Adding qemu 5.1 for rpi3 emulation

This commit is contained in:
Gerardo J. Puerta Cardelles
2021-02-22 09:23:51 +01:00
parent 73dd5b7bae
commit f9ef2aa84c
20 changed files with 4002 additions and 0 deletions

View File

@ -0,0 +1,2 @@
KERNEL=="kvm", GROUP="kvm", MODE="0660"
KERNEL=="vhost-net", GROUP="kvm", MODE="0660", OPTIONS+="static_node=vhost-net"

View File

@ -0,0 +1,14 @@
# This should have the following permissions: root:qemu 0640
# allow br0
# Uncommenting the above would allow users in the 'qemu' group
# to add devices to 'br0'
# allow virbr0
# Uncommenting the above would allow users in the 'qemu' group
# to add devices to 'virbr0'
# include /etc/qemu/bob.conf
# Uncommenting the above would allow users in the 'bob' group
# to have permissions defined in it, iff it has the following
# permissions: root:bob 0640

View File

@ -0,0 +1,11 @@
--- qemu-2.11.1/include/disas/capstone.h 2018-02-14 22:53:22.000000000 +0100
+++ qemu-2.11.1/include/disas/capstone.h 2018-02-17 20:12:12.754703951 +0100
@@ -3,7 +3,7 @@
#ifdef CONFIG_CAPSTONE
-#include <capstone.h>
+#include <capstone/capstone.h>
#else

View File

@ -0,0 +1,13 @@
--- a/configure
+++ b/configure
@@ -4468,10 +4468,6 @@ fi
if test "$gcov" = "yes" ; then
CFLAGS="-fprofile-arcs -ftest-coverage -g $CFLAGS"
LDFLAGS="-fprofile-arcs -ftest-coverage $LDFLAGS"
-elif test "$fortify_source" = "yes" ; then
- CFLAGS="-O2 -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 $CFLAGS"
-elif test "$debug" = "no"; then
- CFLAGS="-O2 $CFLAGS"
fi
##########################################

View File

@ -0,0 +1,12 @@
diff --git a/Makefile b/Makefile
index 04a0d450..e0013a59 100644
--- a/Makefile
+++ b/Makefile
@@ -803,6 +802,7 @@
$(call install-prog,$(HELPERS-y),$(DESTDIR)$(libexecdir))
endif
ifdef CONFIG_TRACE_SYSTEMTAP
+ mkdir -p $(DESTDIR)$(bindir)
$(INSTALL_PROG) "scripts/qemu-trace-stap" $(DESTDIR)$(bindir)
endif
ifneq ($(BLOBS),)

