Hello community, here is the log from the commit of package qemu for openSUSE:Factory checked in at 2020-07-26 16:14:28 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/qemu (Old) and /work/SRC/openSUSE:Factory/.qemu.new.3592 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "qemu" Sun Jul 26 16:14:28 2020 rev:177 rq:822155 version:5.0.0 Changes: -------- --- /work/SRC/openSUSE:Factory/qemu/qemu.changes 2020-06-05 20:03:21.652559904 +0200 +++ /work/SRC/openSUSE:Factory/.qemu.new.3592/qemu.changes 2020-07-26 16:15:37.540607256 +0200 @@ -1,0 +2,59 @@ +Tue Jul 21 15:58:10 UTC 2020 - Bruce Rogers <[email protected]> + +- Updating to Sphinx v3.1.2 in Factory is exposing an issue in + qemu doc sources. Fix it + docs-fix-trace-docs-build-with-sphinx-3..patch + +------------------------------------------------------------------- +Wed Jul 8 23:00:21 UTC 2020 - Bruce Rogers <[email protected]> + +- Fix DoS possibility in ati-vga emulation (CVE-2020-13800 + bsc#1172495) + ati-vga-check-mm_index-before-recursive-.patch +- Fix DoS possibility in Network Block Device (nbd) support + infrastructure (CVE-2020-10761 bsc#1172710) + nbd-server-Avoid-long-error-message-asse.patch +- Fix null pointer dereference possibility (DoS) in MegaRAID SAS + 8708EM2 emulation (CVE-2020-13659 bsc#1172386) + exec-set-map-length-to-zero-when-returni.patch +- Fix OOB access possibility in MegaRAID SAS 8708EM2 emulation + (CVE-2020-13362 bsc#1172383) + megasas-use-unsigned-type-for-reply_queu.patch +- Fix legacy IGD passthrough + hw-vfio-pci-quirks-Fix-broken-legacy-IGD.patch + +------------------------------------------------------------------- +Wed Jul 1 00:10:43 UTC 2020 - Bruce Rogers <[email protected]> + +- The latest gcc10 available in Factory has the fix for the + issue this patch was created to avoid, so drop it + build-Work-around-gcc10-bug-by-not-using.patch + +------------------------------------------------------------------- +Sun Jun 28 16:25:32 UTC 2020 - Bruce Rogers <[email protected]> + +- Switch to upstream versions of some patches we carry + add-enum-cast-to-avoid-gcc10-warning.patch + -> golan-Add-explicit-type-casts-for-nodnic.patch + Be-explicit-about-fcommon-compiler-direc.patch + -> build-Be-explicit-about-fcommon-compiler.patch + Do-not-apply-WORKAROUND_CFLAGS-for-host-.patch + -> build-Do-not-apply-WORKAROUND_CFLAGS-for.patch + Fix-s-directive-argument-is-null-error.patch + -> build-Fix-s-directive-argument-is-null-e.patch + Workaround-compilation-error-with-gcc-9..patch + -> build-Workaround-compilation-error-with-.patch + work-around-gcc10-problem-with-zero-leng.patch + -> intel-Avoid-spurious-compiler-warning-on.patch +- Fix vgabios issue for cirrus graphics emulation, which + effectively downgraded it to standard VGA behavior + vga-fix-cirrus-bios.patch + +------------------------------------------------------------------- +Fri Jun 12 16:14:07 UTC 2020 - Bruce Rogers <[email protected]> + +- Fix OOB access possibility in ES1370 audio device emulation + (CVE-2020-13361 bsc#1172384) + es1370-check-total-frame-count-against-c.patch + +------------------------------------------------------------------- Old: ---- Be-explicit-about-fcommon-compiler-direc.patch Do-not-apply-WORKAROUND_CFLAGS-for-host-.patch Fix-s-directive-argument-is-null-error.patch Workaround-compilation-error-with-gcc-9..patch add-enum-cast-to-avoid-gcc10-warning.patch build-Work-around-gcc10-bug-by-not-using.patch work-around-gcc10-problem-with-zero-leng.patch New: ---- ati-vga-check-mm_index-before-recursive-.patch build-Be-explicit-about-fcommon-compiler.patch build-Do-not-apply-WORKAROUND_CFLAGS-for.patch build-Fix-s-directive-argument-is-null-e.patch build-Workaround-compilation-error-with-.patch docs-fix-trace-docs-build-with-sphinx-3..patch es1370-check-total-frame-count-against-c.patch exec-set-map-length-to-zero-when-returni.patch golan-Add-explicit-type-casts-for-nodnic.patch hw-vfio-pci-quirks-Fix-broken-legacy-IGD.patch intel-Avoid-spurious-compiler-warning-on.patch megasas-use-unsigned-type-for-reply_queu.patch nbd-server-Avoid-long-error-message-asse.patch vga-fix-cirrus-bios.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ qemu.spec ++++++ --- /var/tmp/diff_new_pack.972iwf/_old 2020-07-26 16:15:54.424621471 +0200 +++ /var/tmp/diff_new_pack.972iwf/_new 2020-07-26 16:15:54.428621474 +0200 @@ -127,82 +127,89 @@ # This patch queue is auto-generated - see README.PACKAGING for process # Patches applied in base project: -Patch00000: virtiofsd-add-rlimit-nofile-NUM-option.patch -Patch00001: virtiofsd-stay-below-fs.file-max-sysctl-.patch -Patch00002: audio-fix-wavcapture-segfault.patch -Patch00003: XXX-dont-dump-core-on-sigabort.patch -Patch00004: qemu-binfmt-conf-Modify-default-path.patch -Patch00005: qemu-cvs-gettimeofday.patch -Patch00006: qemu-cvs-ioctl_debug.patch -Patch00007: qemu-cvs-ioctl_nodirection.patch -Patch00008: linux-user-add-binfmt-wrapper-for-argv-0.patch -Patch00009: PPC-KVM-Disable-mmu-notifier-check.patch -Patch00010: linux-user-binfmt-support-host-binaries.patch -Patch00011: linux-user-Fake-proc-cpuinfo.patch -Patch00012: linux-user-use-target_ulong.patch -Patch00013: Make-char-muxer-more-robust-wrt-small-FI.patch -Patch00014: linux-user-lseek-explicitly-cast-non-set.patch -Patch00015: AIO-Reduce-number-of-threads-for-32bit-h.patch -Patch00016: xen_disk-Add-suse-specific-flush-disable.patch -Patch00017: qemu-bridge-helper-reduce-security-profi.patch -Patch00018: qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch -Patch00019: linux-user-properly-test-for-infinite-ti.patch -Patch00020: roms-Makefile-pass-a-packaging-timestamp.patch -Patch00021: Raise-soft-address-space-limit-to-hard-l.patch -Patch00022: increase-x86_64-physical-bits-to-42.patch -Patch00023: i8254-Fix-migration-from-SLE11-SP2.patch -Patch00024: acpi_piix4-Fix-migration-from-SLE11-SP2.patch -Patch00025: Switch-order-of-libraries-for-mpath-supp.patch -Patch00026: Make-installed-scripts-explicitly-python.patch -Patch00027: hw-smbios-handle-both-file-formats-regar.patch -Patch00028: xen-add-block-resize-support-for-xen-dis.patch -Patch00029: tests-qemu-iotests-Triple-timeout-of-i-o.patch -Patch00030: tests-Fix-block-tests-to-be-compatible-w.patch -Patch00031: xen-ignore-live-parameter-from-xen-save-.patch -Patch00032: Conditionalize-ui-bitmap-installation-be.patch -Patch00033: tests-change-error-message-in-test-162.patch -Patch00034: hw-usb-hcd-xhci-Fix-GCC-9-build-warning.patch -Patch00035: hw-usb-dev-mtp-Fix-GCC-9-build-warning.patch -Patch00036: hw-intc-exynos4210_gic-provide-more-room.patch -Patch00037: configure-only-populate-roms-if-softmmu.patch -Patch00038: pc-bios-s390-ccw-net-avoid-warning-about.patch -Patch00039: roms-change-cross-compiler-naming-to-be-.patch -Patch00040: tests-Disable-some-block-tests-for-now.patch -Patch00041: test-add-mapping-from-arch-of-i686-to-qe.patch -Patch00042: roms-Makefile-enable-cross-compile-for-b.patch -Patch00043: s390x-Move-diagnose-308-subcodes-and-rcs.patch -Patch00044: Sync-pv.patch -Patch00045: s390x-protvirt-Support-unpack-facility.patch -Patch00046: s390x-protvirt-Add-migration-blocker.patch -Patch00047: s390x-protvirt-Inhibit-balloon-when-swit.patch -Patch00048: s390x-protvirt-KVM-intercept-changes.patch -Patch00049: s390x-Add-SIDA-memory-ops.patch -Patch00050: s390x-protvirt-Move-STSI-data-over-SIDAD.patch -Patch00051: s390x-protvirt-SCLP-interpretation.patch -Patch00052: s390x-protvirt-Set-guest-IPL-PSW.patch -Patch00053: s390x-protvirt-Move-diag-308-data-over-S.patch -Patch00054: s390x-protvirt-Disable-address-checks-fo.patch -Patch00055: s390x-protvirt-Move-IO-control-structure.patch -Patch00056: s390x-protvirt-Handle-SIGP-store-status-.patch -Patch00057: s390x-Add-unpack-facility-feature-to-GA1.patch -Patch00058: s390x-s390-virtio-ccw-Fix-build-on-syste.patch -Patch00059: configure-remove-pkgversion-from-CONFIG_.patch -Patch00060: gcc10-maybe-uninitialized.patch -Patch00061: docs-add-SUSE-support-statements-to-html.patch -Patch00062: build-Work-around-gcc10-bug-by-not-using.patch +Patch00000: s390x-Move-diagnose-308-subcodes-and-rcs.patch +Patch00001: Sync-pv.patch +Patch00002: s390x-protvirt-Support-unpack-facility.patch +Patch00003: s390x-protvirt-Add-migration-blocker.patch +Patch00004: s390x-protvirt-Inhibit-balloon-when-swit.patch +Patch00005: s390x-protvirt-KVM-intercept-changes.patch +Patch00006: s390x-Add-SIDA-memory-ops.patch +Patch00007: s390x-protvirt-Move-STSI-data-over-SIDAD.patch +Patch00008: s390x-protvirt-SCLP-interpretation.patch +Patch00009: s390x-protvirt-Set-guest-IPL-PSW.patch +Patch00010: s390x-protvirt-Move-diag-308-data-over-S.patch +Patch00011: s390x-protvirt-Disable-address-checks-fo.patch +Patch00012: s390x-protvirt-Move-IO-control-structure.patch +Patch00013: s390x-protvirt-Handle-SIGP-store-status-.patch +Patch00014: s390x-Add-unpack-facility-feature-to-GA1.patch +Patch00015: virtiofsd-add-rlimit-nofile-NUM-option.patch +Patch00016: virtiofsd-stay-below-fs.file-max-sysctl-.patch +Patch00017: es1370-check-total-frame-count-against-c.patch +Patch00018: audio-fix-wavcapture-segfault.patch +Patch00019: ati-vga-check-mm_index-before-recursive-.patch +Patch00020: nbd-server-Avoid-long-error-message-asse.patch +Patch00021: hw-vfio-pci-quirks-Fix-broken-legacy-IGD.patch +Patch00022: megasas-use-unsigned-type-for-reply_queu.patch +Patch00023: exec-set-map-length-to-zero-when-returni.patch +Patch00024: XXX-dont-dump-core-on-sigabort.patch +Patch00025: qemu-binfmt-conf-Modify-default-path.patch +Patch00026: qemu-cvs-gettimeofday.patch +Patch00027: qemu-cvs-ioctl_debug.patch +Patch00028: qemu-cvs-ioctl_nodirection.patch +Patch00029: linux-user-add-binfmt-wrapper-for-argv-0.patch +Patch00030: PPC-KVM-Disable-mmu-notifier-check.patch +Patch00031: linux-user-binfmt-support-host-binaries.patch +Patch00032: linux-user-Fake-proc-cpuinfo.patch +Patch00033: linux-user-use-target_ulong.patch +Patch00034: Make-char-muxer-more-robust-wrt-small-FI.patch +Patch00035: linux-user-lseek-explicitly-cast-non-set.patch +Patch00036: AIO-Reduce-number-of-threads-for-32bit-h.patch +Patch00037: xen_disk-Add-suse-specific-flush-disable.patch +Patch00038: qemu-bridge-helper-reduce-security-profi.patch +Patch00039: qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch +Patch00040: linux-user-properly-test-for-infinite-ti.patch +Patch00041: roms-Makefile-pass-a-packaging-timestamp.patch +Patch00042: Raise-soft-address-space-limit-to-hard-l.patch +Patch00043: increase-x86_64-physical-bits-to-42.patch +Patch00044: i8254-Fix-migration-from-SLE11-SP2.patch +Patch00045: acpi_piix4-Fix-migration-from-SLE11-SP2.patch +Patch00046: Switch-order-of-libraries-for-mpath-supp.patch +Patch00047: Make-installed-scripts-explicitly-python.patch +Patch00048: hw-smbios-handle-both-file-formats-regar.patch +Patch00049: xen-add-block-resize-support-for-xen-dis.patch +Patch00050: tests-qemu-iotests-Triple-timeout-of-i-o.patch +Patch00051: tests-Fix-block-tests-to-be-compatible-w.patch +Patch00052: xen-ignore-live-parameter-from-xen-save-.patch +Patch00053: Conditionalize-ui-bitmap-installation-be.patch +Patch00054: tests-change-error-message-in-test-162.patch +Patch00055: hw-usb-hcd-xhci-Fix-GCC-9-build-warning.patch +Patch00056: hw-usb-dev-mtp-Fix-GCC-9-build-warning.patch +Patch00057: hw-intc-exynos4210_gic-provide-more-room.patch +Patch00058: configure-only-populate-roms-if-softmmu.patch +Patch00059: pc-bios-s390-ccw-net-avoid-warning-about.patch +Patch00060: roms-change-cross-compiler-naming-to-be-.patch +Patch00061: tests-Disable-some-block-tests-for-now.patch +Patch00062: test-add-mapping-from-arch-of-i686-to-qe.patch +Patch00063: roms-Makefile-enable-cross-compile-for-b.patch +Patch00064: s390x-s390-virtio-ccw-Fix-build-on-syste.patch +Patch00065: configure-remove-pkgversion-from-CONFIG_.patch +Patch00066: gcc10-maybe-uninitialized.patch +Patch00067: docs-add-SUSE-support-statements-to-html.patch +Patch00068: docs-fix-trace-docs-build-with-sphinx-3..patch # Patches applied in roms/seabios/: Patch01000: seabios-use-python2-explicitly-as-needed.patch Patch01001: seabios-switch-to-python3-as-needed.patch Patch01002: enable-cross-compilation-on-ARM.patch +Patch01003: vga-fix-cirrus-bios.patch # Patches applied in roms/ipxe/: -Patch02000: stub-out-the-SAN-req-s-in-int13.patch -Patch02001: ipxe-Makefile-fix-issues-of-build-reprod.patch -Patch02002: Fix-s-directive-argument-is-null-error.patch -Patch02003: Workaround-compilation-error-with-gcc-9..patch -Patch02004: Do-not-apply-WORKAROUND_CFLAGS-for-host-.patch -Patch02005: Be-explicit-about-fcommon-compiler-direc.patch -Patch02006: work-around-gcc10-problem-with-zero-leng.patch -Patch02007: add-enum-cast-to-avoid-gcc10-warning.patch +Patch02000: build-Fix-s-directive-argument-is-null-e.patch +Patch02001: build-Workaround-compilation-error-with-.patch +Patch02002: build-Do-not-apply-WORKAROUND_CFLAGS-for.patch +Patch02003: build-Be-explicit-about-fcommon-compiler.patch +Patch02004: intel-Avoid-spurious-compiler-warning-on.patch +Patch02005: golan-Add-explicit-type-casts-for-nodnic.patch +Patch02006: stub-out-the-SAN-req-s-in-int13.patch +Patch02007: ipxe-Makefile-fix-issues-of-build-reprod.patch # Patches applied in roms/sgabios/: Patch03000: sgabios-Makefile-fix-issues-of-build-rep.patch Patch03001: roms-sgabios-Fix-csum8-to-be-built-by-ho.patch @@ -959,24 +966,31 @@ %patch00058 -p1 %patch00059 -p1 %patch00060 -p1 -%if %{legacy_qemu_kvm} && 0%{?is_opensuse} == 0 %patch00061 -p1 -%endif %patch00062 -p1 +%patch00063 -p1 +%patch00064 -p1 +%patch00065 -p1 +%patch00066 -p1 +%if %{legacy_qemu_kvm} && 0%{?is_opensuse} == 0 +%patch00067 -p1 +%endif +%patch00068 -p1 %patch01000 -p1 %patch01001 -p1 %patch01002 -p1 -%if 0%{?patch-possibly-applied-elsewhere} +%patch01003 -p1 %patch02000 -p1 -%endif %patch02001 -p1 +%ifarch aarch64 %patch02002 -p1 +%endif %patch02003 -p1 -%ifarch aarch64 %patch02004 -p1 -%endif %patch02005 -p1 +%if 0%{?patch-possibly-applied-elsewhere} %patch02006 -p1 +%endif %patch02007 -p1 %patch03000 -p1 %patch03001 -p1 @@ -1468,7 +1482,7 @@ # Compile the QOM test binary first, so that ... touch -r config-host.mak pc-bios -make %{?_smp_mflags} tests/qtest/qom-test %{?_smp_mflags} V=1 +make %{?_smp_mflags} tests/qtest/qom-test V=1 # ... make comes in fresh and has lots of address space (needed for 32bit, bsc#957379) make %{?_smp_mflags} check-report.tap V=1 ++++++ PPC-KVM-Disable-mmu-notifier-check.patch ++++++ --- /var/tmp/diff_new_pack.972iwf/_old 2020-07-26 16:15:54.568621592 +0200 +++ /var/tmp/diff_new_pack.972iwf/_new 2020-07-26 16:15:54.572621595 +0200 @@ -14,7 +14,7 @@ 1 file changed, 2 insertions(+) diff --git a/exec.c b/exec.c -index 2874bb508853d353bca3b9790e5d..76ac1f619b563c591f36f9601c15 100644 +index 2c419f327cf925ee55c46d111272..7adf108c66ed8912588cb83bc15e 100644 --- a/exec.c +++ b/exec.c @@ -2297,11 +2297,13 @@ RAMBlock *qemu_ram_alloc_from_fd(ram_addr_t size, MemoryRegion *mr, ++++++ Sync-pv.patch ++++++ --- /var/tmp/diff_new_pack.972iwf/_old 2020-07-26 16:15:54.604621622 +0200 +++ /var/tmp/diff_new_pack.972iwf/_new 2020-07-26 16:15:54.604621622 +0200 @@ -2,10 +2,10 @@ Date: Tue, 25 Feb 2020 06:09:23 -0500 Subject: Sync pv +Git-commit: 6807f464961cfee1dd81c95e22ddd91fa352fcc4 References: bsc#1167075 Signed-off-by: Janosch Frank <[email protected]> -(cherry picked from commit 6807f464961cfee1dd81c95e22ddd91fa352fcc4) Signed-off-by: Bruce Rogers <[email protected]> --- linux-headers/linux/kvm.h | 45 +++++++++++++++++++++++++++++++++++++-- ++++++ ati-vga-check-mm_index-before-recursive-.patch ++++++ From: Prasad J Pandit <[email protected]> Date: Thu, 4 Jun 2020 14:38:30 +0530 Subject: ati-vga: check mm_index before recursive call (CVE-2020-13800) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Git-commit: a98610c429d52db0937c1e48659428929835c455 References: bsc#1172495, CVE-2020-13800 While accessing VGA registers via ati_mm_read/write routines, a guest may set 's->regs.mm_index' such that it leads to infinite recursion. Check mm_index value to avoid such recursion. Log an error message for wrong values. Reported-by: Ren Ding <[email protected]> Reported-by: Hanqing Zhao <[email protected]> Reported-by: Yi Ren <[email protected]> Message-id: [email protected] Suggested-by: BALATON Zoltan <[email protected]> Suggested-by: Philippe Mathieu-Daudé <[email protected]> Signed-off-by: Prasad J Pandit <[email protected]> Signed-off-by: Gerd Hoffmann <[email protected]> Signed-off-by: Bruce Rogers <[email protected]> --- hw/display/ati.