diff options
author | Alexander Kanavin <alex.kanavin@gmail.com> | 2022-12-24 17:59:43 +0100 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2022-12-26 18:49:07 +0000 |
commit | 9caff14abbb742e5083056b899ee6fc0a5fba8f3 (patch) | |
tree | f1011ab47b0a00d76ceb26c4899d62b92b0ccc78 /meta/recipes-devtools/qemu | |
parent | d7f7b788f7cef5f8db9df3613a108e13998155e1 (diff) | |
download | poky-9caff14abbb742e5083056b899ee6fc0a5fba8f3.tar.gz |
qemu: update 7.1.0 -> 7.2.0
qemu no longer carries libslirp in-tree,
so enabling slirp requires providing external libslirp.
Another noteworthy change is:
x86: TCG support for AVX, AVX2, F16C, FMA3 and VAES instructions
... which means both meta-intel and qemu x86 targets can
now fully utilize Haswell-and-later instruction set with benefits
for performance in emulation and on silicon.
Changelog:
https://wiki.qemu.org/ChangeLog/7.2
(From OE-Core rev: d82e521995832580e990c0c173651aafd43d299c)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-devtools/qemu')
-rw-r--r-- | meta/recipes-devtools/qemu/qemu-native_7.2.0.bb (renamed from meta/recipes-devtools/qemu/qemu-native_7.1.0.bb) | 0 | ||||
-rw-r--r-- | meta/recipes-devtools/qemu/qemu-system-native_7.2.0.bb (renamed from meta/recipes-devtools/qemu/qemu-system-native_7.1.0.bb) | 0 | ||||
-rw-r--r-- | meta/recipes-devtools/qemu/qemu.inc | 14 | ||||
-rw-r--r-- | meta/recipes-devtools/qemu/qemu/0001-net-tulip-Restrict-DMA-engine-to-memories.patch | 64 | ||||
-rw-r--r-- | meta/recipes-devtools/qemu/qemu/CVE-2022-3165.patch | 59 | ||||
-rw-r--r-- | meta/recipes-devtools/qemu/qemu/arm-cpreg-fix.patch | 27 | ||||
-rw-r--r-- | meta/recipes-devtools/qemu/qemu_7.2.0.bb (renamed from meta/recipes-devtools/qemu/qemu_7.1.0.bb) | 0 |
7 files changed, 6 insertions, 158 deletions
diff --git a/meta/recipes-devtools/qemu/qemu-native_7.1.0.bb b/meta/recipes-devtools/qemu/qemu-native_7.2.0.bb index a94dc0b61e..a94dc0b61e 100644 --- a/meta/recipes-devtools/qemu/qemu-native_7.1.0.bb +++ b/meta/recipes-devtools/qemu/qemu-native_7.2.0.bb | |||
diff --git a/meta/recipes-devtools/qemu/qemu-system-native_7.1.0.bb b/meta/recipes-devtools/qemu/qemu-system-native_7.2.0.bb index 04c7c2a6ac..04c7c2a6ac 100644 --- a/meta/recipes-devtools/qemu/qemu-system-native_7.1.0.bb +++ b/meta/recipes-devtools/qemu/qemu-system-native_7.2.0.bb | |||
diff --git a/meta/recipes-devtools/qemu/qemu.inc b/meta/recipes-devtools/qemu/qemu.inc index 27e3a8e259..b63c643dd8 100644 --- a/meta/recipes-devtools/qemu/qemu.inc +++ b/meta/recipes-devtools/qemu/qemu.inc | |||
@@ -27,15 +27,12 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \ | |||
27 | file://0008-tests-meson.build-use-relative-path-to-refer-to-file.patch \ | 27 | file://0008-tests-meson.build-use-relative-path-to-refer-to-file.patch \ |
28 | file://0009-Define-MAP_SYNC-and-MAP_SHARED_VALIDATE-on-needed-li.patch \ | 28 | file://0009-Define-MAP_SYNC-and-MAP_SHARED_VALIDATE-on-needed-li.patch \ |
