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=f4y78DZuWE72gNoonYDHT4sqoWtE+t4xNKIT2ywME4M=; b=WE/KKRlFci3XH0gx867QTKRQQaHxmgw6DhDVOilc0s8FdlXQ+tdxcqfuySWiCPU3MshknRDLHt9244zANbqpGlUMfi6fQaZOvl6+mMZqAqXcmu6chaEbo2AFiSSyMXiBxennMyCvnunGDZqCuTD1IxMBJZYuqvTNeHS3sQEIA8Y= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807467084533.5361668942935; Sat, 11 Jul 2026 15:04:27 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifnJ-0007pP-Ux; Sat, 11 Jul 2026 18:03:34 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifmi-0007A8-T9; Sat, 11 Jul 2026 18:02:58 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifme-0008Tj-Vh; Sat, 11 Jul 2026 18:02:55 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id E8CB71C0AAF; Sun, 12 Jul 2026 00:59:40 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 9DC0A3EAF3A; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 8C89D1332B; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807180; bh=3cwmI49HXM72Da66YxfJEp4L0b8B2GoQ2HW28gHV5eQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=NZ0hxNYn9zc36XFmjP4FCPILYy14Req/iG5nPPfHydHbcoDjSfw+gns/Jo0EHut6C 76Z8/GwC3DuXa0JAhBE2Rq3hSKUi4IOJpXdlTJAb6PLmqfJX4tKlkAnkUsBivA56it pHmzYEtQ2U7fsyWY2qRswjSS4xuBm9P8x55WowNcKM9fksLf9LBc0JFeSivT9Ob3OT C12YeqUhD5waMhDtkJ1Mgh8KvtrMDbEmFT5ESPs0NQr5RYwI+a2yf1VA/4jtM4c9Y9 Q0lu5VNsY/yJUsm0sszsaaKldveiA3jcP0eKhOv6cDm01xqhxL4gZlPj9tClFZqnjD kDrtPgGobfihw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, =?UTF-8?q?Alex=20Benn=C3=A9e?= , Peter Maydell , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Arnd Bergmann , Michael Tokarev Subject: [Stable-11.0.3 36/81] hw/arm: use cortex-a9 mpcore base for CBAR on npcm7xx machines Date: Sun, 12 Jul 2026 00:58:14 +0300 Message-ID: <20260711215904.3757-36-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807468500154100 From: Alex Benn=C3=A9e CBAR is an IMPDEF register and according to the A9 TRM [1]: In Cortex-A9 MPCore implementations, the base address is reset to PERIPHBASE[31:13] so that software can determine the location of the private memory region [2]. If it doesn't we will confuse the Linux kernel as it probes the system SCU registers [3] and erroneously assumes the system is a buggy Aegis SOC and nerf the emission of SEV instructions, deadlocking any WFE's in the kernel (or QEMU smpboot code). [1] https://developer.arm.com/documentation/ddi0388/i/system-control/regist= er-descriptions/configuration-base-address-register [2] https://developer.arm.com/documentation/ddi0407/g/Introduction/Private-= Memory-Region [3] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree= /arch/arm/kernel/head.S?h=3Dv7.1#n550 Fixes: 2d8f048c25ab ("hw/arm: Add NPCM730 and NPCM750 SoC models") Cc: qemu-stable@nongnu.org Signed-off-by: Alex Benn=C3=A9e Reviewed-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daud=C3=A9 Message-id: 20260624103049.884930-2-alex.bennee@linaro.org Suggested-by: Arnd Bergmann Reviewed-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daud=C3=A9 Signed-off-by: Peter Maydell (cherry picked from commit 62b425bec3d52a326781025d1c51eb4d65ece49e) Signed-off-by: Michael Tokarev diff --git a/hw/arm/npcm7xx.c b/hw/arm/npcm7xx.c index c2bbcd89dbc..c27f149c04a 100644 --- a/hw/arm/npcm7xx.c +++ b/hw/arm/npcm7xx.c @@ -492,7 +492,7 @@ static void npcm7xx_realize(DeviceState *dev, Error **e= rrp) /* CPUs */ for (i =3D 0; i < nc->num_cpus; i++) { object_property_set_int(OBJECT(&s->cpu[i]), "reset-cbar", - NPCM7XX_GIC_CPU_IF_ADDR, &error_abort); + NPCM7XX_CPUP_BA, &error_abort); object_property_set_bool(OBJECT(&s->cpu[i]), "reset-hivecs", true, &error_abort); =20 --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807559; cv=none; d=zohomail.com; s=zohoarc; b=ZK1cO0YQf6310jY2EEzU8XY02fcTrOSQmtGWtMDzHrPpwa0+LHPKHq6ypjszcEzoQGrhBD51It3cjyG06g5yLopxpzciiTL4vAEM/qFoFrfe9i8EM2cT4D7pvMEeUiei8nMQuD6yL72v9QAGYGLVN73MT5i/G1c3QQRr+cN6v2U= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807559; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=L986xgGB+qAC9ags2+pmTu1UAYk/3suOY8Vv+gdqE94=; b=KseIPpcNScPnChOoDp/xW+JitQjkOmIJUPCwEMV0tP7/W5Tzwr0Uq90zYm4ik0TOq/3ST2j8jGtzBqYVoHOKttE8sN6tD9TT/rBHKVdEPJ/3fd37iZBb5q+QtKFFMV0Vqv0Hhy9ehGRdP2rqtrczSEzDjN+SkUtktVpp8+I19Wk= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807558995986.9800074737335; Sat, 11 Jul 2026 15:05:58 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifnR-0008Ly-5t; Sat, 11 Jul 2026 18:03:41 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifmk-0007AP-Ge; Sat, 11 Jul 2026 18:02:58 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifmg-0008Tu-Vp; Sat, 11 Jul 2026 18:02:58 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id EF9F61C0AB0; Sun, 12 Jul 2026 00:59:40 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id A48E03EAF3B; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 8F1871332D; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807180; bh=2/UMdZmGkrqCMWpA4A1Pr5CQLkrQP/7AvMXSoTxKWMM=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=AfGFdYxFJ4ZlznojKjQP+GZ2uWs1aSg31uEE+Kqh4RnA/J/MsmxcCCNpIP+aM62Et p8BjJxTZa1sFFef70paiBOOnuAsb9EydyzUZbAmAlUq4eMfDhBxtbnsqGuPy7cMZGT xRWR/OURCWS9FMMRCG+euMa+sqL54POcAeL2lJdz01sn9kstaAAsNhZCVdlJjRTY2q /HdHnpWAKcLgRIFkThBsMSDmoe4ecpLhoJoDbJmk/iwaA62qkuABx+yB/pEwA80jzq yuN6w/UPMMEkeNFOrcWwQl4ISeGkKcJvO0cR89wCeUksSRO392xtKl6ex7s3YULimf RaeJUI/xdMeRQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Jesper Wendel Devantier , jaeyeong , Jesper Wendel Devantier , Klaus Jensen , Michael Tokarev Subject: [Stable-11.0.3 37/81] hw/nvme: fix FDP set FDP events Date: Sun, 12 Jul 2026 00:58:15 +0300 Message-ID: <20260711215904.3757-37-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807559950154100 Content-Type: text/plain; charset="utf-8" From: Jesper Wendel Devantier Addresses an issue reported whereby user-provided event type values could trigger two issues: 1. if provided event_type =3D=3D 0xff -> out-of-bounds access 2. if provided event_type > 7 -> generate a value too large for the u8 event mask. This patch fixes (1) by correctly adjusting the length of the look-up array to be 256 values. This patch fixes (2) by: a. changing the event_type mask to 64bit, matching NvmeRuHandle.event_filter b. Matching the behavior of Get Feature - FDP Events by skipping event type values which we do not support. 5.2.26.1.21 of the 2.3 Base specification does not explicitly tell us to reject unsupported event type values. c. Documenting in the event type lookup table, that supporting event types greater than 63 requires refactoring the masking code. Cc: qemu-stable@nongnu.org Reported-by: jaeyeong Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3631 Signed-off-by: Jesper Wendel Devantier Reviewed-by: Klaus Jensen Signed-off-by: Klaus Jensen (cherry picked from commit ec917cd49918b6135546b4f6c02658a1913e3d7c) Signed-off-by: Michael Tokarev diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c index 8463fd3e9a0..28cc8d0e7dc 100644 --- a/hw/nvme/ctrl.c +++ b/hw/nvme/ctrl.c @@ -6242,10 +6242,6 @@ static uint16_t nvme_get_feature_fdp_events(NvmeCtrl= *n, NvmeNamespace *ns, for (uint8_t event_type =3D 0; event_type < FDP_EVT_MAX; event_type++)= { uint8_t shift =3D nvme_fdp_evf_shifts[event_type]; if (!shift && event_type) { - /* - * only first entry (event_type =3D=3D 0) has a shift value of= 0 - * other entries are simply unpopulated. - */ continue; } =20 @@ -6490,9 +6486,9 @@ static uint16_t nvme_set_feature_fdp_events(NvmeCtrl = *n, NvmeNamespace *ns, uint8_t noet =3D (cdw11 >> 16) & 0xff; uint16_t ret, ruhid; uint8_t enable =3D le32_to_cpu(cmd->cdw12) & 0x1; - uint8_t event_mask =3D 0; + uint64_t event_mask =3D 0; unsigned int i; - g_autofree uint8_t *events =3D g_malloc0(noet); + g_autofree uint8_t *events =3D NULL; NvmeRuHandle *ruh =3D NULL; =20 assert(ns); @@ -6505,15 +6501,29 @@ static uint16_t nvme_set_feature_fdp_events(NvmeCtr= l *n, NvmeNamespace *ns, return NVME_INVALID_FIELD | NVME_DNR; } =20 + if (unlikely(noet =3D=3D 0)) { + return NVME_SUCCESS; + } + ruhid =3D ns->fdp.phs[ph]; ruh =3D &n->subsys->endgrp.fdp.ruhs[ruhid]; =20 + events =3D g_malloc0(noet); + ret =3D nvme_h2c(n, events, noet, req); if (ret) { return ret; } =20 for (i =3D 0; i < noet; i++) { + /* + * We ignore requests to enable tracking of unsupported FDP event = types + */ + uint8_t event_type =3D events[i]; + uint8_t shift =3D nvme_fdp_evf_shifts[event_type]; + if (!shift && event_type) { + continue; + } event_mask |=3D (1 << nvme_fdp_evf_shifts[events[i]]); } =20 diff --git a/hw/nvme/nvme.h b/hw/nvme/nvme.h index d66f7dc82d5..ad0f8fa9678 100644 --- a/hw/nvme/nvme.h +++ b/hw/nvme/nvme.h @@ -160,7 +160,14 @@ typedef struct NvmeZone { #define NVME_FDP_MAX_NS_RUHS 32u #define FDPVSS 0 =20 -static const uint8_t nvme_fdp_evf_shifts[FDP_EVT_MAX] =3D { +/* + * NOTE: Apart from event type 0, any event type with a shift value of 0 is + * considered unsupported and thus skipped in get/set features calls. + * + * NOTE: NvmeRuHandle uses a 64bit event mask - refactor to support event = types + * of 63 or greater. + */ +static const uint8_t nvme_fdp_evf_shifts[FDP_EVT_MAX + 1] =3D { /* Host events */ [FDP_EVT_RU_NOT_FULLY_WRITTEN] =3D 0, [FDP_EVT_RU_ATL_EXCEEDED] =3D 1, --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807555; cv=none; d=zohomail.com; s=zohoarc; b=QLBapq5I5R5Z/I0VIh78iAWh/LGidFxCH2fHKJWdC7hZJ+56loS7Dco7MnL2G5FAMJ/HsXTZ9NvdslN5B7QPdbLxd8ytmJcluFnzUMPLfUMOiwV3EweMp2f+kzIOMznIj4y+21yikR7Tb1/Kovld6ietn0aXGHf2TxibjmTWACc= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807555; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=Uvccfl3bro0t2dOdtSMY851BxB1YKZsfktfizSjUuJE=; b=b48UTSvyrN5BMtzfozcHP7PWN5Ogegjf7fleno5jw3+NBlZl41rwxiGtUVMATA/boBvWJnD4OZrh+uwlqoWsKzoMM4/g0lI7XIIK7gs1FjdKkXKjklLqkygV1Ig3pa4Apq0K5B84+sp25ZhsOb7F94STpxJQQeDmuv5H+cF40dA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807555678489.733943909715; Sat, 11 Jul 2026 15:05:55 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifnR-0008R2-Pp; Sat, 11 Jul 2026 18:03:42 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifn6-0007dc-CA; Sat, 11 Jul 2026 18:03:22 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifn4-0008UH-LK; Sat, 11 Jul 2026 18:03:20 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id F38131C0AB1; Sun, 12 Jul 2026 00:59:40 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id AA65D3EAF3C; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 919D31332F; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807180; bh=uslL7lUFm6NS/mScZulwl1QVvrIBrXr6yCUQtg7VLUo=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=kLfdURWH4D6ChfvRO/OUZucBCpfMhF2N3yhYPyzYbX9P40afrK5sL6zz/JMILAX3b LgCC/bwM7ka70DKQrUggNZ6KRWT3STaECx0daDmptpnU4YcLZTVYPYJJyl4wFJapou vyZ3SKNpJ7G/gqQENgoj3rPx68FWjG4MvWQBd/Xzp8SoeWJhti4DvRX/OpN/jRtXP5 gQqw/naTlG/OIl+u0oRVSVFlc9z4K21eUMj4vnO1+IRoJJdZX+99znlph79kJGVAH8 yGUomiJtGWLEa4oOY9nrLKxbNaAGjt7eKG2DGSMV5GJ9TupfpHaS4nFuCWOUzLfgN5 EStjU3e0O3Z+A== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Keith Busch , Feifan Qian , boy juju , Klaus Jensen , Michael Tokarev Subject: [Stable-11.0.3 38/81] hw/nvme: ensure sgl forward progress Date: Sun, 12 Jul 2026 00:58:16 +0300 Message-ID: <20260711215904.3757-38-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807557809154100 Content-Type: text/plain; charset="utf-8" From: Keith Busch A degenerate host can create segment loops of zero-byte data descriptors that the controller never breaks out of. While the spec allows zero length segments, it provides no guidance on handling loops. It makes no sense for a host to submit such a descriptor anyway since it can and trivially should point to the next transfer segment, so don't even try to work with such behavior. Just reject the command, terminating the loop. Cc: qemu-stable@nongnu.org Reported-by: Feifan Qian Reported-by: boy juju Signed-off-by: Keith Busch Reviewed-by: Klaus Jensen Signed-off-by: Klaus Jensen (cherry picked from commit 034baf047fe143c2713f35fa640407d9da2f6fc3) Signed-off-by: Michael Tokarev diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c index 28cc8d0e7dc..76d024c81e5 100644 --- a/hw/nvme/ctrl.c +++ b/hw/nvme/ctrl.c @@ -1088,6 +1088,8 @@ static uint16_t nvme_map_sgl(NvmeCtrl *n, NvmeSg *sg,= NvmeSglDescriptor sgl, } =20 for (;;) { + size_t prev_len =3D len; + switch (NVME_SGL_TYPE(sgld->type)) { case NVME_SGL_DESCR_TYPE_SEGMENT: case NVME_SGL_DESCR_TYPE_LAST_SEGMENT: @@ -1168,6 +1170,17 @@ static uint16_t nvme_map_sgl(NvmeCtrl *n, NvmeSg *sg= , NvmeSglDescriptor sgl, if (status) { goto unmap; } + + /* + * Reject if this segment made no forward progress. The host should + * have skipped linking an empty segment. While not strictly spec + * compliant, allowing this makes it easy for a pathological host = to + * create an infinite loop. + */ + if (len =3D=3D prev_len) { + status =3D NVME_INVALID_SGL_SEG_DESCR | NVME_DNR; + goto unmap; + } } =20 out: --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807487; cv=none; d=zohomail.com; s=zohoarc; b=VP4un7hV/lMIpS4rNK48YN4EjNIms0bQ/yvxgL0n7vv4k8R1eEI1SE5l3mpnqxCcYBd6s0OyEkycubvksRHUkvgIYauAzh+Iswl2MfNNkyGmEMmbh9IO7uN6f63p6WFMsn0FYKx0OgIHosiUoBCoe0i+IXnlkIZq7RtPREq22/4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807487; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=m2/PJnItY9radjuS7BMmiTiVPvcMrg/hR+M+klW+HnU=; b=QqvXbuKxgZstWRe5VsChoRP3eqQYnYoH3afT3UMZd1x493CT1hhBpp0CWN7lny3c8nGHqcjooMmyLkhisIHHqeZBip9laEBzcOh4n8IKbOATh2yM4ss1K52LQDNWuGjP4SVhU4z1KDpBH1lyJd2Q0/IRPcXjajmdC2aeZvWpGdg= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807487342240.57911186728575; Sat, 11 Jul 2026 15:04:47 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifnR-0008QE-J3; Sat, 11 Jul 2026 18:03:41 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifn8-0007f6-Jf; Sat, 11 Jul 2026 18:03:24 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifn6-0008UW-Ko; Sat, 11 Jul 2026 18:03:22 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 0445A1C0AB2; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id AF6C83EAF3D; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 9435813331; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=irlmIn10kiPWJ3bIYoAxOSN8apYoOmHx2+kvcs6k7eI=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=nxHeWG26AJr6cVm5AXMbaaHUL2z2SplziubkU+74uZdjn1HlP1uJx9YmaS2X7sPT1 mvGr58+ubRnFXFhhih/wU89QS/TZUcyz6y1U/HInTzzWDljw8ksu1ZEIvKXXpeaLc7 05AuOLICwIdHxsNxeMB0n0UCj/kdueeRSWqgX2Gsu2RWGWQEgKrBjGcebrqjoEPlb8 HsXt/3TMtLYsGBeDP00EXlobw+lxEEBLfdQSAHTNGY+mX0ZphQOFZscunZjzh9tjD9 OfmFgCdi1jid4UzXif9y6limQTPyY7RZ6bn2P+MNaC2ZEeVTaeou76rvo8GkejmyVN gS7WAY5C1jcew== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Christian Borntraeger , Hendrik Brueckner , Matthew Rosato , Eric Farman , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Cornelia Huck , Michael Tokarev Subject: [Stable-11.0.3 39/81] s390x/sclp: reject invalid write event data headers Date: Sun, 12 Jul 2026 00:58:17 +0300 Message-ID: <20260711215904.3757-39-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807488687154100 From: Christian Borntraeger If a guest submits an sccb with a tiny header length but a large number of event mask entries, the write_event_mask handler will 1. return the wrong RC (ok instead of error) 2. write to memory after the allocated sccb in qemu host memory. Add the necessary checks. Cc: qemu-stable@nongnu.org Reviewed-by: Hendrik Brueckner Reviewed-by: Matthew Rosato Reviewed-by: Eric Farman Reviewed-by: Philippe Mathieu-Daud=C3=A9 Signed-off-by: Christian Borntraeger Message-ID: <20260707070728.147203-2-borntraeger@linux.ibm.com> Signed-off-by: Cornelia Huck (cherry picked from commit d88cd8f5570f4d6e08d62e098a8b7f53cdc75536) Signed-off-by: Michael Tokarev diff --git a/hw/s390x/event-facility.c b/hw/s390x/event-facility.c index fee286ea639..184c469bd39 100644 --- a/hw/s390x/event-facility.c +++ b/hw/s390x/event-facility.c @@ -286,6 +286,7 @@ static void read_event_data(SCLPEventFacility *ef, SCCB= *sccb) static void write_event_mask(SCLPEventFacility *ef, SCCB *sccb) { WriteEventMask *we_mask =3D (WriteEventMask *) sccb; + uint16_t sccb_length =3D be16_to_cpu(sccb->h.length); uint16_t mask_length =3D be16_to_cpu(we_mask->mask_length); sccb_mask_t tmp_mask; =20 @@ -294,6 +295,11 @@ static void write_event_mask(SCLPEventFacility *ef, SC= CB *sccb) return; } =20 + if (sccb_length < sizeof(WriteEventMask) + 4 * mask_length) { + sccb->h.response_code =3D cpu_to_be16(SCLP_RC_INSUFFICIENT_SCCB_LE= NGTH); + return; + } + /* * Note: We currently only support masks up to 8 byte length; * the remainder is filled up with zeroes. Older Linux --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807482; cv=none; d=zohomail.com; s=zohoarc; b=jcCTTP4WjrvooDuS/DhLCvK20y017D/AjKDtaxMgsy3ow4h4EJSnrN0S0xZO0giIydGaHhDtJIFaeWKSJMjTGbggS2BNJnOyhkxGWPMt7KDDLk+TfoSkx6m4WZ+GcBpOU21KOK6OWa2XRUHSwTe8H944WbL11eG4x5We6faVG/8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807482; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=uelp0IIP9rxExlbEc6pCWAcojjLVbNcR0ZTu2ti/33w=; b=VXz1or9D342ev9uFHz06rnwDWeTm/Xl+wblLZVSfjlrSKhlN6uKWSDVfh9pcu9I6WxmgpIuo6rCA69VAo2zzBmlKZHI4PCLBOCdatlqzxi4lOATae+1HwyfKM3G/dq07jScHApBBvMm8HHjyAGD1ecP0jVnEnJDRYWjftjmBzOk= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807482520626.2226942646985; Sat, 11 Jul 2026 15:04:42 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifnT-0000Ch-7Z; Sat, 11 Jul 2026 18:03:43 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifn9-0007hU-S5; Sat, 11 Jul 2026 18:03:24 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifn7-0000Ap-SV; Sat, 11 Jul 2026 18:03:23 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 0982C1C0AB3; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id B4E2D3EAF3E; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 96C4913333; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=lMxgmBxPZgkIZe1yfCXgZoMOdYZzlgTKyz3c5LVEjU8=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=P+xaWJkBOr3sW5by5KGthUugn1rhKkXZw8rrC0B52htN/LpLi+xoyA6Z7JV8Kx3hl Gp1dYjpxX+mf7tX5zJitv6bE/CyM5rALoqZj/HkdxWZDqwXHnuyHlJkIvX5iPLk8hi nKXXxVma9pQbowjXG6SRPzEjszEvG9eYOxoFqI/0LSB0YdusnjeELelUaO+xHK/g2H b7e5Bhxm2wp11RgxGfPwtie9tZS5+dPHgrOwKegA7UvqjHksduFSuZV3mxVhgWnvyV Gt9+BXN1bY2SAfbptUmCgumrOzEs9j88Y6FDUyOF2RjJKcjunKQ9GPlk5U1e02YJMy W9QdMRkGnqqrw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Matthew Rosato , Christian Borntraeger , Farhan Ali , Cornelia Huck , Michael Tokarev Subject: [Stable-11.0.3 40/81] s390x/pci: Tighten region detection for BAR read/write Date: Sun, 12 Jul 2026 00:58:18 +0300 Message-ID: <20260711215904.3757-40-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807484667154100 Content-Type: text/plain; charset="utf-8" From: Matthew Rosato For PCISTG/PCISTB/PCILG instruction emulation, ensure that the offset and length provided by the guest does not overflow, and only return a memory region when the specified offset+length combination matches an existing subregion or the parent region. Cc: qemu-stable@nongnu.org Fixes: 4f6482bfe3 ("s390x/pci: search for subregion inside the BARs") Signed-off-by: Matthew Rosato Reviewed-by: Christian Borntraeger Reviewed-by: Farhan Ali Signed-off-by: Christian Borntraeger Message-ID: <20260707070728.147203-3-borntraeger@linux.ibm.com> Signed-off-by: Cornelia Huck (cherry picked from commit 2d709a70c75724e972126671b2e2c0fca0b6e239) Signed-off-by: Michael Tokarev diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c index 10066ca6180..ef20f7645eb 100644 --- a/hw/s390x/s390-pci-inst.c +++ b/hw/s390x/s390-pci-inst.c @@ -392,13 +392,22 @@ static int zpci_endian_swap(uint64_t *ptr, uint8_t le= n) static MemoryRegion *s390_get_subregion(MemoryRegion *mr, uint64_t offset, uint8_t len) { + uint64_t last =3D offset + len; MemoryRegion *subregion; uint64_t subregion_size; =20 + /* + * Ensure the region is valid, the calculated address cannot wrap and = that + * it falls within this region. + */ + if (!mr || offset > last || last > memory_region_size(mr)) { + return NULL; + } + QTAILQ_FOREACH(subregion, &mr->subregions, subregions_link) { subregion_size =3D memory_region_size(subregion); if ((offset >=3D subregion->addr) && - (offset + len) <=3D (subregion->addr + subregion_size)) { + (last) <=3D (subregion->addr + subregion_size)) { mr =3D subregion; break; } @@ -413,6 +422,10 @@ static MemTxResult zpci_read_bar(S390PCIBusDevice *pbd= ev, uint8_t pcias, =20 mr =3D pbdev->pdev->io_regions[pcias].memory; mr =3D s390_get_subregion(mr, offset, len); + if (!mr) { + return MEMTX_ERROR; + } + offset -=3D mr->addr; return memory_region_dispatch_read(mr, offset, data, size_memop(len) | MO_BE, @@ -513,6 +526,10 @@ static MemTxResult zpci_write_bar(S390PCIBusDevice *pb= dev, uint8_t pcias, =20 mr =3D pbdev->pdev->io_regions[pcias].memory; mr =3D s390_get_subregion(mr, offset, len); + if (!mr) { + return MEMTX_ERROR; + } + offset -=3D mr->addr; return memory_region_dispatch_write(mr, offset, data, size_memop(len) | MO_BE, @@ -900,6 +917,11 @@ int pcistb_service_call(S390CPU *cpu, uint8_t r1, uint= 8_t r3, uint64_t gaddr, =20 mr =3D pbdev->pdev->io_regions[pcias].memory; mr =3D s390_get_subregion(mr, offset, len); + if (!mr) { + s390_program_interrupt(env, PGM_OPERAND, ra); + return 0; + } + offset -=3D mr->addr; =20 for (i =3D 0; i < len; i +=3D 8) { --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807605; cv=none; d=zohomail.com; s=zohoarc; b=iErvn17dqJcoRGnbzChf+kQgtwQBiV+E1xmwCdOnwGEZGqEDhXAPk7G9tIHb9qWQlVsZ0dka9yughv5JBAl/rwdODmgPzvGmWi5hmCF7tTdyuHbNQavU6UNaEDhgGdrps4ibDxTEvw56+rZOEUywuBWfZRXJFdjD/scEbf7eCiQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807605; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=gM9ASsOsLBzmTSU/0VadYPZOp0Gnw7ylotfAiyxVIHA=; b=cnw/AD5hJKAcIQ9YNIfeNrLrH0Y0pr1ehaVHtj9o96jvCEg3OZbE70olqx6YwDriNVQ19d+VTajYppozcJ18jvFxZcGEISyDFRIngKm6if15c3hizB3g+NrJsGDDbK5uYvg7/2xJ+GBqqX10IGyXQLMA220SNl0j7BCXTML3ZIA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807605211105.97130565210136; Sat, 11 Jul 2026 15:06:45 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifnS-00006r-KE; Sat, 11 Jul 2026 18:03:42 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifnB-0007lu-Lc; Sat, 11 Jul 2026 18:03:26 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifn9-0000B4-Tl; Sat, 11 Jul 2026 18:03:25 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 1073F1C0AB4; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id BB6A13EAF3F; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 9952313335; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=zivBvMtzxtYkIZOGgfUxFwYqxl7Hte03wmnIXCt/eyk=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=lb1sdgz1pdjdS9mN/KM2+IslWhTHR2kZ/XU2KZCRvprBtZuF9oINmy+QHws/BSrwL N9FQS6RLPahehY15Qnw9wUZjNK58DeqVGqMrCh9wCngU5jSGdDNqxZ2DTjXizMbaBH a04ZuOKAtL0r8+Tg1ZUPeSCBRKTarmPXhXUo7QtDcgCSNJ+oKHPR+I8eNjcfACWPLf uNVFyMlb7+x+CusThQsvIgjLh4bsBsgtXiJjVeSt21dPdqk0tX79SbacyxDSfx4ng5 +/1Pxd0PzDIgoM6RKyqLbX/g+VnBaYia9D7M7KqYTjLdjY3iClfszRZ0s7IckUUiYN SoE4QnCJMFPow== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Matthew Rosato , Christian Borntraeger , Farhan Ali , Cornelia Huck , Michael Tokarev Subject: [Stable-11.0.3 41/81] s390x/pci: Shrink RPCIT ranges to registered window Date: Sun, 12 Jul 2026 00:58:19 +0300 Message-ID: <20260711215904.3757-41-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807606388154100 Content-Type: text/plain; charset="utf-8" From: Matthew Rosato Today, if a RPCIT instruction is presented from the guest whose range exceeds the previously-registered IOAT, QEMU will process the range so long as 1) the specified range at least partially overlaps with what was previously registered and 2) the guest has valid IOAT entries in its table. If the entries are not present (invalid), then the RPCIT will unnecessarily spend time reporting the invalid region/segment entries. Optimize this path by exiting immediately if the requested range falls completely outside of the previously-registered range or if the requested range ends before it starts (which would only occur if the guest-specified address + length would overflow a u64). Otherwise, clamp the request to only the portion of the range that overlaps with what was previously registered, effectively ignoring the portion outside