packages/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

!652 上游社区Patch回合，Bugfix

Browse Source 
From: @omnihorizon 
Reviewed-by: @yezengruan 
Signed-off-by: @yezengruan
This commit is contained in:
openeuler-ci-bot 2022-09-30 09:31:09 +00:00 committed by Gitee
commit c4e55971db
No known key found for this signature in database
GPG Key ID: 173E9B9CA92EEF8F
6 changed files with 326 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

116
exec-memory-Extract-address_space_set-from-dma_memor.patch Normal file
View File

@ -0,0 +1,116 @@
From d9a1de34f34c853dc8596ba64b5d9c5d33c2f0cd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
Date: Sat, 15 Jan 2022 21:37:23 +0100
Subject: [PATCH 1/5] exec/memory: Extract address_space_set() from
dma_memory_set()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
dma_memory_set() does a DMA barrier, set the address space with
a constant value. The constant value filling code is not specific
to DMA and can be used for AddressSpace. Extract it as a new
helper: address_space_set().
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
[lv: rebase]
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Message-Id: <20220115203725.3834712-2-laurent@vivier.eu>
Signed-off-by: zhangxinhao <zhangxinhao1@huawei.com>
---
include/exec/memory.h | 16 ++++++++++++++++
softmmu/dma-helpers.c | 15 +--------------
softmmu/physmem.c | 19 +++++++++++++++++++
3 files changed, 36 insertions(+), 14 deletions(-)
diff --git a/include/exec/memory.h b/include/exec/memory.h
index 3e84d62e40..afa6039a9f 100644
--- a/include/exec/memory.h
+++ b/include/exec/memory.h
@@ -2966,6 +2966,22 @@ address_space_write_cached(MemoryRegionCache *cache, hwaddr addr,
}
}
+/**
+ * address_space_set: Fill address space with a constant byte.
+ *
+ * Return a MemTxResult indicating whether the operation succeeded
+ * or failed (eg unassigned memory, device rejected the transaction,
+ * IOMMU fault).
+ *
+ * @as: #AddressSpace to be accessed
+ * @addr: address within that address space
+ * @c: constant byte to fill the memory
+ * @len: the number of bytes to fill with the constant byte
+ * @attrs: memory transaction attributes
+ */
+MemTxResult address_space_set(AddressSpace *as, hwaddr addr,
+ uint8_t c, hwaddr len, MemTxAttrs attrs);
+
#ifdef NEED_CPU_H
/* enum device_endian to MemOp. */
static inline MemOp devend_memop(enum device_endian end)
diff --git a/softmmu/dma-helpers.c b/softmmu/dma-helpers.c
index b0be156479..c2028b6585 100644
--- a/softmmu/dma-helpers.c
+++ b/softmmu/dma-helpers.c
@@ -23,20 +23,7 @@ MemTxResult dma_memory_set(AddressSpace *as, dma_addr_t addr,
{
dma_barrier(as, DMA_DIRECTION_FROM_DEVICE);
-#define FILLBUF_SIZE 512
- uint8_t fillbuf[FILLBUF_SIZE];
- int l;
- MemTxResult error = MEMTX_OK;
-
- memset(fillbuf, c, FILLBUF_SIZE);
- while (len > 0) {
- l = len < FILLBUF_SIZE ? len : FILLBUF_SIZE;
- error |= address_space_write(as, addr, attrs, fillbuf, l);
- len -= l;
- addr += l;
- }
-
- return error;
+ return address_space_set(as, addr, c, len, attrs);
}
void qemu_sglist_init(QEMUSGList *qsg, DeviceState *dev, int alloc_hint,
diff --git a/softmmu/physmem.c b/softmmu/physmem.c
index be39a49ceb..0e709ae384 100644
--- a/softmmu/physmem.c
+++ b/softmmu/physmem.c
@@ -2983,6 +2983,25 @@ MemTxResult address_space_rw(AddressSpace *as, hwaddr addr, MemTxAttrs attrs,
}
}
+MemTxResult address_space_set(AddressSpace *as, hwaddr addr,
+ uint8_t c, hwaddr len, MemTxAttrs attrs)
+{
+#define FILLBUF_SIZE 512
+ uint8_t fillbuf[FILLBUF_SIZE];
+ int l;
+ MemTxResult error = MEMTX_OK;
+
+ memset(fillbuf, c, FILLBUF_SIZE);
+ while (len > 0) {
+ l = len < FILLBUF_SIZE ? len : FILLBUF_SIZE;
+ error |= address_space_write(as, addr, attrs, fillbuf, l);
+ len -= l;
+ addr += l;
+ }
+
+ return error;
+}
+
void cpu_physical_memory_rw(hwaddr addr, void *buf,
hwaddr len, bool is_write)
{
--
2.27.0

