summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--meta/conf/distro/include/tcmode-default.inc2
-rw-r--r--meta/recipes-devtools/qemu/qemu-native_9.0.0.bb (renamed from meta/recipes-devtools/qemu/qemu-native_8.2.1.bb)0
-rw-r--r--meta/recipes-devtools/qemu/qemu-system-native_9.0.0.bb (renamed from meta/recipes-devtools/qemu/qemu-system-native_8.2.1.bb)0
-rw-r--r--meta/recipes-devtools/qemu/qemu.inc55
-rw-r--r--meta/recipes-devtools/qemu/qemu/0001-linux-user-x86_64-Handle-the-vsyscall-page-in-open_s.patch56
-rw-r--r--meta/recipes-devtools/qemu/qemu/0001-qemu-Add-addition-environment-space-to-boot-loader-q.patch18
-rw-r--r--meta/recipes-devtools/qemu/qemu/0002-apic-fixup-fallthrough-to-PIC.patch (renamed from meta/recipes-devtools/qemu/qemu/0003-apic-fixup-fallthrough-to-PIC.patch)18
-rw-r--r--meta/recipes-devtools/qemu/qemu/0002-linux-user-loongarch64-Remove-TARGET_FORCE_SHMLBA.patch43
-rw-r--r--meta/recipes-devtools/qemu/qemu/0003-configure-Add-pkg-config-handling-for-libgcrypt.patch (renamed from meta/recipes-devtools/qemu/qemu/0004-configure-Add-pkg-config-handling-for-libgcrypt.patch)18
-rw-r--r--meta/recipes-devtools/qemu/qemu/0003-linux-user-Add-strace-for-shmat.patch71
-rw-r--r--meta/recipes-devtools/qemu/qemu/0004-linux-user-Rewrite-target_shmat.patch236
-rw-r--r--meta/recipes-devtools/qemu/qemu/0004-qemu-Do-not-include-file-if-not-exists.patch (renamed from meta/recipes-devtools/qemu/qemu/0005-qemu-Do-not-include-file-if-not-exists.patch)18
-rw-r--r--meta/recipes-devtools/qemu/qemu/0005-qemu-Add-some-user-space-mmap-tweaks-to-address-musl.patch (renamed from meta/recipes-devtools/qemu/qemu/0006-qemu-Add-some-user-space-mmap-tweaks-to-address-musl.patch)18
-rw-r--r--meta/recipes-devtools/qemu/qemu/0005-tests-tcg-Check-that-shmat-does-not-break-proc-self-.patch85
-rw-r--r--meta/recipes-devtools/qemu/qemu/0006-qemu-Determinism-fixes.patch (renamed from meta/recipes-devtools/qemu/qemu/0007-qemu-Determinism-fixes.patch)18
-rw-r--r--meta/recipes-devtools/qemu/qemu/0007-tests-meson.build-use-relative-path-to-refer-to-file.patch (renamed from meta/recipes-devtools/qemu/qemu/0008-tests-meson.build-use-relative-path-to-refer-to-file.patch)20
-rw-r--r--meta/recipes-devtools/qemu/qemu/0008-Define-MAP_SYNC-and-MAP_SHARED_VALIDATE-on-needed-li.patch (renamed from meta/recipes-devtools/qemu/qemu/0009-Define-MAP_SYNC-and-MAP_SHARED_VALIDATE-on-needed-li.patch)16
-rw-r--r--meta/recipes-devtools/qemu/qemu/0009-linux-user-Replace-use-of-lfs64-related-functions-an.patch (renamed from meta/recipes-devtools/qemu/qemu/0002-linux-user-Replace-use-of-lfs64-related-functions-an.patch)61
-rw-r--r--meta/recipes-devtools/qemu/qemu/0010-configure-lookup-meson-exutable-from-PATH.patch (renamed from meta/recipes-devtools/qemu/qemu/fixedmeson.patch)21
-rw-r--r--meta/recipes-devtools/qemu/qemu/0010-hw-pvrdma-Protect-against-buggy-or-malicious-guest-d.patch40
-rw-r--r--meta/recipes-devtools/qemu/qemu/0011-linux-user-workaround-for-missing-MAP_FIXED_NOREPLAC.patch282
-rw-r--r--meta/recipes-devtools/qemu/qemu/0011-qemu-Ensure-pip-and-the-python-venv-aren-t-used-for-.patch (renamed from meta/recipes-devtools/qemu/qemu/no-pip.patch)26
-rw-r--r--meta/recipes-devtools/qemu/qemu/0012-linux-user-workaround-for-missing-MAP_SHARED_VALIDAT.patch51
-rw-r--r--meta/recipes-devtools/qemu/qemu/4a8579ad8629b57a43daa62e46cc7af6e1078116.patch60
-rw-r--r--meta/recipes-devtools/qemu/qemu/CVE-2023-6683.patch91
-rw-r--r--meta/recipes-devtools/qemu/qemu_9.0.0.bb (renamed from meta/recipes-devtools/qemu/qemu_8.2.1.bb)0
26 files changed, 160 insertions, 1164 deletions
diff --git a/meta/conf/distro/include/tcmode-default.inc b/meta/conf/distro/include/tcmode-default.inc
index 950f29134d..4fb6e47b7f 100644
--- a/meta/conf/distro/include/tcmode-default.inc
+++ b/meta/conf/distro/include/tcmode-default.inc
@@ -22,7 +22,7 @@ BINUVERSION ?= "2.42%"
22GDBVERSION ?= "14.%" 22GDBVERSION ?= "14.%"
23GLIBCVERSION ?= "2.39%" 23GLIBCVERSION ?= "2.39%"
24LINUXLIBCVERSION ?= "6.9%" 24LINUXLIBCVERSION ?= "6.9%"
25QEMUVERSION ?= "8.2%" 25QEMUVERSION ?= "9.0%"
26GOVERSION ?= "1.22%" 26GOVERSION ?= "1.22%"
27RUSTVERSION ?= "1.75%" 27RUSTVERSION ?= "1.75%"
28 28
diff --git a/meta/recipes-devtools/qemu/qemu-native_8.2.1.bb b/meta/recipes-devtools/qemu/qemu-native_9.0.0.bb
index a77953529b..a77953529b 100644
--- a/meta/recipes-devtools/qemu/qemu-native_8.2.1.bb
+++ b/meta/recipes-devtools/qemu/qemu-native_9.0.0.bb
diff --git a/meta/recipes-devtools/qemu/qemu-system-native_8.2.1.bb b/meta/recipes-devtools/qemu/qemu-system-native_9.0.0.bb
index 5d2fbcbc02..5d2fbcbc02 100644
--- a/meta/recipes-devtools/qemu/qemu-system-native_8.2.1.bb
+++ b/meta/recipes-devtools/qemu/qemu-system-native_9.0.0.bb
diff --git a/meta/recipes-devtools/qemu/qemu.inc b/meta/recipes-devtools/qemu/qemu.inc
index f76cbbb5cb..fb38fb44de 100644
--- a/meta/recipes-devtools/qemu/qemu.inc
+++ b/meta/recipes-devtools/qemu/qemu.inc
@@ -22,62 +22,31 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \
22 file://powerpc_rom.bin \ 22 file://powerpc_rom.bin \
23 file://run-ptest \ 23 file://run-ptest \
24 file://0001-qemu-Add-addition-environment-space-to-boot-loader-q.patch \ 24 file://0001-qemu-Add-addition-environment-space-to-boot-loader-q.patch \
25 file://0003-apic-fixup-fallthrough-to-PIC.patch \ 25 file://0002-apic-fixup-fallthrough-to-PIC.patch \
26 file://0004-configure-Add-pkg-config-handling-for-libgcrypt.patch \ 26 file://0003-configure-Add-pkg-config-handling-for-libgcrypt.patch \
27 file://0005-qemu-Do-not-include-file-if-not-exists.patch \ 27 file://0004-qemu-Do-not-include-file-if-not-exists.patch \
28 file://0006-qemu-Add-some-user-space-mmap-tweaks-to-address-musl.patch \ 28 file://0005-qemu-Add-some-user-space-mmap-tweaks-to-address-musl.patch \
29 file://0007-qemu-Determinism-fixes.patch \ 29 file://0006-qemu-Determinism-fixes.patch \
30 file://0008-tests-meson.build-use-relative-path-to-refer-to-file.patch \ 30 file://0007-tests-meson.build-use-relative-path-to-refer-to-file.patch \
31 file://0009-Define-MAP_SYNC-and-MAP_SHARED_VALIDATE-on-needed-li.patch \ 31 file://0008-Define-MAP_SYNC-and-MAP_SHARED_VALIDATE-on-needed-li.patch \
32 file://0010-hw-pvrdma-Protect-against-buggy-or-malicious-guest-d.patch \ 32 file://0009-linux-user-Replace-use-of-lfs64-related-functions-an.patch \
33 file://0002-linux-user-Replace-use-of-lfs64-related-functions-an.patch \ 33 file://0010-configure-lookup-meson-exutable-from-PATH.patch \
34 file://fixedmeson.patch \ 34 file://0011-qemu-Ensure-pip-and-the-python-venv-aren-t-used-for-.patch \
35 file://no-pip.patch \
36 file://4a8579ad8629b57a43daa62e46cc7af6e1078116.patch \
37 file://0001-linux-user-x86_64-Handle-the-vsyscall-page-in-open_s.patch \
38 file://0002-linux-user-loongarch64-Remove-TARGET_FORCE_SHMLBA.patch \
39 file://0003-linux-user-Add-strace-for-shmat.patch \
40 file://0004-linux-user-Rewrite-target_shmat.patch \
41 file://0005-tests-tcg-Check-that-shmat-does-not-break-proc-self-.patch \
42 file://CVE-2023-6683.patch \
43 file://qemu-guest-agent.init \ 35 file://qemu-guest-agent.init \
44 file://qemu-guest-agent.udev \ 36 file://qemu-guest-agent.udev \
45 " 37 "
46UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar" 38UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar"
47 39
48# SDK_OLDEST_KERNEL is set below 4.17, which is the minimum version required by QEMU >= 8.1 40SRC_URI[sha256sum] = "32708ac66c30d8c892633ea968c771c1c76d597d70ddead21a0d22ccf386da69"
49# This is due to two MMAP flags being used at certain points
50SRC_URI:append:class-nativesdk = " \
51 file://0011-linux-user-workaround-for-missing-MAP_FIXED_NOREPLAC.patch \
52 file://0012-linux-user-workaround-for-missing-MAP_SHARED_VALIDAT.patch \
53 "
54
55# Support building and using native version on pre 4.17 kernels
56SRC_URI:append:class-native = " \
57 file://0011-linux-user-workaround-for-missing-MAP_FIXED_NOREPLAC.patch \
58 file://0012-linux-user-workaround-for-missing-MAP_SHARED_VALIDAT.patch \
59 "
60
61SRC_URI[sha256sum] = "8562751158175f9d187c5f22b57555abe3c870f0325c8ced12c34c6d987729be"
62 41
63CVE_STATUS[CVE-2007-0998] = "not-applicable-config: The VNC server can expose host files uder some circumstances. We don't enable it by default." 42CVE_STATUS[CVE-2007-0998] = "not-applicable-config: The VNC server can expose host files uder some circumstances. We don't enable it by default."