of the registered range. Cc: qemu-stable@nongnu.org Fixes: 5d1abf2344 ("s390x/pci: enforce zPCI state checking") Reviewed-by: Christian Borntraeger Reviewed-by: Farhan Ali Signed-off-by: Matthew Rosato Signed-off-by: Christian Borntraeger Message-ID: <20260707070728.147203-4-borntraeger@linux.ibm.com> Signed-off-by: Cornelia Huck (cherry picked from commit b8c8ec1d752661e1904d089c77d8617c4b6bfb5a) Signed-off-by: Michael Tokarev diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c index ef20f7645eb..b7de23c7d2c 100644 --- a/hw/s390x/s390-pci-inst.c +++ b/hw/s390x/s390-pci-inst.c @@ -770,10 +770,16 @@ int rpcit_service_call(S390CPU *cpu, uint8_t r1, uint= 8_t r2, uintptr_t ra) goto err; } =20 - if (end < iommu->pba || start > iommu->pal) { + if (end < start || end < iommu->pba || start > iommu->pal) { error =3D ERR_EVENT_OORANGE; goto err; } + /* + * If the specified range at least partially overlaps the registered + * aperture, clamp the request to the aperture and ignore the rest. + */ + sstart =3D MAX(start, iommu->pba); + end =3D MIN(end, iommu->pal + 1); =20 retry: start =3D sstart; --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807558; cv=none; d=zohomail.com; s=zohoarc; b=EoqF2MK6yGmAgSUbTEI7TjltPRwQ9w7mxxyd19K+n3ZE65gufo7YhXSABKspolRPnD3Pv+uR3+mhZcFI8Q2cGl75jGauaZpCuoWW0ftb9nKTZNPNokXKpf4fyL1h6Qtq9jKIXFD+1gnlXdaGGLVOm2ioKQquCz3NvIfjnljtG6A= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807558; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=OkwXy5nKS48AMRL03ERMn0hfdostB9cP7NvL1ySI+TE=; b=C3X6iAhfo/7L3/n+H/6PZkKDUzAAFLiFIq06CK3MiniBmd3eu20ZYnJuXarzXFwt1ufNHOwwLmfDQ+zgg/PZatx6xq15VC9If55QALkDks7XL3qqms3L54dM1Wib4EuNGfN96ed+ooNeljEu/1qQq4vk8qO5Q7wPNGSbz+DXJco= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807558953887.3136603491224; Sat, 11 Jul 2026 15:05:58 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifnT-0000BS-3v; Sat, 11 Jul 2026 18:03:43 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifnG-0007pa-Qe; Sat, 11 Jul 2026 18:03:32 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifnB-0000BO-CQ; Sat, 11 Jul 2026 18:03:26 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 167191C0AB5; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id C108A3EAF40; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 9BE6A13337; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=nuTOMIE/WJ+A+UsDjoUlEZxCqmfVQBK6le+mjRTmLcA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=t+YR1uQe4S2mb4QDj7EQqFwZYwuFlcy56EsU4Rx95zAiTXcVM5pg3KlqYcn2QpVSt +8aCvXXS8UsVrlUJRDdY4r3XoxpaVlT3oUtPz3Bl770Q9Z9NZLdF5kKRo0dqeknqN9 KUGq4dQ7ZgKQrWEvlKI9OIhr7uVayCkURGsgjhMmGWTjxnqfRtFQbBp4mGkPc5YHh+ E4NHTZSce8uV34GWCB1mdmzoJh5FIOPOUJW2Udu8opGojIxx5jXGHPfgrKKlSCOrl4 UXNBZb1XKWnhHaK9AELRiwO7Y6vWAfgqvnZuadl0GQ0GrpUUbRhL4CmhcaO3jQ6POg gdnAUkqAdHlnA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Matthew Rosato , Christian Borntraeger , Farhan Ali , Eric Farman , Cornelia Huck , Michael Tokarev Subject: [Stable-11.0.3 42/81] s390x/ioinst: Require strict length and format for SEI CHSC handler Date: Sun, 12 Jul 2026 00:58:20 +0300 Message-ID: <20260711215904.3757-42-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807559715154100 Content-Type: text/plain; charset="utf-8" From: Matthew Rosato Ensure SEI commands that are received are of the appropriate length and format before handling. Cc: qemu-stable@nongnu.org Fixes: 8cba80c3a0 ("s390: Add PCI bus support") Reviewed-by: Christian Borntraeger Reviewed-by: Farhan Ali Reviewed-by: Eric Farman Signed-off-by: Matthew Rosato Signed-off-by: Christian Borntraeger Message-ID: <20260707070728.147203-5-borntraeger@linux.ibm.com> Signed-off-by: Cornelia Huck (cherry picked from commit 386268daea86e53d90baf99df5c7b8e2727ea783) Signed-off-by: Michael Tokarev diff --git a/target/s390x/ioinst.c b/target/s390x/ioinst.c index 2320dd4c122..94619f92155 100644 --- a/target/s390x/ioinst.c +++ b/target/s390x/ioinst.c @@ -609,13 +609,27 @@ static int chsc_sei_nt2_have_event(void) =20 #define CHSC_SEI_NT0 (1ULL << 63) #define CHSC_SEI_NT2 (1ULL << 61) +#define CHSC_SEI_0_FMT 0x0f000000 static void ioinst_handle_chsc_sei(ChscReq *req, ChscResp *res) { uint64_t selection_mask =3D ldq_be_p(&req->param1); + uint32_t param0 =3D be32_to_cpu(req->param0); uint8_t *res_flags =3D (uint8_t *)res->data; + uint16_t len =3D be16_to_cpu(req->len); + uint16_t resp_code; int have_event =3D 0; int have_more =3D 0; =20 + if (len !=3D 0x0010) { + resp_code =3D 0x0003; + goto out_err; + } + + if (param0 & CHSC_SEI_0_FMT) { + resp_code =3D 0x0007; + goto out_err; + } + /* regarding architecture nt0 can not be masked */ have_event =3D !chsc_sei_nt0_get_event(res); have_more =3D chsc_sei_nt0_have_event(); @@ -642,6 +656,12 @@ static void ioinst_handle_chsc_sei(ChscReq *req, ChscR= esp *res) res->code =3D cpu_to_be16(0x0005); res->len =3D cpu_to_be16(CHSC_MIN_RESP_LEN); } + return; + + out_err: + res->code =3D cpu_to_be16(resp_code); + res->len =3D cpu_to_be16(CHSC_MIN_RESP_LEN); + res->param =3D 0; } =20 static void ioinst_handle_chsc_unimplemented(ChscResp *res) --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807476; cv=none; d=zohomail.com; s=zohoarc; b=DU6stDgMxXgIzr4mX7cAzITwgc8Z5nt8SEob0Zla48d02DyW79Buf5kaoohlRBIHJ14GKo35i4keomqvh75gViyQIeUWLNwvqOgwZ9HVBNKXyY0jBy7qx+k/h3P39tsxTpuc67Vpt1E8uJE3IYZtlkI+ViPJGktsHa7pJk3oaFk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807476; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=sqfBmXIn/6RvRaYmwHzQ0d8a6pPKkVrCGBuV0aPV2FU=; b=C1CDxlkSdvKw+bcYlUmHX/pbF5C9vxCS/EmJY1AxsgH5M5I5KIAsieI4wRrSTS6P8AWnesVXx1W2YxVq5SWUgucgdlD83l9ciAs/FjSL2O47Kf8H+6HQI0dkCHwntEUUbfnv1HlC1i3kSiijDWio9cVjqk5XdYM5QleP1dvmq8A= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807476407793.8432625165593; Sat, 11 Jul 2026 15:04:36 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifna-0000sV-Sw; Sat, 11 Jul 2026 18:03:51 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifnY-0000iA-T7; Sat, 11 Jul 2026 18:03:48 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifnX-0000Bx-5p; Sat, 11 Jul 2026 18:03:48 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 1BD341C0AB6; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id C6F9F3EAF41; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 9E71E13339; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=YH47+b8fV/DnyDFj9VG/LcIADvM/vUMQPHWHdEi+OYc=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=RMdeQM+H7Ip9lUbrsWqrYW0fUECG3xQN5rh1fhI1cZPpBP4DpQcB1CLZqJa9JoZg5 h09zvirrxhU9+O53HfKIHqHKC3fQrzDyTqFTjAdlNnmyEvFOGwx+H8NMromYyQOO0a wccz/+ofjT91nQAwYsAdFgg09sqW7jxRm5MhtiLVm6oMW2rcUdoQT8ZWmusPznfliG gno1E75qR+gcEjPe7NsLj2G7l+vtogvXlGYhJH3yzZFWNfVeR6jaUVMBN4PVxUARV5 qKt1pw2vMbbav4LZwRQxn/vBZZfkuThQZ2tS69EoXvf/zmYLU6k2q4qYwof/1Toqcz WcsM9iLTY3/HA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Eric Farman , Christian Borntraeger , Matthew Rosato , Cornelia Huck , Michael Tokarev Subject: [Stable-11.0.3 43/81] s390x/css: limit number of CHPIDs in description Date: Sun, 12 Jul 2026 00:58:21 +0300 Message-ID: <20260711215904.3757-43-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807478559154100 Content-Type: text/plain; charset="utf-8" From: Eric Farman virtio-ccw uses a single virtual CHPID for all devices and device-types, but vfio-ccw (passthrough) shares real CHPID information with the guest. A sufficiently large passthrough configuration would exceed the defined response payload. Fix this by limiting the number of CHPID descriptions that are returned based on the given response format. Cc: qemu-stable@nongnu.org Reviewed-by: Christian Borntraeger Reviewed-by: Matthew Rosato Signed-off-by: Eric Farman Signed-off-by: Christian Borntraeger Message-ID: <20260707070728.147203-6-borntraeger@linux.ibm.com> Signed-off-by: Cornelia Huck (cherry picked from commit 22f2da06a8b291c975a7caf05dbd3b180c856741) Signed-off-by: Michael Tokarev diff --git a/hw/s390x/css.c b/hw/s390x/css.c index 04ce3178a0b..13a0e113703 100644 --- a/hw/s390x/css.c +++ b/hw/s390x/css.c @@ -1870,6 +1870,7 @@ int css_collect_chp_desc(int m, uint8_t cssid, uint8_= t f_chpid, uint8_t l_chpid, int i, desc_size; uint32_t words[8]; uint32_t chpid_type_word; + uint32_t max_chpids, chpid_count =3D 0; CssImage *css; =20 if (!m && !cssid) { @@ -1880,9 +1881,25 @@ int css_collect_chp_desc(int m, uint8_t cssid, uint8= _t f_chpid, uint8_t l_chpid, if (!css) { return 0; } + + if (rfmt =3D=3D 0) { + max_chpids =3D 256; + } else if (rfmt =3D=3D 1) { + max_chpids =3D 127; + } else { + /* Should be rejected by caller */ + return 0; + } + desc_size =3D 0; for (i =3D f_chpid; i <=3D l_chpid; i++) { if (css->chpids[i].in_use) { + /* Limit number of CHPIDs sent back */ + if (chpid_count =3D=3D max_chpids) { + break; + } + + chpid_count++; chpid_type_word =3D 0x80000000 | (css->chpids[i].type << 8) | = i; if (rfmt =3D=3D 0) { words[0] =3D cpu_to_be32(chpid_type_word); --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807496; cv=none; d=zohomail.com; s=zohoarc; b=WPJJbybK0dQi/SkcuITdv5qtVKGoECarO2JzijOTxqRsPKKMmepvAn4N1g4c3L34cyd29rBHye8e7YutrKm2PySo9PV4V6Mx0RtzMh55O5ik4J5V2sHdy1+v3Pe0QxmNvG+BdHfvVbRsthwP9m+xnumayB2WOhZHOWpJiBfc0AU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807496; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=BCbWf7c20Qn5x467ufs2mV3/2Ztd3jDnrAI8FdmfQcQ=; b=Fw7r3yUmtmwsFckfum8N9NCxlBUT6BMdZJt2yK2RChVmBdMQxZq10e7SB6j0LJhgOYeEGnPLE50L3ESqmbPJrHolclYh0rCUnEhm1G2h0zmO0MXi96SoQdcjNgfBmUCIqo90qnAUmeJZzrVsnBzGxjDalPPJCq/auUfzOAJbTrM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807496729331.45769120050204; Sat, 11 Jul 2026 15:04:56 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifnf-00014b-TU; Sat, 11 Jul 2026 18:03:56 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifnd-000132-PO; Sat, 11 Jul 2026 18:03:53 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifnc-0000Cv-7m; Sat, 11 Jul 2026 18:03:53 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 222A31C0AB7; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id CD16E3EAF42; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id A0DDD1333B; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=sOb7KOaB9Fa5lT3CgCH9pL8kdvFT6gD12EgC3VN22GE=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=ECAKRPbDnYFMhwWCJa14wpzEst2uQtxdYdla2e9MoMSdnbqF82woyemPfwOhlsIOD 4gLmb+x9/NBsrGfzMViP3co6jK+T9cD/omg57XjmmdhmgVlaP+9HI5PS7KlNDVGWAV U3b0EY2PIs0f5HPH0Fx+RymjQuui2E3rGLxAUnvl5ELFnurvFKyShyW29kZ1on2Gi4 F9r7xSGwUw8HyhcARa48R+MxRz00xseTVmLG9JHN6y67Dhh73E/oVE/Pl4b7A3WCey I9wvnRgOwvA2GJBMAqxZwpbl4N5/vo11HzxgtVy1cTFl4Qaph/cy8u48s7fO/WQgrl 4GPJTy9OSqStg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Miao Wang , Song Gao , Michael Tokarev Subject: [Stable-11.0.3 44/81] target/loongarch: Enable TARGET_PAGE_BITS_VARY for loongarch64 user-only Date: Sun, 12 Jul 2026 00:58:22 +0300 Message-ID: <20260711215904.3757-44-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807499163154100 Content-Type: text/plain; charset="utf-8" From: Miao Wang Hard coding PAGE_SIZE to 4K will prevent user-only emulation from working on hosts with 16K page size. Fixes: 1d832c19db1e ("target/loongarch: Support 4K page size") Fixes: qemu-project/qemu#3651 Signed-off-by: Miao Wang Reviewed-by: Song Gao Message-ID: <20260630-loong64-vary-page-sz-v1-1-1d1a894674be@gmail.com> Signed-off-by: Song Gao (cherry picked from commit e819c126a8d9629f57deef31689f3a7fc476fa45) Signed-off-by: Michael Tokarev diff --git a/target/loongarch/cpu-param.h b/target/loongarch/cpu-param.h index 3bcf77b3755..6abe72ff5ca 100644 --- a/target/loongarch/cpu-param.h +++ b/target/loongarch/cpu-param.h @@ -10,6 +10,11 @@ =20 #define TARGET_VIRT_ADDR_SPACE_BITS 48 =20 -#define TARGET_PAGE_BITS 12 +#ifdef CONFIG_USER_ONLY +/* Allow user-only to vary page size from 4k */ +# define TARGET_PAGE_BITS_VARY +#else +# define TARGET_PAGE_BITS 12 +#endif =20 #endif --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807616; cv=none; d=zohomail.com; s=zohoarc; b=oC1rbD72Ly8eYMGDE0lWEiRo6DhAJyZ0Vh+escpdtxn6IDD8+tsJYndJ5PH+PKAY6SUGcvklCWtpzTOj+zAFdyYG9bW7IcYstOeeuiCeuSrVO0FCjTtcT+lANiTDOfIFEXFjUFDBowmsgWH0ZpdzaAA+qSq0uqiba8Hu09fAeJE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807616; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=i8Mk+4028TZ+tDB9eYk4GpN8/i3zRAyACB12SXXo5ik=; b=BmS2iewnCqGywJ2ugPDfWJXMGt7HiSXOHsNgqCWyG96rIY0N9YUPkPpkWY0NT6unHT8piAZgkatlCxLmZ5euHjO8jiZegYwMZOVvB8/64DY2otT2ubha1GLcTkl3T3OjJWDpjBGRTEK49jqhKMLBY10CO1pla+2MYxvMIc2izs4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807616498775.9290860621109; Sat, 11 Jul 2026 15:06:56 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifne-00013E-1J; Sat, 11 Jul 2026 18:03:54 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifnc-0000zG-4k; Sat, 11 Jul 2026 18:03:52 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifna-0000EF-DS; Sat, 11 Jul 2026 18:03:51 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 283E51C0AB8; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id D3D233EAF43; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id A3C7C1333D; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=biPwYpAnfr1hBchP6HVOm+ghjqEnOAsAsduEE8R9IYo=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=qvGgwuB7jprQHSvbicK6JqWYlZbO+ZcV3g7B9ofcG1WFfBkzvnz+b1ECskgPZVeL8 MoPqA2VZZU0RJSbBLk1LF/X6ocnhdTtx+SqFzvYqb0whwvK3hgAPlbc20/q73wrnor MH8Kx1/MwQqiSD69mE4o3cjaAQ1a6OA3AMPZdXzmfsjVyPd/bSGbziJMiwarY4UOMl XkgjZUvg17dVKuV6/UaC+d5PLfz0s9zlD+EpcfCq9P50YGJP6hBOMgiGkst7eJ5aBo eNo52OLd3r4XU0ZvpKdtSa31a2XXQbEHsRhneuock1HoD2+36sW1SO9OkhMHDUZQo/ +bMar0SnWSqCA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Torin Carey , Peter Maydell , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-11.0.3 45/81] hw/misc/edu: restrict dma access to dma buffer Date: Sun, 12 Jul 2026 00:58:23 +0300 Message-ID: <20260711215904.3757-45-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807619150154100 From: Torin Carey The EDU device doesn't enforce any bound checks on the addresses provided, allowing users of the device to perform arbitrary reads and writes to QEMU's address space. Signed-off-by: Torin Carey Cc: qemu-stable@nongnu.org Fixes: 7b608e5d6c1 ("hw: misc: edu: use qemu_log_mask instead of hw_error") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3852 Reviewed-by: Peter Maydell Message-ID: Signed-off-by: Philippe Mathieu-Daud=C3=A9 (cherry picked from commit 42f599172ae023924f288e20af0ceed681674747) Signed-off-by: Michael Tokarev diff --git a/hw/misc/edu.c b/hw/misc/edu.c index cece633e113..a4b01269e8b 100644 --- a/hw/misc/edu.c +++ b/hw/misc/edu.c @@ -103,7 +103,7 @@ static void edu_lower_irq(EduState *edu, uint32_t val) } } =20 -static void edu_check_range(uint64_t xfer_start, uint64_t xfer_size, +static bool edu_check_range(uint64_t xfer_start, uint64_t xfer_size, uint64_t dma_start, uint64_t dma_size) { uint64_t xfer_end =3D xfer_start + xfer_size; @@ -115,13 +115,15 @@ static void edu_check_range(uint64_t xfer_start, uint= 64_t xfer_size, */ if (dma_end >=3D dma_start && xfer_end >=3D xfer_start && xfer_start >=3D dma_start && xfer_end <=3D dma_end) { - return; + return true; } =20 qemu_log_mask(LOG_GUEST_ERROR, "EDU: DMA range 0x%016"PRIx64"-0x%016"PRIx64 " out of bounds (0x%016"PRIx64"-0x%016"PRIx64")!", xfer_start, xfer_end - 1, dma_start, dma_end - 1); + + return false; } =20 static dma_addr_t edu_clamp_addr(const EduState *edu, dma_addr_t addr) @@ -148,16 +150,18 @@ static void edu_dma_timer(void *opaque) =20 if (EDU_DMA_DIR(edu->dma.cmd) =3D=3D EDU_DMA_FROM_PCI) { uint64_t dst =3D edu->dma.dst; - edu_check_range(dst, edu->dma.cnt, DMA_START, DMA_SIZE); - dst -=3D DMA_START; - pci_dma_read(&edu->pdev, edu_clamp_addr(edu, edu->dma.src), - edu->dma_buf + dst, edu->dma.cnt); + if (edu_check_range(dst, edu->dma.cnt, DMA_START, DMA_SIZE)) { + dst -=3D DMA_START; + pci_dma_read(&edu->pdev, edu_clamp_addr(edu, edu->dma.src), + edu->dma_buf + dst, edu->dma.cnt); + } } else { uint64_t src =3D edu->dma.src; - edu_check_range(src, edu->dma.cnt, DMA_START, DMA_SIZE); - src -=3D DMA_START; - pci_dma_write(&edu->pdev, edu_clamp_addr(edu, edu->dma.dst), - edu->dma_buf + src, edu->dma.cnt); + if (edu_check_range(src, edu->dma.cnt, DMA_START, DMA_SIZE)) { + src -=3D DMA_START; + pci_dma_write(&edu->pdev, edu_clamp_addr(edu, edu->dma.dst), + edu->dma_buf + src, edu->dma.cnt); + } } =20 edu->dma.cmd &=3D ~EDU_DMA_RUN; --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807644; cv=none; d=zohomail.com; s=zohoarc; b=iP/VnuJc1bbpk422SuYCPoppCbeRM08pKW6WD0Zdf3HB2wx4Va07s8hOXsivO9GMmv9BJzJtLmVS71Iapi1k9s0jyvyUximHa6iR7dir/WLevXW25s04u9ujRl40muwNwH+2zSI3NaWIGjHiUc2F8Q8ar8F4S6IdzuZ+noRo5Kg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807644; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=boujVgCGEhFCkUDPMWQDi4HTs5Myaw4xcz2QHp8TEa4=; b=QzpsjWQ8eKXiwDP04lvs8Qtmpa/h9jv8bTsBnatD6WosLh4xzzAnVJUmY488Ui5qseRYUpBLiE5id5kRzO61UOnyVA4KZiaXll4RFC6/JhLgSNil3J944BfFVVN76tsP8+n4ncg91kBxiMh3RB4Ob040kkbz8deTKWtoz7f8Vqs= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807644702788.332476861464; Sat, 11 Jul 2026 15:07:24 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifnh-00017i-DY; Sat, 11 Jul 2026 18:03:57 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifnf-00014B-8d; Sat, 11 Jul 2026 18:03:55 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifnd-0000EY-IV; Sat, 11 Jul 2026 18:03:55 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 2E15E1C0AB9; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id D8FAA3EAF44; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id A64F11333F; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=fJjD9xWydlVpgE6rdohPTQy0ExdJtZ/U3fgNqChL0eQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=QX6Mjd0fajeVeQonU2KtMqmMLjke5GYS+4HawTwpnh6TAZez4JBN4jLiNWZvzDxgx aqD6v8dsajLO9vmPC5IAY6V6nw2dG4uqc9G9RQvvE3aO5D6In627XHkonZF1RnfNL/ rZ+YO9pBY17bda6De14NU3Xqh8OBJun0aJh000RJ+y/KMd0CNKP85XT9qXCJPCNVbF Qf1/9LybWvsdxUBFihlLK79n0d2FJuoOwQqKck2v99KAnD8PQmfY4auPYl5MVHTUZX 7mQ/1bAUQc5iN6YmE53YmkR006CFzy+Fiq8Tx4XcpBJPRKbGinsKKjaXRTx2X3680z Z46GUQD7QKB3Q== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Junjie Cao , Feifan Qian , Chad Jablonski , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-11.0.3 46/81] hw/display/ati: reset host_data.next in write handler after flush Date: Sun, 12 Jul 2026 00:58:24 +0300 Message-ID: <20260711215904.3757-46-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807647042154100 From: Junjie Cao ati_host_data_flush() resets host_data.next only on its success path. When it returns early (unsupported bpp, direction, src_source, or src_datatype), next remains stale at >=3D 4. The next HOST_DATA write then stores a guest-controlled dword at acc[4+], overflowing the 4-element accumulator array. Fix this by resetting next unconditionally in the write handler after calling ati_host_data_flush() or ati_host_data_finish(), and removing the reset from inside ati_host_data_flush(). This ensures the write handler owns the full lifecycle of the accumulator index regardless of flush success or failure. Cc: qemu-stable@nongnu.org Reported-by: Feifan Qian Resolves: https://lore.kernel.org/qemu-devel/Czyl6yVfL6sHl_o1kRk8N_LpwXMMRV= hO9vgz1qCVJFagn9D4nHSKuiux39iOLty0Q3acxQq_FeovPhTQvSKus2htwjI9lTajLZmqovr0W= xs=3D@proton.me/ Signed-off-by: Junjie Cao Reviewed-by: Chad Jablonski Message-ID: <20260519023937.439077-2-junjie.cao@intel.com> Signed-off-by: Philippe Mathieu-Daud=C3=A9 (cherry picked from commit 3565faa0ace1f258789aafaf440ab55c3419df60) Signed-off-by: Michael Tokarev diff --git a/hw/display/ati.c b/hw/display/ati.c index 0489995d00b..7d4e40a142c 100644 --- a/hw/display/ati.c +++ b/hw/display/ati.c @@ -1032,8 +1032,10 @@ static void ati_mm_write(void *opaque, hwaddr addr, s->host_data.acc[s->host_data.next++] =3D data; if (addr =3D=3D HOST_DATA_LAST) { ati_host_data_finish(s); + s->host_data.next =3D 0; } else if (s->host_data.next >=3D 4) { ati_host_data_flush(s); + s->host_data.next =3D 0; } break; default: diff --git a/hw/display/ati_2d.c b/hw/display/ati_2d.c index 48498677c7e..8ef82bb87fd 100644 --- a/hw/display/ati_2d.c +++ b/hw/display/ati_2d.c @@ -452,7 +452,6 @@ bool ati_host_data_flush(ATIVGAState *s) } =20 /* Track state of the overall blit for use by the next flush */ - s->host_data.next =3D 0; s->host_data.row =3D row; s->host_data.col =3D col; if (s->host_data.row >=3D ctx.dst.height) { --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807581; cv=none; d=zohomail.com; s=zohoarc; b=CuyIAhJG5K0x4Xo6CEECHnjHSw8KdiRujU50PNwkA+QQlmVQNA6yx2NV7gR9b6Cs0zixO/MoziDrso2bF/GJa0Nh9lPlABo5CbmoD83UoOVjIgZg7EN1Ha3Dn8hgX2nD2JP06eOK1q78eHUyXc+khegSIZIFRBDtL98zJ5oo10s= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807581; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=2jvloFldDIYu0MmyD15aMOhxZAfz+khZNoi+H2/Z3uw=; b=M/ba8suidf0B9X52AxZ3qwvL9XzmACrDXlHIQfEWmzGMwxEC+OkOLcMde/EOv2JIuHoMIHUjRVTpS9JoLVL0/G39yJdIcE0+AJYxUnP872RA1JTJKSQAG+VhXokryU34olwCGHUM6aXh80W/ofpDTXXmL++GJcduxqW3clCrcnU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807581288354.6987831032624; Sat, 11 Jul 2026 15:06:21 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifnj-0001Fk-77; Sat, 11 Jul 2026 18:03:59 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifng-00016N-P9; Sat, 11 Jul 2026 18:03:56 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifnf-0000Fk-5r; Sat, 11 Jul 2026 18:03:56 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 336131C0ABA; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id DE8D93EAF45; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id A8C4913341; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=FaJS5R+gKCiWVlVkXPRzdxDXSytnyRiohqszJtJk9MQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=TApWUXKCEF+8DLiou+0SebQXoGrvCv6tBmdtMbjjWWWFXUjyf7PkZQcQTegF6Bf75 dXbcvz3KO4y5wDXf5VEeBKRAa+r/5nKQXovIIlKoftBXgBF3Xx8u8GNqsqwdt83Bs6 jXWBKLyVkdj6oZSSbhIiHh9V9pgK7iK/KH84Wm/C+++oEn/Aya1K4eKx/9QU+VS2cE CcFI5fW3vTQ0kcaR/47LXLQQarkSLSF/1CSkXsa3F7hRoGad4iYFjTS79TkuFKAQ4K pa57HaTE335xRFh9NhhnNmwAa4EFQoEjmgpG9eXTay+QG+Hth4WIqFHwUjgtl8fBUl 1Tt0Igc39xTwg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Junjie Cao , Feifan Qian , Chad Jablonski , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-11.0.3 47/81] hw/display/ati: guard against zero bpp in ati_host_data_flush Date: Sun, 12 Jul 2026 00:58:25 +0300 Message-ID: <20260711215904.3757-47-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807584251154100 From: Junjie Cao ati_bpp_from_datatype() returns 0 for unrecognized dp_datatype nibble values (0, 1, or >=3D 7). ati_host_data_flush() only guards against the bpp =3D=3D 24 case but not bpp =3D=3D 0, leading to: 1. Division by zero at "pix_count /=3D ctx.bpp" (SIGFPE) when src_datatype is SRC_COLOR. 