diff --git a/kvm-hw-core-platform-bus-guard-platform_bus_get_mmio_add.patch b/kvm-hw-core-platform-bus-guard-platform_bus_get_mmio_add.patch new file mode 100644 index 0000000..c46e74d --- /dev/null +++ b/kvm-hw-core-platform-bus-guard-platform_bus_get_mmio_add.patch @@ -0,0 +1,50 @@ +From dee147a00ef424ebb5882f45b2dcd88eef30e0d1 Mon Sep 17 00:00:00 2001 +From: Mohammadfaiz Bawa +Date: Tue, 14 Jul 2026 22:01:45 +0530 +Subject: [PATCH 01/12] hw/core/platform-bus: guard + platform_bus_get_mmio_addr() against NULL + +RH-Author: Mohammadfaiz Bawa +RH-MergeRequest: 511: hw/tpm: fix tpm-ppi migration failure for older machine types +RH-Jira: RHEL-180837 +RH-Acked-by: Eric Auger +RH-Acked-by: Gavin Shan +RH-Commit: [1/3] 622f42e2d1c609def22b2796cf83080248897548 (faizb/qemu-kvm) + +JIRA: https://redhat.atlassian.net/browse/RHEL-180837 + +sysbus_mmio_get_region() returns NULL when a device has fewer MMIO +regions than the requested slot index. platform_bus_get_mmio_addr() +passes the result directly to memory_region_is_mapped() without a +NULL check, causing a SIGSEGV. + +Return -1 early when the region pointer is NULL, consistent with the +existing "not mapped" path. + +Reviewed-by: Peter Maydell +Signed-off-by: Mohammadfaiz Bawa +Link: https://lore.kernel.org/qemu-devel/20260619093140.832136-2-mbawa@redhat.com +Signed-off-by: Stefan Berger +(cherry picked from commit fb7609c4bf74e31ea06c0d8e400dd01badcfa4c3) +Signed-off-by: Mohammadfaiz Bawa +--- + hw/core/platform-bus.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/hw/core/platform-bus.c b/hw/core/platform-bus.c +index 6950063de4..95add361cc 100644 +--- a/hw/core/platform-bus.c ++++ b/hw/core/platform-bus.c +@@ -59,8 +59,7 @@ hwaddr platform_bus_get_mmio_addr(PlatformBusDevice *pbus, SysBusDevice *sbdev, + Object *pbus_mr_obj = OBJECT(pbus_mr); + Object *parent_mr; + +- if (!memory_region_is_mapped(sbdev_mr)) { +- /* Region is not mapped? */ ++ if (!sbdev_mr || !memory_region_is_mapped(sbdev_mr)) { + return -1; + } + +-- +2.52.0 + diff --git a/kvm-hw-tpm-default-tpm-tis-device-PPI-to-disabled.patch b/kvm-hw-tpm-default-tpm-tis-device-PPI-to-disabled.patch new file mode 100644 index 0000000..add4867 --- /dev/null +++ b/kvm-hw-tpm-default-tpm-tis-device-PPI-to-disabled.patch @@ -0,0 +1,46 @@ +From fa2f8fe2dda08627add2104d534c2c375705514f Mon Sep 17 00:00:00 2001 +From: Mohammadfaiz Bawa +Date: Thu, 16 Jul 2026 14:19:40 +0530 +Subject: [PATCH 03/12] hw/tpm: default tpm-tis-device PPI to disabled + +RH-Author: Mohammadfaiz Bawa +RH-MergeRequest: 511: hw/tpm: fix tpm-ppi migration failure for older machine types +RH-Jira: RHEL-180837 +RH-Acked-by: Eric Auger +RH-Acked-by: Gavin Shan +RH-Commit: [3/3] 848b5a32d209187bc7e59e69fde0743d9476d419 (faizb/qemu-kvm) + +JIRA: https://redhat.atlassian.net/browse/RHEL-180837 +UPSTREAM: RHEL-only + +Migration is currently broken between 10.3 and earlier qemu versions +that do not implement tpm PPI (including 10.2) with "Unknown ramblock +tpm-ppi" error. Upstream 5e33de4f00c2 ("hw/core/machine: disable +tpm-tis-device PPI for machine type <= 11.0") uses a compat setting +to turn the PPI feature off for older machine types and change the +default for 11.1. However, downstream, we do not have a new machine +type for 10.3 when the feature was introduced so we cannot +discriminate between 10.2 and 10.3. So turn the feature off for now. +We will change the default for next machine type. + +Signed-off-by: Mohammadfaiz Bawa +--- + hw/tpm/tpm_tis_sysbus.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/hw/tpm/tpm_tis_sysbus.c b/hw/tpm/tpm_tis_sysbus.c +index 253c394087..63e126e360 100644 +--- a/hw/tpm/tpm_tis_sysbus.c ++++ b/hw/tpm/tpm_tis_sysbus.c +@@ -94,7 +94,7 @@ static void tpm_tis_sysbus_reset(DeviceState *dev) + static const Property tpm_tis_sysbus_properties[] = { + DEFINE_PROP_UINT32("irq", TPMStateSysBus, state.irq_num, TPM_TIS_IRQ), + DEFINE_PROP_TPMBE("tpmdev", TPMStateSysBus, state.be_driver), +- DEFINE_PROP_BOOL("ppi", TPMStateSysBus, state.ppi_enabled, true), ++ DEFINE_PROP_BOOL("ppi", TPMStateSysBus, state.ppi_enabled, false), + }; + + static void tpm_tis_sysbus_initfn(Object *obj) +-- +2.52.0 + diff --git a/kvm-hw-tpm-gate-PPI-support-on-tpm-tis-device-behind-a-d.patch b/kvm-hw-tpm-gate-PPI-support-on-tpm-tis-device-behind-a-d.patch new file mode 100644 index 0000000..368b0ed --- /dev/null +++ b/kvm-hw-tpm-gate-PPI-support-on-tpm-tis-device-behind-a-d.patch @@ -0,0 +1,97 @@ +From 2aa010ee971b6323018033536d8bc192641d253e Mon Sep 17 00:00:00 2001 +From: Mohammadfaiz Bawa +Date: Tue, 14 Jul 2026 22:01:45 +0530 +Subject: [PATCH 02/12] hw/tpm: gate PPI support on tpm-tis-device behind a + device property + +RH-Author: