)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"824bae2e6e30e5fcbebb77526e2bc9607367b100","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":1,"id":"6f4492b0_200b1b7b","updated":"2026-06-26 15:48:22.000000000","message":"i need to dig into the detail more but this is not totally off base form what i was hopign for\n\ni need ot spend some time diging into some of the design desiosn and implciatons before im comfortable with all fo them but some notes in line form this intial shallow pass.","commit_id":"941d628093789e9791b2c95f7eaff21002f891f6"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"73c5a74f4a46b9289875e2da8eb543d765c5b3ff","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":1,"id":"bcd34406_811cee38","updated":"2026-06-27 11:46:39.000000000","message":"i spent a couple of hours yesterday evning and this moring reviewing this with ai help and create https://paste.opendev.org/show/bDXSGmjCs9TH0NRXcVaK/ as a review guide.\n\noverall i am now convicned that memmap\u003d... kernel arges are reuqied and the right way to do this. \n\nwe willl need ot create a preplaybook to configure the kernel args andreboot the vm in the ci job and then invoke https://opendev.org/zuul/zuul-jobs/src/branch/master/roles/post-reboot-tasks\n\nto restablish the log stream and wait for the vm to be fully back up before proceeding.\n\nfor now we only need to supprot debian but we shoudl make that pre playbook work for ubuntu and centos eventually.\n\nover all this is promising but ther are a number of correctness/safty issues tha teim has found and we need to refien the devstack functionatly and the testing\nbut over all this looks correct directionatlly\n\none thi8ng that would help is to split this up a bit so that its simpler to review.\n\nhopefully that helps","commit_id":"941d628093789e9791b2c95f7eaff21002f891f6"},{"author":{"_account_id":12393,"name":"chandan kumar","display_name":"Chandan Kumar","email":"chkumar@redhat.com","username":"chkumar246"},"change_message_id":"3b320a3f4182c132f5ba4851ff7c197822c10050","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"d9c4f244_2e0a7555","updated":"2026-06-28 09:20:26.000000000","message":"Thank you Sean for taking the time to deeply review it. I might have addressed all of them.\n\nHere is what I was thinking about of breaking them into smaller commits:\n```\n 1. pci-sim: add VF personality mechanism with NVMe config space\n  2. pci-sim: add NVMe 1.4 controller emulation with VFIO guest path\n  3. pci-sim: add Phase 1 NVMe host char device driver with test suite\n  4. pci-sim: add Phase 2 stock nvme driver binding via BAR0 polling\n  5. devstack: add pci-sim multi-PF personality support for NVMe\n  6. pci-sim: add DevStack NVMe passthrough test and CI job\n  7. pci-sim: update documentation for NVMe emulation\n```\nSo that it would be easier to review. But all before that, I want to make sure it works with existing pci-sim tempest tests and present it. Then move forward.\n\nI will mark below addressed later in few weeks. Thank you once again!.","commit_id":"7bfd2c520ad312077947759b8a0d8eb892b758a9"},{"author":{"_account_id":12393,"name":"chandan kumar","display_name":"Chandan Kumar","email":"chkumar@redhat.com","username":"chkumar246"},"change_message_id":"bfdfe1ed6f9b6a72a6330826ec1a044b94b3c318","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"0dee16c5_3744d32e","in_reply_to":"d9c4f244_2e0a7555","updated":"2026-06-28 09:30:10.000000000","message":"More granular\n```\n1. Personality mechanism — sysfs vf_personality attr, NVMe class code/MSIX/BAR0 in config space, UART class_mask fix\n  2. NVMe header — register offsets, opcodes, status codes, SQE/CQE structs, queue/controller state structs\n  3. NVMe lifecycle — init/cleanup/reset/close, file-backed storage, CAP/VS/CC/CSTS state machine\n  4. Identify commands — Identify Controller, Namespace, NS Active List, NS Descriptors\n  5. Queue + features + logs — Create/Delete CQ/SQ, Set/Get Features, Get Log Page\n  6. I/O commands + PRP — Read, Write, Write Zeroes, Flush, PRP list traversal\n  7. Format + Sanitize — Format NVM (LBA format change, secure erase), Sanitize (block erase, overwrite, crypto erase)\n  8. VFIO BAR0 dispatch — register/doorbell routing, IOVA-to-virt translation, VFIO probe/open/close wiring\n  9. VFIO MSIX + guest probes — eventfd interrupt delivery, run_nvme_vfio_guest_probe.sh/.py\n  10. Phase 1 host char device — /dev/pci_sim_nvmeN, NVME_IOCTL_ADMIN/IO_CMD, sysfs attrs, module registration\n  11. Phase 2 BAR0 memory — alloc_pages + SetPageReserved, memremap, BAR0 pre-init before pci_enable_sriov\n  12. Phase 2 polling kthread — register/doorbell dispatch loop, IRQ injection via msi_get_virq + irq_retrigger\n  13. NVMe test suite — test_pci_sim_nvme_host.sh: Phase 1 + Phase 2 + rebind + cross-personality + fio + filesystem\n  14. DevStack multi-PF — PCI_SIM_DEVICES\u003d\"nova:uart,cyborg:nvme\" parsing, per-PF personality, NVMe module params\n  15. DevStack test + CI — shared test helpers, run-devstack-nvme-passthrough-test.sh, Zuul cyborg-tempest-pci-sim-nvme job\n  16. Documentation — developer-guide, testing.rst, overview, devstack docs, README updates\n```\nI will share the plan later on.","commit_id":"7bfd2c520ad312077947759b8a0d8eb892b758a9"},{"author":{"_account_id":12393,"name":"chandan kumar","display_name":"Chandan Kumar","email":"chkumar@redhat.com","username":"chkumar246"},"change_message_id":"c8714c13283d0c94077e3cb6955cbdae9e7bb5d4","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"b5bcb451_bea1b763","updated":"2026-06-29 08:15:15.000000000","message":"Hello @smooney@redhat.com, It is working in CI https://zuul.opendev.org/t/openstack/build/48a8d1139c1b453498b0505a63f451bc\n\nhttps://storage.gra.cloud.ovh.net/v1/AUTH_dcaab5e32b234d56b626f72581e3644c/zuul_opendev_logs_48a/openstack/48a8d1139c1b453498b0505a63f451bc/controller/logs/screen-cyborg-agent.txt\n\nI can see nvme list as a lspci output.\n```\nJun 29 08:07:20.781136 np3c7e8d9685c24 cyborg-agent[78595]: 0000:00:01.0 ISA bridge [0601]: Intel Corporation 82371SB PIIX3 ISA [Natoma/Triton II] [8086:7000]\nJun 29 08:07:20.781136 np3c7e8d9685c24 cyborg-agent[78595]: 0000:00:01.1 IDE interface [0101]: Intel Corporation 82371SB PIIX3 IDE [Natoma/Triton II] [8086:7010]\nJun 29 08:07:20.781136 np3c7e8d9685c24 cyborg-agent[78595]: 0000:00:01.2 USB controller [0c03]: Intel Corporation 82371SB PIIX3 USB [Natoma/Triton II] [8086:7020] (rev 01)\nJun 29 08:07:20.781136 np3c7e8d9685c24 cyborg-agent[78595]: 0000:00:01.3 Bridge [0680]: Intel Corporation 82371AB/EB/MB PIIX4 ACPI [8086:7113] (rev 03)\nJun 29 08:07:20.781136 np3c7e8d9685c24 cyborg-agent[78595]: 0000:00:02.0 VGA compatible controller [0300]: Red Hat, Inc. Virtio 1.0 GPU [1af4:1050] (rev 01)\nJun 29 08:07:20.781136 np3c7e8d9685c24 cyborg-agent[78595]: 0000:00:03.0 Ethernet controller [0200]: Red Hat, Inc. Virtio network device [1af4:1000]\nJun 29 08:07:20.781136 np3c7e8d9685c24 cyborg-agent[78595]: 0000:00:04.0 SCSI storage controller [0100]: Red Hat, Inc. Virtio block device [1af4:1001]\nJun 29 08:07:20.781136 np3c7e8d9685c24 cyborg-agent[78595]: 0000:00:05.0 Unclassified device [00ff]: Red Hat, Inc. Virtio memory balloon [1af4:1002]\nJun 29 08:07:20.781136 np3c7e8d9685c24 cyborg-agent[78595]: 0000:00:06.0 Unclassified device [00ff]: Red Hat, Inc. Virtio RNG [1af4:1005]\nJun 29 08:07:20.781136 np3c7e8d9685c24 cyborg-agent[78595]: 0001:00:00.0 Unassigned class [ff00]: Device [1d55:1000] (rev 01)\nJun 29 08:07:20.781136 np3c7e8d9685c24 cyborg-agent[78595]: 0001:00:00.1 Non-Volatile memory controller [0108]: Device [1d55:1001] (rev 01)\nJun 29 08:07:20.781136 np3c7e8d9685c24 cyborg-agent[78595]: 0001:00:00.2 Non-Volatile memory controller [0108]: Device [1d55:1001] (rev 01)\nJun 29 08:07:20.781136 np3c7e8d9685c24 cyborg-agent[78595]: 0001:00:00.3 Non-Volatile memory controller [0108]: Device [1d55:1001] (rev 01)\nJun 29 08:07:20.781136 np3c7e8d9685c24 cyborg-agent[78595]: 0001:00:00.4 Non-Volatile memory controller [0108]: Device [1d55:1001] (rev 01)\n```","commit_id":"276b746d0b955b91840b522fdad3e57bac9983d9"},{"author":{"_account_id":12393,"name":"chandan kumar","display_name":"Chandan Kumar","email":"chkumar@redhat.com","username":"chkumar246"},"change_message_id":"fd9b5227f7e11e2defeda4a79e4b1b19d0f3c0b2","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"425019b0_76117d0e","in_reply_to":"b5bcb451_bea1b763","updated":"2026-06-30 08:07:16.000000000","message":"Based on recent run https://zuul.opendev.org/t/openstack/build/4205a247259241d6ac1df4005826d4ef with pci tempest test\nhttps://review.opendev.org/c/openstack/cyborg-tempest-plugin/+/995328/3#message-ee76299ab2ab91f7f1a65bbdbc0cae33dcc0c880\nand from tempest.log file https://storage.gra.cloud.ovh.net/v1/AUTH_dcaab5e32b234d56b626f72581e3644c/zuul_opendev_logs_420/openstack/4205a247259241d6ac1df4005826d4ef/controller/logs/tempest_log.txt\n\nlsblk is listing nvme block as well as lspci on guest.\n```\n2026-06-29 16:07:58.075 84635 INFO tempest.lib.common.ssh [-] ssh connection to ubuntu@172.24.5.57 successfully created\n2026-06-29 16:08:00.273 84635 INFO cyborg_tempest_plugin.tests.scenario.test_pci_driver_lifecycle [-] Guest lspci -nn:\n00:00.0 Host bridge [0600]: Intel Corporation 440FX - 82441FX PMC [Natoma] [8086:1237] (rev 02)\n00:01.0 ISA bridge [0601]: Intel Corporation 82371SB PIIX3 ISA [Natoma/Triton II] [8086:7000]\n00:01.1 IDE interface [0101]: Intel Corporation 82371SB PIIX3 IDE [Natoma/Triton II] [8086:7010]\n00:01.3 Bridge [0680]: Intel Corporation 82371AB/EB/MB PIIX4 ACPI [8086:7113] (rev 03)\n00:02.0 VGA compatible controller [0300]: Red Hat, Inc. Virtio 1.0 GPU [1af4:1050] (rev 01)\n00:03.0 Ethernet controller [0200]: Red Hat, Inc. Virtio network device [1af4:1000]\n00:04.0 SCSI storage controller [0100]: Red Hat, Inc. Virtio block device [1af4:1001]\n00:05.0 Non-Volatile memory controller [0108]: Device [1d55:1001] (rev 01)\n00:06.0 Unclassified device [00ff]: Red Hat, Inc. Virtio memory balloon [1af4:1002]\n00:07.0 Unclassified device [00ff]: Red Hat, Inc. Virtio RNG [1af4:1005]\n\n2026-06-29 16:08:00.273 84635 DEBUG tempest.lib.common.utils.linux.remote_client [-] Remote command: set -eu -o pipefail; PATH\u003d$PATH:/sbin:/usr/sbin; lsblk 2\u003e/dev/null || echo \"lsblk not available\" exec_command /opt/stack/tempest/tempest/lib/common/utils/linux/remote_client.py:114\n2026-06-29 16:08:00.273 84635 INFO tempest.lib.common.ssh [-] Creating ssh connection to \u0027172.24.5.57:22\u0027 as \u0027ubuntu\u0027 with public key authentication\n2026-06-29 16:08:01.264 84635 INFO paramiko.transport [-] Connected (version 2.0, client OpenSSH_9.6p1)\n2026-06-29 16:08:01.668 84635 INFO paramiko.transport [-] Authentication (publickey) successful!\n2026-06-29 16:08:01.669 84635 INFO tempest.lib.common.ssh [-] ssh connection to ubuntu@172.24.5.57 successfully created\n2026-06-29 16:08:02.658 84635 INFO cyborg_tempest_plugin.tests.scenario.test_pci_driver_lifecycle [-] Guest lsblk:\nNAME    MAJ:MIN RM  SIZE RO TYPE MOUNTPOINTS\nvda     253:0    0    5G  0 disk \n├─vda1  253:1    0    4G  0 part /\n├─vda14 253:14   0    4M  0 part \n├─vda15 253:15   0  106M  0 part /boot/efi\n└─vda16 259:0    0  913M  0 part /boot\nnvme0n1 259:1    0   64M  0 disk \n```","commit_id":"276b746d0b955b91840b522fdad3e57bac9983d9"}],"devstack/lib/pci_sim":[{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"824bae2e6e30e5fcbebb77526e2bc9607367b100","unresolved":true,"context_lines":[{"line_number":8,"context_line":"PCI_SIM_PF_DEVICE_ID\u003d${PCI_SIM_PF_DEVICE_ID:-0x1000}"},{"line_number":9,"context_line":"PCI_SIM_VF_DEVICE_ID\u003d${PCI_SIM_VF_DEVICE_ID:-0x1001}"},{"line_number":10,"context_line":"PCI_SIM_MODULE_NAME\u003d${PCI_SIM_MODULE_NAME:-fake_pci_sriov}"},{"line_number":11,"context_line":"PCI_SIM_DEVICE_TYPE\u003d${PCI_SIM_DEVICE_TYPE:-uart}"},{"line_number":12,"context_line":"PCI_SIM_NVME_NS_SIZE_MB\u003d${PCI_SIM_NVME_NS_SIZE_MB:-64}"},{"line_number":13,"context_line":"PCI_SIM_NVME_BACKING_FILE\u003d${PCI_SIM_NVME_BACKING_FILE:-/tmp/pci-sim-nvme}"},{"line_number":14,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":1,"id":"630614c7_c6274b9d","line":11,"range":{"start_line":11,"start_character":0,"end_line":11,"end_character":48},"updated":"2026-06-26 15:48:22.000000000","message":"we will want to be able to use both the uart and nvme profiel on diffent PFs at the same time since we are nto going ot use a diffent job for this vs the other testing.\n\nso we really need somethin more like a service to personaltiy mapp\n\nPCI_SIM_DEVICES\u003d\"nova:uart,nova:mdev,cyborg:uart,cyborg:nvme,cyborg:mdev\"\n\ni.e. that would replace our current PCI_SIM_NUM_PFS\n\nalso if the option is expected to be configure it should be in devstack/setting not here\n\nvalues in here are for thing that can technially be chagne but should not be in general.","commit_id":"941d628093789e9791b2c95f7eaff21002f891f6"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"824bae2e6e30e5fcbebb77526e2bc9607367b100","unresolved":true,"context_lines":[{"line_number":10,"context_line":"PCI_SIM_MODULE_NAME\u003d${PCI_SIM_MODULE_NAME:-fake_pci_sriov}"},{"line_number":11,"context_line":"PCI_SIM_DEVICE_TYPE\u003d${PCI_SIM_DEVICE_TYPE:-uart}"},{"line_number":12,"context_line":"PCI_SIM_NVME_NS_SIZE_MB\u003d${PCI_SIM_NVME_NS_SIZE_MB:-64}"},{"line_number":13,"context_line":"PCI_SIM_NVME_BACKING_FILE\u003d${PCI_SIM_NVME_BACKING_FILE:-/tmp/pci-sim-nvme}"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"function pci_sim_validate_config {"},{"line_number":16,"context_line":"    # The module supports up to 16 fake host bridges/PFs and up to 7 VFs"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"dd27f20b_2487a122","line":13,"range":{"start_line":13,"start_character":0,"end_line":13,"end_character":20},"updated":"2026-06-26 15:48:22.000000000","message":"```suggestion\nPCI_SIM_NVME_BACKING_DIR\u003d${PCI_SIM_NVME_BACKING_DIR:-\"${DEST}/data/pci-sim/nvme\"}\n```","commit_id":"941d628093789e9791b2c95f7eaff21002f891f6"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"824bae2e6e30e5fcbebb77526e2bc9607367b100","unresolved":true,"context_lines":[{"line_number":9,"context_line":"PCI_SIM_VF_DEVICE_ID\u003d${PCI_SIM_VF_DEVICE_ID:-0x1001}"},{"line_number":10,"context_line":"PCI_SIM_MODULE_NAME\u003d${PCI_SIM_MODULE_NAME:-fake_pci_sriov}"},{"line_number":11,"context_line":"PCI_SIM_DEVICE_TYPE\u003d${PCI_SIM_DEVICE_TYPE:-uart}"},{"line_number":12,"context_line":"PCI_SIM_NVME_NS_SIZE_MB\u003d${PCI_SIM_NVME_NS_SIZE_MB:-64}"},{"line_number":13,"context_line":"PCI_SIM_NVME_BACKING_FILE\u003d${PCI_SIM_NVME_BACKING_FILE:-/tmp/pci-sim-nvme}"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"function pci_sim_validate_config {"},{"line_number":16,"context_line":"    # The module supports up to 16 fake host bridges/PFs and up to 7 VFs"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"7c7430c6_870ce62e","line":13,"range":{"start_line":12,"start_character":1,"end_line":13,"end_character":73},"updated":"2026-06-26 15:48:22.000000000","message":"these shoudl be in setting too.","commit_id":"941d628093789e9791b2c95f7eaff21002f891f6"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"4bc11ce7a56cd6279855972d2749219558d13616","unresolved":false,"context_lines":[{"line_number":23,"context_line":"        return"},{"line_number":24,"context_line":"    fi"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"    IFS\u003d\u0027,\u0027 read -ra entries \u003c\u003c\u003c \"$PCI_SIM_DEVICES\""},{"line_number":27,"context_line":"    for entry in \"${entries[@]}\"; do"},{"line_number":28,"context_line":"        entry\u003d$(echo \"$entry\" | xargs)"},{"line_number":29,"context_line":"        svc\u003d\"${entry%%:*}\""}],"source_content_type":"application/octet-stream","patch_set":3,"id":"95daaa7a_6661dcb5","line":26,"updated":"2026-06-28 10:09:47.000000000","message":"devstack/lib/pci_sim pci_sim_parse_devices uses \u0027entries\u0027 array without a \u0027local\u0027 declaration, leaking it into the function\u0027s caller scope. The variable is not in the \u0027local entry svc pers\u0027 list at the top of the function.