rpm/qemu
SHA256
1
0
Fork 0
forked from pool/qemu
Code Pull Requests Activity
5f7cc8fe5e
qemu/hw-usb-hcd-ehci-fix-writeback-order.patch
Dario Faggioli 5f7cc8fe5e Accepting request 990667 from home:dfaggioli:old_qemu 
- Substantial rework of the spec file: 
  * the 'make check' testsuite now runs in the %check section of
    the main package, not in a subpackage
  * switched from %setup to %autosetup
  * rearranged the content in order to minimize the use of %if,
    %ifarch, etc
- Properly fix bsc#1198038, CVE-2022-0216
* Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch
  tests-qtest-Move-the-fuzz-tests-to-x86-o.patch
- Make temp dir (for update_git.sh) configurable
- Added new subpackages (audio-dbus, ui-dbus)
- bsc#1199018 was never fixed in Factory's QEMU 6.2. It is
  now (since the patches are already in SeaBIOS 1.16.0)
- Some tests are having issues when run in OBS. They seem to be
  due to race conditions, triggered by resource constraints of
  OBS workers. Let's disable them for now, while looking for a fix
- Update to v7.0.0. For full release notese, see:
  * https://wiki.qemu.org/ChangeLog/7.0
  Be sure to also check the following pages:
  * https://qemu-project.gitlab.io/qemu/about/removed-features.html
  * https://qemu-project.gitlab.io/qemu/about/deprecated.html
  Some notable changes:
  * [ARM] The virt board has gained a new control knob to disable passing a RNG seed in the DTB (dtb-kaslr-seed)
  * [ARM] The AST2600 SoC now supports a dummy version of the i3c device
  * [ARM] The virt board can now run guests with KVM on hosts with restricted IPA ranges
  * [ARM] The virt board now supports virtio-mem-pci
  * [ARM] The virt board now supports specifying the guest CPU topology
  * [ARM] On the virt board, we now enable PAuth when using KVM or hvf and the host CPU supports it
  * [RISC-V] Add support for ratified 1.0 Vector extension
  * [RISC-V] Support for the Zve64f and Zve32f extensions
  * [RISC-V] Drop support for draft 0.7.1 Vector extension
  * [RISC-V] Support Zfhmin and Zfh extensions
  * [RISC-V] RISC-V KVM support
  * [RISC-V] Mark Hypervisor extension as non experimental
  * [RISC-V] Enable Hypervisor extension by default
  * [x86] Support for Intel AMX.
  * [PCI/PCIe] Q35: fix PCIe device becoming disabled after migration when ACPI based PCI hotplug is used (6b0969f1ec)
  * [PCI/PCIe] initial bits of SR/IOV support (250346169)
  * [PCI/PCIe] arm/virt: fixed PXB interrupt routing (e609301b45)
  * [PCI/PCIe] arm/virt: support for virtio-mem-pci (b1b87327a9)
  * [virtiofs] Fix for CVE-2022-0358 - behaviour with supplementary groups and SGID directories
  * [virtiofs] Improved security label support
  * [virtiofs] The virtiofsd in qemu is now starting to be deprecated; please start using and contributing to Rust virtiofsd
* Patches dropped:
  acpi-validate-hotplug-selector-on-access.patch
  block-backend-Retain-permissions-after-m.patch
  block-qdict-Fix-Werror-maybe-uninitializ.patch
  brotli-fix-actual-variable-array-paramet.patch
  display-qxl-render-fix-race-condition-in.patch
  doc-Add-the-SGX-numa-description.patch
  hw-i386-amd_iommu-Fix-maybe-uninitialize.patch
  hw-intc-exynos4210_gic-provide-more-room.patch
  hw-nvme-fix-CVE-2021-3929.patch
  hw-nvram-at24-return-0xff-if-1-byte-addr.patch
  iotest-065-explicit-compression-type.patch
  iotest-214-explicit-compression-type.patch
  iotest-302-use-img_info_log-helper.patch
  iotest-303-explicit-compression-type.patch
  iotest-39-use-_qcow2_dump_header.patch
  iotests-60-more-accurate-set-dirty-bit-i.patch
  iotests-bash-tests-filter-compression-ty.patch
  iotests-common.rc-introduce-_qcow2_dump_.patch
  iotests-declare-lack-of-support-for-comp.patch
  iotests-drop-qemu_img_verbose-helper.patch
  iotests-massive-use-_qcow2_dump_header.patch
  iotests-MRCE-Write-data-to-source.patch
  iotests.py-filter-out-successful-output-.patch
  iotests.py-img_info_log-rename-imgopts-a.patch
  iotests.py-implement-unsupported_imgopts.patch
  iotests.py-qemu_img-create-support-IMGOP.patch
  iotests.py-rewrite-default-luks-support-.patch
  iotests-specify-some-unsupported_imgopts.patch
  meson-build-all-modules-by-default.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch
  python-aqmp-add-__del__-method-to-legacy.patch
  python-aqmp-add-_session_guard.patch
  python-aqmp-add-SocketAddrT-to-package-r.patch
  python-aqmp-add-socket-bind-step-to-lega.patch
  python-aqmp-add-start_server-and-accept-.patch
  python-aqmp-copy-type-definitions-from-q.patch
  python-aqmp-drop-_bind_hack.patch
  python-aqmp-fix-docstring-typo.patch
  python-aqmp-Fix-negotiation-with-pre-oob.patch
  python-aqmp-fix-race-condition-in-legacy.patch
  Python-aqmp-fix-type-definitions-for-myp.patch
  python-aqmp-handle-asyncio.TimeoutError-.patch
  python-aqmp-refactor-_do_accept-into-two.patch
  python-aqmp-remove-_new_session-and-_est.patch
  python-aqmp-rename-accept-to-start_serve.patch
  python-aqmp-rename-AQMPError-to-QMPError.patch
  python-aqmp-split-_client_connected_cb-o.patch
  python-aqmp-squelch-pylint-warning-for-t.patch
  python-aqmp-stop-the-server-during-disco.patch
  python-introduce-qmp-shell-wrap-convenie.patch
  python-machine-raise-VMLaunchFailure-exc.patch
  python-move-qmp-shell-under-the-AQMP-pac.patch
  python-move-qmp-utilities-to-python-qemu.patch
  python-qmp-switch-qmp-shell-to-AQMP.patch
  python-support-recording-QMP-session-to-.patch
  python-upgrade-mypy-to-0.780.patch
  qcow2-simple-case-support-for-downgradin.patch
  qemu-binfmt-conf.sh-should-use-F-as-shor.patch
  tests-qemu-iotests-040-Skip-TestCommitWi.patch
  tests-qemu-iotests-Fix-051-for-binaries-.patch
  tests-qemu-iotests-testrunner-Quote-case.patch
  tools-virtiofsd-Add-rseq-syscall-to-the-.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch
  vhost-vsock-detach-the-virqueue-element-.patch
  virtiofsd-Drop-membership-of-all-supplem.patch
  virtio-net-fix-map-leaking-on-error-duri.patch
  Disable-some-tests-that-have-problems-in.patch
* Patches added:
  intc-exynos4210_gic-replace-snprintf-wit.patch
  Revert-8dcb404bff6d9147765d7dd3e9c849337.patch
------------------------------------------------------------------
- Fix bsc#1197084
* Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
* Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
* Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch
- backport patches for having coroutine work well when LTO is used
* Patches added:
  coroutine-ucontext-use-QEMU_DEFINE_STATI.patch
  coroutine-use-QEMU_DEFINE_STATIC_CO_TLS.patch
  coroutine-win32-use-QEMU_DEFINE_STATIC_C.patch
- seabios: drop patch that changes python in python2.
  Just go to python3 directly.
* Patches dropped:
  seabios-use-python2-explicitly-as-needed.patch