Mohammadfaiz Bawa +RH-MergeRequest: 511: hw/tpm: fix tpm-ppi migration failure for older machine types +RH-Jira: RHEL-180837 +RH-Acked-by: Eric Auger +RH-Acked-by: Gavin Shan +RH-Commit: [2/3] ab0f19971bae0c49870a92e7e75c4cc0fa96a66d (faizb/qemu-kvm) + +JIRA: https://redhat.atlassian.net/browse/RHEL-180837 + +Add a "ppi" boolean property (default: true) to tpm-tis-device. +When ppi=off the RAMBlock is never registered and the migration +stream omits "tpm-ppi", restoring backward compatibility. + +Move sysbus_init_mmio() calls from instance_init to realizefn so +the memory regions are initialized before being registered. When +ppi=off, the PPI MMIO region is simply not exposed. + +Fixes: 46cd2c1050f0 ("hw/tpm: add PPI support to tpm-tis-device for ARM64 virt") +Signed-off-by: Mohammadfaiz Bawa +Reviewed-by: Stefan Berger +Link: https://lore.kernel.org/qemu-devel/20260619093140.832136-3-mbawa@redhat.com +Signed-off-by: Stefan Berger +(cherry picked from commit 5f0348bf6ca17707475c5ccb10909b7a4407513b) +Signed-off-by: Mohammadfaiz Bawa +--- + hw/tpm/tpm_tis.h | 1 + + hw/tpm/tpm_tis_sysbus.c | 18 +++++++++++------- + 2 files changed, 12 insertions(+), 7 deletions(-) + +diff --git a/hw/tpm/tpm_tis.h b/hw/tpm/tpm_tis.h +index 1531620bf9..6ac9804050 100644 +--- a/hw/tpm/tpm_tis.h ++++ b/hw/tpm/tpm_tis.h +@@ -76,6 +76,7 @@ typedef struct TPMState { + size_t be_buffer_size; + + TPMPPI ppi; ++ bool ppi_enabled; + } TPMState; + + extern const VMStateDescription vmstate_locty; +diff --git a/hw/tpm/tpm_tis_sysbus.c b/hw/tpm/tpm_tis_sysbus.c +index 65ef59edd8..253c394087 100644 +--- a/hw/tpm/tpm_tis_sysbus.c ++++ b/hw/tpm/tpm_tis_sysbus.c +@@ -94,6 +94,7 @@ static void tpm_tis_sysbus_reset(DeviceState *dev) + static const Property tpm_tis_sysbus_properties[] = { + DEFINE_PROP_UINT32("irq", TPMStateSysBus, state.irq_num, TPM_TIS_IRQ), + DEFINE_PROP_TPMBE("tpmdev", TPMStateSysBus, state.be_driver), ++ DEFINE_PROP_BOOL("ppi", TPMStateSysBus, state.ppi_enabled, true), + }; + + static void tpm_tis_sysbus_initfn(Object *obj) +@@ -101,9 +102,7 @@ static void tpm_tis_sysbus_initfn(Object *obj) + TPMStateSysBus *sbdev = TPM_TIS_SYSBUS(obj); + TPMState *s = &sbdev->state; + +- sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio); + sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq); +- sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->ppi.ram); + } + + static void tpm_tis_sysbus_realizefn(DeviceState *dev, Error **errp) +@@ -122,14 +121,19 @@ static void tpm_tis_sysbus_realizefn(DeviceState *dev, Error **errp) + return; + } + +- s->ppi.buf = qemu_memalign(host_page_size, +- ROUND_UP(TPM_PPI_ADDR_SIZE, host_page_size)); + memory_region_init_io(&s->mmio, OBJECT(dev), &tpm_tis_memory_ops, + s, "tpm-tis-mmio", + TPM_TIS_NUM_LOCALITIES << TPM_TIS_LOCALITY_SHIFT); +- memory_region_init_ram_device_ptr(&s->ppi.ram, OBJECT(dev), "tpm-ppi", +- TPM_PPI_ADDR_SIZE, s->ppi.buf); +- vmstate_register_ram(&s->ppi.ram, dev); ++ sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->mmio); ++ ++ if (s->ppi_enabled) { ++ s->ppi.buf = qemu_memalign(host_page_size, ++ ROUND_UP(TPM_PPI_ADDR_SIZE, host_page_size)); ++ memory_region_init_ram_device_ptr(&s->ppi.ram, OBJECT(dev), "tpm-ppi", ++ TPM_PPI_ADDR_SIZE, s->ppi.buf); ++ sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->ppi.ram); ++ vmstate_register_ram(&s->ppi.ram, dev); ++ } + } + + static void tpm_tis_sysbus_class_init(ObjectClass *klass, const void *data) +-- +2.52.0 + diff --git a/kvm-s390x-css-firm-up-handling-of-chained-TIC-CCWs.patch b/kvm-s390x-css-firm-up-handling-of-chained-TIC-CCWs.patch new file mode 100644 index 0000000..876494a --- /dev/null +++ b/kvm-s390x-css-firm-up-handling-of-chained-TIC-CCWs.patch @@ -0,0 +1,88 @@ +From b02928d3eec7a63f029b3881788f7d8bd0780a17 Mon Sep 17 00:00:00 2001 +From: Christoph Schlameuss +Date: Thu, 16 Jul 2026 10:34:43 +0200 +Subject: [PATCH 12/12] s390x/css: firm up handling of chained TIC CCWs + +RH-Author: Christoph Schlameuss +RH-MergeRequest: 510: s390x: interface harding fixes +RH-Jira: RHEL-192791 +RH-Acked-by: Cornelia Huck +RH-Acked-by: acordeir +RH-Commit: [9/9] 19745abb6f8cc576ccf6d561c0c8f1341ffe7ed8 (cschlame/qemu-kvm) + +JIRA: https://redhat.atlassian.net/browse/RHEL-192791 + +commit 33bece0fa121c0a85df4f0372145ca74b967e78e +Author: Eric Farman +Date: Mon Jul 13 09:47:08 2026 +0200 + + s390x/css: firm up handling of chained TIC CCWs + + The logic in css_interpret_ccw() correctly returns -EINVAL if a + Transfer-In-Channel (TIC) CCW is command chained to another TIC CCW. + The same routine also correctly returns -EINVAL if 256 CCWs do not + perform a data transfer as part of the I/O operation [0]. + + What is