summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools/qemu
diff options
context:
space:
mode:
Diffstat (limited to 'meta/recipes-devtools/qemu')
-rw-r--r--meta/recipes-devtools/qemu/qemu.inc2
-rw-r--r--meta/recipes-devtools/qemu/qemu/0001-pci-assign-sync-MSI-MSI-X-cap-and-table-with-PCIDevi.patch71
-rw-r--r--meta/recipes-devtools/qemu/qemu/0001-virtio-zero-vq-inuse-in-virtio_reset.patch57
-rw-r--r--meta/recipes-devtools/qemu/qemu/0002-fix-CVE-2016-7423.patch45
-rw-r--r--meta/recipes-devtools/qemu/qemu_2.7.1.bb (renamed from meta/recipes-devtools/qemu/qemu_2.7.0.bb)10
5 files changed, 4 insertions, 181 deletions
diff --git a/meta/recipes-devtools/qemu/qemu.inc b/meta/recipes-devtools/qemu/qemu.inc
index b46e7f72e2..ac5fcac83e 100644
--- a/meta/recipes-devtools/qemu/qemu.inc
+++ b/meta/recipes-devtools/qemu/qemu.inc
@@ -9,8 +9,6 @@ require qemu-targets.inc
9inherit autotools ptest 9inherit autotools ptest
10BBCLASSEXTEND = "native nativesdk" 10BBCLASSEXTEND = "native nativesdk"
11 11
12PR = "r1"
13
14# QEMU_TARGETS is overridable variable 12# QEMU_TARGETS is overridable variable
15QEMU_TARGETS ?= "arm aarch64 i386 mips mipsel mips64 mips64el ppc sh4 x86_64" 13QEMU_TARGETS ?= "arm aarch64 i386 mips mipsel mips64 mips64el ppc sh4 x86_64"
16 14
diff --git a/meta/recipes-devtools/qemu/qemu/0001-pci-assign-sync-MSI-MSI-X-cap-and-table-with-PCIDevi.patch b/meta/recipes-devtools/qemu/qemu/0001-pci-assign-sync-MSI-MSI-X-cap-and-table-with-PCIDevi.patch
deleted file mode 100644
index 03472dd0bf..0000000000
--- a/meta/recipes-devtools/qemu/qemu/0001-pci-assign-sync-MSI-MSI-X-cap-and-table-with-PCIDevi.patch
+++ /dev/null
@@ -1,71 +0,0 @@
1From 6baa545df93253fced4fc0d52b14b98447e00473 Mon Sep 17 00:00:00 2001
2From: Peter Xu <peterx@redhat.com>
3Date: Mon, 28 Nov 2016 15:02:44 +0800
4Subject: [PATCH] pci-assign: sync MSI/MSI-X cap and table with PCIDevice
5
6Since commit e1d4fb2d ("kvm-irqchip: x86: add msi route notify fn"),
7kvm_irqchip_add_msi_route() starts to use pci_get_msi_message() to fetch
8MSI info. This requires that we setup MSI related fields in PCIDevice.
9For most devices, that won't be a problem, as long as we are using
10general interfaces like msi_init()/msix_init().
11
12However, for pci-assign devices, MSI/MSI-X is treated differently - PCI
13assign devices are maintaining its own MSI table and cap information in
14AssignedDevice struct. however that's not synced up with PCIDevice's
15fields. That will leads to pci_get_msi_message() failed to find correct
16MSI capability, even with an NULL msix_table.
17
18A quick fix is to sync up the two places: both the capability bits and
19table address for MSI/MSI-X.