64 43
65# https://bugzilla.redhat.com/show_bug.cgi?id=1609015#c11 44# https://bugzilla.redhat.com/show_bug.cgi?id=1609015#c11
66CVE_STATUS[CVE-2018-18438] = "disputed: The issues identified by this CVE were determined to not constitute a vulnerability." 45CVE_STATUS[CVE-2018-18438] = "disputed: The issues identified by this CVE were determined to not constitute a vulnerability."
67 46
68# As per https://nvd.nist.gov/vuln/detail/CVE-2023-0664
69# https://bugzilla.redhat.com/show_bug.cgi?id=2167423
70CVE_STATUS[CVE-2023-0664] = "not-applicable-platform: Issue only applies on Windows"
71
72# As per https://bugzilla.redhat.com/show_bug.cgi?id=2203387 47# As per https://bugzilla.redhat.com/show_bug.cgi?id=2203387
73CVE_STATUS[CVE-2023-2680] = "not-applicable-platform: RHEL specific issue." 48CVE_STATUS[CVE-2023-2680] = "not-applicable-platform: RHEL specific issue."
74 49
75CVE_STATUS[CVE-2023-3019] = "cpe-incorrect: Applies only against versions before 8.2.0"
76
77CVE_STATUS[CVE-2023-5088] = "cpe-incorrect: Applies only against version 8.2.0 and earlier"
78
79CVE_STATUS[CVE-2023-6693] = "cpe-incorrect: Applies only against version 8.2.0 and earlier"
80
81COMPATIBLE_HOST:mipsarchn32 = "null" 50COMPATIBLE_HOST:mipsarchn32 = "null"
82COMPATIBLE_HOST:mipsarchn64 = "null" 51COMPATIBLE_HOST:mipsarchn64 = "null"
83COMPATIBLE_HOST:riscv32 = "null" 52COMPATIBLE_HOST:riscv32 = "null"
@@ -182,6 +151,8 @@ do_install () {
182 rm ${D}${datadir}/qemu/s390-netboot.img -f 151 rm ${D}${datadir}/qemu/s390-netboot.img -f
183 # ELF binary /usr/share/qemu/s390-ccw.img has relocations in .text [textrel] 152 # ELF binary /usr/share/qemu/s390-ccw.img has relocations in .text [textrel]
184 rm ${D}${datadir}/qemu/s390-ccw.img -f 153 rm ${D}${datadir}/qemu/s390-ccw.img -f
154 # We don't support PARISC and these cause strip and SDK relocation errors
155 rm ${D}${datadir}/qemu/hppa* -f
185} 156}
186 157
187# The following fragment will create a wrapper for qemu-mips user emulation 158# The following fragment will create a wrapper for qemu-mips user emulation
diff --git a/meta/recipes-devtools/qemu/qemu/0001-linux-user-x86_64-Handle-the-vsyscall-page-in-open_s.patch b/meta/recipes-devtools/qemu/qemu/0001-linux-user-x86_64-Handle-the-vsyscall-page-in-open_s.patch
deleted file mode 100644
index 2eaebe883c..0000000000
--- a/meta/recipes-devtools/qemu/qemu/0001-linux-user-x86_64-Handle-the-vsyscall-page-in-open_s.patch
+++ /dev/null
@@ -1,56 +0,0 @@
1From 4517e2046610722879761bcdb60edbb2b929c848 Mon Sep 17 00:00:00 2001
2From: Richard Henderson <richard.henderson@linaro.org>
3Date: Wed, 28 Feb 2024 10:25:14 -1000
4Subject: [PATCH 1/5] linux-user/x86_64: Handle the vsyscall page in
5 open_self_maps_{2,4}
6
7This is the only case in which we expect to have no host memory backing
8for a guest memory page, because in general linux user processes cannot
9map any pages in the top half of the 64-bit address space.
10
11Upstream-Status: Submitted [https://www.mail-archive.com/qemu-devel@nongnu.org/msg1026793.html]
12
13Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2170
14Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
15Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
16---
17 linux-user/syscall.c | 16 ++++++++++++++++
18 1 file changed, 16 insertions(+)
19
20diff --git a/linux-user/syscall.c b/linux-user/syscall.c
21index a114f29a8..8307a8a61 100644
22--- a/linux-user/syscall.c
23+++ b/linux-user/syscall.c
24@@ -7922,6 +7922,10 @@ static void open_self_maps_4(const struct open_self_maps_data *d,
25 path = "[heap]";
26 } else if (start == info->vdso) {
27 path = "[vdso]";
28+#ifdef TARGET_X86_64
29+ } else if (start == TARGET_VSYSCALL_PAGE) {
30+ path = "[vsyscall]";
31+#endif
32 }
33
34 /* Except null device (MAP_ANON), adjust offset for this fragment. */
35@@ -8010,6 +8014,18 @@ static int open_self_maps_2(void *opaque, target_ulong guest_start,
36 uintptr_t host_start = (uintptr_t)g2h_untagged(guest_start);
37 uintptr_t host_last = (uintptr_t)g2h_untagged(guest_end - 1);
38
39+#ifdef TARGET_X86_64
40+ /*
41+ * Because of the extremely high position of the page within the guest
42+ * virtual address space, this is not backed by host memory at all.
43+ * Therefore the loop below would fail. This is the only instance
44+ * of not having host backing memory.
45+ */
46+ if (guest_start == TARGET_VSYSCALL_PAGE) {
47+ return open_self_maps_3(opaque, guest_start, guest_end, flags);
48+ }
49+#endif
50+
51 while (1) {
52 IntervalTreeNode *n =
53 interval_tree_iter_first(d->host_maps, host_start, host_start);
54--
552.34.1
56
diff --git a/meta/recipes-devtools/qemu/qemu/0001-qemu-Add-addition-environment-space-to-boot-loader-q.patch b/meta/recipes-devtools/qemu/qemu/0001-qemu-Add-addition-environment-space-to-boot-loader-q.patch
index c65508017d..2333cc8432 100644
--- a/meta/recipes-devtools/qemu/qemu/0001-qemu-Add-addition-environment-space-to-boot-loader-q.patch
+++ b/meta/recipes-devtools/qemu/qemu/0001-qemu-Add-addition-environment-space-to-boot-loader-q.patch
@@ -1,7 +1,7 @@
1From de64af82950a6908f9407dfc92b83c17e2af3eab Mon Sep 17 00:00:00 2001 1From e9baf07a667a1c04b57e14776cc4fa387448c908 Mon Sep 17 00:00:00 2001
2From: Jason Wessel <jason.wessel@windriver.com> 2From: Jason Wessel <jason.wessel@windriver.com>
3Date: Fri, 28 Mar 2014 17:42:43 +0800 3Date: Fri, 28 Mar 2014 17:42:43 +0800
4Subject: [PATCH 01/12] qemu: Add addition environment space to boot loader 4Subject: [PATCH 01/11] qemu: Add addition environment space to boot loader
5 qemu-system-mips 5 qemu-system-mips
6 6
7Upstream-Status: Inappropriate - OE uses deep paths 7Upstream-Status: Inappropriate - OE uses deep paths
@@ -13,16 +13,15 @@ to only 256 bytes. This patch expands the limit.