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/hw/display/ati.c b/hw/display/ati.c index 58ec8291d4601b70720fa1484f88..9228f1b242bb7b141eb50a19e12b 100644 --- a/hw/display/ati.c +++ b/hw/display/ati.c @@ -285,8 +285,11 @@ static uint64_t ati_mm_read(void *opaque, hwaddr addr, unsigned int size) if (idx <= s->vga.vram_size - size) { val = ldn_le_p(s->vga.vram_ptr + idx, size); } - } else { + } else if (s->regs.mm_index > MM_DATA + 3) { val = ati_mm_read(s, s->regs.mm_index + addr - MM_DATA, size); + } else { + qemu_log_mask(LOG_GUEST_ERROR, + "ati_mm_read: mm_index too small: %u\n", s->regs.mm_index); } break; case BIOS_0_SCRATCH ... BUS_CNTL - 1: @@ -520,8 +523,11 @@ static void ati_mm_write(void *opaque, hwaddr addr, if (idx <= s->vga.vram_size - size) { stn_le_p(s->vga.vram_ptr + idx, size, data); } - } else { + } else if (s->regs.mm_index > MM_DATA + 3) { ati_mm_write(s, s->regs.mm_index + addr - MM_DATA, data, size); + } else { + qemu_log_mask(LOG_GUEST_ERROR, + "ati_mm_write: mm_index too small: %u\n", s->regs.mm_index); } break; case BIOS_0_SCRATCH ... BUS_CNTL - 1: ++++++ build-Be-explicit-about-fcommon-compiler.patch ++++++ From: Bruce Rogers <[email protected]> Date: Wed, 6 May 2020 15:03:02 -0600 Subject: [build] Be explicit about -fcommon compiler directive Git-commit: 6260364cc4bfea9a78867da63be8d4bf50e4a561 References: boo#1171140 gcc10 switched default behavior from -fcommon to -fno-common. Since "__shared" relies on the legacy behavior, explicitly specify it. Signed-off-by: Bruce Rogers <[email protected]> Modified-by: Michael Brown <[email protected]> Signed-off-by: Michael Brown <[email protected]> --- src/Makefile.housekeeping | 1 + 1 file changed, 1 insertion(+) diff --git a/roms/ipxe/src/Makefile.housekeeping b/roms/ipxe/src/Makefile.housekeeping index 1b175b9508c0d20f169801f8763d..893bd20f1fd5cecf0e480dee05bd 100644 --- a/roms/ipxe/src/Makefile.housekeeping +++ b/roms/ipxe/src/Makefile.housekeeping @@ -422,6 +422,7 @@ CFLAGS += -Os CFLAGS += -g ifeq ($(CCTYPE),gcc) CFLAGS += -ffreestanding +CFLAGS += -fcommon CFLAGS += -Wall -W -Wformat-nonliteral HOST_CFLAGS += -Wall -W -Wformat-nonliteral endif ++++++ build-Do-not-apply-WORKAROUND_CFLAGS-for.patch ++++++ From: Michael Brown <[email protected]> Date: Mon, 22 Jul 2019 14:51:28 +0100 Subject: [build] Do not apply WORKAROUND_CFLAGS for host compiler Git-commit: a4f8c6e31f6c62522cfc633bbbffa81b22f9d6f3 Include-If: %ifarch aarch64 The WORKAROUND_CFLAGS list is constructed based on running tests on the target compiler, and the results may not be valid for the host compiler. The only relevant workaround required for the host compiler is -Wno-stringop-truncation, which is needed to avoid a spurious compiler warning for a totally correct usage of strncpy() in util/elf2efi.c. Duplicating the workaround tests for the host compiler is messy, as is conditionally applying __attribute__((nonstring)). Fix instead by disapplying WORKAROUND_CFLAGS for the host compiler, and using memcpy() with an explicitly calculated length instead of strncpy() in util/elf2efi.c. Reported-by: Ignat Korchagin <[email protected]> Reported-by: Christopher Clark <[email protected]> Signed-off-by: Michael Brown <[email protected]> Signed-off-by: Bruce Rogers <[email protected]> --- src/Makefile.housekeeping | 2 +- src/util/elf2efi.c | 6 +++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/roms/ipxe/src/Makefile.housekeeping b/roms/ipxe/src/Makefile.housekeeping index 4b09e81f0b1eb82e79f6af11986d..1b175b9508c0d20f169801f8763d 100644 --- a/roms/ipxe/src/Makefile.housekeeping +++ b/roms/ipxe/src/Makefile.housekeeping @@ -454,7 +454,7 @@ endif CFLAGS += $(WORKAROUND_CFLAGS) $(EXTRA_CFLAGS) ASFLAGS += $(WORKAROUND_ASFLAGS) $(EXTRA_ASFLAGS) LDFLAGS += $(WORKAROUND_LDFLAGS) $(EXTRA_LDFLAGS) -HOST_CFLAGS += $(WORKAROUND_CFLAGS) -O2 -g +HOST_CFLAGS += -O2 -g # Inhibit -Werror if NO_WERROR is specified on make command line # diff --git a/roms/ipxe/src/util/elf2efi.c b/roms/ipxe/src/util/elf2efi.c index 2c5b9df8aae853bfce4d5d3bae89..bcd53c9afda7880d42ec80c07f17 100644 --- a/roms/ipxe/src/util/elf2efi.c +++ b/roms/ipxe/src/util/elf2efi.c @@ -458,6 +458,7 @@ static struct pe_section * process_section ( struct elf_file *elf, struct pe_header *pe_header ) { struct pe_section *new; const char *name; + size_t name_len; size_t section_memsz; size_t section_filesz; unsigned long code_start; @@ -494,7 +495,10 @@ static struct pe_section * process_section ( struct elf_file *elf, memset ( new, 0, sizeof ( *new ) + section_filesz ); /* Fill in section header details */ - strncpy ( ( char * ) new->hdr.Name, name, sizeof ( new->hdr.Name ) ); + name_len = strlen ( name ); + if ( name_len > sizeof ( new->hdr.Name ) ) + name_len = sizeof ( new->hdr.Name ); + memcpy ( new->hdr.Name, name, name_len ); new->hdr.Misc.VirtualSize = section_memsz; new->hdr.VirtualAddress = shdr->sh_addr; new->hdr.SizeOfRawData = section_filesz; ++++++ build-Fix-s-directive-argument-is-null-e.patch ++++++ From: Valentine Barshak <[email protected]> Date: Sun, 9 Jun 2019 13:30:11 +0300 Subject: [build] Fix "'%s' directive argument is null" error Git-commit: 412acd7854de10e7194f362a6b1a3257a17974f7 References: bsc#1121464 Use '%p' directive, and print handle's address if the address is null and the handle doesn't have a name. This fixes the following compilation error: interface/efi/efi_debug.c:334:3: error: '%s' directive argument is null [-Werror=format-overflow=] Signed-off-by: Valentine Barshak <[email protected]> Signed-off-by: Michael Brown <[email protected]> Signed-off-by: Bruce Rogers <[email protected]> --- src/interface/efi/efi_debug.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/roms/ipxe/src/interface/efi/efi_debug.c b/roms/ipxe/src/interface/efi/efi_debug.c index 8ea0a822d044caca088c64ca2407..de9b1af5579cfddba1b55788b7b6 100644 --- a/roms/ipxe/src/interface/efi/efi_debug.c +++ b/roms/ipxe/src/interface/efi/efi_debug.c @@ -331,8 +331,7 @@ void dbg_efi_protocols ( EFI_HANDLE handle ) { /* Sanity check */ if ( ! handle ) { - printf ( "HANDLE %s could not retrieve protocols\n", - efi_handle_name ( handle ) ); + printf ( "HANDLE %p could not retrieve protocols\n", handle ); return; } ++++++ build-Workaround-compilation-error-with-.patch ++++++ From: Valentine Barshak <[email protected]> Date: Mon, 22 Jul 2019 10:47:50 +0100 Subject: [build] Workaround compilation error with gcc 9.1 Git-commit: 1dd56dbd11082fb622c2ed21cfaced4f47d798a6 References: bsc#1121464 Compiling with gcc 9.1 generates lots of "taking address of packed member of ... may result in an unaligned pointer value" warnings. Some of these warnings are genuine, and indicate correctly that parts of iPXE currently require the CPU (or runtime environment) to support unaligned accesses. For example: the TCP/IP receive data path will attempt to access 32-bit fields that may not be aligned to a 32-bit boundary. Other warnings are either spurious (such as when the pointer is to a variable-length byte array, which can have no alignment requirement anyway) or unhelpful (such as when the pointer is used solely to provide a debug colour value