diff options
-rw-r--r-- | meta/recipes-devtools/qemu/qemu-native_8.1.2.bb (renamed from meta/recipes-devtools/qemu/qemu-native_8.1.0.bb) | 0 | ||||
-rw-r--r-- | meta/recipes-devtools/qemu/qemu-system-native_8.1.2.bb (renamed from meta/recipes-devtools/qemu/qemu-system-native_8.1.0.bb) | 0 | ||||
-rw-r--r-- | meta/recipes-devtools/qemu/qemu.inc | 5 | ||||
-rw-r--r-- | meta/recipes-devtools/qemu/qemu/0001-softmmu-Assert-data-in-bounds-in-iotlb_to_section.patch | 42 | ||||
-rw-r--r-- | meta/recipes-devtools/qemu/qemu/0001-softmmu-Use-async_run_on_cpu-in-tcg_commit.patch | 157 | ||||
-rw-r--r-- | meta/recipes-devtools/qemu/qemu/CVE-2023-42467.patch | 49 | ||||
-rw-r--r-- | meta/recipes-devtools/qemu/qemu_8.1.2.bb (renamed from meta/recipes-devtools/qemu/qemu_8.1.0.bb) | 0 |
7 files changed, 1 insertions, 252 deletions
diff --git a/meta/recipes-devtools/qemu/qemu-native_8.1.0.bb b/meta/recipes-devtools/qemu/qemu-native_8.1.2.bb index 73a0f63f2b..73a0f63f2b 100644 --- a/meta/recipes-devtools/qemu/qemu-native_8.1.0.bb +++ b/meta/recipes-devtools/qemu/qemu-native_8.1.2.bb | |||
diff --git a/meta/recipes-devtools/qemu/qemu-system-native_8.1.0.bb b/meta/recipes-devtools/qemu/qemu-system-native_8.1.2.bb index 558a416f7b..558a416f7b 100644 --- a/meta/recipes-devtools/qemu/qemu-system-native_8.1.0.bb +++ b/meta/recipes-devtools/qemu/qemu-system-native_8.1.2.bb | |||
diff --git a/meta/recipes-devtools/qemu/qemu.inc b/meta/recipes-devtools/qemu/qemu.inc index 78c495516f..5ab2cb83b4 100644 --- a/meta/recipes-devtools/qemu/qemu.inc +++ b/meta/recipes-devtools/qemu/qemu.inc | |||
@@ -29,18 +29,15 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \ | |||
29 | file://0009-Define-MAP_SYNC-and-MAP_SHARED_VALIDATE-on-needed-li.patch \ | 29 | file://0009-Define-MAP_SYNC-and-MAP_SHARED_VALIDATE-on-needed-li.patch \ |
30 | file://0010-hw-pvrdma-Protect-against-buggy-or-malicious-guest-d.patch \ | 30 | file://0010-hw-pvrdma-Protect-against-buggy-or-malicious-guest-d.patch \ |
31 | file://0002-linux-user-Replace-use-of-lfs64-related-functions-an.patch \ | 31 | file://0002-linux-user-Replace-use-of-lfs64-related-functions-an.patch \ |
32 | file://0001-softmmu-Assert-data-in-bounds-in-iotlb_to_section.patch \ | ||
33 | file://0001-softmmu-Use-async_run_on_cpu-in-tcg_commit.patch \ | ||
34 | file://fixedmeson.patch \ | 32 | file://fixedmeson.patch \ |
35 | file://fixmips.patch \ | 33 | file://fixmips.patch \ |
36 | file://qemu-guest-agent.init \ | 34 | file://qemu-guest-agent.init \ |
37 | file://qemu-guest-agent.udev \ | 35 | file://qemu-guest-agent.udev \ |
38 | file://CVE-2023-42467.patch \ | ||
39 | " | 36 | " |
40 | UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar" | 37 | UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar" |
41 | 38 | ||
42 | 39 | ||
43 | SRC_URI[sha256sum] = "710c101198e334d4762eef65f649bc43fa8a5dd75303554b8acfec3eb25f0e55" | 40 | SRC_URI[sha256sum] = "541526a764576eb494d2ff5ec46aeb253e62ea29035d1c23c0a8af4e6cd4f087" |
44 | 41 | ||
45 | SRC_URI:append:class-target = " file://cross.patch" | 42 | SRC_URI:append:class-target = " file://cross.patch" |
46 | SRC_URI:append:class-nativesdk = " file://cross.patch" | 43 | SRC_URI:append:class-nativesdk = " file://cross.patch" |