13 13
14Signed-off-by: Jason Wessel <jason.wessel@windriver.com> 14Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
15Signed-off-by: Roy Li <rongqing.li@windriver.com> 15Signed-off-by: Roy Li <rongqing.li@windriver.com>
16
17--- 16---
18 hw/mips/malta.c | 2 +- 17 hw/mips/malta.c | 2 +-
19 1 file changed, 1 insertion(+), 1 deletion(-) 18 1 file changed, 1 insertion(+), 1 deletion(-)
20 19
21Index: qemu-8.0.0/hw/mips/malta.c 20diff --git a/hw/mips/malta.c b/hw/mips/malta.c
22=================================================================== 21index af74008c82..a588b9ad4e 100644
23--- qemu-8.0.0.orig/hw/mips/malta.c 22--- a/hw/mips/malta.c
24+++ qemu-8.0.0/hw/mips/malta.c 23+++ b/hw/mips/malta.c
25@@ -64,7 +64,7 @@ 24@@ -63,7 +63,7 @@
26 #define ENVP_PADDR 0x2000 25 #define ENVP_PADDR 0x2000
27 #define ENVP_VADDR cpu_mips_phys_to_kseg0(NULL, ENVP_PADDR) 26 #define ENVP_VADDR cpu_mips_phys_to_kseg0(NULL, ENVP_PADDR)
28 #define ENVP_NB_ENTRIES 16 27 #define ENVP_NB_ENTRIES 16
@@ -31,3 +30,6 @@ Index: qemu-8.0.0/hw/mips/malta.c
31 30
32 /* Hardware addresses */ 31 /* Hardware addresses */
33 #define FLASH_ADDRESS 0x1e000000ULL 32 #define FLASH_ADDRESS 0x1e000000ULL
33--
342.44.0
35
diff --git a/meta/recipes-devtools/qemu/qemu/0003-apic-fixup-fallthrough-to-PIC.patch b/meta/recipes-devtools/qemu/qemu/0002-apic-fixup-fallthrough-to-PIC.patch
index e85f8202e9..5f8fe4faa3 100644
--- a/meta/recipes-devtools/qemu/qemu/0003-apic-fixup-fallthrough-to-PIC.patch
+++ b/meta/recipes-devtools/qemu/qemu/0002-apic-fixup-fallthrough-to-PIC.patch
@@ -1,7 +1,7 @@
1From dc2a8ccd440ee3741b61606eafed3f7e092f4312 Mon Sep 17 00:00:00 2001 1From 23bf534e463bf4c1ba2e1356eaf17be0b23b192e Mon Sep 17 00:00:00 2001
2From: Mark Asselstine <mark.asselstine@windriver.com> 2From: Mark Asselstine <mark.asselstine@windriver.com>
3Date: Tue, 26 Feb 2013 11:43:28 -0500 3Date: Tue, 26 Feb 2013 11:43:28 -0500
4Subject: [PATCH 03/12] apic: fixup fallthrough to PIC 4Subject: [PATCH 02/11] apic: fixup fallthrough to PIC
5 5
6Commit 0e21e12bb311c4c1095d0269dc2ef81196ccb60a [Don't route PIC 6Commit 0e21e12bb311c4c1095d0269dc2ef81196ccb60a [Don't route PIC
7interrupts through the local APIC if the local APIC config says so.] 7interrupts through the local APIC if the local APIC config says so.]
@@ -24,16 +24,15 @@ serviced, is -1.
24Signed-off-by: Mark Asselstine <mark.asselstine@windriver.com> 24Signed-off-by: Mark Asselstine <mark.asselstine@windriver.com>
25Upstream-Status: Submitted [https://lists.gnu.org/archive/html/qemu-devel/2013-04/msg00878.html] 25Upstream-Status: Submitted [https://lists.gnu.org/archive/html/qemu-devel/2013-04/msg00878.html]
26Signed-off-by: He Zhe <zhe.he@windriver.com> 26Signed-off-by: He Zhe <zhe.he@windriver.com>
27
28--- 27---
29 hw/intc/apic.c | 2 +- 28 hw/intc/apic.c | 2 +-
30 1 file changed, 1 insertion(+), 1 deletion(-) 29 1 file changed, 1 insertion(+), 1 deletion(-)
31 30
32Index: qemu-8.0.0/hw/intc/apic.c 31diff --git a/hw/intc/apic.c b/hw/intc/apic.c
33=================================================================== 32index 4186c57b34..43cd805a96 100644
34--- qemu-8.0.0.orig/hw/intc/apic.c 33--- a/hw/intc/apic.c
35+++ qemu-8.0.0/hw/intc/apic.c 34+++ b/hw/intc/apic.c
36@@ -607,7 +607,7 @@ int apic_accept_pic_intr(DeviceState *de 35@@ -759,7 +759,7 @@ int apic_accept_pic_intr(DeviceState *dev)
37 APICCommonState *s = APIC(dev); 36 APICCommonState *s = APIC(dev);
38 uint32_t lvt0; 37 uint32_t lvt0;
39 38
@@ -42,3 +41,6 @@ Index: qemu-8.0.0/hw/intc/apic.c
42 return -1; 41 return -1;
43 42
44 lvt0 = s->lvt[APIC_LVT_LINT0]; 43 lvt0 = s->lvt[APIC_LVT_LINT0];
44--
452.44.0
46
diff --git a/meta/recipes-devtools/qemu/qemu/0002-linux-user-loongarch64-Remove-TARGET_FORCE_SHMLBA.patch b/meta/recipes-devtools/qemu/qemu/0002-linux-user-loongarch64-Remove-TARGET_FORCE_SHMLBA.patch
deleted file mode 100644
index 3f01aaa644..0000000000
--- a/meta/recipes-devtools/qemu/qemu/0002-linux-user-loongarch64-Remove-TARGET_FORCE_SHMLBA.patch
+++ /dev/null
@@ -1,43 +0,0 @@
1From 5bf65b24414d3ff8339f6f1beb221c7c35c91e5d Mon Sep 17 00:00:00 2001
2From: Richard Henderson <richard.henderson@linaro.org>
3Date: Wed, 28 Feb 2024 10:25:15 -1000
4Subject: [PATCH 2/5] linux-user/loongarch64: Remove TARGET_FORCE_SHMLBA
5
6The kernel abi was changed with
7
8 commit d23b77953f5a4fbf94c05157b186aac2a247ae32
9 Author: Huacai Chen <chenhuacai@kernel.org>
10 Date: Wed Jan 17 12:43:08 2024 +0800
11
12 LoongArch: Change SHMLBA from SZ_64K to PAGE_SIZE
13
14during the v6.8 cycle.
15
16Upstream-Status: Submitted [https://www.mail-archive.com/qemu-devel@nongnu.org/msg1026793.html]
17
18Reviewed-by: Song Gao <gaosong@loongson.cn>
19Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
20Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
21---
22 linux-user/loongarch64/target_syscall.h | 7 -------
23 1 file changed, 7 deletions(-)
24
25diff --git a/linux-user/loongarch64/target_syscall.h b/linux-user/loongarch64/target_syscall.h
26index 8b5de5212..39f229bb9 100644
27--- a/linux-user/loongarch64/target_syscall.h
28+++ b/linux-user/loongarch64/target_syscall.h
29@@ -38,11 +38,4 @@ struct target_pt_regs {
30 #define TARGET_MCL_FUTURE 2
31 #define TARGET_MCL_ONFAULT 4
32
33-#define TARGET_FORCE_SHMLBA
34-
35-static inline abi_ulong target_shmlba(CPULoongArchState *env)
36-{
37- return 64 * KiB;
38-}
39-
40 #endif
41--
422.34.1
43
diff --git a/meta/recipes-devtools/qemu/qemu/0004-configure-Add-pkg-config-handling-for-libgcrypt.patch b/meta/recipes-devtools/qemu/qemu/0003-configure-Add-pkg-config-handling-for-libgcrypt.patch
index f981a64a54..30e269f8f4 100644
--- a/meta/recipes-devtools/qemu/qemu/0004-configure-Add-pkg-config-handling-for-libgcrypt.patch
+++ b/meta/recipes-devtools/qemu/qemu/0003-configure-Add-pkg-config-handling-for-libgcrypt.patch
@@ -1,7 +1,7 @@
1From d8265abdce5dc2bf74b3fccdf2b7257b4f3894f0 Mon Sep 17 00:00:00 2001 1From e4f6c6b9f43b28271bc9dc6cbcafad53f80387e0 Mon Sep 17 00:00:00 2001
2From: He Zhe <zhe.he@windriver.com> 2From: He Zhe <zhe.he@windriver.com>
3Date: Wed, 28 Aug 2019 19:56:28 +0800 3Date: Wed, 28 Aug 2019 19:56:28 +0800
4Subject: [PATCH 04/12] configure: Add pkg-config handling for libgcrypt 4Subject: [PATCH 03/11] configure: Add pkg-config handling for libgcrypt
5 5
6libgcrypt may also be controlled by pkg-config, this patch adds pkg-config 6libgcrypt may also be controlled by pkg-config, this patch adds pkg-config
7handling for libgcrypt. 7handling for libgcrypt.
@@ -9,16 +9,15 @@ handling for libgcrypt.