\n\n**Severity**: WARNING | **Confidence**: 0.7\n\n**Impact**: The variable leaks into the global namespace and could collide with another \u0027entries\u0027. A pre-existing global \u0027entries\u0027 would shadow it. DevStack runs with set -u in places.\n\n**Suggestion**:\nAdd \u0027entries\u0027 to the \u0027local\u0027 declaration: \u0027local entry svc pers entries\u0027. This keeps the variable scoped to the function and matches the local-first style used in pci_sim_find_devs.","commit_id":"fe98d64830043cbea7292c4cb3e91d1441680ecb"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"4bc11ce7a56cd6279855972d2749219558d13616","unresolved":false,"context_lines":[{"line_number":386,"context_line":"        target\u003d$(pci_sim_pf_target \"$index\")"},{"line_number":387,"context_line":"        if [[ $target \u003d\u003d \"$wanted_target\" ]]; then"},{"line_number":388,"context_line":"            mapfile -t pf_vfs \u003c \u003c(pci_sim_find_vfs_for_pf \"$pf\")"},{"line_number":389,"context_line":"            printf \u0027%s"},{"line_number":390,"context_line":"\u0027 \"${pf_vfs[@]}\""},{"line_number":391,"context_line":"        fi"},{"line_number":392,"context_line":"        index\u003d$((index + 1))"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"2fe0c9a6_e45b9eb9","line":389,"updated":"2026-06-28 10:09:47.000000000","message":"devstack/lib/pci_sim pci_sim_collect_target_vfs embeds a literal newline inside the printf format string (printf \u0027%s\\n\u0027 with the newline as an actual line break in the source) instead of using an escaped \\n on a single line.\n\n**Severity**: WARNING | **Confidence**: 0.9\n\n**Impact**: This works because bash treats the embedded newline literally, but it is fragile and confusing. A maintainer reading the source sees a split string and a future editor may \u0027fix\u0027 it incorrectly.\n\n**Suggestion**:\nReplace with printf \u0027%s\\n\u0027 \"${pf_vfs[@]}\" on a single line using an escaped backslash-n, matching the convention used elsewhere in the plugin.","commit_id":"fe98d64830043cbea7292c4cb3e91d1441680ecb"}],"doc/source/contributor/pci-sim/devstack.rst":[{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"4bc11ce7a56cd6279855972d2749219558d13616","unresolved":false,"context_lines":[{"line_number":59,"context_line":""},{"line_number":60,"context_line":"``PCI_SIM_CONFIGURE_NOVA_PCI``"},{"line_number":61,"context_line":"  Configure Nova to consume pci-sim VFs directly using Nova\u0027s ``[pci]``"},{"line_number":62,"context_line":"  ``device_spec`` and ``alias`` options.  Defaults to ``False``.  Nova entries"},{"line_number":63,"context_line":"  are generated by exact VF address and use ``managed\u003d\\\"no\\\"``.  The plugin"},{"line_number":64,"context_line":"  updates both ``/etc/nova/nova.conf`` and, when present, DevStack\u0027s compute"},{"line_number":65,"context_line":"  service config ``/etc/nova/nova-cpu.conf``."}],"source_content_type":"text/x-rst","patch_set":3,"id":"d8edf94c_d5e6dddb","line":62,"updated":"2026-06-28 10:09:47.000000000","message":"devstack.rst says PCI_SIM_CONFIGURE_NOVA_PCI \u0027Defaults to False\u0027, but devstack/settings sets it via trueorfalse ${ENABLE_PCI_SIM}, meaning it defaults to True whenever pci-sim is enabled. The same applies to PCI_SIM_CONFIGURE_CYBORG_PCI.\n\n**Severity**: SUGGESTION | **Confidence**: 0.8\n\n**Benefit**: A reader following the docs would expect no Nova PCI config unless they opt in, but the actual behavior is that it is on by default. Correcting the docs prevents confusion when debugging device_spec injection.\n\n**Recommendation**:\nUpdate devstack.rst to state the actual default: \u0027Defaults to the value of ENABLE_PCI_SIM\u0027 (i.e. True when pci-sim is on). Mirror the wording already used for PCI_SIM_BUILD/PCI_SIM_LOAD.","commit_id":"fe98d64830043cbea7292c4cb3e91d1441680ecb"}],"pci-sim/fake_pci_sriov.h":[{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"824bae2e6e30e5fcbebb77526e2bc9607367b100","unresolved":true,"context_lines":[{"line_number":118,"context_line":"\tenum pci_sim_personality personality;"},{"line_number":119,"context_line":"\tstruct mutex lock;"},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"\t/* Phase 2: reserved memory BAR0 for stock nvme driver binding */"},{"line_number":122,"context_line":"\tvoid __iomem *bar0_mapped;"},{"line_number":123,"context_line":"\tstruct pci_sim_nvme nvme_state[MAX_VFS];"},{"line_number":124,"context_line":"\tstruct task_struct *poll_kthread;"},{"line_number":125,"context_line":"\tu32 shadow_cc[MAX_VFS];"},{"line_number":126,"context_line":"\tu32 shadow_dbs[MAX_VFS][PCI_SIM_NVME_MAX_IO_QUEUES * 2 + 2];"},{"line_number":127,"context_line":"};"},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"struct pci_sim_uart {"}],"source_content_type":"text/x-csrc","patch_set":1,"id":"973661d5_809c8fe3","line":126,"range":{"start_line":121,"start_character":1,"end_line":126,"end_character":61},"updated":"2026-06-26 15:48:22.000000000","message":"im not sure this is the correct play to store this\n\ni woudl have expected it to be in a pci_sim_nvme struct not in the fake_pci_host\n\nthat or part of\n\nstruct resource bus_resource;\nstruct resource mem_resource;\n\ndepedingin on hwo it is used.","commit_id":"941d628093789e9791b2c95f7eaff21002f891f6"}],"pci-sim/fake_pci_sriov_cfg.c":[{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"709ed6945feaad371d0c401117ea339fa2236b4e","unresolved":false,"context_lines":[{"line_number":623,"context_line":""},{"line_number":624,"context_line":"\tif (host-\u003ebar0_mapped) {"},{"line_number":625,"context_line":"\t\tfor (i \u003d 0; i \u003c num_vfs; i++) {"},{"line_number":626,"context_line":"\t\t\thost-\u003envme_state[i].pdev \u003d"},{"line_number":627,"context_line":"\t\t\t\tpci_get_domain_bus_and_slot("},{"line_number":628,"context_line":"\t\t\t\t\thost-\u003edomain_nr, 0,"},{"line_number":629,"context_line":"\t\t\t\t\tPCI_DEVFN(0, i + 1));"}],"source_content_type":"text/x-csrc","patch_set":4,"id":"caab3ff5_c5facbbd","line":626,"updated":"2026-06-29 05:22:27.000000000","message":"sriov_configure sets nvme_state[i].pdev via pci_get_domain_bus_and_slot (takes a ref) while poll_check_regs also calls it guarded only by if(!nvme-\u003epdev); a pre-init or re-enable race can acquire a second ref without releasing the first.\n\n**Severity**: HIGH | **Confidence**: 0.7\n\n**Risk**: A leaked pci_dev reference pins the device and its sysfs resources, preventing clean module unload or VF re-creation across personality switches and restacks.\n\n**Priority**: Before merge\n**Why This Matters**: DevStack stack/unstack cycles and the personality-switch test repeatedly create and destroy VFs; reference leaks compound over repeated runs and the test suite specifically exercises cross-personality switching.\n\n**Recommendation**:\nAcquire the pdev reference in exactly one place: either assign it only in poll_check_regs (and have configure not set it), or set it in configure and make poll_check_regs never re-get. Add a defensive pci_dev_put of any prior value before overwriting pdev, and zero pdev in poll_vf_cleanup before the next enable.","commit_id":"8cb337f7f11a274a16c17c29b793cbfec39335f4"}],"pci-sim/fake_pci_sriov_core.c":[{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"824bae2e6e30e5fcbebb77526e2bc9607367b100","unresolved":true,"context_lines":[{"line_number":29,"context_line":"MODULE_PARM_DESC(vfio_uart_trace,"},{"line_number":30,"context_line":"\t\t \"Trace VFIO BAR0 UART register accesses\");"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"unsigned int nvme_ns_size_mb \u003d 64;"},{"line_number":33,"context_line":"module_param(nvme_ns_size_mb, uint, 0444);"},{"line_number":34,"context_line":"MODULE_PARM_DESC(nvme_ns_size_mb,"},{"line_number":35,"context_line":"\t\t \"Size of NVMe namespace backing store in MB (default 64)\");"},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"char *nvme_backing_file \u003d \"/tmp/pci-sim-nvme\";"},{"line_number":38,"context_line":"module_param(nvme_backing_file, charp, 0444);"},{"line_number":39,"context_line":"MODULE_PARM_DESC(nvme_backing_file,"},{"line_number":40,"context_line":"\t\t \"Path prefix for NVMe backing files (per-VF: \u003cprefix\u003e.\u003cindex\u003e)\");"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"unsigned long nvme_memmap_start;"},{"line_number":43,"context_line":"module_param(nvme_memmap_start, ulong, 0444);"},{"line_number":44,"context_line":"MODULE_PARM_DESC(nvme_memmap_start,"},{"line_number":45,"context_line":"\t\t \"Physical start address of reserved memory for NVMe BAR0 (requires memmap\u003d boot param)\");"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"unsigned long nvme_memmap_size;"},{"line_number":48,"context_line":"module_param(nvme_memmap_size, ulong, 0444);"},{"line_number":49,"context_line":"MODULE_PARM_DESC(nvme_memmap_size,"},{"line_number":50,"context_line":"\t\t \"Size of reserved memory for NVMe BAR0 in bytes\");"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"static int fake_intx_irq;"},{"line_number":53,"context_line":"module_param(fake_intx_irq, int, 0644);"}],"source_content_type":"text/x-csrc","patch_set":1,"id":"6634d8d3_f1b7840e","line":50,"range":{"start_line":32,"start_character":0,"end_line":50,"end_character":53},"updated":"2026-06-26 15:48:22.000000000","message":"i am not confived this is the corect approch\n\nwe shoudl be using backing files which this appar to do\n\nwe can have a module option for the size of that (and or sysfs parmater to allow seting per pf)\n\nbut \n```\nunsigned long nvme_memmap_start;\nmodule_param(nvme_memmap_start, ulong, 0444);\nMODULE_PARM_DESC(nvme_memmap_start,\n\t\t \"Physical start address of reserved memory for NVMe BAR0 (requires memmap\u003d boot param)\");\n\nunsigned long nvme_memmap_size;\nmodule_param(nvme_memmap_size, ulong, 0444);\nMODULE_PARM_DESC(nvme_memmap_size,\n\t\t \"Size of reserved memory for NVMe BAR0 in bytes\");\n```\nshoudl be dynimcally lcoacated iwthout requrie us to reserve space via memmap\u003d \nand the size of the bar0 regain shoudl be fixed and small.\n\ni..e just large enouch to cover the requried io queues and cortrol registers.\n\nhopefly that will be in the 10s of KBs pervf not the 10s or MBs\n\ni would really like to not require kernel args and a reboot to be able to use this fucntionality if we can avoid that.","commit_id":"941d628093789e9791b2c95f7eaff21002f891f6"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"4bc11ce7a56cd6279855972d2749219558d13616","unresolved":false,"context_lines":[{"line_number":328,"context_line":"{"},{"line_number":329,"context_line":"\tstruct platform_device *pdev;"},{"line_number":330,"context_line":"\tint i;"},{"line_number":331,"context_line":""},{"line_number":332,"context_line":"\tif (!host)"},{"line_number":333,"context_line":"\t\treturn;"},{"line_number":334,"context_line":""}],"source_content_type":"text/x-csrc","patch_set":3,"id":"76cc53d1_08c0678d","line":331,"updated":"2026-06-28 10:09:47.000000000","message":"In fake_pci_host_remove, pci_sim_nvme_poll_stop(host) (kthread_stop) runs AFTER pci_stop_root_bus/pci_remove_root_bus tear down the PCI bus. The poll kthread may still touch nvme_state[].pdev between bus teardown and kthread_stop completing.\n\n**Severity**: HIGH | **Confidence**: 0.8\n\n**Risk**: Lifetime mismatch: the poll kthread dereferences nvme-\u003epdev-derived resources after the PCI bus is removed but before kthread_stop completes, causing a use-after-free on the pci_dev structure.\n\n**Priority**: Before merge\n**Why This Matters**: This is exactly the soft-lockup / use-after-free window the change is trying to eliminate. Getting the stop/teardown ordering wrong defeats the purpose and can panic the host.\n\n**Recommendation**:\nStop the polling kthread (pci_sim_nvme_poll_stop) BEFORE tearing down the PCI bus in fake_pci_host_remove. Null out nvme_state[i].pdev under poll_lock before bus removal so the kthread observes the NULL and skips the VF.","commit_id":"fe98d64830043cbea7292c4cb3e91d1441680ecb"}],"pci-sim/fake_pci_sriov_nvme.c":[{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"1afc7d4f00f55d2845e98936f9c027e121cb24d3","unresolved":false,"context_lines":[{"line_number":61,"context_line":"\tcqe-\u003ersvd \u003d 0;"},{"line_number":62,"context_line":"\tcqe-\u003esq_head \u003d cpu_to_le16(sq_head);"},{"line_number":63,"context_line":"\tcqe-\u003esq_id \u003d cpu_to_le16(sq_id);"},{"line_number":64,"context_line":"\tcqe-\u003ecommand_id \u003d command_id;"},{"line_number":65,"context_line":"\tcqe-\u003estatus \u003d cpu_to_le16((status \u003c\u003c 1) | cq-\u003ecq_phase);"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"\tcq-\u003ecq_tail++;"}],"source_content_type":"text/x-csrc","patch_set":1,"id":"bc3a7b88_c24f2513","line":64,"updated":"2026-06-26 15:16:00.000000000","message":"nvme_sim_post_completion writes cqe-\u003ecommand_id directly without cpu_to_le16(). The SQE command_id is __u16 but CQE command_id is __le16, creating a byte-order inconsistency on big-endian.\n\n**Severity**: SUGGESTION | **Confidence**: 0.7\n\n**Benefit**: Correctness on big-endian architectures and consistency with the rest of the CQE fields which use cpu_to_le16.