diff --git a/meta/recipes-devtools/qemu/qemu/0001-softmmu-Assert-data-in-bounds-in-iotlb_to_section.patch b/meta/recipes-devtools/qemu/qemu/0001-softmmu-Assert-data-in-bounds-in-iotlb_to_section.patch deleted file mode 100644 index 7380e16ab3..0000000000 --- a/meta/recipes-devtools/qemu/qemu/0001-softmmu-Assert-data-in-bounds-in-iotlb_to_section.patch +++ /dev/null | |||
@@ -1,42 +0,0 @@ | |||
1 | From 86e4f93d827d3c1efd00cd8a906e38a2c0f2b5bc Mon Sep 17 00:00:00 2001 | ||
2 | From: Richard Henderson <richard.henderson@linaro.org> | ||
3 | Date: Fri, 25 Aug 2023 14:06:58 -0700 | ||
4 | Subject: [PATCH] softmmu: Assert data in bounds in iotlb_to_section | ||
5 | MIME-Version: 1.0 | ||
6 | Content-Type: text/plain; charset=UTF-8 | ||
7 | Content-Transfer-Encoding: 8bit | ||
8 | |||
9 | Acked-by: Alex Bennée <alex.bennee@linaro.org> | ||
10 | Suggested-by: Alex Bennée <alex.bennee@linaro.org> | ||
11 | Signed-off-by: Richard Henderson <richard.henderson@linaro.org> | ||
12 | |||
13 | Upstream-Status: Backport [https://gitlab.com/qemu-project/qemu/-/commit/86e4f93d827d3c1efd00cd8a906e38a2c0f2b5bc] | ||
14 | --- | ||
15 | softmmu/physmem.c | 10 ++++++++-- | ||
16 | 1 file changed, 8 insertions(+), 2 deletions(-) | ||
17 | |||
18 | diff --git a/softmmu/physmem.c b/softmmu/physmem.c | ||
19 | index 3df73542e1..7597dc1c39 100644 | ||
20 | --- a/softmmu/physmem.c | ||
21 | +++ b/softmmu/physmem.c | ||
22 | @@ -2413,9 +2413,15 @@ MemoryRegionSection *iotlb_to_section(CPUState *cpu, | ||
23 | int asidx = cpu_asidx_from_attrs(cpu, attrs); | ||
24 | CPUAddressSpace *cpuas = &cpu->cpu_ases[asidx]; | ||
25 | AddressSpaceDispatch *d = qatomic_rcu_read(&cpuas->memory_dispatch); | ||
26 | - MemoryRegionSection *sections = d->map.sections; | ||
27 | + int section_index = index & ~TARGET_PAGE_MASK; | ||
28 | + MemoryRegionSection *ret; | ||
29 | + | ||
30 | + assert(section_index < d->map.sections_nb); | ||
31 | + ret = d->map.sections + section_index; | ||
32 | + assert(ret->mr); | ||
33 | + assert(ret->mr->ops); | ||
34 | |||
35 | - return §ions[index & ~TARGET_PAGE_MASK]; | ||
36 | + return ret; | ||
37 | } | ||
38 | |||
39 | static void io_mem_init(void) | ||
40 | -- | ||
41 | 2.34.1 | ||
42 | |||
diff --git a/meta/recipes-devtools/qemu/qemu/0001-softmmu-Use-async_run_on_cpu-in-tcg_commit.patch b/meta/recipes-devtools/qemu/qemu/0001-softmmu-Use-async_run_on_cpu-in-tcg_commit.patch deleted file mode 100644 index 8289b45991..0000000000 --- a/meta/recipes-devtools/qemu/qemu/0001-softmmu-Use-async_run_on_cpu-in-tcg_commit.patch +++ /dev/null | |||
@@ -1,157 +0,0 @@ | |||
1 | From 0d58c660689f6da1e3feff8a997014003d928b3b Mon Sep 17 00:00:00 2001 | ||
2 | From: Richard Henderson <richard.henderson@linaro.org> | ||
3 | Date: Fri, 25 Aug 2023 16:13:17 -0700 | ||
4 | Subject: [PATCH] softmmu: Use async_run_on_cpu in tcg_commit | ||
5 | MIME-Version: 1.0 | ||
6 | Content-Type: text/plain; charset=UTF-8 | ||
7 | Content-Transfer-Encoding: 8bit | ||
8 | |||
9 | After system startup, run the update to memory_dispatch | ||
10 | and the tlb_flush on the cpu. This eliminates a race, | ||
11 | wherein a running cpu sees the memory_dispatch change | ||
12 | but has not yet seen the tlb_flush. | ||