9Upstream-Status: Denied [https://lists.nongnu.org/archive/html/qemu-devel/2019-08/msg06333.html] 9Upstream-Status: Denied [https://lists.nongnu.org/archive/html/qemu-devel/2019-08/msg06333.html]
10 10
11Signed-off-by: He Zhe <zhe.he@windriver.com> 11Signed-off-by: He Zhe <zhe.he@windriver.com>
12
13--- 12---
14 meson.build | 2 +- 13 meson.build | 2 +-
15 1 file changed, 1 insertion(+), 1 deletion(-) 14 1 file changed, 1 insertion(+), 1 deletion(-)
16 15
17Index: qemu-8.1.0/meson.build 16diff --git a/meson.build b/meson.build
18=================================================================== 17index 91a0aa64c6..e8373d55b8 100644
19--- qemu-8.1.0.orig/meson.build 18--- a/meson.build
20+++ qemu-8.1.0/meson.build 19+++ b/meson.build
21@@ -1481,7 +1481,7 @@ endif 20@@ -1655,7 +1655,7 @@ endif
22 if not gnutls_crypto.found() 21 if not gnutls_crypto.found()
23 if (not get_option('gcrypt').auto() or have_system) and not get_option('nettle').enabled() 22 if (not get_option('gcrypt').auto() or have_system) and not get_option('nettle').enabled()
24 gcrypt = dependency('libgcrypt', version: '>=1.8', 23 gcrypt = dependency('libgcrypt', version: '>=1.8',
@@ -27,3 +26,6 @@ Index: qemu-8.1.0/meson.build
27 required: get_option('gcrypt')) 26 required: get_option('gcrypt'))
28 # Debian has removed -lgpg-error from libgcrypt-config 27 # Debian has removed -lgpg-error from libgcrypt-config
29 # as it "spreads unnecessary dependencies" which in 28 # as it "spreads unnecessary dependencies" which in
29--
302.44.0
31
diff --git a/meta/recipes-devtools/qemu/qemu/0003-linux-user-Add-strace-for-shmat.patch b/meta/recipes-devtools/qemu/qemu/0003-linux-user-Add-strace-for-shmat.patch
deleted file mode 100644
index 0c601c804a..0000000000
--- a/meta/recipes-devtools/qemu/qemu/0003-linux-user-Add-strace-for-shmat.patch
+++ /dev/null
@@ -1,71 +0,0 @@
1From e8f06676c6c88e12cd5f4f81a839b7111c683596 Mon Sep 17 00:00:00 2001
2From: Richard Henderson <richard.henderson@linaro.org>
3Date: Wed, 28 Feb 2024 10:25:16 -1000
4Subject: [PATCH 3/5] linux-user: Add strace for shmat
5
6Upstream-Status: Submitted [https://www.mail-archive.com/qemu-devel@nongnu.org/msg1026793.html]
7
8Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
9Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
10---
11 linux-user/strace.c | 23 +++++++++++++++++++++++
12 linux-user/strace.list | 2 +-
13 2 files changed, 24 insertions(+), 1 deletion(-)
14
15diff --git a/linux-user/strace.c b/linux-user/strace.c
16index cf26e5526..47d6ec326 100644
17--- a/linux-user/strace.c
18+++ b/linux-user/strace.c
19@@ -670,6 +670,25 @@ print_semctl(CPUArchState *cpu_env, const struct syscallname *name,
20 }
21 #endif
22
23+static void
24+print_shmat(CPUArchState *cpu_env, const struct syscallname *name,
25+ abi_long arg0, abi_long arg1, abi_long arg2,
26+ abi_long arg3, abi_long arg4, abi_long arg5)
27+{
28+ static const struct flags shmat_flags[] = {
29+ FLAG_GENERIC(SHM_RND),
30+ FLAG_GENERIC(SHM_REMAP),
31+ FLAG_GENERIC(SHM_RDONLY),
32+ FLAG_GENERIC(SHM_EXEC),
33+ };
34+
35+ print_syscall_prologue(name);
36+ print_raw_param(TARGET_ABI_FMT_ld, arg0, 0);
37+ print_pointer(arg1, 0);
38+ print_flags(shmat_flags, arg2, 1);
39+ print_syscall_epilogue(name);
40+}
41+
42 #ifdef TARGET_NR_ipc
43 static void
44 print_ipc(CPUArchState *cpu_env, const struct syscallname *name,
45@@ -683,6 +702,10 @@ print_ipc(CPUArchState *cpu_env, const struct syscallname *name,
46 print_ipc_cmd(arg3);
47 qemu_log(",0x" TARGET_ABI_FMT_lx ")", arg4);
48 break;
49+ case IPCOP_shmat:
50+ print_shmat(cpu_env, &(const struct syscallname){ .name = "shmat" },
51+ arg1, arg4, arg2, 0, 0, 0);
52+ break;
53 default:
54 qemu_log(("%s("
55 TARGET_ABI_FMT_ld ","
56diff --git a/linux-user/strace.list b/linux-user/strace.list
57index 6655d4f26..dfd4237d1 100644
58--- a/linux-user/strace.list
59+++ b/linux-user/strace.list
60@@ -1398,7 +1398,7 @@
61 { TARGET_NR_sgetmask, "sgetmask" , NULL, NULL, NULL },
62 #endif
63 #ifdef TARGET_NR_shmat
64-{ TARGET_NR_shmat, "shmat" , NULL, NULL, print_syscall_ret_addr },
65+{ TARGET_NR_shmat, "shmat" , NULL, print_shmat, print_syscall_ret_addr },
66 #endif
67 #ifdef TARGET_NR_shmctl
68 { TARGET_NR_shmctl, "shmctl" , NULL, NULL, NULL },
69--
702.34.1
71
diff --git a/meta/recipes-devtools/qemu/qemu/0004-linux-user-Rewrite-target_shmat.patch b/meta/recipes-devtools/qemu/qemu/0004-linux-user-Rewrite-target_shmat.patch
deleted file mode 100644
index 88c3ed40b0..0000000000
--- a/meta/recipes-devtools/qemu/qemu/0004-linux-user-Rewrite-target_shmat.patch
+++ /dev/null
@@ -1,236 +0,0 @@
1From cb48d5d1592e63ebd0d4a3e300ef98e38e6306d7 Mon Sep 17 00:00:00 2001
2From: Richard Henderson <richard.henderson@linaro.org>
3Date: Wed, 28 Feb 2024 10:25:17 -1000
4Subject: [PATCH 4/5] linux-user: Rewrite target_shmat
5
6Handle combined host and guest alignment requirements.
7Handle host and guest page size differences.
8Handle SHM_EXEC.
9
10Upstream-Status: Submitted [https://www.mail-archive.com/qemu-devel@nongnu.org/msg1026793.html]
11
12Resolves: https://gitlab.com/qemu-project/qemu/-/issues/115
13Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
14Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
15---
16 linux-user/mmap.c | 166 +++++++++++++++++++++++++++++++++++++---------
17 1 file changed, 133 insertions(+), 33 deletions(-)
18
19diff --git a/linux-user/mmap.c b/linux-user/mmap.c
20index 18fb3aaf7..6a2f649bb 100644
21--- a/linux-user/mmap.c
22+++ b/linux-user/mmap.c
23@@ -1062,69 +1062,161 @@ static inline abi_ulong target_shmlba(CPUArchState *cpu_env)
24 }
25 #endif
26
27+#if defined(__arm__) || defined(__mips__) || defined(__sparc__)
28+#define HOST_FORCE_SHMLBA 1
29+#else
30+#define HOST_FORCE_SHMLBA 0
31+#endif
32+
33 abi_ulong target_shmat(CPUArchState *cpu_env, int shmid,
34 abi_ulong shmaddr, int shmflg)
35 {
36 CPUState *cpu = env_cpu(cpu_env);
37- abi_ulong raddr;
38 struct shmid_ds shm_info;
39 int ret;
40- abi_ulong shmlba;
41+ int h_pagesize;
42+ int t_shmlba, h_shmlba, m_shmlba;
43+ size_t t_len, h_len, m_len;
44
45 /* shmat pointers are always untagged */
46
47- /* find out the length of the shared memory segment */
48+ /*
49+ * Because we can't use host shmat() unless the address is sufficiently
50+ * aligned for the host, we'll need to check both.
51+ * TODO: Could be fixed with softmmu.
52+ */
53+ t_shmlba = target_shmlba(cpu_env);
54+ h_pagesize = qemu_real_host_page_size();
55+ h_shmlba = (HOST_FORCE_SHMLBA ? SHMLBA : h_pagesize);
56+ m_shmlba = MAX(t_shmlba, h_shmlba);
57+
58+ if (shmaddr) {
59+ if (shmaddr & (m_shmlba - 1)) {
60+ if (shmflg & SHM_RND) {
61+ /*
62+ * The guest is allowing the kernel to round the address.
63+ * Assume that the guest is ok with us rounding to the
64+ * host required alignment too. Anyway if we don't, we'll
65+ * get an error from the kernel.
66+ */
67+ shmaddr &= ~(m_shmlba - 1);
68+ if (shmaddr == 0 && (shmflg & SHM_REMAP)) {
69+ return -TARGET_EINVAL;
70+ }
71+ } else {
72+ int require = TARGET_PAGE_SIZE;
73+#ifdef TARGET_FORCE_SHMLBA
74+ require = t_shmlba;
75+#endif
76+ /*
77+ * Include host required alignment, as otherwise we cannot
78+ * use host shmat at all.