\n\n**Recommendation**:\nChange line 64 to cqe-\u003ecommand_id \u003d cpu_to_le16(command_id); to match the field\u0027s __le16 declaration. The SQE command_id should also be read with le16_to_cpu at the dispatch site.","commit_id":"941d628093789e9791b2c95f7eaff21002f891f6"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"1afc7d4f00f55d2845e98936f9c027e121cb24d3","unresolved":false,"context_lines":[{"line_number":126,"context_line":"\t}"},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"\t/* Case 3: PRP2 is a PRP list pointer */"},{"line_number":129,"context_line":"\twhile (transferred \u003c len) {"},{"line_number":130,"context_line":"\t\t__le64 *prp_list;"},{"line_number":131,"context_line":"\t\tsize_t chunk;"},{"line_number":132,"context_line":"\t\tu64 prp_entry;"}],"source_content_type":"text/x-csrc","patch_set":1,"id":"05e32347_89cad3b4","line":129,"updated":"2026-06-26 15:16:00.000000000","message":"PRP list traversal has no bound on chain depth, allowing an infinite loop if a PRP list entry chains back to itself or forms a cycle. The while loop in nvme_sim_prp_transfer follows prp2 \u003d prp_entry to traverse chained lists with no visited-set or iteration counter.\n\n**Severity**: HIGH | **Confidence**: 0.8\n\n**Risk**: A malicious or buggy guest can craft PRP lists that chain in a cycle, causing the kernel to loop indefinitely in the VFIO write handler (process context), soft-locking the CPU.\n\n**Priority**: Before merge\n**Why This Matters**: Even with the batch limit in process_sq, each individual PRP transfer can loop unboundedly if the chain cycles.\n\n**Recommendation**:\nTrack total bytes transferred and ensure the loop terminates when transferred \u003e\u003d len (it does via the inner while condition), but also add a max chain count (e.g., len / page_size + 2) as a hard limit to break pathological cycles.","commit_id":"941d628093789e9791b2c95f7eaff21002f891f6"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"1afc7d4f00f55d2845e98936f9c027e121cb24d3","unresolved":false,"context_lines":[{"line_number":181,"context_line":""},{"line_number":182,"context_line":"\twhile (len \u003e 0) {"},{"line_number":183,"context_line":"\t\tchunk \u003d min_t(size_t, len, PAGE_SIZE);"},{"line_number":184,"context_line":"\t\tkernel_write(fp, zeros, chunk, \u0026offset);"},{"line_number":185,"context_line":"\t\tlen -\u003d chunk;"},{"line_number":186,"context_line":"\t}"},{"line_number":187,"context_line":"\tkfree(zeros);"}],"source_content_type":"text/x-csrc","patch_set":1,"id":"0be0ada5_9e9ceae6","line":184,"updated":"2026-06-26 15:16:00.000000000","message":"nvme_sim_file_zero and nvme_sim_file_fill silently ignore the return value of kernel_write. If the backing file write fails (disk full, I/O error), the sanitize/format/zero operation reports success to the NVMe client despite data not being written.\n\n**Severity**: WARNING | **Confidence**: 0.9\n\n**Impact**: Format and sanitize commands silently succeed even when backing file I/O fails, giving false confidence in data erasure.\n\n**Suggestion**:\nCapture the kernel_write return value and return an error from nvme_sim_file_zero/nvme_sim_file_fill, propagating it as NVME_SC_INTERNAL from the calling format/sanitize paths.","commit_id":"941d628093789e9791b2c95f7eaff21002f891f6"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"1afc7d4f00f55d2845e98936f9c027e121cb24d3","unresolved":false,"context_lines":[{"line_number":801,"context_line":"u16 pci_sim_nvme_do_read(struct pci_sim_nvme *nvme, void *buf,"},{"line_number":802,"context_line":"\t\t\t u64 slba, u16 nlb)"},{"line_number":803,"context_line":"{"},{"line_number":804,"context_line":"\tloff_t offset \u003d slba * nvme-\u003elba_size;"},{"line_number":805,"context_line":"\tsize_t len \u003d (size_t)nlb * nvme-\u003elba_size;"},{"line_number":806,"context_line":""},{"line_number":807,"context_line":"\tif (offset + len \u003e nvme-\u003estorage_size)"}],"source_content_type":"text/x-csrc","patch_set":1,"id":"9d3f0f18_c14bf5ee","line":804,"updated":"2026-06-26 15:16:00.000000000","message":"Integer overflow in NVMe I/O read/write: offset \u003d slba * lba_size can wrap 64-bit, bypassing the bounds check and causing OOB kernel_read/kernel_write on the backing file.\n\n**Severity**: CRITICAL | **Confidence**: 0.8\n\n**Risk**: A guest or userspace client crafting an NVMe read/write command with a large slba can trigger a 64-bit multiplication overflow, bypass the bounds check, and cause a kernel heap overflow or OOB write via kernel_read/kernel_write on the backing file.\n\n**Priority**: Immediate\n**Why This Matters**: Kernel memory corruption from untrusted NVMe command input. Even in a test fixture, this can crash the host kernel during VFIO guest testing.\n\n**Recommendation**:\nUse check_mul_overflow() to detect overflow: if (check_mul_overflow(slba, (u64)nvme-\u003elba_size, \u0026offset)) return NVME_SC_INVALID_FIELD; Also validate slba + nlb does not exceed num_lbas before the multiplication.","commit_id":"941d628093789e9791b2c95f7eaff21002f891f6"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"1afc7d4f00f55d2845e98936f9c027e121cb24d3","unresolved":false,"context_lines":[{"line_number":807,"context_line":"\tif (offset + len \u003e nvme-\u003estorage_size)"},{"line_number":808,"context_line":"\t\treturn NVME_SC_INVALID_FIELD;"},{"line_number":809,"context_line":""},{"line_number":810,"context_line":"\tkernel_read(nvme-\u003ebacking_fp, buf, len, \u0026offset);"},{"line_number":811,"context_line":"\treturn NVME_SC_SUCCESS;"},{"line_number":812,"context_line":"}"},{"line_number":813,"context_line":""}],"source_content_type":"text/x-csrc","patch_set":1,"id":"3f431188_77a8aa22","line":810,"updated":"2026-06-26 15:16:00.000000000","message":"nvme_sim_io_read and nvme_sim_io_write ignore the return value of kernel_read/kernel_write in pci_sim_nvme_do_read/do_write. A partial read or I/O error returns NVME_SC_SUCCESS with uninitialized or short buffer data transferred to the guest.\n\n**Severity**: WARNING | **Confidence**: 0.9\n\n**Impact**: I/O errors on the backing file are masked; the guest receives stale data and a success status, violating NVMe error reporting semantics.\n\n**Suggestion**:\nCheck the ssize_t return from kernel_read/kernel_write. If negative, return NVME_SC_INTERNAL; if short, return NVME_SC_SUCCESS only for complete transfers.","commit_id":"941d628093789e9791b2c95f7eaff21002f891f6"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"1afc7d4f00f55d2845e98936f9c027e121cb24d3","unresolved":false,"context_lines":[{"line_number":944,"context_line":"\tif (!sq-\u003esq_base)"},{"line_number":945,"context_line":"\t\treturn;"},{"line_number":946,"context_line":""},{"line_number":947,"context_line":"\twhile (sq-\u003esq_head !\u003d sq-\u003esq_tail \u0026\u0026 budget-- \u003e 0) {"},{"line_number":948,"context_line":"\t\tsqe \u003d (struct pci_sim_nvme_sqe *)sq-\u003esq_base + sq-\u003esq_head;"},{"line_number":949,"context_line":""},{"line_number":950,"context_line":"\t\tif (qid \u003d\u003d 0)"}],"source_content_type":"text/x-csrc","patch_set":1,"id":"a0fd2306_d73eca5b","line":947,"updated":"2026-06-26 15:16:00.000000000","message":"nvme_sim_process_sq lacks an sq_depth \u003e 0 guard. If a queue is activated with stale or zero depth (the rebind race from the commit message), the batch limit of 64 is a band-aid, not a root-cause fix.\n\n**Severity**: CRITICAL | **Confidence**: 0.7\n\n**Risk**: If a queue is activated with sq_depth\u003d0 (the rebind race from the commit message), stale zero values caused documented soft lockups. The batch limit prevents hangs but the root cause is unguarded.\n\n**Priority**: Before merge\n**Why This Matters**: The commit message documents this exact soft-lockup bug. The batch limit prevents hangs but the root cause (processing commands on a queue with uninitialized depth) should be guarded explicitly.\n\n**Recommendation**:\nAdd an explicit check: if (sq-\u003esq_depth \u003d\u003d 0) return; at the top of nvme_sim_process_sq, and ensure all queue creation paths validate depth \u003e 0 before setting sq_base.","commit_id":"941d628093789e9791b2c95f7eaff21002f891f6"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"64996d6bb6b27192b8bb9dfc540fd713b0dd9187","unresolved":false,"context_lines":[{"line_number":831,"context_line":"{"},{"line_number":832,"context_line":"\tu64 end_lba;"},{"line_number":833,"context_line":"\tu64 end;"},{"line_number":834,"context_line":"\tsize_t len \u003d (size_t)nlb * nvme-\u003elba_size;"},{"line_number":835,"context_line":"\tloff_t offset;"},{"line_number":836,"context_line":""},{"line_number":837,"context_line":"\tif (check_add_overflow((u64)slba, (u64)nlb, \u0026end_lba) ||"}],"source_content_type":"text/x-csrc","patch_set":2,"id":"c85441bc_ea9ed270","line":834,"updated":"2026-06-28 09:42:28.000000000","message":"validate_lba_range computes len \u003d (size_t)nlb * nvme-\u003elba_size with an unchecked multiply, while adjacent guards use check_mul_overflow/check_add_overflow for slba*lba_size and offset+len. The same unchecked pattern is duplicated in nvme_sim_io_read (912) and nvme_sim_io_write (938).\n\n**Severity**: WARNING | **Confidence**: 0.8\n\n**Impact**: Currently safe because nlb is u16 and the (size_t) cast promotes before multiply, but the pattern is inconsistent with the careful overflow checking around it and will silently break if lba_size or nlb types widen.\n\n**Suggestion**:\nUse check_mul_overflow(nlb, nvme-\u003elba_size, \u0026len) for consistency, or add a comment documenting that nlb is bounded to u16 so the multiply cannot overflow. Centralize the len computation in a helper to avoid the three duplicated unchecked multiplies.","commit_id":"7bfd2c520ad312077947759b8a0d8eb892b758a9"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"64996d6bb6b27192b8bb9dfc540fd713b0dd9187","unresolved":false,"context_lines":[{"line_number":914,"context_line":"\tu16 status;"},{"line_number":915,"context_line":"\tint ret;"},{"line_number":916,"context_line":""},{"line_number":917,"context_line":"\tbuf \u003d kvmalloc(len, GFP_KERNEL);"},{"line_number":918,"context_line":"\tif (!buf)"},{"line_number":919,"context_line":"\t\treturn NVME_SC_INTERNAL;"},{"line_number":920,"context_line":""}],"source_content_type":"text/x-csrc","patch_set":2,"id":"989f7497_2365baab","line":917,"updated":"2026-06-28 09:42:28.000000000","message":"nvme_sim_io_read and nvme_sim_io_write allocate the full transfer buffer (kvmalloc(len)) before validate_lba_range is reached (validation happens inside pci_sim_nvme_do_read/do_write). A request for a huge but invalid LBA range still forces a large allocation.\n\n**Severity**: SUGGESTION | **Confidence**: 0.9\n\n**Benefit**: Validating the LBA range before allocating the buffer avoids pointlessly large kvmalloc calls for out-of-range I/O, reducing memory pressure from malformed VFIO BAR0 commands.\n\n**Recommendation**:\nCall validate_lba_range before kvmalloc in nvme_sim_io_read/nvme_sim_io_write, then pass the validated offset/len into do_read/do_write, or have do_read accept a pre-validated buffer.","commit_id":"7bfd2c520ad312077947759b8a0d8eb892b758a9"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"64996d6bb6b27192b8bb9dfc540fd713b0dd9187","unresolved":false,"context_lines":[{"line_number":1321,"context_line":"\tpci_sim_nvme_reset(nvme);"},{"line_number":1322,"context_line":""},{"line_number":1323,"context_line":"\tif (nvme-\u003ebacking_fp)"},{"line_number":1324,"context_line":"\t\tnvme_sim_file_zero(nvme-\u003ebacking_fp, 0, nvme-\u003estorage_size);"},{"line_number":1325,"context_line":"}"},{"line_number":1326,"context_line":""},{"line_number":1327,"context_line":"void pci_sim_nvme_cleanup(struct pci_sim_nvme *nvme)"}],"source_content_type":"text/x-csrc","patch_set":2,"id":"ee43a6b1_1966554d","line":1324,"updated":"2026-06-28 09:42:28.000000000","message":"pci_sim_nvme_close zeroes the entire backing file (full storage_size) on every VFIO close_device. Called from pci_sim_vfio_close_device on each guest detach. With 64MB default namespace this performs O(storage) synchronous kernel_write per close and destroys all data on normal VM shutdown/detach.\n\n**Severity**: HIGH | **Confidence**: 0.9\n\n**Risk**: O(storage_size) synchronous write I/O on every VFIO device close causes multi-second stalls; data is silently destroyed on normal detach rather than only on explicit sanitize/format/reset. Surprising for test consumers.\n\n**Priority**: Before merge\n**Why This Matters**: Each VM detach or VFIO container close triggers a full-file zero pass (64MB+ of page-sized kernel_write loops). This is slow and destroys backing data unexpectedly; sanitize-on-close semantics should be opt-in or moved to cleanup.\n\n**Recommendation**:\nRemove the file_zero from pci_sim_nvme_close; restrict data destruction to pci_sim_nvme_cleanup (device removal) or make it gated behind an explicit sanitize/format command. If a \u0027clean slate per attach\u0027 is intended, add a module parameter to disable it.","commit_id":"7bfd2c520ad312077947759b8a0d8eb892b758a9"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"4bc11ce7a56cd6279855972d2749219558d13616","unresolved":false,"context_lines":[{"line_number":57,"context_line":"\tif (!cq-\u003ecq_base || !cq-\u003ecreated)"},{"line_number":58,"context_line":"\t\treturn;"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"\t/* CQ full: tail is about to overwrite unprocessed entries */"},{"line_number":61,"context_line":"\tif (cq-\u003ecq_depth \u0026\u0026"},{"line_number":62,"context_line":"\t    (cq-\u003ecq_tail + 1) % cq-\u003ecq_depth \u003d\u003d cq-\u003ecq_head)"},{"line_number":63,"context_line":"\t\treturn;"}],"source_content_type":"text/x-csrc","patch_set":3,"id":"3fe50027_cc6f81ce","line":60,"updated":"2026-06-28 10:09:47.000000000","message":"nvme_sim_post_completion silently drops completions when the CQ is full. It returns without posting the CQE and without any error/backpressure, so the corresponding SQE is consumed (sq_head already advanced) but its completion is lost. The host will never see the command complete.\n\n**Severity**: WARNING | **Confidence**: 0.8\n\n**Impact**: A lost completion stalls the host driver indefinitely for that command_id and there is no log indicating why. Debugging a hung nvme device against this emulator becomes very difficult.