29 | file://0010-hw-pvrdma-Protect-against-buggy-or-malicious-guest-d.patch \ | 29 | file://0010-hw-pvrdma-Protect-against-buggy-or-malicious-guest-d.patch \ |
30 | file://0001-net-tulip-Restrict-DMA-engine-to-memories.patch \ | ||
31 | file://0001-contrib-vhost-user-blk-Replace-lseek64-with-lseek.patch \ | 30 | file://0001-contrib-vhost-user-blk-Replace-lseek64-with-lseek.patch \ |
32 | file://0002-linux-user-Replace-use-of-lfs64-related-functions-an.patch \ | 31 | file://0002-linux-user-Replace-use-of-lfs64-related-functions-an.patch \ |
33 | file://arm-cpreg-fix.patch \ | ||
34 | file://CVE-2022-3165.patch \ | ||
35 | " | 32 | " |
36 | UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar" | 33 | UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar" |
37 | 34 | ||
38 | SRC_URI[sha256sum] = "a0634e536bded57cf38ec8a751adb124b89c776fe0846f21ab6c6728f1cbbbe6" | 35 | SRC_URI[sha256sum] = "5b49ce2687744dad494ae90a898c52204a3406e84d072482a1e1be854eeb2157" |
39 | 36 | ||
40 | SRC_URI:append:class-target = " file://cross.patch" | 37 | SRC_URI:append:class-target = " file://cross.patch" |
41 | SRC_URI:append:class-nativesdk = " file://cross.patch" | 38 | SRC_URI:append:class-nativesdk = " file://cross.patch" |
@@ -72,15 +69,16 @@ do_install_ptest() { | |||
72 | sed -i -e "1s,#!/usr/bin/bash,#!${base_bindir}/bash," ${D}${PTEST_PATH}/tests/data/acpi/disassemle-aml.sh | 69 | sed -i -e "1s,#!/usr/bin/bash,#!${base_bindir}/bash," ${D}${PTEST_PATH}/tests/data/acpi/disassemle-aml.sh |
73 | 70 | ||
74 | # Strip the paths from the QEMU variable, we can use PATH | 71 | # Strip the paths from the QEMU variable, we can use PATH |
75 | sed -i -e "s#^QEMU=.*/qemu-#QEMU=qemu-#g" ${D}${PTEST_PATH}/tests/tcg/*.mak | 72 | makfiles=$(find ${D}${PTEST_PATH} -name "*.mak") |
73 | sed -i -e "s#^QEMU=.*/qemu-#QEMU=qemu-#g" $makfiles | ||
76 | 74 | ||
77 | # Strip compiler flags as they break reproducibility | 75 | # Strip compiler flags as they break reproducibility |
78 | sed -i -e "s,^CC=.*,CC=gcc," \ | 76 | sed -i -e "s,^CC=.*,CC=gcc," \ |
79 | -e "s,^CCAS=.*,CCAS=gcc," \ | 77 | -e "s,^CCAS=.*,CCAS=gcc," \ |
80 | -e "s,^LD=.*,LD=ld," ${D}${PTEST_PATH}/tests/tcg/*.mak | 78 | -e "s,^LD=.*,LD=ld," $makfiles |
81 | 79 | ||
82 | # Update SRC_PATH variable to the right place on target | 80 | # Update SRC_PATH variable to the right place on target |
83 | sed -i -e "s#^SRC_PATH=.*#SRC_PATH=${PTEST_PATH}#g" ${D}${PTEST_PATH}/tests/tcg/*.mak | 81 | sed -i -e "s#^SRC_PATH=.*#SRC_PATH=${PTEST_PATH}#g" $makfiles |
84 | 82 | ||
85 | } | 83 | } |
86 | 84 | ||
@@ -200,7 +198,7 @@ PACKAGECONFIG[bpf] = "--enable-bpf,--disable-bpf,libbpf" | |||
200 | PACKAGECONFIG[capstone] = "--enable-capstone,--disable-capstone" | 198 | PACKAGECONFIG[capstone] = "--enable-capstone,--disable-capstone" |
201 | PACKAGECONFIG[rdma] = "--enable-rdma,--disable-rdma" | 199 | PACKAGECONFIG[rdma] = "--enable-rdma,--disable-rdma" |