79+ */
80+ require = MAX(require, h_shmlba);
81+ if (shmaddr & (require - 1)) {
82+ return -TARGET_EINVAL;
83+ }
84+ }
85+ }
86+ } else {
87+ if (shmflg & SHM_REMAP) {
88+ return -TARGET_EINVAL;
89+ }
90+ }
91+ /* All rounding now manually concluded. */
92+ shmflg &= ~SHM_RND;
93+
94+ /* Find out the length of the shared memory segment. */
95 ret = get_errno(shmctl(shmid, IPC_STAT, &shm_info));
96 if (is_error(ret)) {
97 /* can't get length, bail out */
98 return ret;
99 }
100+ t_len = TARGET_PAGE_ALIGN(shm_info.shm_segsz);
101+ h_len = ROUND_UP(shm_info.shm_segsz, h_pagesize);
102+ m_len = MAX(t_len, h_len);
103
104- shmlba = target_shmlba(cpu_env);
105-
106- if (shmaddr & (shmlba - 1)) {
107- if (shmflg & SHM_RND) {
108- shmaddr &= ~(shmlba - 1);
109- } else {
110- return -TARGET_EINVAL;
111- }
112- }
113- if (!guest_range_valid_untagged(shmaddr, shm_info.shm_segsz)) {
114+ if (!guest_range_valid_untagged(shmaddr, m_len)) {
115 return -TARGET_EINVAL;
116 }
117
118 WITH_MMAP_LOCK_GUARD() {
119- void *host_raddr;
120+ bool mapped = false;
121+ void *want, *test;
122 abi_ulong last;
123
124- if (shmaddr) {
125- host_raddr = shmat(shmid, (void *)g2h_untagged(shmaddr), shmflg);
126+ if (!shmaddr) {
127+ shmaddr = mmap_find_vma(0, m_len, m_shmlba);
128+ if (shmaddr == -1) {
129+ return -TARGET_ENOMEM;
130+ }
131+ mapped = !reserved_va;
132+ } else if (shmflg & SHM_REMAP) {
133+ /*
134+ * If host page size > target page size, the host shmat may map
135+ * more memory than the guest expects. Reject a mapping that
136+ * would replace memory in the unexpected gap.
137+ * TODO: Could be fixed with softmmu.
138+ */
139+ if (t_len < h_len &&
140+ !page_check_range_empty(shmaddr + t_len,
141+ shmaddr + h_len - 1)) {
142+ return -TARGET_EINVAL;
143+ }
144 } else {
145- abi_ulong mmap_start;
146+ if (!page_check_range_empty(shmaddr, shmaddr + m_len - 1)) {
147+ return -TARGET_EINVAL;
148+ }
149+ }
150
151- /* In order to use the host shmat, we need to honor host SHMLBA. */
152- mmap_start = mmap_find_vma(0, shm_info.shm_segsz,
153- MAX(SHMLBA, shmlba));
154+ /* All placement is now complete. */
155+ want = (void *)g2h_untagged(shmaddr);
156
157- if (mmap_start == -1) {
158- return -TARGET_ENOMEM;
159+ /*
160+ * Map anonymous pages across the entire range, then remap with
161+ * the shared memory. This is required for a number of corner
162+ * cases for which host and guest page sizes differ.
163+ */
164+ if (h_len != t_len) {
165+ int mmap_p = PROT_READ | (shmflg & SHM_RDONLY ? 0 : PROT_WRITE);
166+ int mmap_f = MAP_PRIVATE | MAP_ANONYMOUS
167+ | (reserved_va || (shmflg & SHM_REMAP)
168+ ? MAP_FIXED : MAP_FIXED_NOREPLACE);
169+
170+ test = mmap(want, m_len, mmap_p, mmap_f, -1, 0);
171+ if (unlikely(test != want)) {
172+ /* shmat returns EINVAL not EEXIST like mmap. */
173+ ret = (test == MAP_FAILED && errno != EEXIST
174+ ? get_errno(-1) : -TARGET_EINVAL);
175+ if (mapped) {
176+ do_munmap(want, m_len);
177+ }
178+ return ret;
179 }
180- host_raddr = shmat(shmid, g2h_untagged(mmap_start),
181- shmflg | SHM_REMAP);
182+ mapped = true;
183 }
184
185- if (host_raddr == (void *)-1) {
186- return get_errno(-1);
187+ if (reserved_va || mapped) {
188+ shmflg |= SHM_REMAP;
189+ }
190+ test = shmat(shmid, want, shmflg);
191+ if (test == MAP_FAILED) {
192+ ret = get_errno(-1);
193+ if (mapped) {
194+ do_munmap(want, m_len);
195+ }
196+ return ret;
197 }
198- raddr = h2g(host_raddr);
199- last = raddr + shm_info.shm_segsz - 1;
200+ assert(test == want);
201
202- page_set_flags(raddr, last,
203+ last = shmaddr + m_len - 1;
204+ page_set_flags(shmaddr, last,
205 PAGE_VALID | PAGE_RESET | PAGE_READ |
206- (shmflg & SHM_RDONLY ? 0 : PAGE_WRITE));
207+ (shmflg & SHM_RDONLY ? 0 : PAGE_WRITE) |
208+ (shmflg & SHM_EXEC ? PAGE_EXEC : 0));
209
210- shm_region_rm_complete(raddr, last);
211- shm_region_add(raddr, last);
212+ shm_region_rm_complete(shmaddr, last);
213+ shm_region_add(shmaddr, last);
214 }
215
216 /*
217@@ -1138,7 +1230,15 @@ abi_ulong target_shmat(CPUArchState *cpu_env, int shmid,
218 tb_flush(cpu);
219 }
220
221- return raddr;
222+ if (qemu_loglevel_mask(CPU_LOG_PAGE)) {
223+ FILE *f = qemu_log_trylock();
224+ if (f) {
225+ fprintf(f, "page layout changed following shmat\n");
226+ page_dump(f);
227+ qemu_log_unlock(f);
228+ }
229+ }
230+ return shmaddr;
231 }
232
233 abi_long target_shmdt(abi_ulong shmaddr)
234--
2352.34.1
236
diff --git a/meta/recipes-devtools/qemu/qemu/0005-qemu-Do-not-include-file-if-not-exists.patch b/meta/recipes-devtools/qemu/qemu/0004-qemu-Do-not-include-file-if-not-exists.patch
index 38aa4c3bbe..d9cab428c4 100644
--- a/meta/recipes-devtools/qemu/qemu/0005-qemu-Do-not-include-file-if-not-exists.patch
+++ b/meta/recipes-devtools/qemu/qemu/0004-qemu-Do-not-include-file-if-not-exists.patch
@@ -1,7 +1,7 @@
1From f39e7bfc5ed07b5ecaeb705c4eae4855ca120d47 Mon Sep 17 00:00:00 2001 1From 5223d46a8d5302396f9fc7cc5d830769e87242fe Mon Sep 17 00:00:00 2001
2From: Oleksiy Obitotskyy <oobitots@cisco.com> 2From: Oleksiy Obitotskyy <oobitots@cisco.com>
3Date: Wed, 25 Mar 2020 21:21:35 +0200 3Date: Wed, 25 Mar 2020 21:21:35 +0200
4Subject: [PATCH 05/12] qemu: Do not include file if not exists 4Subject: [PATCH 04/11] qemu: Do not include file if not exists
5 5
6Script configure checks for if_alg.h and check failed but 6Script configure checks for if_alg.h and check failed but
7if_alg.h still included. 7if_alg.h still included.