13 | |||
14 | Since the update now happens on the cpu, we need not use | ||
15 | qatomic_rcu_read to protect the read of memory_dispatch. | ||
16 | |||
17 | Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1826 | ||
18 | Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1834 | ||
19 | Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1846 | ||
20 | Tested-by: Alex Bennée <alex.bennee@linaro.org> | ||
21 | Reviewed-by: Alex Bennée <alex.bennee@linaro.org> | ||
22 | Signed-off-by: Richard Henderson <richard.henderson@linaro.org> | ||
23 | |||
24 | Upstream-Status: Backport [0d58c660689f6da1e3feff8a997014003d928b3b] | ||
25 | --- | ||
26 | accel/tcg/cpu-exec-common.c | 30 ---------------------------- | ||
27 | include/exec/cpu-common.h | 1 - | ||
28 | softmmu/physmem.c | 40 +++++++++++++++++++++++++++---------- | ||
29 | 3 files changed, 29 insertions(+), 42 deletions(-) | ||
30 | |||
31 | Index: qemu-8.1.0/accel/tcg/cpu-exec-common.c | ||
32 | =================================================================== | ||
33 | --- qemu-8.1.0.orig/accel/tcg/cpu-exec-common.c | ||
34 | +++ qemu-8.1.0/accel/tcg/cpu-exec-common.c | ||
35 | @@ -33,36 +33,6 @@ void cpu_loop_exit_noexc(CPUState *cpu) | ||
36 | cpu_loop_exit(cpu); | ||
37 | } | ||
38 | |||
39 | -#if defined(CONFIG_SOFTMMU) | ||
40 | -void cpu_reloading_memory_map(void) | ||
41 | -{ | ||
42 | - if (qemu_in_vcpu_thread() && current_cpu->running) { | ||
43 | - /* The guest can in theory prolong the RCU critical section as long | ||
44 | - * as it feels like. The major problem with this is that because it | ||
45 | - * can do multiple reconfigurations of the memory map within the | ||
46 | - * critical section, we could potentially accumulate an unbounded | ||
47 | - * collection of memory data structures awaiting reclamation. | ||
48 | - * | ||
49 | - * Because the only thing we're currently protecting with RCU is the | ||
50 | - * memory data structures, it's sufficient to break the critical section | ||
51 | - * in this callback, which we know will get called every time the | ||
52 | - * memory map is rearranged. | ||
53 | - * | ||
54 | - * (If we add anything else in the system that uses RCU to protect | ||
55 | - * its data structures, we will need to implement some other mechanism | ||
56 | - * to force TCG CPUs to exit the critical section, at which point this | ||
57 | - * part of this callback might become unnecessary.) | ||
58 | - * | ||
59 | - * This pair matches cpu_exec's rcu_read_lock()/rcu_read_unlock(), which | ||
60 | - * only protects cpu->as->dispatch. Since we know our caller is about | ||
61 | - * to reload it, it's safe to split the critical section. | ||
62 | - */ | ||
63 | - rcu_read_unlock(); | ||
64 | - rcu_read_lock(); | ||
65 | - } | ||
66 | -} | ||
67 | -#endif | ||
68 | - | ||
69 | void cpu_loop_exit(CPUState *cpu) | ||
70 | { | ||
71 | /* Undo the setting in cpu_tb_exec. */ | ||
72 | Index: qemu-8.1.0/include/exec/cpu-common.h | ||
73 | =================================================================== | ||
74 | --- qemu-8.1.0.orig/include/exec/cpu-common.h | ||
75 | +++ qemu-8.1.0/include/exec/cpu-common.h | ||
76 | @@ -133,7 +133,6 @@ static inline void cpu_physical_memory_w | ||