View File

@ -0,0 +1,94 @@
https://bugs.gentoo.org/719266
From ac2071c3791b67fc7af78b8ceb320c01ca1b5df7 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Mon, 6 Apr 2020 22:34:26 +0200
Subject: [PATCH] ati-vga: Fix checks in ati_2d_blt() to avoid crash
In some corner cases (that never happen during normal operation but a
malicious guest could program wrong values) pixman functions were
called with parameters that result in a crash. Fix this and add more
checks to disallow such cases.
Reported-by: Ziming Zhang <ezrakiez@gmail.com>
Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Message-id: 20200406204029.19559747D5D@zero.eik.bme.hu
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
hw/display/ati_2d.c | 37 ++++++++++++++++++++++++++-----------
1 file changed, 26 insertions(+), 11 deletions(-)
--- a/hw/display/ati_2d.c
+++ b/hw/display/ati_2d.c
@@ -53,12 +53,20 @@ void ati_2d_blt(ATIVGAState *s)
s->vga.vbe_start_addr, surface_data(ds), surface_stride(ds),
surface_bits_per_pixel(ds),
(s->regs.dp_mix & GMC_ROP3_MASK) >> 16);
- int dst_x = (s->regs.dp_cntl & DST_X_LEFT_TO_RIGHT ?
- s->regs.dst_x : s->regs.dst_x + 1 - s->regs.dst_width);
- int dst_y = (s->regs.dp_cntl & DST_Y_TOP_TO_BOTTOM ?
- s->regs.dst_y : s->regs.dst_y + 1 - s->regs.dst_height);
+ unsigned dst_x = (s->regs.dp_cntl & DST_X_LEFT_TO_RIGHT ?
+ s->regs.dst_x : s->regs.dst_x + 1 - s->regs.dst_width);
+ unsigned dst_y = (s->regs.dp_cntl & DST_Y_TOP_TO_BOTTOM ?
+ s->regs.dst_y : s->regs.dst_y + 1 - s->regs.dst_height);
int bpp = ati_bpp_from_datatype(s);
+ if (!bpp) {
+ qemu_log_mask(LOG_GUEST_ERROR, "Invalid bpp\n");
+ return;
+ }
int dst_stride = DEFAULT_CNTL ? s->regs.dst_pitch : s->regs.default_pitch;
+ if (!dst_stride) {
+ qemu_log_mask(LOG_GUEST_ERROR, "Zero dest pitch\n");
+ return;
+ }
uint8_t *dst_bits = s->vga.vram_ptr + (DEFAULT_CNTL ?
s->regs.dst_offset : s->regs.default_offset);
@@ -82,12 +90,16 @@ void ati_2d_blt(ATIVGAState *s)
switch (s->regs.dp_mix & GMC_ROP3_MASK) {
case ROP3_SRCCOPY:
{
- int src_x = (s->regs.dp_cntl & DST_X_LEFT_TO_RIGHT ?
- s->regs.src_x : s->regs.src_x + 1 - s->regs.dst_width);
- int src_y = (s->regs.dp_cntl & DST_Y_TOP_TO_BOTTOM ?
- s->regs.src_y : s->regs.src_y + 1 - s->regs.dst_height);
+ unsigned src_x = (s->regs.dp_cntl & DST_X_LEFT_TO_RIGHT ?
+ s->regs.src_x : s->regs.src_x + 1 - s->regs.dst_width);
+ unsigned src_y = (s->regs.dp_cntl & DST_Y_TOP_TO_BOTTOM ?
+ s->regs.src_y : s->regs.src_y + 1 - s->regs.dst_height);
int src_stride = DEFAULT_CNTL ?
s->regs.src_pitch : s->regs.default_pitch;
+ if (!src_stride) {
+ qemu_log_mask(LOG_GUEST_ERROR, "Zero source pitch\n");
+ return;
+ }
uint8_t *src_bits = s->vga.vram_ptr + (DEFAULT_CNTL ?
s->regs.src_offset : s->regs.default_offset);
@@ -137,8 +149,10 @@ void ati_2d_blt(ATIVGAState *s)
dst_y * surface_stride(ds),
s->regs.dst_height * surface_stride(ds));
}
- s->regs.dst_x += s->regs.dst_width;
- s->regs.dst_y += s->regs.dst_height;
+ s->regs.dst_x = (s->regs.dp_cntl & DST_X_LEFT_TO_RIGHT ?
+ dst_x + s->regs.dst_width : dst_x);
+ s->regs.dst_y = (s->regs.dp_cntl & DST_Y_TOP_TO_BOTTOM ?
+ dst_y + s->regs.dst_height : dst_y);
break;
}
case ROP3_PATCOPY:
@@ -179,7 +193,8 @@ void ati_2d_blt(ATIVGAState *s)
dst_y * surface_stride(ds),
s->regs.dst_height * surface_stride(ds));
}
- s->regs.dst_y += s->regs.dst_height;
+ s->regs.dst_y = (s->regs.dp_cntl & DST_Y_TOP_TO_BOTTOM ?
+ dst_y + s->regs.dst_height : dst_y);
break;
}
default:
--
2.26.2