\n\n**Suggestion**:\nAt minimum emit a rate-limited pr_warn_ratelimited when the CQ-full drop occurs so the failure mode is diagnosable. Preferably do not advance sq_head for a command whose completion cannot be posted.","commit_id":"fe98d64830043cbea7292c4cb3e91d1441680ecb"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"4bc11ce7a56cd6279855972d2749219558d13616","unresolved":false,"context_lines":[{"line_number":147,"context_line":"\t\tif (!prp_list)"},{"line_number":148,"context_line":"\t\t\treturn -EFAULT;"},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"\t\twhile (transferred \u003c len) {"},{"line_number":151,"context_line":"\t\t\tprp_entry \u003d le64_to_cpu(prp_list[list_idx]);"},{"line_number":152,"context_line":"\t\t\tif (!prp_entry)"},{"line_number":153,"context_line":"\t\t\t\treturn -EFAULT;"}],"source_content_type":"text/x-csrc","patch_set":3,"id":"cdb83b59_37213cfc","line":150,"updated":"2026-06-28 10:09:47.000000000","message":"PRP list traversal indexes prp_list[list_idx] with list_idx unbounded against page capacity. If a hostile guest supplies a PRP list where the chaining condition does not hold, list_idx increments past the page boundary, reading kernel memory beyond the PRP list page.\n\n**Severity**: CRITICAL | **Confidence**: 0.8\n\n**Risk**: A guest (VFIO) or host ioctl caller supplying a crafted PRP list can drive the emulator to read arbitrary kernel linear-map memory adjacent to the PRP list page, leaking it into the I/O data buffer or storage file.\n\n**Priority**: Before merge\n**Why This Matters**: pci-sim VFs are exposed to guest-controlled command streams in passthrough and host-ioctl modes. An OOB read from a guest-controlled index defeats the sandbox and can leak kernel memory; it is a kernel safety defect a maintainer would block.\n\n**Recommendation**:\nAdd an explicit bound check before indexing: if (list_idx \u003e\u003d (int)(page_size / sizeof(__le64))) { prp2 \u003d le64_to_cpu(prp_list[list_idx - 1]); break; } to chain to the next list page. Decrement max_chains on every list_idx increment rather than only per outer iteration so the total entry count is bounded independently of page chaining.","commit_id":"fe98d64830043cbea7292c4cb3e91d1441680ecb"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"4bc11ce7a56cd6279855972d2749219558d13616","unresolved":false,"context_lines":[{"line_number":191,"context_line":"\tif (!zeros)"},{"line_number":192,"context_line":"\t\treturn -ENOMEM;"},{"line_number":193,"context_line":""},{"line_number":194,"context_line":"\twhile (len \u003e 0) {"},{"line_number":195,"context_line":"\t\tchunk \u003d min_t(size_t, len, PAGE_SIZE);"},{"line_number":196,"context_line":"\t\tret \u003d kernel_write(fp, zeros, chunk, \u0026offset);"},{"line_number":197,"context_line":"\t\tif (ret \u003c 0) {"}],"source_content_type":"text/x-csrc","patch_set":3,"id":"a7261879_3ef981ae","line":194,"updated":"2026-06-28 10:09:47.000000000","message":"nvme_sim_file_zero and nvme_sim_file_fill loop calling kernel_write but only check ret \u003c 0. A positive short write (0 \u003c ret \u003c chunk) is treated as success: len is decremented by chunk but offset advances by ret, silently skipping the remainder and leaving stale data.\n\n**Severity**: HIGH | **Confidence**: 0.9\n\n**Risk**: A short kernel_write during Format (ses\u003e\u003d1), Sanitize, or Write Zeroes leaves un-zeroed regions, so a subsequent read returns stale data instead of zeros/pattern. This is a data-integrity correctness issue for the emulated device semantics.\n\n**Priority**: Before merge\n**Why This Matters**: Format/Sanitize/Write-Zeroes correctness is part of the NVMe contract the emulator claims to support. Silent stale-data on these commands undermines tests that rely on deterministic post-format contents.\n\n**Recommendation**:\nTreat ret !\u003d chunk as a failure or loop on the remainder: if (ret !\u003d chunk) { kfree(zeros); return ret \u003c 0 ? ret : -EIO; }. Advance offset by ret in a partial-write loop. Apply the same fix to nvme_sim_file_fill.","commit_id":"fe98d64830043cbea7292c4cb3e91d1441680ecb"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"4bc11ce7a56cd6279855972d2749219558d13616","unresolved":false,"context_lines":[{"line_number":436,"context_line":" * Admin command: Create I/O Completion Queue"},{"line_number":437,"context_line":" * \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d */"},{"line_number":438,"context_line":""},{"line_number":439,"context_line":"static u16 nvme_sim_create_cq(struct pci_sim_nvme *nvme,"},{"line_number":440,"context_line":"\t\t\t      struct pci_sim_nvme_sqe *cmd)"},{"line_number":441,"context_line":"{"},{"line_number":442,"context_line":"\tu16 qid \u003d le32_to_cpu(cmd-\u003ecdw10) \u0026 0xFFFF;"}],"source_content_type":"text/x-csrc","patch_set":3,"id":"00454a8f_f28da6cd","line":439,"updated":"2026-06-28 10:09:47.000000000","message":"create_sq/create_cq accept any qsize up to 65535 (u16), larger than the 1023-entry max (MQES) advertised in CAP. A guest can create queues deeper than the controller claims to support.\n\n**Severity**: SUGGESTION | **Confidence**: 0.8\n\n**Benefit**: Honoring the advertised CAP.MQES keeps the emulation self-consistent and prevents a guest from allocating oversized queue memory regions that the emulator then indexes with u16 head/tail.\n\n**Recommendation**:\nIn create_cq/create_sq, reject qsize - 1 \u003e (CAP.MQES \u003d 1023) with NVME_SC_INVALID_FIELD.","commit_id":"fe98d64830043cbea7292c4cb3e91d1441680ecb"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"4bc11ce7a56cd6279855972d2749219558d13616","unresolved":false,"context_lines":[{"line_number":609,"context_line":"{"},{"line_number":610,"context_line":"\tu8 *p \u003d buf;"},{"line_number":611,"context_line":""},{"line_number":612,"context_line":"\tswitch (lid) {"},{"line_number":613,"context_line":"\tcase NVME_LOG_ERROR:"},{"line_number":614,"context_line":"\t\tbreak;"},{"line_number":615,"context_line":"\tcase NVME_LOG_SMART:"}],"source_content_type":"text/x-csrc","patch_set":3,"id":"182e6fba_93a9fa43","line":612,"updated":"2026-06-28 10:09:47.000000000","message":"pci_sim_nvme_fill_log_page\u0027s SMART/health log hardcodes composite temperature 293 and percentages 100/10 with no comment marking them as placeholder values. The error log (NVME_LOG_ERROR) is entirely unimplemented (empty case).\n\n**Severity**: SUGGESTION | **Confidence**: 0.8\n\n**Benefit**: Clearer provenance of the synthesized SMART data prevents confusion when interpreting nvme-cli output against this emulator.\n\n**Recommendation**:\nAdd comments marking the SMART fields as synthesized placeholders and the NVME_LOG_ERROR case as an unimplemented stub. Consider returning a zeroed error-log page rather than leaving the buffer with no explicit handling.","commit_id":"fe98d64830043cbea7292c4cb3e91d1441680ecb"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"4bc11ce7a56cd6279855972d2749219558d13616","unresolved":false,"context_lines":[{"line_number":828,"context_line":""},{"line_number":829,"context_line":"static u16 validate_lba_range(struct pci_sim_nvme *nvme, u64 slba, u16 nlb,"},{"line_number":830,"context_line":"\t\t\t      loff_t *offset_out, size_t *len_out)"},{"line_number":831,"context_line":"{"},{"line_number":832,"context_line":"\tu64 end_lba;"},{"line_number":833,"context_line":"\tu64 end;"},{"line_number":834,"context_line":"\tsize_t len \u003d (size_t)nlb * nvme-\u003elba_size;"}],"source_content_type":"text/x-csrc","patch_set":3,"id":"0a51f134_1df9265b","line":831,"updated":"2026-06-28 10:09:47.000000000","message":"The Identify Controller data sets MDTS (id[77]) to 5, advertising a 128 KiB max data transfer, but nvme_sim_io_read/nvme_sim_io_write and the host ioctl path enforce no MDTS limit on nlb*lba_size.\n\n**Severity**: SUGGESTION | **Confidence**: 0.9\n\n**Benefit**: Makes the emulator honor its own advertised capabilities, preventing oversized allocations and matching real-controller behavior so tests exercising MDTS boundaries are meaningful.\n\n**Recommendation**:\nIn validate_lba_range (or the I/O handlers) return NVME_SC_INVALID_FIELD when (u64)nlb * lba_size \u003e (1UL \u003c\u003c (5 + PAGE_SHIFT)).","commit_id":"fe98d64830043cbea7292c4cb3e91d1441680ecb"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"4bc11ce7a56cd6279855972d2749219558d13616","unresolved":false,"context_lines":[{"line_number":830,"context_line":"\t\t\t      loff_t *offset_out, size_t *len_out)"},{"line_number":831,"context_line":"{"},{"line_number":832,"context_line":"\tu64 end_lba;"},{"line_number":833,"context_line":"\tu64 end;"},{"line_number":834,"context_line":"\tsize_t len \u003d (size_t)nlb * nvme-\u003elba_size;"},{"line_number":835,"context_line":"\tloff_t offset;"},{"line_number":836,"context_line":""}],"source_content_type":"text/x-csrc","patch_set":3,"id":"12102999_5a3b305e","line":833,"updated":"2026-06-28 10:09:47.000000000","message":"validate_lba_range computes len \u003d (size_t)nlb * nvme-\u003elba_size WITHOUT check_mul_overflow (line 833). The check_mul_overflow at line 843 guards slba*lba_size, a different product. This is the one unchecked multiply in an otherwise overflow-hardened function.\n\n**Severity**: HIGH | **Confidence**: 0.8\n\n**Risk**: If lba_size is raised above 64KB (Format NVM extended formats) or nlb is widened, the unchecked multiplication becomes an integer-overflow allocator-size confusion leading to an undersized allocation followed by an over-length memcpy into guest memory.\n\n**Priority**: Before merge\n**Why This Matters**: The rest of the LBA validation is overflow-hardened; this single unchecked multiply is the weak link and an inconsistent style that future maintainers may copy. Defense-in-depth here is cheap.\n\n**Recommendation**:\nCompute len once with check_mul_overflow((u64)nlb, (u64)nvme-\u003elba_size, \u0026len_bytes) inside validate_lba_range and return the validated len via the out-parameter; have the I/O handlers use that exact value for kvmalloc rather than recomputing.","commit_id":"fe98d64830043cbea7292c4cb3e91d1441680ecb"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"4bc11ce7a56cd6279855972d2749219558d13616","unresolved":false,"context_lines":[{"line_number":1146,"context_line":"\t\treturn;"},{"line_number":1147,"context_line":""},{"line_number":1148,"context_line":"\tif (is_sq) {"},{"line_number":1149,"context_line":"\t\tnvme-\u003equeues[qid].sq_tail \u003d val \u0026 0xFFFF;"},{"line_number":1150,"context_line":"\t\tnvme_sim_process_sq(nvme, qid);"},{"line_number":1151,"context_line":"\t} else {"},{"line_number":1152,"context_line":"\t\tnvme-\u003equeues[qid].cq_head \u003d val \u0026 0xFFFF;"}],"source_content_type":"text/x-csrc","patch_set":3,"id":"a607598b_f64e85f8","line":1149,"updated":"2026-06-28 10:09:47.000000000","message":"pci_sim_nvme_doorbell_write masks the SQ tail to val \u0026 0xFFFF but does not validate it against sq-\u003esq_depth before storing and processing. The SQE address is computed from sq_head (always \u003c depth) so it is safe today, but an unchecked tail is a latent risk.\n\n**Severity**: SUGGESTION | **Confidence**: 0.8\n\n**Benefit**: Defensive validation of the doorbell tail against the queue depth matches real-controller behavior and hardens against future changes to the dispatch loop.\n\n**Recommendation**:\nAfter masking, validate: if ((val \u0026 0xFFFF) \u003e\u003d sq-\u003esq_depth) ignore or wrap the doorbell write rather than storing an out-of-range tail.","commit_id":"fe98d64830043cbea7292c4cb3e91d1441680ecb"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"4bc11ce7a56cd6279855972d2749219558d13616","unresolved":false,"context_lines":[{"line_number":1291,"context_line":"\t\t\tvf_index, sz / (1024 * 1024), path);"},{"line_number":1292,"context_line":""},{"line_number":1293,"context_line":"\treturn 0;"},{"line_number":1294,"context_line":"}"},{"line_number":1295,"context_line":""},{"line_number":1296,"context_line":"void pci_sim_nvme_reset(struct pci_sim_nvme *nvme)"},{"line_number":1297,"context_line":"{"}],"source_content_type":"text/x-csrc","patch_set":3,"id":"b570db61_9004203d","line":1294,"updated":"2026-06-28 10:09:47.000000000","message":"nvme_sim_process_sq dereferences sq-\u003esq_base without the same lock the poll kthread uses. pci_sim_nvme_reset zeroes queues[].sq_base without acquiring poll_lock, so a CC-disable reset racing the polling kthread can dereference a queue pointer being concurrently zeroed.\n\n**Severity**: CRITICAL | **Confidence**: 0.8\n\n**Risk**: A race between a CC-disable reset (or close) and the polling kthread dispatching a final command can dereference a NULL or torn sq_base pointer, crashing the host kernel in the kthread or ioctl path.\n\n**Priority**: Before merge\n**Why This Matters**: Concurrent command processing without a single consistent lock across the poll and VFIO/reset paths is a kernel panic risk. pci-sim runs in-kernel and a NULL deref in a kthread takes down the host.\n\n**Recommendation**:\nHave pci_sim_nvme_reset take poll_lock when operating in the poll-kthread configuration (or factor a locked inner reset), and ensure all writers of sq_base/cq_base/created (create_sq, delete_sq, delete_cq, reset) hold the same lock the kthread holds.","commit_id":"fe98d64830043cbea7292c4cb3e91d1441680ecb"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"4bc11ce7a56cd6279855972d2749219558d13616","unresolved":false,"context_lines":[{"line_number":1324,"context_line":"\t\tnvme_sim_file_zero(nvme-\u003ebacking_fp, 0, nvme-\u003estorage_size);"},{"line_number":1325,"context_line":"}"},{"line_number":1326,"context_line":""},{"line_number":1327,"context_line":"void pci_sim_nvme_cleanup(struct pci_sim_nvme *nvme)"},{"line_number":1328,"context_line":"{"},{"line_number":1329,"context_line":"\tpci_sim_nvme_reset(nvme);"},{"line_number":1330,"context_line":""}],"source_content_type":"text/x-csrc","patch_set":3,"id":"0d2faed7_dcca278d","line":1327,"updated":"2026-06-28 10:09:47.000000000","message":"pci_sim_nvme_cleanup / pci_sim_nvme_reset / pci_sim_nvme_close never call mutex_destroy(\u0026nvme-\u003epoll_lock). mutex_init is called in pci_sim_nvme_init, so the matching mutex_destroy is missing on teardown.\n\n**Severity**: WARNING | **Confidence**: 0.8\n\n**Impact**: Under lock debugging (CONFIG_DEBUG_LOCK_ALLOC) the module produces warnings on every VF teardown; on production configs it is a latent hygiene issue.\n\n**Suggestion**:\nCall mutex_destroy(\u0026nvme-\u003epoll_lock) in pci_sim_nvme_cleanup (after pci_sim_nvme_reset) and mutex_destroy(\u0026dev-\u003elock) in pci_sim_nvme_host_remove, matching the mutex_init pairs.","commit_id":"fe98d64830043cbea7292c4cb3e91d1441680ecb"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"709ed6945feaad371d0c401117ea339fa2236b4e","unresolved":false,"context_lines":[{"line_number":57,"context_line":"\tif (!cq-\u003ecq_base || !cq-\u003ecreated)"},{"line_number":58,"context_line":"\t\treturn;"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"\t/* CQ full: tail is about to overwrite unprocessed entries */"},{"line_number":61,"context_line":"\tif (cq-\u003ecq_depth \u0026\u0026"},{"line_number":62,"context_line":"\t    (cq-\u003ecq_tail + 1) % cq-\u003ecq_depth \u003d\u003d cq-\u003ecq_head)"},{"line_number":63,"context_line":"\t\treturn;"}],"source_content_type":"text/x-csrc","patch_set":4,"id":"ba31eada_d3cd4d86","line":60,"updated":"2026-06-29 05:22:27.000000000","message":"nvme_sim_post_completion silently returns on CQ-full (cq_tail+1 \u003d\u003d cq_head) with no error status or log, dropping that command\u0027s CQE entirely.