[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-commits] [qemu/qemu] af566c: hw/pvrdma: Protect against buggy or m
|
From: |
Alex Bennée |
|
Subject: |
[Qemu-commits] [qemu/qemu] af566c: hw/pvrdma: Protect against buggy or malicious gues... |
|
Date: |
Tue, 31 Oct 2023 23:14:31 -0700 |
Branch: refs/heads/staging-8.1
Home: https://github.com/qemu/qemu
Commit: af566ccb38bdb65ed239c9cd22de3fbde9ad1483
https://github.com/qemu/qemu/commit/af566ccb38bdb65ed239c9cd22de3fbde9ad1483
Author: Yuval Shaia <yuval.shaia.ml@gmail.com>
Date: 2023-10-19 (Thu, 19 Oct 2023)
Changed paths:
M hw/rdma/vmw/pvrdma_main.c
Log Message:
-----------
hw/pvrdma: Protect against buggy or malicious guest driver
Guest driver allocates and initialize page tables to be used as a ring
of descriptors for CQ and async events.
The page table that represents the ring, along with the number of pages
in the page table is passed to the device.
Currently our device supports only one page table for a ring.
Let's make sure that the number of page table entries the driver
reports, do not exceeds the one page table size.
Reported-by: Soul Chen <soulchen8650@gmail.com>
Signed-off-by: Yuval Shaia <yuval.shaia.ml@gmail.com>
Fixes: CVE-2023-1544
Message-ID: <20230301142926.18686-1-yuval.shaia.ml@gmail.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
(cherry picked from commit 85fc35afa93c7320d1641d344d0c5dfbe341d087)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: 9285589334de8faa924f898547bcc716b14a9f0d
https://github.com/qemu/qemu/commit/9285589334de8faa924f898547bcc716b14a9f0d
Author: Fabiano Rosas <farosas@suse.de>
Date: 2023-10-19 (Thu, 19 Oct 2023)
Changed paths:
M scripts/analyze-migration.py
Log Message:
-----------
migration: Fix analyze-migration read operation signedness
The migration code uses unsigned values for 16, 32 and 64-bit
operations. Fix the script to do the same.
This was causing an issue when parsing the migration stream generated
on the ppc64 target because one of instance_ids was larger than the
32bit signed maximum:
Traceback (most recent call last):
File "/home/fabiano/kvm/qemu/build/scripts/analyze-migration.py", line 658,
in <module>
dump.read(dump_memory = args.memory)
File "/home/fabiano/kvm/qemu/build/scripts/analyze-migration.py", line 592,
in read
classdesc = self.section_classes[section_key]
KeyError: ('spapr_iommu', -2147483648)
Signed-off-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
Message-ID: <20231009184326.15777-6-farosas@suse.de>
(cherry picked from commit caea03279e11dfcb0e5a567b81fe7f02ee80af02)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: 95b3854bf7b11c58f89f19d274d958e4ca5d7873
https://github.com/qemu/qemu/commit/95b3854bf7b11c58f89f19d274d958e4ca5d7873
Author: Juan Quintela <quintela@redhat.com>
Date: 2023-10-19 (Thu, 19 Oct 2023)
Changed paths:
M migration/ram.c
Log Message:
-----------
migration: Non multifd migration don't care about multifd flushes
RDMA was having trouble because
migrate_multifd_flush_after_each_section() can only be true or false,
but we don't want to send any flush when we are not in multifd
migration.
CC: Fabiano Rosas <farosas@suse.de
Fixes: 294e5a4034e81 ("multifd: Only flush once each full round of memory")
Reported-by: Li Zhijian <lizhijian@fujitsu.com>
Reviewed-by: Li Zhijian <lizhijian@fujitsu.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
Message-ID: <20231011205548.10571-2-quintela@redhat.com>
(cherry picked from commit d4f34485ca8a077c98fc2303451e9bece9200dd7)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: 663aca79f96968357736fdaf50c49eea87efa50c
https://github.com/qemu/qemu/commit/663aca79f96968357736fdaf50c49eea87efa50c
Author: John Snow <jsnow@redhat.com>
Date: 2023-10-19 (Thu, 19 Oct 2023)
Changed paths:
M python/qemu/qmp/protocol.py
Log Message:
-----------
python/qmp: remove Server.wait_closed() call for Python 3.12
This patch is a backport from
https://gitlab.com/qemu-project/python-qemu-qmp/-/commit/e03a3334b6a477beb09b293708632f2c06fe9f61
According to Guido in https://github.com/python/cpython/issues/104344 ,
this call was never meant to wait for the server to shut down - that is
handled synchronously - but instead, this waits for all connections to
close. Or, it would have, if it wasn't broken since it was introduced.