@@ -11,16 +11,15 @@ Signed-off-by: Oleksiy Obitotskyy <oobitots@cisco.com>
11 11
12[update patch context] 12[update patch context]
13Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> 13Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
14
15--- 14---
16 linux-user/syscall.c | 2 ++ 15 linux-user/syscall.c | 2 ++
17 1 file changed, 2 insertions(+) 16 1 file changed, 2 insertions(+)
18 17
19Index: qemu-8.0.0/linux-user/syscall.c 18diff --git a/linux-user/syscall.c b/linux-user/syscall.c
20=================================================================== 19index 3df2b94d9a..18f09f1f07 100644
21--- qemu-8.0.0.orig/linux-user/syscall.c 20--- a/linux-user/syscall.c
22+++ qemu-8.0.0/linux-user/syscall.c 21+++ b/linux-user/syscall.c
23@@ -115,7 +115,9 @@ 22@@ -116,7 +116,9 @@
24 #include <linux/blkpg.h> 23 #include <linux/blkpg.h>
25 #include <netpacket/packet.h> 24 #include <netpacket/packet.h>
26 #include <linux/netlink.h> 25 #include <linux/netlink.h>
@@ -30,3 +29,6 @@ Index: qemu-8.0.0/linux-user/syscall.c
30 #include <linux/rtc.h> 29 #include <linux/rtc.h>
31 #include <sound/asound.h> 30 #include <sound/asound.h>
32 #ifdef HAVE_BTRFS_H 31 #ifdef HAVE_BTRFS_H
32--
332.44.0
34
diff --git a/meta/recipes-devtools/qemu/qemu/0006-qemu-Add-some-user-space-mmap-tweaks-to-address-musl.patch b/meta/recipes-devtools/qemu/qemu/0005-qemu-Add-some-user-space-mmap-tweaks-to-address-musl.patch
index 5d1d7c6881..3c7f5776ff 100644
--- a/meta/recipes-devtools/qemu/qemu/0006-qemu-Add-some-user-space-mmap-tweaks-to-address-musl.patch
+++ b/meta/recipes-devtools/qemu/qemu/0005-qemu-Add-some-user-space-mmap-tweaks-to-address-musl.patch
@@ -1,7 +1,7 @@
1From 375cae3dd6151ef33cae8f243f6a2c2da6c0c356 Mon Sep 17 00:00:00 2001 1From 1c295069857b9850f15f2cd6b33b133ea641a454 Mon Sep 17 00:00:00 2001
2From: Richard Purdie <richard.purdie@linuxfoundation.org> 2From: Richard Purdie <richard.purdie@linuxfoundation.org>
3Date: Fri, 8 Jan 2021 17:27:06 +0000 3Date: Fri, 8 Jan 2021 17:27:06 +0000
4Subject: [PATCH 06/12] qemu: Add some user space mmap tweaks to address musl 4Subject: [PATCH 05/11] qemu: Add some user space mmap tweaks to address musl
5 32 bit 5 32 bit
6 6
7When using qemu-i386 to build qemux86 webkitgtk on musl, it sits in an 7When using qemu-i386 to build qemux86 webkitgtk on musl, it sits in an
@@ -18,16 +18,15 @@ rather than ENOMEM so adjust the other part of the test to this.
18 18
19Upstream-Status: Submitted [https://lists.gnu.org/archive/html/qemu-devel/2021-01/msg01355.html] 19Upstream-Status: Submitted [https://lists.gnu.org/archive/html/qemu-devel/2021-01/msg01355.html]
20Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org 20Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org
21
22--- 21---
23 linux-user/mmap.c | 10 +++++++--- 22 linux-user/mmap.c | 10 +++++++---
24 1 file changed, 7 insertions(+), 3 deletions(-) 23 1 file changed, 7 insertions(+), 3 deletions(-)
25 24
26Index: qemu-8.0.0/linux-user/mmap.c 25diff --git a/linux-user/mmap.c b/linux-user/mmap.c
27=================================================================== 26index be3b9a68eb..481286f01d 100644
28--- qemu-8.0.0.orig/linux-user/mmap.c 27--- a/linux-user/mmap.c
29+++ qemu-8.0.0/linux-user/mmap.c 28+++ b/linux-user/mmap.c
30@@ -776,12 +776,16 @@ abi_long target_mremap(abi_ulong old_add 29@@ -1060,12 +1060,16 @@ abi_long target_mremap(abi_ulong old_addr, abi_ulong old_size,
31 int prot; 30 int prot;
32 void *host_addr; 31 void *host_addr;
33 32
@@ -47,3 +46,6 @@ Index: qemu-8.0.0/linux-user/mmap.c
47 return -1; 46 return -1;
48 } 47 }
49 48
49--
502.44.0
51
diff --git a/meta/recipes-devtools/qemu/qemu/0005-tests-tcg-Check-that-shmat-does-not-break-proc-self-.patch b/meta/recipes-devtools/qemu/qemu/0005-tests-tcg-Check-that-shmat-does-not-break-proc-self-.patch
deleted file mode 100644
index 5afb35ea0c..0000000000
--- a/meta/recipes-devtools/qemu/qemu/0005-tests-tcg-Check-that-shmat-does-not-break-proc-self-.patch
+++ /dev/null
@@ -1,85 +0,0 @@
1From 1234063488134ad1f541f56dd30caa7896905f06 Mon Sep 17 00:00:00 2001
2From: Ilya Leoshkevich <iii@linux.ibm.com>
3Date: Wed, 28 Feb 2024 10:25:18 -1000
4Subject: [PATCH 5/5] tests/tcg: Check that shmat() does not break
5 /proc/self/maps
6
7Add a regression test for a recently fixed issue, where shmat()
8desynced the guest and the host view of the address space and caused
9open("/proc/self/maps") to SEGV.
10
11Upstream-Status: Submitted [https://www.mail-archive.com/qemu-devel@nongnu.org/msg1026793.html]
12
13Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
14Message-Id: <jwyuvao4apydvykmsnvacwshdgy3ixv7qvkh4dbxm3jkwgnttw@k4wpaayou7oq>
15Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
16Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
17---
18 tests/tcg/multiarch/linux/linux-shmat-maps.c | 55 ++++++++++++++++++++
19 1 file changed, 55 insertions(+)
20 create mode 100644 tests/tcg/multiarch/linux/linux-shmat-maps.c
21
22diff --git a/tests/tcg/multiarch/linux/linux-shmat-maps.c b/tests/tcg/multiarch/linux/linux-shmat-maps.c
23new file mode 100644
24index 000000000..0ccf7a973
25--- /dev/null
26+++ b/tests/tcg/multiarch/linux/linux-shmat-maps.c
27@@ -0,0 +1,55 @@
28+/*
29+ * Test that shmat() does not break /proc/self/maps.
30+ *
31+ * SPDX-License-Identifier: GPL-2.0-or-later
32+ */
33+#include <assert.h>
34+#include <fcntl.h>
35+#include <stdlib.h>
36+#include <sys/ipc.h>
37+#include <sys/shm.h>
38+#include <unistd.h>
39+
40+int main(void)
41+{
42+ char buf[128];
43+ int err, fd;
44+ int shmid;
45+ ssize_t n;
46+ void *p;
47+
48+ shmid = shmget(IPC_PRIVATE, 1, IPC_CREAT | 0600);
49+ assert(shmid != -1);
50+
51+ /*
52+ * The original bug required a non-NULL address, which skipped the
53+ * mmap_find_vma step, which could result in a host mapping smaller
54+ * than the target mapping. Choose an address at random.
55+ */
56+ p = shmat(shmid, (void *)0x800000, SHM_RND);
57+ if (p == (void *)-1) {
58+ /*
59+ * Because we are now running the testcase for all guests for which
60+ * we have a cross-compiler, the above random address might conflict
61+ * with the guest executable in some way. Rather than stopping,
62+ * continue with a system supplied address, which should never fail.
63+ */
64+ p = shmat(shmid, NULL, 0);
65+ assert(p != (void *)-1);
66+ }
67+
68+ fd = open("/proc/self/maps", O_RDONLY);
69+ assert(fd != -1);
70+ do {
71+ n = read(fd, buf, sizeof(buf));
72+ assert(n >= 0);
73+ } while (n != 0);
74+ close(fd);
75+
76+ err = shmdt(p);
77+ assert(err == 0);
78+ err = shmctl(shmid, IPC_RMID, NULL);
79+ assert(err == 0);
80+
81+ return EXIT_SUCCESS;
82+}
83--
842.34.1
85
diff --git a/meta/recipes-devtools/qemu/qemu/0007-qemu-Determinism-fixes.patch b/meta/recipes-devtools/qemu/qemu/0006-qemu-Determinism-fixes.patch
index d3f965e070..f07054f19a 100644
--- a/meta/recipes-devtools/qemu/qemu/0007-qemu-Determinism-fixes.patch
+++ b/meta/recipes-devtools/qemu/qemu/0006-qemu-Determinism-fixes.patch
@@ -1,7 +1,7 @@
1From 50bab5c2605b609ea7ea154f57a9be96d656725a Mon Sep 17 00:00:00 2001 1From 9d32df80e33a7541658858497f45bed1e59e3621 Mon Sep 17 00:00:00 2001
2From: Richard Purdie <richard.purdie@linuxfoundation.org> 2From: Richard Purdie <richard.purdie@linuxfoundation.org>
3Date: Mon, 1 Mar 2021 13:00:47 +0000 3Date: Mon, 1 Mar 2021 13:00:47 +0000
4Subject: [PATCH 07/12] qemu: Determinism fixes 4Subject: [PATCH 06/11] qemu: Determinism fixes
5 5
6When sources are included within debug information, a couple of areas of the 6When sources are included within debug information, a couple of areas of the
7qemu build are not reproducible due to either full buildpaths or timestamps. 7qemu build are not reproducible due to either full buildpaths or timestamps.
@@ -11,16 +11,15 @@ meson to pass relative paths but we can fix that in the script.