\n\n**Severity**: WARNING | **Confidence**: 0.8\n\n**Impact**: Under CQ pressure a guest command is lost with no status posted, producing a guest-side hang or NVMe controller reset rather than a recoverable error.\n\n**Suggestion**:\nOn CQ-full, either defer the completion until space frees (standard controller behavior) or post a CQ-full/abort status so the guest can react. At minimum log a rate-limited warning so the dropped completion is diagnosable.","commit_id":"8cb337f7f11a274a16c17c29b793cbfec39335f4"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"709ed6945feaad371d0c401117ea339fa2236b4e","unresolved":false,"context_lines":[{"line_number":133,"context_line":"\t}"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"\t/* Case 3: PRP2 is a PRP list pointer */"},{"line_number":136,"context_line":"\tmax_chains \u003d (int)(len / page_size) + 2;"},{"line_number":137,"context_line":"\twhile (transferred \u003c len) {"},{"line_number":138,"context_line":"\t\t__le64 *prp_list;"},{"line_number":139,"context_line":"\t\tsize_t chunk;"}],"source_content_type":"text/x-csrc","patch_set":4,"id":"14a3daab_10c2c700","line":136,"updated":"2026-06-29 05:22:27.000000000","message":"nvme_sim_prp_transfer bounds the chained PRP traversal by max_chains \u003d len/page_size + 2, derived from the attacker-controlled requested length rather than a fixed cap.\n\n**Severity**: WARNING | **Confidence**: 0.8\n\n**Impact**: A guest can force the host kernel to walk a long PRP chain under the BAR0 lock, lengthening the synchronous VFIO write path and degrading host responsiveness for the emulated controller.\n\n**Suggestion**:\nCap the chain depth with an explicit constant (e.g. MDTS-derived) independent of len, and break/return -EFAULT when exceeded. The commit message mentions a PRP depth limit; make it a hard fixed constant rather than len-derived.","commit_id":"8cb337f7f11a274a16c17c29b793cbfec39335f4"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"709ed6945feaad371d0c401117ea339fa2236b4e","unresolved":false,"context_lines":[{"line_number":191,"context_line":"\tif (!zeros)"},{"line_number":192,"context_line":"\t\treturn -ENOMEM;"},{"line_number":193,"context_line":""},{"line_number":194,"context_line":"\twhile (len \u003e 0) {"},{"line_number":195,"context_line":"\t\tchunk \u003d min_t(size_t, len, PAGE_SIZE);"},{"line_number":196,"context_line":"\t\tret \u003d kernel_write(fp, zeros, chunk, \u0026offset);"},{"line_number":197,"context_line":"\t\tif (ret \u003c 0) {"}],"source_content_type":"text/x-csrc","patch_set":4,"id":"48608e7e_44066a18","line":194,"updated":"2026-06-29 05:22:27.000000000","message":"nvme_sim_file_zero reduces len by chunk on each loop, but kernel_write may return a short count; the code only checks ret\u003c0, so len tracking can diverge from bytes actually written.\n\n**Severity**: WARNING | **Confidence**: 0.7\n\n**Impact**: A backing file/filesystem that returns short writes could cause len to be mis-tracked during format/sanitize, lengthening the emulated controller\u0027s blocking path or looping longer than intended.\n\n**Suggestion**:\nHandle short writes explicitly: advance len by ret (the bytes actually written) rather than chunk, or treat ret \u003c chunk as an error. kernel_write returns the count written, so subtracting the full chunk when only ret bytes were written mis-tracks remaining length.","commit_id":"8cb337f7f11a274a16c17c29b793cbfec39335f4"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"709ed6945feaad371d0c401117ea339fa2236b4e","unresolved":false,"context_lines":[{"line_number":266,"context_line":"\t\t nvme-\u003evf_index);"},{"line_number":267,"context_line":"}"},{"line_number":268,"context_line":""},{"line_number":269,"context_line":"static u16 nvme_sim_identify_ctrl(struct pci_sim_nvme *nvme,"},{"line_number":270,"context_line":"\t\t\t\t  struct pci_sim_nvme_sqe *cmd)"},{"line_number":271,"context_line":"{"},{"line_number":272,"context_line":"\tu8 *id;"}],"source_content_type":"text/x-csrc","patch_set":4,"id":"c278259e_6697cfff","line":269,"updated":"2026-06-29 05:22:27.000000000","message":"Five admin handlers (identify ctrl/ns/ns_list/ns_descs, get_log_page) each duplicate kzalloc(4096) -\u003e fill -\u003e nvme_sim_prp_transfer -\u003e kfree.\n\n**Severity**: SUGGESTION | **Confidence**: 0.8\n\n**Benefit**: A single nvme_sim_admin_dma helper removes ~60 lines of repeated alloc/transfer/free boilerplate and eliminates the chance of one site forgetting the kfree on an error branch.\n\n**Recommendation**:\nAdd a helper like nvme_sim_dma_out(nvme, cmd, fill_fn) that allocates 4096, calls the fill, does the PRP transfer, and always frees. Convert the five identify/log handlers to it.","commit_id":"8cb337f7f11a274a16c17c29b793cbfec39335f4"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"709ed6945feaad371d0c401117ea339fa2236b4e","unresolved":false,"context_lines":[{"line_number":831,"context_line":"{"},{"line_number":832,"context_line":"\tu64 end_lba;"},{"line_number":833,"context_line":"\tu64 end;"},{"line_number":834,"context_line":"\tsize_t len \u003d (size_t)nlb * nvme-\u003elba_size;"},{"line_number":835,"context_line":"\tloff_t offset;"},{"line_number":836,"context_line":""},{"line_number":837,"context_line":"\tif (check_add_overflow((u64)slba, (u64)nlb, \u0026end_lba) ||"}],"source_content_type":"text/x-csrc","patch_set":4,"id":"0baf29d3_60d4c210","line":834,"updated":"2026-06-29 05:22:27.000000000","message":"validate_lba_range and three IO callers compute len \u003d nlb * lba_size with a plain multiply, bypassing the overflow helpers used elsewhere for slba and offset.\n\n**Severity**: HIGH | **Confidence**: 0.8\n\n**Risk**: On 64-bit the u16*4096 max cannot overflow, so this is latent, not exploitable now. But it is fragile: if lba_size widens or nlb is widened, the unchecked multiply silently sizes the transfer buffer from guest input.\n\n**Priority**: Before merge\n**Why This Matters**: The rest of the patch deliberately uses overflow helpers to avoid trusting guest multiplies. Leaving the buffer-size multiply unchecked contradicts that hardening and is the kind of gap that becomes a memory-corruption bug after a later refactor. It is duplicated across four sites.\n\n**Recommendation**:\nCentralize the (nlb, lba_size)-\u003elen computation in one helper that uses check_mul_overflow, and call it from validate_lba_range and all three IO paths (nvme.c:834, 912, 938 and nvme_host.c:162) so the buffer size and validated len always agree.","commit_id":"8cb337f7f11a274a16c17c29b793cbfec39335f4"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"709ed6945feaad371d0c401117ea339fa2236b4e","unresolved":false,"context_lines":[{"line_number":907,"context_line":"static u16 nvme_sim_io_read(struct pci_sim_nvme *nvme,"},{"line_number":908,"context_line":"\t\t\t    struct pci_sim_nvme_sqe *cmd)"},{"line_number":909,"context_line":"{"},{"line_number":910,"context_line":"\tu64 slba \u003d ((u64)le32_to_cpu(cmd-\u003ecdw11) \u003c\u003c 32) | le32_to_cpu(cmd-\u003ecdw10);"},{"line_number":911,"context_line":"\tu16 nlb \u003d (le32_to_cpu(cmd-\u003ecdw12) \u0026 0xFFFF) + 1;"},{"line_number":912,"context_line":"\tsize_t len \u003d (size_t)nlb * nvme-\u003elba_size;"},{"line_number":913,"context_line":"\tvoid *buf;"}],"source_content_type":"text/x-csrc","patch_set":4,"id":"8e4fe7d9_530ef3db","line":910,"updated":"2026-06-29 05:22:27.000000000","message":"SLBA/nlb decode (((u64)cdw11\u003c\u003c32)|cdw10, (cdw12\u00260xFFFF)+1) is repeated verbatim in nvme_sim_io_read, io_write, write_zeroes and the host ioctl path.\n\n**Severity**: SUGGESTION | **Confidence**: 0.8\n\n**Benefit**: A single nvme_sim_decode_rw_cmd helper reduces copy-paste and ensures the SLBA endianness/assembly is consistent everywhere.\n\n**Recommendation**:\nExtract slba and nlb decoding into a helper struct/function and call it from all four sites.","commit_id":"8cb337f7f11a274a16c17c29b793cbfec39335f4"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"709ed6945feaad371d0c401117ea339fa2236b4e","unresolved":false,"context_lines":[{"line_number":1016,"context_line":"\tif (!sq-\u003esq_base || sq-\u003esq_depth \u003d\u003d 0)"},{"line_number":1017,"context_line":"\t\treturn;"},{"line_number":1018,"context_line":""},{"line_number":1019,"context_line":"\twhile (sq-\u003esq_head !\u003d sq-\u003esq_tail \u0026\u0026 budget-- \u003e 0) {"},{"line_number":1020,"context_line":"\t\tsqe \u003d (struct pci_sim_nvme_sqe *)sq-\u003esq_base + sq-\u003esq_head;"},{"line_number":1021,"context_line":""},{"line_number":1022,"context_line":"\t\tif (qid \u003d\u003d 0)"}],"source_content_type":"text/x-csrc","patch_set":4,"id":"f8947cec_eef042fb","line":1019,"updated":"2026-06-29 05:22:27.000000000","message":"nvme_sim_process_sq has a per-doorbell batch limit (64 + cond_resched), but bar0_rw can batch many doorbell writes in one call with no total work budget across them.\n\n**Severity**: WARNING | **Confidence**: 0.7\n\n**Impact**: A guest issuing a large BAR0 write spanning many doorbell offsets can drive repeated process_sq iterations synchronously under sim-\u003elock, amplifying latency.\n\n**Suggestion**:\nTrack a total work budget across the whole bar0_rw call (not just per doorbell) and break out once consumed, returning the bytes already advanced.","commit_id":"8cb337f7f11a274a16c17c29b793cbfec39335f4"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"709ed6945feaad371d0c401117ea339fa2236b4e","unresolved":false,"context_lines":[{"line_number":1170,"context_line":""},{"line_number":1171,"context_line":"\tcount \u003d min_t(size_t, count, PCI_SIM_NVME_BAR0_SIZE - pos);"},{"line_number":1172,"context_line":""},{"line_number":1173,"context_line":"\tmutex_lock(\u0026sim-\u003elock);"},{"line_number":1174,"context_line":""},{"line_number":1175,"context_line":"\twhile (done \u003c count) {"},{"line_number":1176,"context_line":"\t\tsize_t remaining \u003d count - done;"}],"source_content_type":"text/x-csrc","patch_set":4,"id":"5786cbdd_a5a91e0f","line":1173,"updated":"2026-06-29 05:22:27.000000000","message":"The NVMe command core is reachable via two different locks: the VFIO path uses sim-\u003elock, the poll-kthread path uses nvme-\u003epoll_lock. Both mutate the shared queues[] array and post completions.\n\n**Severity**: HIGH | **Confidence**: 0.8\n\n**Risk**: If a VF is rebound while a VFIO client or the poll kthread is mid-command (the rebind the test suite itself exercises), queue state can be mutated concurrently under different locks, corrupting SQ/CQ indices or the created flag.\n\n**Priority**: Before merge\n**Why This Matters**: The rebind-from-vfio-to-nvme scenario is explicitly tested, and the commit message defers admin-queue creation specifically to handle rebind. That makes the two-lock model load-bearing for a supported workflow, so it needs an explicit, documented invariant.\n\n**Recommendation**:\nDocument/enforce that per-VF queues are mutated under only one lock because a VF is bound to exactly one driver. Either unify on one mutex (e.g. move bar0_rw to nvme-\u003epoll_lock) or add a comment + WARN_ON asserting the binding exclusion, and ensure pci_sim_nvme_reset runs under the queue-guarding lock during rebind.","commit_id":"8cb337f7f11a274a16c17c29b793cbfec39335f4"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"709ed6945feaad371d0c401117ea339fa2236b4e","unresolved":false,"context_lines":[{"line_number":1239,"context_line":"int pci_sim_nvme_init(struct pci_sim_nvme *nvme, struct pci_dev *pdev,"},{"line_number":1240,"context_line":"\t\t      int vf_index)"},{"line_number":1241,"context_line":"{"},{"line_number":1242,"context_line":"\tsize_t sz \u003d (size_t)nvme_ns_size_mb * 1024 * 1024;"},{"line_number":1243,"context_line":"\tchar path[256];"},{"line_number":1244,"context_line":"\tint err;"},{"line_number":1245,"context_line":""}],"source_content_type":"text/x-csrc","patch_set":4,"id":"5b25ac10_d44c0a8b","line":1242,"updated":"2026-06-29 05:22:27.000000000","message":"nvme_ns_size_mb (uint module param) is not validated; a value of 0 yields storage_size\u003d0 and num_lbas\u003d0 and init still creates a 0-byte backing file.\n\n**Severity**: SUGGESTION | **Confidence**: 0.7\n\n**Benefit**: Failing fast on a nonsensical namespace size prevents a degenerate controller from being created and produces a clearer error than a 0-byte backing file.\n\n**Recommendation**:\nValidate nvme_ns_size_mb \u003e\u003d 1 (and \u003c\u003d a reasonable cap) in pci_sim_nvme_init and return -EINVAL with a clear pr_err if out of range.","commit_id":"8cb337f7f11a274a16c17c29b793cbfec39335f4"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"709ed6945feaad371d0c401117ea339fa2236b4e","unresolved":false,"context_lines":[{"line_number":1264,"context_line":"\t\tnvme-\u003ebacking_fp \u003d NULL;"},{"line_number":1265,"context_line":"\t\treturn err;"},{"line_number":1266,"context_line":"\t}"},{"line_number":1267,"context_line":"\terr \u003d vfs_truncate(\u0026nvme-\u003ebacking_fp-\u003ef_path, sz);"},{"line_number":1268,"context_line":"\tif (err) {"},{"line_number":1269,"context_line":"\t\tpr_err(\"pci_sim_nvme: failed to size backing file %s: %d\\n\","},{"line_number":1270,"context_line":"\t\t       path, err);"}],"source_content_type":"text/x-csrc","patch_set":4,"id":"c520d866_409965b8","line":1267,"updated":"2026-06-29 05:22:27.000000000","message":"pci_sim_nvme_init sizes the backing file via vfs_truncate(\u0026f_path, sz), an internal VFS entry point intended for userspace-initiated truncation, used on a module-created filp_open handle.\n\n**Severity**: HIGH | **Confidence**: 0.8\n\n**Risk**: vfs_truncate is not a stable kernel-to-kernel API and its signature/behavior has changed across kernel versions; depending on it risks build breaks and subtle size/permission failures on other kernels the fixture claims to support.\n\n**Priority**: Before merge\n**Why This Matters**: The pci-sim module is meant to build across kernel versions with compat gates in fake_pci_sriov_compat.h. Relying on an internal VFS entry point for file sizing undermines that portability goal and the truncate can fail in ways filp_open/kernel_write would not.