diff --git a/kvm-hw-vfio-align-mmap-to-power-of-2-of-region-size-for-.patch b/kvm-hw-vfio-align-mmap-to-power-of-2-of-region-size-for-.patch new file mode 100644 index 0000000..5a21526 --- /dev/null +++ b/kvm-hw-vfio-align-mmap-to-power-of-2-of-region-size-for-.patch @@ -0,0 +1,186 @@ +From 3107adc6f949c4e6b92d78c3311f2aad3e3bdc85 Mon Sep 17 00:00:00 2001 +From: Ankit Agrawal +Date: Tue, 17 Feb 2026 15:30:10 +0000 +Subject: [PATCH 3/4] hw/vfio: align mmap to power-of-2 of region size for + hugepfnmap +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +RH-Author: Cédric Le Goater +RH-MergeRequest: 500: NVIDIA:Grace:Backport hw/vfio: Enable hugepfnmap for non-power-of-2 device memory regions - GB200 +RH-Jira: RHEL-150900 +RH-Acked-by: Rodolfo Vick +RH-Acked-by: Miroslav Rezanina +RH-Commit: [3/3] 34c31321e6c6613b7de013250a7f2927046b831d (clegoate/qemu-kvm-centos) + +On Grace-based systems such as GB200, device memory is exposed as a +BAR but the actual mappable size is not power-of-2 aligned. The +previous algorithm aligned each sparse mmap area based on its +individual size using ctz64() which prevented efficient huge page +usage by the kernel. + +Adjust VFIO region mapping alignment to use the next power-of-2 of +the total region size and place the sparse subregions at their +appropriate offset. This provides better opportunities to get huge +alignment allowing the kernel to use larger page sizes for the VMA. + +This enables the use of PMD-level huge pages which can significantly +improve memory access performance and reduce TLB pressure for large +device memory regions. + +With this change: +- Create a single aligned base mapping for the entire region +- Change Alignment to be based on pow2ceil(region->size), capped at 1GiB +- Unmap gaps between sparse regions +- Use MAP_FIXED to overlay sparse mmap areas at their offsets + +Example VMA for device memory of size 0x2F00F00000 on GB200: + +Before (misaligned, no hugepfnmap): +ff88ff000000-ffb7fff00000 rw-s 400000000000 00:06 727 /dev/vfio/devices/vfio1 + +After (aligned to 1GiB boundary, hugepfnmap enabled): +ff8ac0000000-ffb9c0f00000 rw-s 400000000000 00:06 727 /dev/vfio/devices/vfio1 + +Requires sparse regions to be sorted by offset (done in previous +patch) to correctly identify and handle gaps. + +cc: Alex Williamson +Reviewed-by: Alex Williamson +Reviewed-by: Shameer Kolothum +Suggested-by: Jason Gunthorpe +Signed-off-by: Ankit Agrawal +Reviewed-by: Cédric Le Goater +Link: https://lore.kernel.org/qemu-devel/20260217153010.408739-4-ankita@nvidia.com +Signed-off-by: Cédric Le Goater +(cherry picked from commit 3863e47828d5bda1776fb7588a2187c7fba1d0c2) +Signed-off-by: Cédric Le Goater +--- + hw/vfio/region.c | 86 +++++++++++++++++++++++++++++++++--------------- + 1 file changed, 59 insertions(+), 27 deletions(-) + +diff --git a/hw/vfio/region.c b/hw/vfio/region.c +index 055033a79e..1e9915fdd3 100644 +--- a/hw/vfio/region.c ++++ b/hw/vfio/region.c +@@ -344,8 +344,11 @@ static bool vfio_region_create_dma_buf(VFIORegion *region, Error **errp) + + int vfio_region_mmap(VFIORegion *region) + { +- int i, ret, prot = 0; ++ void *map_base, *map_align; + Error *local_err = NULL; ++ int i, ret, prot = 0; ++ off_t map_offset = 0; ++ size_t align; + char *name; + int fd; + +@@ -356,41 +359,61 @@ int vfio_region_mmap(VFIORegion *region) + prot |= region->flags & VFIO_REGION_INFO_FLAG_READ ? PROT_READ : 0; + prot |= region->flags & VFIO_REGION_INFO_FLAG_WRITE ? PROT_WRITE : 0; + +- for (i = 0; i < region->nr_mmaps; i++) { +- size_t align = MIN(1ULL << ctz64(region->mmaps[i].size), 1 * GiB); +- void *map_base, *map_align; ++ /* ++ * Align the mmap for more efficient mapping in the kernel. Ideally ++ * we'd know the PMD and PUD mapping sizes to use as discrete alignment ++ * intervals, but we don't. As of Linux v6.19, the largest PUD size ++ * supporting huge pfnmap is 1GiB (ARCH_SUPPORTS_PUD_PFNMAP is only set ++ * on x86_64). ++ * ++ * Align by power-of-two of the size of the entire region - capped ++ * by 1G - and place the sparse subregions at their appropriate offset. ++ * This will get maximum alignment. ++ * ++ * NB. qemu_memalign() and friends actually allocate memory, whereas ++ * the region size here can exceed host memory, therefore we manually ++ * create an oversized anonymous mapping and clean it up for alignment. ++ */ + +- /* +- * Align the mmap for more efficient mapping in the kernel. Ideally +- * we'd know the PMD and PUD mapping sizes to use as discrete alignment +- * intervals, but we don't. As of Linux v6.12, the largest PUD size +- * supporting huge pfnmap is 1GiB (ARCH_SUPPORTS_PUD_PFNMAP is only set +- * on x86_64). Align by power-of-two size, capped at 1GiB. +- * +- * NB. qemu_memalign() and friends actually allocate memory, whereas +- * the region size here can exceed host memory, therefore we manually +- * create an oversized anonymous mapping and clean it up for alignment. +- */ +- map_base = mmap(0, region->mmaps[i].size + align, PROT_NONE, +- MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); +- if (map_base == MAP_FAILED) { +- ret = -errno; +- goto no_mmap; +- } ++ align = MIN(pow2ceil(region->size), 1 * GiB); + +- fd = vfio_device_get_region_fd(region->vbasedev, region->nr); ++ map_base = mmap(0, region->size + align, PROT_NONE, ++ MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); ++ if (map_base == MAP_FAILED) { ++ ret = -errno; ++ trace_vfio_region_mmap_fault(memory_region_name(region->mem), -1, ++ region->fd_offset, ++ region->fd_offset + region->size - 1, ret); ++ return ret; ++ } ++ ++ fd = vfio_device_get_region_fd(region->vbasedev, region->nr); + +- map_align = (void *)ROUND_UP((uintptr_t)map_base, (uintptr_t)align); +- munmap(map_base, map_align - map_base); +- munmap(map_align + region->mmaps[i].size, +- align - (map_align - map_base)); ++ map_align = (void *)ROUND_UP((uintptr_t)map_base, (uintptr_t)align); ++ munmap(map_base, map_align - map_base); ++ munmap(map_align + region->size, ++ align - (map_align - map_base)); + +- region->mmaps[i].mmap = mmap(map_align, region->mmaps[i].size, prot, ++ /* ++ * Regions should already be sorted by vfio_setup_region_sparse_mmaps(). ++ * This is critical for the following algorithm which relies on range ++ * offsets being in ascending order. ++ */ ++ for (i = 0; i < region->nr_mmaps; i++) { ++ munmap(map_align + map_offset, region->mmaps[i].offset - map_offset); ++ region->mmaps[i].mmap = mmap(map_align + region->mmaps[i].offset, ++ region->mmaps[i].size, prot, + MAP_SHARED | MAP_FIXED, fd, + region->fd_offset + + region->mmaps[i].offset); + if (region->mmaps[i].mmap == MAP_FAILED) { + ret = -errno; ++ /* ++ * Only unmap the rest of the region. Any mmaps that were successful ++ * will be unmapped in no_mmap. ++ */ ++ munmap(map_align + region->mmaps[i].offset, ++ region->size - region->mmaps[i].offset); + goto no_mmap; + } + +@@ -408,6 +431,15 @@ int vfio_region_mmap(VFIORegion *region) + region->mmaps[i].offset, + region->mmaps[i].offset + + region->mmaps[i].size - 1); ++ ++ map_offset = region->mmaps[i].offset + region->mmaps[i].size; ++ } ++ ++ /* ++ * Unmap the rest of the region not covered by sparse mmap. ++ */ ++ if (map_offset < region->size) { ++ munmap(map_align + map_offset, region->size - map_offset); + } + + if (!vfio_region_create_dma_buf(region, &local_err)) { +-- +2.52.0 + diff --git a/kvm-hw-vfio-sort-and-validate-sparse-mmap-regions-by-off.patch b/kvm-hw-vfio-sort-and-validate-sparse-mmap-regions-by-off.patch new file mode 100644 index 0000000..8d4aea5 --- /dev/null +++ b/kvm-hw-vfio-sort-and-validate-sparse-mmap-regions-by-off.patch @@ -0,0 +1,121 @@ +From d0ac3ec4e1dc8ede0d4ea9bba020aa42845d2b0e Mon Sep 17 00:00:00 2001 +From: Ankit Agrawal +Date: Tue, 17 Feb 2026 15:30:08 +0000 +Subject: [PATCH 1/4] hw/vfio: sort and validate sparse mmap regions by offset +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +RH-Author: Cédric Le Goater +RH-MergeRequest: 500: NVIDIA:Grace:Backport hw/vfio: Enable hugepfnmap for non-power-of-2 device memory regions - GB200 +RH-Jira: RHEL-150900 +RH-Acked-by: Rodolfo Vick +RH-Acked-by: Miroslav Rezanina +RH-Commit: [1/3] d3a69bde63db8369e77d3703771fab637c9157a7 (clegoate/qemu-kvm-centos) + +Sort sparse mmap regions by offset during region setup to ensure +predictable mapping order, avoid overlaps and a proper handling +of the gaps between sub-regions. + +Add validation to detect overlapping sparse regions early during +setup before any mapping operations begin. + +The sorting is performed on the subregions ranges during +vfio_setup_region_sparse_mmaps(). This also ensures that subsequent +mapping code can rely on subregions being in ascending offset order. + +This is preparatory work for alignment adjustments needed to support +hugepfnmap on systems where device memory (e.g., Grace-based systems) +may have non-power-of-2 sizes. + +cc: Alex Williamson +Reviewed-by: Alex Williamson +Reviewed-by: Shameer Kolothum +Signed-off-by: Ankit Agrawal +Reviewed-by: Cédric Le Goater +Link: https://lore.kernel.org/qemu-devel/20260217153010.408739-2-ankita@nvidia.com +Signed-off-by: Cédric Le Goater +(cherry picked from commit da02b21cc70ef04a9ad15198f33551f17c94dff5) +Signed-off-by: Cédric Le Goater +--- + hw/vfio/region.c | 46 +++++++++++++++++++++++++++++++++++++++++++++- + 1 file changed, 45 insertions(+), 1 deletion(-) + +diff --git a/hw/vfio/region.c b/hw/vfio/region.c +index 1deaef12fd..a61e47a79c 100644 +--- a/hw/vfio/region.c ++++ b/hw/vfio/region.c +@@ -149,6 +149,19 @@ static const MemoryRegionOps vfio_region_ops = { + }, + }; + ++static int vfio_mmap_compare_offset(const void *a, const void *b) ++{ ++ const VFIOMmap *mmap_a = a; ++ const VFIOMmap *mmap_b = b; ++ ++ if (mmap_a->offset < mmap_b->offset) { ++ return -1; ++ } else if (mmap_a->offset > mmap_b->offset) { ++ return 1; ++ } ++ return 0; ++} ++ + static int vfio_setup_region_sparse_mmaps(VFIORegion *region, + struct vfio_region_info *info) + { +@@ -182,6 +195,35 @@ static int vfio_setup_region_sparse_mmaps(VFIORegion *region, + region->nr_mmaps = j; + region->mmaps = g_realloc(region->mmaps, j * sizeof(VFIOMmap)); + ++ /* ++ * Sort sparse mmaps by offset to ensure proper handling of gaps ++ * and predictable mapping order in vfio_region_mmap(). ++ */ ++ if (region->nr_mmaps > 1) { ++ qsort(region->mmaps, region->nr_mmaps, sizeof(VFIOMmap), ++ vfio_mmap_compare_offset); ++ ++ /* ++ * Validate that sparse regions don't overlap after sorting. ++ */ ++ for (i = 1; i < region->nr_mmaps; i++) { ++ off_t prev_end = region->mmaps[i - 1].offset + ++ region->mmaps[i - 1].size; ++ if (prev_end > region->mmaps[i].offset) { ++ error_report("%s: overlapping sparse mmap regions detected " ++ "in region %d: [0x%"PRIx64"-0x%"PRIx64"] overlaps " ++ "with [0x%"PRIx64"-0x%"PRIx64"]", ++ __func__, region->nr, region->mmaps[i - 1].offset, ++ prev_end - 1, region->mmaps[i].offset, ++ region->mmaps[i].offset + region->mmaps[i].size - 1); ++ g_free(region->mmaps); ++ region->mmaps = NULL; ++ region->nr_mmaps = 0; ++ return -EINVAL; ++ } ++ } ++ } ++ + return 0; + } + +@@ -213,11 +255,13 @@ int vfio_region_setup(Object *obj, VFIODevice *vbasedev, VFIORegion *region, + + ret = vfio_setup_region_sparse_mmaps(region, info); + +- if (ret) { ++ if (ret == -ENODEV) { + region->nr_mmaps = 1; + region->mmaps = g_new0(VFIOMmap, region->nr_mmaps); + region->mmaps[0].offset = 0; + region->mmaps[0].size = region->size; ++ } else if (ret) { ++ return ret; + } + } + } +-- +2.52.0 + diff --git a/kvm-vfio-Add-Error-parameter-to-vfio_region_setup.patch b/kvm-vfio-Add-Error-parameter-to-vfio_region_setup.patch new file mode 100644 index 0000000..4331a6c --- /dev/null +++ b/kvm-vfio-Add-Error-parameter-to-vfio_region_setup.patch @@ -0,0 +1,147 @@ +From e4a9b1a603140f3e07aafed06d545125e856b608 Mon Sep 17 00:00:00 2001 +From: Ankit Agrawal +Date: Tue, 17 Feb 2026 15:30:09 +0000 +Subject: [PATCH 2/4] vfio: Add Error ** parameter to vfio_region_setup() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +RH-Author: Cédric Le Goater +RH-MergeRequest: 500: NVIDIA:Grace:Backport hw/vfio: Enable hugepfnmap for non-power-of-2 device memory regions - GB200 +RH-Jira: RHEL-150900 +RH-Acked-by: Rodolfo Vick +RH-Acked-by: Miroslav Rezanina +RH-Commit: [2/3] ae95924770d3a7828fc3d67df36fc6d09baf2e97 (clegoate/qemu-kvm-centos) + +Add an Error **errp parameter to vfio_region_setup() and +vfio_setup_region_sparse_mmaps to allow proper error handling +instead of just returning error codes. + +The function sets errors via error_setg() when failure occur. + +Suggested-by: Cedric Le Goater +Signed-off-by: Ankit Agrawal +Reviewed-by: Cédric Le Goater +Link: https://lore.kernel.org/qemu-devel/20260217153010.408739-3-ankita@nvidia.com +Signed-off-by: Cédric Le Goater +(cherry picked from commit c42010197eb905fe826550bb5f7c236d5534ddb4) +Signed-off-by: Cédric Le Goater +--- + hw/vfio/display.c | 6 +++--- + hw/vfio/pci.c | 3 +-- + hw/vfio/region.c | 20 +++++++++++--------- + hw/vfio/vfio-region.h | 2 +- + 4 files changed, 16 insertions(+), 15 deletions(-) + +diff --git a/hw/vfio/display.c b/hw/vfio/display.c +index faacd9019a..5a42a6f7a2 100644 +--- a/hw/vfio/display.c ++++ b/hw/vfio/display.c +@@ -446,13 +446,13 @@ static void vfio_display_region_update(void *opaque) + + if (!dpy->region.buffer.size) { + /* mmap region */ ++ Error *error = NULL; + ret = vfio_region_setup(OBJECT(vdev), &vdev->vbasedev, + &dpy->region.buffer, + plane.region_index, +- "display"); ++ "display", &error); + if (ret != 0) { +- error_report("%s: vfio_region_setup(%d): %s", +- __func__, plane.region_index, strerror(-ret)); ++ error_report_err(error); + goto err; + } + ret = vfio_region_mmap(&dpy->region.buffer); +diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c +index 378b475b2c..1ba66699dc 100644 +--- a/hw/vfio/pci.c ++++ b/hw/vfio/pci.c +@@ -2993,11 +2993,10 @@ bool vfio_pci_populate_device(VFIOPCIDevice *vdev, Error **errp) + char *name = g_strdup_printf("%s BAR %d", vbasedev->name, i); + + ret = vfio_region_setup(OBJECT(vdev), vbasedev, +- &vdev->bars[i].region, i, name); ++ &vdev->bars[i].region, i, name, errp); + g_free(name); + + if (ret) { +- error_setg_errno(errp, -ret, "failed to get region %d info", i); + return false; + } + +diff --git a/hw/vfio/region.c b/hw/vfio/region.c +index a61e47a79c..055033a79e 100644 +--- a/hw/vfio/region.c ++++ b/hw/vfio/region.c +@@ -163,7 +163,8 @@ static int vfio_mmap_compare_offset(const void *a, const void *b) + } + + static int vfio_setup_region_sparse_mmaps(VFIORegion *region, +- struct vfio_region_info *info) ++ struct vfio_region_info *info, ++ Error **errp) + { + struct vfio_info_cap_header *hdr; + struct vfio_region_info_cap_sparse_mmap *sparse; +@@ -210,12 +211,12 @@ static int vfio_setup_region_sparse_mmaps(VFIORegion *region, + off_t prev_end = region->mmaps[i - 1].offset + + region->mmaps[i - 1].size; + if (prev_end > region->mmaps[i].offset) { +- error_report("%s: overlapping sparse mmap regions detected " +- "in region %d: [0x%"PRIx64"-0x%"PRIx64"] overlaps " +- "with [0x%"PRIx64"-0x%"PRIx64"]", +- __func__, region->nr, region->mmaps[i - 1].offset, +- prev_end - 1, region->mmaps[i].offset, +- region->mmaps[i].offset + region->mmaps[i].size - 1); ++ error_setg(errp, "%s: overlapping sparse mmap regions detected " ++ "in region %d: [0x%"PRIx64"-0x%"PRIx64"] overlaps " ++ "with [0x%"PRIx64"-0x%"PRIx64"]", ++ __func__, region->nr, region->mmaps[i - 1].offset, ++ prev_end - 1, region->mmaps[i].offset, ++ region->mmaps[i].offset + region->mmaps[i].size - 1); + g_free(region->mmaps); + region->mmaps = NULL; + region->nr_mmaps = 0; +@@ -228,13 +229,14 @@ static int vfio_setup_region_sparse_mmaps(VFIORegion *region, + } + + int vfio_region_setup(Object *obj, VFIODevice *vbasedev, VFIORegion *region, +- int index, const char *name) ++ int