View File

@ -0,0 +1,16 @@
diff --git i/configure w/configure
index a72a5def57..546d757603 100755
--- i/configure
+++ w/configure
@@ -6093,10 +6093,6 @@ write_c_skeleton
if test "$gcov" = "yes" ; then
QEMU_CFLAGS="-fprofile-arcs -ftest-coverage -g $QEMU_CFLAGS"
QEMU_LDFLAGS="-fprofile-arcs -ftest-coverage $QEMU_LDFLAGS"
-elif test "$fortify_source" = "yes" ; then
- CFLAGS="-O2 -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 $CFLAGS"
-elif test "$debug" = "no"; then
- CFLAGS="-O2 $CFLAGS"
fi
if test "$have_asan" = "yes"; then

View File

@ -0,0 +1,50 @@
https://lists.nongnu.org/archive/html/qemu-devel/2020-04/msg02643.html
From 6bce23d8daf96a7faa9288e7414948cda31ddaa2 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyfox@gentoo.org>
Date: Thu, 16 Apr 2020 18:55:49 +0100
Subject: [PATCH] linux-user/strace.list: fix epoll_create{,1} -strace output
Fix syscall name and parameters priinter.
Before the change:
```
$ alpha-linux-user/qemu-alpha -strace -L /usr/alpha-unknown-linux-gnu/ /tmp/a
...
1274697 %s(%d)(2097152,274903156744,274903156760,274905840712,274877908880,274903235616) = 3
1274697 exit_group(0)
```
After the change:
```
$ alpha-linux-user/qemu-alpha -strace -L /usr/alpha-unknown-linux-gnu/ /tmp/a
...
1273719 epoll_create1(2097152) = 3
1273719 exit_group(0)
```
Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org>
---
linux-user/strace.list | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/linux-user/strace.list
+++ b/linux-user/strace.list
@@ -125,10 +125,10 @@
{ TARGET_NR_dup3, "dup3" , "%s(%d,%d,%d)", NULL, NULL },
#endif
#ifdef TARGET_NR_epoll_create
-{ TARGET_NR_epoll_create, "%s(%d)", NULL, NULL, NULL },
+{ TARGET_NR_epoll_create, "epoll_create", "%s(%d)", NULL, NULL },
#endif
#ifdef TARGET_NR_epoll_create1
-{ TARGET_NR_epoll_create1, "%s(%d)", NULL, NULL, NULL },
+{ TARGET_NR_epoll_create1, "epoll_create1", "%s(%d)", NULL, NULL },
#endif
#ifdef TARGET_NR_epoll_ctl
{ TARGET_NR_epoll_ctl, "epoll_ctl" , NULL, NULL, NULL },
--
2.26.2

View File

@ -0,0 +1,35 @@
https://gitlab.freedesktop.org/slirp/libslirp/-/commit/c7ede54cbd2e2b25385325600958ba0124e31cc0
https://bugzilla.redhat.com/show_bug.cgi?id=1835986
https://bugs.gentoo.org/731992
From c7ede54cbd2e2b25385325600958ba0124e31cc0 Mon Sep 17 00:00:00 2001
From: Ralf Haferkamp <rhafer@suse.com>
Date: Fri, 3 Jul 2020 14:51:16 +0200
Subject: [PATCH] Drop bogus IPv6 messages
Drop IPv6 message shorter than what's mentioned in the payload
length header (+ the size of the IPv6 header). They're invalid an could
lead to data leakage in icmp6_send_echoreply().
---
src/ip6_input.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/slirp/src/ip6_input.c
+++ b/slirp/src/ip6_input.c
@@ -49,6 +49,13 @@ void ip6_input(struct mbuf *m)
goto bad;
}
+ // Check if the message size is big enough to hold what's
+ // set in the payload length header. If not this is an invalid
+ // packet
+ if (m->m_len < ntohs(ip6->ip_pl) + sizeof(struct ip6)) {
+ goto bad;
+ }
+
/* check ip_ttl for a correct ICMP reply */
if (ip6->ip_hl == 0) {
icmp6_send_error(m, ICMP6_TIMXCEED, ICMP6_TIMXCEED_INTRANS);
--
GitLab