\n\n**Recommendation**:\nDrop the truncate and instead nvme_sim_file_zero the full storage_size once after filp_open (the close path already does this), or use vfs_fallocate. Gate any retained truncate behind the compat header.","commit_id":"8cb337f7f11a274a16c17c29b793cbfec39335f4"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"35e017347459249acfc9cfaa8c84ec45ba13d9f4","unresolved":false,"context_lines":[{"line_number":936,"context_line":"{"},{"line_number":937,"context_line":"\tu64 slba \u003d ((u64)le32_to_cpu(cmd-\u003ecdw11) \u003c\u003c 32) |"},{"line_number":938,"context_line":"\t\t   le32_to_cpu(cmd-\u003ecdw10);"},{"line_number":939,"context_line":"\tu16 nlb \u003d (le32_to_cpu(cmd-\u003ecdw12) \u0026 0xFFFF) + 1;"},{"line_number":940,"context_line":"\tsize_t len \u003d (size_t)nlb * nvme-\u003elba_size;"},{"line_number":941,"context_line":"\tvoid *buf;"},{"line_number":942,"context_line":"\tu16 status;"}],"source_content_type":"text/x-csrc","patch_set":7,"id":"a6f8976f_a9c7b87d","line":939,"updated":"2026-07-16 05:51:35.000000000","message":"The NVMe NLB field in CDW12 is 0-based; actual count is (field+1). I/O handlers store this in u16. When field\u003d0xFFFF, (0xFFFF+1)\u003d65536 truncates to 0 in u16. This makes len\u003d0, bypasses the MDTS check, and returns SUCCESS with zero data transferred. Affects both VFIO and host ioctl paths from untr...\n\n**Severity**: SUGGESTION | **Confidence**: 0.9\n\n**Benefit**: An NVMe command with NLB\u003d0xFFFF silently succeeds without transferring data. The caller receives NVME_SC_SUCCESS believing the operation completed. MDTS enforcement is bypassed for this edge case, potentially causing silent data loss in test scenarios.\n\n**Recommendation**:\nChange nlb from u16 to u32 in nvme_sim_io_read, nvme_sim_io_write, nvme_sim_io_write_zeroes (fake_pci_sriov_nvme.c), and pci_sim_nvme_host_io_cmd (fake_pci_sriov_nvme_host.c). This lets the MDTS check receive the correct len and reject oversized commands.","commit_id":"1555efdf74d7f1de296fda792b98a89329cd90e0"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"35e017347459249acfc9cfaa8c84ec45ba13d9f4","unresolved":false,"context_lines":[{"line_number":1325,"context_line":"\t\t    (1ULL \u003c\u003c 16) | /* CQR */"},{"line_number":1326,"context_line":"\t\t    (1ULL \u003c\u003c 24) | /* TO */"},{"line_number":1327,"context_line":"\t\t    (0ULL \u003c\u003c 32) | /* DSTRD */"},{"line_number":1328,"context_line":"\t\t    (0ULL \u003c\u003c 37) | /* CSS: NVM command set */"},{"line_number":1329,"context_line":"\t\t    (0ULL \u003c\u003c 48) | /* MPSMIN */"},{"line_number":1330,"context_line":"\t\t    (0ULL \u003c\u003c 52); /* MPSMAX */"},{"line_number":1331,"context_line":"\tnvme-\u003evs \u003d 0x00010400;"}],"source_content_type":"text/x-csrc","patch_set":7,"id":"33414f5a_c3e08983","line":1328,"updated":"2026-07-16 05:51:35.000000000","message":"The CAP register in pci_sim_nvme_init sets CSS to 0 via (0ULL \u003c\u003c 37) despite the comment saying \u0027CSS: NVM command set\u0027. Per NVMe 1.4 spec section 3.1.8, CAP.CSS bit 37 \u0027shall be set to 1\u0027 for NVM CS support. Same omission in poll pre-init paths where CAP omits bit 37 entirely.\n\n**Severity**: SUGGESTION | **Confidence**: 0.8\n\n**Benefit**: A strictly NVMe-spec-compliant host driver could refuse to probe the controller. The Linux nvme driver currently tolerates CSS\u003d0, but future kernel versions may enforce the spec, breaking Phase 2 stock driver binding.\n\n**Recommendation**:\nChange (0ULL \u003c\u003c 37) to (1ULL \u003c\u003c 37) in pci_sim_nvme_init line 1328. Add | (1ULL \u003c\u003c 37) to cap in preinit_bar0_regs and poll_reinit_bar0 in fake_pci_sriov_nvme_poll.c lines 278 and 86.","commit_id":"1555efdf74d7f1de296fda792b98a89329cd90e0"}],"pci-sim/fake_pci_sriov_nvme.h":[{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"824bae2e6e30e5fcbebb77526e2bc9607367b100","unresolved":true,"context_lines":[{"line_number":155,"context_line":""},{"line_number":156,"context_line":"struct pci_sim_vfio_vf;"},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"/* Lifecycle (decoupled from VFIO — usable by any host driver) */"},{"line_number":159,"context_line":"int pci_sim_nvme_init(struct pci_sim_nvme *nvme, struct pci_dev *pdev,"},{"line_number":160,"context_line":"\t\t      int vf_index);"},{"line_number":161,"context_line":"void pci_sim_nvme_cleanup(struct pci_sim_nvme *nvme);"},{"line_number":162,"context_line":"void pci_sim_nvme_reset(struct pci_sim_nvme *nvme);"},{"line_number":163,"context_line":"void pci_sim_nvme_close(struct pci_sim_nvme *nvme);"}],"source_content_type":"text/x-csrc","patch_set":1,"id":"2ab6a5ed_953b67c2","line":160,"range":{"start_line":158,"start_character":1,"end_line":160,"end_character":22},"updated":"2026-06-26 15:48:22.000000000","message":"we shoudl chec ck what the actual kernel convetion on this formating is but i dont think this si correct.\n\nwhiel its not a short term goal i woudl potically liek to be abel to upstream this ot the actual kernel so i want use to follow there code convetion for the kernel as much as reasonable.\n\nfor now this is out of scope but it hink seperately im goint to look into configureing a seperate code formatiner and liters for the c code to enforece kernel convetnions automaticly.","commit_id":"941d628093789e9791b2c95f7eaff21002f891f6"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"4bc11ce7a56cd6279855972d2749219558d13616","unresolved":false,"context_lines":[{"line_number":91,"context_line":"};"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"/* NVMe completion queue entry */"},{"line_number":94,"context_line":"struct pci_sim_nvme_cqe {"},{"line_number":95,"context_line":"\t__le32 result;"},{"line_number":96,"context_line":"\t__le32 rsvd;"},{"line_number":97,"context_line":"\t__le16 sq_head;"}],"source_content_type":"text/x-csrc","patch_set":3,"id":"72400120_1920bc0d","line":94,"updated":"2026-06-28 10:09:47.000000000","message":"The CQE struct defines result as __le32 and rsvd as __le32, but NVMe 1.4 defines the CQE DW0-DW1 as a 64-bit result field. nvme_sim_post_completion only takes a u32 result and writes 0 to rsvd, truncating any 64-bit command result.\n\n**Severity**: WARNING | **Confidence**: 0.8\n\n**Impact**: Commands whose result legitimately uses DW1 will see zero instead of the expected value. For the currently implemented command set the result fits in DW0, so this is latent rather than immediately broken, but it is a spec deviation.\n\n**Suggestion**:\nRename rsvd to result_hi (or treat DW0:DW1 as a __le64 result) and thread a u64 result through nvme_sim_post_completion so future commands returning 64-bit data are correct. Document that DW1 is currently unused.","commit_id":"fe98d64830043cbea7292c4cb3e91d1441680ecb"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"709ed6945feaad371d0c401117ea339fa2236b4e","unresolved":false,"context_lines":[{"line_number":44,"context_line":"#define NVME_IO_WRITE_ZEROES\t0x08"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"/* NVMe status codes */"},{"line_number":47,"context_line":"#define NVME_SC_SUCCESS\t\t\t0x0000"},{"line_number":48,"context_line":"#define NVME_SC_INVALID_OPCODE\t\t0x0001"},{"line_number":49,"context_line":"#define NVME_SC_INVALID_FIELD\t\t0x0002"},{"line_number":50,"context_line":"#define NVME_SC_INVALID_NS\t\t0x000B"}],"source_content_type":"text/x-csrc","patch_set":4,"id":"f9381ba2_e28ca962","line":47,"updated":"2026-06-29 05:22:27.000000000","message":"NVMe status/opcode constants are redefined locally in fake_pci_sriov_nvme.h with spec-exact values already present in the kernel\u0027s include/linux/nvme.h.\n\n**Severity**: SUGGESTION | **Confidence**: 0.8\n\n**Benefit**: Reusing the kernel\u0027s existing nvme.h definitions removes a source of spec-value drift and makes the emulation obviously spec-conformant by construction.\n\n**Recommendation**:\nWhere the kernel headers already define these (opcodes, CNS values, status codes, register offsets), include \u003clinux/nvme.h\u003e and use the canonical names instead of redefining, keeping only pci_sim-private constants.","commit_id":"8cb337f7f11a274a16c17c29b793cbfec39335f4"}],"pci-sim/fake_pci_sriov_nvme_host.c":[{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"1afc7d4f00f55d2845e98936f9c027e121cb24d3","unresolved":false,"context_lines":[{"line_number":208,"context_line":"\treturn status ? -EIO : 0;"},{"line_number":209,"context_line":"}"},{"line_number":210,"context_line":""},{"line_number":211,"context_line":"static long pci_sim_nvme_host_ioctl(struct file *filp, unsigned int ioc,"},{"line_number":212,"context_line":"\t\t\t\t    unsigned long arg)"},{"line_number":213,"context_line":"{"},{"line_number":214,"context_line":"\tstruct pci_sim_nvme_host_dev *dev \u003d filp-\u003eprivate_data;"}],"source_content_type":"text/x-csrc","patch_set":1,"id":"e5b78a9f_a325a4db","line":211,"updated":"2026-06-26 15:16:00.000000000","message":"Host char device ioctls (admin_cmd, io_cmd, reset) have no mutex. Concurrent ioctls on /dev/pci_sim_nvmeN race on nvme-\u003equeues, lba_size, and backing file offset, risking data corruption.\n\n**Severity**: HIGH | **Confidence**: 0.8\n\n**Risk**: Concurrent ioctl calls on the same char device corrupt nvme controller state (lba_size changed by format during a read) or race on the backing file position, producing corrupt reads/writes.\n\n**Priority**: Before merge\n**Why This Matters**: The char device is world-accessible via standard open(); nvme-cli and other tools can issue commands concurrently.\n\n**Recommendation**:\nAdd a mutex to struct pci_sim_nvme_host_dev and lock it in pci_sim_nvme_host_ioctl around admin_cmd, io_cmd, and reset operations.","commit_id":"941d628093789e9791b2c95f7eaff21002f891f6"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"1afc7d4f00f55d2845e98936f9c027e121cb24d3","unresolved":false,"context_lines":[{"line_number":300,"context_line":"\t}"},{"line_number":301,"context_line":""},{"line_number":302,"context_line":"\tret \u003d pci_sim_nvme_init(\u0026dev-\u003envme, pdev,"},{"line_number":303,"context_line":"\t\t\t\tPCI_FUNC(pdev-\u003edevfn) - 1);"},{"line_number":304,"context_line":"\tif (ret)"},{"line_number":305,"context_line":"\t\tgoto err_ida;"},{"line_number":306,"context_line":""}],"source_content_type":"text/x-csrc","patch_set":1,"id":"23751903_52c7b0de","line":303,"updated":"2026-06-26 15:16:00.000000000","message":"vf_index can be -1 when PCI_FUNC(pdev-\u003edevfn) is 0. The host driver id_table matches NVMe class on any function; PCI_FUNC(devfn)-1 for function 0 yields -1, used in backing file paths and serial numbers.\n\n**Severity**: HIGH | **Confidence**: 0.8\n\n**Risk**: If the NVMe host driver binds to a VF at PCI function 0, vf_index\u003d-1 is passed to pci_sim_nvme_init where it indexes nvme-\u003evf_index, used in snprintf for backing file path suffix and controller serial. Negative index is semantically wrong and could cause confusing behavior.\n\n**Priority**: Before merge\n**Why This Matters**: Function 0 is the PF in pci-sim\u0027s layout; VFs start at function 1. But the driver\u0027s id_table uses class_mask matching without a devfn constraint, so misbinding is possible during driver_override races.\n\n**Recommendation**:\nAdd a guard: if (PCI_FUNC(pdev-\u003edevfn) \u003d\u003d 0) return -ENODEV; at the top of pci_sim_nvme_host_probe, and validate vf_index \u003e\u003d 0 inside pci_sim_nvme_init with an early return -EINVAL.","commit_id":"941d628093789e9791b2c95f7eaff21002f891f6"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"64996d6bb6b27192b8bb9dfc540fd713b0dd9187","unresolved":false,"context_lines":[{"line_number":159,"context_line":""},{"line_number":160,"context_line":"\tslba \u003d ((u64)cmd.cdw11 \u003c\u003c 32) | cmd.cdw10;"},{"line_number":161,"context_line":"\tnlb \u003d (cmd.cdw12 \u0026 0xFFFF) + 1;"},{"line_number":162,"context_line":"\txfer_len \u003d (size_t)nlb * nvme-\u003elba_size;"},{"line_number":163,"context_line":""},{"line_number":164,"context_line":"\tswitch (cmd.opcode) {"},{"line_number":165,"context_line":"\tcase NVME_IO_READ:"}],"source_content_type":"text/x-csrc","patch_set":2,"id":"b580c575_5309c5f5","line":162,"updated":"2026-06-28 09:42:28.000000000","message":"pci_sim_nvme_host_io_cmd computes xfer_len \u003d (size_t)nlb * nvme-\u003elba_size without overflow checks, then kvmalloc(xfer_len) directly. nlb derives from attacker-controlled ioctl cdw12 ((cdw12\u00260xFFFF)+1), reaching 65535; with lba_size\u003d4096 the allocation is ~256MB per ioctl on a host char device.\n\n**Severity**: HIGH | **Confidence**: 0.8\n\n**Risk**: A process holding /dev/pci_sim_nvmeN can request a large kvmalloc (up to ~256MB) per NVME_IOCTL_IO_CMD, a memory-amplification vector on the host. nlb also wraps to 0 when cdw12\u00260xFFFF\u003d\u003d0xFFFF, producing a zero-length transfer.\n\n**Priority**: Before merge\n**Why This Matters**: The host char device exposes ioctls without a cap on transfer size; validate_lba_range bounds the result against num_lbas but only after the allocation. The kernel allocation itself is sized by unchecked user input.\n\n**Recommendation**:\nCap xfer_len at a sane MDTS-derived maximum before kvmalloc (Identify reports MDTS\u003d128KB), and use check_mul_overflow for nlb*lba_size. Alternatively validate the LBA range before allocating the buffer.","commit_id":"7bfd2c520ad312077947759b8a0d8eb892b758a9"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"4bc11ce7a56cd6279855972d2749219558d13616","unresolved":false,"context_lines":[{"line_number":159,"context_line":""},{"line_number":160,"context_line":"\tslba \u003d ((u64)cmd.cdw11 \u003c\u003c 32) | cmd.cdw10;"},{"line_number":161,"context_line":"\tnlb \u003d (cmd.cdw12 \u0026 0xFFFF) + 1;"},{"line_number":162,"context_line":"\txfer_len \u003d (size_t)nlb * nvme-\u003elba_size;"},{"line_number":163,"context_line":""},{"line_number":164,"context_line":"\tswitch (cmd.opcode) {"},{"line_number":165,"context_line":"\tcase NVME_IO_READ:"}],"source_content_type":"text/x-csrc","patch_set":3,"id":"2b347c71_088afdd4","line":162,"updated":"2026-06-28 10:09:47.000000000","message":"pci_sim_nvme_host_io_cmd computes xfer_len \u003d (size_t)nlb * nvme-\u003elba_size with no overflow check and no upper cap before kvmalloc(xfer_len). nlb up to 65536 and lba_size up to 4096 (268 MB) allows a single ioctl to request a huge GFP_KERNEL allocation.\n\n**Severity**: HIGH | **Confidence**: 0.8\n\n**Risk**: A process with access to /dev/pci_sim_nvmeN can request huge allocations per ioctl, causing memory pressure or OOM on the host. kvmalloc falls back to vmalloc for large sizes, consuming vmalloc address space.\n\n**Priority**: Before merge\n**Why This Matters**: The char device node is reachable by any process with permissions; bounding the allocation prevents trivial local denial-of-service and matches the MDTS\u003d128KB advertised in the Identify Controller data.