for the DBGC() macro). There appears to be no easy way to silence the spurious warnings. Since the ability to perform unaligned accesses is already a requirement for iPXE, work around the problem by silencing this class of warnings. Signed-off-by: Valentine Barshak <[email protected]> Modified-by: Michael Brown <[email protected]> Signed-off-by: Michael Brown <[email protected]> Signed-off-by: Bruce Rogers <[email protected]> --- src/Makefile.housekeeping | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/roms/ipxe/src/Makefile.housekeeping b/roms/ipxe/src/Makefile.housekeeping index f8334921b8b93cbd03f0a0de9910..4b09e81f0b1eb82e79f6af11986d 100644 --- a/roms/ipxe/src/Makefile.housekeeping +++ b/roms/ipxe/src/Makefile.housekeeping @@ -185,6 +185,15 @@ WNST_TEST = $(CC) -Wstringop-truncation -x c -c /dev/null -o /dev/null \ >/dev/null 2>&1 WNST_FLAGS := $(shell $(WNST_TEST) && $(ECHO) '-Wno-stringop-truncation') WORKAROUND_CFLAGS += $(WNST_FLAGS) + +# gcc 9.1 generates warnings for taking address of packed member which +# may result in an unaligned pointer value. Inhibit the warnings. +# +WNAPM_TEST = $(CC) -Wno-address-of-packed-member -x c -c /dev/null \ + -o /dev/null >/dev/null 2>&1 +WNAPM_FLAGS := $(shell $(WNAPM_TEST) && \ + $(ECHO) '-Wno-address-of-packed-member') +WORKAROUND_CFLAGS += $(WNAPM_FLAGS) endif # Some versions of gas choke on division operators, treating them as ++++++ bundles.tar.xz ++++++ Binary files old/fdd76fecdde1ad444ff4deb7f1c4f7e4a1ef97d6.bundle and new/fdd76fecdde1ad444ff4deb7f1c4f7e4a1ef97d6.bundle differ Binary files old/roms/ipxe/de4565cbe76ea9f7913a01f331be3ee901bb6e17.bundle and new/roms/ipxe/de4565cbe76ea9f7913a01f331be3ee901bb6e17.bundle differ Binary files old/roms/seabios/f21b5a4aeb020f2a5e2c6503f906a9349dd2f069.bundle and new/roms/seabios/f21b5a4aeb020f2a5e2c6503f906a9349dd2f069.bundle differ ++++++ docs-fix-trace-docs-build-with-sphinx-3..patch ++++++ From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <[email protected]> Date: Tue, 14 Jul 2020 17:26:59 +0100 Subject: docs: fix trace docs build with sphinx 3.1.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Git-commit: 0000000000000000000000000000000000000000 In Fedora 33 rawhide, we now have sphinx 3.1.1, as opposed to previous 2.2.2. This new version generates a warning on the source: docs/qemu-option-trace.rst.inc:4:Malformed option description '[enable=]PATTERN', should look like "opt", "-opt args", "--opt args", "/opt args" or "+opt args" This turns into an error when QEMU passes -W to sphinx-build Strangely the previous 2.2.2 code has the exact same logic for checking the syntax, but it is not being triggered. While it is only complaining about the first option, I changed all the options to give consistency. Signed-off-by: Daniel P. Berrangé <[email protected]> Signed-off-by: Bruce Rogers <[email protected]> --- docs/qemu-option-trace.rst.inc | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/qemu-option-trace.rst.inc b/docs/qemu-option-trace.rst.inc index 7e09773a9c518f6a47e9262b66c6..e79b0b43fcb3f5a05ad281109e6f 100644 --- a/docs/qemu-option-trace.rst.inc +++ b/docs/qemu-option-trace.rst.inc @@ -1,7 +1,7 @@ Specify tracing options. -.. option:: [enable=]PATTERN +.. option:: -trace [enable=]PATTERN Immediately enable events matching *PATTERN* (either event name or a globbing pattern). This option is only @@ -11,7 +11,7 @@ Specify tracing options. Use :option:`-trace help` to print a list of names of trace points. -.. option:: events=FILE +.. option:: -trace events=FILE Immediately enable events listed in *FILE*. The file must contain one event name (as listed in the ``trace-events-all`` @@ -19,7 +19,7 @@ Specify tracing options. available if QEMU has been compiled with the ``simple``, ``log`` or ``ftrace`` tracing backend. -.. option:: file=FILE +.. option:: -trace file=FILE Log output traces to *FILE*. This option is only available if QEMU has been compiled with ++++++ es1370-check-total-frame-count-against-c.patch ++++++ From: Prasad J Pandit <[email protected]> Date: Fri, 15 May 2020 01:36:08 +0530 Subject: es1370: check total frame count against current frame Git-commit: 369ff955a8497988d079c4e3fa1e93c2570c1c69 References: bsc#1172384, CVE-2020-13361 A guest user may set channel frame count via es1370_write() such that, in es1370_transfer_audio(), total frame count 'size' is lesser than the number of frames that are processed 'cnt'. int cnt = d->frame_cnt >> 16; int size = d->frame_cnt & 0xffff; if (size < cnt), it results in incorrect calculations leading to OOB access issue(s). Add check to avoid it. Reported-by: Ren Ding <[email protected]> Reported-by: Hanqing Zhao <[email protected]> Signed-off-by: Prasad J Pandit <[email protected]> Message-id: [email protected] Signed-off-by: Gerd Hoffmann <[email protected]> Signed-off-by: Bruce Rogers <[email protected]> --- hw/audio/es1370.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/hw/audio/es1370.c b/hw/audio/es1370.c index 89c4dabcd44fb2d7782e3cabc51d..5f8a83ff56241d94347c1e51419e 100644 --- a/hw/audio/es1370.c +++ b/hw/audio/es1370.c @@ -643,6 +643,9 @@ static void es1370_transfer_audio (ES1370State *s, struct chan *d, int loop_sel, int csc_bytes = (csc + 1) << d->shift; int cnt = d->frame_cnt >> 16; int size = d->frame_cnt & 0xffff; + if (size < cnt) { + return; + } int left = ((size - cnt + 1) << 2) + d->leftover; int transferred = 0; int temp = MIN (max, MIN (left, csc_bytes)); @@ -651,7 +654,7 @@ static void es1370_transfer_audio (ES1370State *s, struct chan *d, int loop_sel, addr += (cnt << 2) + d->leftover; if (index == ADC_CHANNEL) { - while (temp) { + while (temp > 0) { int acquired, to_copy; to_copy = MIN ((size_t) temp, sizeof (tmpbuf)); @@ -669,7 +672,7 @@ static void es1370_transfer_audio (ES1370State *s, struct chan *d, int loop_sel, else { SWVoiceOut *voice = s->dac_voice[index]; - while (temp) { + while (temp > 0) { int copied, to_copy; to_copy = MIN ((size_t) temp, sizeof (tmpbuf)); ++++++ exec-set-map-length-to-zero-when-returni.patch ++++++ From: Prasad J Pandit <[email protected]> Date: Tue, 26 May 2020 16:47:43 +0530 Subject: exec: set map length to zero when returning NULL MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Git-commit: 77f55eac6c433e23e82a1b88b2d74f385c4c7d82 References: bsc#1172386, CVE-2020-13659 When mapping physical memory into host's virtual address space, 'address_space_map' may return NULL if BounceBuffer is in_use. Set and return '*plen = 0' to avoid later NULL pointer dereference. Reported-by: Alexander Bulekov <[email protected]> Fixes: https://bugs.launchpad.net/qemu/+bug/1878259 Suggested-by: Paolo Bonzini <[email protected]> Suggested-by: Peter Maydell <[email protected]> Signed-off-by: Prasad J Pandit <[email protected]> Message-Id: <[email protected]> Reviewed-by: Philippe Mathieu-Daudé <[email protected]> Signed-off-by: Paolo Bonzini <[email protected]> Signed-off-by: Bruce Rogers <[email protected]> --- exec.c | 1 + include/exec/memory.h | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/exec.c b/exec.c index 2874bb508853d353bca3b9790e5d..2c419f327cf925ee55c46d111272 100644 --- a/exec.c +++ b/exec.c @@ -3538,6 +3538,7 @@ void *address_space_map(AddressSpace *as, if (!memory_access_is_direct(mr, is_write)) { if (atomic_xchg(&bounce.in_use, true)) { + *plen = 0; return NULL; } /* Avoid unbounded allocations */ diff --git a/include/exec/memory.h b/include/exec/memory.h index e000bd2f97b2fce76a41f9b5d9f3..8fa2d3cab2d51e5328e28151c65c 100644 --- a/include/exec/memory.h +++ b/include/exec/memory.h @@ -2303,7 +2303,8 @@ bool address_space_access_valid(AddressSpace *as, hwaddr addr, hwaddr len, /* address_space_map: map a physical memory region into a host virtual address * * May map a subset of the requested range, given by and returned in @plen. - * May return %NULL if resources needed to perform the mapping are exhausted. + * May return %NULL and set *@plen to zero(0), if resources needed to perform + * the mapping are exhausted. * Use only for reads OR writes - not for read-modify-write operations. * Use cpu_register_map_client() to know when retrying the map operation is * likely to succeed. ++++++ golan-Add-explicit-type-casts-for-nodnic.patch ++++++ From: Michael Brown <[email protected]> Date: Sat, 27 Jun 2020 20:43:32 +0100 Subject: [golan] Add explicit type casts for nodnic_queue_pair_type Git-commit: 8a1d66c7aec020f3e90254ed2fa55ecd9494fcc3 References: boo#1171139 GCC 10 emits warnings for implicit conversions of enumerated types. The flexboot_nodnic code defines nodnic_queue_pair_type with values identical to those of ib_queue_pair_type, and implicitly casts between them. Add an explicit cast to fix the warning. Signed-off-by: Michael Brown <[email protected]> Signed-off-by: Bruce Rogers <[email protected]> --- src/drivers/infiniband/flexboot_nodnic.