2. g_assert_not_reached() in stn_he_p() when bypp (=3D bpp/8 =3D 0) hits the default case of the size switch. Both are guest-triggerable via MMIO writes to the dp_datatype register while a HOST_DATA blit is active. Add an explicit bpp =3D=3D 0 check with LOG_GUEST_ERROR before proceeding with the blit, consistent with the existing check in ati_2d_do_blt(). Cc: qemu-stable@nongnu.org Reported-by: Feifan Qian Signed-off-by: Junjie Cao Reviewed-by: Chad Jablonski Message-ID: <20260519023937.439077-3-junjie.cao@intel.com> Signed-off-by: Philippe Mathieu-Daud=C3=A9 (cherry picked from commit 90f8e5c307679b7468f73924e63682567a10564d) Signed-off-by: Michael Tokarev diff --git a/hw/display/ati_2d.c b/hw/display/ati_2d.c index 8ef82bb87fd..22dd811bd85 100644 --- a/hw/display/ati_2d.c +++ b/hw/display/ati_2d.c @@ -377,6 +377,11 @@ bool ati_host_data_flush(ATIVGAState *s) =20 setup_2d_blt_ctx(s, &ctx); =20 + if (!ctx.bpp) { + qemu_log_mask(LOG_GUEST_ERROR, + "host_data_blt: invalid bpp from datatype\n"); + return false; + } if (ctx.bpp =3D=3D 24) { qemu_log_mask(LOG_UNIMP, "host_data_blt: unsupported in 24 bits mode\n"); --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807535; cv=none; d=zohomail.com; s=zohoarc; b=m+6X1fwvXnQjXWjy6oJ9q5PRVs2icQczNxGiteG0Fd/X//w62v8VQukT6vHEgSW3sIjyviycKs6WpGdhF1HiooC76Mkv8S+fYUPZfUpXTK1vNW5FilUdaNrsNJ8YJ6GP8XTV7SJxE25x8I2w6EpFOi7tJGdMDABF/kAwfQmkNyE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807535; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=oPr1Af6fq3vyJBRca+ZlztIOLWDK5np3xw4zpWZuC1Y=; b=CLLARSWvDRDtuOZhM09IW4eiG2+dGNjpbLxz+dskzz2pGpAsrmrudme0iR5jusBuZeKp/8S3rc+libIahZAhL0Jb5f2RI6dwIi+29B8XdrAFdL6lz4Guc7iigXQQlgn6N9eXEmRIn7gZsVb2aJdyWzrEk6yBr/1dByT/MlL3jbQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 17838075353110.4057569435614141; Sat, 11 Jul 2026 15:05:35 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifo4-0001mz-50; Sat, 11 Jul 2026 18:04:20 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifo2-0001jD-FM; Sat, 11 Jul 2026 18:04:18 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifo0-0000GV-Pq; Sat, 11 Jul 2026 18:04:18 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 391981C0ABB; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id E488E3EAF46; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id AB1B313343; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=NC6KBC9WdXLOAh9bLq7yGrmhRdpCxbbAkK3QPsV7m0o=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=JPFV5Mt43hUF4lW4scVThqvV5KULT5p+F7LnqxFDX3x6HBBF0k4F8wNUB3Df7IVE/ kroWkjne8GevkInxUKDccxtF0RyLuN93dP4idMeXuGlFyLzIq0nyRVQQZwyHKR46MS ADnYjpbYw1gmOGvmucmx1QIJqDXYSYIFDMvACdno8hTwupk3EeFaOMSTKCRd+jZQ1Q 9J02GwDuMAIQ//gCWESaS45EsGzFsejFfHeBGp5OQRiO0BfG/mfwORWikJ8umV3ZfP 72N0pYc3jvUh9slFDkxxq7TdzjAX2ssnAq9dMkVS2Pav5DaK70FXITw2dlciIUorYY cXOorcVWikP9g== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, "Denis V. Lunev" , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-11.0.3 48/81] hw/ide/ahci: cancel in-flight buffered reads on command engine restart Date: Sun, 12 Jul 2026 00:58:26 +0300 Message-ID: <20260711215904.3757-48-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807538022154100 From: "Denis V. Lunev" ATAPI CD reads are issued through ide_buffered_readv() (cd_read_sector() and ide_atapi_cmd_read_dma_cb() in hw/ide/atapi.c). The PIO path discards the returned aiocb; the DMA path stores it in s->bus->dma->aiocb. A guest can stop and restart a port's command engine (PxCMD.ST 1 -> 0 -> 1) while such a read is still in flight. Stopping the engine unmaps the command list (ahci_unmap_clb_address()) and restarting it re-maps the list and clears AHCIDevice.cur_cmd to NULL, but nothing tears down the outstanding read. This path does not run ide_reset(), so the drive's transfer state is preserved and the read still completes. Its callbacks then dereference the stale or NULL cur_cmd in the AHCI transfer helpers: PIO: cd_read_sector_cb() -> ide_atapi_cmd_reply_end() -> ide_transfer_start_norecurse() -> ahci_pio_transfer() DMA: ide_atapi_cmd_read_dma_cb() -> ahci_dma_rw_buf() -> ahci_populate_sglist() Both crash with a NULL cur_cmd; the PIO variant has been seen in the field. Cancel the outstanding I/O when the command list is unmapped, reusing ide_cancel_dma_sync() as the ATAPI DEVICE RESET command does. It runs the completion callback with -ECANCELED (which tears down s->bus->dma->aiocb for the DMA case) and orphans the buffered request, so the eventual asynchronous completion is a no-op. Merely setting the orphaned flag is not enough: it would leave s->bus->dma->aiocb pointing at a freed aiocb that a later reset would cancel. Fixes: 1d8c11d63154 ("ide: add support for IDEBufferedRequest") Signed-off-by: Denis V. Lunev Message-ID: <20260619112158.304782-2-den@openvz.org> [PMD: Use ide_bus_active_if()] Signed-off-by: Philippe Mathieu-Daud=C3=A9 (cherry picked from commit d9f78431d8ebdc2d03ad74461138c1c9eb076aa5) Signed-off-by: Michael Tokarev diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c index 08f51c8e361..80cc386a6aa 100644 --- a/hw/ide/ahci.c +++ b/hw/ide/ahci.c @@ -740,6 +740,9 @@ static bool ahci_map_clb_address(AHCIDevice *ad) =20 static void ahci_unmap_clb_address(AHCIDevice *ad) { + /* Cancel in-flight reads that would complete against a cleared cur_cm= d. */ + ide_cancel_dma_sync(ide_bus_active_if(&ad->port)); + if (ad->lst =3D=3D NULL) { trace_ahci_unmap_clb_address_null(ad->hba, ad->port_no); return; --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807605; cv=none; d=zohomail.com; s=zohoarc; b=YdcVF9Po+jIDPwE2gpxgArAeRMBHeviUydSoaAKQn13lJmpowqnmYP5G3vbWcsPGyqyFmJjBTKUYs66dMxRsyTrcXq33sEFMvbTCtNXDQOAsiOexh2Y6ncAimHFDFLVxKcnYwQhVUEeS8KPgo+Jhq6wf/l4ITDC152IJYeoKs8g= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807605; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=kP3+abmhMocBwWknh5NBDuAjMXbdqp6s3M5KkLYc3FY=; b=NVElVNcgJ9J8qvRa7KR4b5s7iAoqEmwYYM85Nf7N3UL5fBkxzLHgOJa81vTuDWyuTMeFNo4PjDVb723muaN816GWITcULZWvtoln79sYATmp9DCa9Q6GOcJY906iwbNNZcLqWBpS+syTvLCF+s0n9zFUMU9vEFSChbTET7+RH9k= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807605252561.1549568876345; Sat, 11 Jul 2026 15:06:45 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifo4-0001oj-T7; Sat, 11 Jul 2026 18:04:21 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifo4-0001nU-3q; Sat, 11 Jul 2026 18:04:20 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifo2-0000Gm-7v; Sat, 11 Jul 2026 18:04:19 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 3EFB61C0ABC; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id E9AD13EAF47; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id AD83E13345; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=YlCOYq8LtBNuwHcN41KnBzTECRMnmu4Pc2G3A0ypwDU=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=bU98D8Wt3zK/kDf3Ou+WpQShxe8V7WAsLoL9O/rhAo/RTY1pqJ1BrAxQLZqEva/a7 I1rUax3mZBabpl2hAJ9UhwTJEsKJIgAKzjqrvc7dqqOOsW1VsoajMXf8ul1iEERQmt lWQZL7Jr8JFOXU+2HEDBVRXPDnayf65cYvkKOiuYgQ14B4oRvLA0+FMYmKdwjQiR2D g22d6bLsDPSKJgpRIHdcz6Xvfxa7hYC3ON5D0UNb6/UloAUwMQAGN+MRRTWriG1eCt 7N9Hrs0fhGhBbdre+VVa4PchetGyg9lBCpLFTa9LSL7N7NhT2+BlhIUIApN7XGT2qH YsaVfQxKAJsBg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, "Denis V. Lunev" , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-11.0.3 49/81] tests/qtest/ahci: test ATAPI read completing after engine restart Date: Sun, 12 Jul 2026 00:58:27 +0300 Message-ID: <20260711215904.3757-49-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DIET_1=0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807606507154100 From: "Denis V. Lunev" Add a regression test for the crash that occurs when a buffered ATAPI read completes after the command engine has been restarted. Issue an ATAPI READ_10 against a blkdebug-backed CD, suspend the backend read so it stays in flight, stop and restart the port's command engine (which re-maps the command list and clears cur_cmd), then release the read. The PIO and DMA reply paths fault in different AHCI helpers (ahci_pio_transfer() vs ahci_dma_rw_buf()), so cover both. The DMA variant is the reliable guard: on engine restart check_cmd() can re-arm cur_cmd before the old read completes, so the PIO variant does not fault in every build. The test only asserts that qemu survives a subsequent register access; if the blkdebug breakpoint ever failed to park the read it would pass without exercising the bug, as with the existing break/resume tests. Signed-off-by: Denis V. Lunev Message-ID: <20260619112158.304782-3-den@openvz.org> Signed-off-by: Philippe Mathieu-Daud=C3=A9 (cherry picked from commit cb7bc10385f365c0792b77fc73b1d17a16cbaefd) Signed-off-by: Michael Tokarev diff --git a/tests/qtest/ahci-test.c b/tests/qtest/ahci-test.c index 5c32ff20029..44799eea153 100644 --- a/tests/qtest/ahci-test.c +++ b/tests/qtest/ahci-test.c @@ -1625,6 +1625,69 @@ static void test_cdrom_pio_multi(void) ahci_test_cdrom_read10(3, false); } =20 +/* + * Regression test: a buffered ATAPI read completing after a command + * engine restart must not dereference the cleared cur_cmd. Cover both + * PIO and DMA; the DMA variant is the reliable guard. + */ +static void test_atapi_engine_restart_in_flight(bool dma) +{ + AHCIQState *ahci; + AHCICommand *cmd; + unsigned char *tx; + char *iso; + int fd; + uint8_t port; + uint64_t buffer; + uint64_t iso_size =3D (uint64_t)ATAPI_SECTOR_SIZE * 2; + + fd =3D prepare_iso(iso_size, &tx, &iso); + + ahci =3D ahci_boot_and_enable("-drive if=3Dnone,id=3Ddrive0," + "file=3Dblkdebug::%s,format=3Draw,readonly= =3Don " + "-M q35 " + "-device ide-cd,drive=3Ddrive0 ", iso); + port =3D ahci_port_select(ahci); + + buffer =3D ahci_alloc(ahci, ATAPI_SECTOR_SIZE); + qtest_memset(ahci->parent->qts, buffer, 0x00, ATAPI_SECTOR_SIZE); + + /* Suspend the next backend read so the ATAPI read stays in flight. */ + g_free(qtest_hmp(ahci->parent->qts, + "qemu-io drive0 \"break read_aio rd\"")); + + cmd =3D ahci_atapi_command_create(CMD_ATAPI_READ_10, ATAPI_SECTOR_SIZE, + dma); + ahci_command_adjust(cmd, 0, buffer, ATAPI_SECTOR_SIZE, 0); + ahci_command_commit(ahci, cmd, port); + ahci_command_issue_async(ahci, cmd); + + /* Stop and restart the command engine to re-map the command list. */ + ahci_px_clr(ahci, port, AHCI_PX_CMD, AHCI_PX_CMD_ST); + ahci_px_set(ahci, port, AHCI_PX_CMD, AHCI_PX_CMD_ST); + + g_free(qtest_hmp(ahci->parent->qts, "qemu-io drive0 \"resume rd\"")); + + /* Round-trip through the device to confirm qemu is still alive. */ + ahci_px_rreg(ahci, port, AHCI_PX_TFD); + + ahci_command_free(cmd); + ahci_free(ahci, buffer); + g_free(tx); + ahci_shutdown(ahci); + remove_iso(fd, iso); +} + +static void test_atapi_engine_restart_pio(void) +{ + test_atapi_engine_restart_in_flight(false); +} + +static void test_atapi_engine_restart_dma(void) +{ + test_atapi_engine_restart_in_flight(true); +} + /* Regression test: Test that a READ_CD command with a BCL of 0 but a size= of 0 * completes as a NOP instead of erroring out. */ static void test_atapi_bcl(void) @@ -2042,6 +2105,10 @@ int main(int argc, char **argv) =20 qtest_add_func("/ahci/cdrom/pio/bcl", test_atapi_bcl); qtest_add_func("/ahci/cdrom/eject", test_atapi_tray); + qtest_add_func("/ahci/cdrom/engine_restart/pio", + test_atapi_engine_restart_pio); + qtest_add_func("/ahci/cdrom/engine_restart/dma", + test_atapi_engine_restart_dma); =20 ret =3D g_test_run(); =20 --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807600; cv=none; d=zohomail.com; s=zohoarc; b=FZG6QeZfwPudDdcxMtrsxGaIIUBi7n27jWeP6aOayZo1K9PPvpDYNc1ZkKG0NwrpZZ7mnt8nmZtfKFD0vBAWU+F64kW9o34gx4jTkRxXu9Akdm0wN0D1uVQVTGimTmEDJepbT5ocHFLl8p6tzPQoH42hzIdbRLxFFBoCbfugrLU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807600; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=5NSSPUaOeNkSmox84Eu7DJDvsyKTxrbcegUWhEiJx2U=; b=hfOjnsNcqbBs5b6RfAJ/+L08C2aStYkjDfHLVdcQL+Tqz1c9Tfvwi08eNnsjn8jhFITTwQKL9Q4yfDaUHo3z2r3ulXgBPTFh7eAICNZO/Sh5AxD9OWBSkOA5slqDfORUf8fdcgE3xZ/zFnO+fQln/s66hgDJgPap1M6l7cj3H00= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807600810983.6957184820823; Sat, 11 Jul 2026 15:06:40 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifo8-000266-Ph; Sat, 11 Jul 2026 18:04:25 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifo6-0001tZ-8V; Sat, 11 Jul 2026 18:04:22 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifo4-0000I3-7q; Sat, 11 Jul 2026 18:04:21 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 444551C0ABD; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id EFAC93EAF48; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id AFEB413347; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=6o4QXKrAfHBv/13iR2iSq2AMyvJa+9WDo2zhcCyCTys=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Gs/EfHj8frV8v00zuTmgXqxAsAIGD766vr1Jm7eNaR9ULIfe/Ea6QmEQgjylKe4fn zIpLgkDATFy/1MQqnZsKR3qCcHS7kUrDw7Oz3LxOP0cQifr9ahWORP8IhqfExelxVR RfoLBPEA6wbj5bxDkjsT+UFELAhdsdDXIfgWaoPH0fLgZTADRJsyrstt5Ta/iefaQ6 l7qmzFLf8tPJnLW+5JgXbQs8w3RAVQ2N3j1xV4jqbjrkt3/wKw0jpD8lorsRS3MvsD R5ZeBtAxOcctnR+2VXOmT4E/XwY2ST0mbt3zl2ZD9aLXn9xI9Tw53ONCF2eJiuQA3C V0MnF5Ee4/RHg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-11.0.3 50/81] hw/dma/i8257: Return zeroes for read_memory in verify mode Date: Sun, 12 Jul 2026 00:58:28 +0300 Message-ID: <20260711215904.3757-50-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807602368154100 From: Peter Maydell The i8257 DMA controller has a "verify" mode, which the datasheet describes like this: > DMA verify, which does not actually involve the transfer of data. > When an 8257 channel is in the DMA verify mode, it will respond the > same as described for transfer operations, except that no memory or > I/O read/write control signals will be generated. When an 8257 > channel is in the DMA verify mode, it will respond the same as > described for transfer operations, except that no memory or I/O read > /write control signals will be generated, thus preventing the > transfer of data. The 8257, however, will gain control of the system > bus and will acknowledge the peripheral's DMA request for each DMA > cycle. The perihperal can use these acknowledge signals to enable an > internal access of each byte of a data block in order to execute some > verification procedure, such as the accumulation of a CRC check word. In practice, for QEMU's purposes the only real user of this is the floppy controller, which can be made to perform a "read data from floppy disk and check the checksum" by telling the fdc to do a read and the DMA controller to do a verify. This causes the fdc to do all the usual read actions including the checksum, but the data is never written to memory. However, it is possible for a guest doing something silly to program the DMA controller to do a verify operation for a device that wants to read from memory. Currently we simply return early from i8257_dma_read_memory() without writing to the buffer. None of the callers (the GUS, sb16 and cs4231a sound cards, plus the fdc) expect this, so they will take the uninitialized data as if it were from the guest. This can cause us to leak host data off the stack into the guest. Make i8257_dma_read_memory() fill the buffer with zeroes rather than leaving it untouched for a verify operation. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3487 Signed-off-by: Peter Maydell Reviewed-by: Daniel P. Berrang=C3=A9 Message-ID: <20260629140128.1900095-1-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daud=C3=A9 (cherry picked from commit 03071f99a3e1549b3acc9b9534961632df016f76) Signed-off-by: Michael Tokarev diff --git a/hw/dma/i8257.c b/hw/dma/i8257.c index 3637d8f82d7..34c19dbd84e 100644 --- a/hw/dma/i8257.c +++ b/hw/dma/i8257.c @@ -407,6 +407,19 @@ static int i8257_dma_read_memory(IsaDma *obj, int ncha= n, void *buf, int pos, hwaddr addr =3D ((r->pageh & 0x7f) << 24) | (r->page << 16) | r->now[A= DDR]; =20 if (i8257_is_verify_transfer(r)) { + /* + * If the device is expecting this verify operation then + * it won't care about the nonexistent data. But if it + * is expecting a real read (i.e. the guest has misprogrammed + * the DMA controller and the device) it's going to try to do + * something with the buffer contents. Give it zeroes. + * (It's not clear whether this is exactly what happens if + * you do this on real hardware. In practice no device QEMU + * emulates has a use for verify on a memory-read transfer, + * so we don't care beyond avoiding the guest being able to + * trigger the caller reading uninitialized data.) + */ + memset(buf, 0, len); return len; } =20 --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807627; cv=none; d=zohomail.com; s=zohoarc; b=G4FU96gi8b57KVkxvtpRqU0nIPg0poVtRt+DSAKV0JyCq4XDDp469JW0aKkqBceDB/DTKU0OjnmoxVVQfNRe7FAos5g+e1c9y5+gCOaBh0FRHay0015QKMOaB1QKoLHoHT/lZ8nV8uMRmg0JGAEd+YDXLYDg1sypOvx85CIItOk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807627; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=ipmO3tHN/loRVw0og4D4kIVZsIi1sXiWwXyIh7AQ5EQ=; b=df4SSojUdvn7koCS/5cIP0G5HZbl+q//VR9NzSmkeV8LvZB2zeaeA9c6LwaYpUx7Z4Xsfkq5/+AX8wNlwpu22IwgjcqvOW6trofKqzeaTCyHrlcLYNnIL0ifKOAn5Yw3lqweICZEdzb5pH0FtUyQA33HfGyZjOV6u4H+iO2EsV0= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807627777211.22160862427882; Sat, 11 Jul 2026 15:07:07 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifoA-0002Le-CI; Sat, 11 Jul 2026 18:04:26 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifo7-00021k-Cn; Sat, 11 Jul 2026 18:04:23 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifo5-0000IP-HS; Sat, 11 Jul 2026 18:04:23 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 4A37A1C0ABE; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 014AD3EAF49; Sun, 12 Jul 2026 00:59:51 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id B247513349; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=Vf4ThstD9/nu0JmqenpiSl32qQnpEMfk3XWv2WZ4bgM=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=ruKQ7bObX3Mc3Fd33xIwDHSz0D4LLCCEjygftXoQR/6r0JtmuaXl3geA/84OuOHpm M6QiLNBeg9jslTWXQlTOES66V6IX9lbasz0cV3tZzEv1OfnqfBywmfbo3pmulXMwmX cq2xp/7hk9+oMIJIiXn8m8MFq7gDSM9ddkfhiEPVuk9C9rNO88CtCTL4BxsHHQvU3K 8GXoeD1R1aiMPeX4eFcN2xai6nFfSO66gB3zHOYRdq35vZ8TQzYBQGXSphECWxjb74 iMa6o44nK6zRNCxLuM6/noih+HCYq/IGCEAzWxDcdUya1qNrZaDI/07bhc10/Ez15O WiGblSqfWINbA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-11.0.3 51/81] hw/scsi/mptsas: Reset doorbell state on reset Date: Sun, 12 Jul 2026 00:58:29 +0300 Message-ID: <20260711215904.3757-51-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807628653154100 From: Peter Maydell Currently the mptsas reset function clears intr_status, but it doesn't reset the doorbell state machine. This means that the state machine and the interrupt state get out of sync, and the guest can trigger an assertion failure in mptsas_doorbell_read() where s->doorbell_state is still DOORBELL_READ but s->intr_status does not have MPI_HIS_DOORBELL_INTERRUPT set. Fix this by having reset also reset the doorbell state. Strictly speaking we don't need to also clear doorbell_reply_idx and doorbell_reply_size, because those are only read when in DOORBELL_READ state, and the code always sets them up before transitioning into that state. But it's less confusing to clear them out on reset. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/304 Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daud=C3=A9 Message-ID: <20260629185035.2138238-1-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daud=C3=A9 (cherry picked from commit 831a13665ab1123b5ccd127820f287e41be137e9) Signed-off-by: Michael Tokarev diff --git a/hw/scsi/mptsas.c b/hw/scsi/mptsas.c index e4a7b2fee4a..5df124c0ce5 100644 --- a/hw/scsi/mptsas.c +++ b/hw/scsi/mptsas.c @@ -811,6 +811,10 @@ static void mptsas_soft_reset(MPTSASState *s) s->intr_status =3D 0; s->intr_mask =3D save_mask; =20 + s->doorbell_state =3D DOORBELL_NONE; + s->doorbell_reply_idx =3D 0; + s->doorbell_reply_size =3D 0; + s->reply_free_tail =3D 0; s->reply_free_head =3D 0; s->reply_post_tail =3D 0; --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807644; cv=none; d=zohomail.com; s=zohoarc; b=GxoWR0d2jsp1AbPIE27c20IrRjk/VjYlCatzE9pb3vYoL68xNnh3pwAyLKZjilhiHNs1cfOvJIiSxVaSBAobdS7XvpHnjtRgw0eakWqKZUxvswoU69T2fQ64+9MuEKnRdBNOmE9bassurnRvkp1apCJCXLs9AgmM918sxiDtblQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807644; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=OQw7/2scaV2hJ5Xxl+OghHZuSd8rped+rgiif1U3+E8=; b=EGxezjg6atRGFrDgSI+L44yQuitmK9VwOwEjefcW438aWiDVxn5qb0Qw6M1DRwNeGRpisVdB1Yas/HFZDZxl4u5rVZDflS1bXDIQNAq43uf7TfZOjg5lJ9eYVbCZ6/35ef5i0qCCF19sGAyTTHhP6bvXCQEu9O2tgCrFLA2VXBo= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807644485797.0434725540348; Sat, 11 Jul 2026 15:07:24 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifoV-0003SP-As; Sat, 11 Jul 2026 18:04:47 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifoT-0003Pk-FF; Sat, 11 Jul 2026 18:04:45 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifoR-0000Id-OK; Sat, 11 Jul 2026 18:04:45 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 4F17B1C0ABF; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 0699C3EAF4A; Sun, 12 Jul 2026 00:59:51 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id B49651334B; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=x+PfetWz0JUn+OwM6oI/vUJA8aiYexVFJ80TaWlBdP0=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=TTLLA3ubOu1E4oAYgK9L0PR60QDRqxIUBL9tGayqj54KJ+BQfbo4J9vhiy9lDhmGd byMy5BG9qbXlE+cUlqe94H72Wn/PXYhYAMWlTm2+fGpZe+ZqHYG8Ab1dXmvsoJEsCz 6SRvWJpH8QTz2C3uLybsR7YxdhlBb0p/20V+vhj7UeuscCjpdWfGdanUSuh9y7HNeM UEwPV+8fKnePV2Lf1VkwmwmlsNhpc8VL9v880/wo+1eaVU0JUeiwm4Ht5nf45wLuTV rLructXuwZMtJ50Mr+ZJWWIsp8i2xqxF8do5VB8tx7uDLE3zcajFbdl8wE/yncx3CP /vq3XauCiGC9Q== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Thomas Huth , =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-11.0.3 52/81] hw/display/qxl: Fix mono cursor validation that can read past a cursor chunk Date: Sun, 12 Jul 2026 00:58:30 +0300 Message-ID: <20260711215904.3757-52-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807646931154100 From: Thomas Huth qxl_render_cursor() maps the guest-provided QXLCursor object using the guest-controlled cursor->chunk.data_size. For a mono cursor, qxl_cursor() then validates the expected bitmap size against cursor->data_size, but it does not validate that the first chunk actually contains that many bytes. A guest could set cursor->data_size to the correct full mono cursor size while setting cursor->chunk.data_size to zero. In that case, cursor_set_mon= o() reads the AND/XOR masks starting at cursor->chunk.data. If the cursor object is placed at the end of the QXL RAM BAR, those reads cross the mapped RAM region and could crash the QEMU process (e.g. under ASan). Fix it by double-checking cursor->chunk.data_size for the correct size. This patch is based on the suggested changes by the reporter in the bug ticket. Reported-by: huntr bubble Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3646 Signed-off-by: Thomas Huth Acked-by: Marc-Andr=C3=A9 Lureau Message-ID: <20260630101022.379057-1-thuth@redhat.com> Signed-off-by: Philippe Mathieu-Daud=C3=A9 (cherry picked from commit 0e51b71c7b7706923536c1f7923cace82877932b) Signed-off-by: Michael Tokarev diff --git a/hw/display/qxl-render.c b/hw/display/qxl-render.c index c6a9ac1da10..1fe63b6f5ca 100644 --- a/hw/display/qxl-render.c +++ b/hw/display/qxl-render.c @@ -272,9 +272,11 @@ static QEMUCursor *qxl_cursor(PCIQXLDevice *qxl, QXLCu= rsor *cursor, case SPICE_CURSOR_TYPE_MONO: /* Assume that the full cursor is available in a single chunk. */ size =3D 2 * cursor_get_mono_bpl(c) * c->height; - if (size !=3D cursor->data_size) { - fprintf(stderr, "%s: bad monochrome cursor %ux%u with size %u\= n", - __func__, c->width, c->height, cursor->data_size); + if (size !