\n\n**Recommendation**:\nCap xfer_len at the advertised MDTS (128 KiB, i.e. 1 \u003c\u003c (5 + 12)) and return NVME_SC_INVALID_FIELD when exceeded. Use check_mul_overflow for the nlb*lba_size product.","commit_id":"fe98d64830043cbea7292c4cb3e91d1441680ecb"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"4bc11ce7a56cd6279855972d2749219558d13616","unresolved":false,"context_lines":[{"line_number":329,"context_line":"\t}"},{"line_number":330,"context_line":""},{"line_number":331,"context_line":"\tret \u003d pci_sim_nvme_init(\u0026dev-\u003envme, pdev,"},{"line_number":332,"context_line":"\t\t\t\tPCI_FUNC(pdev-\u003edevfn) - 1);"},{"line_number":333,"context_line":"\tif (ret)"},{"line_number":334,"context_line":"\t\tgoto err_ida;"},{"line_number":335,"context_line":""}],"source_content_type":"text/x-csrc","patch_set":3,"id":"8037c2a3_f7533f75","line":332,"updated":"2026-06-28 10:09:47.000000000","message":"pci_sim_nvme_host_probe derives vf_index \u003d PCI_FUNC(pdev-\u003edevfn) - 1 without bounds-checking that the result falls within [0, MAX_VFS). A VF at an unexpected devfn produces a negative or oversized vf_index used to build the backing-file path and Identify serial.\n\n**Severity**: WARNING | **Confidence**: 0.7\n\n**Impact**: A bogus index does not overflow the 20-byte serial field (bounded by %04d) but produces inconsistent/overlapping device identities and backing files for VFs the driver should not have claimed.\n\n**Suggestion**:\nValidate that PCI_FUNC(pdev-\u003edevfn) is in [1, PCI_SIM_NVME_HOST_MAX_DEVS] before deriving vf_index, and return -ENODEV otherwise.","commit_id":"fe98d64830043cbea7292c4cb3e91d1441680ecb"}],"pci-sim/fake_pci_sriov_nvme_poll.c":[{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"4bc11ce7a56cd6279855972d2749219558d13616","unresolved":false,"context_lines":[{"line_number":21,"context_line":" * IRQ injection — nvmevirt pattern"},{"line_number":22,"context_line":" * \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d */"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"static void pci_sim_nvme_poll_signal_irq(struct pci_sim_nvme *nvme, int vector)"},{"line_number":25,"context_line":"{"},{"line_number":26,"context_line":"\tunsigned int virq;"},{"line_number":27,"context_line":"\tstruct irq_data *data;"}],"source_content_type":"text/x-csrc","patch_set":3,"id":"c4d5be51_7380e3e1","line":24,"updated":"2026-06-28 10:09:47.000000000","message":"The IRQ-injection path dereferences nvme-\u003epdev-\u003edev in pci_sim_nvme_poll_signal_irq (msi_get_virq(\u0026nvme-\u003epdev-\u003edev, vector)) without re-checking that nvme-\u003epdev is still non-NULL under poll_lock at the point of use.\n\n**Severity**: WARNING | **Confidence**: 0.7\n\n**Impact**: Closes a narrow NULL-deref window where cleanup nulls pdev while the kthread is posting a completion and about to signal IRQ.\n\n**Suggestion**:\nCapture nvme-\u003epdev into a local under poll_lock at the top of the caller and pass the device pointer, or have signal_irq read pdev under poll_lock and return early if NULL.","commit_id":"fe98d64830043cbea7292c4cb3e91d1441680ecb"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"4bc11ce7a56cd6279855972d2749219558d13616","unresolved":false,"context_lines":[{"line_number":369,"context_line":"\treturn 0;"},{"line_number":370,"context_line":"}"},{"line_number":371,"context_line":""},{"line_number":372,"context_line":"void pci_sim_nvme_poll_vf_cleanup(struct fake_pci_host *host, int vf_idx)"},{"line_number":373,"context_line":"{"},{"line_number":374,"context_line":"\tstruct pci_sim_nvme *nvme \u003d \u0026host-\u003envme_state[vf_idx];"},{"line_number":375,"context_line":""}],"source_content_type":"text/x-csrc","patch_set":3,"id":"bf1cc2ab_a42b68ab","line":372,"updated":"2026-06-28 10:09:47.000000000","message":"pci_sim_nvme_poll_vf_cleanup calls pci_dev_put(nvme-\u003epdev) but pdev may be set by BOTH fake_pci_sriov_configure AND poll_check_regs. If both run, two references are taken but only one pci_dev_put is issued, leaking a pci_dev reference.\n\n**Severity**: HIGH | **Confidence**: 0.8\n\n**Risk**: pci_dev reference leak prevents the device from ever being freed. A concurrent kthread iteration can also re-resolve and re-set pdev after poll_vf_cleanup has already run and put the reference, leaving a dangling pointer.\n\n**Priority**: Before merge\n**Why This Matters**: Reference-count imbalance and racing pointer reassignment are classic kernel bugs. The kthread must be fully stopped before any poll_vf_cleanup runs, and pdev resolution must be idempotent.\n\n**Recommendation**:\nAlways stop the kthread before calling pci_sim_nvme_poll_vf_cleanup. In poll_check_regs, resolve pdev under poll_lock and only assign if currently NULL. Have poll_vf_cleanup take poll_lock, pci_dev_put, and set pdev\u003dNULL atomically. Let the kthread own pdev resolution exclusively.","commit_id":"fe98d64830043cbea7292c4cb3e91d1441680ecb"}],"pci-sim/fake_pci_sriov_uart.c":[{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"824bae2e6e30e5fcbebb77526e2bc9607367b100","unresolved":true,"context_lines":[{"line_number":467,"context_line":""},{"line_number":468,"context_line":"\tif ((pdev-\u003eclass \u003e\u003e 8) \u003d\u003d (FAKE_PCI_NVME_CLASS \u003e\u003e 8))"},{"line_number":469,"context_line":"\t\treturn -ENODEV;"},{"line_number":470,"context_line":""},{"line_number":471,"context_line":"\tret \u003d pci_enable_device(pdev);"},{"line_number":472,"context_line":"\tif (ret)"},{"line_number":473,"context_line":"\t\treturn ret;"}],"source_content_type":"text/x-csrc","patch_set":1,"id":"2a01a528_4430ca97","line":470,"updated":"2026-06-26 15:48:22.000000000","message":"this feels like we have a leaky absraction that need to be fixed before we proceed","commit_id":"941d628093789e9791b2c95f7eaff21002f891f6"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"4bc11ce7a56cd6279855972d2749219558d13616","unresolved":false,"context_lines":[{"line_number":533,"context_line":"}"},{"line_number":534,"context_line":""},{"line_number":535,"context_line":"static const struct pci_device_id pci_sim_vf_ids[] \u003d {"},{"line_number":536,"context_line":"\t{ .vendor \u003d FAKE_PCI_VENDOR_ID, .device \u003d FAKE_PCI_VF_DEVICE_ID,"},{"line_number":537,"context_line":"\t  .subvendor \u003d PCI_ANY_ID, .subdevice \u003d PCI_ANY_ID,"},{"line_number":538,"context_line":"\t  .class \u003d FAKE_PCI_SERIAL_CLASS, .class_mask \u003d 0xFFFFFF },"},{"line_number":539,"context_line":"\t{ .vendor \u003d FAKE_PCI_VENDOR_ID, .device \u003d FAKE_PCI_VF_DEVICE_ID,"}],"source_content_type":"text/x-csrc","patch_set":3,"id":"48b763cd_34ce5b6d","line":536,"updated":"2026-06-28 10:09:47.000000000","message":"fake_pci_sriov_uart.c now matches VFs by two id_table entries with class_mask 0xFFFFFF. The NVMe host and VFIO drivers claim NVMe-class VFs via separate id_tables. There is no comment documenting why both entries are needed or how a future personality should add its entry.\n\n**Severity**: SUGGESTION | **Confidence**: 0.7\n\n**Benefit**: Documenting the class-based partitioning prevents a future personality from accidentally claiming (or failing to claim) a VF class, which would silently break binding.\n\n**Recommendation**:\nAdd a brief comment above pci_sim_vf_ids explaining the class-based partitioning across pci_sim_vf_driver / pci_sim_nvme_host_driver / pci_sim_vfio_driver.","commit_id":"fe98d64830043cbea7292c4cb3e91d1441680ecb"}],"pci-sim/run_nvme_vfio_guest_probe.py":[{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"4bc11ce7a56cd6279855972d2749219558d13616","unresolved":false,"context_lines":[{"line_number":1,"context_line":"#!/usr/bin/env python3"},{"line_number":2,"context_line":"# SPDX-License-Identifier: GPL-2.0"},{"line_number":3,"context_line":"\"\"\"Boot an Ubuntu guest with one fake NVMe VF and run NVMe validation."},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"This helper is launched by ``run_nvme_vfio_guest_probe.sh`` after the shell"}],"source_content_type":"text/x-python","patch_set":3,"id":"9ca1c0f0_eca0c8f5","line":2,"updated":"2026-06-28 10:09:47.000000000","message":"run_nvme_vfio_guest_probe.py carries SPDX-License-Identifier: GPL-2.0, while sibling OpenStack tooling in tools/ and devstack/ uses Apache-2.0. The two-tier licensing is intentional per the project structure but worth confirming.\n\n**Severity**: SUGGESTION | **Confidence**: 0.7\n\n**Benefit**: Confirms the licensing intent for a Python guest-probe helper that drives QEMU and parses output (not part of the .ko build).\n\n**Recommendation**:\nIf this script is meant to be OpenStack-side tooling, consider SPDX-License-Identifier: Apache-2.0 to match tools/ and devstack/. If it is genuinely part of the GPL kernel test fixture, add a comment clarifying why it is GPL while sibling scripts are Apache.","commit_id":"fe98d64830043cbea7292c4cb3e91d1441680ecb"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"4bc11ce7a56cd6279855972d2749219558d13616","unresolved":false,"context_lines":[{"line_number":83,"context_line":"    ]"},{"line_number":84,"context_line":"    print(\"+ \" + \" \".join(cmd), flush\u003dTrue)"},{"line_number":85,"context_line":"    master, slave \u003d pty.openpty()"},{"line_number":86,"context_line":"    proc \u003d subprocess.Popen("},{"line_number":87,"context_line":"        cmd, stdin\u003dslave, stdout\u003dslave, stderr\u003dslave, close_fds\u003dTrue"},{"line_number":88,"context_line":"    )"},{"line_number":89,"context_line":"    os.close(slave)"}],"source_content_type":"text/x-python","patch_set":3,"id":"025ec82d_ab89f989","line":86,"updated":"2026-06-28 10:09:47.000000000","message":"run_nvme_vfio_guest_probe.py opens a PTY pair (master, slave), passes slave to Popen, then closes slave. If Popen raises (e.g. qemu-system-x86_64 not found, OSError), the function returns neither proc nor master, and the master fd leaks.\n\n**Severity**: WARNING | **Confidence**: 0.7\n\n**Impact**: On a Popen exception the master fd is orphaned. The caller\u0027s finally only closes the master it receives. In a one-shot CI script this is low-impact but it is a resource-leak pattern.\n\n**Suggestion**:\nWrap the pty.openpty()/Popen in try/except so that on Popen failure os.close(master) and os.close(slave) are called before re-raising. This makes the helper robust to missing QEMU binaries.","commit_id":"fe98d64830043cbea7292c4cb3e91d1441680ecb"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"4bc11ce7a56cd6279855972d2749219558d13616","unresolved":false,"context_lines":[{"line_number":138,"context_line":"            buf \u003d \"\""},{"line_number":139,"context_line":"            continue"},{"line_number":140,"context_line":"        if not logged and re.search(r\"(?:^|[\\r\\n])Password:\\s*$\", buf):"},{"line_number":141,"context_line":"            send(master, \"testpass\\n\")"},{"line_number":142,"context_line":"            logged \u003d True"},{"line_number":143,"context_line":"            buf \u003d \"\""},{"line_number":144,"context_line":"            time.sleep(1)"}],"source_content_type":"text/x-python","patch_set":3,"id":"63238630_fdbfa3f0","line":141,"updated":"2026-06-28 10:09:47.000000000","message":"run_nvme_vfio_guest_probe.py logs the guest root password (\u0027testpass\u0027) to stdout and the log file via the serial console read path. The console read loop echoes everything received back to sys.stdout (tee\u0027d to LOG in the .sh wrapper).\n\n**Severity**: WARNING | **Confidence**: 0.8\n\n**Impact**: The credential is a known weak test password baked into the image, but it still ends up in CI log artifacts that may be world-readable. Not a production secret, but gratuitous credential logging.\n\n**Suggestion**:\nSuppress the echo during the password send window (clear buf before/after sending the password), or document explicitly that the log contains the test credential and is non-sensitive. At minimum do not echo the password line back to stdout.","commit_id":"fe98d64830043cbea7292c4cb3e91d1441680ecb"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"4bc11ce7a56cd6279855972d2749219558d13616","unresolved":false,"context_lines":[{"line_number":170,"context_line":""},{"line_number":171,"context_line":""},{"line_number":172,"context_line":"def main() -\u003e None:"},{"line_number":173,"context_line":"    image \u003d os.environ[\"IMAGE\"]"},{"line_number":174,"context_line":"    vf \u003d os.environ[\"VF\"]"},{"line_number":175,"context_line":"    deadline_s \u003d int(os.environ.get(\"QEMU_DEADLINE\", \"180\"))"},{"line_number":176,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"bf340884_41683618","line":173,"updated":"2026-06-28 10:09:47.000000000","message":"main() does os.environ[\u0027IMAGE\u0027] and os.environ[\u0027VF\u0027] without validation. If the caller forgets to export these, the script dies with an uncaught KeyError traceback rather than a helpful usage message.\n\n**Severity**: WARNING | **Confidence**: 0.8\n\n**Impact**: A KeyError on missing env is a poor diagnostic for a CI failure inside a long, expensive QEMU workflow. It points at the wrong layer.\n\n**Suggestion**:\nConvert IMAGE/VF to argparse positional/required arguments, or add explicit guards: for var in (\u0027IMAGE\u0027,\u0027VF\u0027): if var not in os.environ: sys.exit(f\u0027missing required env {var}; see module docstring\u0027).","commit_id":"fe98d64830043cbea7292c4cb3e91d1441680ecb"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"709ed6945feaad371d0c401117ea339fa2236b4e","unresolved":false,"context_lines":[{"line_number":138,"context_line":"            buf \u003d \"\""},{"line_number":139,"context_line":"            continue"},{"line_number":140,"context_line":"        if not logged and re.search(r\"(?:^|[\\r\\n])Password:\\s*$\", buf):"},{"line_number":141,"context_line":"            send(master, \"testpass\\n\")"},{"line_number":142,"context_line":"            logged \u003d True"},{"line_number":143,"context_line":"            buf \u003d \"\""},{"line_number":144,"context_line":"            time.sleep(1)"}],"source_content_type":"text/x-python","patch_set":4,"id":"ef8c27d2_065eb230","line":141,"updated":"2026-06-29 05:22:27.000000000","message":"The QEMU guest probe sends root password \u0027testpass\u0027 as a hardcoded literal; the passthrough test also defaults SSH_PASSWORD\u003dtestpass, so any retained test image shares a known credential.\n\n**Severity**: WARNING | **Confidence**: 0.7\n\n**Impact**: A test image kept around (KEEP\u003d1 or a retained Glance image) has a publicly-known root password, a minor exposure if the test network is reachable.