202 | PACKAGECONFIG[vde] = "--enable-vde,--disable-vde" | 200 | PACKAGECONFIG[vde] = "--enable-vde,--disable-vde" |
203 | PACKAGECONFIG[slirp] = "--enable-slirp=internal,--disable-slirp" | 201 | PACKAGECONFIG[slirp] = "--enable-slirp,--disable-slirp,libslirp" |
204 | PACKAGECONFIG[brlapi] = "--enable-brlapi,--disable-brlapi" | 202 | PACKAGECONFIG[brlapi] = "--enable-brlapi,--disable-brlapi" |
205 | PACKAGECONFIG[jack] = "--enable-jack,--disable-jack,jack," | 203 | PACKAGECONFIG[jack] = "--enable-jack,--disable-jack,jack," |
206 | 204 | ||
diff --git a/meta/recipes-devtools/qemu/qemu/0001-net-tulip-Restrict-DMA-engine-to-memories.patch b/meta/recipes-devtools/qemu/qemu/0001-net-tulip-Restrict-DMA-engine-to-memories.patch deleted file mode 100644 index 6c85a77ba7..0000000000 --- a/meta/recipes-devtools/qemu/qemu/0001-net-tulip-Restrict-DMA-engine-to-memories.patch +++ /dev/null | |||
@@ -1,64 +0,0 @@ | |||
1 | CVE: CVE-2022-2962 | ||
2 | Upstream-Status: Backport | ||
3 | Signed-off-by: Ross Burton <ross.burton@arm.com> | ||
4 | |||
5 | From 5c5c50b0a73d78ffe18336c9996fef5eae9bbbb0 Mon Sep 17 00:00:00 2001 | ||
6 | From: Zheyu Ma <zheyuma97@gmail.com> | ||
7 | Date: Sun, 21 Aug 2022 20:43:43 +0800 | ||
8 | Subject: [PATCH] net: tulip: Restrict DMA engine to memories | ||
9 | |||
10 | The DMA engine is started by I/O access and then itself accesses the | ||
11 | I/O registers, triggering a reentrancy bug. | ||
12 | |||
13 | The following log can reveal it: | ||
14 | ==5637==ERROR: AddressSanitizer: stack-overflow | ||
15 | #0 0x5595435f6078 in tulip_xmit_list_update qemu/hw/net/tulip.c:673 | ||
16 | #1 0x5595435f204a in tulip_write qemu/hw/net/tulip.c:805:13 | ||
17 | #2 0x559544637f86 in memory_region_write_accessor qemu/softmmu/memory.c:492:5 | ||
18 | #3 0x5595446379fa in access_with_adjusted_size qemu/softmmu/memory.c:554:18 | ||
19 | #4 0x5595446372fa in memory_region_dispatch_write qemu/softmmu/memory.c | ||
20 | #5 0x55954468b74c in flatview_write_continue qemu/softmmu/physmem.c:2825:23 | ||
21 | #6 0x559544683662 in flatview_write qemu/softmmu/physmem.c:2867:12 | ||
22 | #7 0x5595446833f3 in address_space_write qemu/softmmu/physmem.c:2963:18 | ||
23 | #8 0x5595435fb082 in dma_memory_rw_relaxed qemu/include/sysemu/dma.h:87:12 | ||
24 | #9 0x5595435fb082 in dma_memory_rw qemu/include/sysemu/dma.h:130:12 | ||
25 | #10 0x5595435fb082 in dma_memory_write qemu/include/sysemu/dma.h:171:12 | ||
26 | #11 0x5595435fb082 in stl_le_dma qemu/include/sysemu/dma.h:272:1 | ||
27 | #12 0x5595435fb082 in stl_le_pci_dma qemu/include/hw/pci/pci.h:910:1 | ||
28 | #13 0x5595435fb082 in tulip_desc_write qemu/hw/net/tulip.c:101:9 | ||
29 | #14 0x5595435f7e3d in tulip_xmit_list_update qemu/hw/net/tulip.c:706:9 | ||
30 | #15 0x5595435f204a in tulip_write qemu/hw/net/tulip.c:805:13 | ||
31 | |||
32 | Fix this bug by restricting the DMA engine to memories regions. | ||
33 | |||
34 | Signed-off-by: Zheyu Ma <zheyuma97@gmail.com> | ||
35 | Signed-off-by: Jason Wang <jasowang@redhat.com> | ||