11 11
12Upstream-Status: Pending [some version of all/part of this may be accepted] 12Upstream-Status: Pending [some version of all/part of this may be accepted]
13RP 2021/3/1 13RP 2021/3/1
14
15--- 14---
16 scripts/decodetree.py | 2 +- 15 scripts/decodetree.py | 2 +-
17 1 file changed, 1 insertion(+), 1 deletion(-) 16 1 file changed, 1 insertion(+), 1 deletion(-)
18 17
19Index: qemu-8.0.0/scripts/decodetree.py 18diff --git a/scripts/decodetree.py b/scripts/decodetree.py
20=================================================================== 19index e8b72da3a9..5cd86b1428 100644
21--- qemu-8.0.0.orig/scripts/decodetree.py 20--- a/scripts/decodetree.py
22+++ qemu-8.0.0/scripts/decodetree.py 21+++ b/scripts/decodetree.py
23@@ -1328,7 +1328,7 @@ def main(): 22@@ -1558,7 +1558,7 @@ def main():
24 toppat = ExcMultiPattern(0) 23 toppat = ExcMultiPattern(0)
25 24
26 for filename in args: 25 for filename in args:
@@ -29,3 +28,6 @@ Index: qemu-8.0.0/scripts/decodetree.py
29 f = open(filename, 'rt', encoding='utf-8') 28 f = open(filename, 'rt', encoding='utf-8')
30 parse_file(f, toppat) 29 parse_file(f, toppat)
31 f.close() 30 f.close()
31--
322.44.0
33
diff --git a/meta/recipes-devtools/qemu/qemu/0008-tests-meson.build-use-relative-path-to-refer-to-file.patch b/meta/recipes-devtools/qemu/qemu/0007-tests-meson.build-use-relative-path-to-refer-to-file.patch
index a84364ccc1..74de158b2e 100644
--- a/meta/recipes-devtools/qemu/qemu/0008-tests-meson.build-use-relative-path-to-refer-to-file.patch
+++ b/meta/recipes-devtools/qemu/qemu/0007-tests-meson.build-use-relative-path-to-refer-to-file.patch
@@ -1,7 +1,7 @@
1From 2bf9388b801d4389e2d57e95a7897bfc1c42786e Mon Sep 17 00:00:00 2001 1From 77ebf67d0c96f51da91c8499200ebd13f4dcdd68 Mon Sep 17 00:00:00 2001
2From: Changqing Li <changqing.li@windriver.com> 2From: Changqing Li <changqing.li@windriver.com>
3Date: Thu, 14 Jan 2021 06:33:04 +0000 3Date: Thu, 14 Jan 2021 06:33:04 +0000
4Subject: [PATCH 08/12] tests/meson.build: use relative path to refer to files 4Subject: [PATCH 07/11] tests/meson.build: use relative path to refer to files
5 5
6Fix error like: 6Fix error like:
7Fatal error: can't create tests/ptimer-test.p/..._qemu-5.2.0_hw_core_ptimer.c.o: File name too long 7Fatal error: can't create tests/ptimer-test.p/..._qemu-5.2.0_hw_core_ptimer.c.o: File name too long
@@ -12,16 +12,15 @@ filename too long. Fixed by using relative path to refer to files
12Upstream-Status: Submitted [send to qemu-devel] 12Upstream-Status: Submitted [send to qemu-devel]
13 13
14Signed-off-by: Changqing Li <changqing.li@windriver.com> 14Signed-off-by: Changqing Li <changqing.li@windriver.com>
15
16--- 15---
17 tests/unit/meson.build | 4 ++-- 16 tests/unit/meson.build | 4 ++--
18 1 file changed, 2 insertions(+), 2 deletions(-) 17 1 file changed, 2 insertions(+), 2 deletions(-)
19 18
20Index: qemu-8.0.0/tests/unit/meson.build 19diff --git a/tests/unit/meson.build b/tests/unit/meson.build
21=================================================================== 20index 228a21d03c..272fb4c6ca 100644
22--- qemu-8.0.0.orig/tests/unit/meson.build 21--- a/tests/unit/meson.build
23+++ qemu-8.0.0/tests/unit/meson.build 22+++ b/tests/unit/meson.build
24@@ -46,7 +46,7 @@ tests = { 23@@ -47,7 +47,7 @@ tests = {
25 'test-keyval': [testqapi], 24 'test-keyval': [testqapi],
26 'test-logging': [], 25 'test-logging': [],
27 'test-uuid': [], 26 'test-uuid': [],
@@ -30,7 +29,7 @@ Index: qemu-8.0.0/tests/unit/meson.build
30 'test-qapi-util': [], 29 'test-qapi-util': [],
31 'test-interval-tree': [], 30 'test-interval-tree': [],
32 'test-xs-node': [qom], 31 'test-xs-node': [qom],
33@@ -136,7 +136,7 @@ if have_system 32@@ -138,7 +138,7 @@ if have_system
34 'test-util-sockets': ['socket-helpers.c'], 33 'test-util-sockets': ['socket-helpers.c'],
35 'test-base64': [], 34 'test-base64': [],
36 'test-bufferiszero': [], 35 'test-bufferiszero': [],
@@ -39,3 +38,6 @@ Index: qemu-8.0.0/tests/unit/meson.build
39 'test-vmstate': [migration, io], 38 'test-vmstate': [migration, io],
40 'test-yank': ['socket-helpers.c', qom, io, chardev] 39 'test-yank': ['socket-helpers.c', qom, io, chardev]
41 } 40 }
41--
422.44.0
43
diff --git a/meta/recipes-devtools/qemu/qemu/0009-Define-MAP_SYNC-and-MAP_SHARED_VALIDATE-on-needed-li.patch b/meta/recipes-devtools/qemu/qemu/0008-Define-MAP_SYNC-and-MAP_SHARED_VALIDATE-on-needed-li.patch
index 4de6cc2445..2e28590e11 100644
--- a/meta/recipes-devtools/qemu/qemu/0009-Define-MAP_SYNC-and-MAP_SHARED_VALIDATE-on-needed-li.patch
+++ b/meta/recipes-devtools/qemu/qemu/0008-Define-MAP_SYNC-and-MAP_SHARED_VALIDATE-on-needed-li.patch
@@ -1,7 +1,7 @@
1From ebf4bb2f51da83af0c61480414cfa156f7308b34 Mon Sep 17 00:00:00 2001 1From 21b159a11bbcb1eeb26f12456e4c3fd62a06cbec Mon Sep 17 00:00:00 2001
2From: Khem Raj <raj.khem@gmail.com> 2From: Khem Raj <raj.khem@gmail.com>
3Date: Mon, 21 Mar 2022 10:09:38 -0700 3Date: Mon, 21 Mar 2022 10:09:38 -0700
4Subject: [PATCH 09/12] Define MAP_SYNC and MAP_SHARED_VALIDATE on needed linux 4Subject: [PATCH 08/11] Define MAP_SYNC and MAP_SHARED_VALIDATE on needed linux
5 systems 5 systems
6 6
7linux only wires MAP_SYNC and MAP_SHARED_VALIDATE for architectures 7linux only wires MAP_SYNC and MAP_SHARED_VALIDATE for architectures
@@ -13,15 +13,14 @@ Upstream-Status: Submitted [https://lists.nongnu.org/archive/html/qemu-devel/202
13Signed-off-by: Khem Raj <raj.khem@gmail.com> 13Signed-off-by: Khem Raj <raj.khem@gmail.com>
14Cc: Zhang Yi <yi.z.zhang@linux.intel.com> 14Cc: Zhang Yi <yi.z.zhang@linux.intel.com>
15Cc: Michael S. Tsirkin <mst@redhat.com> 15Cc: Michael S. Tsirkin <mst@redhat.com>
16
17--- 16---
18 util/mmap-alloc.c | 10 +++++++--- 17 util/mmap-alloc.c | 10 +++++++---
19 1 file changed, 7 insertions(+), 3 deletions(-) 18 1 file changed, 7 insertions(+), 3 deletions(-)
20 19
21Index: qemu-8.0.0/util/mmap-alloc.c 20diff --git a/util/mmap-alloc.c b/util/mmap-alloc.c
22=================================================================== 21index ed14f9c64d..038f5b4b55 100644
23--- qemu-8.0.0.orig/util/mmap-alloc.c 22--- a/util/mmap-alloc.c
24+++ qemu-8.0.0/util/mmap-alloc.c 23+++ b/util/mmap-alloc.c
25@@ -10,14 +10,18 @@ 24@@ -10,14 +10,18 @@
26 * later. See the COPYING file in the top-level directory. 25 * later. See the COPYING file in the top-level directory.