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/roms/ipxe/src/drivers/infiniband/flexboot_nodnic.c b/roms/ipxe/src/drivers/infiniband/flexboot_nodnic.c index c13fcefc56866da67d701baa96b8..4463bb78458cbeadd962ed7909ef 100644 --- a/roms/ipxe/src/drivers/infiniband/flexboot_nodnic.c +++ b/roms/ipxe/src/drivers/infiniband/flexboot_nodnic.c @@ -365,7 +365,8 @@ static int flexboot_nodnic_create_qp ( struct ib_device *ibdev, goto qp_alloc_err; } - status = nodnic_port_create_qp(&port->port_priv, qp->type, + status = nodnic_port_create_qp(&port->port_priv, + (nodnic_queue_pair_type) qp->type, qp->send.num_wqes * sizeof(struct nodnic_send_wqbb), qp->send.num_wqes, qp->recv.num_wqes * sizeof(struct nodnic_recv_wqe), @@ -406,7 +407,8 @@ static void flexboot_nodnic_destroy_qp ( struct ib_device *ibdev, struct flexboot_nodnic_port *port = &flexboot_nodnic->port[ibdev->port - 1]; struct flexboot_nodnic_queue_pair *flexboot_nodnic_qp = ib_qp_get_drvdata ( qp ); - nodnic_port_destroy_qp(&port->port_priv, qp->type, + nodnic_port_destroy_qp(&port->port_priv, + (nodnic_queue_pair_type) qp->type, flexboot_nodnic_qp->nodnic_queue_pair); free(flexboot_nodnic_qp); ++++++ hw-vfio-pci-quirks-Fix-broken-legacy-IGD.patch ++++++ From: Thomas Huth <[email protected]> Date: Thu, 11 Jun 2020 11:36:40 -0600 Subject: hw/vfio/pci-quirks: Fix broken legacy IGD passthrough MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Git-commit: 643a4eacef87a318cf71800a4fb2ae1f78c4b245 The #ifdef CONFIG_VFIO_IGD in pci-quirks.c is not working since the required header config-devices.h is not included, so that the legacy IGD passthrough is currently broken. Let's include the right header to fix this issue. Buglink: https://bugs.launchpad.net/qemu/+bug/1882784 Fixes: 29d62771c81d ("hw/vfio: Move the IGD quirk code to a separate file") Signed-off-by: Thomas Huth <[email protected]> Reviewed-by: Philippe Mathieu-Daudé <[email protected]> Signed-off-by: Alex Williamson <[email protected]> Signed-off-by: Bruce Rogers <[email protected]> --- hw/vfio/pci-quirks.c | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/vfio/pci-quirks.c b/hw/vfio/pci-quirks.c index 2d348f8237fa6a8e7aac10a4a920..656098b827c69f04ac1d6e2ff227 100644 --- a/hw/vfio/pci-quirks.c +++ b/hw/vfio/pci-quirks.c @@ -11,6 +11,7 @@ */ #include "qemu/osdep.h" +#include "config-devices.h" #include "exec/memop.h" #include "qemu/units.h" #include "qemu/error-report.h" ++++++ intel-Avoid-spurious-compiler-warning-on.patch ++++++ From: Michael Brown <[email protected]> Date: Sat, 27 Jun 2020 20:21:11 +0100 Subject: [intel] Avoid spurious compiler warning on GCC 10 Git-commit: 28cf9806d1632d378485005babec295da0c77fcf References: boo#1171123 ` GCC 10 produces a spurious warning about an out-of-bounds array access for the unsized raw dword array in union intelvf_msg. Avoid the warning by embedding the zero-length array within a struct. Signed-off-by: Michael Brown <[email protected]> Signed-off-by: Bruce Rogers <[email protected]> --- src/drivers/net/intelvf.c | 18 ++++++++++-------- src/drivers/net/intelvf.h | 8 +++++++- 2 files changed, 17 insertions(+), 9 deletions(-) diff --git a/roms/ipxe/src/drivers/net/intelvf.c b/roms/ipxe/src/drivers/net/intelvf.c index ac6fea745457863544edf6658138..0d48b4178cb5aa0542ba7c507d04 100644 --- a/roms/ipxe/src/drivers/net/intelvf.c +++ b/roms/ipxe/src/drivers/net/intelvf.c @@ -52,14 +52,15 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); */ static void intelvf_mbox_write ( struct intel_nic *intel, const union intelvf_msg *msg ) { + const struct intelvf_msg_raw *raw = &msg->raw; unsigned int i; /* Write message */ DBGC2 ( intel, "INTEL %p sending message", intel ); - for ( i = 0 ; i < ( sizeof ( *msg ) / sizeof ( msg->dword[0] ) ) ; i++){ - DBGC2 ( intel, "%c%08x", ( i ? ':' : ' ' ), msg->dword[i] ); - writel ( msg->dword[i], ( intel->regs + intel->mbox.mem + - ( i * sizeof ( msg->dword[0] ) ) ) ); + for ( i = 0 ; i < ( sizeof ( *msg ) / sizeof ( raw->dword[0] ) ) ; i++){ + DBGC2 ( intel, "%c%08x", ( i ? ':' : ' ' ), raw->dword[i] ); + writel ( raw->dword[i], ( intel->regs + intel->mbox.mem + + ( i * sizeof ( raw->dword[0] ) ) ) ); } DBGC2 ( intel, "\n" ); } @@ -72,14 +73,15 @@ static void intelvf_mbox_write ( struct intel_nic *intel, */ static void intelvf_mbox_read ( struct intel_nic *intel, union intelvf_msg *msg ) { + struct intelvf_msg_raw *raw = &msg->raw; unsigned int i; /* Read message */ DBGC2 ( intel, "INTEL %p received message", intel ); - for ( i = 0 ; i < ( sizeof ( *msg ) / sizeof ( msg->dword[0] ) ) ; i++){ - msg->dword[i] = readl ( intel->regs + intel->mbox.mem + - ( i * sizeof ( msg->dword[0] ) ) ); - DBGC2 ( intel, "%c%08x", ( i ? ':' : ' ' ), msg->dword[i] ); + for ( i = 0 ; i < ( sizeof ( *msg ) / sizeof ( raw->dword[0] ) ) ; i++){ + raw->dword[i] = readl ( intel->regs + intel->mbox.mem + + ( i * sizeof ( raw->dword[0] ) ) ); + DBGC2 ( intel, "%c%08x", ( i ? ':' : ' ' ), raw->dword[i] ); } DBGC2 ( intel, "\n" ); } diff --git a/roms/ipxe/src/drivers/net/intelvf.h b/roms/ipxe/src/drivers/net/intelvf.h index ab404698fe6de9f48370931fdf56..ffb18e04052f1b4a6fe406f5062c 100644 --- a/roms/ipxe/src/drivers/net/intelvf.h +++ b/roms/ipxe/src/drivers/net/intelvf.h @@ -119,6 +119,12 @@ struct intelvf_msg_queues { uint32_t dflt; } __attribute__ (( packed )); +/** Raw mailbox message */ +struct intelvf_msg_raw { + /** Raw dwords */ + uint32_t dword[0]; +} __attribute__ (( packed )); + /** Mailbox message */ union intelvf_msg { /** Message header */ @@ -132,7 +138,7 @@ union intelvf_msg { /** Queue configuration message */ struct intelvf_msg_queues queues; /** Raw dwords */ - uint32_t dword[0]; + struct intelvf_msg_raw raw; }; /** Maximum time to wait for mailbox message ++++++ ipxe-Makefile-fix-issues-of-build-reprod.patch ++++++ --- /var/tmp/diff_new_pack.972iwf/_old 2020-07-26 16:15:54.852621831 +0200 +++ /var/tmp/diff_new_pack.972iwf/_new 2020-07-26 16:15:54.856621834 +0200 @@ -14,10 +14,10 @@ 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/roms/ipxe/src/Makefile.housekeeping b/roms/ipxe/src/Makefile.housekeeping -index f8334921b8b93cbd03f0a0de9910..97fa325bb52314e05192d0414436 100644 +index 893bd20f1fd5cecf0e480dee05bd..9c33cc08c4db1bbd0f9966924fce 100644 --- a/roms/ipxe/src/Makefile.housekeeping +++ b/roms/ipxe/src/Makefile.housekeeping -@@ -1162,11 +1162,18 @@ blib : $(BLIB) +@@ -1172,11 +1172,18 @@ blib : $(BLIB) # Command to generate build ID. Must be unique for each $(BIN)/%.tmp, # even within the same build run. # @@ -38,7 +38,7 @@ # Build version # -@@ -1186,7 +1193,7 @@ $(BIN)/version.%.o : core/version.c $(MAKEDEPS) $(GIT_INDEX) +@@ -1196,7 +1203,7 @@ $(BIN)/version.%.o : core/version.c $(MAKEDEPS) $(GIT_INDEX) $(BIN)/%.tmp : $(BIN)/version.