36 | --- | ||
37 | hw/net/tulip.c | 4 ++-- | ||
38 | 1 file changed, 2 insertions(+), 2 deletions(-) | ||
39 | |||
40 | diff --git a/hw/net/tulip.c b/hw/net/tulip.c | ||
41 | index 097e905bec..b9e42c322a 100644 | ||
42 | --- a/hw/net/tulip.c | ||
43 | +++ b/hw/net/tulip.c | ||
44 | @@ -70,7 +70,7 @@ static const VMStateDescription vmstate_pci_tulip = { | ||
45 | static void tulip_desc_read(TULIPState *s, hwaddr p, | ||
46 | struct tulip_descriptor *desc) | ||
47 | { | ||
48 | - const MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED; | ||
49 | + const MemTxAttrs attrs = { .memory = true }; | ||
50 | |||
51 | if (s->csr[0] & CSR0_DBO) { | ||
52 | ldl_be_pci_dma(&s->dev, p, &desc->status, attrs); | ||
53 | @@ -88,7 +88,7 @@ static void tulip_desc_read(TULIPState *s, hwaddr p, | ||
54 | static void tulip_desc_write(TULIPState *s, hwaddr p, | ||
55 | struct tulip_descriptor *desc) | ||
56 | { | ||
57 | - const MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED; | ||
58 | + const MemTxAttrs attrs = { .memory = true }; | ||
59 | |||
60 | if (s->csr[0] & CSR0_DBO) { | ||
61 | stl_be_pci_dma(&s->dev, p, desc->status, attrs); | ||
62 | -- | ||
63 | 2.34.1 | ||
64 | |||
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2022-3165.patch b/meta/recipes-devtools/qemu/qemu/CVE-2022-3165.patch deleted file mode 100644 index 3b4a6694c2..0000000000 --- a/meta/recipes-devtools/qemu/qemu/CVE-2022-3165.patch +++ /dev/null | |||
@@ -1,59 +0,0 @@ | |||
1 | CVE: CVE-2022-3165 | ||
2 | Upstream-Status: Backport | ||
3 | Signed-off-by: Ross Burton <ross.burton@arm.com> | ||
4 | |||
5 | From d307040b18bfcb1393b910f1bae753d5c12a4dc7 Mon Sep 17 00:00:00 2001 | ||
6 | From: Mauro Matteo Cascella <mcascell@redhat.com> | ||
7 | Date: Sun, 25 Sep 2022 22:45:11 +0200 | ||
8 | Subject: [PATCH] ui/vnc-clipboard: fix integer underflow in | ||
9 | vnc_client_cut_text_ext | ||
10 | |||
11 | Extended ClientCutText messages start with a 4-byte header. If len < 4, | ||
12 | an integer underflow occurs in vnc_client_cut_text_ext. The result is | ||
13 | used to decompress data in a while loop in inflate_buffer, leading to | ||
14 | CPU consumption and denial of service. Prevent this by checking dlen in | ||
15 | protocol_client_msg. | ||
16 | |||
17 | Fixes: CVE-2022-3165 | ||
18 | Fixes: 0bf41cab93e5 ("ui/vnc: clipboard support") | ||
19 | Reported-by: TangPeng <tangpeng@qianxin.com> | ||
20 | Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> | ||
21 | Message-Id: <20220925204511.1103214-1-mcascell@redhat.com> | ||
22 | Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> | ||
23 | --- | ||
24 | ui/vnc.c | 11 ++++++++--- | ||
25 | 1 file changed, 8 insertions(+), 3 deletions(-) | ||
26 | |||
27 | diff --git a/ui/vnc.c b/ui/vnc.c | ||
28 | index 6a05d06147..acb3629cd8 100644 | ||
29 | --- a/ui/vnc.c | ||
30 | +++ b/ui/vnc.c | ||
31 | @@ -2442,8 +2442,8 @@ static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len) | ||