74
hw-elf_ops-clear-uninitialized-segment-space.patch Normal file
View File

@ -0,0 +1,74 @@
From 081ccc809448bec8e2bf144b2d49e64ed01b0e9f Mon Sep 17 00:00:00 2001
From: Laurent Vivier <laurent@vivier.eu>
Date: Sat, 15 Jan 2022 21:37:24 +0100
Subject: [PATCH 2/5] hw/elf_ops: clear uninitialized segment space
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
When the mem_size of the segment is bigger than the file_size,
and if this space doesn't overlap another segment, it needs
to be cleared.
This bug is very similar to the one we had for linux-user,
22d113b52f41 ("linux-user: Fix loading of BSS segments"),
where .bss section is encoded as an extension of the the data
one by setting the segment p_memsz > p_filesz.
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
[PMD: Use recently added address_space_set()]
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220115203725.3834712-3-laurent@vivier.eu>
Signed-off-by: zhangxinhao <zhangxinhao1@huawei.com>
---
hw/core/loader.c | 4 ++++
include/hw/elf_ops.h | 13 +++++++++++++
2 files changed, 17 insertions(+)
diff --git a/hw/core/loader.c b/hw/core/loader.c
index 052a0fd719..19edb928e9 100644
--- a/hw/core/loader.c
+++ b/hw/core/loader.c
@@ -1164,9 +1164,13 @@ static void rom_reset(void *unused)
if (rom->mr) {
void *host = memory_region_get_ram_ptr(rom->mr);
memcpy(host, rom->data, rom->datasize);
+ memset(host + rom->datasize, 0, rom->romsize - rom->datasize);
} else {
address_space_write_rom(rom->as, rom->addr, MEMTXATTRS_UNSPECIFIED,
rom->data, rom->datasize);
+ address_space_set(rom->as, rom->addr + rom->datasize, 0,
+ rom->romsize - rom->datasize,
+ MEMTXATTRS_UNSPECIFIED);
}
if (rom->isrom) {
/* rom needs to be written only once */
diff --git a/include/hw/elf_ops.h b/include/hw/elf_ops.h
index 995de8495c..7c3b1d0f6c 100644
--- a/include/hw/elf_ops.h
+++ b/include/hw/elf_ops.h
@@ -555,6 +555,19 @@ static ssize_t glue(load_elf, SZ)(const char *name, int fd,
if (res != MEMTX_OK) {
goto fail;
}
+ /*
+ * We need to zero'ify the space that is not copied
+ * from file
+ */
+ if (file_size < mem_size) {
+ res = address_space_set(as ? as : &address_space_memory,
+ addr + file_size, 0,
+ mem_size - file_size,
+ MEMTXATTRS_UNSPECIFIED);
+ if (res != MEMTX_OK) {
+ goto fail;
+ }
+ }
}
}
--
2.27.0

14
qemu.spec
View File

@ -1,6 +1,6 @@
Name: qemu
Version: 6.2.0
Release: 50
Release: 51
Epoch: 10
Summary: QEMU is a generic and open source machine emulator and virtualizer
License: GPLv2 and BSD and MIT and CC-BY-SA-4.0
@ -305,6 +305,11 @@ Patch0292: scsi-lsi53c895a-fix-use-after-free-in-lsi_do_msgout-.patch
Patch0293: scsi-lsi53c895a-really-fix-use-after-free-in-lsi_do_.patch
Patch0294: hw-usb-hcd-xhci-Fix-unbounded-loop-in-xhci_ring_chai.patch
Patch0295: net-tulip-Restrict-DMA-engine-to-memories.patch
Patch0296: exec-memory-Extract-address_space_set-from-dma_memor.patch
Patch0297: hw-elf_ops-clear-uninitialized-segment-space.patch
Patch0298: vhost-also-check-queue-state-in-the-vhost_dev_set_lo.patch
Patch0299: vhost-net-fix-improper-cleanup-in-vhost_net_start.patch
Patch0300: virtio-net-setup-vhost_dev-and-notifiers-for-cvq-onl.patch
BuildRequires: flex
BuildRequires: gcc
@ -817,6 +822,13 @@ getent passwd qemu >/dev/null || \
%endif
%changelog
* Fri Sep 30 2022 zhangxinhao <zhangxinhao1@huawei.com> - 10:6.2.0-51
- exec/memory: Extract address_space_set() from dma_memory_set()
- hw/elf_ops: clear uninitialized segment space
- vhost: also check queue state in the vhost_dev_set_log
- vhost-net: fix improper cleanup in vhost_net_start
- virtio-net: setup vhost_dev and notifiers for cvq only
* Fri Sep 30 2022 zhangbo <oscar.zhangbo@huawei.com> - 10:6.2.0-50
- net: tulip: Restrict DMA engine to memories (CVE-2020-14394)

39
vhost-also-check-queue-state-in-the-vhost_dev_set_lo.patch Normal file
View File