missing, however, is a combination of these two, where a loop + can be generated that will continue processing CCWs but without + providing an opportunity to catch a breath. Fix this by capping + the number of TIC CCWs in a channel program at the same limit as + the CCWs without data transfer. + + [0] See "Invalid Sequence" in z/Architecture Principles of Operation + (SA22-7832-14), p16-27 + + Cc: qemu-stable@nongnu.org + Signed-off-by: Eric Farman + Acked-by: Christian Borntraeger + Reviewed-by: Farhan Ali + Signed-off-by: Christian Borntraeger + Message-ID: <20260713074708.884282-1-borntraeger@linux.ibm.com> + Signed-off-by: Cornelia Huck + +Signed-off-by: Christoph Schlameuss +--- + hw/s390x/css.c | 7 +++++++ + include/hw/s390x/css.h | 1 + + 2 files changed, 8 insertions(+) + +diff --git a/hw/s390x/css.c b/hw/s390x/css.c +index d89c223339..63947eff5a 100644 +--- a/hw/s390x/css.c ++++ b/hw/s390x/css.c +@@ -1075,6 +1075,12 @@ static int css_interpret_ccw(SubchDev *sch, hwaddr ccw_addr, + ret = -EINVAL; + break; + } ++ /* Limit the number of TICs in a given channel program */ ++ if (sch->ccw_tic_cnt == 255) { ++ ret = -EINVAL; ++ break; ++ } ++ sch->ccw_tic_cnt++; + sch->channel_prog = ccw.cda; + ret = -EAGAIN; + break; +@@ -1126,6 +1132,7 @@ static void sch_handle_start_func_virtual(SubchDev *sch) + sch->ccw_fmt_1 = !!(orb->ctrl0 & ORB_CTRL0_MASK_FMT); + schib->scsw.flags |= (sch->ccw_fmt_1) ? SCSW_FLAGS_MASK_FMT : 0; + sch->ccw_no_data_cnt = 0; ++ sch->ccw_tic_cnt = 0; + suspend_allowed = !!(orb->ctrl0 & ORB_CTRL0_MASK_SPND); + } else { + /* Start Function resumed via rsch */ +diff --git a/include/hw/s390x/css.h b/include/hw/s390x/css.h +index 0b0400a9d4..17385140c3 100644 +--- a/include/hw/s390x/css.h ++++ b/include/hw/s390x/css.h +@@ -132,6 +132,7 @@ struct SubchDev { + bool ccw_fmt_1; + bool thinint_active; + uint8_t ccw_no_data_cnt; ++ uint8_t ccw_tic_cnt; + uint16_t migrated_schid; /* used for mismatch detection */ + CcwDataStream cds; + /* transport-provided data: */ +-- +2.52.0 + diff --git a/kvm-s390x-css-limit-number-of-CHPIDs-in-description.patch b/kvm-s390x-css-limit-number-of-CHPIDs-in-description.patch new file mode 100644 index 0000000..d88c553 --- /dev/null +++ b/kvm-s390x-css-limit-number-of-CHPIDs-in-description.patch @@ -0,0 +1,82 @@ +From 459bb0c6ebf1b985ba2dce97818f7d5b9e46020c Mon Sep 17 00:00:00 2001 +From: Christoph Schlameuss +Date: Sat, 11 Jul 2026 14:58:01 +0200 +Subject: [PATCH 04/12] s390x/css: limit number of CHPIDs in description + +RH-Author: Christoph Schlameuss +RH-MergeRequest: 510: s390x: interface harding fixes +RH-Jira: RHEL-192791 +RH-Acked-by: Cornelia Huck +RH-Acked-by: acordeir +RH-Commit: [1/9] 254d87004bf31f31ee0cc3e203aaa99e9cbd15e2 (cschlame/qemu-kvm) + +JIRA: https://redhat.atlassian.net/browse/RHEL-192791 + +commit 22f2da06a8b291c975a7caf05dbd3b180c856741 +Author: Eric Farman +Date: Tue Jul 7 09:07:28 2026 +0200 + + s390x/css: limit number of CHPIDs in description + + virtio-ccw uses a single virtual CHPID for all devices and + device-types, but vfio-ccw (passthrough) shares real CHPID + information with the guest. A sufficiently large passthrough + configuration would exceed the defined response payload. + + Fix this by limiting the number of CHPID descriptions that + are returned based on the given response format. + + Cc: qemu-stable@nongnu.org + Reviewed-by: Christian Borntraeger + Reviewed-by: Matthew Rosato + Signed-off-by: Eric Farman + Signed-off-by: Christian Borntraeger + Message-ID: <20260707070728.147203-6-borntraeger@linux.ibm.com> + Signed-off-by: Cornelia Huck + +Signed-off-by: Christoph Schlameuss +--- + hw/s390x/css.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/hw/s390x/css.c b/hw/s390x/css.c +index 53444f6828..d89c223339 100644 +--- a/hw/s390x/css.c ++++ b/hw/s390x/css.c +@@ -1871,6 +1871,7 @@ int css_collect_chp_desc(int m, uint8_t cssid, uint8_t f_chpid, uint8_t l_chpid, + int i, desc_size; + uint32_t words[8]; + uint32_t chpid_type_word; ++ uint32_t max_chpids, chpid_count = 0; + CssImage *css; + + if (!m && !cssid) { +@@ -1881,9 +1882,25 @@ int css_collect_chp_desc(int m, uint8_t cssid, uint8_t f_chpid, uint8_t l_chpid, + if (!css) { + return 0; + } ++ ++ if (rfmt == 0) { ++ max_chpids = 256; ++ } else if (rfmt == 1) { ++ max_chpids = 127; ++ } else { ++ /* Should be rejected by caller */ ++ return 0; ++ } ++ + desc_size = 0; + for (i = f_chpid; i <= l_chpid; i++) { + if (css->chpids[i].in_use) { ++ /* Limit number of CHPIDs sent back */ ++ if (chpid_count == max_chpids) { ++ break; ++ } ++ ++ chpid_count++; + chpid_type_word = 0x80000000 | (css->chpids[i].type << 8) | i; + if (rfmt == 0) { + words[0] = cpu_to_be32(chpid_type_word); +-- +2.52.0 + diff --git a/kvm-s390x-ioinst-Require-strict-length-and-format-for-SE.patch b/kvm-s390x-ioinst-Require-strict-length-and-format-for-SE.patch new file mode 100644 index 0000000..d8df1af --- /dev/null +++ b/kvm-s390x-ioinst-Require-strict-length-and-format-for-SE.patch @@ -0,0 +1,87 @@ +From c1dcb5bd9b4f2ed7a057f475861a9ebb72f00f67 Mon Sep 17 00:00:00 2001 +From: Christoph Schlameuss +Date: Sat, 11 Jul 2026 14:58:01 +0200 +Subject: [PATCH 05/12] s390x/ioinst: Require strict length and format for SEI + CHSC handler + +RH-Author: Christoph Schlameuss +RH-MergeRequest: 510: s390x: interface harding fixes +RH-Jira: RHEL-192791 +RH-Acked-by: Cornelia Huck +RH-Acked-by: acordeir +RH-Commit: [2/9] 6d8c4d614b902223a3e926641aac736cbcb596fc (cschlame/qemu-kvm) + +JIRA: https://redhat.atlassian.net/browse/RHEL-192791 + +commit 386268daea86e53d90baf99df5c7b8e2727ea783 +Author: Matthew Rosato +Date: Tue Jul 7 09:07:27 2026 +0200 + + s390x/ioinst: Require strict length and format for SEI CHSC handler + + Ensure SEI commands that are received are of the appropriate length and + format before handling. + + Cc: qemu-stable@nongnu.org + Fixes: 8cba80c3a0 ("s390: Add PCI bus support") + Reviewed-by: Christian Borntraeger + Reviewed-by: Farhan Ali + Reviewed-by: Eric Farman + Signed-off-by: Matthew Rosato + Signed-off-by: Christian Borntraeger + Message-ID: <20260707070728.147203-5-borntraeger@linux.ibm.com> + Signed-off-by: Cornelia Huck + +Signed-off-by: Christoph Schlameuss +--- + target/s390x/ioinst.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/target/s390x/ioinst.c b/target/s390x/ioinst.c +index 2320dd4c12..94619f9215 100644 +--- a/target/s390x/ioinst.c ++++ b/target/s390x/ioinst.c +@@ -609,13 +609,27 @@ static int chsc_sei_nt2_have_event(void) + + #define CHSC_SEI_NT0 (1ULL << 63) + #define CHSC_SEI_NT2 (1ULL << 61) ++#define CHSC_SEI_0_FMT 0x0f000000 + static void ioinst_handle_chsc_sei(ChscReq *req, ChscResp *res) + { + uint64_t selection_mask = ldq_be_p(&req->param1); ++ uint32_t param0 = be32_to_cpu(req->param0); + uint8_t *res_flags = (uint8_t *)res->data; ++ uint16_t len = be16_to_cpu(req->len); ++ uint16_t resp_code; + int have_event = 0; + int have_more = 0; + ++ if (len != 0x0010) { ++ resp_code = 0x0003; ++ goto out_err; ++ } ++ ++ if (param0 & CHSC_SEI_0_FMT) { ++ resp_code = 0x0007; ++ goto out_err; ++ } ++ + /* regarding architecture nt0 can not be masked */ + have_event = !chsc_sei_nt0_get_event(res); + have_more = chsc_sei_nt0_have_event(); +@@ -642,6 +656,12 @@ static void ioinst_handle_chsc_sei(ChscReq *req, ChscResp *res) + res->code = cpu_to_be16(0x0005); + res->len = cpu_to_be16(CHSC_MIN_RESP_LEN); + } ++ return; ++ ++ out_err: ++ res->code = cpu_to_be16(resp_code); ++ res->len = cpu_to_be16(CHSC_MIN_RESP_LEN); ++ res->param = 0; + } + + static void ioinst_handle_chsc_unimplemented(ChscResp *res) +-- +2.52.0 + diff --git a/kvm-s390x-kvm-clamp-stsi-3.2.2-size.patch b/kvm-s390x-kvm-clamp-stsi-3.2.2-size.patch new file mode 100644 index 0000000..3588157 --- /dev/null +++ b/kvm-s390x-kvm-clamp-stsi-3.2.2-size.patch @@ -0,0 +1,59 @@ +From 11005598084892e065466adc25a0cf125c03d826 Mon Sep 17 00:00:00 2001 +From: Christoph Schlameuss +Date: Sat, 11 Jul 2026 14:58:15 +0200 +Subject: [PATCH 09/12] s390x/kvm: clamp stsi 3.2.2 size + +RH-Author: Christoph Schlameuss +RH-MergeRequest: 510: s390x: interface harding fixes +RH-Jira: RHEL-192791 +RH-Acked-by: Cornelia Huck +RH-Acked-by: acordeir +RH-Commit: [6/9] b2551d15e058714d1ca135308a6f9d5e537cd6fe (cschlame/qemu-kvm) + +JIRA: https://redhat.atlassian.net/browse/RHEL-192791 + +commit a57e4612b61da20ddab196502c76b4dc05da1de8 +Author: Christian Borntraeger +Date: Mon Jun 22 11:20:35 2026 +0200 + + s390x/kvm: clamp stsi 3.2.2 size + + The stsi 3.2.2 page is being prepared by the kvm module and the size is + clamped by the kernel. As the memory is mapped in the guest, another + guest VCPU could race and overwrite the count and messing up the move + operation. For any out of bound count, fall back to the kernel buffer. + + Cc: qemu-stable@nongnu.org + Signed-off-by: Christian Borntraeger + Reviewed-by: Eric Farman + Message-ID: <20260622092035.400959-1-borntraeger@linux.ibm.com> + Signed-off-by: Cornelia Huck + +Signed-off-by: Christoph Schlameuss +--- + target/s390x/kvm/kvm.