\n\n**Suggestion**:\nGenerate a random password per run (or require it via env with no default for production-like runs), and document that retained images must be destroyed. At minimum note the credential in the developer guide.","commit_id":"8cb337f7f11a274a16c17c29b793cbfec39335f4"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"709ed6945feaad371d0c401117ea339fa2236b4e","unresolved":false,"context_lines":[{"line_number":170,"context_line":""},{"line_number":171,"context_line":""},{"line_number":172,"context_line":"def main() -\u003e None:"},{"line_number":173,"context_line":"    image \u003d os.environ[\"IMAGE\"]"},{"line_number":174,"context_line":"    vf \u003d os.environ[\"VF\"]"},{"line_number":175,"context_line":"    deadline_s \u003d int(os.environ.get(\"QEMU_DEADLINE\", \"180\"))"},{"line_number":176,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"3e6307ba_9551ac42","line":173,"updated":"2026-06-29 05:22:27.000000000","message":"run_nvme_vfio_guest_probe.py reads IMAGE/VF from os.environ without guarding KeyError, and int()-parses QEMU_DEADLINE without guarding ValueError.\n\n**Severity**: WARNING | **Confidence**: 0.8\n\n**Impact**: Operators running the guest probe helper directly get a raw traceback on missing/invalid input, making the test harness harder to debug in CI failures.\n\n**Suggestion**:\nWrap the env access in a small helper that prints the expected variables (IMAGE, VF, QEMU_DEADLINE) and exits non-zero with a clear message. Guard the int() parse similarly.","commit_id":"8cb337f7f11a274a16c17c29b793cbfec39335f4"}],"pci-sim/run_nvme_vfio_guest_probe.sh":[{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"4bc11ce7a56cd6279855972d2749219558d13616","unresolved":false,"context_lines":[{"line_number":86,"context_line":""},{"line_number":87,"context_line":"msg \"ensure Ubuntu image\""},{"line_number":88,"context_line":"if [ ! -s \"$IMAGE_BASE\" ]; then"},{"line_number":89,"context_line":"\ttimeout 600s curl -L --fail --connect-timeout 20 \\"},{"line_number":90,"context_line":"\t\t-o \"$IMAGE_BASE.tmp\" \"$IMAGE_URL\""},{"line_number":91,"context_line":"\tmv \"$IMAGE_BASE.tmp\" \"$IMAGE_BASE\""},{"line_number":92,"context_line":"fi"}],"source_content_type":"text/x-sh","patch_set":3,"id":"be17c686_79dcda56","line":89,"updated":"2026-06-28 10:09:47.000000000","message":"run_nvme_vfio_guest_probe.sh downloads the Ubuntu 24.04 cloud image with curl --fail but no sha256 verification. A corrupted or tampered image would produce confusing guest-boot failures.\n\n**Severity**: SUGGESTION | **Confidence**: 0.8\n\n**Benefit**: Standard practice for test image fetching prevents silent corruption from causing opaque guest-probe failures.\n\n**Recommendation**:\nAfter download, verify against the published SHA256SUMS file (curl the SHA256SUMS alongside the image, sha256sum -c).","commit_id":"fe98d64830043cbea7292c4cb3e91d1441680ecb"}],"pci-sim/test_pci_sim_nvme_host.sh":[{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"824bae2e6e30e5fcbebb77526e2bc9607367b100","unresolved":true,"context_lines":[{"line_number":1,"context_line":"#!/bin/bash"},{"line_number":2,"context_line":"# SPDX-License-Identifier: GPL-2.0"},{"line_number":3,"context_line":"#"},{"line_number":4,"context_line":"# Smoke test for pci-sim NVMe host character device driver."}],"source_content_type":"text/x-sh","patch_set":1,"id":"46c2f351_28234c85","line":1,"updated":"2026-06-26 15:48:22.000000000","message":"the main testign gaps i see her are i dont think you are doing any data read/write tests\n\nso woudl like to see some thest tha tuse parted and mkfs to partion the nvme device, create a file system, mount it locally and write to a file, unmount and remote and read form the same file.\n\nit woudl be also good to chekck the partion tbale ectra should up in lsblk/blkid properly with unique serials/uuids ectra.","commit_id":"941d628093789e9791b2c95f7eaff21002f891f6"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"1afc7d4f00f55d2845e98936f9c027e121cb24d3","unresolved":false,"context_lines":[{"line_number":24,"context_line":"        echo 0 \u003e \"$pf/sriov_numvfs\" 2\u003e/dev/null || true"},{"line_number":25,"context_line":"    fi"},{"line_number":26,"context_line":"    rmmod -f fake_pci_sriov 2\u003e/dev/null || true"},{"line_number":27,"context_line":"    rm -f /tmp/pci-sim-nvme.* 2\u003e/dev/null || true"},{"line_number":28,"context_line":"}"},{"line_number":29,"context_line":"trap cleanup EXIT"},{"line_number":30,"context_line":""}],"source_content_type":"text/x-sh","patch_set":1,"id":"20cacf5b_0fa471ee","line":27,"updated":"2026-06-26 15:16:00.000000000","message":"Test script uses \u0027rmmod -f fake_pci_sriov\u0027 which force-removes the module even if it has live references, risking kernel crash if devices are in use. The -f flag is dangerous and should not be used even in test scripts.\n\n**Severity**: WARNING | **Confidence**: 0.8\n\n**Impact**: Force-removing a kernel module with active device references can panic the kernel.\n\n**Suggestion**:\nUse plain \u0027rmmod fake_pci_sriov\u0027 (without -f) and properly unbind VFs and disable SR-IOV in cleanup before removal. If rmmod fails, report the error rather than forcing.","commit_id":"941d628093789e9791b2c95f7eaff21002f891f6"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"4bc11ce7a56cd6279855972d2749219558d13616","unresolved":false,"context_lines":[{"line_number":53,"context_line":"echo \"--- Loading module ---\""},{"line_number":54,"context_line":"insmod \"$MODULE\" nvme_backing_file\u003d/tmp/pci-sim-nvme"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"PF\u003d\"/sys/bus/pci/devices/0001:00:00.0\""},{"line_number":57,"context_line":"if [ ! -d \"$PF\" ]; then"},{"line_number":58,"context_line":"    fail \"PF device not found\""},{"line_number":59,"context_line":"    exit 1"}],"source_content_type":"text/x-sh","patch_set":3,"id":"58588e0e_edd70b67","line":56,"updated":"2026-06-28 10:09:47.000000000","message":"test_pci_sim_nvme_host.sh hardcodes PCI addresses (0001:00:00.0, .1, .2) instead of discovering them. The DevStack plugin and run_nvme_vfio_guest_probe.sh both discover devices by vendor/device ID.\n\n**Severity**: SUGGESTION | **Confidence**: 0.8\n\n**Benefit**: Discovering the PF via lspci/sysfs would make the suite robust to topology changes and consistent with the other scripts that already do discovery.\n\n**Recommendation**:\nAdd a discovery step at the top (lspci -D -d 1d55:1000 | head -1 or a sysfs walk matching vendor/device) and derive VF addresses from the PF.","commit_id":"fe98d64830043cbea7292c4cb3e91d1441680ecb"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"4bc11ce7a56cd6279855972d2749219558d13616","unresolved":false,"context_lines":[{"line_number":219,"context_line":""},{"line_number":220,"context_line":"echo \"--- Unloading module for Phase 2 reload ---\""},{"line_number":221,"context_line":"CLEANUP\u003d\"$(dirname \"$MODULE\")/cleanup_fake_pci_sriov.sh\""},{"line_number":222,"context_line":"bash \"$CLEANUP\" 2\u003e\u00261"},{"line_number":223,"context_line":"sleep 0.5"},{"line_number":224,"context_line":""},{"line_number":225,"context_line":"# Parse memmap\u003d from kernel cmdline for BAR0 reserved memory"}],"source_content_type":"text/x-sh","patch_set":3,"id":"c2614a31_ca4b37e2","line":222,"updated":"2026-06-28 10:09:47.000000000","message":"test_pci_sim_nvme_host.sh unconditionally invokes an external cleanup script whose existence is assumed. CLEANUP\u003ddirname($MODULE)/cleanup_fake_pci_sriov.sh is run with \u0027bash \"$CLEANUP\"\u0027 under set -e; if the script is not co-located the suite aborts before Phase 2.\n\n**Severity**: WARNING | **Confidence**: 0.7\n\n**Impact**: If MODULE is supplied from a make install path where the cleanup script is not co-located, bash fails to open the file and set -e aborts the entire test suite before Phase 2 runs.\n\n**Suggestion**:\nGuard the call: if [[ -f \"$CLEANUP\" ]]; then bash \"$CLEANUP\"; else rmmod fake_pci_sriov ...; fi. Alternatively reuse the existing cleanup() trap function which already handles rmmod.","commit_id":"fe98d64830043cbea7292c4cb3e91d1441680ecb"}],"playbooks/pci-sim-nvme-pre.yaml":[{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"4bc11ce7a56cd6279855972d2749219558d13616","unresolved":false,"context_lines":[{"line_number":33,"context_line":"        state: present"},{"line_number":34,"context_line":"        backrefs: yes"},{"line_number":35,"context_line":"        regexp: \u0027GRUB_CMDLINE_LINUX\u003d\"([^\"]*)\"\u0027"},{"line_number":36,"context_line":"        line: \u003e-"},{"line_number":37,"context_line":"          GRUB_CMDLINE_LINUX\u003d\"\\1"},{"line_number":38,"context_line":"          memmap\u003d{{ pci_sim_nvme_memmap_size }}M\\\\\\\\\\\\${{ pci_sim_nvme_memmap_start }}G\""},{"line_number":39,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"716fd73b_0f74382e","line":36,"updated":"2026-06-28 10:09:47.000000000","message":"GRUB memmap lineinfile uses heavy backslash escaping (\u0027memmap\u003d...M\\\\\\\\$...G\u0027) risking a malformed kernel parameter. The kernel memmap\u003d syntax needs a literal $: memmap\u003d512M$7G. Seven backslashes before $ may render a literal backslash or shell-escaped $ that the kernel will not parse.\n\n**Severity**: HIGH | **Confidence**: 0.8\n\n**Risk**: If the memmap\u003d parameter is malformed, Phase 2 NVMe tests cannot bind the stock nvme driver and the job fails silently with a confusing \u0027driver did not bind\u0027 error after a full reboot cycle.\n\n**Priority**: Before merge\n**Why This Matters**: The memmap\u003d parameter is the foundation of the entire Phase 2 test path. A malformed GRUB line wastes an expensive reboot cycle in CI and the failure mode is obscure.\n\n**Recommendation**:\nTest the exact rendered /etc/default/grub content in a real Zuul run before relying on it. Simplify the escaping: use a literal $ without the backref and heavy escaping. Add a post-write assert that the rendered line contains a literal \u0027memmap\u003d\u0027 followed by a digit and \u0027$\u0027 with no preceding backslash.","commit_id":"fe98d64830043cbea7292c4cb3e91d1441680ecb"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"4bc11ce7a56cd6279855972d2749219558d13616","unresolved":false,"context_lines":[{"line_number":55,"context_line":"      become: true"},{"line_number":56,"context_line":"      ansible.builtin.reboot:"},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"    - name: Run post-boot tasks"},{"line_number":59,"context_line":"      ansible.builtin.include_role:"},{"line_number":60,"context_line":"        name: post-reboot-tasks"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"566785b4_a06b288b","line":58,"updated":"2026-06-28 10:09:47.000000000","message":"Zuul pre-run playbook references a non-existent Ansible role \u0027post-reboot-tasks\u0027. The final task uses ansible.builtin.include_role with name \u0027post-reboot-tasks\u0027, but this role does not exist anywhere in the repository (no roles/ directory, no requirements.yml, no required-projects providing it).\n\n**Severity**: HIGH | **Confidence**: 0.9\n\n**Risk**: Ansible will fail with \u0027ERROR! the role post-reboot-tasks was not found\u0027 after the reboot completes, causing the cyborg-tempest-pci-sim-nvme job\u0027s pre-run to fail on every execution.\n\n**Priority**: Before merge\n**Why This Matters**: The entire cyborg-tempest-pci-sim-nvme CI job depends on this playbook. A non-existent role means the job can never pass. This makes the new non-voting job permanently red.\n\n**Recommendation**:\nEither (a) add the role under roles/post-reboot-tasks/ with the post-reboot setup tasks (re-confirming the kernel cmdline now contains memmap\u003d, verifying KVM/nesting, re-running prep the reboot invalidated), or (b) if no post-reboot work is needed, remove the final include_role task entirely.","commit_id":"fe98d64830043cbea7292c4cb3e91d1441680ecb"}],"tools/run-devstack-nvme-passthrough-test.sh":[{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"4bc11ce7a56cd6279855972d2749219558d13616","unresolved":false,"context_lines":[{"line_number":158,"context_line":""},{"line_number":159,"context_line":"    require_command sshpass"},{"line_number":160,"context_line":"    sshpass -p \"$SSH_PASSWORD\" \\"},{"line_number":161,"context_line":"        ssh -o StrictHostKeyChecking\u003dno -o UserKnownHostsFile\u003d/dev/null \\"},{"line_number":162,"context_line":"            -o ConnectTimeout\u003d10 \\"},{"line_number":163,"context_line":"            \"$SSH_USER@$ip\" \u003c\u003c\u0027GUEST_EOF\u0027 | tee \"$log\" || rc\u003d$?"},{"line_number":164,"context_line":"set -u"}],"source_content_type":"text/x-sh","patch_set":3,"id":"432b09ac_4c1a2ba9","line":161,"updated":"2026-06-28 10:09:47.000000000","message":"tools/run-devstack-nvme-passthrough-test.sh uses StrictHostKeyChecking\u003dno with UserKnownHostsFile\u003d/dev/null and a hardcoded default password over SSH.\n\n**Severity**: WARNING | **Confidence**: 0.8\n\n**Impact**: In a DevStack CI context this is acceptable, but a misconfigured floating IP or DNS rebinding could lead to sending the test password / guest commands to an unintended host. The combination is a classic TOFU bypass.\n\n**Suggestion**:\nAcceptable for ephemeral CI VMs, but consider pinning the known host key from the server create step, or scope the insecure options strictly to the test VM\u0027s FIP. At minimum add a comment noting these are intentional for ephemeral CI guests.","commit_id":"fe98d64830043cbea7292c4cb3e91d1441680ecb"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"709ed6945feaad371d0c401117ea339fa2236b4e","unresolved":false,"context_lines":[{"line_number":96,"context_line":"    openstack token issue -f value -c id \u003e/dev/null"},{"line_number":97,"context_line":"}"},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"open_default_security_group() {"},{"line_number":100,"context_line":"    local project_id sg_id"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"    project_id\u003d$(openstack token issue -f value -c project_id)"}],"source_content_type":"text/x-sh","patch_set":4,"id":"00caf780_bc56462b","line":99,"updated":"2026-06-29 05:22:27.000000000","message":"run-devstack-nvme-passthrough-test.sh opens the project default security group for ICMP/SSH rather than a dedicated group, and uses ssh with StrictHostKeyChecking\u003dno.\n\n**Severity**: WARNING | **Confidence**: 0.8\n\n**Impact**: The test permanently alters the project default security group and disables host-key checking, persisting beyond the run and affecting unrelated workloads in the same project.\n\n**Suggestion**:\nCreate a dedicated pci-sim test security group scoped to this run and delete it on cleanup; keep StrictHostKeyChecking\u003dno (acceptable for ephemeral CI) but scope the firewall change rather than mutating the default group.","commit_id":"8cb337f7f11a274a16c17c29b793cbfec39335f4"}]}