@ -0,0 +1,39 @@
From cb16f58f6db98113f9079b27e7e313c91060e6e4 Mon Sep 17 00:00:00 2001
From: Ni Xun <richardni@tencent.com>
Date: Thu, 9 Jun 2022 21:10:12 +0800
Subject: [PATCH 3/5] vhost: also check queue state in the vhost_dev_set_log
error routine
When check queue state in the vhost_dev_set_log routine, it miss the error
routine check, this patch also check queue state in error case.
Fixes: 1e5a050f5798 ("check queue state in the vhost_dev_set_log routine")
Signed-off-by: Ni Xun <richardni@tencent.com>
Reviewed-by: Zhigang Lu <tonnylu@tencent.com>
Message-Id: <OS0PR01MB57139163F3F3955960675B52EAA79@OS0PR01MB5713.jpnprd01.prod.outlook.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: zhangxinhao <zhangxinhao1@huawei.com>
---
hw/virtio/vhost.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index 4c4072951c..3ac6cfde03 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -900,6 +900,10 @@ static int vhost_dev_set_log(struct vhost_dev *dev, bool enable_log)
err_vq:
for (; i >= 0; --i) {
idx = dev->vhost_ops->vhost_get_vq_index(dev, dev->vq_index + i);
+ addr = virtio_queue_get_desc_addr(dev->vdev, idx);
+ if (!addr) {
+ continue;
+ }
vhost_virtqueue_set_addr(dev, dev->vqs + i, idx,
dev->log_enabled);
}
--
2.27.0

44
vhost-net-fix-improper-cleanup-in-vhost_net_start.patch Normal file
View File

@ -0,0 +1,44 @@
From 4670dbaa57d7f034c2b5720d2a4c141a82f73025 Mon Sep 17 00:00:00 2001
From: Si-Wei Liu <si-wei.liu@oracle.com>
Date: Fri, 6 May 2022 19:28:15 -0700
Subject: [PATCH 4/5] vhost-net: fix improper cleanup in vhost_net_start
vhost_net_start() missed a corresponding stop_one() upon error from
vhost_set_vring_enable(). While at it, make the error handling for
err_start more robust. No real issue was found due to this though.
Signed-off-by: Si-Wei Liu <si-wei.liu@oracle.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Message-Id: <1651890498-24478-5-git-send-email-si-wei.liu@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: zhangxinhao <zhangxinhao1@huawei.com>
---
hw/net/vhost_net.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/hw/net/vhost_net.c b/hw/net/vhost_net.c
index e8a79db94d..1911ffd7ed 100644
--- a/hw/net/vhost_net.c
+++ b/hw/net/vhost_net.c
@@ -439,6 +439,7 @@ int vhost_net_start(VirtIODevice *dev, NetClientState *ncs,
r = vhost_set_vring_enable(peer, peer->vring_enable);
if (r < 0) {
+ vhost_net_stop_one(get_vhost_net(peer), dev);
goto err_start;
}
}
@@ -448,7 +449,8 @@ int vhost_net_start(VirtIODevice *dev, NetClientState *ncs,
err_start:
while (--i >= 0) {
- peer = qemu_get_peer(ncs , i);
+ peer = qemu_get_peer(ncs, i < data_queue_pairs ?
+ i : n->max_queue_pairs);
vhost_net_stop_one(get_vhost_net(peer), dev);
}
e = k->set_guest_notifiers(qbus->parent, total_notifiers, false);
--
2.27.0

40
virtio-net-setup-vhost_dev-and-notifiers-for-cvq-onl.patch Normal file
View File

@ -0,0 +1,40 @@
From 89409c7268be2feb85d33af1f3571c0cb62298fb Mon Sep 17 00:00:00 2001
From: Si-Wei Liu <si-wei.liu@oracle.com>
Date: Fri, 6 May 2022 19:28:12 -0700
Subject: [PATCH 5/5] virtio-net: setup vhost_dev and notifiers for cvq only
when feature is negotiated
When the control virtqueue feature is absent or not negotiated,
vhost_net_start() still tries to set up vhost_dev and install
vhost notifiers for the control virtqueue, which results in
erroneous ioctl calls with incorrect queue index sending down
to driver. Do that only when needed.
Fixes: 22288fe ("virtio-net: vhost control virtqueue support")
Signed-off-by: Si-Wei Liu <si-wei.liu@oracle.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Message-Id: <1651890498-24478-2-git-send-email-si-wei.liu@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: zhangxinhao <zhangxinhao1@huawei.com>
---
hw/net/virtio-net.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index d33da9b7ef..918a7aba89 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -243,7 +243,8 @@ static void virtio_net_vhost_status(VirtIONet *n, uint8_t status)
VirtIODevice *vdev = VIRTIO_DEVICE(n);
NetClientState *nc = qemu_get_queue(n->nic);
int queue_pairs = n->multiqueue ? n->max_queue_pairs : 1;
- int cvq = n->max_ncs - n->max_queue_pairs;
+ int cvq = virtio_vdev_has_feature(vdev, VIRTIO_NET_F_CTRL_VQ) ?
+ n->max_ncs - n->max_queue_pairs : 0;
if (!get_vhost_net(nc->peer)) {
return;
--
2.27.0