32 | if (len == 1) { | ||
33 | return 8; | ||
34 | } | ||
35 | + uint32_t dlen = abs(read_s32(data, 4)); | ||
36 | if (len == 8) { | ||
37 | - uint32_t dlen = abs(read_s32(data, 4)); | ||
38 | if (dlen > (1 << 20)) { | ||
39 | error_report("vnc: client_cut_text msg payload has %u bytes" | ||
40 | " which exceeds our limit of 1MB.", dlen); | ||
41 | @@ -2456,8 +2456,13 @@ static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len) | ||
42 | } | ||
43 | |||
44 | if (read_s32(data, 4) < 0) { | ||
45 | - vnc_client_cut_text_ext(vs, abs(read_s32(data, 4)), | ||
46 | - read_u32(data, 8), data + 12); | ||
47 | + if (dlen < 4) { | ||
48 | + error_report("vnc: malformed payload (header less than 4 bytes)" | ||
49 | + " in extended clipboard pseudo-encoding."); | ||
50 | + vnc_client_error(vs); | ||
51 | + break; | ||
52 | + } | ||
53 | + vnc_client_cut_text_ext(vs, dlen, read_u32(data, 8), data + 12); | ||
54 | break; | ||
55 | } | ||
56 | vnc_client_cut_text(vs, read_u32(data, 4), data + 8); | ||
57 | -- | ||
58 | GitLab | ||
59 | |||
diff --git a/meta/recipes-devtools/qemu/qemu/arm-cpreg-fix.patch b/meta/recipes-devtools/qemu/qemu/arm-cpreg-fix.patch deleted file mode 100644 index 071691f8ca..0000000000 --- a/meta/recipes-devtools/qemu/qemu/arm-cpreg-fix.patch +++ /dev/null | |||
@@ -1,27 +0,0 @@ | |||
1 | target/arm: mark SP_EL1 with ARM_CP_EL3_NO_EL2_KEEP | ||
2 | |||
3 | SP_EL1 must be kept when EL3 is present but EL2 is not. Therefore mark | ||
4 | it with ARM_CP_EL3_NO_EL2_KEEP. | ||
5 | |||
6 | Fixes: 696ba3771894 ("target/arm: Handle cpreg registration for missing EL") | ||
7 | Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org> | ||
8 | |||
9 | Upstream-Status: Submitted [https://lists.gnu.org/archive/html/qemu-devel/2022-09/msg04515.html] | ||
10 | |||
11 | --- | ||
12 | target/arm/helper.c | 2 +- | ||
13 | 1 file changed, 1 insertion(+), 1 deletion(-) | ||
14 | |||
15 | Index: qemu-7.1.0/target/arm/helper.c | ||
16 | =================================================================== | ||
17 | --- qemu-7.1.0.orig/target/arm/helper.c | ||
18 | +++ qemu-7.1.0/target/arm/helper.c | ||
19 | @@ -4971,7 +4971,7 @@ static const ARMCPRegInfo v8_cp_reginfo[ | ||
20 | .fieldoffset = offsetof(CPUARMState, sp_el[0]) }, | ||
21 | { .name = "SP_EL1", .state = ARM_CP_STATE_AA64, | ||
22 | .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 1, .opc2 = 0, | ||
23 | - .access = PL2_RW, .type = ARM_CP_ALIAS, | ||
24 | + .access = PL2_RW, .type = ARM_CP_ALIAS | ARM_CP_EL3_NO_EL2_KEEP, | ||
25 | .fieldoffset = offsetof(CPUARMState, sp_el[1]) }, | ||
26 | { .name = "SPSel", .state = ARM_CP_STATE_AA64, | ||
27 | .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 2, .opc2 = 0, | ||
diff --git a/meta/recipes-devtools/qemu/qemu_7.1.0.bb b/meta/recipes-devtools/qemu/qemu_7.2.0.bb index 42e133967e..42e133967e 100644 --- a/meta/recipes-devtools/qemu/qemu_7.1.0.bb +++ b/meta/recipes-devtools/qemu/qemu_7.2.0.bb | |||