77 | { | ||
78 | cpu_physical_memory_rw(addr, (void *)buf, len, true); | ||
79 | } | ||
80 | -void cpu_reloading_memory_map(void); | ||
81 | void *cpu_physical_memory_map(hwaddr addr, | ||
82 | hwaddr *plen, | ||
83 | bool is_write); | ||
84 | Index: qemu-8.1.0/softmmu/physmem.c | ||
85 | =================================================================== | ||
86 | --- qemu-8.1.0.orig/softmmu/physmem.c | ||
87 | +++ qemu-8.1.0/softmmu/physmem.c | ||
88 | @@ -680,8 +680,7 @@ address_space_translate_for_iotlb(CPUSta | ||
89 | IOMMUTLBEntry iotlb; | ||
90 | int iommu_idx; | ||
91 | hwaddr addr = orig_addr; | ||
92 | - AddressSpaceDispatch *d = | ||
93 | - qatomic_rcu_read(&cpu->cpu_ases[asidx].memory_dispatch); | ||
94 | + AddressSpaceDispatch *d = cpu->cpu_ases[asidx].memory_dispatch; | ||
95 | |||
96 | for (;;) { | ||
97 | section = address_space_translate_internal(d, addr, &addr, plen, false); | ||
98 | @@ -2412,7 +2411,7 @@ MemoryRegionSection *iotlb_to_section(CP | ||
99 | { | ||
100 | int asidx = cpu_asidx_from_attrs(cpu, attrs); | ||
101 | CPUAddressSpace *cpuas = &cpu->cpu_ases[asidx]; | ||
102 | - AddressSpaceDispatch *d = qatomic_rcu_read(&cpuas->memory_dispatch); | ||
103 | + AddressSpaceDispatch *d = cpuas->memory_dispatch; | ||
104 | int section_index = index & ~TARGET_PAGE_MASK; | ||
105 | MemoryRegionSection *ret; | ||
106 | |||
107 | @@ -2487,23 +2486,42 @@ static void tcg_log_global_after_sync(Me | ||
108 | } | ||
109 | } | ||
110 | |||
111 | +static void tcg_commit_cpu(CPUState *cpu, run_on_cpu_data data) | ||
112 | +{ | ||
113 | + CPUAddressSpace *cpuas = data.host_ptr; | ||
114 | + | ||
115 | + cpuas->memory_dispatch = address_space_to_dispatch(cpuas->as); | ||
116 | + tlb_flush(cpu); | ||
117 | +} | ||
118 | + | ||
119 | static void tcg_commit(MemoryListener *listener) | ||
120 | { | ||
121 | CPUAddressSpace *cpuas; | ||
122 | - AddressSpaceDispatch *d; | ||
123 | + CPUState *cpu; | ||
124 | |||
125 | assert(tcg_enabled()); | ||
126 | /* since each CPU stores ram addresses in its TLB cache, we must | ||
127 | reset the modified entries */ | ||
128 | cpuas = container_of(listener, CPUAddressSpace, tcg_as_listener); | ||
129 | - cpu_reloading_memory_map(); | ||
130 | - /* The CPU and TLB are protected by the iothread lock. | ||
131 | - * We reload the dispatch pointer now because cpu_reloading_memory_map() | ||
132 | - * may have split the RCU critical section. | ||
133 | + cpu = cpuas->cpu; | ||
134 | + | ||
135 | + /* | ||
136 | + * Defer changes to as->memory_dispatch until the cpu is quiescent. | ||
137 | + * Otherwise we race between (1) other cpu threads and (2) ongoing | ||
138 | + * i/o for the current cpu thread, with data cached by mmu_lookup(). | ||
139 | + * | ||
140 | + * In addition, queueing the work function will kick the cpu back to | ||
141 | + * the main loop, which will end the RCU critical section and reclaim | ||
142 | + * the memory data structures. | ||
143 | + * | ||
144 | + * That said, the listener is also called during realize, before | ||
145 | + * all of the tcg machinery for run-on is initialized: thus halt_cond. | ||
146 | */ | ||
147 | - d = address_space_to_dispatch(cpuas->as); | ||
148 | - qatomic_rcu_set(&cpuas->memory_dispatch, d); | ||