3.12 fixes the bug, which now causes a hang in our code. The fix is just
to remove the wait.
Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Message-id: 20231006195243.3131140-3-jsnow@redhat.com
Signed-off-by: John Snow <jsnow@redhat.com>
(cherry picked from commit acf873873ae38e68371b0c53c42d3530636ff94e)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: adbbddf90beec4219ee9fa0a4b6f7eb4f107989e
https://github.com/qemu/qemu/commit/adbbddf90beec4219ee9fa0a4b6f7eb4f107989e
Author: Paolo Bonzini <pbonzini@redhat.com>
Date: 2023-10-19 (Thu, 19 Oct 2023)
Changed paths:
M tests/docker/docker.py
Log Message:
-----------
tests/docker: avoid invalid escape in Python string
This is an error in Python 3.12; fix it by using a raw string literal.
Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit a5e3cb3b90a62a42cd19ad9a20ca25c7df1dc3da)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: 23b0010786f354845f8ff7760bc1af83fc160649
https://github.com/qemu/qemu/commit/23b0010786f354845f8ff7760bc1af83fc160649
Author: Paolo Bonzini <pbonzini@redhat.com>
Date: 2023-10-19 (Thu, 19 Oct 2023)
Changed paths:
M docs/sphinx/hxtool.py
Log Message:
-----------
docs/sphinx: avoid invalid escape in Python string
This is an error in Python 3.12; fix it by using a raw string literal.
Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit e4b6532cc0a5518c0dea15eeca573829df9ec1df)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: 7a04747125e595c7cb4db66dcd0b4fc4b13b6e87
https://github.com/qemu/qemu/commit/7a04747125e595c7cb4db66dcd0b4fc4b13b6e87
Author: Paolo Bonzini <pbonzini@redhat.com>
Date: 2023-10-19 (Thu, 19 Oct 2023)
Changed paths:
M target/hexagon/hex_common.py
Log Message:
-----------
target/hexagon: avoid invalid escape in Python string
This is an error in Python 3.12; fix it by using a raw string literal.
Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit e41c40d101fce79af4d679955eb6e0d31e02c47c)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: 6dbb538a7159edef132353e6855ad0b8a501fc87
https://github.com/qemu/qemu/commit/6dbb538a7159edef132353e6855ad0b8a501fc87
Author: Paolo Bonzini <pbonzini@redhat.com>
Date: 2023-10-19 (Thu, 19 Oct 2023)
Changed paths:
M tests/avocado/virtio_check_params.py
Log Message:
-----------
tests/avocado: avoid invalid escape in Python string
This is an error in Python 3.12; fix it by using a raw string literal.
Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 1b5f3f65cc71341a4f9fc9e89bb6985fde703758)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: 791cbfeec2065c29755ba5d89fd6378a1530ec94
https://github.com/qemu/qemu/commit/791cbfeec2065c29755ba5d89fd6378a1530ec94
Author: Paolo Bonzini <pbonzini@redhat.com>
Date: 2023-10-19 (Thu, 19 Oct 2023)
Changed paths:
M tests/vm/basevm.py
Log Message:
-----------
tests/vm: avoid invalid escape in Python string
This is an error in Python 3.12; fix it by using a raw string literal
or by double-escaping the backslash.
Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 86a8989d4557a09b68f8b78b6c3fb6ad3f23ca6f)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: 71452f87c9ad7a205516066f37dfb7e7d12f1d02
https://github.com/qemu/qemu/commit/71452f87c9ad7a205516066f37dfb7e7d12f1d02
Author: Paolo Bonzini <pbonzini@redhat.com>
Date: 2023-10-19 (Thu, 19 Oct 2023)
Changed paths:
M scripts/tracetool/__init__.py
M scripts/tracetool/format/log_stap.py
Log Message:
-----------
tracetool: avoid invalid escape in Python string
This is an error in Python 3.12; fix it by using a raw string literal.
Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit e6d8e5e6e366ab4c9ed7d8ed1572f98c6ad6a38e)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: e73f57b1b57bb41ebbbcb6fe6f75bc8a770d17c7
https://github.com/qemu/qemu/commit/e73f57b1b57bb41ebbbcb6fe6f75bc8a770d17c7
Author: Richard Henderson <richard.henderson@linaro.org>
Date: 2023-10-19 (Thu, 19 Oct 2023)
Changed paths:
M linux-user/elfload.c
Log Message:
-----------
linux-user: Fixes for zero_bss
The previous change, 2d385be6152, assumed !PAGE_VALID meant that
the page would be unmapped by the elf image. However, since we
reserved the entire image space via mmap, PAGE_VALID will always
be set. Instead, assume PROT_NONE for the same condition.
Furthermore, assume bss is only ever present for writable segments,
and that there is no page overlap between PT_LOAD segments.
Instead of an assert, return false to indicate failure.
Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1854
Fixes: 2d385be6152 ("linux-user: Do not adjust zero_bss for host page size")
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
(cherry picked from commit e6e66b03287331abc6f184456dbc6d25505590ec)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: 814f91d6790de6b24832f9282527a447bdc33de2
https://github.com/qemu/qemu/commit/814f91d6790de6b24832f9282527a447bdc33de2
Author: Mikulas Patocka <mpatocka@redhat.com>
Date: 2023-10-19 (Thu, 19 Oct 2023)
Changed paths:
M linux-user/mips/cpu_loop.c
Log Message:
-----------
linux-user/mips: fix abort on integer overflow
QEMU mips userspace emulation crashes with "qemu: unhandled CPU exception
0x15 - aborting" when one of the integer arithmetic instructions detects
an overflow.
This patch fixes it so that it delivers SIGFPE with FPE_INTOVF instead.
Cc: qemu-stable@nongnu.org
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Message-Id: <3ef979a8-3ee1-eb2d-71f7-d788ff88dd11@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
(cherry picked from commit 6fad9b4bb91dcc824f9c00a36ee843883b58313b)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: 1e4c468ec7cae54905560c9d9fede0bdbb52eeb4
https://github.com/qemu/qemu/commit/1e4c468ec7cae54905560c9d9fede0bdbb52eeb4
Author: Mikulas Patocka <mpatocka@redhat.com>
Date: 2023-10-19 (Thu, 19 Oct 2023)
Changed paths:
M linux-user/sh4/signal.c
Log Message:
-----------
linux-user/sh4: Fix crashes on signal delivery
sh4 uses gUSA (general UserSpace Atomicity) to provide atomicity on CPUs
that don't have atomic instructions. A gUSA region that adds 1 to an
atomic variable stored in @R2 looks like this:
4004b6: 03 c7 mova 4004c4 <gusa+0x10>,r0
4004b8: f3 61 mov r15,r1
4004ba: 09 00 nop
4004bc: fa ef mov #-6,r15
4004be: 22 63 mov.l @r2,r3
4004c0: 01 73 add #1,r3
4004c2: 32 22 mov.l r3,@r2
4004c4: 13 6f mov r1,r15
R0 contains a pointer to the end of the gUSA region
R1 contains the saved stack pointer
R15 contains negative length of the gUSA region
When this region is interrupted by a signal, the kernel detects if
R15 >= -128U. If yes, the kernel rolls back PC to the beginning of the
region and restores SP by copying R1 to R15.
The problem happens if we are interrupted by a signal at address 4004c4.
R15 still holds the value -6, but the atomic value was already written by
an instruction at address 4004c2. In this situation we can't undo the
gUSA. The function unwind_gusa does nothing, the signal handler attempts
to push a signal frame to the address -6 and crashes.
This patch fixes it, so that if we are interrupted at the last instruction
in a gUSA region, we copy R1 to R15 to restore the correct stack pointer
and avoid crashing.
There's another bug: if we are interrupted in a delay slot, we save the
address of the instruction in the delay slot. We must save the address of
the previous instruction.