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c +index 491cc5f975..0cbd254655 100644 +--- a/target/s390x/kvm/kvm.c ++++ b/target/s390x/kvm/kvm.c +@@ -1791,6 +1791,15 @@ static void insert_stsi_3_2_2(S390CPU *cpu, __u64 addr, uint8_t ar) + } else if (s390_cpu_virt_mem_read(cpu, addr, ar, &sysib, sizeof(sysib))) { + return; + } ++ ++ /* ++ * The memory was filled by the kernel but mapped into the guest. ++ * If something is fishy, do not touch the buffer. ++ */ ++ if (sysib.count == 0 || sysib.count > ARRAY_SIZE(sysib.ext_names)) { ++ return; ++ } ++ + /* Shift the stack of Extended Names to prepare for our own data */ + memmove(&sysib.ext_names[1], &sysib.ext_names[0], + sizeof(sysib.ext_names[0]) * (sysib.count - 1)); +-- +2.52.0 + diff --git a/kvm-s390x-pci-Shrink-RPCIT-ranges-to-registered-window.patch b/kvm-s390x-pci-Shrink-RPCIT-ranges-to-registered-window.patch new file mode 100644 index 0000000..f4f5147 --- /dev/null +++ b/kvm-s390x-pci-Shrink-RPCIT-ranges-to-registered-window.patch @@ -0,0 +1,75 @@ +From 170dc4d69a492c43d9ed6245abac91ce9ea2a6f1 Mon Sep 17 00:00:00 2001 +From: Christoph Schlameuss +Date: Sat, 11 Jul 2026 14:58:01 +0200 +Subject: [PATCH 06/12] s390x/pci: Shrink RPCIT ranges to registered window + +RH-Author: Christoph Schlameuss +RH-MergeRequest: 510: s390x: interface harding fixes +RH-Jira: RHEL-192791 +RH-Acked-by: Cornelia Huck +RH-Acked-by: acordeir +RH-Commit: [3/9] 50b2f5350069c1e213dac06f8b9c2c002df84525 (cschlame/qemu-kvm) + +JIRA: https://redhat.atlassian.net/browse/RHEL-192791 + +commit b8c8ec1d752661e1904d089c77d8617c4b6bfb5a +Author: Matthew Rosato +Date: Tue Jul 7 09:07:26 2026 +0200 + + s390x/pci: Shrink RPCIT ranges to registered window + + Today, if a RPCIT instruction is presented from the guest whose range + exceeds the previously-registered IOAT, QEMU will process the range + so long as 1) the specified range at least partially overlaps with + what was previously registered and 2) the guest has valid IOAT entries + in its table. If the entries are not present (invalid), then the + RPCIT will unnecessarily spend time reporting the invalid + region/segment entries. + + Optimize this path by exiting immediately if the requested range falls + completely outside of the previously-registered range or if the + requested range ends before it starts (which would only occur if the + guest-specified address + length would overflow a u64). Otherwise, + clamp the request to only the portion of the range that overlaps with + what was previously registered, effectively ignoring the portion + outside of the registered range. + + Cc: qemu-stable@nongnu.org + Fixes: 5d1abf2344 ("s390x/pci: enforce zPCI state checking") + Reviewed-by: Christian Borntraeger + Reviewed-by: Farhan Ali + Signed-off-by: Matthew Rosato + Signed-off-by: Christian Borntraeger + Message-ID: <20260707070728.147203-4-borntraeger@linux.ibm.com> + Signed-off-by: Cornelia Huck + +Signed-off-by: Christoph Schlameuss +--- + hw/s390x/s390-pci-inst.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c +index a3bb5aa221..5a2aa1c12e 100644 +--- a/hw/s390x/s390-pci-inst.c ++++ b/hw/s390x/s390-pci-inst.c +@@ -753,10 +753,16 @@ int rpcit_service_call(S390CPU *cpu, uint8_t r1, uint8_t r2, uintptr_t ra) + goto err; + } + +- if (end < iommu->pba || start > iommu->pal) { ++ if (end < start || end < iommu->pba || start > iommu->pal) { + error = ERR_EVENT_OORANGE; + goto err; + } ++ /* ++ * If the specified range at least partially overlaps the registered ++ * aperture, clamp the request to the aperture and ignore the rest. ++ */ ++ sstart = MAX(start, iommu->pba); ++ end = MIN(end, iommu->pal + 1); + + retry: + start = sstart; +-- +2.52.0 + diff --git a/kvm-s390x-pci-Tighten-region-detection-for-BAR-read-writ.patch b/kvm-s390x-pci-Tighten-region-detection-for-BAR-read-writ.patch new file mode 100644 index 0000000..3078a30 --- /dev/null +++ b/kvm-s390x-pci-Tighten-region-detection-for-BAR-read-writ.patch @@ -0,0 +1,104 @@ +From 624da84e824b854a9cbd64be087627d6991f8358 Mon Sep 17 00:00:00 2001 +From: Christoph Schlameuss +Date: Sat, 11 Jul 2026 14:58:15 +0200 +Subject: [PATCH 07/12] s390x/pci: Tighten region detection for BAR read/write + +RH-Author: Christoph Schlameuss +RH-MergeRequest: 510: s390x: interface harding fixes +RH-Jira: RHEL-192791 +RH-Acked-by: Cornelia Huck +RH-Acked-by: acordeir +RH-Commit: [4/9] 187be7e6318f69afd409a43a36ebc9ecfb295dec (cschlame/qemu-kvm) + +JIRA: https://redhat.atlassian.net/browse/RHEL-192791 + +commit 2d709a70c75724e972126671b2e2c0fca0b6e239 +Author: Matthew Rosato +Date: Tue Jul 7 09:07:25 2026 +0200 + + s390x/pci: Tighten region detection for BAR read/write + + For PCISTG/PCISTB/PCILG instruction emulation, ensure that the offset + and length provided by the guest does not overflow, and only return + a memory region when the specified offset+length combination matches + an existing subregion or the parent region. + + Cc: qemu-stable@nongnu.org + Fixes: 4f6482bfe3 ("s390x/pci: search for subregion inside the BARs") + Signed-off-by: Matthew Rosato + Reviewed-by: Christian Borntraeger + Reviewed-by: Farhan Ali + Signed-off-by: Christian Borntraeger + Message-ID: <20260707070728.147203-3-borntraeger@linux.ibm.com> + Signed-off-by: Cornelia Huck + +Signed-off-by: Christoph Schlameuss +--- + hw/s390x/s390-pci-inst.c | 24 +++++++++++++++++++++++- + 1 file changed, 23 insertions(+), 1 deletion(-) + +diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c +index 5a2aa1c12e..17d74d8542 100644 +--- a/hw/s390x/s390-pci-inst.c ++++ b/hw/s390x/s390-pci-inst.c +@@ -392,13 +392,22 @@ static int zpci_endian_swap(uint64_t *ptr, uint8_t len) + static MemoryRegion *s390_get_subregion(MemoryRegion *mr, uint64_t offset, + uint8_t len) + { ++ uint64_t last = offset + len; + MemoryRegion *subregion; + uint64_t subregion_size; + ++ /* ++ * Ensure the region is valid, the calculated address cannot wrap and that ++ * it falls within this region. ++ */ ++ if (!mr || offset > last || last > memory_region_size(mr)) { ++ return NULL; ++ } ++ + QTAILQ_FOREACH(subregion, &mr->subregions, subregions_link) { + subregion_size = int128_get64(subregion->size); + if ((offset >= subregion->addr) && +- (offset + len) <= (subregion->addr + subregion_size)) { ++ (last) <= (subregion->addr + subregion_size)) { + mr = subregion; + break; + } +@@ -413,6 +422,10 @@ static MemTxResult zpci_read_bar(S390PCIBusDevice *pbdev, uint8_t pcias, + + mr = pbdev->pdev->io_regions[pcias].memory; + mr = s390_get_subregion(mr, offset, len); ++ if (!mr) { ++ return MEMTX_ERROR; ++ } ++ + offset -= mr->addr; + return memory_region_dispatch_read(mr, offset, data, + size_memop(len) | MO_BE, +@@ -513,6 +526,10 @@ static MemTxResult zpci_write_bar(S390PCIBusDevice *pbdev, uint8_t pcias, + + mr = pbdev->pdev->io_regions[pcias].memory; + mr = s390_get_subregion(mr, offset, len); ++ if (!mr) { ++ return MEMTX_ERROR; ++ } ++ + offset -= mr->addr; + return memory_region_dispatch_write(mr, offset, data, + size_memop(len) | MO_BE, +@@ -906,6 +923,11 @@ int pcistb_service_call(S390CPU *cpu, uint8_t r1, uint8_t r3, uint64_t gaddr, + + mr = pbdev->pdev->io_regions[pcias].memory; + mr = s390_get_subregion(mr, offset, len); ++ if (!mr) { ++ s390_program_interrupt(env, PGM_OPERAND, ra); ++ return 0; ++ } ++ + offset -= mr->addr; + + for (i = 0; i < len; i += 8) { +-- +2.52.0 + diff --git a/kvm-s390x-sclp-prevent-re-reading-the-sclp-header.patch b/kvm-s390x-sclp-prevent-re-reading-the-sclp-header.patch new file mode 100644 index 0000000..c6a790c --- /dev/null +++ b/kvm-s390x-sclp-prevent-re-reading-the-sclp-header.patch @@ -0,0 +1,66 @@ +From e2c3b08190f32460c9046fd71da7ea96fdca4afe Mon Sep 17 00:00:00 2001 +From: Christoph Schlameuss +Date: Thu, 16 Jul 2026 10:34:43 +0200 +Subject: [PATCH 10/12] s390x/sclp: prevent re-reading the sclp header + +RH-Author: Christoph Schlameuss +RH-MergeRequest: 510: s390x: interface harding fixes +RH-Jira: RHEL-192791 +RH-Acked-by: Cornelia Huck +RH-Acked-by: acordeir +RH-Commit: [7/9] f84a26f6a6546cc221689dff2a415053462bf4ab (cschlame/qemu-kvm) + +JIRA: https://redhat.atlassian.net/browse/RHEL-192791 + +commit 20701190e023216d0213a107a491402ce2cc501e +Author: Christian Borntraeger +Date: Thu Jul 9 16:29:05 2026 +0200 + + s390x/sclp: prevent re-reading the sclp header + + We verify the sccb length and then allocate based on that length. The + following access re-reads the sccb again. This can race against other + vCPUs overwriting the length field. + + sclp_service_call_protected does not need a change as the ultravisor + provides a consistent snapshot. + + Fixes: c1db53a5910f ("s390/sclp: read sccb from mem based on provided length") + Cc: qemu-stable@nongnu.org + Signed-off-by: Christian Borntraeger + Reviewed-by: Matthew Rosato + Reviewed-by: Eric Farman + Reviewed-by: Collin Walling + Message-ID: <20260709142906.197474-2-borntraeger@linux.ibm.com> + Signed-off-by: Cornelia Huck + +Conflicts: target code is still using cpu_physical_memory_read() instead + of upsteam having switched to address_space_read() and + handling possible errors; sticking to old behavior for now + +Signed-off-by: Christoph Schlameuss +--- + hw/s390x/sclp.