On 7/14/26 04:34, Ilya Leoshkevich wrote:
fill_buf_random() writes the entire guest-requested amount of random
bytes in one go. Since the length is a full 64-bit value, a guest can
request several gigabytes and keep the vCPU spinning inside the helper,
without a chance to react to interrupts.
Do the same thing as cpacf_sha512(): process only a limited amount of
data per instruction execution and report partial completion with
condition code 3. This way the guest reissues the instruction, and
pending interrupts can be handled in between.
Reported-by: Christian Borntraeger <[email protected]>
Fixes: 3dbc5fdacb5a ("target/s390x: support PRNO_TRNG instruction")
Cc: [email protected]
Signed-off-by: Ilya Leoshkevich <[email protected]>
---
target/s390x/tcg/crypto_helper.c | 25 +++++++++++++++++++------
1 file changed, 19 insertions(+), 6 deletions(-)
diff --git a/target/s390x/tcg/crypto_helper.c b/target/s390x/tcg/crypto_helper.c
index 8fe0a222198..4902c4e93ba 100644
--- a/target/s390x/tcg/crypto_helper.c
+++ b/target/s390x/tcg/crypto_helper.c
@@ -242,12 +242,13 @@ static int cpacf_sha512(CPUS390XState *env, const int
mmu_idx, uintptr_t ra,
return !len ? 0 : 3;
}
-static void fill_buf_random(CPUS390XState *env, const int mmu_idx, uintptr_t ra,
- uint64_t *buf_reg, uint64_t *len_reg)
+static int fill_buf_random(CPUS390XState *env, const int mmu_idx, uintptr_t ra,
+ uint64_t *buf_reg, uint64_t *len_reg)
{
+ enum { MAX_BYTES_PER_RUN = 8192 }; /* Arbitrary: keep interactivity. */
const MemOpIdx oi = make_memop_idx(MO_8, mmu_idx);
uint8_t tmp[256];
- uint64_t len = *len_reg;
+ uint64_t len = *len_reg, processed = 0;
int buf_reg_len = 64;
if (!(env->psw.mask & PSW_MASK_64)) {
@@ -258,6 +259,10 @@ static void fill_buf_random(CPUS390XState *env, const int
mmu_idx, uintptr_t ra,
while (len) {
size_t block = MIN(len, sizeof(tmp));
+ if (processed >= MAX_BYTES_PER_RUN) {
+ break;
+ }
Alternately, stop with cpu_loop_exit_requested() at the bottom of the loop.
Either way,
Reviewed-by: Richard Henderson <[email protected]>
r~