index, const char *name, Error **errp) + { + struct vfio_region_info *info = NULL; + int ret; + + ret = vfio_device_get_region_info(vbasedev, index, &info); + if (ret) { ++ error_setg_errno(errp, -ret, "failed to get region %d info", index); + return ret; + } + +@@ -253,7 +255,7 @@ int vfio_region_setup(Object *obj, VFIODevice *vbasedev, VFIORegion *region, + if (!vbasedev->no_mmap && + region->flags & VFIO_REGION_INFO_FLAG_MMAP) { + +- ret = vfio_setup_region_sparse_mmaps(region, info); ++ ret = vfio_setup_region_sparse_mmaps(region, info, errp); + + if (ret == -ENODEV) { + region->nr_mmaps = 1; +diff --git a/hw/vfio/vfio-region.h b/hw/vfio/vfio-region.h +index ede6e0c8f9..9b21d4ee5b 100644 +--- a/hw/vfio/vfio-region.h ++++ b/hw/vfio/vfio-region.h +@@ -38,7 +38,7 @@ void vfio_region_write(void *opaque, hwaddr addr, + uint64_t vfio_region_read(void *opaque, + hwaddr addr, unsigned size); + int vfio_region_setup(Object *obj, VFIODevice *vbasedev, VFIORegion *region, +- int index, const char *name); ++ int index, const char *name, Error **errp); + int vfio_region_mmap(VFIORegion *region); + void vfio_region_mmaps_set_enabled(VFIORegion *region, bool enabled); + void vfio_region_unmap(VFIORegion *region); +-- +2.52.0 + diff --git a/kvm-virtio-blk-add-missing-VIRTIO_BLK_T_SCSI_CMD-size-ch.patch b/kvm-virtio-blk-add-missing-VIRTIO_BLK_T_SCSI_CMD-size-ch.patch new file mode 100644 index 0000000..9dbdd58 --- /dev/null +++ b/kvm-virtio-blk-add-missing-VIRTIO_BLK_T_SCSI_CMD-size-ch.patch @@ -0,0 +1,61 @@ +From 2bfe6c3fa58eea53c6b230069b10c3f8521fef68 Mon Sep 17 00:00:00 2001 +From: Stefan Hajnoczi +Date: Tue, 26 May 2026 11:49:57 -0400 +Subject: [PATCH 4/4] virtio-blk: add missing VIRTIO_BLK_T_SCSI_CMD size check + (CVE-2026-48914) + +RH-Author: Stefan Hajnoczi +RH-MergeRequest: 501: virtio-blk: add missing VIRTIO_BLK_T_SCSI_CMD size check (CVE-2026-48914) +RH-Jira: RHEL-184530 +RH-Acked-by: Kevin Wolf +RH-Acked-by: Miroslav Rezanina +RH-Commit: [1/1] e2f65ed64020791c8b48c630b79d18371db30624 (stefanha/centos-stream-qemu-kvm) + +Check that the iovec containing struct virtio_scsi_inhdr is large enough +before storing an error value there. + +Feifan Qian pointed out that this can be used to +corrupt heap memory when the descriptor uses an MMIO address and a +length of 1, forcing QEMU to allocate a 1-byte heap bounce buffer. +virtio_stl_p() stores 4 bytes and therefore corrupts whatever is beyond +the bounce buffer. + +Fixes: CVE-2026-48914 +Fixes: f34e73cd69bd ("virtio-blk: report non-zero status when failing SG_IO requests") +Reported-by: Feifan Qian +Cc: Paolo Bonzini +Signed-off-by: Stefan Hajnoczi +Message-ID: <20260526154957.1741622-1-stefanha@redhat.com> +Reviewed-by: Kevin Wolf +Signed-off-by: Kevin Wolf +(cherry picked from commit aeea0c2804c42f24915467a1e4c70e649e39b8e0) +Signed-off-by: Stefan Hajnoczi +--- + hw/block/virtio-blk.