=3D cursor->data_size || cursor->chunk.data_size < size)= { + qxl_set_guest_bug(qxl, "%s: bad monochrome cursor %ux%u" + " data_size %u chunk_size %u", + __func__, c->width, c->height, + cursor->data_size, cursor->chunk.data_size); goto fail; } and_mask =3D cursor->chunk.data; --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807560; cv=none; d=zohomail.com; s=zohoarc; b=PLVFZ7DT7oT3k06eMt5CFLlqlaGFclDQpwXP9ArhwA/43DBYvgyuyUkgPVOGUDDuDiIdZshUgdQvq4pLxtFR4NbVXDWTgj9LbTXT3iO1IhBMgwZZIQ5DtXCkV6y1Jh7VDAS6wlbu/P0ReyCnqrflCZsptSodUN2hmekQnA+qeIU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807560; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=7gHp8OEbIu/wrlScDi9I0DqDVZJx2ftUAqdWWGdXq58=; b=nMA1XN+qSt4KQaeHkh8seTZ7mG1Zu7ONbeRLU6JW4Er10DYuWPvKsMv3la5yNqe8NLX5rboTOpU72CFLQf5nEc7QqMpdAUcpvjuyc4vseQp1oIJoqU1NEcQ7b16zpkdsVs5L3Dd5SD9lx2beSX9V+1ZfZb3oRjlCczsgRiEPv4E= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807560106891.6521226176898; Sat, 11 Jul 2026 15:06:00 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifoW-0003V8-Au; Sat, 11 Jul 2026 18:04:48 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifoU-0003QZ-KZ; Sat, 11 Jul 2026 18:04:46 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifoS-0000Io-Su; Sat, 11 Jul 2026 18:04:46 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 544D51C0AC0; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 0B65F3EAF4B; Sun, 12 Jul 2026 00:59:51 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id B70AA1334D; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=AmXa34GkWAKZ+42cqjvspGOsXvpCNEE/VZgSOahoWcA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=FDW6N6zZdsub5OKCBKT9v+dUIxVKTfWms1m5XhjiyapDktyPCxXhoPb6wSsMuK15s yimdWYLDZchEjAbL5xBT6Rf9KoeqU+6Qn3xUZzTiZv+otFfx68B/EoWMBoN8i32iX1 377m+JadQbJ4+qcqop9E4uUT/B4RpJ+8cc5LDyN1oq8ZZTOVJuPiMM9xVyer1Od6Bl 31D4BqiRF8lBlTkoF1lllH4V9dwE+5juVCocKsUfhH93VG+GstDwZI+cTBLGsSVvz3 StRO3ZmH3Z+7gtfVZmpIuWK2PwKW4wuGnZUVqw7MYyFVOwnnwxvNTYHqs3HdXc5Gua 5O/28cYIfyoSw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, no92 , Clement Mathieu--Drif , Yi Liu , "Michael S. Tsirkin" , Michael Tokarev Subject: [Stable-11.0.3 53/81] intel_iommu: Correctly set pt bit in extended capability register Date: Sun, 12 Jul 2026 00:58:31 +0300 Message-ID: <20260711215904.3757-53-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807562036154100 Content-Type: text/plain; charset="utf-8" From: no92 With the changes in c7b2e22bd957, the `pt` bit was set in the (wrong) capability register, instead of the (correct) extended capability register. Fixes: c7b2e22bd957 ("hw/i386/x86-iommu: Remove X86IOMMUState::pt_supported= field") Signed-off-by: no92 Reviewed-by: Clement Mathieu--Drif Reviewed-by: Yi Liu Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Message-ID: <20260624103933.1793586-3-leo@managarm.org> (cherry picked from commit dbc0ed56223011281e14b5cb8c02453915d35d12) Signed-off-by: Michael Tokarev diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c index f395fa248c0..7b2cead8f8b 100644 --- a/hw/i386/intel_iommu.c +++ b/hw/i386/intel_iommu.c @@ -4998,7 +4998,7 @@ static void vtd_cap_init(IntelIOMMUState *s) { X86IOMMUState *x86_iommu =3D X86_IOMMU_DEVICE(s); =20 - s->cap =3D VTD_CAP_FRO | VTD_CAP_NFR | VTD_CAP_ND | VTD_ECAP_PT | + s->cap =3D VTD_CAP_FRO | VTD_CAP_NFR | VTD_CAP_ND | VTD_CAP_MAMV | VTD_CAP_PSI | VTD_CAP_SSLPS | VTD_CAP_DRAIN | VTD_CAP_ESRTPS | VTD_CAP_MGAW(s->aw_bits); if (x86_iommu->dma_translation) { @@ -5009,7 +5009,7 @@ static void vtd_cap_init(IntelIOMMUState *s) s->cap |=3D VTD_CAP_SAGAW_48bit; } } - s->ecap =3D VTD_ECAP_QI | VTD_ECAP_IRO; + s->ecap =3D VTD_ECAP_QI | VTD_ECAP_IRO | VTD_ECAP_PT; =20 if (x86_iommu_ir_supported(x86_iommu)) { s->ecap |=3D VTD_ECAP_IR | VTD_ECAP_MHMV; --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807556; cv=none; d=zohomail.com; s=zohoarc; b=SJlUvgsC5Y8PaRPfPa0AilhshJQtu8gti58EiJUQ/1qTiMJqRoY9Vhal80MvfjQWEbmxbKL/h8T4C7SFBfTqJN+b07wpmsh1MSTraB6BPtvOaPbbalTXgOhW91jRqNFu8a060BX4JqS4mm4hMWns4Cd49cL/oaaJ1RMBRDC1MtM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807556; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=iKfrMs0VcyRfk9o45NvnruQalHE1AgGmnN0VOeo8mUA=; b=g7njHrEYUPw/OsVeOyzy5W340P7sdOefaSTHF+68UcN1WvfCx0ORRJW3Lhvl0kOMI4MOLTkrUxCGzx6MDDvMF8ma2klZwOVCHIOv+VacPOyiZauxp0F0k+gn1Yk8fnn9X6+JYtPHKzUHPcePZHgwVnqwKytVfPVbABPjXbHR7ok= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807556361557.6501311501322; Sat, 11 Jul 2026 15:05:56 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifoY-0003Y0-9A; Sat, 11 Jul 2026 18:04:50 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifoW-0003Vx-JE; Sat, 11 Jul 2026 18:04:48 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifoU-0000N8-UU; Sat, 11 Jul 2026 18:04:48 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 594CE1C0AC1; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 105773EAF4C; Sun, 12 Jul 2026 00:59:51 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id B977C1334F; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=FbLxTK3dK0Ntfc0GcAK6KQwuQ6t1UT4nBw08tUjanLI=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=ntiUsc/8baZ/Gr0foerPunaVO2vkLGqFSFHiY2tNyADtmz8eK/BovmbwTQ4XsK7jv +V8C+jYYCF+3Gm3soY7DodBQsNUGAeflHjYgOGZNv9fBQl+OzqI1BSkUOMLGf/bse2 /DAIimG/cYyurrYO67BUV+k5WAO+yOd3HbhYfNHu1+pkK+GkYfoQahhjJPxFlNO2Qg XyQVkW92WWrmKQt6OjXf7yTDgHsjiE4fdjjwnXl2Ro09BvsuhaOWr3aPiE2hmTFnx4 44nbJvPeIMl0CeiTcHIPdcjxEXCNJvixnSkIA3xmd73iiT3EFqYfT0AD8LQsJJuvZ7 ZhJfOkDLb9Oow== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, lizhaoxin04 , Miao Kezhan , "Michael S. Tsirkin" , Michael Tokarev Subject: [Stable-11.0.3 54/81] vdpa: fix use-after-free of vqs in vhost_vdpa_device_unrealize Date: Sun, 12 Jul 2026 00:58:32 +0300 Message-ID: <20260711215904.3757-54-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807557848154100 Content-Type: text/plain; charset="utf-8" From: lizhaoxin04 vhost_vdpa_device_unrealize() frees s->dev.vqs before vhost_dev_cleanup(), but vhost_dev_cleanup() still accesses hdev->vqs while tearing down virtqueues. This leads to a use-after-free and may crash QEMU with SIGSEGV during vDPA hot-unplug. Save the vqs pointer in a local variable, call vhost_dev_cleanup(), and free it afterward. This matches the cleanup pattern used by vhost-scsi. Fixes: b430a2bd23 ("vdpa: add vdpa-dev support") Co-developed-by: Miao Kezhan Signed-off-by: Li Zhaoxin Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Message-ID: <20260622100145.18924-1-lizhaoxin04@baidu.com> (cherry picked from commit e03463812e74d1befc8d7f6f158eca531e2d6406) Signed-off-by: Michael Tokarev diff --git a/hw/virtio/vdpa-dev.c b/hw/virtio/vdpa-dev.c index 4532d63653e..7d98b23b471 100644 --- a/hw/virtio/vdpa-dev.c +++ b/hw/virtio/vdpa-dev.c @@ -173,6 +173,7 @@ static void vhost_vdpa_device_unrealize(DeviceState *de= v) { VirtIODevice *vdev =3D VIRTIO_DEVICE(dev); VhostVdpaDevice *s =3D VHOST_VDPA_DEVICE(vdev); + struct vhost_virtqueue *vqs =3D s->dev.vqs; int i; =20 virtio_set_status(vdev, 0); @@ -184,8 +185,8 @@ static void vhost_vdpa_device_unrealize(DeviceState *de= v) virtio_cleanup(vdev); =20 g_free(s->config); - g_free(s->dev.vqs); vhost_dev_cleanup(&s->dev); + g_free(vqs); g_free(s->vdpa.shared); qemu_close(s->vhostfd); s->vhostfd =3D -1; --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807610; cv=none; d=zohomail.com; s=zohoarc; b=BFefP26ouojVtLr7DuXw4JvdZIG3bKKxs1PlcokGZKHLnrNSK6W2o7pkjdoXqAA7XGkmxstMj/hWQ54JN+9WeceCxZNHfr0RifL4yTEnkne3hcxmTusE/o19TSwNgQwcd9SRbnJ9lZELIbMEEDUsJnDFkBykkApOoP4Rwh7xngU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807610; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=g5pAms6VH5I1eIYOQTQRmXcnz+n4YQ7iYEYReeR5bXM=; b=KquSz0DTuXQN3LzzbI6lLiaUeLLuTfQdzMnJzCnMrPPymNQqazLHCs0jlBDSDogDuaxpKknXaJc0Qtp7cFmTS0OW39sBhfyBwtyjryXc4ybgt81nhxKpjoKjqteGFndUnawtI/aKXfvLYNkIzFoIPVWfktvRHysgnTmo6xgk4Bg= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807610933184.05407040920636; Sat, 11 Jul 2026 15:06:50 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifoa-0003aq-EM; Sat, 11 Jul 2026 18:04:52 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifoX-0003XS-KA; Sat, 11 Jul 2026 18:04:49 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifoW-0000Ny-4N; Sat, 11 Jul 2026 18:04:49 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 5E8781C0AC2; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 15A103EAF4D; Sun, 12 Jul 2026 00:59:51 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id BBECA13351; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=iHYQpyNPdzXsG1Hyh5gnLv5dtisLNiUhnurAc4Ozgf4=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=BoCDjQhe8Gab3YpeDs7i0Pk/wxSBGKfv3g55VyZ2GnQkIyi3CjGvdlXt7IkC6Cdef LIVOUnCCBibC9Mjg8Iw7ZwYhZoFcuTAVYS1pAZlNZaGC/FiP+PlKRSx9Xv3X6gQ+r2 MD2HSkjZma9/V2u0QwRZ4vzEpt0KAEaKOKcahmZLTYg5tONPfGFAvueZCTSMVQTEFu 4YF0xvk0FMtFVf7Mf1HU+wccsbEJghcyko74MjyXbhvpHTx3jSiDZGLI7Krpznur23 Ay9UJS2ppP+BPAcojS1MgL7Bl2bGvgQh8vfWfzTH1aQYr5dc5hr4Poaa4ShMRT2vpR rP6J4e/xPn9hA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Nathan Chen , Shameer Kolothum , Eric Auger , Peter Maydell , Michael Tokarev Subject: [Stable-11.0.3 55/81] hw/arm/smmuv3: Update ATC invalidation check Date: Sun, 12 Jul 2026 00:58:33 +0300 Message-ID: <20260711215904.3757-55-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807612437154100 Content-Type: text/plain; charset="utf-8" From: Nathan Chen Use smmuv3_ats_enabled() to determine whether ATS is enabled for the guest when handling an ATC invalidation command, as setting the ATS property value to 'auto' will resolve to ATS being detected as enabled in the ATC invalidation check otherwise. Fixes: f7f5013a55a3 ("hw/arm/smmuv3-accel: Add support for ATS") Reported-by: Shameer Kolothum Reviewed-by: Eric Auger Reviewed-by: Shameer Kolothum Signed-off-by: Nathan Chen Tested-by: Eric Auger Message-id: 20260608174900.2227340-2-nathanc@nvidia.com Signed-off-by: Peter Maydell (cherry picked from commit 8addbdb793b783228ab22867ac5e2d59ea6662a7) Signed-off-by: Michael Tokarev diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c index 7fead1c3cff..4e4b79c0f1c 100644 --- a/hw/arm/smmuv3.c +++ b/hw/arm/smmuv3.c @@ -1528,7 +1528,7 @@ static int smmuv3_cmdq_consume(SMMUv3State *s, Error = **errp) { SMMUDevice *sdev =3D smmu_find_sdev(bs, CMD_SID(&cmd)); =20 - if (!sdev || !s->ats) { + if (!sdev || !smmuv3_ats_enabled(s)) { trace_smmuv3_unhandled_cmd(type); break; } --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807655; cv=none; d=zohomail.com; s=zohoarc; b=LKJTK9tZXq29r8XMBeOlC9TvKrx9Hbw2L4MkSuCfCIWTlfNElOcBz1/we9vCPg1vLFpS7zmpfD0ur8xDhbQi/qLn1QAutaiThhtzuwb+iAQwlmU9pdTnqdox77SLKQjp0xXu3lSNKVN3uts/CbUphLETTD1NgxNQw4SZXGEWeaw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807655; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=FtB3UQ9hcKwwmKw9rAm2xzxzqE94jwdYaGs5vs3TvKk=; b=bxWMZeRKGROVC8NJDGJgLZNcOFyzVKVW366Cdbd6hCU0bC0G+7jCv27Uttcv9NicX4tRHOjfO69khXLixDHiICqvsHUqqJ/21l6/zNG1lEM6A63mBqtaqfszDwljZbIBR5sn9ln3PQBqI29+FwJbKXnvF8ac8BMAwPOVc0yRfMk= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807655297864.8239343125822; Sat, 11 Jul 2026 15:07:35 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifoa-0003bJ-PC; Sat, 11 Jul 2026 18:04:52 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifoZ-0003aJ-PW; Sat, 11 Jul 2026 18:04:51 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifoY-0000OQ-1T; Sat, 11 Jul 2026 18:04:51 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 633971C0AC3; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 1A9123EAF4E; Sun, 12 Jul 2026 00:59:51 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id BE59113353; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=GvJ43gxMWlBLeNH5PwRFw/Yz0H6yBNdyKI8/cBryauM=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=fY9rD6aHEqKze8KNNjmREzfnKN9oSslIQSXrUOU2hePjk9dmoSWgfMAjbvzcei7bQ x4WnWR1Eu0qIqmLFcSOwJBC+C9PpTOptW8V7ic5TflYmrr8AWCI3hwIlL5DzHHs9Iz +2RsK0GYB2duqmEstOF9ghh6YGqNqvSXnGk9eWmAftNQxogimvUNccCcHm9Mdlv4nZ J5qhyKuKaU+6e501V2Qv3DCK++uVP7WH4qCwhGEglQpLeCy3ze8rsdIyXaFuvcJtoz srM7RdT7cxIyYuvFMI0bjh7knt1eYDh4JppxEBgtmOYXoO9URP/QnrewlnvsRJVrG/ M4dBdNCDfuicQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, "hemanshu.khilari.foss" , luc@lmichel.fr, peter.maydell@linaro.org, hemanshu_dev@proton.me, Michael Tokarev Subject: [Stable-11.0.3 56/81] hw/core/qdev-clock: Fix potential null pointer dereference Date: Sun, 12 Jul 2026 00:58:34 +0300 Message-ID: <20260711215904.3757-56-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807657383154100 Content-Type: text/plain; charset="utf-8" From: "hemanshu.khilari.foss" qdev_get_clocklist() function returns a pointer to the NamedClockList struct. This function is called in qdev_alias_clock() and the returned pointer is immediately dereferenced without a null check. Passing a clock name that doesn't exist to qdev_get_clocklist() is a programming error, and so this change is not fixing a bug, only making the reporting of that programming error a bit more helpful and bringing it in to line with qdev_get_clock_in() and qdev_get_clock_out(). Cc: luc@lmichel.fr Cc: peter.maydell@linaro.org Cc: hemanshu_dev@proton.me Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/2342 Signed-off-by: hemanshu.khilari.foss Message-id: 20260531153354.88909-2-hemanshu.khilari.foss@gmail.com Reviewed-by: Luc Michel Reviewed-by: Peter Maydell Signed-off-by: Peter Maydell (cherry picked from commit 7913b3b9463ffb4078d33c7ddaeacd1bb38aae3e) Signed-off-by: Michael Tokarev diff --git a/hw/core/qdev-clock.c b/hw/core/qdev-clock.c index 6e2967e433e..861f78f94c6 100644 --- a/hw/core/qdev-clock.c +++ b/hw/core/qdev-clock.c @@ -157,7 +157,14 @@ Clock *qdev_alias_clock(DeviceState *dev, const char *= name, DeviceState *alias_dev, const char *alias_name) { NamedClockList *ncl =3D qdev_get_clocklist(dev, name); - Clock *clk =3D ncl->clock; + Clock *clk; + + if (!ncl) { + error_report("Can not find clock '%s' for device type '%s'", + name, object_get_typename(OBJECT(dev))); + abort(); + } + clk =3D ncl->clock; =20 ncl =3D qdev_init_clocklist(alias_dev, alias_name, true, ncl->output, = clk); =20 --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807533; cv=none; d=zohomail.com; s=zohoarc; b=YQ+4IS4pIJKgQldJbkmHLgJY9fQnQuUm/B557xVwQjMY2a0AvapsQaCRuPg1ylUnMgEHoN79TJD3DNxLRVVtSTQZJHPr+Z0c/bAXpc8/vCBRCuPWJX3qVGshMgxGDd7JptJOlh6KHc3NVEJjl2xvcE/fL/frNkCbBXa7PRjlo30= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807533; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=8vr3O7fbbeo9rTrqCUvOvXnH6ryzOWUR3V/ym5DGGXI=; b=i8VUmIIWsA9eYDU+jfypMfYvJbd6xvrV8294gkgTeeXnhGFg9chcVMBfR2L+/yDb5MIjOLb/Kwu19b/6xH77Mk4+YTQ62qDnlifaw3do/fHduGjQ9wDeNRzPWJ7PhKuqCF3V3YKllaWcEK+eS821lCvLdu2jBvZMt7X3FJ+vdCI= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 178380753375324.634694436264; Sat, 11 Jul 2026 15:05:33 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifp3-0004PW-Hk; Sat, 11 Jul 2026 18:05:23 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifov-0004GV-1F; Sat, 11 Jul 2026 18:05:13 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifot-0000Ob-3A; Sat, 11 Jul 2026 18:05:12 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 68B991C0AC4; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 1F5833EAF4F; Sun, 12 Jul 2026 00:59:51 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id C09D713355; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=lzzsv4m1zYxGpON0TV3+c+SD41VQNEXYLR39VzUql+c=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=hRx3mORz0aqPXwIR9IF9V3sEnfMywZekgryHf5UHx5U1Sd11O/ag4YScJI/VMQq74 cIfeKCv4zQ1Up7z1lRI+pSnKlCKRPN535Mwnsg7bV73/+drppUUobguuiu+iN9E1KZ nqt7W+MzKfbTA+JvXg+cXSnhbicXnXyBT4SfDHoKgi4HcKpQabGBZfxyU8dval3zUM n7JqN+0W6CWsjZMIf83+LrYgPD3lyxF2EqVIKnufAd8mBsnJW+QqrBmNg54k+qw/0q hy1A5BGueWgrW0QIwh11k7wYN/3rTd9nGgfz8clOejH+siVT5Hp5RhnftQuEX2hann 8arOQBxOsNKdQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Stefan Hajnoczi , Paolo Bonzini , Michael Tokarev Subject: [Stable-11.0.3 57/81] scsi: adjust error_prepend() formatting Date: Sun, 12 Jul 2026 00:58:35 +0300 Message-ID: <20260711215904.3757-57-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807535343154101 Content-Type: text/plain; charset="utf-8" From: Stefan Hajnoczi The error strings will be concatenated so add a separator to make the combined error message easy to read. Signed-off-by: Stefan Hajnoczi Link: https://lore.kernel.org/r/20260401171927.396672-2-stefanha@redhat.com Signed-off-by: Paolo Bonzini (cherry picked from commit 15c57ac351ccb4af625cd7dc582831f472c1a68f) Signed-off-by: Michael Tokarev diff --git a/hw/scsi/scsi-generic.c b/hw/scsi/scsi-generic.c index a2316a5266e..b55d0683238 100644 --- a/hw/scsi/scsi-generic.c +++ b/hw/scsi/scsi-generic.c @@ -439,7 +439,7 @@ static bool scsi_generic_pr_register(SCSIDevice *s, uin= t64_t key, Error **errp) ret =3D scsi_SG_IO(s->conf.blk, SG_DXFER_TO_DEV, cmd, sizeof(cmd), buf, sizeof(buf), s->io_timeout, errp); if (ret < 0) { - error_prepend(errp, "PERSISTENT RESERVE OUT with REGISTER"); + error_prepend(errp, "PERSISTENT RESERVE OUT with REGISTER: "); return false; } return true; @@ -463,7 +463,7 @@ static bool scsi_generic_pr_preempt(SCSIDevice *s, uint= 64_t key, ret =3D scsi_SG_IO(s->conf.blk, SG_DXFER_TO_DEV, cmd, sizeof(cmd), buf, sizeof(buf), s->io_timeout, errp); if (ret < 0) { - error_prepend(errp, "PERSISTENT RESERVE OUT with PREEMPT"); + error_prepend(errp, "PERSISTENT RESERVE OUT with PREEMPT: "); return false; } return true; --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807662; cv=none; d=zohomail.com; s=zohoarc; b=NM39nTuAd/spROtH+orU5osY4Jc0Ifq7j/mWZCtImv6QQo+CP47NinN75hyFz/L5+4rY735FYySI18rpxfzkLCV4G1gIuYaRb9TdxPwIvca1rlXcsx9f4sYMEXHg6q9Gk1Qd+Usse/9uOgHracyq47gyiR247TaJuywQQy7LySQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807662; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=INctWgXYEXTIHB/J6ogNofNk7vPl1ocq5/SJxelLHpA=; b=hP7c8mpeuNYkNoM4ZIP8HElYFBvTvpBvZ8iHxGAFIAT1IzB0iJ593ZSH8CNGyHFRtrUc2AUX6Fqeifr0QLwhudNeZEcbpydYWtzwCXGB1+6+CCu1pM3kjvblW9Jj1KYuBwuXvm8K3/4VwrsaO7Rlp1YBBoMrDHWjS/xMy8e8p4Q= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807662494543.5065077741057; Sat, 11 Jul 2026 15:07:42 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifpD-0004nV-AA; Sat, 11 Jul 2026 18:05:31 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifox-0004Lk-NJ; Sat, 11 Jul 2026 18:05:15 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifov-0000Oo-An; Sat, 11 Jul 2026 18:05:14 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 6D9CB1C0AC5; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 24BA33EAF50; Sun, 12 Jul 2026 00:59:51 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id C2F7713357; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=bCMVFGcS9pSFs0oWr3Jp9KED3QuIW9mi9PPpdkwK6MQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=pOWnKV697FTK7/i1BAYDxXQODzOf9MC2FKOl6+9cKdS2OQMMDzWZlVWkuVc30FFS+ vc9DpsBpadP/U4htZyLFu/a+tRQRyzPra6eRXooNvxyuDIq14RcdYeWeeR3daEpvfM LgV2OyVFtQug9LsZm9a9ulTofFm/vL+R/LYI0aMKLy18QsjSAC1chjAhxjmQRjocH0 P2OBvHIuU4ChI/x9nUfCPLVpH1PDh7F9k30fc8dC1eklJXcedc+r71k60ivYw+aRty 3qWyZ2TtanlolpjFxSqH4aR9TPI8PI75bcksxnFMcCnOi3kDJ8v27gxKDhRY+BqmYe +vSk9hye78Kdw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Stefan Hajnoczi , Qing Wang , Paolo Bonzini , Michael Tokarev Subject: [Stable-11.0.3 58/81] scsi: always send valid PREEMPT TYPE field Date: Sun, 12 Jul 2026 00:58:36 +0300 Message-ID: <20260711215904.3757-58-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807665235154100 Content-Type: text/plain; charset="utf-8" From: Stefan Hajnoczi The SPC-6 specification says that the PREEMPT service action ignores the TYPE field when there is no reservation. However, the LIO Linux iSCSI target rejects commands with a zero TYPE field. The field never ends up being used in this case, so replace it with a "valid" value to work around the issue. Reported-by: Qing Wang Buglink: https://redhat.atlassian.net/browse/RHEL-155807 Signed-off-by: Stefan Hajnoczi Link: https://lore.kernel.org/r/20260401171927.396672-3-stefanha@redhat.com Signed-off-by: Paolo Bonzini (cherry picked from commit 15a202656cd553911272f9666aa067c706fc3dfe) Signed-off-by: Michael Tokarev diff --git a/hw/scsi/scsi-generic.c b/hw/scsi/scsi-generic.c index b55d0683238..349dea6bddf 100644 --- a/hw/scsi/scsi-generic.c +++ b/hw/scsi/scsi-generic.c @@ -453,6 +453,16 @@ static bool scsi_generic_pr_preempt(SCSIDevice *s, uin= t64_t key, uint64_t key_be =3D cpu_to_be64(key); int ret; =20 + /* + * The LIO iSCSI target in Linux up to at least version 7.0 rejects PR= EEMPT + * commands with a zero TYPE field although the SPC-6 specification sa= ys + * the field should be ignored when there is no persistent reservation. + * Work around this by choosing an arbitrary valid PR type value. + */ + if (resv_type =3D=3D 0) { + resv_type =3D PR_TYPE_WRITE_EXCLUSIVE; + } + cmd[0] =3D PERSISTENT_RESERVE_OUT; cmd[1] =3D PRO_PREEMPT; cmd[2] =3D resv_type & 0xf; diff --git a/include/scsi/constants.h b/include/scsi/constants.h index cb97bdb6362..717e470a5d4 100644 --- a/include/scsi/constants.h +++ b/include/scsi/constants.h @@ -340,4 +340,14 @@ #define PRO_REGISTER_AND_MOVE 0x07 #define PRO_REPLACE_LOST_RESERVATION 0x08 =20 +/* + * Persistent reservation types + */ +#define PR_TYPE_WRITE_EXCLUSIVE 0x1 +#define PR_TYPE_EXCLUSIVE_ACCESS 0x3 +#define PR_TYPE_WRITE_EXCLUSIVE_REG_ONLY 0x5 +#define PR_TYPE_EXCLUSIVE_ACCESS_REG_ONLY 0x6 +#define PR_TYPE_WRITE_EXCLUSIVE_ALL_REGS 0x7 +#define PR_TYPE_EXCLUSIVE_ACCESS_ALL_REGS 0x8 + #endif --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807598; cv=none; d=zohomail.com; s=zohoarc; b=J44qisipe0rKUsAVwFHn8n8gqW6ijwmOsynjSLZFW1h7fmLPCMbNpVFqdTf9Sba4U2W2Jcqlb8F/5cAaIIbk93QNB34iLX6dH7WkVITmtMFABsyX08Ja+mbYkQKAktIfegmgxFcp7s+SrM8H0mLTiBnovBHH8ibAlABRFMT/kCs= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807598; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=tciy+6Ya9emOwCSxguSDyf9AOlFdUo9GiI211q1cvM4=; b=QlyJPeTkk4jVzfEXJb4uhn41MWOGpZZS+lg8jr8FTJXiugtZIfzMrxsjFPF17JeQhbLDdiyCuGQ3DkkLNOBPG0M9ZaiYmg8tz+vmLEBB3JIi0rlvKxk6jgsalPmZLdSaEvrXmv/fkIV0DXpSUrdrx2RCIAwvrbF+SyMLxTjXL9I= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807598328998.1044033136028; Sat, 11 Jul 2026 15:06:38 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifpB-0004eI-VA; Sat, 11 Jul 2026 18:05:30 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifoy-0004PS-5C; Sat, 11 Jul 2026 18:05:17 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifow-0000az-HI; Sat, 11 Jul 2026 18:05:15 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 7433E1C0AC6; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 2B1E73EAF51; Sun, 12 Jul 2026 00:59:51 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id C540013359; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=0wUaGL+SyRk9TslpNYgpAnx7XjUEd1F+xd6GutZPLCI=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=A2OHmoBIv8yLReZRU1GAR7tdHfYQjlsVfQ0Du6H+V0O5zSNwE2rkGN8ZLZIMF6xSI Ucw+mAULe2Gi+7/5xz+k2IP5iXCbyiRyiozTvVNtfPuxSGDjOrTmzi1pVgU81nIi6k Tvi1cjkdxK4Azcv3F2GLVDbnosQTYUDyR51trf7yeCpYL7OgJ67kWnboFdczrnCOFV DHt0vCc5Bsjlek1oKzrWEy2qiifkOaR3LZWPI9iuldWIGtR17Yh8sCU2etdnqSqTg8 2w6zDDZC+Cj8mUDFQC8Y1r+4eyWuxK59OD/7NWoaBLp/0LIRNh+lH9ZCOEiMvzZCMG jp6KLmTMTKc3Q== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Stefan Hajnoczi , Paolo Bonzini , Michael Tokarev Subject: [Stable-11.0.3 59/81] scsi: register again after PREEMPT without reservation Date: Sun, 12 Jul 2026 00:58:37 +0300 Message-ID: <20260711215904.3757-59-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807600298154100 Content-Type: text/plain; charset="utf-8" From: Stefan Hajnoczi The SCSI specification says PREEMPT without a reservation removes all registrations with the given key. Try to register again after PREEMPT since our key will have been removed. In practice some SCSI targets keep the calling I_T nexus' registration instead of removing it. Therefore we need to handle both the spec-compliant and the non-compliant behavior. Signed-off-by: Stefan Hajnoczi Reviewed-by: Paolo Bonzini Link: https://lore.kernel.org/r/20260401171927.396672-4-stefanha@redhat.com Signed-off-by: Paolo Bonzini (cherry picked from commit b9a3b329d09dea5a4692de483419693ef0e23052) Signed-off-by: Michael Tokarev diff --git a/hw/scsi/scsi-generic.c b/hw/scsi/scsi-generic.c index 349dea6bddf..5182f9236da 100644 --- a/hw/scsi/scsi-generic.c +++ b/hw/scsi/scsi-generic.c @@ -513,6 +513,16 @@ bool scsi_generic_pr_state_preempt(SCSIDevice *s, Erro= r **errp) if (!scsi_generic_pr_preempt(s, key, resv_type, errp)) { return false; } + + /* + * Some SCSI targets, like the Linux LIO target, remove our + * registration when preempting without a reservation (resv_type i= s 0). + * Try to register again but ignore the error since a RESERVATION + * CONFLICT is expected if our registration remained in place. + */ + if (resv_type =3D=3D 0) { + scsi_generic_pr_register(s, key, NULL); + } } return true; } --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807620; cv=none; d=zohomail.com; s=zohoarc; b=NkVSUBGCCa+smBChfkDuhJLfhBTE7rkCTCVFthIXI8lyi65QMngjSPhLp95qEBZ7TFiQYTHq/leCLfCf6bejnOXdACbNBAfK8vlcni7JUXibC+QOXnAlHXi/YJBXi/z8eVBOYRBsncP2sncTMEOSqQy3VOZ76AptAvq3ggEw6RE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807620; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=wpSl2NjZ4mHVzTVbSNfcy1AtHyrgue7mu3vcIlPIBCE=; b=N9cgUye4bGB7sDn37iwjC6jeWm9zaOVQlrDKAfxU3rAFumt2MJZaWBS6MlwnQaRVPmgSnyABNqvZUKZw9KNuuN/8tfLPCpQsmseLFj+zUwzMg14DIUd3O7+9yHSrE/l6JaVXX8Fzb8/DqdZi6nJWqCLArBpPEfBNWIQGk/F3Pg8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807620726503.05008940713844; Sat, 11 Jul 2026 15:07:00 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifpD-0004qY-OL; Sat, 11 Jul 2026 18:05:31 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifp0-0004Uj-QQ; Sat, 11 Jul 2026 18:05:19 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifoz-0000bP-3a; Sat, 11 Jul 2026 18:05:18 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 7A6BD1C0AC7; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 304313EAF52; Sun, 12 Jul 2026 00:59:51 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id C7A701335B; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=7HMKc60spAKEu7etDQ7jsCDcdQ3mD5HIQYRCuhKKk/o=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=fy2F2nTyQYpouQt0sVBVMPk6cZJSkR2L2o4ZzQcdijZqW1q9eT2d4d0uB8wuKbNTK sTqvHMucul+vGwOKyyvAOCrIAhrHSKorUaQmBGeKx1F/8NHdMkfwU8soh9cy2SNLia Tg+DuqoxyFDfBMxH8pokGmpDoAX0++G25itLMx2q8JicJffIYcdovHIbvRPw0rosiw PdzkXELCmtYZ82wPLwB2Nfzaz059Oh32xBW8VFaxckiEK5V042dWMlytbw4PpB0zlH EPxsy3ardp81wStcq/xJKhuTCECXEwwMVKnOo+KziTf1M1PuChp7oDsgP/VTXENi17 O+DUnnOhPsMuQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Sanjeeva Yerrapureddy , Akihiko Odaki , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-11.0.3 60/81] hw/net: fix e1000e/igb ip_len inflation by Ethernet minimum-frame padding Date: Sun, 12 Jul 2026 00:58:38 +0300 Message-ID: <20260711215904.3757-60-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807622989154100 From: Sanjeeva Yerrapureddy When a guest transmits a short Ethernet frame, iov_size() returns the padded wire length including any bytes added to reach the Ethernet minimum frame size of 60 bytes. net_tx_pkt_rebuild_payload() uses this inflated size as payload_len. net_tx_pkt_update_ip_hdr_checksum() then overwrites the IPv4 Total Length field with payload_len + l3_hdr_len, inflating it by the padding. The receiver interprets Ethernet padding as IP payload, producing a malformed packet. Fix by removing the ip_len write from net_tx_pkt_update_ip_hdr_checksum() so it only recomputes the checksum, and moving the ip_len assignment into net_tx_pkt_update_ip_checksums() where it is only performed for TSO (where ip_len must be derived from payload_len since the guest sets ip_len=3D0 per Intel 82574 datasheet =C2=A77.3.4 for super-packets the host will segment). Both e1000e and igb already call net_tx_pkt_update_ip_hdr_checksum() from their IXSM paths, so both are corrected by this single common- layer change. Signed-off-by: Sanjeeva Yerrapureddy Reivewed-by: Akihiko Odaki Reviewed-by: Philippe Mathieu-Daud=C3=A9 Message-ID: <20260629-net-tx-pkt-ip-length-padding-v5-1-16760e30252e@gmail.