uefi-ref/qemu
1
0
Fork 0
mirror of https://gitlab.com/qemu-project/qemu.git synced 2026-08-26 22:23:12 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions
qemu/hw
History
Exact
Andrew Jones 43b8553eea hw/riscv/riscv-iommu: preserve requested perm in spa_fetch() 
b18e3f0e2d fixed spa_fetch() faults whose TTYP used the leaf PTE
permission instead of the original request permission.  However, it kept
that request-narrowed value in iotlb->perm after a successful walk, and
riscv_iommu_translate() caches iotlb->perm for later accesses to the same
IOVA.

That means a write to an RW mapping can cache the entry as write-only.
A later read then hits the cache and faults even though the mapping allows
it, which showed up in NVMe testing as bogus completions and controller
timeouts.

Keep the requested permission in a separate req_perm and use it for all
permission checks and fault-type decisions.  Accumulate the leaf
permissions separately and copy them to iotlb->perm only after the full
walk succeeds, so cached entries describe the mapping rather than the
current request.  Since faults leave iotlb->perm as the original request,
the S-stage and G-stage TTYP fixes remain intact.

Fixes: b18e3f0e2d ("hw/riscv/riscv-iommu.c: fix fault type for spa_fetch() faults")
Fixes: 12422e1f44 in 10.0.x
Signed-off-by: Andrew Jones <andrew.jones@oss.qualcomm.com>
Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Message-ID: <20260717144525.1154204-1-andrew.jones@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
(cherry picked from commit aa51eec004)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-25 14:11:14 +03:00
..
9pfs hw/9pfs/xen: drain in-flight PDUs before xen-9p disconnect 2026-07-31 11:08:41 +03:00
acpi hw/acpi: correct field sequence in SPCR table 2026-07-15 15:34:37 +03:00
adc hw/adc: Fix out-of-bounds write in Aspeed ADC model 2026-02-06 00:02:27 +03:00
alpha hw/boards: Do not create unusable default if=sd drives 2025-02-16 14:25:08 +01:00
arm hw/arm/aspeed: Add missing Kconfig dependencies on required components 2026-08-17 15:16:40 +03:00
audio hw/audio/intel-hda: restrict all DMA engine paths to memories 2026-07-22 12:41:36 +03:00
avr hw/boards: Do not create unusable default if=sd drives 2025-02-16 14:25:08 +01:00
block hw/block/pflash_cfi01: Restore ROMD mode after migration 2026-08-17 19:23:02 +03:00
char serial: clear transmit retry callback on unrealize 2026-08-21 20:02:37 +03:00
core hw/core/qdev-clock: Fix potential null pointer dereference 2026-07-08 13:27:01 +03:00
cpu hw/cpu/arm_mpcore: Remove default values for GIC external IRQs 2025-02-20 14:20:29 +00:00
cxl mem/cxl_type3: support 3, 6, 12 and 16 interleave ways 2025-02-21 07:18:42 -05:00
display hw/display/virtio-gpu: Unmap DMA regions on reset 2026-08-05 10:52:02 +03:00
dma hw/dma/i8257: Return zeroes for read_memory in verify mode 2026-07-08 13:27:01 +03:00
fsi hw: Use device_class_set_legacy_reset() instead of opencoding 2024-09-13 15:31:44 +01:00
gpio hw/gpio/pca9554: Avoid leak in pca9554_set_pin() 2025-09-04 23:16:52 +03:00
hppa hw/hppa: Fix interrupt of LASI parallel port 2025-10-28 18:30:49 +03:00
hyperv hyperv/syndbg: check length returned by cpu_physical_memory_map() 2026-03-13 10:17:42 +03:00
i2c hw/i2c/microbit_i2c: Don't index off end of twi_read_sequence[] 2026-05-19 23:40:30 +03:00
i386 intel_iommu: Check address mask before using it in pasid-based iotlb invalidation 2026-07-31 11:08:41 +03:00
ide hw/ide/atapi: read the whole elementary transfer asynchronously 2026-08-17 19:23:02 +03:00
input hid: fix incorrect return value for hid 2025-10-15 23:27:03 +03:00
intc hw/intc/loongarch_pch_pic: Validate htmsi_vector before indexing parent_irq 2026-08-17 19:23:02 +03:00
ipack hw/ipack: Remove legacy qemu_allocate_irqs() use 2025-01-31 19:36:44 +01:00