View File

@ -0,0 +1,62 @@
https://bugs.gentoo.org/735146
From 4fd46e6cdd976f4aecdc3fbbad728e00a7bc4ee0 Mon Sep 17 00:00:00 2001
From: Rafael Kitover <rkitover@gmail.com>
Date: Thu, 13 Aug 2020 20:19:24 +0000
Subject: [PATCH] configure: Require pixman for vhost-user-gpu.
Use the test from Makefile to check if vhost-user-gpu is being built,
and if so require pixman.
Signed-off-by: Rafael Kitover <rkitover@gmail.com>
---
configure | 28 ++++++++++++++--------------
1 file changed, 14 insertions(+), 14 deletions(-)
--- a/configure
+++ b/configure
@@ -4062,20 +4062,6 @@ if test "$modules" = yes; then
fi
fi
-##########################################
-# pixman support probe
-
-if test "$softmmu" = "no"; then
- pixman_cflags=
- pixman_libs=
-elif $pkg_config --atleast-version=0.21.8 pixman-1 > /dev/null 2>&1; then
- pixman_cflags=$($pkg_config --cflags pixman-1)
- pixman_libs=$($pkg_config --libs pixman-1)
-else
- error_exit "pixman >= 0.21.8 not present." \
- "Please install the pixman devel package."
-fi
-
##########################################
# libmpathpersist probe
@@ -4491,6 +4477,20 @@ if test "$opengl" = "yes" && test "$have_x11" = "yes"; then
done
fi
+##########################################
+# pixman support probe
+
+if test "$softmmu" = "no" && ! test "${linux} ${virglrenderer} ${gbm} ${want_tools}" = "yes yes yes yes"; then
+ pixman_cflags=
+ pixman_libs=
+elif $pkg_config --atleast-version=0.21.8 pixman-1 > /dev/null 2>&1; then
+ pixman_cflags=$($pkg_config --cflags pixman-1)
+ pixman_libs=$($pkg_config --libs pixman-1)
+else
+ error_exit "pixman >= 0.21.8 not present." \
+ "Please install the pixman devel package."
+fi
+
##########################################
# libxml2 probe
if test "$libxml2" != "no" ; then
--
2.28.0