= com> Signed-off-by: Philippe Mathieu-Daud=C3=A9 (cherry picked from commit 9e41b5d22aeb942ad6ecc3174504ff645a10da6a) Signed-off-by: Michael Tokarev diff --git a/hw/net/net_tx_pkt.c b/hw/net/net_tx_pkt.c index 903238dca24..b134348fe80 100644 --- a/hw/net/net_tx_pkt.c +++ b/hw/net/net_tx_pkt.c @@ -93,9 +93,6 @@ void net_tx_pkt_update_ip_hdr_checksum(struct NetTxPkt *p= kt) uint16_t csum; assert(pkt); =20 - pkt->l3_hdr.ip.ip_len =3D cpu_to_be16(pkt->payload_len + - pkt->vec[NET_TX_PKT_L3HDR_FRAG].iov_len); - pkt->l3_hdr.ip.ip_sum =3D 0; csum =3D net_raw_checksum(pkt->l3_hdr.octets, pkt->vec[NET_TX_PKT_L3HDR_FRAG].iov_len); @@ -117,7 +114,9 @@ void net_tx_pkt_update_ip_checksums(struct NetTxPkt *pk= t) =20 if (gso_type =3D=3D VIRTIO_NET_HDR_GSO_TCPV4 || gso_type =3D=3D VIRTIO_NET_HDR_GSO_UDP) { - /* Calculate IP header checksum */ + /* Set ip_len and calculate IP header checksum */ + pkt->l3_hdr.ip.ip_len =3D cpu_to_be16(pkt->payload_len + + pkt->vec[NET_TX_PKT_L3HDR_FRAG].iov_len); net_tx_pkt_update_ip_hdr_checksum(pkt); =20 /* Calculate IP pseudo header checksum */ --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807604; cv=none; d=zohomail.com; s=zohoarc; b=ZTbiPEkhpqGh6h7ATtRCYJ18Ej1qfSy3S1PNhxG8qq54j19Aba+wlw+77Q57EIzFQsSstslDOXH3abuaZ5cKvRcqwX0j3EyT4msjWwIRYCOvgAhi9h0NjyFX7qVmIAmFQ3Py0sEWepWTg9kY+Qh4hb+zOQqjQEBLXqRNS9udhPs= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807604; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=Eziwdwu7QRc56Z7uJVLwkfYqhyZM+C5Un7HKZjzc1VE=; b=mjf6wuWw/lhJYCKv8/JoEkF7rn+0WPhmZ+nsYE2xHl6mxQvaGb3lsAlI6L89jXL1cqduv5RVmUWMxcQqgNAh6PabUs15bWa0loCVL2p0JvNXSSfJCJEicjvc2Y2uEqgcfegm7Dwq1MSzU8XnJVZcgCcIT5Bof/1NvnN86EQs4SQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807604108509.95468761016707; Sat, 11 Jul 2026 15:06:44 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifpN-0005nK-M9; Sat, 11 Jul 2026 18:05:41 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifpL-0005g5-Lo; Sat, 11 Jul 2026 18:05:39 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifpJ-0000bY-N1; Sat, 11 Jul 2026 18:05:39 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 808A91C0AC8; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 372D63EAF53; Sun, 12 Jul 2026 00:59:51 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id CA1C41335D; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=MI7uRsMIx7P0xMIvgrXGd6plvVl2HxCsSXwG5yiEXxo=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=uQoMULZdok9Zd2JP+I8WOhjrYdnxW2FkWqYcUh3Jitg20FYp0nO5tIpkz+0w9IRA8 uvM0NJnvTYGzKlsioEgWbchp3gbink0/wAxPWAA10/9Rt50OoYYK+DokkcrAq07myU m1cX5DQXEQQh4bchELVy5cI/as3f6C01MWmE59GKIgu819YKNd+2tXk/wU6Z8baGE5 9aX0P9zPWfF5LDmfzKHGgN8fZE0xjgTIy+KGL0pxnr1FuXd3gfE9WuVuOkjWRVtSsX jNNU8nJZNC7EAilhSQcfPE+P195YSjFb+tZkrIuYwnTLFeskuljKIv20mOQ6A0bNyw f4TejL7h2Bu5w== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Richard Henderson , =?UTF-8?q?Alex=20Benn=C3=A9e?= , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-11.0.3 61/81] accel/tcg: Use TLB_FORCE_SLOW not TLB_MMIO for user-only plugins Date: Sun, 12 Jul 2026 00:58:39 +0300 Message-ID: <20260711215904.3757-61-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807606463154100 From: Richard Henderson In 6d03226b422 we set TLB_MMIO to a non-zero value for user-only so that we could return a non-zero value from probe_* functions so that we could force callers like Arm SVE vector moves to use the slow path rather than direct access. All for the sake of exposing these accesses to plugins. Back then, TLB_FORCE_SLOW did not exist, so TLB_MMIO seemed like a reasonable solution. However, user-only doesn't really have MMIO and this has knock-on effects, like forcing Arm SVE first-fault vector loads to stop. Better to use TLB_FORCE_SLOW as a more exact trigger for plugins. Cc: qemu-stable@nongnu.org Fixes: 6d03226b422 ("plugins: force slow path when plugins instrument memor= y ops") Acked-by: Alex Benn=C3=A9e Reviewed-by: Philippe Mathieu-Daud=C3=A9 Signed-off-by: Richard Henderson Message-ID: <20260702171057.47998-1-richard.henderson@linaro.org> (cherry picked from commit b79a9b6e5b5657534615dd8e574d58305e16841c) Signed-off-by: Michael Tokarev diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c index d283d3cc724..dd0bcde4d49 100644 --- a/accel/tcg/user-exec.c +++ b/accel/tcg/user-exec.c @@ -768,7 +768,7 @@ static int probe_access_internal(CPUArchState *env, vad= dr addr, if (page_flags & acc_flag) { if (access_type !=3D MMU_INST_FETCH && cpu_plugin_mem_cbs_enabled(env_cpu(env))) { - return TLB_MMIO; + return TLB_FORCE_SLOW; } return 0; /* success */ } @@ -803,7 +803,7 @@ void *probe_access(CPUArchState *env, vaddr addr, int s= ize, =20 g_assert(-(addr | TARGET_PAGE_MASK) >=3D size); flags =3D probe_access_internal(env, addr, size, access_type, false, r= a); - g_assert((flags & ~TLB_MMIO) =3D=3D 0); + g_assert((flags & ~TLB_FORCE_SLOW) =3D=3D 0); =20 return size ? g2h_vaddr(env_cpu(env), addr) : NULL; } diff --git a/include/exec/tlb-flags.h b/include/exec/tlb-flags.h index 357e79095c9..e12cddf2345 100644 --- a/include/exec/tlb-flags.h +++ b/include/exec/tlb-flags.h @@ -27,12 +27,13 @@ =20 /* * Allow some level of source compatibility with softmmu. - * Invalid is set when the page does not have requested permissions. - * MMIO is set when we want the target helper to use the functional + * INVALID is set when the page does not have requested permissions. + * FORCE_SLOW is set when we want the target helper to use the functional * interface for load/store so that plugins see the access. */ #define TLB_INVALID_MASK (1 << 0) -#define TLB_MMIO (1 << 1) +#define TLB_FORCE_SLOW (1 << 1) +#define TLB_MMIO 0 #define TLB_WATCHPOINT 0 =20 #else --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807642; cv=none; d=zohomail.com; s=zohoarc; b=IVqCacCOb0ZU1kRFx1lgpdVMZe1qKWnueS0LQ2sS5RgZ40vf4rAoOecq7fTMGcdGuDrz6TR61u6ToJcB6DtHYu2w0E0yKPphjUj7drV5Agx195E7bnuOCyvEqD+H+X1nIT9mWg8oYJFhdhDC97yRh47LcxYYCG0a/GSOCKT3i7k= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807642; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=24dHDcnvOW1eT+040lT9B0WNpr5n5A2dzZ0aJX/p6WM=; b=bHDvaThjLwqMAguf9Q12geSg5Qusx65rj7nKkbz3nh+b/j8ZdOPUjgLnrbDXeP1SrnztFDhrkkod33Ao9kiq466CI49GDmLOHaUXUaZSg5DTzXRXznkH4krDkmCiAigOn8gaKDEbkC9jiW7GAUMI1NXBGy4f6dMb6AlI8LdhFIY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807642837308.6266122859886; Sat, 11 Jul 2026 15:07:22 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifpS-00062s-BI; Sat, 11 Jul 2026 18:05:46 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifpO-0005tT-DW; Sat, 11 Jul 2026 18:05:42 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifpM-0000c3-C0; Sat, 11 Jul 2026 18:05:42 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 854E01C0AC9; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 3C1013EAF54; Sun, 12 Jul 2026 00:59:51 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id CCC3F1335F; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=wTg+U40SNU3eeOy9WQM2Ylx2TLCzMkjokSZmIvnz2pg=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=iqx/w7YYxLcX8CmJx7TNrPE1nE4FkeOFe6tjspOSySD8ydkQRKcsmRKLvv2hccj9o mz+iFQz1TM0eDGSHvxH7lesqY8WmOoet4GZznqPeWjol6aj+4/g0XAUIk66/wlpHGT 6QJiLPOn7Cl/ztLw2IZOTdK3J5WFCX6DimZqEKv2HBZq5dZNCb6XalN2A2G4meFpNg WEG5TE01LY0gtjkywljwNmkCFJwkGOvKmvtVbYDYjsGrm3vP+iq4b5zCgvEJAxU09V DW72pQcoRcN78ld/Rgmk23pq0OJ7N2sp20ApIs2F+bJMu97gnM90qEpnYnenAUELRV 2kKgRyOw9G4Wg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Ilya Leoshkevich , Alex Crichton , Ulrich Weigand , Richard Henderson , Pierrick Bouvier , Michael Tokarev Subject: [Stable-11.0.3 62/81] accel/tcg: Make PageFlagsNodes' start and last immutable Date: Sun, 12 Jul 2026 00:58:40 +0300 Message-ID: <20260711215904.3757-62-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807645002154100 Content-Type: text/plain; charset="utf-8" From: Ilya Leoshkevich page_check_range() may race with pageflags_set_clear() as follows: T1 T2 ------------------------------------- -------------------------------- p =3D pageflags_find(start, last= ); interval_tree_remove(&p->itree, ...); p->itree.start =3D last + 1; if (start < p->itree.start) { ret =3D false; interval_tree_insert(&p->itree, ...); leading to errors like fail indirect write 0x72f0a659aff0 (Bad address) in vma-pthread test. I am able to reliably reproduce this on a machine with 32 SMT threads as follows in about 25 seconds: jobs=3D32; \ seq "$jobs" | \ time -p parallel \ --jobs=3D"$jobs" \ --halt=3Dnow,done=3D1 \ --ungroup \ ' _=3D{}; while ./qemu-s390x tests/tcg/s390x-linux-user/vma-pthread; = do printf .; done ' Also wasmtime project reported a similar failure pattern in their CI [1] with a similar reproducer [2]. There are other races like this. In general, region bounds mutating underneath the reader are very hard to reason about. So fix this by preventing mutations and creating copies instead. Use RCU guards in readers to avoid uses-after-frees. Now, when the reader finds a node, it may fearlessly access its fields and be certain that at some point in time the respective region had the respective bounds and permissions. The downside is slightly more expensive mprotect(), but complexity reduction is worth it. Lockless field accesses should probably be wrapped in qatomic_read(), but this is a pre-existing issue, so do not change it here. [1] https://github.com/bytecodealliance/wasmtime/issues/10000 [2] https://gist.github.com/alexcrichton/f14f23a892ffb9df2522754572d51b1c Cc: qemu-stable@nongnu.org Reported-by: Alex Crichton Reported-by: Ulrich Weigand Fixes: 67ff2186b0a4 ("accel/tcg: Use interval tree for user-only page track= ing") Signed-off-by: Ilya Leoshkevich Reviewed-by: Richard Henderson Reviewed-by: Pierrick Bouvier Signed-off-by: Richard Henderson Message-ID: <20260706165445.57418-2-iii@linux.ibm.com> (cherry picked from commit e03b7dac65d96d7d9b34bb88803029cf5ec7e4a9) Signed-off-by: Michael Tokarev diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c index dd0bcde4d49..7cd26a238d5 100644 --- a/accel/tcg/user-exec.c +++ b/accel/tcg/user-exec.c @@ -238,13 +238,16 @@ void page_dump(FILE *f) =20 int page_get_flags(vaddr address) { - PageFlagsNode *p =3D pageflags_find(address, address); + PageFlagsNode *p; + + RCU_READ_LOCK_GUARD(); =20 /* * See util/interval-tree.c re lockless lookups: no false positives but * there are false negatives. If we find nothing, retry with the mmap * lock acquired. */ + p =3D pageflags_find(address, address); if (p) { return p->flags; } @@ -300,15 +303,15 @@ static void pageflags_create_merge(vaddr start, vaddr= last, int flags) =20 if (prev) { if (next) { - prev->itree.last =3D next->itree.last; + pageflags_create(prev->itree.start, next->itree.last, flags); g_free_rcu(next, rcu); } else { - prev->itree.last =3D last; + pageflags_create(prev->itree.start, last, flags); } - interval_tree_insert(&prev->itree, &pageflags_root); + g_free_rcu(prev, rcu); } else if (next) { - next->itree.start =3D start; - interval_tree_insert(&next->itree, &pageflags_root); + pageflags_create(start, next->itree.last, flags); + g_free_rcu(next, rcu); } else { pageflags_create(start, last, flags); } @@ -370,8 +373,8 @@ static bool pageflags_set_clear(vaddr start, vaddr last, if (set_flags !=3D merge_flags) { if (p_start < start) { interval_tree_remove(&p->itree, &pageflags_root); - p->itree.last =3D start - 1; - interval_tree_insert(&p->itree, &pageflags_root); + pageflags_create(p_start, start - 1, p_flags); + g_free_rcu(p, rcu); =20 if (last < p_last) { if (merge_flags & PAGE_VALID) { @@ -393,11 +396,11 @@ static bool pageflags_set_clear(vaddr start, vaddr la= st, } if (last < p_last) { interval_tree_remove(&p->itree, &pageflags_root); - p->itree.start =3D last + 1; - interval_tree_insert(&p->itree, &pageflags_root); + pageflags_create(last + 1, p_last, p_flags); if (merge_flags & PAGE_VALID) { pageflags_create(start, last, merge_flags); } + g_free_rcu(p, rcu); } else { if (merge_flags & PAGE_VALID) { p->flags =3D merge_flags; @@ -418,8 +421,8 @@ static bool pageflags_set_clear(vaddr start, vaddr last, if (set_flags =3D=3D p_flags) { if (start < p_start) { interval_tree_remove(&p->itree, &pageflags_root); - p->itree.start =3D start; - interval_tree_insert(&p->itree, &pageflags_root); + pageflags_create(start, p_last, p_flags); + g_free_rcu(p, rcu); } if (p_last < last) { start =3D p_last + 1; @@ -431,8 +434,8 @@ static bool pageflags_set_clear(vaddr start, vaddr last, /* Maybe split out head and/or tail ranges with the original flags. */ interval_tree_remove(&p->itree, &pageflags_root); if (p_start < start) { - p->itree.last =3D start - 1; - interval_tree_insert(&p->itree, &pageflags_root); + pageflags_create(p_start, start - 1, p_flags); + g_free_rcu(p, rcu); =20 if (p_last < last) { goto restart; @@ -441,8 +444,8 @@ static bool pageflags_set_clear(vaddr start, vaddr last, pageflags_create(last + 1, p_last, p_flags); } } else if (last < p_last) { - p->itree.start =3D last + 1; - interval_tree_insert(&p->itree, &pageflags_root); + pageflags_create(last + 1, p_last, p_flags); + g_free_rcu(p, rcu); } else { g_free_rcu(p, rcu); goto restart; @@ -504,6 +507,8 @@ bool page_check_range(vaddr start, vaddr len, int flags) return false; /* wrap around */ } =20 + RCU_READ_LOCK_GUARD(); + locked =3D have_mmap_lock(); while (true) { PageFlagsNode *p =3D pageflags_find(start, last); --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807677; cv=none; d=zohomail.com; s=zohoarc; b=i7viLK95vQCHMi165unjNscayOjfT0W2zGFxmYDpyLQZp0WLJoZFxJm8yVeqlE+QJl5qHG4+4nACyiBdf1iihiemXicWzkYLvYNPg6KX5qRfiS6ehWQZZ065PfmCBnxH7Tyq7tdYlFjJ8yd8JluRZ3Id/GWtW9BdRqm1U+V9jrI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807677; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=4zHWL5BSpX4wsXJnbvSpQibqCa7bGzMzgY9+T1kyF5s=; b=DJTNhONuk6o76zqMcmIjJPYU7p83XyR3n1MmR06tU0DUy1y/LaMNdjm23m76uGKc09OGSQp1I5xC10KNuJap29SkQ3HxO/egMO3ZS7xbc4bVjMIxzSWnFyvGtYOrT1cleX0S7VLGX3/XFPsQad1O+9Qoqv3d5jSut2c1WD/2X1k= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807677684196.63417018383836; Sat, 11 Jul 2026 15:07:57 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifpT-00068g-Au; Sat, 11 Jul 2026 18:05:47 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifpP-0005wN-Oq; Sat, 11 Jul 2026 18:05:44 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifpN-0000gf-5y; Sat, 11 Jul 2026 18:05:43 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 8B0FA1C0ACA; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 41D873EAF55; Sun, 12 Jul 2026 00:59:51 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id CF28513361; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=QDxvu03qE1EQj7QawkvnyJPVhGJ67e1LXu/tDLkCcEM=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=gYo9tFTKgP7egS15Pp0CsaV93o84whpeNQNGklWHZsKXhbByE0yu/G7vrlSSeOnDC XMAYmjVUYaghkNgg+++OLlPTZTj1nOoJhOvwjnhtlWEequgQ96ftkSRtsFy0dT4pGn QYOI4l/zH0+3+z7rnnIgAli3NOr/EU0mzpOcKiK1IhYOHOgkLh/OZBSjnYMGQYj0pk Bk7sniLkPxwTbSIN1wtk+gyeuZ33BDwBrkEv3ao28axocLwS8o/dMhw3ErNs/9Qq8B /LkvzM447ZZqVT6MoNMkJSMGmnxMCgK2AzT/NNSw2AxXqm5a57jwf2abT+G45bv/bF 92Mz5LJwMElEg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Richard Henderson , Michael Tokarev Subject: [Stable-11.0.3 63/81] tcg/loongarch64: Fix cmp_vec with TCG_COND_NE Date: Sun, 12 Jul 2026 00:58:41 +0300 Message-ID: <20260711215904.3757-63-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807679433154100 Content-Type: text/plain; charset="utf-8" From: Richard Henderson For NE we need to invert EQ, not swap operands. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3589 Signed-off-by: Richard Henderson Message-ID: <20260623140609.645445-1-richard.henderson@linaro.org> (cherry picked from commit c56ebd64b82aa4d4a4e2144abbf9568ef593b836) Signed-off-by: Michael Tokarev diff --git a/tcg/loongarch64/tcg-target.c.inc b/tcg/loongarch64/tcg-target.= c.inc index c3350c90fc5..182dcfd5ebb 100644 --- a/tcg/loongarch64/tcg-target.c.inc +++ b/tcg/loongarch64/tcg-target.c.inc @@ -2371,19 +2371,36 @@ static void tcg_out_vec_op(TCGContext *s, TCGOpcode= opc, default: g_assert_not_reached(); } - break; - } - - insn =3D cmp_vec_insn[cond][lasx][vece]; - if (insn =3D=3D 0) { - TCGArg t; - t =3D a1, a1 =3D a2, a2 =3D t; - cond =3D tcg_swap_cond(cond); - insn =3D cmp_vec_insn[cond][lasx][vece]; - tcg_debug_assert(insn !=3D 0); + } else { + switch (cond) { + case TCG_COND_EQ: + case TCG_COND_LE: + case TCG_COND_LEU: + case TCG_COND_LT: + case TCG_COND_LTU: + insn =3D cmp_vec_insn[cond][lasx][vece]; + tcg_out32(s, encode_vdvjvk_insn(insn, a0, a1, a2)); + break; + case TCG_COND_GE: + case TCG_COND_GEU: + case TCG_COND_GT: + case TCG_COND_GTU: + insn =3D cmp_vec_insn[tcg_swap_cond(cond)][lasx][vece]; + tcg_out32(s, encode_vdvjvk_insn(insn, a0, a2, a1)); + break; + case TCG_COND_NE: + /* ne -> not(eq) */ + insn =3D cmp_vec_insn[TCG_COND_EQ][lasx][vece]; + tcg_out32(s, encode_vdvjvk_insn(insn, a0, a1, a2)); + insn =3D lasx ? OPC_XVNOR_V : OPC_VNOR_V; + tcg_out32(s, encode_vdvjvk_insn(insn, a0, a0, a0)); + break; + default: + g_assert_not_reached(); + } } } - goto vdvjvk; + break; case INDEX_op_add_vec: tcg_out_addsub_vec(s, lasx, vece, a0, a1, a2, const_args[2], true); break; --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807653; cv=none; d=zohomail.com; s=zohoarc; b=eY9nI8JY98bjzIBwRBEGrVe0dj8R2SwUznbLotl8+WVqZScZ23GEAum//3OXAKnex7I/wcxNPEcf3mCTTOp20Sgf1J2JNpdsRNx2LcJNbbE1s0mxQtrvx1kWKck1EHj7UiJUZyI4EIzQXhchBY2AG69auo99EtLbqyR8XugB1aY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807653; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=7cVH/Aofr/GFasnPrNejMQEyKvR4iX5POuNJXGJ8J4s=; b=nxvjJ2Mra5IigcfY4CoQSn+wX2Tb6F2Az8aPWOp6utmhlFFwnOp1/uCXjSl0h+h861dfIcNbCy9MqqKL4vnKC/hQ0vnc2gQkSOB/mPisljtpvo2T3sH3yHNxUz8Qu8a7i5po7hFDwWCE6RE6hroSrLclxG8nzkjpqScycUDkcgU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 178380765353413.138609725509014; Sat, 11 Jul 2026 15:07:33 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifpW-0006Sy-Bm; Sat, 11 Jul 2026 18:05:50 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifpR-00062y-UH; Sat, 11 Jul 2026 18:05:46 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifpP-0000h2-T4; Sat, 11 Jul 2026 18:05:45 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 90FEC1C0ACB; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 4788B3EAF56; Sun, 12 Jul 2026 00:59:51 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id D1B3713363; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=Qr/i8I8IBEHoW3K54fVf/nBkolXXzPDq4ww5nE4cG6g=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=FIwlp9q4GeyqAkNgaLJYqJXK7F7f60twtZxoPxY4k7JbX3Tznj4dslOvP/pqAJ0La l0mCmSpEwhuDxXxpd+L5QNL4S05TU67yUSlS6987Bt68pnvv0eGN1acn60D0rz2gXN 8fRlE1MPH/54hKuPxhw9KYqQ7ff98z2A1PjwSfKifgHNinEsM0ABpmAC7/llK2ojQW YSlkshuz+wP89UJTBe28m2OHF3/Q6/2iBoiAZkISHjjSw++3/q9mJdMT3NY6AQmL0N rFw0PQnp9QGU0I9cVSKm9QRLItmEiUYlIZqbzvVYQXROtI2F5PXeIevty0AbZnwiZ3 7LZKwfICbD6jA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Randy Schifflin , Yoshinori Sato , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-11.0.3 64/81] target/sh4: fixup tcg for sh4 fipr/ftrv instructions Date: Sun, 12 Jul 2026 00:58:42 +0300 Message-ID: <20260711215904.3757-64-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807655047154100 From: Randy Schifflin Fixes TCG generation for sh4 `fipr` and `ftrv` instructions. Updates the current logic for these instructions to check the FPSCR register appropriately (according to the sh4 cpu manual, `fipr` and `ftrv` are only defined when the FPSCR register PR flag is 0). Also fixes the mth/nth-vector operands by multiplying by 4 to convert to the correct floating point register offset. Signed-off-by: Randy Schifflin Reviewed-by: Yoshinori Sato Message-ID: <20260629-fixup-sh4-tcg-fpu-instructions-b4-v1-2-4356b305f971@g= mail.com> Signed-off-by: Philippe Mathieu-Daud=C3=A9 (cherry picked from commit 614a52cf549e6aefa656634b4d3fa0d4686125c6) Signed-off-by: Michael Tokarev diff --git a/target/sh4/op_helper.c b/target/sh4/op_helper.c index cf0f80e4a54..7f8b27eabee 100644 --- a/target/sh4/op_helper.c +++ b/target/sh4/op_helper.c @@ -487,7 +487,7 @@ void helper_ftrv(CPUSH4State *env, uint32_t n) float32 p; =20 bank_matrix =3D (env->sr & FPSCR_FR) ? 0 : 16; - bank_vector =3D (env->sr & FPSCR_FR) ? 16 : 0; + bank_vector =3D (env->sr & FPSCR_FR) ? 16 + n : n; set_float_exception_flags(0, &env->fp_status); for (i =3D 0 ; i < 4 ; i++) { r[i] =3D float32_zero; diff --git a/target/sh4/translate.c b/target/sh4/translate.c index b1057727c55..3f018611316 100644 --- a/target/sh4/translate.c +++ b/target/sh4/translate.c @@ -377,11 +377,6 @@ static inline void gen_store_fpr64(DisasContext *ctx, = TCGv_i64 t, int reg) goto do_illegal; \ } =20 -#define CHECK_FPSCR_PR_1 \ - if (!(ctx->tbflags & FPSCR_PR)) { \ - goto do_illegal; \ - } - #define CHECK_SH4A \ if (!(ctx->features & SH_FEATURE_SH4A)) { \ goto do_illegal; \ @@ -1740,22 +1735,22 @@ static void _decode_opc(DisasContext * ctx) return; case 0xf0ed: /* fipr FVm,FVn */ CHECK_FPU_ENABLED - CHECK_FPSCR_PR_1 + CHECK_FPSCR_PR_0 { - TCGv m =3D tcg_constant_i32((ctx->opcode >> 8) & 3); - TCGv n =3D tcg_constant_i32((ctx->opcode >> 10) & 3); + TCGv m =3D tcg_constant_i32(((ctx->opcode >> 8) & 3) << 2); + TCGv n =3D tcg_constant_i32(((ctx->opcode >> 10) & 3) << 2); gen_helper_fipr(tcg_env, m, n); return; } break; case 0xf0fd: /* ftrv XMTRX,FVn */ CHECK_FPU_ENABLED - CHECK_FPSCR_PR_1 + CHECK_FPSCR_PR_0 { if ((ctx->opcode & 0x0300) !