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/hw/s390x/sclp.c b/hw/s390x/sclp.c +index 16057356b1..27a354029c 100644 +--- a/hw/s390x/sclp.c ++++ b/hw/s390x/sclp.c +@@ -328,10 +328,12 @@ int sclp_service_call(S390CPU *cpu, uint64_t sccb, uint32_t code) + /* + * we want to work on a private copy of the sccb, to prevent guests + * from playing dirty tricks by modifying the memory content after +- * the host has checked the values ++ * the host has checked the values. ++ * Reuse the previously fetched header + */ + work_sccb = g_malloc0(be16_to_cpu(header.length)); + cpu_physical_memory_read(sccb, work_sccb, be16_to_cpu(header.length)); ++ work_sccb->h = header; + + if (!sclp_command_code_valid(code)) { + work_sccb->h.response_code = cpu_to_be16(SCLP_RC_INVALID_SCLP_COMMAND); +-- +2.52.0 + diff --git a/kvm-s390x-sclp-reject-invalid-write-event-data-headers.patch b/kvm-s390x-sclp-reject-invalid-write-event-data-headers.patch new file mode 100644 index 0000000..3c3b02c --- /dev/null +++ b/kvm-s390x-sclp-reject-invalid-write-event-data-headers.patch @@ -0,0 +1,71 @@ +From 603081937866d300dc72d26a782168564478a8f4 Mon Sep 17 00:00:00 2001 +From: Christoph Schlameuss +Date: Sat, 11 Jul 2026 14:58:15 +0200 +Subject: [PATCH 08/12] s390x/sclp: reject invalid write event data headers +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +RH-Author: Christoph Schlameuss +RH-MergeRequest: 510: s390x: interface harding fixes +RH-Jira: RHEL-192791 +RH-Acked-by: Cornelia Huck +RH-Acked-by: acordeir +RH-Commit: [5/9] b38f0d679531edbc7f9f1ebaa8b6b8e5bd385292 (cschlame/qemu-kvm) + +JIRA: https://redhat.atlassian.net/browse/RHEL-192791 + +commit d88cd8f5570f4d6e08d62e098a8b7f53cdc75536 +Author: Christian Borntraeger +Date: Tue Jul 7 09:07:24 2026 +0200 + + s390x/sclp: reject invalid write event data headers + + If a guest submits an sccb with a tiny header length but a large number + of event mask entries, the write_event_mask handler will + 1. return the wrong RC (ok instead of error) + 2. write to memory after the allocated sccb in qemu host memory. + + Add the necessary checks. + + Cc: qemu-stable@nongnu.org + Reviewed-by: Hendrik Brueckner + Reviewed-by: Matthew Rosato + Reviewed-by: Eric Farman + Reviewed-by: Philippe Mathieu-Daudé + Signed-off-by: Christian Borntraeger + Message-ID: <20260707070728.147203-2-borntraeger@linux.ibm.com> + Signed-off-by: Cornelia Huck + +Signed-off-by: Christoph Schlameuss +--- + hw/s390x/event-facility.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/hw/s390x/event-facility.c b/hw/s390x/event-facility.c +index fee286ea63..184c469bd3 100644 +--- a/hw/s390x/event-facility.c ++++ b/hw/s390x/event-facility.c +@@ -286,6 +286,7 @@ static void read_event_data(SCLPEventFacility *ef, SCCB *sccb) + static void write_event_mask(SCLPEventFacility *ef, SCCB *sccb) + { + WriteEventMask *we_mask = (WriteEventMask *) sccb; ++ uint16_t sccb_length = be16_to_cpu(sccb->h.length); + uint16_t mask_length = be16_to_cpu(we_mask->mask_length); + sccb_mask_t tmp_mask; + +@@ -294,6 +295,11 @@ static void write_event_mask(SCLPEventFacility *ef, SCCB *sccb) + return; + } + ++ if (sccb_length < sizeof(WriteEventMask) + 4 * mask_length) { ++ sccb->h.response_code = cpu_to_be16(SCLP_RC_INSUFFICIENT_SCCB_LENGTH); ++ return; ++ } ++ + /* + * Note: We currently only support masks up to 8 byte length; + * the remainder is filled up with zeroes. Older Linux +-- +2.52.0 + diff --git a/kvm-s390x-sclpcpi-check-event-length-field-before-readin.patch b/kvm-s390x-sclpcpi-check-event-length-field-before-readin.patch new file mode 100644 index 0000000..111da97 --- /dev/null +++ b/kvm-s390x-sclpcpi-check-event-length-field-before-readin.patch @@ -0,0 +1,58 @@ +From 7b4c4fc735e983f616c42a55022f6900687b4b05 Mon Sep 17 00:00:00 2001 +From: Christoph Schlameuss +Date: Thu, 16 Jul 2026 10:34:43 +0200 +Subject: [PATCH 11/12] s390x/sclpcpi: check event length field before reading + from buffer + +RH-Author: Christoph Schlameuss +RH-MergeRequest: 510: s390x: interface harding fixes +RH-Jira: RHEL-192791 +RH-Acked-by: Cornelia Huck +RH-Acked-by: acordeir +RH-Commit: [8/9] b28bf870b91442a2d450dd0a6afee4d5673cc694 (cschlame/qemu-kvm) + +JIRA: https://redhat.atlassian.net/browse/RHEL-192791 + +commit 8a116a28535c34b001e68b52f85d6be3acb75350 +Author: Christian Borntraeger +Date: Thu Jul 9 16:29:06 2026 +0200 + + s390x/sclpcpi: check event length field before reading from buffer + + A guest might send a too short SCCB with SCLP_EVENT_CTRL_PGM_ID. QEMU + would fill its data structures with garbage data. Check for the precise + length of the CBI data structure and reject otherwise. + + Fixes: f345978f24be ("hw/s390x: add Control-Program Identification to QOM") + Cc: qemu-stable@nongnu.org + Signed-off-by: Christian Borntraeger + Reviewed-by: Matthew Rosato + Reviewed-by: Janosch Frank + Reviewed-by: Eric Farman + Message-ID: <20260709142906.197474-3-borntraeger@linux.ibm.com> + Signed-off-by: Cornelia Huck + +Signed-off-by: Christoph Schlameuss +--- + hw/s390x/sclpcpi.