View File

@ -0,0 +1,82 @@
From 202d69a715a4b1824dcd7ec1683d027ed2bae6d3 Mon Sep 17 00:00:00 2001
Message-Id: <202d69a715a4b1824dcd7ec1683d027ed2bae6d3.1606202550.git.mprivozn@redhat.com>
From: Gerd Hoffmann <kraxel@redhat.com>
Date: Mon, 24 Aug 2020 13:00:57 +0200
Subject: [PATCH] usb-host: workaround libusb bug
libusb_get_device_speed() does not work for
libusb_wrap_sys_device() devices in v1.0.23.
Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1871090
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 20200824110057.32089-1-kraxel@redhat.com
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
---
hw/usb/host-libusb.c | 37 ++++++++++++++++++++++++++++++++++++-
1 file changed, 36 insertions(+), 1 deletion(-)
diff --git a/hw/usb/host-libusb.c b/hw/usb/host-libusb.c
index c474551d84..08604f787f 100644
--- a/hw/usb/host-libusb.c
+++ b/hw/usb/host-libusb.c
@@ -39,6 +39,11 @@
#endif
#include <libusb.h>
+#ifdef CONFIG_LINUX
+#include <sys/ioctl.h>
+#include <linux/usbdevice_fs.h>
+#endif
+
#include "qapi/error.h"
#include "migration/vmstate.h"
#include "monitor/monitor.h"
@@ -885,6 +890,7 @@ static void usb_host_ep_update(USBHostDevice *s)
static int usb_host_open(USBHostDevice *s, libusb_device *dev, int hostfd)
{
USBDevice *udev = USB_DEVICE(s);
+ int libusb_speed;
int bus_num = 0;
int addr = 0;
int rc;
@@ -935,7 +941,36 @@ static int usb_host_open(USBHostDevice *s, libusb_device *dev, int hostfd)
usb_ep_init(udev);
usb_host_ep_update(s);
- udev->speed = speed_map[libusb_get_device_speed(dev)];
+ libusb_speed = libusb_get_device_speed(dev);
+#ifdef CONFIG_LINUX
+ if (hostfd && libusb_speed == 0) {
+ /*
+ * Workaround libusb bug: libusb_get_device_speed() does not
+ * work for libusb_wrap_sys_device() devices in v1.0.23.
+ *
+ * Speeds are defined in linux/usb/ch9.h, file not included
+ * due to name conflicts.
+ */
+ int rc = ioctl(hostfd, USBDEVFS_GET_SPEED, NULL);
+ switch (rc) {
+ case 1: /* low */
+ libusb_speed = LIBUSB_SPEED_LOW;
+ break;
+ case 2: /* full */
+ libusb_speed = LIBUSB_SPEED_FULL;
+ break;
+ case 3: /* high */
+ case 4: /* wireless */
+ libusb_speed = LIBUSB_SPEED_HIGH;
+ break;
+ case 5: /* super */
+ case 6: /* super plus */
+ libusb_speed = LIBUSB_SPEED_SUPER;
+ break;
+ }
+ }
+#endif
+ udev->speed = speed_map[libusb_speed];
usb_host_speed_compat(s);
if (s->ddesc.iProduct) {
--
2.26.2

View File

@ -0,0 +1,90 @@
https://bugs.gentoo.org/743649
From b946434f2659a182afc17e155be6791ebfb302eb Mon Sep 17 00:00:00 2001
From: Gerd Hoffmann <kraxel@redhat.com>
Date: Tue, 25 Aug 2020 07:36:36 +0200
Subject: [PATCH] usb: fix setup_len init (CVE-2020-14364)
Store calculated setup_len in a local variable, verify it, and only
write it to the struct (USBDevice->setup_len) in case it passed the
sanity checks.
This prevents other code (do_token_{in,out} functions specifically)
from working with invalid USBDevice->setup_len values and overrunning
the USBDevice->setup_buf[] buffer.
Fixes: CVE-2020-14364
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Tested-by: Gonglei <arei.gonglei@huawei.com>
Reviewed-by: Li Qiang <liq3ea@gmail.com>
Message-id: 20200825053636.29648-1-kraxel@redhat.com
---
hw/usb/core.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
diff --git a/hw/usb/core.c b/hw/usb/core.c
index 5abd128b6b..5234dcc73f 100644
--- a/hw/usb/core.c
+++ b/hw/usb/core.c
@@ -129,6 +129,7 @@ void usb_wakeup(USBEndpoint *ep, unsigned int stream)
static void do_token_setup(USBDevice *s, USBPacket *p)
{
int request, value, index;
+ unsigned int setup_len;
if (p->iov.size != 8) {
p->status = USB_RET_STALL;
@@ -138,14 +139,15 @@ static void do_token_setup(USBDevice *s, USBPacket *p)
usb_packet_copy(p, s->setup_buf, p->iov.size);
s->setup_index = 0;
p->actual_length = 0;
- s->setup_len = (s->setup_buf[7] << 8) | s->setup_buf[6];
- if (s->setup_len > sizeof(s->data_buf)) {
+ setup_len = (s->setup_buf[7] << 8) | s->setup_buf[6];
+ if (setup_len > sizeof(s->data_buf)) {
fprintf(stderr,
"usb_generic_handle_packet: ctrl buffer too small (%d > %zu)\n",
- s->setup_len, sizeof(s->data_buf));
+ setup_len, sizeof(s->data_buf));
p->status = USB_RET_STALL;
return;
}
+ s->setup_len = setup_len;
request = (s->setup_buf[0] << 8) | s->setup_buf[1];
value = (s->setup_buf[3] << 8) | s->setup_buf[2];
@@ -259,26 +261,28 @@ static void do_token_out(USBDevice *s, USBPacket *p)
static void do_parameter(USBDevice *s, USBPacket *p)
{
int i, request, value, index;
+ unsigned int setup_len;
for (i = 0; i < 8; i++) {
s->setup_buf[i] = p->parameter >> (i*8);
}
s->setup_state = SETUP_STATE_PARAM;
- s->setup_len = (s->setup_buf[7] << 8) | s->setup_buf[6];
s->setup_index = 0;
request = (s->setup_buf[0] << 8) | s->setup_buf[1];
value = (s->setup_buf[3] << 8) | s->setup_buf[2];
index = (s->setup_buf[5] << 8) | s->setup_buf[4];
- if (s->setup_len > sizeof(s->data_buf)) {
+ setup_len = (s->setup_buf[7] << 8) | s->setup_buf[6];
+ if (setup_len > sizeof(s->data_buf)) {
fprintf(stderr,
"usb_generic_handle_packet: ctrl buffer too small (%d > %zu)\n",
- s->setup_len, sizeof(s->data_buf));
+ setup_len, sizeof(s->data_buf));
p->status = USB_RET_STALL;
return;
}
+ s->setup_len = setup_len;
if (p->pid == USB_TOKEN_OUT) {
usb_packet_copy(p, s->data_buf, s->setup_len);
--
2.28.0