%.o $(BLIB) $(MAKEDEPS) $(LDSCRIPT) $(QM)$(ECHO) " [LD] $@" $(Q)$(LD) $(LDFLAGS) -T $(LDSCRIPT) $(TGT_LD_FLAGS) $< $(BLIB) -o $@ \ ++++++ megasas-use-unsigned-type-for-reply_queu.patch ++++++ From: Prasad J Pandit <[email protected]> Date: Thu, 14 May 2020 00:55:38 +0530 Subject: megasas: use unsigned type for reply_queue_head and check index Git-commit: f50ab86a2620bd7e8507af865b164655ee921661 References: bsc#1172383, CVE-2020-13362 A guest user may set 'reply_queue_head' field of MegasasState to a negative value. Later in 'megasas_lookup_frame' it is used to index into s->frames[] array. Use unsigned type to avoid OOB access issue. Also check that 'index' value stays within s->frames[] bounds through the while() loop in 'megasas_lookup_frame' to avoid OOB access. Reported-by: Ren Ding <[email protected]> Reported-by: Hanqing Zhao <[email protected]> Reported-by: Alexander Bulekov <[email protected]> Signed-off-by: Prasad J Pandit <[email protected]> Acked-by: Alexander Bulekov <[email protected]> Message-Id: <[email protected]> Signed-off-by: Paolo Bonzini <[email protected]> Signed-off-by: Bruce Rogers <[email protected]> --- hw/scsi/megasas.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c index af18c88b656e7f5fa299c5f0dda1..6ce598cd6908b5223470b506c481 100644 --- a/hw/scsi/megasas.c +++ b/hw/scsi/megasas.c @@ -112,7 +112,7 @@ typedef struct MegasasState { uint64_t reply_queue_pa; void *reply_queue; int reply_queue_len; - int reply_queue_head; + uint16_t reply_queue_head; int reply_queue_tail; uint64_t consumer_pa; uint64_t producer_pa; @@ -445,7 +445,7 @@ static MegasasCmd *megasas_lookup_frame(MegasasState *s, index = s->reply_queue_head; - while (num < s->fw_cmds) { + while (num < s->fw_cmds && index < MEGASAS_MAX_FRAMES) { if (s->frames[index].pa && s->frames[index].pa == frame) { cmd = &s->frames[index]; break; ++++++ nbd-server-Avoid-long-error-message-asse.patch ++++++ From: Eric Blake <[email protected]> Date: Mon, 8 Jun 2020 13:26:37 -0500 Subject: nbd/server: Avoid long error message assertions CVE-2020-10761 Git-commit: 5c4fe018c025740fef4a0a4421e8162db0c3eefd References: bsc#1172710, CVE-2020-10761 Ever since commit 36683283 (v2.8), the server code asserts that error strings sent to the client are well-formed per the protocol by not exceeding the maximum string length of 4096. At the time the server first started sending error messages, the assertion could not be triggered, because messages were completely under our control. However, over the years, we have added latent scenarios where a client could trigger the server to attempt an error message that would include the client's information if it passed other checks first: - requesting NBD_OPT_INFO/GO on an export name that is not present (commit 0cfae925 in v2.12 echoes the name) - requesting NBD_OPT_LIST/SET_META_CONTEXT on an export name that is not present (commit e7b1948d in v2.12 echoes the name) At the time, those were still safe because we flagged names larger than 256 bytes with a different message; but that changed in commit 93676c88 (v4.2) when we raised the name limit to 4096 to match the NBD string limit. (That commit also failed to change the magic number 4096 in nbd_negotiate_send_rep_err to the just-introduced named constant.) So with that commit, long client names appended to server text can now trigger the assertion, and thus be used as a denial of service attack against a server. As a mitigating factor, if the server requires TLS, the client cannot trigger the problematic paths unless it first supplies TLS credentials, and such trusted clients are less likely to try to intentionally crash the server. We may later want to further sanitize the user-supplied strings we place into our error messages, such as scrubbing out control characters, but that is less important to the CVE fix, so it can be a later patch to the new nbd_sanitize_name. Consideration was given to changing the assertion in nbd_negotiate_send_rep_verr to instead merely log a server error and truncate the message, to avoid leaving a latent path that could trigger a future CVE DoS on any new error message. However, this merely complicates the code for something that is already (correctly) flagging coding errors, and now that we are aware of the long message pitfall, we are less likely to introduce such errors in the future, which would make such error handling dead code. Reported-by: Xueqiang Wei <[email protected]> CC: [email protected] Fixes: https://bugzilla.redhat.com/1843684 CVE-2020-10761 Fixes: 93676c88d7 Signed-off-by: Eric Blake <[email protected]> Message-Id: <[email protected]> Reviewed-by: Vladimir Sementsov-Ogievskiy <[email protected]> Signed-off-by: Bruce Rogers <[email protected]> --- nbd/server.c | 23 ++++++++++++++++++++--- tests/qemu-iotests/143 | 4 ++++ tests/qemu-iotests/143.out | 2 ++ 3 files changed, 26 insertions(+), 3 deletions(-) diff --git a/nbd/server.c b/nbd/server.c index 02b1ed080145b3f99979887d4268..20754e9ebc3c1342692c99e7a99f 100644 --- a/nbd/server.c +++ b/nbd/server.c @@ -217,7 +217,7 @@ nbd_negotiate_send_rep_verr(NBDClient *client, uint32_t type, msg = g_strdup_vprintf(fmt, va); len = strlen(msg); - assert(len < 4096); + assert(len < NBD_MAX_STRING_SIZE); trace_nbd_negotiate_send_rep_err(msg); ret = nbd_negotiate_send_rep_len(client, type, len, errp); if (ret < 0) { @@ -231,6 +231,19 @@ nbd_negotiate_send_rep_verr(NBDClient *client, uint32_t type, return 0; } +/* + * Return a malloc'd copy of @name suitable for use in an error reply. + */ +static char * +nbd_sanitize_name(const char *name) +{ + if (strnlen(name, 80) < 80) { + return g_strdup(name); + } + /* XXX Should we also try to sanitize any control characters? */ + return g_strdup_printf("%.80s...", name); +} + /* Send an error reply. * Return -errno on error, 0 on success. */ static int GCC_FMT_ATTR(4, 5) @@ -595,9 +608,11 @@ static int nbd_negotiate_handle_info(NBDClient *client, Error **errp) exp = nbd_export_find(name); if (!exp) { + g_autofree char *sane_name = nbd_sanitize_name(name); + return nbd_negotiate_send_rep_err(client, NBD_REP_ERR_UNKNOWN, errp, "export '%s' not present", - name); + sane_name); } /* Don't bother sending NBD_INFO_NAME unless client requested it */ @@ -995,8 +1010,10 @@ static int nbd_negotiate_meta_queries(NBDClient *client, meta->exp = nbd_export_find(export_name); if (meta->exp == NULL) { + g_autofree char *sane_name = nbd_sanitize_name(export_name); + return nbd_opt_drop(client, NBD_REP_ERR_UNKNOWN, errp, - "export '%s' not present", export_name); + "export '%s' not present", sane_name); } ret = nbd_opt_read(client, &nb_queries, sizeof(nb_queries), errp); diff --git a/tests/qemu-iotests/143 b/tests/qemu-iotests/143 index f649b36195011e9b0f19e4b51a8d..d2349903b1b5fa1b48ffc3e7a00d 100755 --- a/tests/qemu-iotests/143 +++ b/tests/qemu-iotests/143 @@ -58,6 +58,10 @@ _send_qemu_cmd $QEMU_HANDLE \ $QEMU_IO_PROG -f raw -c quit \ "nbd+unix:///no_such_export?socket=$SOCK_DIR/nbd" 2>&1 \ | _filter_qemu_io | _filter_nbd +# Likewise, with longest possible name permitted in NBD protocol +$QEMU_IO_PROG -f raw -c quit \ + "nbd+unix:///$(printf %4096d 1 | tr ' ' a)?socket=$SOCK_DIR/nbd" 2>&1 \ + | _filter_qemu_io | _filter_nbd | sed 's/aaaa*aa/aa--aa/' _send_qemu_cmd $QEMU_HANDLE \ "{ 'execute': 'quit' }" \ diff --git a/tests/qemu-iotests/143.out b/tests/qemu-iotests/143.out index 1f4001c6013137a13d90f64b4f86..fc9c0a761fa107a5c800d27af843 100644 --- a/tests/qemu-iotests/143.out +++ b/tests/qemu-iotests/143.out @@ -5,6 +5,8 @@ QA output created by 143 {"return": {}} qemu-io: can't open device nbd+unix:///no_such_export?socket=SOCK_DIR/nbd: Requested export not available server reported: export 'no_such_export' not present +qemu-io: can't open device nbd+unix:///aa--aa1?socket=SOCK_DIR/nbd: Requested export not available +server reported: export 'aa--aa...' not present { 'execute': 'quit' } {"return": {}} {"timestamp": {"seconds": TIMESTAMP, "microseconds": TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}} ++++++ qemu.spec.in ++++++ --- /var/tmp/diff_new_pack.972iwf/_old 2020-07-26 16:15:55.016621969 +0200 +++ /var/tmp/diff_new_pack.972iwf/_new 2020-07-26 16:15:55.016621969 +0200 @@ -1297,7 +1297,7 @@ # Compile the QOM test binary first, so that ... touch -r config-host.mak pc-bios -make %{?