20
21Upstream-Status: Backport [https://lists.gnu.org/archive/html/qemu-devel/2016-11/msg04649.html]
22
23Reported-by: Changlimin <address@hidden>
24Tested-by: Changlimin <address@hidden>
25Cc: address@hidden
26Fixes: e1d4fb2d ("kvm-irqchip: x86: add msi route notify fn")
27Signed-off-by: Peter Xu <address@hidden>
28Signed-off-by: He Zhe <zhe.he@windriver.com>
29---
30 hw/i386/kvm/pci-assign.c | 4 ++++
31 1 file changed, 4 insertions(+)
32
33diff --git a/hw/i386/kvm/pci-assign.c b/hw/i386/kvm/pci-assign.c
34index 8238fbc..87dcbdd 100644
35--- a/hw/i386/kvm/pci-assign.c
36+++ b/hw/i386/kvm/pci-assign.c
37@@ -1251,6 +1251,7 @@ static int assigned_device_pci_cap_init(PCIDevice *pci_dev, Error **errp)
38 error_propagate(errp, local_err);
39 return -ENOTSUP;
40 }
41+ dev->dev.cap_present |= QEMU_PCI_CAP_MSI;
42 dev->cap.available |= ASSIGNED_DEVICE_CAP_MSI;
43 /* Only 32-bit/no-mask currently supported */
44 ret = pci_add_capability2(pci_dev, PCI_CAP_ID_MSI, pos, 10,
45@@ -1285,6 +1286,7 @@ static int assigned_device_pci_cap_init(PCIDevice *pci_dev, Error **errp)
46 error_propagate(errp, local_err);
47 return -ENOTSUP;
48 }
49+ dev->dev.cap_present |= QEMU_PCI_CAP_MSIX;
50 dev->cap.available |= ASSIGNED_DEVICE_CAP_MSIX;
51 ret = pci_add_capability2(pci_dev, PCI_CAP_ID_MSIX, pos, 12,
52 &local_err);
53@@ -1648,6 +1650,7 @@ static void assigned_dev_register_msix_mmio(AssignedDevice *dev, Error **errp)
54 dev->msix_table = NULL;
55 return;
56 }
57+ dev->dev.msix_table = (uint8_t *)dev->msix_table;
58
59 assigned_dev_msix_reset(dev);
60
61@@ -1665,6 +1668,7 @@ static void assigned_dev_unregister_msix_mmio(AssignedDevice *dev)
62 error_report("error unmapping msix_table! %s", strerror(errno));
63 }
64 dev->msix_table = NULL;
65+ dev->dev.msix_table = NULL;
66 }
67
68 static const VMStateDescription vmstate_assigned_device = {
69--
702.8.3
71
diff --git a/meta/recipes-devtools/qemu/qemu/0001-virtio-zero-vq-inuse-in-virtio_reset.patch b/meta/recipes-devtools/qemu/qemu/0001-virtio-zero-vq-inuse-in-virtio_reset.patch
deleted file mode 100644
index 86955d0437..0000000000
--- a/meta/recipes-devtools/qemu/qemu/0001-virtio-zero-vq-inuse-in-virtio_reset.patch
+++ /dev/null
@@ -1,57 +0,0 @@
1Upstream-Status: Backport
2
3Supplementary fix of CVE-2016-5403 which is backported from:
4
5http://git.qemu.org/?p=qemu.git;a=commit;h=4b7f91e
6
7Signed-off-by: Kai Kang <kai.kang@windriver.com>
8---
9From 4b7f91ed0270a371e1933efa21ba600b6da23ab9 Mon Sep 17 00:00:00 2001
10From: Stefan Hajnoczi <stefanha@redhat.com>
11Date: Wed, 7 Sep 2016 11:51:25 -0400
12Subject: [PATCH] virtio: zero vq->inuse in virtio_reset()
13
14vq->inuse must be zeroed upon device reset like most other virtqueue
15fields.
16
17In theory, virtio_reset() just needs assert(vq->inuse == 0) since
18devices must clean up in-flight requests during reset (requests cannot
19not be leaked!).
20
21In practice, it is difficult to achieve vq->inuse == 0 across reset
22because balloon, blk, 9p, etc implement various different strategies for
23cleaning up requests. Most devices call g_free(elem) directly without
24telling virtio.c that the VirtQueueElement is cleaned up. Therefore
25vq->inuse is not decremented during reset.
26
27This patch zeroes vq->inuse and trusts that devices are not leaking
28VirtQueueElements across reset.
29
30I will send a follow-up series that refactors request life-cycle across
31all devices and converts vq->inuse = 0 into assert(vq->inuse == 0) but
32this more invasive approach is not appropriate for stable trees.