Cc: qemu-stable@nongnu.org
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Reviewed-by: Yoshinori Sato <ysato@users.sourcefoege.jp>
Message-Id: <b16389f7-6c62-70b7-59b3-87533c0bcc@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
(cherry picked from commit 3b894b699c9a9c064466e128c18be80a3f2113bc)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: 59ee12a961bbde4e2be6766ba297c03a3d670356
https://github.com/qemu/qemu/commit/59ee12a961bbde4e2be6766ba297c03a3d670356
Author: Helge Deller <deller@gmx.de>
Date: 2023-10-21 (Sat, 21 Oct 2023)
Changed paths:
M hw/input/lasips2.c
Log Message:
-----------
lasips2: LASI PS/2 devices are not user-createable
Those PS/2 ports are created with the LASI controller when
a 32-bit PA-RISC machine is created.
Mark them not user-createable to avoid showing them in
the qemu device list.
Signed-off-by: Helge Deller <deller@gmx.de>
Cc: qemu-stable@nongnu.org
(cherry picked from commit a1e6a5c46219bada2c7b932748527553b36559ae)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: 31c6d1d6549a153c0e6023308b47794672c5275b
https://github.com/qemu/qemu/commit/31c6d1d6549a153c0e6023308b47794672c5275b
Author: Michal Orzel <michal.orzel@amd.com>
Date: 2023-10-21 (Sat, 21 Oct 2023)
Changed paths:
M target/arm/helper.c
Log Message:
-----------
target/arm: Fix CNTPCT_EL0 trapping from EL0 when HCR_EL2.E2H is 0
On an attempt to access CNTPCT_EL0 from EL0 using a guest running on top
of Xen, a trap from EL2 was observed which is something not reproducible
on HW (also, Xen does not trap accesses to physical counter).
This is because gt_counter_access() checks for an incorrect bit (1
instead of 0) of CNTHCTL_EL2 if HCR_EL2.E2H is 0 and access is made to
physical counter. Refer ARM ARM DDI 0487J.a, D19.12.2:
When HCR_EL2.E2H is 0:
- EL1PCTEN, bit [0]: refers to physical counter
- EL1PCEN, bit [1]: refers to physical timer registers
Drop entire block "if (hcr & HCR_E2H) {...} else {...}" from EL0 case
and fall through to EL1 case, given that after fixing checking for the
correct bit, the handling is the same.
Fixes: 5bc8437136fb ("target/arm: Update timer access for VHE")
Signed-off-by: Michal Orzel <michal.orzel@amd.com>
Tested-by: Oleksandr Tyshchenko <oleksandr_tyshchenko@epam.com>
Message-id: 20230928094404.20802-1-michal.orzel@amd.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
(cherry picked from commit d01448c79d89cfdc86228081b1dd1dfaf85fb4c3)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: fdeedb886aa40e2e632f365c46c53c3380135073
https://github.com/qemu/qemu/commit/fdeedb886aa40e2e632f365c46c53c3380135073
Author: Lu Gao <lu.gao@verisilicon.com>
Date: 2023-10-24 (Tue, 24 Oct 2023)
Changed paths:
M hw/sd/sdhci.c
Log Message:
-----------
hw/sd/sdhci: Block Size Register bits [14:12] is lost
Block Size Register bits [14:12] is SDMA Buffer Boundary, it is missed
in register write, but it is needed in SDMA transfer. e.g. it will be
used in sdhci_sdma_transfer_multi_blocks to calculate boundary_ variables.
Missing this field will cause wrong operation for different SDMA Buffer
Boundary settings.
Fixes: d7dfca0807 ("hw/sdhci: introduce standard SD host controller")
Fixes: dfba99f17f ("hw/sdhci: Fix DMA Transfer Block Size field")
Signed-off-by: Lu Gao <lu.gao@verisilicon.com>
Signed-off-by: Jianxian Wen <jianxian.wen@verisilicon.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-ID: <20220321055618.4026-1-lu.gao@verisilicon.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
(cherry picked from commit ae5f70baf549925080fcdbc6c1939c98a4a39246)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: 28facf15989f43a4b6e801e6349c03603a78a6a0
https://github.com/qemu/qemu/commit/28facf15989f43a4b6e801e6349c03603a78a6a0
Author: Peter Maydell <peter.maydell@linaro.org>
Date: 2023-10-24 (Tue, 24 Oct 2023)
Changed paths:
M hw/rdma/vmw/pvrdma_cmd.c
Log Message:
-----------
hw/rdma/vmw/pvrdma_cmd: Use correct struct in query_port()
In query_port() we pass the address of a local pvrdma_port_attr
struct to the rdma_query_backend_port() function. Unfortunately,
rdma_backend_query_port() wants a pointer to a struct ibv_port_attr,
and the two are not the same length.