=3D 0x0100) { goto do_illegal; } - TCGv n =3D tcg_constant_i32((ctx->opcode >> 10) & 3); + TCGv n =3D tcg_constant_i32(((ctx->opcode >> 10) & 3) << 2); gen_helper_ftrv(tcg_env, n); return; } --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807628; cv=none; d=zohomail.com; s=zohoarc; b=YSH8NkHT9Cj3RhuhQ8HreuP12KkGMIa1+yCGSEKjKcfHz9V43o8uXojNzOj7y1/cWqZ6tl9xrSLrCb2jvJ0umvkWZVweP0gRG/MVvyQlDaavaHFNq/a1TtQBRM+JteQmnwn4HLq6Do4HBBBPFoKNiEwIk0MyNSMqJDiedHK5I3w= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807628; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=jRDgqHMWsdfK2wM9wzGrjOQVsy+om+DLCzGF+B8lakc=; b=KPNF5596/PidZ3AsjPlOoGp5ihTsmjsG4Wczpb2dU9iae4UYoahkTmL664+Hp5WY61XxZLJmavJ2F/IR81dFWSVb2whRLBNd4zIL5hKK5wTSVsoZBr4g+ViTZJc4U5x38Mjl5ftMoX3XDVvpZ+EGF8nhhrZS0uO2H8KgEyxFD/U= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807628211803.1128685981249; Sat, 11 Jul 2026 15:07:08 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifpX-0006V1-Bw; Sat, 11 Jul 2026 18:05:51 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifpT-0006B1-4R; Sat, 11 Jul 2026 18:05:47 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifpR-0000hJ-9q; Sat, 11 Jul 2026 18:05:46 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 967CE1C0ACC; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 4D8C33EAF57; Sun, 12 Jul 2026 00:59:51 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id D437D13365; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=1sGmdcj+0zYCA1aoM3xC6DkpJdawlyEHwafMS29CB4o=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=P5qJmT8KkMOdWOa1gczwKm/tTPZpFwsBslCSnGVbU3xO1H5L9RpbuWDtVmKTG/0HE VtdFwjRvLm5ey/3OwoZxM5WEQ1oUyUekiyMLCA7GZvGd7pFioucLDAh/o31ni8QatF xMO+BGwWAuhcnk3IeNYidob7z0t5Ew0XeTE42cTqomgI6MdKxH6SjzzYxStbydpHF6 iWZ2f1OvQjoF1Qj0sTVfO0XGHzuY42zZf8JJOj5ygxlRBuxTNmK5Fq6U0lQaQx0ylA WOFvOyMg+NETdFe95wTgKgNEy8rc4WfzQ0yKQ99rNZimM7u6UWgC1XHCmYY7MeIK2L OrWWCZNMDOJSw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, yujun , =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , Michael Tokarev Subject: [Stable-11.0.3 65/81] crypto/x509-utils: fix gnutls error code in crt_init failure path Date: Sun, 12 Jul 2026 00:58:43 +0300 Message-ID: <20260711215904.3757-65-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807631190154100 From: yujun qcrypto_get_x509_cert_fingerprint() reports gnutls_strerror(ret) when gnutls_x509_crt_init() fails, but ret is still the initial value -1. Store the gnutls return code before formatting the error, matching other gnutls call sites in the tree. Fixes: 2183ab6251 ("crypto/x509-utils: Check for error from gnutls_x509_crt= _init()") Signed-off-by: yujun Reviewed-by: Daniel P. Berrang=C3=A9 Signed-off-by: Daniel P. Berrang=C3=A9 (cherry picked from commit 4952681a5fdc29dc74396756ab85f90ee15ea9bc) Signed-off-by: Michael Tokarev diff --git a/crypto/x509-utils.c b/crypto/x509-utils.c index 39bb6d4d8c3..1843488bca3 100644 --- a/crypto/x509-utils.c +++ b/crypto/x509-utils.c @@ -46,7 +46,8 @@ int qcrypto_get_x509_cert_fingerprint(uint8_t *cert, size= _t size, return -1; } =20 - if (gnutls_x509_crt_init(&crt) < 0) { + ret =3D gnutls_x509_crt_init(&crt); + if (ret < 0) { error_setg(errp, "Unable to initialize certificate: %s", gnutls_strerror(ret)); return -1; --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807766; cv=none; d=zohomail.com; s=zohoarc; b=FylsCXKRp1i1a1z2jGZndoZDqaItpLRe69hYOCxksshZtt0j/sCc4ggVpZfVNXMuS8IwJxMSVDtFOOd3kh2g8mUn57AkcRCjpS+KcE92Mcl9iY+t4DItbvArzJwK6nt+VYthN44Plo7ngbmztKY92XMaRfEz12Ztl9CyBkwB9Xc= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807766; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=Y2fOXmkG/yASPLCJfPKXkxSZaJDfSz9qioKKG7ltYlg=; b=dfUCLKj6pjO7fbGedASoziDLdQCjKbnlwbkhLXi0fiu2776ouZYxQNcBfPmWfLTrXTLkKq0nH1tkqDorhWogn91tP48qomzXlwcTw1Ew1jWTtdP5cZnCcAbQXA7324pOqdfrAFxLlwlsPxFuU7b4STL6cIcSihRysvtU+zReWm4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807766662299.6030641214429; Sat, 11 Jul 2026 15:09:26 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifpt-0008Sw-1O; Sat, 11 Jul 2026 18:06:13 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifpq-0008Af-9N; Sat, 11 Jul 2026 18:06:10 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifpn-0000hh-I9; Sat, 11 Jul 2026 18:06:09 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 9C1271C0ACD; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 538213EAF58; Sun, 12 Jul 2026 00:59:51 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id D6C8313367; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=OyyLouD3KzjMvGtRSL93d2KC9SpgmZJSaUXwj8zN9Qc=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Q9PMXdCSBiiYlQQ5nb7L37BBxBKjQUKtSZZ6lzHUTI0mTig6vXnwxya/uIZTCWNLX FXImsWfebK+oznKr5sF6OplrzzhOUf3cUTDt3/N1x/XF+kaI1fOGHPOXQFR7tC5jQK KsaiDggiZ3KrS++UFomegghZ+vduELwocLQJeyf5rR8iCRbJQ+h/+cVCZ5uVn0z4Pc 1Fncl0ZXHutvdpxQMFyLCsrAuGedvbqpUWf0kzuYyWDX7SB8zVTcCFXMj5JwKhPp8h sc1D1Dj8f48n0P4ytjarBH26z4g2vh3pX7stCp26h4jWF5xlF+jlvPh7+dK+kuBD8h yHSrLAeVP+xeA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Jia Jia , Jeuk Kim , Michael Tokarev Subject: [Stable-11.0.3 66/81] hw/ufs: avoid double unref of wrapped scsi-hd Date: Sun, 12 Jul 2026 00:58:44 +0300 Message-ID: <20260711215904.3757-66-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807768812154100 Content-Type: text/plain; charset="utf-8" From: Jia Jia ufs_init_scsi_device() creates an internal scsi-hd and adds it as a child of lu->bus. qdev_realize_and_unref() then drops the construction reference, leaving the bus child ownership to tear it down. ufs_lu_unrealize() still unrefs lu->scsi_dev directly. If the UFS controller is ejected through ACPI PCI hotplug, the scsi-hd object can be finalized there and then the bus child removal RCU callback later unrefs the same object again. Keep lu->scsi_dev as a borrowed pointer and clear it during unrealize without unreffing it. Add a qtest that ejects the UFS controller through the x86 ACPI PCI hotplug eject register. On an ASAN build, the test reproduces the UAF before the fix. Fixes: 096434fea13a ("hw/ufs: Modify lu.c to share codes with SCSI subsyste= m") Cc: qemu-stable@nongnu.org Signed-off-by: Jia Jia Signed-off-by: Jeuk Kim (cherry picked from commit 90aacd5bc405cb71f77472616093f9e5ad9afd2b) (Mjt: tests/qtest/ufs-test.c: context fixup) Signed-off-by: Michael Tokarev diff --git a/hw/ufs/lu.c b/hw/ufs/lu.c index 709d6adcf68..ebaf979313e 100644 --- a/hw/ufs/lu.c +++ b/hw/ufs/lu.c @@ -416,10 +416,7 @@ static void ufs_lu_unrealize(DeviceState *dev) { UfsLu *lu =3D DO_UPCAST(UfsLu, qdev, dev); =20 - if (lu->scsi_dev) { - object_unref(OBJECT(lu->scsi_dev)); - lu->scsi_dev =3D NULL; - } + lu->scsi_dev =3D NULL; } =20 static void ufs_lu_class_init(ObjectClass *oc, const void *data) diff --git a/tests/qtest/ufs-test.c b/tests/qtest/ufs-test.c index 7f999441552..564202e5849 100644 --- a/tests/qtest/ufs-test.c +++ b/tests/qtest/ufs-test.c @@ -34,6 +34,8 @@ #define TEST_QID 0 #define QUEUE_SIZE 32 #define UFS_MCQ_MAX_QNUM 32 +#define ACPI_PCIHP_ADDR 0xae00 +#define PCI_EJ_BASE 0x0008 =20 typedef struct QUfs QUfs; =20 @@ -635,6 +637,17 @@ static void ufstest_reg_read(void *obj, void *data, QG= uestAllocator *alloc) qpci_iounmap(&ufs->dev, ufs->bar); } =20 +static void ufstest_acpi_eject(void *obj, void *data, QGuestAllocator *all= oc) +{ + QUfs *ufs =3D obj; + QTestState *qts =3D ufs->dev.bus->qts; + + qtest_outl(qts, ACPI_PCIHP_ADDR + PCI_EJ_BASE, 1 << 4); + qtest_qmp_assert_success(qts, "{ 'execute': 'query-status' }"); + g_usleep(3 * G_USEC_PER_SEC); + qtest_qmp_assert_success(qts, "{ 'execute': 'query-status' }"); +} + static void ufstest_init(void *obj, void *data, QGuestAllocator *alloc) { QUfs *ufs =3D obj; @@ -1234,6 +1247,8 @@ static void ufs_register_nodes(void) .edge.extra_device_opts =3D "mcq=3Dtrue,mcq-maxq=3D1" }; =20 + QOSGraphTestOptions acpi_eject_test_opts =3D { .subprocess =3D true }; + add_qpci_address(&edge_opts, &(QPCIAddress){ .devfn =3D QPCI_DEVFN(4, = 0) }); =20 qos_node_create_driver("ufs", ufs_create); @@ -1251,6 +1266,10 @@ static void ufs_register_nodes(void) g_test_message("Skipping ufs io tests for ppc64"); return; } + if (!strcmp(arch, "i386") || !strcmp(arch, "x86_64")) { + qos_add_test("acpi-eject", "ufs", ufstest_acpi_eject, + &acpi_eject_test_opts); + } qos_add_test("init", "ufs", ufstest_init, NULL); qos_add_test("legacy-read-write", "ufs", ufstest_read_write, &io_test_= opts); qos_add_test("mcq-read-write", "ufs", ufstest_read_write, &mcq_test_op= ts); --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807772; cv=none; d=zohomail.com; s=zohoarc; b=gGQ5W4Cpxty2j3VOqHunh9Dyz1jYZSTY5usKMyHiW8MQU2Vwrm8Ybl+wDivdFb3YzlmzUZIjTjSMWpixhTaWulZD3g245iCmIjkyHR2+SEY9dWagQuxFgFr51xer+nHFUDolEqDW/DSfi75URVJJZ7d4ZEv4ACi/0hlnBwFs4oA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807772; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=hs7elHQxWK72GSLbuIcpbXowCKqzEcmtakgn2CbwADE=; b=Ee80R3dZo+yoJmOOd2QrTjsrUneZtvp3RzfBN8Z4VdLLU1ep3hOHOUAoVQDP3R4kvjYwshEsthcWqNZ9NzLkRPQ0w1o8w0ig9QAPVn1USgHyEbpFqEvKgcv2plRhGF1t20iDvWbUOtVpHXHr91xBpTKzxE0qDxBs+79BtnYYarc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807772697929.562781526397; Sat, 11 Jul 2026 15:09:32 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifps-0008PC-HR; Sat, 11 Jul 2026 18:06:12 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifpq-0008Dd-M0; Sat, 11 Jul 2026 18:06:10 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifpo-0000hx-Km; Sat, 11 Jul 2026 18:06:10 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id A27A31C0ACE; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 596943EAF59; Sun, 12 Jul 2026 00:59:51 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id D969213369; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=B7KsRGNyVEEYDlbiHI4fiED6oJQOw9Errnr9ooRgBG0=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=B70TzBkR2R80Xrl310rZ57fbsJPgoLn0pAuCzG5a6G/kAV+xzL2ypBZ02qWwLPYRP ZCrX3EQ5YrbEtbsjPJAGB8p+eM4AWt6prgdacmfEyjtCXeyeVix/A7zwHTVVHPJwlK we1xr2C4QYrVc07TDL1X+IS3094FZirwf6MTgzH8UBsVMLbg0mJ2Fh4Hw1BTTjzGiS S06gGS0E+69UjukRgh6Ujna3IU3iTblHkizAfz7U0D0ff0sdEK/D7VjoXM+lbEUJhS pGR4o66Okvrc4U9aGedcwhX3sT1OLsxpNRlcjrFqR0YdIg319JaWXObZKVe52p44yX z5689m/20QwzQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Daniel Henrique Barboza , Alistair Francis , Michael Tokarev Subject: [Stable-11.0.3 67/81] hw/riscv/riscv-iommu.c: fix fault type for spa_fetch() faults Date: Sun, 12 Jul 2026 00:58:45 +0300 Message-ID: <20260711215904.3757-67-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807774823154100 Content-Type: text/plain; charset="utf-8" From: Daniel Henrique Barboza Under certain circunstances, like the one described in [1] and [2], a read operation that faults will be logged as a write fault instead, and vice-versa, if they happen after the translation phase in riscv_iommu_spa_fetch(). The first problem is that we're overwriting iotlb->perm with PTE flags, so an IOMMU_RO access flag can be overwritten by whatever flags the PTE has. This will cause the wrong fault type to be thrown at the end of the function in case a fault happens. To solve the iotlb->perm overwrite we'll bit_and the original iotlb->perm access flags with the PTE access flags, preserving the original access type. So a IOMMU_RO access in a R+W PTE will result in a IOMMU_RO perm. Second, the resulting fault is received by riscv_iommu_translate(), which will then report the fault. To do that we require a transaction type (ttype). We're prioritizing checking "perm & IOMMU_RW" to set a UADDR_WR ttype, and then checking "perm & IOMMU_RO" to set UADDR_RD ttype. The issue with that is IOMMU_RO=3D1 and IOMMU_RW=3D3, thus checking "perm & IOMMU_RW" for a write then "perm & IOMMU_RO" for a read will cause the read fault to always be diagnosed as write. Make the iotlb->perm matches more strict: "perm & IOMMU_RW" must be exactly IOMMU_RW, ensuring that 'perm' has both flags. Then we can check perm & IOMMU_WO and perm & IOMMU_RO without worrying about overlapping with the RW flag. [1] https://gitlab.com/qemu-project/qemu/-/work_items/3557 [2] https://gitlab.com/qemu-project/qemu/-/work_items/3577 Fixes: 69a9ae4836 ("hw/riscv/riscv-iommu: add ATS support") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3557 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3577 Signed-off-by: Daniel Henrique Barboza Acked-by: Alistair Francis Message-ID: <20260701124034.552271-1-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis (cherry picked from commit b18e3f0e2d0f301952ff3ae4cb73d0e9eb4ee697) Signed-off-by: Michael Tokarev diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c index b2e2ee486e9..b16a53294dd 100644 --- a/hw/riscv/riscv-iommu.c +++ b/hw/riscv/riscv-iommu.c @@ -272,6 +272,7 @@ static hwaddr riscv_iommu_napot_page_mask(hwaddr ppn, h= waddr addr, hwaddr *out) static int riscv_iommu_spa_fetch(RISCVIOMMUState *s, RISCVIOMMUContext *ct= x, IOMMUTLBEntry *iotlb) { + IOMMUAccessFlags pte_perm; dma_addr_t addr, base; uint64_t satp, gatp, pte; bool en_s, en_g; @@ -499,8 +500,16 @@ static int riscv_iommu_spa_fetch(RISCVIOMMUState *s, R= ISCVIOMMUContext *ctx, } /* Translation phase completed (GPA or SPA) */ iotlb->translated_addr =3D base; - iotlb->perm =3D (pte & PTE_W) ? ((pte & PTE_R) ? IOMMU_RW : IO= MMU_WO) - : IOMMU_RO; + + /* + * Do a bit_and between the PTE bits and the original + * request flags to determine the exact permission we + * need, i.e. if the original request is RO and the + * PTE has RW flags the actual perm is RO. + */ + pte_perm =3D (pte & PTE_W) ? ((pte & PTE_R) ? IOMMU_RW : IOMMU= _WO) + : IOMMU_RO; + iotlb->perm &=3D pte_perm; =20 /* Check MSI GPA address match */ if (pass =3D=3D S_STAGE && (iotlb->perm & IOMMU_WO) && @@ -1682,7 +1691,8 @@ done: if (fault) { unsigned ttype =3D RISCV_IOMMU_FQ_TTYPE_PCIE_ATS_REQ; =20 - if (iotlb->perm & IOMMU_RW) { + if ((iotlb->perm & IOMMU_RW) =3D=3D IOMMU_RW + || iotlb->perm & IOMMU_WO) { ttype =3D RISCV_IOMMU_FQ_TTYPE_UADDR_WR; } else if (iotlb->perm & IOMMU_RO) { ttype =3D RISCV_IOMMU_FQ_TTYPE_UADDR_RD; --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807631; cv=none; d=zohomail.com; s=zohoarc; b=Fphwy7NOQ4o0ik6u8moYDKPvvEBdNVEXiaZVTRjWdSMRMhb5O6ZPheDE9D5pv4jrWHzLY6noxaJE8u/pz0VFMpEZ1QppKA8g+BW3PXYpyPG9DhplGce2JTqpC5Y3ruEfDbbomHU9q4MrJfgDR17cIX9kCHg53SuJtdlNQkHW3ZY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807631; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=Xdj1XTPwpPOOUjsvxbRkpeQ8cukRfN+ITNad+GSjflc=; b=RDCZmaJdVOEWruJZ0KLMzscj9QKbebakczC28DwqkS7kzUAY1aPt56D3V5HR90RIELir/vtqdmvG9k6tMz0NaP+mPLeEf4J+didhuFRIw/uI4B+8tZe47OMRhq0tT7Q0sJjtDYiMdNQ3Bi2D+dDUg5xElbd4ORX19x/x10Mx4+A= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807631006886.8672729991815; Sat, 11 Jul 2026 15:07:11 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifpv-0000GE-NB; Sat, 11 Jul 2026 18:06:15 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifpt-00005P-JF; Sat, 11 Jul 2026 18:06:13 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifpr-0000kw-PI; Sat, 11 Jul 2026 18:06:13 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id A83121C0ACF; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 5F6273EAF5A; Sun, 12 Jul 2026 00:59:51 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id DC1341336B; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=iC7Llk0MXkN1E0EbY/KQjeVTicc0xpZ714SRsRLQ1X0=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=WT9lbRISMlpGalH4R/ZSwvLxVnDgNcLt9SMBe5cicEzjXnJqr4x55ZWwWDIcLONbi EcFPKi0ImV15R4XV4gX2PHkogdv3Q59Zt98TeWkVsYA7NdbQMZ/B2y0Q8hMXQTQNOO rbi2KTg/HoSysHblj6prYA468tsrljzyij1fgnir7sEbZJHMusmEsnruF2s2peAT1a dQOooTxAg9E7CYgJ/eRjHqHBRzxY72UMveJ5+vT8EMBwKLEMO3AT/DBlsAi9Ner3fW WNcYlfHvFbtUaSJ1Tvuio973F6P1F2UzP2Nkeuf3d5CVtD5z/bdbi2ztXrvC9EKsRP H1knIC4zZd+dQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Daniel Henrique Barboza , Nutty Liu , Chao Liu , Alistair Francis , Michael Tokarev Subject: [Stable-11.0.3 68/81] hw/riscv/riscv-iommu.c: check for reserved PTE bits Date: Sun, 12 Jul 2026 00:58:46 +0300 Message-ID: <20260711215904.3757-68-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807632752154100 Content-Type: text/plain; charset="utf-8" From: Daniel Henrique Barboza We need to fault if reserved PTE bits (60:54) are set. Fixes: 0c54acb8243d ("hw/riscv: add RISC-V IOMMU base emulation") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3554 Signed-off-by: Daniel Henrique Barboza Reviewed-by: Nutty Liu Reviewed-by: Chao Liu Message-ID: <20260701121111.537654-2-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis (cherry picked from commit c1d5ec3a2f4bbc9fdc120ba5697e8ad89e682e45) Signed-off-by: Michael Tokarev diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c index b16a53294dd..8e86e9150cc 100644 --- a/hw/riscv/riscv-iommu.c +++ b/hw/riscv/riscv-iommu.c @@ -459,6 +459,8 @@ static int riscv_iommu_spa_fetch(RISCVIOMMUState *s, RI= SCVIOMMUContext *ctx, =20 if (!(pte & PTE_V)) { break; /* Invalid PTE */ + } else if (pte & PTE_RESERVED(false)) { + break; /* Reserved PTE bits set */ } else if (!(pte & (PTE_R | PTE_W | PTE_X))) { base =3D PPN_PHYS(ppn); /* Inner PTE, continue walking */ } else if ((pte & (PTE_R | PTE_W | PTE_X)) =3D=3D PTE_W) { --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807609; cv=none; d=zohomail.com; s=zohoarc; b=EW1Uve2Y7GiG+wpuEQY05hZAe6rob6VvoCtY4pE3dKs4gf6JbxF3BuS6dJcnNQMaJ1bMsFZUH9SSLTPVlkeuqBNxpuxl+KV/Sp34YxAfioCHrcaTTyh+A3iZmyi5CfAvLqG9f10zOe65Q6mFmiNfGORiiIFFltynnIPbqc2ibTU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807609; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=srLHMiytzHPydvqTxOL6Zu4kdQgzY/q4U3ia5ZT0v7U=; b=f1qmQCJ616mWJC5N3zt+Zkn3jd4YJQJd94zdmPbYTkIuJzBOcBX/Fq2yHZUZOwtKmTMHQJL9EYl07EZ6mpt5Bsk7Y5OOERca3nx82mP8zsdowSfzsWneua6jtNcZ4QYA0p2QzzbBvlPt76UsPbluryUJR+vyxe3PvThC3HPTF5Q= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807609561988.6766340240266; Sat, 11 Jul 2026 15:06:49 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifpw-0000LA-T5; Sat, 11 Jul 2026 18:06:17 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifpt-00007d-Vj; Sat, 11 Jul 2026 18:06:14 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifps-0000l6-5v; Sat, 11 Jul 2026 18:06:13 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id B121C1C0AD0; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 6893D3EAF5B; Sun, 12 Jul 2026 00:59:51 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id DEAFC1336D; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=PIjGoZxGK9PyFlLzxsQlfXOKSZkQMgPlbyXy9RaZ+44=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=O98fOe2DOVlSaYKfhWT87dq8L3epb9ZJGdQ2ZhlPCAKKqWzMJ7P5p6rHlSkYZhai+ kCfTW0FPZA7JmgImvYPochafMPQJaHUJGIJsB1a4oSjjtXCSN5zHhkIYwNsEtk91Ml x/83+lYoM5CtqZpQpVqa/CSV3OrJ0oLSetPijXT0gCNm31v7y8zfrM/tUDLBgK3XNm BUfrLYtx2D7Po7Yj/OEirjQOgGkZZoFcH/gElsLldDysWp08WdtavavMwsAVEa8Gmz qWp8cQI92uDEq+5qFmfgjQCr+urn+oRSLyLo0Yce1EpG59GXUpoEX2XHVa8PTpoopr bXw0itZgntlqQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Daniel Henrique Barboza , Nutty Liu , Chao Liu , Alistair Francis , Michael Tokarev Subject: [Stable-11.0.3 69/81] hw/riscv/riscv-iommu.c: fault when !PTE_U and no priv access Date: Sun, 12 Jul 2026 00:58:47 +0300 Message-ID: <20260711215904.3757-69-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807610394154100 Content-Type: text/plain; charset="utf-8" From: Daniel Henrique Barboza All IOMMU accesses are assumed to be user mode unless told otherwise, i.e. we have a process_id. In case we have a non-user mode leaf PTE (PTE_U isn't set) and we are running in user mode, we need to throw a fault. This also reflects on qos-riscv-iommu tests: the tests always run in user mode so our PTEs must have PTE_U (bit 0x10) set. Fixes: 0c54acb8243d ("hw/riscv: add RISC-V IOMMU base emulation") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3553 Signed-off-by: Daniel Henrique Barboza Reviewed-by: Nutty Liu Reviewed-by: Chao Liu Message-ID: <20260701121111.537654-3-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis (cherry picked from commit b795ea0ba4715182805994db0cdabd2650a553a7) Signed-off-by: Michael Tokarev diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c index 8e86e9150cc..021176e3df8 100644 --- a/hw/riscv/riscv-iommu.c +++ b/hw/riscv/riscv-iommu.c @@ -288,6 +288,7 @@ static int riscv_iommu_spa_fetch(RISCVIOMMUState *s, RI= SCVIOMMUContext *ctx, G_STAGE =3D 1, } pass; MemTxResult ret; + bool pv =3D !!ctx->process_id; =20 satp =3D get_field(ctx->satp, RISCV_IOMMU_ATP_MODE_FIELD); gatp =3D get_field(ctx->gatp, RISCV_IOMMU_ATP_MODE_FIELD); @@ -461,6 +462,13 @@ static int riscv_iommu_spa_fetch(RISCVIOMMUState *s, R= ISCVIOMMUContext *ctx, break; /* Invalid PTE */ } else if (pte & PTE_RESERVED(false)) { break; /* Reserved PTE bits set */ + } else if (!(pte & PTE_U) && !pv) { + /* + * All accesses are assumed to be User mode unless + * process_id is valid (pv). In case we have a + * non-user mode PTE and !pv we need to fault. + */ + break; } else if (!(pte & (PTE_R | PTE_W | PTE_X))) { base =3D PPN_PHYS(ppn); /* Inner PTE, continue walking */ } else if ((pte & (PTE_R | PTE_W | PTE_X)) =3D=3D PTE_W) { diff --git a/tests/qtest/libqos/qos-riscv-iommu.h b/tests/qtest/libqos/qos-= riscv-iommu.h index 90e69a5d731..c218e9d66db 100644 --- a/tests/qtest/libqos/qos-riscv-iommu.h +++ b/tests/qtest/libqos/qos-riscv-iommu.h @@ -54,8 +54,8 @@ * PTE masks for RISC-V IOMMU page tables. * Values match PTE_V, PTE_R, PTE_W, PTE_A, PTE_D in target/riscv/cpu_bits= .h */ -#define QRIOMMU_NON_LEAF_PTE_MASK 0x001 /* PTE_V */ -#define QRIOMMU_LEAF_PTE_RW_MASK 0x0c7 /* V|R|W|A|D */ +#define QRIOMMU_NON_LEAF_PTE_MASK 0x011 /* PTE_V | PTE_U */ +#define QRIOMMU_LEAF_PTE_RW_MASK 0x0d7 /* V | R | W | A | D | PTE_U */ #define QRIOMMU_PTE_PPN_MASK 0x003ffffffffffc00ull =20 /* Address-space base offset for test tables */ --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807619; cv=none; d=zohomail.com; s=zohoarc; b=PRwT15PuNyn9cLbv5bRae31HRtNPaAOvkABiR5a9O8Unvj6WnapD70FJp8Fuot544bUb+rrJbya9t3PTuFI+CkE29b1Ab5bYbIw3Zh5YwTwEkGwvShjQd7mgHHNlRT+pLVlNyqxQPbOPUJN3x8zN2olHjZagPScAfA045p7wbBo= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807619; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=Rb/vKflYg/Nt3JMqnVdpCVvAJo+q95Tvyl6ozVH/ySE=; b=Mt1Sy/0rEli+7YzM2jW6qjRvln+XsK3IcVDuu2/EYU/bP8ArIoVv2MwbyYly+iEfaUOQVqITap2ktf+WjeANE4cPDrAVNX0tbKWSUOjxOcSs/yh/7Fn15nXE0Zh3i2YTTjUHAP6kFuUuDvFpeZYKOipBj+nZsJLbWNzJvrQfMME= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 178380761957338.70523599097908; Sat, 11 Jul 2026 15:06:59 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifpz-0000fE-Ey; Sat, 11 Jul 2026 18:06:19 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifpx-0000SY-FC; Sat, 11 Jul 2026 18:06:17 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifpv-0000lb-6I; Sat, 11 Jul 2026 18:06:17 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id B6A481C0AD1; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 6D8623EAF5C; Sun, 12 Jul 2026 00:59:51 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id E11D51336F; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=bFTSxvj/BEC3qyBYYqlDYHhMcfEv9LEOigum8Z0mjow=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=B7/2Lx8ogJFNOQuNbZAsPvHOsJt08tT7LXjB0bLcSX9iH72US8/sVCMcwinhB/9Ow up1OFVjTDB8y8OxYmcHYQZreFgK4DjzHkpIE2TdastMGpcXla3EiGXqAjIohEix7vz PLPLYxjqMooBB9RUVKOvu2iz8OxZah9/TM0kaLAWz+ioDO8whlKVL/Dnw7gpPouy1u R4B5XX//9yDoHaGQ/Zjga7HVD2CHbbqrCw6l/MllXhcCkcne/RTfNWlTpKM4KNqRap 1ZKel3oosEGizspekWlfQYsSNkcWzDzNFtSJK/OL/MWomEgUZu43Njj1NvC3MP5Uxi WkF0knD9ScR0Q== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Daniel Henrique Barboza , Alistair Francis , Michael Tokarev Subject: [Stable-11.0.3 70/81] hw/riscv/riscv-iommu.c: fault for non-user PTE in G_STAGE Date: Sun, 12 Jul 2026 00:58:48 +0300 Message-ID: <20260711215904.3757-70-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807620551154100 Content-Type: text/plain; charset="utf-8" From: Daniel Henrique Barboza riscv-iommu spec 1.0 says: "When checking the U bit in a second-stage PTE, the transaction is treated as not requesting supervisor privilege." We need to *always* fault in case we're on G_STAGE and PTE_U is cleared since we can't be on supervisor mode at this point. Fixes: 0c54acb8243d ("hw/riscv: add RISC-V IOMMU base emulation") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3555 Signed-off-by: Daniel Henrique Barboza Message-ID: <20260701121111.537654-4-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis (cherry picked from commit 9158c900ab308cbb8a70edcc7358efab7b34730e) Signed-off-by: Michael Tokarev diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c index 021176e3df8..2b150d0918f 100644 --- a/hw/riscv/riscv-iommu.c +++ b/hw/riscv/riscv-iommu.c @@ -485,6 +485,16 @@ static int riscv_iommu_spa_fetch(RISCVIOMMUState *s, R= ISCVIOMMUContext *ctx, break; /* Access bit not set */ } else if ((iotlb->perm & IOMMU_WO) && !ade && !(pte & PTE_D)) { break; /* Dirty bit not set */ + } else if (pass =3D=3D G_STAGE && !