33
34Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
35Cc: qemu-stable <qemu-stable@nongnu.org>
36Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
37Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
38Reviewed-by: Ladi Prosek <lprosek@redhat.com>
39---
40 hw/virtio/virtio.c | 1 +
41 1 file changed, 1 insertion(+)
42
43diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
44index 74c085c..e8a13a5 100644
45--- a/hw/virtio/virtio.c
46+++ b/hw/virtio/virtio.c
47@@ -822,6 +822,7 @@ void virtio_reset(void *opaque)
48 vdev->vq[i].signalled_used_valid = false;
49 vdev->vq[i].notification = true;
50 vdev->vq[i].vring.num = vdev->vq[i].vring.num_default;
51+ vdev->vq[i].inuse = 0;
52 }
53 }
54
55--
562.9.3
57
diff --git a/meta/recipes-devtools/qemu/qemu/0002-fix-CVE-2016-7423.patch b/meta/recipes-devtools/qemu/qemu/0002-fix-CVE-2016-7423.patch
deleted file mode 100644
index fdf58a3d65..0000000000
--- a/meta/recipes-devtools/qemu/qemu/0002-fix-CVE-2016-7423.patch
+++ /dev/null
@@ -1,45 +0,0 @@
1Upstream-Status: Backport
2
3Backport patch to fix CVE-2016-7423 from:
4
5http://git.qemu.org/?p=qemu.git;a=commit;h=670e56d3ed
6
7CVE: CVE-2016-7423
8
9Signed-off-by: Kai Kang <kai.kang@windriver.com>
10---
11From 670e56d3ed2918b3861d9216f2c0540d9e9ae0d5 Mon Sep 17 00:00:00 2001
12From: Li Qiang <liqiang6-s@360.cn>
13Date: Mon, 12 Sep 2016 18:14:11 +0530
14Subject: [PATCH] scsi: mptsas: use g_new0 to allocate MPTSASRequest object
15
16When processing IO request in mptsas, it uses g_new to allocate
17a 'req' object. If an error occurs before 'req->sreq' is
18allocated, It could lead to an OOB write in mptsas_free_request
19function. Use g_new0 to avoid it.
20
21Reported-by: Li Qiang <liqiang6-s@360.cn>
22Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
23Message-Id: <1473684251-17476-1-git-send-email-ppandit@redhat.com>
24Cc: qemu-stable@nongnu.org
25Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
26---
27 hw/scsi/mptsas.c | 2 +-
28 1 file changed, 1 insertion(+), 1 deletion(-)
29
30diff --git a/hw/scsi/mptsas.c b/hw/scsi/mptsas.c
31index 0e0a22f..eaae1bb 100644
32--- a/hw/scsi/mptsas.c
33+++ b/hw/scsi/mptsas.c
34@@ -304,7 +304,7 @@ static int mptsas_process_scsi_io_request(MPTSASState *s,
35 goto bad;
36 }
37
38- req = g_new(MPTSASRequest, 1);
39+ req = g_new0(MPTSASRequest, 1);
40 QTAILQ_INSERT_TAIL(&s->pending, req, next);
41 req->scsi_io = *scsi_io;
42 req->dev = s;
43--
442.9.3
45
diff --git a/meta/recipes-devtools/qemu/qemu_2.7.0.bb b/meta/recipes-devtools/qemu/qemu_2.7.1.bb
index 0d680a7eee..8180c5f75a 100644
--- a/meta/recipes-devtools/qemu/qemu_2.7.0.bb
+++ b/meta/recipes-devtools/qemu/qemu_2.7.1.bb
@@ -9,16 +9,14 @@ SRC_URI += "file://configure-fix-Darwin-target-detection.patch \
9 file://no-valgrind.patch \ 9 file://no-valgrind.patch \
10 file://pathlimit.patch \ 10 file://pathlimit.patch \
11 file://qemu-2.5.0-cflags.patch \ 11 file://qemu-2.5.0-cflags.patch \
12 file://0001-virtio-zero-vq-inuse-in-virtio_reset.patch \
13 file://0002-fix-CVE-2016-7423.patch \
14 file://0003-fix-CVE-2016-7908.patch \ 12 file://0003-fix-CVE-2016-7908.patch \
15 file://0004-fix-CVE-2016-7909.patch \ 13 file://0004-fix-CVE-2016-7909.patch \
16 file://0001-pci-assign-sync-MSI-MSI-X-cap-and-table-with-PCIDevi.patch \
17" 14"
18 15
19SRC_URI_prepend = "http://wiki.qemu-project.org/download/${BP}.tar.bz2" 16SRC_URI =+ "http://wiki.qemu-project.org/download/${BP}.tar.bz2"
20SRC_URI[md5sum] = "08d4d06d1cb598efecd796137f4844ab" 17
21SRC_URI[sha256sum] = "326e739506ba690daf69fc17bd3913a6c313d9928d743bd8eddb82f403f81e53" 18SRC_URI[md5sum] = "a315bc51ed443a08d2cf1416d76b9ab4"
19SRC_URI[sha256sum] = "68636788eb69bcb0b44ba220b32b50495d6bd5712a934c282217831c4822958f"
22 20
23COMPATIBLE_HOST_mipsarchn32 = "null" 21COMPATIBLE_HOST_mipsarchn32 = "null"
24COMPATIBLE_HOST_mipsarchn64 = "null" 22COMPATIBLE_HOST_mipsarchn64 = "null"