Coverity spotted this (CID 1507146): pvrdma_port_attr is 48 bytes
long, and ibv_port_attr is 52 bytes, because it has a few extra
fields at the end.
Fortunately, all we do with the attrs struct after the call is to
read a few specific fields out of it which are all at the same
offsets in both structs, so we can simply make the local variable the
correct type. This also lets us drop the cast (which should have
been a bit of a warning flag that we were doing something wrong
here).
We do however need to add extra casts for the fields of the
struct that are enums: clang will complain about the implicit
cast to a different enum type otherwise.
Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
(cherry picked from commit 4ab9a7429bf7507fba4b96b97d4147628c91ba14)
Commit: fd4ce7455f68288efcf255c01f0a97b40e7ac4ab
https://github.com/qemu/qemu/commit/fd4ce7455f68288efcf255c01f0a97b40e7ac4ab
Author: Richard Henderson <richard.henderson@linaro.org>
Date: 2023-10-29 (Sun, 29 Oct 2023)
Changed paths:
M target/sparc/translate.c
Log Message:
-----------
target/sparc: Clear may_lookup for npc == DYNAMIC_PC
With pairs of jmp+rett, pc == DYNAMIC_PC_LOOKUP and
npc == DYNAMIC_PC. Make sure that we exit for interrupts.
Cc: qemu-stable@nongnu.org
Fixes: 633c42834c7 ("target/sparc: Introduce DYNAMIC_PC_LOOKUP")
Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Acked-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
(cherry picked from commit 930f1865cc654b637ffe1207fa5b44bf0a156279)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: 143352cd7d9fa2359ff27a322fa4e2cf17b2583e
https://github.com/qemu/qemu/commit/143352cd7d9fa2359ff27a322fa4e2cf17b2583e
Author: Peter Maydell <peter.maydell@linaro.org>
Date: 2023-10-31 (Tue, 31 Oct 2023)
Changed paths:
M target/arm/tcg/translate-a64.c
Log Message:
-----------
target/arm: Fix syndrome for FGT traps on ERET
In commit 442c9d682c94fc2 when we converted the ERET, ERETAA, ERETAB
instructions to decodetree, the conversion accidentally lost the
correct setting of the syndrome register when taking a trap because
of the FEAT_FGT HFGITR_EL1.ERET bit. Instead of reporting a correct
full syndrome value with the EC and IL bits, we only reported the low
two bits of the syndrome, because the call to syn_erettrap() got
dropped.
Fix the syndrome values for these traps by reinstating the
syn_erettrap() calls.
Fixes: 442c9d682c94fc2 ("target/arm: Convert ERET, ERETAA, ERETAB to
decodetree")
Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20231024172438.2990945-1-peter.maydell@linaro.org
(cherry picked from commit 307521d6e29e559c89afa9dbd337ae75fe3c436d)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Commit: b938418f0d757ce3a2c81bf1f33d15eceead2201
https://github.com/qemu/qemu/commit/b938418f0d757ce3a2c81bf1f33d15eceead2201
Author: Glenn Miles <milesg@linux.vnet.ibm.com>
Date: 2023-10-31 (Tue, 31 Oct 2023)
Changed paths:
M hw/misc/led.c
Log Message:
-----------
misc/led: LED state is set opposite of what is expected
Testing of the LED state showed that when the LED polarity was
set to GPIO_POLARITY_ACTIVE_LOW and a low logic value was set on
the input GPIO of the LED, the LED was being turn off when it was
expected to be turned on.
Fixes: ddb67f6402 ("hw/misc/led: Allow connecting from GPIO output")
Signed-off-by: Glenn Miles <milesg@linux.vnet.ibm.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andrew Jeffery <andrew@codeconstruct.com.au>
Message-id: 20231024191945.4135036-1-milesg@linux.vnet.ibm.com
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
(cherry picked from commit 6f83dc67168d17856744275e2a0d7a6addf6cfb9)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Compare: https://github.com/qemu/qemu/compare/78385bc73810...b938418f0d75
- [Qemu-commits] [qemu/qemu] af566c: hw/pvrdma: Protect against buggy or malicious gues...,
Alex Bennée <=