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c +index 9bab2716c1..a0678300b4 100644 +--- a/hw/block/virtio-blk.c ++++ b/hw/block/virtio-blk.c +@@ -200,10 +200,16 @@ static void virtio_blk_handle_scsi(VirtIOBlockReq *req) + + /* + * The scsi inhdr is placed in the second-to-last input segment, just +- * before the regular inhdr. ++ * before the regular inhdr. VIRTIO implementations normally do not rely on ++ * the precise message framing, but legacy implementations did and so we do ++ * too for the legacy virtio-blk SCSI request type. + * + * Just put anything nonzero so that the ioctl fails in the guest. + */ ++ if (elem->in_sg[elem->in_num - 2].iov_len != sizeof(*scsi)) { ++ status = VIRTIO_BLK_S_IOERR; ++ goto fail; ++ } + scsi = (void *)elem->in_sg[elem->in_num - 2].iov_base; + virtio_stl_p(vdev, &scsi->errors, 255); + status = VIRTIO_BLK_S_UNSUPP; +-- +2.52.0 + diff --git a/qemu-kvm.spec b/qemu-kvm.spec index a6b0662..b64ee5d 100644 --- a/qemu-kvm.spec +++ b/qemu-kvm.spec @@ -143,7 +143,7 @@ Obsoletes: %{name}-block-ssh <= %{epoch}:%{version} \ Summary: QEMU is a machine emulator and virtualizer Name: qemu-kvm Version: 10.1.0 -Release: 20%{?rcrel}%{?dist}%{?cc_suffix} +Release: 21%{?rcrel}%{?dist}%{?cc_suffix} # Epoch because we pushed a qemu-1.0 package. AIUI this can't ever be dropped # Epoch 15 used for RHEL 8 # Epoch 17 used for RHEL 9 (due to release versioning offset in RHEL 8.5) @@ -694,6 +694,14 @@ Patch268: kvm-vfio-container-Restrict-dma_map_file-to-shared-RAM-o.patch Patch269: kvm-scsi-change-buf_size-to-unsigned-int-in-scsi_SG_IO.patch # For RHEL-153123 - live migration failed or get failed WSFC test result during WSFC testing [rhel-10.3] Patch270: kvm-scsi-handle-reservation-changes-across-migration.patch +# For RHEL-150900 - NVIDIA:Grace:Backport hw/vfio: Enable hugepfnmap for non-power-of-2 device memory regions - RHEL 10.3 +Patch271: kvm-hw-vfio-sort-and-validate-sparse-mmap-regions-by-off.patch +# For RHEL-150900 - NVIDIA:Grace:Backport hw/vfio: Enable hugepfnmap for non-power-of-2 device memory regions - RHEL 10.3 +Patch272: kvm-vfio-Add-Error-parameter-to-vfio_region_setup.patch +# For RHEL-150900 - NVIDIA:Grace:Backport hw/vfio: Enable hugepfnmap for non-power-of-2 device memory regions - RHEL 10.3 +Patch273: kvm-hw-vfio-align-mmap-to-power-of-2-of-region-size-for-.patch +# For RHEL-184530 - CVE-2026-48914 qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling [rhel-10.3] +Patch274: kvm-virtio-blk-add-missing-VIRTIO_BLK_T_SCSI_CMD-size-ch.patch %if %{have_clang} BuildRequires: clang @@ -1773,6 +1781,16 @@ useradd -r -u 107 -g qemu -G kvm -d / -s /sbin/nologin \ %endif %changelog +* Fri Jun 19 2026 Miroslav Rezanina - 10.1.0-21 +- kvm-hw-vfio-sort-and-validate-sparse-mmap-regions-by-off.patch [RHEL-150900] +- kvm-vfio-Add-Error-parameter-to-vfio_region_setup.patch [RHEL-150900] +- kvm-hw-vfio-align-mmap-to-power-of-2-of-region-size-for-.patch [RHEL-150900] +- kvm-virtio-blk-add-missing-VIRTIO_BLK_T_SCSI_CMD-size-ch.patch [RHEL-184530] +- Resolves: RHEL-150900 + (NVIDIA:Grace:Backport hw/vfio: Enable hugepfnmap for non-power-of-2 device memory regions - RHEL 10.3) +- Resolves: RHEL-184530 + (CVE-2026-48914 qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling [rhel-10.3]) + * Mon Jun 08 2026 Miroslav Rezanina - 10.1.0-20 - kvm-accel-mshv-Remove-remap-overlapping-mappings-code.patch [RHEL-178767] - kvm-accel-mshv-implement-cpu_thread_is_idle-hook.patch [RHEL-178767]