friedkiwi/qemu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge tag 's390x-20260714' of https://gitlab.com/cohuck/qemu into staging

Browse Source 
more s390x guest->host interface hardening (sclp, css)

# -----BEGIN PGP SIGNATURE-----
#
# iIgEABYKADAWIQRpo7U29cv8ZSCAJsHeiLtWQd5mwQUCalYBQxIcY29odWNrQHJl
# ZGhhdC5jb20ACgkQ3oi7VkHeZsEg8gEA2leqR6LLqQFqacysYj7uu2NK7NqWbShY
# k3wvWVq6h7IBAMzLs/pnrNdJM8VjlPnAdD1UUCXme4MbzDFPv9tFElII
# =+khB
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 14 Jul 2026 10:28:35 BST
# gpg:                using EDDSA key 69A3B536F5CBFC65208026C1DE88BB5641DE66C1
# gpg:                issuer "cohuck@redhat.com"
# gpg: Good signature from "Cornelia Huck <conny@cornelia-huck.de>" [unknown]
# gpg:                 aka "Cornelia Huck <cohuck@kernel.org>" [unknown]
# gpg:                 aka "Cornelia Huck <cornelia.huck@de.ibm.com>" [full]
# gpg:                 aka "Cornelia Huck <huckc@linux.vnet.ibm.com>" [full]
# gpg:                 aka "Cornelia Huck <cohuck@redhat.com>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0  18CE DECF 6B93 C6F0 2FAF
#      Subkey fingerprint: 69A3 B536 F5CB FC65 2080  26C1 DE88 BB56 41DE 66C1

* tag 's390x-20260714' of https://gitlab.com/cohuck/qemu:
  s390x/css: firm up handling of chained TIC CCWs
  s390x/sclpcpi: check event length field before reading from buffer
  s390x/sclp: prevent re-reading the sclp header

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
This commit is contained in:
Stefan Hajnoczi
2026-07-14 20:33:34 +01:00
parent 191489ba75 33bece0fa1
commit a3c1ad55ba
4 changed files with 16 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
hw/s390x/css.c
View File

@@ -1078,6 +1078,12 @@ static int css_interpret_ccw(SubchDev *sch, hwaddr ccw_addr,
ret = -EINVAL;
break;
}
/* Limit the number of TICs in a given channel program */
if (sch->ccw_tic_cnt == 255) {
ret = -EINVAL;
break;
}
sch->ccw_tic_cnt++;
sch->channel_prog = ccw.cda;
ret = -EAGAIN;
break;
@@ -1129,6 +1135,7 @@ static void sch_handle_start_func_virtual(SubchDev *sch)
sch->ccw_fmt_1 = !!(orb->ctrl0 & ORB_CTRL0_MASK_FMT);
schib->scsw.flags |= (sch->ccw_fmt_1) ? SCSW_FLAGS_MASK_FMT : 0;
sch->ccw_no_data_cnt = 0;
sch->ccw_tic_cnt = 0;
suspend_allowed = !!(orb->ctrl0 & ORB_CTRL0_MASK_SPND);
} else {
/* Start Function resumed via rsch */

4
hw/s390x/sclp.c
View File

@@ -329,7 +329,8 @@ int sclp_service_call(S390CPU *cpu, uint64_t sccb, uint32_t code)
/*
* we want to work on a private copy of the sccb, to prevent guests
* from playing dirty tricks by modifying the memory content after
* the host has checked the values
* the host has checked the values.
* Reuse the previously fetched header
*/
work_sccb = g_malloc0(be16_to_cpu(header.length));
ret = address_space_read(as, sccb, attrs,
@@ -337,6 +338,7 @@ int sclp_service_call(S390CPU *cpu, uint64_t sccb, uint32_t code)
if (ret != MEMTX_OK) {
return -PGM_ADDRESSING;
}
work_sccb->h = header;
if (!sclp_command_code_valid(code)) {
work_sccb->h.response_code = cpu_to_be16(SCLP_RC_INVALID_SCLP_COMMAND);

5
hw/s390x/sclpcpi.c
View File

@@ -97,6 +97,11 @@ static int write_event_data(SCLPEvent *event, EventBufferHeader *evt_buf_hdr)
ebh);
SCLPEventCPI *e = SCLP_EVENT_CPI(event);
/* Caller checks sccb length, buffer header checking is our duty */
if (be16_to_cpu(evt_buf_hdr->length) != sizeof(ControlProgramIdMsg)) {
return SCLP_RC_INCONSISTENT_LENGTHS;
}
ascii_put(e->system_type, (char *)cpim->data.system_type,
sizeof(cpim->data.system_type));
ascii_put(e->system_name, (char *)cpim->data.system_name,

1
include/hw/s390x/css.h
View File

@@ -132,6 +132,7 @@ struct SubchDev {
bool ccw_fmt_1;
bool thinint_active;
uint8_t ccw_no_data_cnt;
uint8_t ccw_tic_cnt;
uint16_t migrated_schid; /* used for mismatch detection */
CcwDataStream cds;
/* transport-provided data: */