OBS-URL: https://build.opensuse.org/request/show/990667
OBS-URL: https://build.opensuse.org/package/show/Virtualization/qemu?expand=0&rev=726
2022-07-22 11:50:51 +00:00

61 lines
2.8 KiB
Diff
Raw Blame History

From: Arnout Engelen <arnout@bzzt.net>
Date: Sun, 8 May 2022 17:32:22 +0200
Subject: hw/usb/hcd-ehci: fix writeback order
Git-commit: f471e8b060798f26a7fc339c6152f82f22a7b33d
References: bsc#1192115
The 'active' bit passes control over a qTD between the guest and the
controller: set to 1 by guest to enable execution by the controller,
and the controller sets it to '0' to hand back control to the guest.
ehci_state_writeback write two dwords to main memory using DMA:
the third dword of the qTD (containing dt, total bytes to transfer,
cpage, cerr and status) and the fourth dword of the qTD (containing
the offset).
This commit makes sure the fourth dword is written before the third,
avoiding a race condition where a new offset written into the qTD
by the guest after it observed the status going to go to '0' gets
overwritten by a 'late' DMA writeback of the previous offset.
This race condition could lead to 'cpage out of range (5)' errors,
and reproduced by:
./qemu-system-x86_64 -enable-kvm -bios $SEABIOS/bios.bin -m 4096 -device usb-ehci -blockdev driver=file,read-only=on,filename=/home/aengelen/Downloads/openSUSE-Tumbleweed-DVD-i586-Snapshot20220428-Media.iso,node-name=iso -device usb-storage,drive=iso,bootindex=0 -chardev pipe,id=shell,path=/tmp/pipe -device virtio-serial -device virtconsole,chardev=shell -device virtio-rng-pci -serial mon:stdio -nographic
(press a key, select 'Installation' (2), and accept the default
values. On my machine the 'cpage out of range' is reproduced while
loading the Linux Kernel about once per 7 attempts. With the fix in
this commit it no longer fails)
This problem was previously reported as a seabios problem in
https://mail.coreboot.org/hyperkitty/list/seabios@seabios.org/thread/OUTHT5ISSQJGXPNTUPY3O5E5EPZJCHM3/
and as a nixos CI build failure in
https://github.com/NixOS/nixpkgs/issues/170803
Signed-off-by: Arnout Engelen <arnout@bzzt.net>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Lin Ma <lma@suse.com>
Signed-off-by: Dario Faggioli <dfaggioli@suse.com>
---
hw/usb/hcd-ehci.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index 33a8a377bd9503cf0ac1e6bd97e6..d4da8dcb8d15e3f1dcb8b6cfddf7 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -2011,7 +2011,10 @@ static int ehci_state_writeback(EHCIQueue *q)
ehci_trace_qtd(q, NLPTR_GET(p->qtdaddr), (EHCIqtd *) &q->qh.next_qtd);
qtd = (uint32_t *) &q->qh.next_qtd;
addr = NLPTR_GET(p->qtdaddr);
- put_dwords(q->ehci, addr + 2 * sizeof(uint32_t), qtd + 2, 2);
+ /* First write back the offset */
+ put_dwords(q->ehci, addr + 3 * sizeof(uint32_t), qtd + 3, 1);
+ /* Then write back the token, clearing the 'active' bit */
+ put_dwords(q->ehci, addr + 2 * sizeof(uint32_t), qtd + 2, 1);
ehci_free_packet(p);
/*
View Git Blame Copy Permalink