271 Commits

Author SHA1 Message Date
Jiajie Li
372c6f4847 fix CVE-2020-25085 & CVE-2020-25084
Signed-off-by: Jiajie Li <lijiajie11@huawei.com>
2020-09-18 14:43:13 +08:00
openeuler-ci-bot
cd7a9e26d3 !114 fix slirp/src/ip6_input.c:networking out-of-bounds read information disclosure vulnerability
From: @lijiajie128
Reviewed-by: @yorifang
Signed-off-by: @yorifang
2020-09-11 14:12:05 +08:00
Jiajie Li
a765ea466d Drop bogus IPv6 messages
Drop IPv6 message shorter than what's mentioned in the payload
  length header (+ the size of the IPv6 header). They're invalid and could
  lead to data leakage in icmp6_send_echoreply().
2020-09-11 11:38:56 +08:00
openeuler-ci-bot
486f9ba588 !93 target/arm: ignore evtstrm and cpuid CPU features
Merge pull request !93 from PengLiang/master
2020-09-09 11:37:40 +08:00
Peng Liang
6cc24b9880 target/arm: ignore evtstrm and cpuid CPU features
evtstrm and cpuid cann't be controlled by VMM:
1. evtstrm: The generic timer is configured to generate events at a
   frequency of approximately 100KHz.  It's controlled by the linux
   kernel config CONFIG_ARM_ARCH_TIMER_EVTSTREAM.
2. cpuid: EL0 access to certain ID registers is available.  It's always
   set by linux kernel after 77c97b4ee2129 ("arm64: cpufeature: Expose
   CPUID registers by emulation").
However, they are exposed by getauxval() and /proc/cpuinfo.  Hence,
let's report and ignore the CPU features if someone set them.

Signed-off-by: Peng Liang <liangpeng10@huawei.com>
2020-09-08 23:27:33 +08:00
openeuler-ci-bot
c30ab88d28 !85 fix hw/usb/core.c fix buffer overflow in do_token_setup() function
Merge pull request !85 from lijiajie128/fix-usb
2020-08-26 15:30:53 +08:00
lijiajie128
27947f2b8c Merge branch 'master' of gitee.com:src-openeuler/qemu into fix-usb 2020-08-26 09:30:12 +08:00
openeuler-ci-bot
265c03cadc !84 [feature] Support disable/enable CPU features for AArch64
Merge pull request !84 from PengLiang/master
2020-08-24 20:07:19 +08:00
lijiajie
6665dac3a5 update qemu.spec with Release num Increace one 2020-08-24 16:34:15 +08:00
lijiajie
b9478104d1 update qemu.spec with hw-usb-core-fixe-buffer-overflow.patch 2020-08-21 10:46:04 +08:00
Jiajie Li
0a067ff27f hw/usb: Fix buffer overflow in do_token_setup
Store calculated setup_len in a local variable, verify it, and only
write it to the struct (USBDevice->setup_len) in case it passed the
sanity checks.

This prevent other code (do_token_{in,out} functions specifically)
from working with invalid USBDevice->setup_len values and overruning
the USBDevice->setup_buf[] buffer.
Fixes: CVE-2020-14364
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-08-21 10:38:05 +08:00
Peng Liang
29b03965de Support disable/enable CPU features for AArch64
QEMU does not support disable/enable CPU features in AArch64 for now.
This patch series add support for CPU features in AArch64.

Firstly, we change the isar struct in ARMCPU to an array for
convenience.  Secondly, we add support to configure CPU feautres in
AArch64 and make sure that the ID registers can be synchronized to KVM
so that guest can read the value we configure.  Thirdly, we add a
mechanism to solve the dependency relationship of some CPU features.
Last, we add a KVM_CAP_ARM_CPU_FEATURE to check whether KVM supports to
set CPU features in AArch64.

Also export CPU features to the result of qmp query-cpu-model-expansion
so that libvirt can get the supported CPU features.

Update the ID fields to ARMv8.6 and add some CPU features according to
the new ID fields.

With related KVM patch set[1], we can disable/enable CPU features in
AArch64.

[1] https://patchwork.kernel.org/cover/11711693/

Signed-off-by: Peng Liang <liangpeng10@huawei.com>
2020-08-19 12:44:30 +08:00
Peng Liang
0c39e725b0 target/arm: backport upstream patches to support CPU feature
To support CPU feature in AArch64, we need to move some field from
ARMCPU to ARMISARegisters, add more definitions of ID fields, and add
suport query-cpu-model-expansion qmp command.  Let's backport upstream
patches to do these.