(pte & PTE_U)) { + /* + * riscv-iommu spec 1.0: "When checking the U bit in a + * second-stage PTE, the transaction is treated as + * not requesting supervisor privilege." + * + * I.e. we need to fault if this is a non-user PTE since + * we are always in user mode at this point. + */ + break; } else { /* Leaf PTE, translation completed. */ sc[pass].step =3D sc[pass].levels; --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807721; cv=none; d=zohomail.com; s=zohoarc; b=avIR7bBdcd8rBfT0yAGs4Y+YW44mIMdpTeEPwtyOcaCPamgkbAUt/GgGKsp6Tbzuhab4hlwMqfR4TGHPu63RFpypBL3L4pipLnX0qUd+3b4sfuNLcV0lYLJsxuOwD85H8bhZzC2v/r4iedZqZ9tUopS86UcREw21WoBeIvEIMK0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807721; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=getXlw/Op79BcuYaTiKT/j6ykFYc0Pl++mT40G5q8AE=; b=jeVqEV6a6EyS9jnVdIxZLLV9DlXqHWzx1fA2brpbH9zTzX1uiLXhRUUeg329hSoC94dIWwbGcfUrp3YumrROdmjAiEDcT0k0u7YZ4GG4aswFvpDhZ+BCwGeQOhF374FyyzvGvwltkw8m/VP1MjSa4IGGFbFmgsirMGJ0ZItK7J8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807721460116.81259180768927; Sat, 11 Jul 2026 15:08:41 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifqJ-0001mo-7H; Sat, 11 Jul 2026 18:06:39 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifqH-0001a6-E8; Sat, 11 Jul 2026 18:06:37 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifqF-0000lj-Gy; Sat, 11 Jul 2026 18:06:37 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id BE0A41C0AD2; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 740323EAF5D; Sun, 12 Jul 2026 00:59:51 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id E3A3B13371; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=6zeMMvgmr1LqG7+TAFOiIBHYQoGC1Z+uX80Ucjkuuts=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=qbrQlxRhw4JCuwNaFZnnutDD9mz0BfMOrli6sOLaP05CgZQdurWL9J29LW/u3MLbC B3j8HRizuWVZ7hys7mahQCu8tZKHJ1O9W8Ga38KmLwNPb7JbiY9cWJiJY8h7kUg3uN ifpyk6n3Dn7Fc+/rR9PXyaiZ1EuAsuu+IFgJerwPmRXkRNpChXdYQeXi01KLGKNord kRVV/dowAQEEBaNVppmkDXyDa8yZLvbZUdFuHk255mDjv5aBa5rEmjR1F6sAGjwNJ8 DoxZpvdqPwMg6ZK+WlmOAZC+/cpbgtBJfE/KDU8GKKUd2tPqCzRHbkxpE9Kw92Kb7Z wvY4MIBocALFw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Daniel Henrique Barboza , Nutty Liu , Alistair Francis , Michael Tokarev Subject: [Stable-11.0.3 71/81] hw/riscv/riscv-iommu.c: check reserved MSI PTE basic bits Date: Sun, 12 Jul 2026 00:58:49 +0300 Message-ID: <20260711215904.3757-71-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807722099154100 Content-Type: text/plain; charset="utf-8" From: Daniel Henrique Barboza We need to throw an MSI_MISCONFIGURED error when any of the reserved PTE bits (first doubleword only) are set. Fixes: Fixes: 0c54acb8243d ("hw/riscv: add RISC-V IOMMU base emulation") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3563 Signed-off-by: Daniel Henrique Barboza Reviewed-by: Nutty Liu Message-ID: <20260629125719.679626-1-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis (cherry picked from commit 11486349ad9b8858d3f45a540fd48b7a15b2b61d) Signed-off-by: Michael Tokarev diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c index 2b150d0918f..4330b2257d4 100644 --- a/hw/riscv/riscv-iommu.c +++ b/hw/riscv/riscv-iommu.c @@ -667,6 +667,27 @@ static MemTxResult riscv_iommu_msi_write(RISCVIOMMUSta= te *s, =20 switch (get_field(pte[0], RISCV_IOMMU_MSI_PTE_M)) { case RISCV_IOMMU_MSI_PTE_M_BASIC: + /* + * riscv-iommu spec MSI PTE basic translate mode: + * "When an MSI PTE has fields V =3D 1, C =3D 0, and M =3D 3 + * (basic translate mode), the PTE's complete format is: + * First doubleword: bit 63 C, =3D 0 + * bits 53:10 PPN + * bits 2:1 M, =3D 3 + * bit 0 V, =3D 1 + * All other bits of the first doubleword are reserved + * and must be set to zeros by software. The second + * doubleword is ignored by an IOMMU so is free for + * software to use." + * + * In other words, bits 62:54 and 9:3 of pte[0] are reserved. + */ + if (pte[0] & (GENMASK_ULL(62, 54) | GENMASK_ULL(9, 3))) { + res =3D MEMTX_DECODE_ERROR; + cause =3D RISCV_IOMMU_FQ_CAUSE_MSI_MISCONFIGURED; + goto err; + } + /* MSI Pass-through mode */ addr =3D PPN_PHYS(get_field(pte[0], RISCV_IOMMU_MSI_PTE_PPN)); =20 --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807664; cv=none; d=zohomail.com; s=zohoarc; b=BzsBGAb5ucIs+qV7eCVzNweMagnGgNOuU1RmqrJpu9pcrOTQML2IumGZU0kk1wFI1CFGhrq4xCXm+iGZUZJ/e3yZUNUzeEKtL8VdJoQtAqzzAQpEdSkg6NsQQ8p8X+XadVMlCoPbfrLOuuz2/ZBW+jEFo6ng0ZPq0g2dJYGrIR8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807664; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=ZbVH8lXsEn2P0xBk7imHNhiQurc72DvxJeSM0ytKXwE=; b=c48e1bSpZAUcrWJJZXqQ5AB6uJcQInu0wQ1isF4dtLoN93h/OQVU7rLgm0hsZY63sxukZ3JXS7oofyrPVazsK0tb6i2POCLobTOpeaIPIzqCa/T4/QNiQEMQKvEnl1AHBh1fAo7Od0flJdQPegimYChAM8a/rkBczj3RxZPnVSk= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807664039925.2557524204497; Sat, 11 Jul 2026 15:07:44 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifqM-0002Ft-Ab; Sat, 11 Jul 2026 18:06:42 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifqL-00028r-2Z; Sat, 11 Jul 2026 18:06:41 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifqI-0000mh-Uj; Sat, 11 Jul 2026 18:06:40 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id C339D1C0AD3; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 7A7363EAF5E; Sun, 12 Jul 2026 00:59:51 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id E63DE13373; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=3Q6ZXG+BDAb7zFboOJ/J/8u/UJ71/GcqvySrUBpfbA8=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=cwxFX+AoL6vtcQVeqjHUomm+ZkYPakS5uJximYe3nfVn9kbc5VkcSJ+YsCMktSBh3 R/fLT2IRhINyPv4dKySyL3/6p2+cZ9l90mQGUXqc76DU9kYGVjdHuCCIygHuZAkLkX 69WUr0ag9EVSg49DUb40wf7oe4hW7ojmSDl8OKO4fUkBFfg28Ujl2lG79p22VBkMz8 Yz4uX6irWQtNdVJyIzxfyvO/+RpZHbP831a1wIPZxtWRid+bfRC7UwjXZu15Eze0nK W5dPXh7UFc6wwIgZFUXFcXhXZxehZJA/5JMhpER3dimxN7n9R3rH4PLoFQ/j3l2xZH MgqPdJHHVfIOg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Daniel Henrique Barboza , Nutty Liu , Alistair Francis , Michael Tokarev Subject: [Stable-11.0.3 72/81] hw/riscv/riscv-iommu-sys.c: record fault on IOMMU-generated MSI write Date: Sun, 12 Jul 2026 00:58:50 +0300 Message-ID: <20260711215904.3757-72-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807665249154100 Content-Type: text/plain; charset="utf-8" From: Daniel Henrique Barboza The riscv-iommu spec requires that the IOMMU records its own generated MSI write faults. Fixes: 01c1caa9d1 ("hw/riscv/virt.c, riscv-iommu-sys.c: add MSIx support") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3572 Signed-off-by: Daniel Henrique Barboza Reviewed-by: Nutty Liu Message-ID: <20260629165954.1018123-1-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis (cherry picked from commit 58e801f74e6a4ebd3a0cf3ab1a96e1676b263efd) Signed-off-by: Michael Tokarev diff --git a/hw/riscv/riscv-iommu-sys.c b/hw/riscv/riscv-iommu-sys.c index bf87b0b4ea3..3314adeed23 100644 --- a/hw/riscv/riscv-iommu-sys.c +++ b/hw/riscv/riscv-iommu-sys.c @@ -26,6 +26,7 @@ #include "qemu/host-utils.h" #include "qemu/module.h" #include "qom/object.h" +#include "target/riscv/cpu_bits.h" #include "trace.h" =20 #include "riscv-iommu.h" @@ -143,7 +144,20 @@ static void riscv_iommu_sysdev_send_MSI(RISCVIOMMUStat= eSys *s, =20 address_space_stl_le(&address_space_memory, msi_addr, msi_data, MEMTXATTRS_UNSPECIFIED, &result); - trace_riscv_iommu_sys_msi_sent(vector, msi_addr, msi_data, result); + + if (result =3D=3D MEMTX_OK) { + trace_riscv_iommu_sys_msi_sent(vector, msi_addr, msi_data, result); + } else { + /* Record an access fault error in the fault queue */ + struct riscv_iommu_fq_record ev =3D { 0 }; + RISCVIOMMUState *iommu =3D &s->iommu; + + ev.hdr =3D set_field(ev.hdr, RISCV_IOMMU_FQ_HDR_CAUSE, + RISCV_IOMMU_FQ_CAUSE_MSI_WR_FAULT); + ev.hdr =3D set_field(ev.hdr, RISCV_IOMMU_FQ_HDR_TTYPE, + RISCV_IOMMU_FQ_TTYPE_UADDR_WR); + riscv_iommu_fault(iommu, &ev); + } } =20 static void riscv_iommu_sysdev_notify(RISCVIOMMUState *iommu, diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c index 4330b2257d4..3f0392c2528 100644 --- a/hw/riscv/riscv-iommu.c +++ b/hw/riscv/riscv-iommu.c @@ -108,8 +108,7 @@ void riscv_iommu_notify(RISCVIOMMUState *s, int vec_typ= e) } } =20 -static void riscv_iommu_fault(RISCVIOMMUState *s, - struct riscv_iommu_fq_record *ev) +void riscv_iommu_fault(RISCVIOMMUState *s, struct riscv_iommu_fq_record *e= v) { uint32_t ctrl =3D riscv_iommu_reg_get32(s, RISCV_IOMMU_REG_FQCSR); uint32_t head =3D riscv_iommu_reg_get32(s, RISCV_IOMMU_REG_FQH) & s->f= q_mask; diff --git a/hw/riscv/riscv-iommu.h b/hw/riscv/riscv-iommu.h index 2a9f6fccd52..7a1523e9fd8 100644 --- a/hw/riscv/riscv-iommu.h +++ b/hw/riscv/riscv-iommu.h @@ -99,6 +99,7 @@ void riscv_iommu_pci_setup_iommu(RISCVIOMMUState *iommu, = PCIBus *bus, void riscv_iommu_set_cap_igs(RISCVIOMMUState *s, riscv_iommu_igs_mode mode= ); void riscv_iommu_reset(RISCVIOMMUState *s); void riscv_iommu_notify(RISCVIOMMUState *s, int vec_type); +void riscv_iommu_fault(RISCVIOMMUState *s, struct riscv_iommu_fq_record *e= v); =20 typedef struct RISCVIOMMUContext RISCVIOMMUContext; /* Device translation context state. */ --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807665; cv=none; d=zohomail.com; s=zohoarc; b=eqktqmza+zCz43H+eS4/IASWBF5DrI5m4YK6vpLbec7kHHnYAymlGfx8BDjNaRZLYiuGeU3qG3AdkNJ8Hk1M1lmYSI5HnpXTyBdX4Jj7KnUNfKkAvKOnN+VP22+pZJwhoY+HtxNEXZP3FkbfGMMH0pqOGU0v7WCaSs3YKk1XZb4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807665; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=JzownXtv/zeIU/6qDw2KGtabVad6KPqf+kv/iz3/M5s=; b=gdMZ7ZtXzZwWxWbBaui0QCm1tqzw+GvcvxV2dAh+M2lIh5INFj5wIyOKoh7TOL21OudaEE+DgcbGHb8BBdeXu7x6a4Aqq5IZlBxgPJsZQZmUbuGTVKs12CGR506+CJ0y4mej0XqQ8EtcTmn5AO9n0UBMwuHjKFi/tZorEbVsdYE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807665624471.03558477920683; Sat, 11 Jul 2026 15:07:45 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifqN-0002Tq-Qu; Sat, 11 Jul 2026 18:06:44 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifqL-00028B-9p; Sat, 11 Jul 2026 18:06:41 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifqI-0000pc-Tq; Sat, 11 Jul 2026 18:06:40 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id C8C581C0AD4; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 801CD3EAF5F; Sun, 12 Jul 2026 00:59:51 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id E8C0413375; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=gp1Ggtg5EqdOijSgwF0DQzKz56Xr32EOtA+zOkzXAGQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=AaM4o2zTzCzbxLXzr10zHiJVbClMV0K4JcC0s4yci2MIXX6ZoJH+lmmvZVfGQH2KD g8zQ3NWlHQlUyV8AmpJNHWljLWu1E4Jo0N5S+/5rQJi0ioDZm8etn0yuUfKwCxvPT4 4W/kh47k6bBMFjzNiw+YTBS5WIooMEp++L+748k2bLkfgedF89XluwHGe0J/z/MywD joTICXeQYRxaKVGBYiCxtTMlREjGfjoRcRb2Ds1eVmPbvNaStMhRqNweLHCBnAUOFB o3Q0Z5MWSENZe7hgzYOuxvKBUGcbaPwPEfQpXmMmCLVvGL1zLlPjumYiNqiwI8Kvlf DjbasQtIFbIQg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Daniel Henrique Barboza , Chao Liu , Nutty Liu , Alistair Francis , Michael Tokarev Subject: [Stable-11.0.3 73/81] hw/riscv/riscv-iommu.c: check for misaligned IOHGATP_PPN Date: Sun, 12 Jul 2026 00:58:51 +0300 Message-ID: <20260711215904.3757-73-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807667182154100 Content-Type: text/plain; charset="utf-8" From: Daniel Henrique Barboza We must check if IOHGATP_PPN is 16kb aligned for non-bare GATP modes. Fixes: 69a9ae4836 ("hw/riscv/riscv-iommu: add ATS support") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3550 Signed-off-by: Daniel Henrique Barboza Reviewed-by: Chao Liu Reviewed-by: Nutty Liu Message-ID: <20260702203616.1795588-2-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis (cherry picked from commit bf274c54295c81aeda3835e2e0bc971f0bd57f47) Signed-off-by: Michael Tokarev diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c index 3f0392c2528..e9e204109a9 100644 --- a/hw/riscv/riscv-iommu.c +++ b/hw/riscv/riscv-iommu.c @@ -829,6 +829,21 @@ static bool riscv_iommu_validate_device_ctx(RISCVIOMMU= State *s, return false; } =20 + if (gatp !=3D RISCV_IOMMU_DC_IOHGATP_MODE_BARE) { + uint64_t iohgatp_ppn =3D get_field(ctx->gatp, + RISCV_IOMMU_DC_IOHGATP_PPN); + + /* + * One of the conditions for a misconfigured DDT entry + * according to the riscv-spec: "DC.iohgatp.MODE is not + * Bare and the root page table (address) determined by + * DC.iohgatp.PPN is not aligned to a 16-KiB boundary." + */ + if (PPN_PHYS(iohgatp_ppn) & ((1ULL << 14) - 1)) { + return false; + } + } + fsc_mode =3D get_field(ctx->satp, RISCV_IOMMU_DC_FSC_MODE); =20 if (ctx->tc & RISCV_IOMMU_DC_TC_PDTV) { --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807713; cv=none; d=zohomail.com; s=zohoarc; b=SRImF5G9UxLpiLVT49JNmwolK7g0gej0ntqwZxmj9lmZn/21GgKahOWaoajh6BXqPMiOGTKxirF9Fk/GrADb/D30Gm6CcmARr+Tx+t4hHLKGJ5e3uV3jOJG1u9/ZiL//kuxAWFwJc5Q7g5eaJ7UGNXLly64Uosk14rYfrXj5q7s= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807713; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=qGogKM2yddQ33lURwJPiorVLb30XwyWVg0tsSas98fk=; b=CuOR9P6nUVEo6wS4Ydyboe1Fjwjrkcml2OoyhqlsRQbjYUVMKJ1jumJSzidBWC+rYiXTkkIo5wM5pHtwSDHaepCwE59BiEDi6YnwLOkAmv9m5uylSt+ap9xvN6+/O3eW9Awn3xQ6tVWj8ebQsxesWu2Hip7FTSH54SMpQS/pofo= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807713498968.7561755570023; Sat, 11 Jul 2026 15:08:33 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifqR-000390-Ii; Sat, 11 Jul 2026 18:06:47 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifqO-0002dc-EB; Sat, 11 Jul 2026 18:06:44 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifqM-0000q0-Cv; Sat, 11 Jul 2026 18:06:44 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id CD8ED1C0AD5; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 855C03EAF60; Sun, 12 Jul 2026 00:59:51 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id EB37D13377; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=HBi9jncrm7xDI+ntRKe1yiWaWP4PWrOp6AA6sTByA40=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=pZQZSBwIKj/E5XUuaSNLHQXcZHRjbNo/WY3MQ8lY14z3R3iOGgcGRuSHALj5lCd/c dgPNxM1pXSvgg4+zkoq711OGs342vjQIh6pBbauh9ea3BwBk5LZhTtRIvL4KkbTeE4 bmTLx2y/zxLbM3/YSUzbU4N6rxHErUd9EFgXdtvwYFXp2yKcuGKtwbHKgjJANe9+nn aKql+ebCMOw4EmIHtjVHKfut+gtsOWASEZJqYKQ1aG+TBks0mHm7YpRJKmoEnl+KvL /UfB2kHfuzR+jmSrIZwTUgmMm9ct7Xd09pc/046ko456LWeHEzgQo0laSGHBYxgjnB HD28aODLN5JDA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Daniel Henrique Barboza , Alistair Francis , Michael Tokarev Subject: [Stable-11.0.3 74/81] hw/riscv/riscv-iommu.c: update ioval2 when faulting in spa_fetch() Date: Sun, 12 Jul 2026 00:58:52 +0300 Message-ID: <20260711215904.3757-74-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807716634154100 Content-Type: text/plain; charset="utf-8" From: Daniel Henrique Barboza riscv_iommu_translate(), the only caller of riscv_iommu_spa_fetch(), will use riscv_iommu_report_fault() for all faults it detects. And it will use iotlb->translated_addr as 'iotval2' every time. At this moment we're updating iotlb->translated_addr only after a translation step is completed, meaning any fault that occur before that will have a zeroed iotlb->translated_addr, and as a result iotval2 will also be zero later on. Keep iotlb->translated_addr updated with the latest translated addr we have. Fixes: 0c54acb8243d ("hw/riscv: add RISC-V IOMMU base emulation") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3559 Signed-off-by: Daniel Henrique Barboza Acked-by: Alistair Francis Message-ID: <20260702171202.1322493-1-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis (cherry picked from commit 79616dd6e499c4eed0af534872f3ff0e3c133c04) Signed-off-by: Michael Tokarev diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c index e9e204109a9..37d50968e52 100644 --- a/hw/riscv/riscv-iommu.c +++ b/hw/riscv/riscv-iommu.c @@ -564,6 +564,14 @@ static int riscv_iommu_spa_fetch(RISCVIOMMUState *s, R= ISCVIOMMUContext *ctx, } } while (1); =20 + /* + * riscv_iommu_translate() will receive a fault and then call + * riscv_iommu_report_fault() using iotlb->translated_addr + * as iotval2. Update translated_addr it with the latest + * translated addr we have. + */ + iotlb->translated_addr =3D addr; + return (iotlb->perm & IOMMU_WO) ? (pass ? RISCV_IOMMU_FQ_CAUSE_WR_FAULT_VS : RISCV_IOMMU_FQ_CAUSE_WR_FAULT_S) : --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807691; cv=none; d=zohomail.com; s=zohoarc; b=DkqJ+1EHXC2+sy9MfdD9uG2n6JEU/gwq7PbGE8Q+6elQCKpfLucQeGGxjOad/kOhpBlYN3cpt3FLM3o2jRwFFcDV0g2Uf7jWdqLqeOMf4LQdSTN9xhkSuyltUzrCgCFaIpByKJMJmMcGwCGvfOLMU37LeJL2QH6rtqjDbr2MkaQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807691; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=2YQUAxyX1PkSKHZncVKuG4pXPvfpzz6efgCP5BOGHio=; b=mOWBNlMHjanBq3wj43sc6Z+ZMZJldXa28gMY6mUNGJr1vYe9nVWz/UcGq0U2wkgNjHhYAcwFnffhvDwPL+1SCGDcS+JJN3+uitqYsALO8N7UWP/ttNJRriYZ79QVTHOAqz7YP8nOGycIu55CRHRl1lPhcOX12kkFAgld61nAlhg= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807691806397.26812951015086; Sat, 11 Jul 2026 15:08:11 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifql-0006Gl-Tj; Sat, 11 Jul 2026 18:07:08 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifqj-000633-T6; Sat, 11 Jul 2026 18:07:06 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifqg-0000q3-JI; Sat, 11 Jul 2026 18:07:05 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id D3E321C0AD6; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 8A1D53EAF61; Sun, 12 Jul 2026 00:59:51 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id EDA7413379; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=Z6hNah6jkunQm9TNzNK1O2VT0XM5uDFJDc+XN0Y9pVM=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=douDR5tpLiEQ2kHKdRmuir1hQUjZy6UFj8/tW2zHY34hYhuqHw4zhLHoPjYRtaquX Theqs/M7kzm5XG4uS7Qca9KiwMYnElaeGRQqXtLrH98X7iMaosDxhfYK1/+AWi9/VE Mq5XvidcKJZ7wQjh3h0Dw7jhxnJsJSGp5rFu556RY7T6+x1g+rMxXySy2ZJaBxYQv7 vf36G9xuRsUeeqO8mUj8bhxks2O58EscFpL1r0w5Bk7dzVu+7aTsVJOghzYku8nDnX WpZs9j5694xKjMCqNwOzcMZtHMTsFGo7Si3vMyld/FVKbOfgYpsZMC3Lvm/lZg5TJm raFFJI0vvOn3Q== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Daniel Henrique Barboza , Nutty Liu , Alistair Francis , Michael Tokarev Subject: [Stable-11.0.3 75/81] hw/riscv/riscv-iommu: forbid GATE/SADE if caps.AMO_HWADD is zero Date: Sun, 12 Jul 2026 00:58:53 +0300 Message-ID: <20260711215904.3757-75-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807693663154100 Content-Type: text/plain; charset="utf-8" From: Daniel Henrique Barboza When capabilities.AMO_HWADD isn't set, DC.tc.GADE and DC.tc.SADE are reserved bits and setting them throws a DDT_MISCONFIGURED error. Fixes: 0c54acb8243d ("hw/riscv: add RISC-V IOMMU base emulation") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3549 Signed-off-by: Daniel Henrique Barboza Reviewed-by: Nutty Liu Message-ID: <20260630172110.1866951-1-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis (cherry picked from commit 6d2b9d542fe2cec17eec71bdb33e45bee8805105) Signed-off-by: Michael Tokarev diff --git a/hw/riscv/riscv-iommu-bits.h b/hw/riscv/riscv-iommu-bits.h index 47fe01bee58..28b956daed0 100644 --- a/hw/riscv/riscv-iommu-bits.h +++ b/hw/riscv/riscv-iommu-bits.h @@ -86,6 +86,7 @@ struct riscv_iommu_pq_record { #define RISCV_IOMMU_CAP_SV57X4 BIT_ULL(19) #define RISCV_IOMMU_CAP_MSI_FLAT BIT_ULL(22) #define RISCV_IOMMU_CAP_MSI_MRIF BIT_ULL(23) +#define RISCV_IOMMU_CAP_AMO_HWAD BIT_ULL(24) #define RISCV_IOMMU_CAP_ATS BIT_ULL(25) #define RISCV_IOMMU_CAP_T2GPA BIT_ULL(26) #define RISCV_IOMMU_CAP_IGS GENMASK_ULL(29, 28) diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c index 37d50968e52..c66db608717 100644 --- a/hw/riscv/riscv-iommu.c +++ b/hw/riscv/riscv-iommu.c @@ -407,6 +407,11 @@ static int riscv_iommu_spa_fetch(RISCVIOMMUState *s, R= ISCVIOMMUContext *ctx, const bool ade =3D ctx->tc & (pass ? RISCV_IOMMU_DC_TC_GADE : RISCV_IOMMU_DC_TC_S= ADE); =20 + if (ade && !(s->cap & RISCV_IOMMU_CAP_AMO_HWAD)) { + /* GADE/SADE are reserved bits if AMO_HWAD is cleared. */ + return RISCV_IOMMU_FQ_CAUSE_DDT_MISCONFIGURED; + } + /* Address range check before first level lookup */ if (!sc[pass].step) { const uint64_t va_len =3D va_skip + va_bits; --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807668; cv=none; d=zohomail.com; s=zohoarc; b=Gw3yIDbIUmaT3x4IdlYC3Owx8zq0Xwx4vKhEEfD3zdbZv9Twzoh/mm5wHNaelM+WMpthUMOwtvQL3ngtmcmtfKP8cGbTadbH5PqJpYIE5ul7ZvfwlqfGkn4Hlec55XNBozRNRJXn5upU+oqbO/YhS9AFiEdOSxCK8V07OHLdGtY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807668; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=Z7DfpqvcZCDSw+wAr3AF2JRRC33ztfIm8ErsjFttTqc=; b=QXLPWzUlRauGVE8/n01+fJZiLHxYyJiZspHSSkktp95Z+n9UEUi6mAi5atls3NjRO4+fg5EaYL95QSQKcP4mhAD+lHuwmVB35RdDubPI1T85wGQMuQMXQHtnV0Wky+dTxFgEOFovh7hZ+Mfg4TjjQs/nunQunGzS40AnvJjk+bg= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807668220896.8815367690164; Sat, 11 Jul 2026 15:07:48 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifqn-0006Wo-Jk; Sat, 11 Jul 2026 18:07:09 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifql-0006KU-Tg; Sat, 11 Jul 2026 18:07:07 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifqj-0000qe-T4; Sat, 11 Jul 2026 18:07:07 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id DBE9F1C0AD7; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 91C853EAF62; Sun, 12 Jul 2026 00:59:51 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id F026F1337B; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=dUGT9Ei0IIzGwSUz6+VkyYZglstX4IXv8EFaDTY72BM=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=aLVRikzV4V5L8DDUprOMPujczjpihGouBx5JMYBi/x5p/tCGwgfd3hPRqDxZ+4lKl C8vSBRqXLLx3lUIxfm4odrmZlhJb46PPDouHrt7Efq+fJeF/1N5zb5WuxGJqmTEWUu eckoiw0+3r4BGjr/JFQlu1YRQvDeXXsbwskaxWwG6G6EENnr97Aop1Dfy62kuPJkoX Ewt05WnsR+56MmO91ufTlHODI6wX6ToySzKgKZixGlh4jWzbTd7am9T8m8dUMIBUAc MBS+5UT0QUNZEHJMQeXRLuM2hcF/p4xDt2Nx5PiAJbxziUfFmuOA+tEGL94iv1FTXM fKNZAVd07rrxw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Chengbo Gao , Daniel Henrique Barboza , Alistair Francis , Michael Tokarev Subject: [Stable-11.0.3 76/81] hw/riscv/riscv-iommu: Avoid caching PCI device IDs Date: Sun, 12 Jul 2026 00:58:54 +0300 Message-ID: <20260711215904.3757-76-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807671592154100 Content-Type: text/plain; charset="utf-8" From: Chengbo Gao PCI bus numbers may still be unassigned when QEMU initializes a PCI device's bus-master address space. For devices behind bridges, pci_bus_num() can return 0 at that point because the guest has not yet programmed the bridge Secondary Bus Number register. The RISC-V IOMMU currently stores a fixed device_id in RISCVIOMMUSpace when the address space is created. If the guest later enumerates the device on a non-zero bus, DMA translation still uses the stale device_id and may look up the wrong device context in the DDT. Store the stable PCIBus pointer and devfn in RISCVIOMMUSpace instead, and compute the device_id from the current bus number when it is needed. This keeps DMA translation and ATS invalidation in sync with guest PCI bus enumeration. Signed-off-by: Chengbo Gao Reviewed-by: Daniel Henrique Barboza Message-ID: <20260514020637.2819308-1-gaochengbo@bosc.ac.cn> Signed-off-by: Alistair Francis (cherry picked from commit ca7bac51e04fa1ad384963577fabd3a58355ae23) Signed-off-by: Michael Tokarev diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c index c66db608717..f1815eca663 100644 --- a/hw/riscv/riscv-iommu.c +++ b/hw/riscv/riscv-iommu.c @@ -49,7 +49,8 @@ struct RISCVIOMMUSpace { IOMMUMemoryRegion iova_mr; /* IOVA memory region for attached device = */ AddressSpace iova_as; /* IOVA address space for attached device = */ RISCVIOMMUState *iommu; /* Managing IOMMU device state */ - uint32_t devid; /* Requester identifier, AKA device_id */ + PCIBus *bus; /* PCI bus of the requester */ + uint8_t devfn; /* Requester identifier, AKA device_id */ bool notifier; /* IOMMU unmap notifier enabled */ QLIST_ENTRY(RISCVIOMMUSpace) list; }; @@ -74,6 +75,15 @@ struct RISCVIOMMUEntry { /* IOMMU index for transactions without process_id specified. */ #define RISCV_IOMMU_NOPROCID 0 =20 +static uint32_t riscv_iommu_space_devid(RISCVIOMMUSpace *as) +{ + uint32_t devid =3D PCI_BUILD_BDF(pci_bus_num(as->bus), as->devfn); + + /* FIXME: PCIe bus remapping for attached endpoints. */ + devid |=3D as->iommu->bus << 8; + return devid; +} + static uint8_t riscv_iommu_get_icvec_vector(uint32_t icvec, uint32_t vec_t= ype) { switch (vec_type) { @@ -1456,15 +1466,13 @@ static void riscv_iommu_ctx_put(RISCVIOMMUState *s,= void *ref) } =20 /* Find or allocate address space for a given device */ -static AddressSpace *riscv_iommu_space(RISCVIOMMUState *s, uint32_t devid) +static AddressSpace *riscv_iommu_space(RISCVIOMMUState *s, PCIBus *bus, + int devfn) { RISCVIOMMUSpace *as; =20 - /* FIXME: PCIe bus remapping for attached endpoints. */ - devid |=3D s->bus << 8; - QLIST_FOREACH(as, &s->spaces, list) { - if (as->devid =3D=3D devid) { + if (as->bus =3D=3D bus && as->devfn =3D=3D devfn) { break; } } @@ -1474,10 +1482,11 @@ static AddressSpace *riscv_iommu_space(RISCVIOMMUSt= ate *s, uint32_t devid) as =3D g_new0(RISCVIOMMUSpace, 1); =20 as->iommu =3D s; - as->devid =3D devid; + as->bus =3D bus; + as->devfn =3D devfn; =20 snprintf(name, sizeof(name), "riscv-iommu-%04x:%02x.