_smp_mflags} tests/qtest/qom-test %{?_smp_mflags} V=1 +make %{?_smp_mflags} tests/qtest/qom-test V=1 # ... make comes in fresh and has lots of address space (needed for 32bit, bsc#957379) make %{?_smp_mflags} check-report.tap V=1 ++++++ s390x-Add-SIDA-memory-ops.patch ++++++ --- /var/tmp/diff_new_pack.972iwf/_old 2020-07-26 16:15:55.036621986 +0200 +++ /var/tmp/diff_new_pack.972iwf/_new 2020-07-26 16:15:55.036621986 +0200 @@ -2,6 +2,7 @@ Date: Wed, 5 Feb 2020 06:57:35 -0500 Subject: s390x: Add SIDA memory ops +Git-commit a9f21cec3bc9c86062c7c24bb2143d22cb3c2950 References: bsc#1167075 Protected guests save the instruction control blocks in the SIDA @@ -17,7 +18,6 @@ Reviewed-by: Christian Borntraeger <[email protected]> Reviewed-by: Claudio Imbrenda <[email protected]> Reviewed-by: Cornelia Huck <[email protected]> -(cherry picked from commit a9f21cec3bc9c86062c7c24bb2143d22cb3c2950) Signed-off-by: Bruce Rogers <[email protected]> --- target/s390x/cpu.h | 7 ++++++- ++++++ s390x-Add-unpack-facility-feature-to-GA1.patch ++++++ --- /var/tmp/diff_new_pack.972iwf/_old 2020-07-26 16:15:55.044621993 +0200 +++ /var/tmp/diff_new_pack.972iwf/_new 2020-07-26 16:15:55.044621993 +0200 @@ -2,6 +2,7 @@ Date: Tue, 25 Feb 2020 06:28:51 -0500 Subject: s390x: Add unpack facility feature to GA1 +Git-commit: 3034eaac3b2970ba85a1d77814ceef1352d05357 References: bsc#1167075 The unpack facility is an indication that diagnose 308 subcodes 8-10 @@ -21,7 +22,6 @@ Reviewed-by: Claudio Imbrenda <[email protected]> Reviewed-by: Cornelia Huck <[email protected]> Signed-off-by: Janosch Frank <[email protected]> -(cherry picked from commit 3034eaac3b2970ba85a1d77814ceef1352d05357) Signed-off-by: Bruce Rogers <[email protected]> --- target/s390x/gen-features.c | 1 + ++++++ s390x-Move-diagnose-308-subcodes-and-rcs.patch ++++++ --- /var/tmp/diff_new_pack.972iwf/_old 2020-07-26 16:15:55.056622003 +0200 +++ /var/tmp/diff_new_pack.972iwf/_new 2020-07-26 16:15:55.060622006 +0200 @@ -2,13 +2,13 @@ Date: Fri, 13 Mar 2020 10:35:02 -0400 Subject: s390x: Move diagnose 308 subcodes and rcs into ipl.h +Git-commit: 284bc3dd6e9a978e6e34b00777ce72007a88d6d9 References: bsc#1167075 They are part of the IPL process, so let's put them into the ipl header. Signed-off-by: Janosch Frank <[email protected]> -(cherry picked from commit 284bc3dd6e9a978e6e34b00777ce72007a88d6d9) Signed-off-by: Bruce Rogers <[email protected]> --- hw/s390x/ipl.h | 11 +++++++++++ ++++++ s390x-protvirt-Add-migration-blocker.patch ++++++ --- /var/tmp/diff_new_pack.972iwf/_old 2020-07-26 16:15:55.068622013 +0200 +++ /var/tmp/diff_new_pack.972iwf/_new 2020-07-26 16:15:55.068622013 +0200 @@ -2,6 +2,7 @@ Date: Fri, 6 Mar 2020 06:40:13 -0500 Subject: s390x: protvirt: Add migration blocker +Git-commit: e721e55a3dabb2897081614b17dd4565e85249ac References: bsc#1167075 Migration is not yet supported. @@ -11,7 +12,6 @@ Reviewed-by: Christian Borntraeger <[email protected]> Reviewed-by: Claudio Imbrenda <[email protected]> Reviewed-by: Cornelia Huck <[email protected]> -(cherry picked from commit e721e55a3dabb2897081614b17dd4565e85249ac) Signed-off-by: Bruce Rogers <[email protected]> --- hw/s390x/s390-virtio-ccw.c | 18 ++++++++++++++++++ ++++++ s390x-protvirt-Disable-address-checks-fo.patch ++++++ --- /var/tmp/diff_new_pack.972iwf/_old 2020-07-26 16:15:55.080622023 +0200 +++ /var/tmp/diff_new_pack.972iwf/_new 2020-07-26 16:15:55.080622023 +0200 @@ -2,6 +2,7 @@ Date: Fri, 29 Nov 2019 04:22:41 -0500 Subject: s390x: protvirt: Disable address checks for PV guest IO emulation +Git-commit f658bf14295ad49caf8d1b21033982ce69423fb7 References: bsc#1167075 IO instruction data is routed through SIDAD for protected guests, so @@ -16,7 +17,6 @@ Reviewed-by: Christian Borntraeger <[email protected]> Reviewed-by: Claudio Imbrenda <[email protected]> Reviewed-by: Cornelia Huck <[email protected]> -(cherry picked from commit f658bf14295ad49caf8d1b21033982ce69423fb7) Signed-off-by: Bruce Rogers <[email protected]> --- target/s390x/ioinst.c | 35 ++++++++++++++++++++++++++++------- ++++++ s390x-protvirt-Handle-SIGP-store-status-.patch ++++++ --- /var/tmp/diff_new_pack.972iwf/_old 2020-07-26 16:15:55.092622033 +0200 +++ /var/tmp/diff_new_pack.972iwf/_new 2020-07-26 16:15:55.092622033 +0200 @@ -2,6 +2,7 @@ Date: Tue, 6 Aug 2019 15:40:05 +0200 Subject: s390x: protvirt: Handle SIGP store status correctly +Git-commit: 398fc6874438c320407449d1c9560925aba2280b References: bsc#1167075 For protected VMs status storing is not done by QEMU anymore. @@ -12,7 +13,6 @@ Reviewed-by: Christian Borntraeger <[email protected]> Reviewed-by: Claudio Imbrenda <[email protected]> Reviewed-by: Cornelia Huck <[email protected]> -(cherry picked from commit 398fc6874438c320407449d1c9560925aba2280b) Signed-off-by: Bruce Rogers <[email protected]> --- target/s390x/helper.c | 6 ++++++ ++++++ s390x-protvirt-Inhibit-balloon-when-swit.patch ++++++ --- /var/tmp/diff_new_pack.972iwf/_old 2020-07-26 16:15:55.104622043 +0200 +++ /var/tmp/diff_new_pack.972iwf/_new 2020-07-26 16:15:55.104622043 +0200 @@ -2,6 +2,7 @@ Date: Mon, 24 Feb 2020 07:49:06 -0500 Subject: s390x: protvirt: Inhibit balloon when switching to protected mode +Git-commit: 59dc32a3494d6afdd420f3e401f1f324a1179256 References: bsc#1167075 Ballooning in protected VMs can only be done when the guest shares the @@ -29,7 +30,6 @@ Reviewed-by: Christian Borntraeger <[email protected]> Reviewed-by: Claudio Imbrenda <[email protected]> Reviewed-by: Cornelia Huck <[email protected]> -(cherry picked from commit 59dc32a3494d6afdd420f3e401f1f324a1179256) Signed-off-by: Bruce Rogers <[email protected]> --- hw/s390x/s390-virtio-ccw.c | 11 +++++++++++ ++++++ s390x-protvirt-KVM-intercept-changes.patch ++++++ --- /var/tmp/diff_new_pack.972iwf/_old 2020-07-26 16:15:55.116622053 +0200 +++ /var/tmp/diff_new_pack.972iwf/_new 2020-07-26 16:15:55.116622053 +0200 @@ -2,6 +2,7 @@ Date: Mon, 13 May 2019 10:35:27 +0200 Subject: s390x: protvirt: KVM intercept changes +Git-commit: fd70eb764f176c200d6723c2ad88362f23536bfa References: bsc#1167075 Protected VMs no longer intercept with code 4 for an instruction @@ -30,7 +31,6 @@ Reviewed-by: Christian Borntraeger <[email protected]> Reviewed-by: Claudio Imbrenda <[email protected]> Reviewed-by: Cornelia Huck <[email protected]> -(cherry picked from commit fd70eb764f176c200d6723c2ad88362f23536bfa) Signed-off-by: Bruce Rogers <[email protected]> --- target/s390x/kvm.c | 4 ++++ ++++++ s390x-protvirt-Move-IO-control-structure.patch ++++++ --- /var/tmp/diff_new_pack.972iwf/_old 2020-07-26 16:15:55.128622063 +0200 +++ /var/tmp/diff_new_pack.972iwf/_new 2020-07-26 16:15:55.128622063 +0200 @@ -2,6 +2,7 @@ Date: Wed, 5 Feb 2020 07:02:33 -0500 Subject: s390x: protvirt: Move IO control structures over SIDA +Git-commit: 4989e18cbe5621df39020ef812316f479d8f5246 References: bsc#1167075 For protected guests, we need to put the IO emulation results into the @@ -10,7 +11,6 @@ Signed-off-by: Janosch Frank <[email protected]> Reviewed-by: David Hildenbrand <[email protected]> Reviewed-by: Cornelia Huck <[email protected]> -(cherry picked from commit 4989e18cbe5621df39020ef812316f479d8f5246) Signed-off-by: Bruce Rogers <[email protected]> --- target/s390x/ioinst.c | 61 +++++++++++++++++++++++++++++++------------ ++++++ s390x-protvirt-Move-STSI-data-over-SIDAD.patch ++++++ --- /var/tmp/diff_new_pack.972iwf/_old 2020-07-26 16:15:55.140622073 +0200 +++ /var/tmp/diff_new_pack.972iwf/_new 2020-07-26 16:15:55.140622073 +0200 @@ -2,6 +2,7 @@ Date: Wed, 5 Feb 2020 07:02:51 -0500 Subject: s390x: protvirt: Move STSI data over SIDAD +Git-commit: ccce7a654911ae507c962aff5f41004a7a88fad6 References: bsc#1167075 For protected guests, we need to put the STSI emulation results into @@ -11,7 +12,6 @@ Reviewed-by: David Hildenbrand <[email protected]> Reviewed-by: Claudio Imbrenda <[email protected]> Reviewed-by: Cornelia Huck <[email protected]> -(cherry picked from commit ccce7a654911ae507c962aff5f41004a7a88fad6) Signed-off-by: Bruce Rogers <[email protected]> --- target/s390x/kvm.c | 11 +++++++++-- ++++++ s390x-protvirt-Move-diag-308-data-over-S.patch ++++++ --- /var/tmp/diff_new_pack.972iwf/_old 2020-07-26 16:15:55.152622083 +0200 +++ /var/tmp/diff_new_pack.972iwf/_new 2020-07-26 16:15:55.152622083 +0200 @@ -2,6 +2,7 @@ Date: Wed, 31 Jul 2019 17:49:08 +0200 Subject: s390x: protvirt: Move diag 308 data over SIDA +Git-commit: 258da1c7736d3aa4604ceea6cce00995c6f30058 References: bsc#1167075 For protected guests the IPIB is written/read to/from the SIDA, so we @@ -12,7 +13,6 @@ Reviewed-by: Christian Borntraeger <[email protected]> Reviewed-by: Claudio Imbrenda <[email protected]> Reviewed-by: Cornelia Huck <[email protected]> -(cherry picked from commit 258da1c7736d3aa4604ceea6cce00995c6f30058) Signed-off-by: Bruce Rogers <[email protected]> --- target/s390x/diag.c | 25 ++++++++++++++++++++----- ++++++ s390x-protvirt-SCLP-interpretation.patch ++++++ --- /var/tmp/diff_new_pack.972iwf/_old 2020-07-26 16:15:55.164622093 +0200 +++ /var/tmp/diff_new_pack.972iwf/_new 2020-07-26 16:15:55.164622093 +0200 @@ -2,6 +2,7 @@ Date: Mon, 3 Jun 2019 16:40:29 +0200 Subject: s390x: protvirt: SCLP interpretation +Git-commit: 32633cf4539341180dbc7a92c2655c711b4a6996 References: bsc#1167075 SCLP for a protected guest is done over the SIDAD, so we need to use @@ -16,7 +17,6 @@ Reviewed-by: David Hildenbrand <[email protected]> Reviewed-by: Claudio Imbrenda <[email protected]> Reviewed-by: Cornelia Huck <[email protected]> -(cherry picked from commit 32633cf4539341180dbc7a92c2655c711b4a6996) Signed-off-by: Bruce Rogers <[email protected]> --- hw/s390x/sclp.c | 56 +++++++++++++++++++++++++++++++++-------- ++++++ s390x-protvirt-Set-guest-IPL-PSW.patch ++++++ --- /var/tmp/diff_new_pack.972iwf/_old 2020-07-26 16:15:55.176622104 +0200 +++ /var/tmp/diff_new_pack.972iwf/_new 2020-07-26 16:15:55.176622104 +0200 @@ -2,6 +2,7 @@ Date: Tue, 23 Jul 2019 13:17:32 +0200 Subject: s390x: protvirt: Set guest IPL PSW +Git-commit: e8686d9849f1625f4f4b28403f0555181b72d1b6 References: bsc#1167075 Handling of CPU reset and setting of the IPL psw from guest storage at @@ -14,7 +15,6 @@ Reviewed-by: Christian Borntraeger <[email protected]> Reviewed-by: Claudio Imbrenda <[email protected]> Reviewed-by: Cornelia Huck <[email protected]> -(cherry picked from commit e8686d9849f1625f4f4b28403f0555181b72d1b6) Signed-off-by: Bruce Rogers <[email protected]> --- target/s390x/cpu.c | 26 +++++++++++++++++--------- ++++++ s390x-protvirt-Support-unpack-facility.patch ++++++ --- /var/tmp/diff_new_pack.972iwf/_old 2020-07-26 16:15:55.184622110 +0200 +++ /var/tmp/diff_new_pack.972iwf/_new 2020-07-26 16:15:55.188622114 +0200 @@ -2,6 +2,7 @@ Date: Mon, 11 Feb 2019 16:07:19 +0100 Subject: s390x: protvirt: Support unpack facility +Git-commit: 2150c92b9b7d12b5fbdd2c59e5b17197d28f53db References: bsc#1167075 The unpack facility provides the means to setup a protected guest. A @@ -23,7 +24,6 @@ Reviewed-by: David Hildenbrand <[email protected]> Reviewed-by: Claudio Imbrenda <[email protected]> Reviewed-by: Cornelia Huck <[email protected]> -(cherry picked from commit 2150c92b9b7d12b5fbdd2c59e5b17197d28f53db) [BR: Needed to fix a compiler warning on i586 in hw/s390x/ipl.c] Signed-off-by: Bruce Rogers <[email protected]> --- ++++++ tests-Disable-some-block-tests-for-now.patch ++++++ --- /var/tmp/diff_new_pack.972iwf/_old 2020-07-26 16:15:55.280622191 +0200 +++ /var/tmp/diff_new_pack.972iwf/_new 2020-07-26 16:15:55.284622194 +0200 @@ -2,48 +2,22 @@ Date: Wed, 2 Oct 2019 07:28:04 -0600 Subject: tests: Disable some block tests for now -For a very long time we've experienced intermittent failure of some -block tests. There doesn't seem to be an obvious cause. Given that we -now build qemu using multibuild, the qemu-testsuite failure is now more -problematic to just ignore. Until we can address these failures, which -seem to be tied to the build environment in some way, disable the tests -which are either randomly or reliably failing. - -Currently, this patch is based on these failures seen on 09OCT2019 on -v4.1.0 qemu: -disable 065, 129, 169, 182, 205, 218, 242, 248, 250 -(other architectures not evaluated at this time) +Most tests previously disabled for qemu-testsuite to be able to complete +successfully are no longer (as of v4.1) listed as auto, and therefore +do not get run anymore. 27NOV2019 - added 161 since it is failing on s390x and ppc consistently Signed-off-by: Bruce Rogers <[email protected]> --- - tests/qemu-iotests/group | 20 ++++++++++---------- - 1 file changed, 10 insertions(+), 10 deletions(-) + tests/qemu-iotests/group | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/qemu-iotests/group b/tests/qemu-iotests/group -index 435dccd5af90754a3f80f4455bdb..8409dad73f2cbd7447235ea10b03 100644 +index 435dccd5af90754a3f80f4455bdb..a6c8ed8a5cdef50383594305c0c1 100644 --- a/tests/qemu-iotests/group +++ b/tests/qemu-iotests/group -@@ -86,7 +86,7 @@ - 062 rw auto quick - 063 rw auto quick - 064 rw quick --065 rw quick -+#DISABLE FOR NOW 065 rw quick - 066 rw auto quick - 067 rw quick - 068 rw quick -@@ -150,7 +150,7 @@ - 126 rw auto backing - 127 rw auto backing quick - 128 rw quick --129 rw quick -+#DISABLE FOR NOW 129 rw quick - 130 rw quick - 131 rw quick - 132 rw quick -@@ -182,11 +182,11 @@ +@@ -182,7 +182,7 @@ 158 rw auto quick 159 rw auto quick 160 rw quick @@ -52,54 +26,3 @@ 162 quick 163 rw 165 rw quick --169 rw quick migration -+#DISABLE FOR NOW 169 rw quick migration - 170 rw auto quick - 171 rw quick - 172 auto -@@ -198,7 +198,7 @@ - 178 img - 179 rw auto quick - 181 rw auto migration --182 rw quick -+#DISABLE FOR NOW 182 rw quick - 183 rw migration - 184 rw auto quick - 185 rw -@@ -220,7 +220,7 @@ - 202 rw quick - 203 rw auto migration - 204 rw quick --205 rw quick -+#DISABLE FOR NOW 205 rw quick - 206 rw - 207 rw - 208 rw quick -@@ -233,7 +233,7 @@ - 215 rw quick - 216 rw quick - 217 rw auto quick --218 rw quick -+#DISABLE FOR NOW 218 rw quick - 219 rw - 220 rw auto - 221 rw quick -@@ -256,15 +256,15 @@ - 239 rw quick - 240 quick - 241 rw quick --242 rw quick -+#DISABLE FOR NOW 242 rw quick - 243 rw quick - 244 rw auto quick - 245 rw - 246 rw quick - 247 rw quick --248 rw quick -+#DISABLE FOR NOW 248 rw quick - 249 rw auto quick --250 rw quick -+#DISABLE FOR NOW 250 rw quick - 251 rw auto quick - 252 rw auto backing quick - 253 rw quick ++++++ vga-fix-cirrus-bios.patch ++++++ From: Gerd Hoffmann <[email protected]> Date: Thu, 25 Jun 2020 11:17:09 +0200 Subject: vga: fix cirrus bios Git-commit: d11c75185276ded944f2ea0277532b7fee849bbc Little mistake, big effect. The patch adding the ati driver broke cirrus due to a missing "else", which effectively downgrades cirrus to standard vga. Fixes: 34b6ecc16074 ("vga: add atiext driver") Signed-off-by: Gerd Hoffmann <[email protected]> Signed-off-by: Bruce Rogers <[email protected]> --- vgasrc/vgahw.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roms/seabios/vgasrc/vgahw.h b/roms/seabios/vgasrc/vgahw.h index c774f4f2c6b7c8012096bac2f0ed..8b64660e5ef70d71b440013300bc 100644 --- a/roms/seabios/vgasrc/vgahw.h +++ b/roms/seabios/vgasrc/vgahw.h @@ -36,7 +36,7 @@ static inline int vgahw_set_mode(struct vgamode_s *vmode_g, int flags) { static inline void vgahw_list_modes(u16 seg, u16 *dest, u16 *last) { if (CONFIG_VGA_CIRRUS) clext_list_modes(seg, dest, last); - if (CONFIG_VGA_ATI) + else if (CONFIG_VGA_ATI) ati_list_modes(seg, dest, last); else if (CONFIG_VGA_BOCHS) bochsvga_list_modes(seg, dest, last);