Signed-off-by: Peng Liang <liangpeng10@huawei.com>
2020-08-19 12:36:09 +08:00
openeuler-ci-bot
c112ba0442 !78 build smt processor structure to support smt topology
Merge pull request !78 from fanhenglong/master
2020-08-19 08:48:19 +08:00
Henglong Fan
b391c6d2f4 build smt processor structure to support smt topology
if vcpu support smt, create new smt hierarchy according to
Processor Properties Topology Table(PPTT) in acpi spec 6.3.
Threads sharing a core must be grouped under a unique Processor
hierarchy node structure for each group of threads

Signed-off-by: Henglong Fan <fanhenglong@huawei.com>
2020-08-18 22:00:58 +08:00
openeuler-ci-bot
d95a35c2e0 !77 Aarch64 support vtpm
Merge pull request !77 from JackJF/master
2020-08-17 18:30:49 +08:00
jiangfangjie
54e09b7986 aarch64 support vtpm
Signed-off-by: jiangfangjie <jiangfangjie@huawei.com>
2020-08-13 13:11:02 -04:00
openeuler-ci-bot
4b2cfa2a18 !73 hw/arm/acpi: enable SHPC native hot plug
Merge pull request !73 from 金泽宇/master
2020-08-13 09:35:24 +08:00
Zeyu Jin
6b320d5441 hw/arm/acpi: enable SHPC native hot plug
backport from upstream:
https://git.qemu.org/?p=qemu.git;a=commit;h=e04c13cdcf5befd9d08df38d4d34494a802cdf63

Signed-off-by: Zeyu Jin <jinzeyu@huawei.com>
2020-08-12 14:10:17 +08:00
openeuler-ci-bot
28beefab32 !64 [bugfix] pick several patches from upstream that fix CVE
Merge pull request !64 from zhanghailiang/master
2020-08-06 19:59:17 +08:00
zhanghailiang
bac79dd0c6 qemu: pick serveral patches from upstream that fix CVE
Fix CVE-2020-13361, CVE-2020-13659, CVE-2020-13800, CVE-2020-13362

Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
2020-08-06 17:17:08 +08:00
openeuler-ci-bot
213ba4bb5a !62 Enable werror for qemu and fix a building warning
Merge pull request !62 from FangYing/master
2020-08-06 14:51:01 +08:00
Ying Fang
88bcb3346d spec: Update release version
increase release version by one

Signed-off-by: Ying Fang <fangying1@huawei.com>
2020-08-06 14:23:58 +08:00
Ying Fang
a138fa6057 spec: enable Werror by default
enable Werror by default so that we can check compilation warnnings

Signed-off-by: Ying Fang <fangying1@huawei.com>
2020-08-06 14:23:22 +08:00
Ying Fang
dc93470dc0 migration: add missing ram.h for migration/socket.c
ram.h is missing for migration/socket.c, let's add it.
Later we will enable werror for qemu.spec

Signed-off-by: Ying Fang <fangying1@huawei.com>
2020-08-06 11:13:53 +08:00
Ying Fang
d5b31b6bcb tests: Disalbe filemonitor testcase
Since filemonitor testcase requires that host kernel being a LTS version,
we cannot guarantee that on OBS system. Let's disable it by default.

Signed-off-by: Ying Fang <fangying1@huawei.com>
2020-08-06 11:13:53 +08:00
openeuler-ci-bot
5580ce5ce2 !58 增加qemu.spec rbd支持
Merge pull request !58 from 金泽宇/master
2020-07-24 16:24:52 +08:00
Zeyu Jin
f725fc129f spec: increase build-requirement of rbd-devel
Rbd support is default in qemu configure, so we should also add rbd support in qemu.spec .

Signed-off-by: jinzeyu <jinzeyu@huawei.com>
2020-07-23 20:25:38 +08:00
openeuler-ci-bot
e6d072043a !55 [bugfix] fix two patches format and one CVE bug
Merge pull request !55 from zhanghailiang/master
2020-06-20 17:12:23 +08:00
zhanghailiang
6855f47eb2 spec: increase release number
Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
2020-06-20 15:39:31 +08:00
zhanghailiang
f261f58550 target/arm: Fix PAuth sbox functions
Fix CVE-2020-10702 bug

Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
2020-06-20 15:37:11 +08:00
zhanghailiang
a5d2ec2d8e patch: fix patch format problem which can lead git am failed
Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
2020-06-20 15:25:58 +08:00
openeuler-ci-bot
a4372444dd !54 rebase openEuler-20.03-LTS branch to master
Merge pull request !54 from FangYing/master
2020-06-05 10:46:19 +08:00
Ying Fang
8d6b291d5c spec: Update release version
increase release version by one

Signed-off-by: Ying Fang <fangying1@huawei.com>
2020-06-01 09:13:39 +00:00
Ying Fang
c588c37f4f target/arm: Add the kvm_adjvtime vcpu property for Cortex-A72
Add the kvm_adjvtime vcpu property for ARM Cortex-A72 cpu model,
so that virtual time adjust will be enabled for it.