%d-iova", - PCI_BUS_NUM(as->devid), PCI_SLOT(as->devid), PCI_FUNC(as->devi= d)); + pci_bus_num(bus), PCI_SLOT(devfn), PCI_FUNC(devfn)); =20 /* IOVA address space, untranslated addresses */ memory_region_init_iommu(&as->iova_mr, sizeof(as->iova_mr), @@ -1487,8 +1496,8 @@ static AddressSpace *riscv_iommu_space(RISCVIOMMUStat= e *s, uint32_t devid) =20 QLIST_INSERT_HEAD(&s->spaces, as, list); =20 - trace_riscv_iommu_new(s->parent_obj.id, PCI_BUS_NUM(as->devid), - PCI_SLOT(as->devid), PCI_FUNC(as->devid)); + trace_riscv_iommu_new(s->parent_obj.id, pci_bus_num(bus), + PCI_SLOT(devfn), PCI_FUNC(devfn)); } return &as->iova_as; } @@ -1813,7 +1822,7 @@ static void riscv_iommu_ats(RISCVIOMMUState *s, pid =3D get_field(cmd->dword0, RISCV_IOMMU_CMD_ATS_PID); =20 QLIST_FOREACH(as, &s->spaces, list) { - if (as->devid =3D=3D devid) { + if (riscv_iommu_space_devid(as) =3D=3D devid) { break; } } @@ -2823,8 +2832,9 @@ static IOMMUTLBEntry riscv_iommu_memory_region_transl= ate( .addr_mask =3D ~0ULL, .perm =3D flag, }; + uint32_t devid =3D riscv_iommu_space_devid(as); =20 - ctx =3D riscv_iommu_ctx(as->iommu, as->devid, iommu_idx, &ref); + ctx =3D riscv_iommu_ctx(as->iommu, devid, iommu_idx, &ref); if (ctx =3D=3D NULL) { /* Translation disabled or invalid. */ iotlb.addr_mask =3D 0; @@ -2836,8 +2846,8 @@ static IOMMUTLBEntry riscv_iommu_memory_region_transl= ate( } =20 /* Trace all dma translations with original access flags. */ - trace_riscv_iommu_dma(as->iommu->parent_obj.id, PCI_BUS_NUM(as->devid), - PCI_SLOT(as->devid), PCI_FUNC(as->devid), iommu_= idx, + trace_riscv_iommu_dma(as->iommu->parent_obj.id, PCI_BUS_NUM(devid), + PCI_SLOT(devid), PCI_FUNC(devid), iommu_idx, IOMMU_FLAG_STR[flag & IOMMU_RW], iotlb.iova, iotlb.translated_addr); =20 @@ -2885,7 +2895,7 @@ static AddressSpace *riscv_iommu_find_as(PCIBus *bus,= void *opaque, int devfn) =20 /* Find first matching IOMMU */ while (s !=3D NULL && as =3D=3D NULL) { - as =3D riscv_iommu_space(s, PCI_BUILD_BDF(pci_bus_num(bus), devfn)= ); + as =3D riscv_iommu_space(s, bus, devfn); s =3D s->iommus.le_next; } =20 --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807672; cv=none; d=zohomail.com; s=zohoarc; b=Wwts0PrNmTl22QCWpe3ZAJ+poKhF0NHL5H3tobufZZnAxGqc4k6vGDPRFX24NI3Rihb8OgGGwkcD6EDvZB66VJuXZNJiXUN/tHyTEQApt/dhhF3ar06a4wnXElp79xZnTRcaWe7G5LBcnOcVcuMrunTyVMrMoRpKvv01II0Pj2M= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807672; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=0QN6ULRRYiAKHH+GtAY+H2Z7EAxcNW+mxIhcp4G+4qs=; b=jBKRgo8RHxsfQhsHpFLHwkZhMzyckx1n1TE1c3ZrWfX8VZwpNonN5wocRc1GjDz++ufSBa1ahMJNlQ4DgDLXSeYyldbO4gqKbbsL4Z2007fw4/tLA3dsDjWcaRtR2nOPQtMhskwzkgL2Ede99k3sjrCcudaCfPU8S5/2LXAdqBA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 178380767228865.58429298075487; Sat, 11 Jul 2026 15:07:52 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifqp-0006oG-RY; Sat, 11 Jul 2026 18:07:12 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifqn-0006X8-F8; Sat, 11 Jul 2026 18:07:09 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifql-00010J-Ej; Sat, 11 Jul 2026 18:07:09 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id E15011C0AD8; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 98B273EAF63; Sun, 12 Jul 2026 00:59:51 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id F29AE1337D; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=4dLu/r8GpVdt+cZ1WsuOpEFEiVzdkP6eZ5sgruH3cMc=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=jc+n41ga9Q0j1/eNyeTgLyBaQmjfR3Bu70duAWev3s3vZzO1X84S/JKaKnnFjQzUz EGz8tb68JSjLDHqc7vhBQvBq/Jg6JwvsZEuBuMTLlx9Hv4TW2kWMSmnpXkrD/V7g1U l3DBCZtfiK8l9WTW42NKSQ2W8BvUiDBlYMBUAEfwrOIAr1AJaa3qe7tPVr3BKy45D4 dqFt9epdqqprJ4naxvOu3oUheqfKpA7WVNw/8xOCzGziRbbThr+5Q2GfEvWuoXgJkx 6iM0qOvZ8m7KFQVbO6ZGgd7Nybehfb3j4aR7FqU2WPoqEgwavRxG+fGc0XTw0oy8JW Z19woCC8BucUw== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Daniel Henrique Barboza , Alistair Francis , Michael Tokarev Subject: [Stable-11.0.3 77/81] hw/riscv/riscv-iommu.c: set ftype and iova in riscv_iommu_ctx() Date: Sun, 12 Jul 2026 00:58:55 +0300 Message-ID: <20260711215904.3757-77-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807675326154100 Content-Type: text/plain; charset="utf-8" From: Daniel Henrique Barboza We're hardcoding faulting type as READ, where it could very well be a write access, and we're not recording the faulting addr/iova. A note was added in the fault_type logic because I wasn't able to trivially handle a probable code repeitition it in this same patch. Something to do in a later date. Fixes: 0c54acb8243d ("hw/riscv: add RISC-V IOMMU base emulation") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3564 Signed-off-by: Daniel Henrique Barboza Message-ID: <20260701092241.307801-1-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis (cherry picked from commit ce7fb3282756c04433274e3abcd59407f77c4923) Signed-off-by: Michael Tokarev diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c index f1815eca663..c59e5d40e5e 100644 --- a/hw/riscv/riscv-iommu.c +++ b/hw/riscv/riscv-iommu.c @@ -1407,6 +1407,7 @@ static void riscv_iommu_ctx_inval(RISCVIOMMUState *s,= GHFunc func, /* Find or allocate translation context for a given {device_id, process_id= } */ static RISCVIOMMUContext *riscv_iommu_ctx(RISCVIOMMUState *s, unsigned devid, unsigned process= _id, + IOMMUAccessFlags perm, uint64_t = iova, void **ref) { GHashTable *ctx_cache; @@ -1416,6 +1417,7 @@ static RISCVIOMMUContext *riscv_iommu_ctx(RISCVIOMMUS= tate *s, .process_id =3D process_id, }; unsigned mode =3D get_field(s->ddtp, RISCV_IOMMU_DDTP_MODE); + uint32_t fault_type; =20 ctx_cache =3D g_hash_table_ref(s->ctx_cache); =20 @@ -1451,8 +1453,21 @@ static RISCVIOMMUContext *riscv_iommu_ctx(RISCVIOMMU= State *s, g_hash_table_unref(ctx_cache); *ref =3D NULL; =20 - riscv_iommu_report_fault(s, ctx, RISCV_IOMMU_FQ_TTYPE_UADDR_RD, - fault, !!process_id, 0, 0); + /* + * TODO: (1) do we need to distinguish other fault types + * for ctx fetching and (2) evaluate putting the 'fault_type' + * logic inside riscv_iommu_report_fault() - there's at + * least one other place (end of riscv_iommu_translate()) + * that does something similar. + */ + if (perm & IOMMU_RO) { + fault_type =3D RISCV_IOMMU_FQ_TTYPE_UADDR_RD; + } else { + fault_type =3D RISCV_IOMMU_FQ_TTYPE_UADDR_WR; + } + + riscv_iommu_report_fault(s, ctx, fault_type, fault, + !!process_id, iova, 0); =20 g_free(ctx); return NULL; @@ -2183,6 +2198,8 @@ static void riscv_iommu_process_dbg(RISCVIOMMUState *= s) uint64_t ctrl =3D riscv_iommu_reg_get64(s, RISCV_IOMMU_REG_TR_REQ_CTL); unsigned devid =3D get_field(ctrl, RISCV_IOMMU_TR_REQ_CTL_DID); unsigned pid =3D get_field(ctrl, RISCV_IOMMU_TR_REQ_CTL_PID); + IOMMUAccessFlags perm =3D ctrl & RISCV_IOMMU_TR_REQ_CTL_NW + ? IOMMU_RO : IOMMU_RW; RISCVIOMMUContext *ctx; void *ref; =20 @@ -2190,7 +2207,7 @@ static void riscv_iommu_process_dbg(RISCVIOMMUState *= s) return; } =20 - ctx =3D riscv_iommu_ctx(s, devid, pid, &ref); + ctx =3D riscv_iommu_ctx(s, devid, pid, perm, iova, &ref); if (ctx =3D=3D NULL) { riscv_iommu_reg_set64(s, RISCV_IOMMU_REG_TR_RESPONSE, RISCV_IOMMU_TR_RESPONSE_FAULT | @@ -2198,7 +2215,7 @@ static void riscv_iommu_process_dbg(RISCVIOMMUState *= s) } else { IOMMUTLBEntry iotlb =3D { .iova =3D iova, - .perm =3D ctrl & RISCV_IOMMU_TR_REQ_CTL_NW ? IOMMU_RO : IOMMU_= RW, + .perm =3D perm, .addr_mask =3D ~0, .target_as =3D NULL, }; @@ -2533,7 +2550,7 @@ static MemTxResult riscv_iommu_trap_write(void *opaqu= e, hwaddr addr, /* FIXME: PCIe bus remapping for attached endpoints. */ devid |=3D s->bus << 8; =20 - ctx =3D riscv_iommu_ctx(s, devid, 0, &ref); + ctx =3D riscv_iommu_ctx(s, devid, 0, IOMMU_RW, addr, &ref); if (ctx =3D=3D NULL) { res =3D MEMTX_ACCESS_ERROR; } else { @@ -2834,7 +2851,7 @@ static IOMMUTLBEntry riscv_iommu_memory_region_transl= ate( }; uint32_t devid =3D riscv_iommu_space_devid(as); =20 - ctx =3D riscv_iommu_ctx(as->iommu, devid, iommu_idx, &ref); + ctx =3D riscv_iommu_ctx(as->iommu, devid, iommu_idx, flag, addr, &ref); if (ctx =3D=3D NULL) { /* Translation disabled or invalid. */ iotlb.addr_mask =3D 0; --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807683; cv=none; d=zohomail.com; s=zohoarc; b=YZ2TtEHtpmcVvMM7KgdkOrU8X1XRt7WwxC0GYt/c0FCjlszZaJIim/MzfrVGqnUxnnBSNuQ4EWyirguhaZiSpxAx0Vo25DfpYECywg6mMJc1eOZ3iaUzl8qU/qSI19go/larDU+y8Fs3jB54hSDJd97H/vFGksA8lzyQus65kW8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807683; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=ciSgBKSv+v3guQQ3oNcl1Bgqz+M953jK6+TiC7VvB4c=; b=RLpjWzGPlNB+eC5b1Mhac0y2cQg9eXCDmZkBzINuPcNDcHv9f+VEINQBhVXveCjNBLF2VKszX/mrLE7gut5jSEMyrNmKpqX9uACWaXpOj302tZgZGa2M47so0f2Ud4gMKajO6LiSxwbhLwZ3nqUtHtnUeB0OOPV6Ual2ubaxqKA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807683045472.0935279309672; Sat, 11 Jul 2026 15:08:03 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifqx-00075j-EC; Sat, 11 Jul 2026 18:07:19 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifqp-0006n2-E7; Sat, 11 Jul 2026 18:07:11 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifqn-000126-GK; Sat, 11 Jul 2026 18:07:11 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id E6D8D1C0AD9; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 9DFD43EAF64; Sun, 12 Jul 2026 00:59:51 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 00E931337F; Sun, 12 Jul 2026 00:59:50 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=IIyXBgs7Q7EyMmBK59bS0SPSGlYTJC1VKc2b5fdm0AI=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=DVANpb/PFByeaC1VptCQ/2CSMAyGZBsiHtdgXXmdGEg0Yp/p51r2vkjp3GLVv9fEK 54E1+RZQ4ugjruGnRH0r51LjYWaahPAw9TDT/3mizTHu9M3oCb7RnXtVj/V+6jKmj+ x2Mx1xOvJI80MVZR5OpJSYxouxlOkMt58TqExdAuO+us/ghPV5W6LZx2KiPmQ1JjSW QGgDuPLo6gWlVQu+oJAncnol4udLD4kEJ0CwTBeuILVgyEpsRUiNt/pjvLE8k1clmc eAASH5nnHkURLjyezZo3fNMpibYDrnUSBzo89Q+BqT6g12mKDMZQR4xKEd/Nk1tQX9 4mvgHEbDJSCVA== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Alistair Francis , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Tao Tang , Michael Tokarev Subject: [Stable-11.0.3 78/81] hw/pci/pcie_doe: Check mailbox length for overflows Date: Sun, 12 Jul 2026 00:58:56 +0300 Message-ID: <20260711215904.3757-78-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807685699154100 From: Alistair Francis It was possible that a guest could overflow the `doe_cap->write_mbox` buffer by writing more then PCI_DOE_DW_SIZE_MAX dwords. `doe_cap->write_mbox_len` would continue to increment and there were no bounds checks on the length when offsetting into doe_cap->write_mbox. This patch adds a check and reports a guest error if we would overflow. On an overflow we also silenty discard the entire object as instructed to do in the PCIe spec when the length specified in the header (up to PCI_DOE_DW_SIZE_MAX dwords) doesn't match the length of the object. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3679 Signed-off-by: Alistair Francis Reviewed-by: Philippe Mathieu-Daud=C3=A9 Reviewed-by: Tao Tang Message-ID: <20260707020750.788960-1-alistair.francis@wdc.com> Signed-off-by: Alistair Francis (cherry picked from commit c7e61854544be3ebcc001a33d41807947866a739) Signed-off-by: Michael Tokarev diff --git a/hw/pci/pcie_doe.c b/hw/pci/pcie_doe.c index 2210f869681..1bc2b457816 100644 --- a/hw/pci/pcie_doe.c +++ b/hw/pci/pcie_doe.c @@ -78,14 +78,21 @@ static bool pcie_doe_discovery(DOECap *doe_cap) return true; } =20 +static void pcie_doe_reset_write_mbox(DOECap *st) +{ + st->write_mbox_len =3D 0; + + memset(st->write_mbox, 0, PCI_DOE_DW_SIZE_MAX * DWORD_BYTE); +} + static void pcie_doe_reset_mbox(DOECap *st) { st->read_mbox_idx =3D 0; st->read_mbox_len =3D 0; - st->write_mbox_len =3D 0; =20 memset(st->read_mbox, 0, PCI_DOE_DW_SIZE_MAX * DWORD_BYTE); - memset(st->write_mbox, 0, PCI_DOE_DW_SIZE_MAX * DWORD_BYTE); + + pcie_doe_reset_write_mbox(st); } =20 void pcie_doe_init(PCIDevice *dev, DOECap *doe_cap, uint16_t offset, @@ -356,8 +363,20 @@ void pcie_doe_write_config(DOECap *doe_cap, if (size !=3D DWORD_BYTE) { return; } - doe_cap->write_mbox[doe_cap->write_mbox_len] =3D val; - doe_cap->write_mbox_len++; + if (doe_cap->write_mbox_len < PCI_DOE_DW_SIZE_MAX) { + doe_cap->write_mbox[doe_cap->write_mbox_len] =3D val; + doe_cap->write_mbox_len++; + } else { + qemu_log_mask(LOG_GUEST_ERROR, + "Mailbox write length (%d) overflow\n", + doe_cap->write_mbox_len); + /* + * Too much data has been written, it can't + * "match the Length indicated in DOE Data Object Header 2" + * so we drop the entire object. + */ + pcie_doe_reset_write_mbox(doe_cap); + } break; case PCI_EXP_DOE_CAP: /* fallthrough */ --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807665; cv=none; d=zohomail.com; s=zohoarc; b=OxoTlwpgzInfhp7NS/QGCzfIPQ6M1TSoxypnmvfSvvGFFTkSmaqgWOITSDt/A8ThMTJqiHYQhunPMroIfoKj3cHRb7aegBCCv4wsjjTIwSLt1aT+FA4C/zzPF6MCeuvqX6P3ZAwhv/BzNm6AvyE3dV5zBtOM2G4ozcirG8nN3GU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807665; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=h8pmFV9PL6cDjf2+wah/fRUBTcAu8wa24ERqsJ7Z9X0=; b=O2K25mv1zhrNdGyXilnGLCee35Sf1TSrETW31XzNTArCZv0UTKitSyEdts+65GLHdkhCSYL5EU/T473F3w0NZkIFZ29tZLgr6XgzJtHvCYGW6KAr3GiXLPviEqUObp2H8A1xX3veGTc9iQ8Kh6CvnCeFOX+vSRGADIBonq+9leU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807665356694.1282193459951; Sat, 11 Jul 2026 15:07:45 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifqv-00073k-MM; Sat, 11 Jul 2026 18:07:17 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifqq-0006vo-Fe; Sat, 11 Jul 2026 18:07:12 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifqo-00012W-U3; Sat, 11 Jul 2026 18:07:12 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id ECCD31C0ADA; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id A31013EAF65; Sun, 12 Jul 2026 00:59:51 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 034B113381; Sun, 12 Jul 2026 00:59:51 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=0Hai+S8iJIKj4VhNBwatACETSTtOwjdmJGjzk75GIYc=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=p8rk+qHQiT6NgM9Lwdy5VJBYP77q8NyM7nQkIPxMKa0ur1U5b35K7hxpkJjf+huH3 0jupmaGPJP6ow0mxQLdz2HZlhIc1bnLWQ3ULLEPITWkt+sx/N7vnhlQLDmbcD27HL5 bKtbLomWV6QQ23VIY1Wb7+oBHLttIDrUGzKsXzM2/OXBxBOTcVuGsX0ZOa8ZNU1DSI IKlLhZnqdcOX8CAjMmikTLyQ37SMwhhMMOzCPXncuAQm2uo1B4nBe7FJBEfbqnTvDW /aurrLKB18oYgHUJh1RrVA12hjUBNG+nq5ULA4pS5S9z+w4vZDiHS+PZhPyvIjBSJ4 zUodSQtLsB+3g== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Heinrich Schuchardt , Alistair Francis , Michael Tokarev Subject: [Stable-11.0.3 79/81] tests: allow differences in SPCR Date: Sun, 12 Jul 2026 00:58:57 +0300 Message-ID: <20260711215904.3757-79-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807667296154100 Content-Type: text/plain; charset="utf-8" From: Heinrich Schuchardt For easier bisection add the SPCR table to bios-tables-test-allowed-diff.h. Signed-off-by: Heinrich Schuchardt Acked-by: Alistair Francis Message-ID: <20260705063147.199732-2-heinrich.schuchardt@canonical.com> Signed-off-by: Alistair Francis (cherry picked from commit 18a5220990900ea53539f2f35ac042edacdbdbea) Signed-off-by: Michael Tokarev diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios= -tables-test-allowed-diff.h index dfb8523c8bf..2c7086d9de1 100644 --- a/tests/qtest/bios-tables-test-allowed-diff.h +++ b/tests/qtest/bios-tables-test-allowed-diff.h @@ -1 +1,3 @@ /* List of comma-separated changed AML files to ignore */ +"tests/data/acpi/loongarch64/virt/SPCR", +"tests/data/acpi/riscv64/virt/SPCR", --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807768; cv=none; d=zohomail.com; s=zohoarc; b=JlE0NGuDHGc5Rn21ubFNdV5Z7JwXE4Ie27qjoSbagh82Tpk/iKkCcEhomyZ1yerbeCyxBGVDSTp30B96udmtRVUfl6oj+tWNtOSRsNtai+07B9LX4DWKe8dW5aUJWGaLPI+FCGL9IKg3Tx94ylpc1gbjb4LHGzbyNVl93+CoZ30= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807768; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=s+xajMgZKEXhRShiCM/LMBi1OiCmK58ucwdeMi63mPw=; b=LFIKKH7PbvUFIojaV6dZT41p1nlyQeYtnTKxQZv3ffuWNEid72fxM3SuBJlLB3ukXy+79suz9FPgrsJr97M045b6AYlvYrZpNsxX8+Dzh1UPeO3t2+linckPhDh0MFkOVcEu+W5ydmRA8Z0uan+BuJODj4k1YxdjZ1jbNZGdhs4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807768205973.7288392655254; Sat, 11 Jul 2026 15:09:28 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifrG-0000cv-24; Sat, 11 Jul 2026 18:07:38 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifrE-0000LE-1O; Sat, 11 Jul 2026 18:07:36 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifrA-000130-Qv; Sat, 11 Jul 2026 18:07:34 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id F270C1C0ADB; Sun, 12 Jul 2026 00:59:41 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id A8BE33EAF66; Sun, 12 Jul 2026 00:59:51 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 0595113383; Sun, 12 Jul 2026 00:59:51 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807181; bh=LhMEjECC19NqCfjz4bsEL2lMdROA/kxQbdUHACIOSac=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=roJ5NhzhymicRNXHyrxJfsaYosHRV2qQ+vCTyvSVZtOVe7j+56kZyRGvokM2gu+rk dI/LyUEejHzHKnOg4xetEmsCSF+v9YYkoH/2GN8K14Ly1V3RETdsv208BeIIjhNt0Q VncfHxXtRN5oFUcNlrmxaq+9G6IGuUwk8Yy0hU1ghFyPqClgErVXVsCuatwdvHrGee Bc3beYpThEX+NBPJrd12nBBllqEIupTLcqkNtFfKrVFSsZf79yLpaYtrdtPb4BEuY2 jepT1NR9+5T/gt12uXsFgLl//9ykr/lNtNsetazbhmMWFmPs/u//nYcyjs2c/b/Ajm Yp8II18sQEvKg== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Heinrich Schuchardt , Alistair Francis , Michael Tokarev Subject: [Stable-11.0.3 80/81] hw/acpi: correct field sequence in SPCR table Date: Sun, 12 Jul 2026 00:58:58 +0300 Message-ID: <20260711215904.3757-80-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807770675154100 Content-Type: text/plain; charset="utf-8" From: Heinrich Schuchardt On LoongArch and RISC-V invalid SPCR tables are created: Terminal Type : 00 Language : 03 The correct values are: Terminal Type : 03 Language : 00 This is due to commit 7dd0b070fa09 ("hw/arm/virt-acpi-build.c: Migrate SPCR creation to common location") that swapped the fields. See the specification of the table in https://learn.microsoft.com/en-us/windows-hardware/drivers/bringup/serial-p= ort-console-redirection-table This page shows version 1.10. But the sequence of the fields was not changed since version 1.0. Our LoongArch and ARM code uses version 1.07 of the specification. Our RISC-V code uses version 1.10 of the specification. Fixes: 7dd0b070fa09 ("hw/arm/virt-acpi-build.c: Migrate SPCR creation to co= mmon location") Origin: https://lore.kernel.org/qemu-devel/20260326121947.51200-1-heinrich.= schuchardt@canonical.com/T/#u Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/qemu/+bug/2146419 Signed-off-by: Heinrich Schuchardt Reviewed-by: Alistair Francis Message-ID: <20260705063147.199732-3-heinrich.schuchardt@canonical.com> Signed-off-by: Alistair Francis (cherry picked from commit 15c73b0f17d27956b47812124b646d52181517bf) Signed-off-by: Michael Tokarev diff --git a/hw/acpi/aml-build.c b/hw/acpi/aml-build.c index 4b374050881..a999320e61e 100644 --- a/hw/acpi/aml-build.c +++ b/hw/acpi/aml-build.c @@ -2115,10 +2115,10 @@ void build_spcr(GArray *table_data, BIOSLinker *lin= ker, build_append_int_noprefix(table_data, f->stop_bits, 1); /* Flow Control */ build_append_int_noprefix(table_data, f->flow_control, 1); - /* Language */ - build_append_int_noprefix(table_data, f->language, 1); /* Terminal Type */ build_append_int_noprefix(table_data, f->terminal_type, 1); + /* Language */ + build_append_int_noprefix(table_data, f->language, 1); /* PCI Device ID */ build_append_int_noprefix(table_data, f->pci_device_id, 2); /* PCI Vendor ID */ --=20 2.47.3 From nobody Sun Jul 12 00:42:44 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1783807687; cv=none; d=zohomail.com; s=zohoarc; b=cvfK4wt+jZ3pWM+XmWGiwAkbSNcfI4KOaaaWS7KmCg07SRiIPR3y/xKpgmAbQs6ENgU7fO/KDzX2a2lRaVKjydwkgIxPYLntGhVdW4IK4dQYItlEGWS6iB5/1hdRWgXVwA59H0DbDXAwRd+skFjovTFAnMG8Mc/egcCJOHfK2x4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783807687; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=FLGDxcVf1gs97/FEnYRZ7uch7p3zBUxgLFPnFZn7rM4=; b=ecRma5Snr22bbgVBIdF6xpLEyROr5FoP7BttRvy9zEiK9ODf3iCAGluiTF5g8/L6NezqSLVpM9tP9zDDANG73FJ3ZTg4SaVAuDPkUKQLHx/DcK6mO9gdxysn4hO/NzHMBvAR56FXZPk+ifGBV7Uo7/1gvf9+Vgk37NP8E8KpSBI= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783807687378519.0158267919654; Sat, 11 Jul 2026 15:08:07 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wifrF-0000Ym-Kt; Sat, 11 Jul 2026 18:07:37 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifrE-0000LF-1b; Sat, 11 Jul 2026 18:07:36 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wifrC-00013M-18; Sat, 11 Jul 2026 18:07:35 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 039951C0ADC; Sun, 12 Jul 2026 00:59:42 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id AF0CF3EAF67; Sun, 12 Jul 2026 00:59:51 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 07F3713385; Sun, 12 Jul 2026 00:59:51 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1783807182; bh=tP/CrzL07NHSuDze/u6Nu7yKAkynHCESZWIV2L/jryM=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=LFLdjyxWXXnbHjagdGqz0JuhoLssgN8CaSDaSFCsib0Jenmd2O/KEfAXJU/A0Jxp9 GnBg6phPYqz+SZw4tFN+ZLSqhk8sZdvOUYd+RbvxgP7oTatqCjH0msRg2dRYPAQnIB xZkAj02aUaMOi5T9VuA73vZhKsWeAtJA4JFeVQnJ6rKN9tuqI1uFHuSv6YI35tNF5m Obp/okPs5MiD5nMwntklAf8RyxV5Wn7OsIMyccGPsw+evRslPHdfCfEIKX79GtfmQ4 Llz8SdGQD7PsqWKrj/2fje4so2DXB1WwXlk8RlGup+eoaP+3iTXYxrmaUId180EP24 ewmWAvtbQRl+A== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Heinrich Schuchardt , Alistair Francis , Michael Tokarev Subject: [Stable-11.0.3 81/81] tests: update SPCR loongarch64 and riscv64 test data Date: Sun, 12 Jul 2026 00:58:59 +0300 Message-ID: <20260711215904.3757-81-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1783807689640154100 Content-Type: text/plain; charset="utf-8" From: Heinrich Schuchardt On LoongArch and RISC-V the SPCR test data contained: Terminal Type : 00 Language : 03 The corrected values are: Terminal Type : 03 Language : 00 See the specification of the table in https://learn.microsoft.com/en-us/windows-hardware/drivers/bringup/serial-p= ort-console-redirection-table The ACPI table data was rebuilt with tests/data/acpi/rebuild-expected-aml.sh. Remove SPCR expections from tests/qtest/bios-tables-test-allowed-diff.h. Signed-off-by: Heinrich Schuchardt Acked-by: Alistair Francis Message-ID: <20260705063147.199732-4-heinrich.schuchardt@canonical.com> Signed-off-by: Alistair Francis (cherry picked from commit ec7d32428757d5813935cbe099449f6201980d80) Signed-off-by: Michael Tokarev diff --git a/tests/data/acpi/loongarch64/virt/SPCR b/tests/data/acpi/loonga= rch64/virt/SPCR index 3cc9bbcfb80..7bb819cd0d2 100644 Binary files a/tests/data/acpi/loongarch64/virt/SPCR and b/tests/data/acpi/= loongarch64/virt/SPCR differ diff --git a/tests/data/acpi/riscv64/virt/SPCR b/tests/data/acpi/riscv64/vi= rt/SPCR index 09617f8793a..59d2c8f7f21 100644 Binary files a/tests/data/acpi/riscv64/virt/SPCR and b/tests/data/acpi/risc= v64/virt/SPCR differ diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios= -tables-test-allowed-diff.h index 2c7086d9de1..dfb8523c8bf 100644 --- a/tests/qtest/bios-tables-test-allowed-diff.h +++ b/tests/qtest/bios-tables-test-allowed-diff.h @@ -1,3 +1 @@ /* List of comma-separated changed AML files to ignore */ -"tests/data/acpi/loongarch64/virt/SPCR", -"tests/data/acpi/riscv64/virt/SPCR", --=20 2.47.3