View File

@ -0,0 +1,64 @@
#!/sbin/openrc-run
# Copyright 1999-2018 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2
# Enable automatic non-native program execution by the kernel.
# Defaulting to OC should be safe because it comes down to:
# - do we trust the interp itself to not be malicious? yes; we built it.
# - do we trust the programs we're running? ish; same permission as native
# binaries apply. so if user can do bad stuff natively, cross isn't worse.
: ${QEMU_BINFMT_FLAGS:=OC}
depend() {
after procfs
}
start() {
ebegin "Registering qemu-user binaries (flags: ${QEMU_BINFMT_FLAGS})"
if [ ! -d /proc/sys/fs/binfmt_misc ] ; then
modprobe -q binfmt_misc
fi
if [ ! -d /proc/sys/fs/binfmt_misc ] ; then
eend 1 "You need support for 'misc binaries' in your kernel!"
return
fi
if [ ! -f /proc/sys/fs/binfmt_misc/register ] ; then
mount -t binfmt_misc -o nodev,noexec,nosuid \
binfmt_misc /proc/sys/fs/binfmt_misc >/dev/null 2>&1
eend $? || return
fi
# Probe the native cpu type so we don't try registering them.
local cpu="$(uname -m)"
case "${cpu}" in
armv[4-9]*)
cpu="arm"
;;
i386|i486|i586|i686|i86pc|BePC|x86_64)
cpu="i386"
;;
m68k)
cpu="m68k"
;;
mips*)
cpu="mips"
;;
"Power Macintosh"|ppc|ppc64)
cpu="ppc"
;;
s390*)
cpu="s390"
;;
sh*)
cpu="sh"
;;
sparc*)
cpu="sparc"
;;
esac
# Register the interpreter for each cpu except for the native one.

View File

@ -0,0 +1,14 @@
eend 0
}
stop() {
# We unregister everything in the "qemu-xxx" namespace.
ebegin "Unregistering qemu-user binaries"
local f
for f in /proc/sys/fs/binfmt_misc/qemu-* ; do
if [ -f "${f}" ] ; then
echo '-1' > "${f}"
fi
done
eend 0
}