Signed-off-by: Ying Fang <fangying1@huawei.com>
2020-06-01 09:13:39 +00:00
Ying Fang
24dd460ad6 Revert "target/arm: add ths missing GENERIC_TIMER"
This reverts commit 665d6b61fd86629272885e281410f512f8e7f32e.
2020-06-01 09:13:39 +00:00
zhanghailiang
ad7a2e0d04 target/arm: add ths missing GENERIC_TIMER
Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
2020-06-01 09:13:39 +00:00
Ying Fang
fd193c0aa0 spec: Update release version
increase release verison by one

Signed-off-by: Ying Fang <fangying1@huawei.com>
2020-06-01 09:13:39 +00:00
Ying Fang
6f41ba9021 vtimer: Drop vtimer virtual timer adjust
This patch drops the vtimer virtual timer adjust, cross version migration
from openEuler qemu-4.0.1 to qemu-4.1.0 is not supported as a consequence.

By default openEuler qemu-4.1.0 use kvm_adjvtime as the virtual timer.

Signed-off-by: Ying Fang <fangying1@huawei.com>
2020-06-01 09:13:39 +00:00
Ying Fang
3b892a3933 spec: Update release version
increase release version by one

Signed-off-by: Ying Fang <fanging1@huawei.com>
2020-06-01 09:13:39 +00:00
Ying Fang
d68b43587a migration: Compat virtual timer adjust for v4.0.1 and v4.1.0
Vtimer adjust is used in openEuler qemu-4.0.1, however kvm_adjvtime
is introduced in openEuler qemu-4.1.0. To maintain the compatibility
and enable cross version migration, let's enable vtimer adjust only
if kvm_adjvtime is not enabled, otherwise there may be conflicts
between vtimer adjust and kvm_adjvtime.

After this modification:
1: openEuler qemu-4.0.1 use vtimer as the default virtual timer
2: openEuler qemu-4.1.0 use kvm_adjvtime as the defaut virtual timer

Migration from openEuler qemu-4.0.1 to openEuler qemu-4.1.0 will
be ok, but migration path from upstream qemu-4.0.1 to openEuler
qemu-4..0.1 will be broken.

Since openEuler qemu-4.1.0, kvm_adjvtime is used as the default
virtual timer. So please upgrade to openEuler qemu-4.1.0 and
use the virt-4.1 machine.

Signed-off-by: Ying Fang <fangying1@huawei.com>
2020-06-01 09:13:39 +00:00
Ying Fang
b24393ef8e hw/arm/virt: add missing compat for kvm-no-adjvtime
Machine compatibility for kvm-no-adjvtime is missed,
let's add it for virt machine 4.0, thus kvm-no-adjvtime
is supported in v4.1.0.

Signed-off-by: Ying Fang <fangying1@huawei.com>
2020-06-01 09:13:39 +00:00
Ying Fang
7774be8671 vtimer: introduce the vtimer first used in v4.0.1
To support cross version migration, we had to add the vtimer back
which was introduced in openEuler qemu-4.0.1.

Signed-off-by: Ying Fang <fangying1@huawei.com>
2020-06-01 09:13:39 +00:00
Ying Fang
409590df6a Revert: "vtimer: compat cross version migration from v4.0.1"
This reverts commit patch:
vtimer-compat-cross-version-migration-from-v4.0.1.patch

Signed-off-by: Ying Fang <fangying1@huawei.com>
2020-06-01 09:13:39 +00:00
Ying Fang
a93a929409 spec: Update release version
increase release version by one

Signed-off-by: Ying Fang <fangying1@huawei.com>
2020-06-01 09:13:39 +00:00
Ying Fang
67a1d83a9d log: Add some logs on VM runtime path
Add logs on VM runtime path, to make it easier to do trouble shooting.

Signed-off-by: Ying Fang <fangying1@huawei.com>
2020-06-01 09:13:39 +00:00
Leo Fang
95c8ff21d2 CVE: Fix CVE-2018-19665
upstream url:
https://patchwork.kernel.org/patch/10688527/

Signed-off-by: Ying Fang <fangying1@huawei.com>
2020-06-01 09:13:39 +00:00
Ying Fang
42f23fa4e7 CVE: Fix CVE-2019-15890
this patch fix CVE-2019-15890, upstream patch url:
https://gitlab.freedesktop.org/slirp/libslirp/commit/c5927943

Signed-off-by: Ying Fang <fangying1@huawei.com>
2020-06-01 09:13:39 +00:00
Ying Fang
67973af4ff arm: drop redunt patch
Drop the redunt patch:
ARM-KVM-Check-KVM_CAP_ARM_IRQ_LINE_LAYOUT_2-for-smp_.patch

Signed-off-by: Ying Fang <fangying1@huawei.com>
2020-06-01 09:13:39 +00:00
Ying Fang
ce26e77689 CVE: Fix CVE-2020-7211
backport from upstream:
14ec36e107

Signed-off-by: Ying Fang <fangying1@huawei.com>
2020-06-01 09:13:39 +00:00