ipmi Accel & Exec patch queue 2024-12-21 11:07:00 -05:00
isa hw: Declare various const data as 'const' 2025-02-16 14:26:07 +01:00
loongarch hw/loongarch/virt: Don't abort on access to unimplemented IOCSR 2026-01-18 19:36:11 +03:00
m68k hw/boards: Do not create unusable default if=sd drives 2025-02-16 14:25:08 +01:00
mem hw/cxl: fix OOB access in cxl_doe_cdat_rsp via entry_handle 2026-07-31 11:08:41 +03:00
microblaze hw/ssi/xilinx_spi: Make device endianness configurable 2025-02-16 14:34:57 +01:00
mips target/mips: Revert TARGET_PAGE_BITS_VARY 2025-03-31 21:32:43 +02:00
misc hw/misc/applesmc: Fix a typo setting MSSD key 2026-07-22 12:41:36 +03:00
net hw/net/rtl8139: Send whole of vlan-tagged packet when doing loopback 2026-08-17 19:23:02 +03:00
nubus include/hw/qdev-properties: Remove DEFINE_PROP_END_OF_LIST 2024-12-19 19:36:37 +01:00
nvme hw/nvme: add SPDM_SOCKET Kconfig dependency 2026-08-17 19:23:02 +03:00
nvram nw/nvram/ds1225y: Fix nvram MemoryRegion owner 2025-10-28 15:29:01 +03:00
openrisc target/openrisc: Call cpu_openrisc_clock_init() in cpu_realize() 2025-03-06 15:46:18 +01:00
pci hw/pci/pcie_doe: Check mailbox length for overflows 2026-07-15 15:34:37 +03:00
pci-bridge hw/cxl: fix OOB access in cxl_doe_cdat_rsp via entry_handle 2026-07-31 11:08:41 +03:00
pci-host hw/pci-host/q35.c: Avoid early return in mch_write_config() 2026-07-31 11:08:41 +03:00
ppc hw/ppc/e500: fix bus-frequency property hardcoded to zero in CPU FDT node 2026-05-14 22:33:02 +03:00
remote Memory pull request for 10.0 2025-02-19 08:36:26 +08:00
riscv hw/riscv/riscv-iommu: preserve requested perm in spa_fetch() 2026-08-25 14:11:14 +03:00
rtc mc146818rtc: Fix get_guest_rtc_ns() overflow bug 2026-05-30 09:57:25 +03:00
rx hw/rx: Allow execution without either bios or kernel 2025-02-16 14:45:38 +01:00
s390x s390x/ipl: validate num_comp against iplb length before iterating 2026-08-17 15:16:40 +03:00
scsi virtio-scsi: fix SCSIRequest leak on a bad request 2026-07-31 11:08:41 +03:00
sd hw/sd/sdhci: Fix TYPE_IMX_USDHC to implement sd-spec-version 3 by default 2026-01-21 10:23:37 +03:00
sensor hw: Make class data 'const' 2025-02-16 14:26:07 +01:00
sh4 hw/sh4/sh7750: Remove forgotten abort() in the MM_ITLB_DATA handler 2026-05-14 22:33:01 +03:00
smbios smbios: Fix buffer overrun when using path= option 2025-04-08 20:45:13 +02:00
sparc load_aout: replace bswap_needed with big_endian 2025-03-21 12:51:16 +01:00
sparc64 hw/sparc64/niagara: use int64_t for vdisk size to avoid truncation 2026-07-17 18:11:24 +03:00
ssi hw/ssi/aspeed_smc: Convert mem ops to read/write_with_attrs for error handling 2026-03-31 20:07:01 +03:00
timer rust: Kconfig: Factor out whether HPET is Rust or C 2025-03-20 09:23:24 +01:00
tpm hw/tpm: Have TPM TIS sysbus device inherit from DYNAMIC_SYS_BUS_DEVICE 2025-02-16 14:25:07 +01:00
tricore hw/boards: Do not create unusable default if=sd drives 2025-02-16 14:25:08 +01:00
uefi hw/uefi: make SetupMode read-only 2026-07-24 10:10:54 +03:00
ufs hw/ufs: avoid double unref of wrapped scsi-hd 2026-07-10 13:41:35 +03:00
usb hw/usb/dev-uas: Don't abort if guest provided an undersized buffer for status 2026-08-17 19:23:02 +03:00
vfio vfio/pci: reject invalid PCI_INTERRUPT_PIN values 2026-07-31 11:08:41 +03:00
virtio virtio-mmio: fix QUEUE_NUM_MAX 2026-07-31 11:08:41 +03:00
vmapple hw/vmapple/vmapple: Add vmapple machine type 2025-03-04 14:45:34 +01:00
watchdog hw/watchdog: Add lower bound check for watchdogNumber 2026-08-25 14:11:14 +03:00
xen xen: mapcache: Split mapcache_grants by ro and rw 2025-05-11 09:15:20 +03:00
xenpv hw/boards: Do not create unusable default if=sd drives 2025-02-16 14:25:08 +01:00
xtensa hw/boards: Do not create unusable default if=sd drives 2025-02-16 14:25:08 +01:00
Kconfig Misc HW patches 2025-03-05 21:54:58 +08:00
meson.build Misc HW patches 2025-03-05 21:54:58 +08:00