149 | - tlb_flush(cpuas->cpu); | ||
150 | + if (cpu->halt_cond) { | ||
151 | + async_run_on_cpu(cpu, tcg_commit_cpu, RUN_ON_CPU_HOST_PTR(cpuas)); | ||
152 | + } else { | ||
153 | + tcg_commit_cpu(cpu, RUN_ON_CPU_HOST_PTR(cpuas)); | ||
154 | + } | ||
155 | } | ||
156 | |||
157 | static void memory_map_init(void) | ||
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2023-42467.patch b/meta/recipes-devtools/qemu/qemu/CVE-2023-42467.patch deleted file mode 100644 index 86ab7cf81a..0000000000 --- a/meta/recipes-devtools/qemu/qemu/CVE-2023-42467.patch +++ /dev/null | |||
@@ -1,49 +0,0 @@ | |||
1 | From 7cfcc79b0ab800959716738aff9419f53fc68c9c Mon Sep 17 00:00:00 2001 | ||
2 | From: Thomas Huth <thuth@redhat.com> | ||
3 | Date: Thu, 5 Oct 2023 06:01:10 +0000 | ||
4 | Subject: [PATCH] hw/scsi/scsi-disk: Disallow block sizes smaller than 512 | ||
5 | [CVE-2023-42467] | ||
6 | |||
7 | We are doing things like | ||
8 | |||
9 | nb_sectors /= (s->qdev.blocksize / BDRV_SECTOR_SIZE); | ||
10 | |||
11 | in the code here (e.g. in scsi_disk_emulate_mode_sense()), so if | ||
12 | the blocksize is smaller than BDRV_SECTOR_SIZE (=512), this crashes | ||
13 | with a division by 0 exception. Thus disallow block sizes of 256 | ||
14 | bytes to avoid this situation. | ||
15 | |||
16 | Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1813 | ||
17 | CVE: 2023-42467 | ||
18 | Signed-off-by: Thomas Huth <thuth@redhat.com> | ||
19 | Message-ID: <20230925091854.49198-1-thuth@redhat.com> | ||
20 | Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> | ||
21 | |||
22 | CVE: CVE-2023-42467 | ||
23 | |||
24 | Upstream-Status: Backport [https://gitlab.com/qemu-project/qemu/-/commit/7cfcc79b0ab800959716738aff9419f53fc68c9c] | ||
25 | |||
26 | Signed-off-by: Yogita Urade <yogita.urade@windriver.com> | ||
27 | --- | ||
28 | hw/scsi/scsi-disk.c | 5 +++-- | ||
29 | 1 file changed, 3 insertions(+), 2 deletions(-) | ||
30 | |||
31 | diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c | ||
32 | index e0d79c796..477ee2bcd 100644 | ||
33 | --- a/hw/scsi/scsi-disk.c | ||
34 | +++ b/hw/scsi/scsi-disk.c | ||
35 | @@ -1628,9 +1628,10 @@ static void scsi_disk_emulate_mode_select(SCSIDiskReq *r, uint8_t *inbuf) | ||
36 | * Since the existing code only checks/updates bits 8-15 of the block | ||
37 | * size, restrict ourselves to the same requirement for now to ensure | ||
38 | * that a block size set by a block descriptor and then read back by | ||
39 | - * a subsequent SCSI command will be the same | ||
40 | + * a subsequent SCSI command will be the same. Also disallow a block | ||
41 | + * size of 256 since we cannot handle anything below BDRV_SECTOR_SIZE. | ||
42 | */ | ||
43 | - if (bs && !(bs & ~0xff00) && bs != s->qdev.blocksize) { | ||
44 | + if (bs && !(bs & ~0xfe00) && bs != s->qdev.blocksize) { | ||
45 | s->qdev.blocksize = bs; | ||
46 | trace_scsi_disk_mode_select_set_blocksize(s->qdev.blocksize); | ||
47 | } | ||
48 | -- | ||
49 | 2.40.0 | ||
diff --git a/meta/recipes-devtools/qemu/qemu_8.1.0.bb b/meta/recipes-devtools/qemu/qemu_8.1.2.bb index 84ee0bcc49..84ee0bcc49 100644 --- a/meta/recipes-devtools/qemu/qemu_8.1.0.bb +++ b/meta/recipes-devtools/qemu/qemu_8.1.2.bb | |||