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/hw/s390x/sclpcpi.c b/hw/s390x/sclpcpi.c +index 68fc1b809b..ec4bdf2350 100644 +--- a/hw/s390x/sclpcpi.c ++++ b/hw/s390x/sclpcpi.c +@@ -97,6 +97,11 @@ static int write_event_data(SCLPEvent *event, EventBufferHeader *evt_buf_hdr) + ebh); + SCLPEventCPI *e = SCLP_EVENT_CPI(event); + ++ /* Caller checks sccb length, buffer header checking is our duty */ ++ if (be16_to_cpu(evt_buf_hdr->length) != sizeof(ControlProgramIdMsg)) { ++ return SCLP_RC_INCONSISTENT_LENGTHS; ++ } ++ + ascii_put(e->system_type, (char *)cpim->data.system_type, + sizeof(cpim->data.system_type)); + ascii_put(e->system_name, (char *)cpim->data.system_name, +-- +2.52.0 + diff --git a/qemu-kvm.spec b/qemu-kvm.spec index 1cbb795..9c16ba0 100644 --- a/qemu-kvm.spec +++ b/qemu-kvm.spec @@ -143,7 +143,7 @@ Obsoletes: %{name}-block-ssh <= %{epoch}:%{version} \ Summary: QEMU is a machine emulator and virtualizer Name: qemu-kvm Version: 10.1.0 -Release: 24%{?rcrel}%{?dist}%{?cc_suffix} +Release: 25%{?rcrel}%{?dist}%{?cc_suffix} # Epoch because we pushed a qemu-1.0 package. AIUI this can't ever be dropped # Epoch 15 used for RHEL 8 # Epoch 17 used for RHEL 9 (due to release versioning offset in RHEL 8.5) @@ -1648,6 +1648,30 @@ Patch465: kvm-docs-creation-of-x509-certs-compliant-with-post-quan.patch Patch466: kvm-iommufd-Introduce-handler-for-device-ATS-support.patch # For RHEL-184675 - NVIDIA:Backport vfio/pci: add vfio-pci ATS control property - RHEL 10.3 Patch467: kvm-vfio-pci-Add-ats-property.patch +# For RHEL-180837 - [aarch64] Live migration of TPM-equipped guests fails: Unknown ramblock "tpm-ppi" (qemu-kvm-10.1.0-19.el10 → older builds) +Patch468: kvm-hw-core-platform-bus-guard-platform_bus_get_mmio_add.patch +# For RHEL-180837 - [aarch64] Live migration of TPM-equipped guests fails: Unknown ramblock "tpm-ppi" (qemu-kvm-10.1.0-19.el10 → older builds) +Patch469: kvm-hw-tpm-gate-PPI-support-on-tpm-tis-device-behind-a-d.patch +# For RHEL-180837 - [aarch64] Live migration of TPM-equipped guests fails: Unknown ramblock "tpm-ppi" (qemu-kvm-10.1.0-19.el10 → older builds) +Patch470: kvm-hw-tpm-default-tpm-tis-device-PPI-to-disabled.patch +# For RHEL-192791 - RHEL10.0 - qemu s390x: interface harding fixes +Patch471: kvm-s390x-css-limit-number-of-CHPIDs-in-description.patch +# For RHEL-192791 - RHEL10.0 - qemu s390x: interface harding fixes +Patch472: kvm-s390x-ioinst-Require-strict-length-and-format-for-SE.patch +# For RHEL-192791 - RHEL10.0 - qemu s390x: interface harding fixes +Patch473: kvm-s390x-pci-Shrink-RPCIT-ranges-to-registered-window.patch +# For RHEL-192791 - RHEL10.0 - qemu s390x: interface harding fixes +Patch474: kvm-s390x-pci-Tighten-region-detection-for-BAR-read-writ.patch +# For RHEL-192791 - RHEL10.0 - qemu s390x: interface harding fixes +Patch475: kvm-s390x-sclp-reject-invalid-write-event-data-headers.patch +# For RHEL-192791 - RHEL10.0 - qemu s390x: interface harding fixes +Patch476: kvm-s390x-kvm-clamp-stsi-3.2.2-size.patch +# For RHEL-192791 - RHEL10.0 - qemu s390x: interface harding fixes +Patch477: kvm-s390x-sclp-prevent-re-reading-the-sclp-header.patch +# For RHEL-192791 - RHEL10.0 - qemu s390x: interface harding fixes +Patch478: kvm-s390x-sclpcpi-check-event-length-field-before-readin.patch +# For RHEL-192791 - RHEL10.0 - qemu s390x: interface harding fixes +Patch479: kvm-s390x-css-firm-up-handling-of-chained-TIC-CCWs.patch %if %{have_clang} BuildRequires: clang @@ -2730,6 +2754,24 @@ useradd -r -u 107 -g qemu -G kvm -d / -s /sbin/nologin \ %endif %changelog +* Mon Aug 03 2026 Miroslav Rezanina - 10.1.0-25 +- kvm-hw-core-platform-bus-guard-platform_bus_get_mmio_add.patch [RHEL-180837] +- kvm-hw-tpm-gate-PPI-support-on-tpm-tis-device-behind-a-d.patch [RHEL-180837] +- kvm-hw-tpm-default-tpm-tis-device-PPI-to-disabled.patch [RHEL-180837] +- kvm-s390x-css-limit-number-of-CHPIDs-in-description.patch [RHEL-192791] +- kvm-s390x-ioinst-Require-strict-length-and-format-for-SE.patch [RHEL-192791] +- kvm-s390x-pci-Shrink-RPCIT-ranges-to-registered-window.patch [RHEL-192791] +- kvm-s390x-pci-Tighten-region-detection-for-BAR-read-writ.patch [RHEL-192791] +- kvm-s390x-sclp-reject-invalid-write-event-data-headers.patch [RHEL-192791] +- kvm-s390x-kvm-clamp-stsi-3.2.2-size.patch [RHEL-192791] +- kvm-s390x-sclp-prevent-re-reading-the-sclp-header.patch [RHEL-192791] +- kvm-s390x-sclpcpi-check-event-length-field-before-readin.patch [RHEL-192791] +- kvm-s390x-css-firm-up-handling-of-chained-TIC-CCWs.patch [RHEL-192791] +- Resolves: RHEL-180837 + ([aarch64] Live migration of TPM-equipped guests fails: Unknown ramblock "tpm-ppi" (qemu-kvm-10.1.0-19.el10 → older builds)) +- Resolves: RHEL-192791 + (RHEL10.0 - qemu s390x: interface harding fixes) + * Fri Jul 10 2026 Miroslav Rezanina - 10.1.0-24 - kvm-net-tap-linux.c-avoid-abort-when-setting-invalid-fd.patch [RHEL-113894] - kvm-crypto-only-verify-CA-certs-in-chain-of-trust.patch [RHEL-111934]