27 */ 26 */
@@ -44,3 +43,6 @@ Index: qemu-8.0.0/util/mmap-alloc.c
44 #include "qemu/mmap-alloc.h" 43 #include "qemu/mmap-alloc.h"
45 #include "qemu/host-utils.h" 44 #include "qemu/host-utils.h"
46 #include "qemu/cutils.h" 45 #include "qemu/cutils.h"
46--
472.44.0
48
diff --git a/meta/recipes-devtools/qemu/qemu/0002-linux-user-Replace-use-of-lfs64-related-functions-an.patch b/meta/recipes-devtools/qemu/qemu/0009-linux-user-Replace-use-of-lfs64-related-functions-an.patch
index ceae67be64..7577249d39 100644
--- a/meta/recipes-devtools/qemu/qemu/0002-linux-user-Replace-use-of-lfs64-related-functions-an.patch
+++ b/meta/recipes-devtools/qemu/qemu/0009-linux-user-Replace-use-of-lfs64-related-functions-an.patch
@@ -1,7 +1,7 @@
1From 71f14902256e3c3529710b713e1ea43100bf4c40 Mon Sep 17 00:00:00 2001 1From 23de30079dbf47a8026faddd550a9e181d609c8f Mon Sep 17 00:00:00 2001
2From: Khem Raj <raj.khem@gmail.com> 2From: Khem Raj <raj.khem@gmail.com>
3Date: Sat, 17 Dec 2022 08:37:46 -0800 3Date: Sat, 17 Dec 2022 08:37:46 -0800
4Subject: [PATCH 2/2] linux-user: Replace use of lfs64 related functions and 4Subject: [PATCH 09/11] linux-user: Replace use of lfs64 related functions and
5 macros 5 macros
6 6
7Builds defines -D_FILE_OFFSET_BITS=64 which makes the original functions 7Builds defines -D_FILE_OFFSET_BITS=64 which makes the original functions
@@ -16,11 +16,11 @@ Cc: Laurent Vivier <laurent@vivier.eu>
16 linux-user/syscall.c | 153 +++++++++++-------------------------------- 16 linux-user/syscall.c | 153 +++++++++++--------------------------------
17 1 file changed, 39 insertions(+), 114 deletions(-) 17 1 file changed, 39 insertions(+), 114 deletions(-)
18 18
19Index: qemu-8.0.0/linux-user/syscall.c 19diff --git a/linux-user/syscall.c b/linux-user/syscall.c
20=================================================================== 20index 18f09f1f07..1b7c50a2a7 100644
21--- qemu-8.0.0.orig/linux-user/syscall.c 21--- a/linux-user/syscall.c
22+++ qemu-8.0.0/linux-user/syscall.c 22+++ b/linux-user/syscall.c
23@@ -761,8 +761,8 @@ safe_syscall6(ssize_t, copy_file_range, 23@@ -761,8 +761,8 @@ safe_syscall6(ssize_t, copy_file_range, int, infd, loff_t *, pinoff,
24 */ 24 */
25 #define safe_ioctl(...) safe_syscall(__NR_ioctl, __VA_ARGS__) 25 #define safe_ioctl(...) safe_syscall(__NR_ioctl, __VA_ARGS__)
26 /* Similarly for fcntl. Note that callers must always: 26 /* Similarly for fcntl. Note that callers must always:
@@ -31,7 +31,7 @@ Index: qemu-8.0.0/linux-user/syscall.c
31 * This will then work and use a 64-bit offset for both 32-bit and 64-bit hosts. 31 * This will then work and use a 64-bit offset for both 32-bit and 64-bit hosts.
32 */ 32 */
33 #ifdef __NR_fcntl64 33 #ifdef __NR_fcntl64
34@@ -6813,13 +6813,13 @@ static int target_to_host_fcntl_cmd(int 34@@ -6739,13 +6739,13 @@ static int target_to_host_fcntl_cmd(int cmd)
35 ret = cmd; 35 ret = cmd;
36 break; 36 break;
37 case TARGET_F_GETLK: 37 case TARGET_F_GETLK:
@@ -48,7 +48,7 @@ Index: qemu-8.0.0/linux-user/syscall.c
48 break; 48 break;
49 case TARGET_F_GETOWN: 49 case TARGET_F_GETOWN:
50 ret = F_GETOWN; 50 ret = F_GETOWN;
51@@ -6833,17 +6833,6 @@ static int target_to_host_fcntl_cmd(int 51@@ -6759,17 +6759,6 @@ static int target_to_host_fcntl_cmd(int cmd)
52 case TARGET_F_SETSIG: 52 case TARGET_F_SETSIG:
53 ret = F_SETSIG; 53 ret = F_SETSIG;
54 break; 54 break;
@@ -66,7 +66,7 @@ Index: qemu-8.0.0/linux-user/syscall.c
66 case TARGET_F_SETLEASE: 66 case TARGET_F_SETLEASE:
67 ret = F_SETLEASE; 67 ret = F_SETLEASE;
68 break; 68 break;
69@@ -6895,8 +6884,8 @@ static int target_to_host_fcntl_cmd(int 69@@ -6821,8 +6810,8 @@ static int target_to_host_fcntl_cmd(int cmd)
70 * them to 5, 6 and 7 before making the syscall(). Since we make the 70 * them to 5, 6 and 7 before making the syscall(). Since we make the
71 * syscall directly, adjust to what is supported by the kernel. 71 * syscall directly, adjust to what is supported by the kernel.
72 */ 72 */
@@ -77,7 +77,7 @@ Index: qemu-8.0.0/linux-user/syscall.c
77 } 77 }
78 #endif 78 #endif
79 79
80@@ -6929,55 +6918,11 @@ static int host_to_target_flock(int type 80@@ -6855,55 +6844,11 @@ static int host_to_target_flock(int type)
81 return type; 81 return type;
82 } 82 }
83 83
@@ -136,7 +136,7 @@ Index: qemu-8.0.0/linux-user/syscall.c
136 abi_short l_type; 136 abi_short l_type;
137 abi_short l_whence; 137 abi_short l_whence;
138 abi_llong l_start; 138 abi_llong l_start;
139@@ -6985,10 +6930,10 @@ struct target_oabi_flock64 { 139@@ -6911,10 +6856,10 @@ struct target_oabi_flock64 {
140 abi_int l_pid; 140 abi_int l_pid;
141 } QEMU_PACKED; 141 } QEMU_PACKED;
142 142
@@ -149,7 +149,7 @@ Index: qemu-8.0.0/linux-user/syscall.c
149 int l_type; 149 int l_type;
150 150
151 if (!lock_user_struct(VERIFY_READ, target_fl, target_flock_addr, 1)) { 151 if (!lock_user_struct(VERIFY_READ, target_fl, target_flock_addr, 1)) {
152@@ -7009,10 +6954,10 @@ static inline abi_long copy_from_user_oa 152@@ -6935,10 +6880,10 @@ static inline abi_long copy_from_user_oabi_flock64(struct flock64 *fl,
153 return 0; 153 return 0;
154 } 154 }
155 155
@@ -163,7 +163,7 @@ Index: qemu-8.0.0/linux-user/syscall.c
163 short l_type; 163 short l_type;
164 164
165 if (!lock_user_struct(VERIFY_WRITE, target_fl, target_flock_addr, 0)) { 165 if (!lock_user_struct(VERIFY_WRITE, target_fl, target_flock_addr, 0)) {
166@@ -7030,10 +6975,10 @@ static inline abi_long copy_to_user_oabi 166@@ -6956,10 +6901,10 @@ static inline abi_long copy_to_user_oabi_flock64(abi_ulong target_flock_addr,
167 } 167 }
168 #endif 168 #endif
169 169
@@ -176,7 +176,7 @@ Index: qemu-8.0.0/linux-user/syscall.c
176 int l_type; 176 int l_type;
177 177
178 if (!lock_user_struct(VERIFY_READ, target_fl, target_flock_addr, 1)) { 178 if (!lock_user_struct(VERIFY_READ, target_fl, target_flock_addr, 1)) {
179@@ -7054,10 +6999,10 @@ static inline abi_long copy_from_user_fl 179@@ -6980,10 +6925,10 @@ static inline abi_long copy_from_user_flock64(struct flock64 *fl,
180 return 0; 180 return 0;
181 } 181 }
182 182
@@ -190,7 +190,7 @@ Index: qemu-8.0.0/linux-user/syscall.c
190 short l_type; 190 short l_type;
191 191
192 if (!lock_user_struct(VERIFY_WRITE, target_fl, target_flock_addr, 0)) { 192 if (!lock_user_struct(VERIFY_WRITE, target_fl, target_flock_addr, 0)) {
193@@ -7076,7 +7021,7 @@ static inline abi_long copy_to_user_floc 193@@ -7002,7 +6947,7 @@ static inline abi_long copy_to_user_flock64(abi_ulong target_flock_addr,
194 194
195 static abi_long do_fcntl(int fd, int cmd, abi_ulong arg) 195 static abi_long do_fcntl(int fd, int cmd, abi_ulong arg)
196 { 196 {
@@ -199,7 +199,7 @@ Index: qemu-8.0.0/linux-user/syscall.c
199 #ifdef F_GETOWN_EX 199 #ifdef F_GETOWN_EX
200 struct f_owner_ex fox; 200 struct f_owner_ex fox;
201 struct target_f_owner_ex *target_fox; 201 struct target_f_owner_ex *target_fox;
202@@ -7089,6 +7034,7 @@ static abi_long do_fcntl(int fd, int cmd 202@@ -7015,6 +6960,7 @@ static abi_long do_fcntl(int fd, int cmd, abi_ulong arg)
203 203
204 switch(cmd) { 204 switch(cmd) {
205 case TARGET_F_GETLK: 205 case TARGET_F_GETLK:
@@ -207,7 +207,7 @@ Index: qemu-8.0.0/linux-user/syscall.c
207 ret = copy_from_user_flock(&fl64, arg); 207 ret = copy_from_user_flock(&fl64, arg);
208 if (ret) { 208 if (ret) {
209 return ret; 209 return ret;
210@@ -7098,32 +7044,11 @@ static abi_long do_fcntl(int fd, int cmd 210@@ -7024,32 +6970,11 @@ static abi_long do_fcntl(int fd, int cmd, abi_ulong arg)
211 ret = copy_to_user_flock(arg, &fl64); 211 ret = copy_to_user_flock(arg, &fl64);
212 } 212 }
213 break; 213 break;
@@ -241,7 +241,7 @@ Index: qemu-8.0.0/linux-user/syscall.c
241 if (ret) { 241 if (ret) {
242 return ret; 242 return ret;
243 } 243 }
244@@ -7348,7 +7273,7 @@ static inline abi_long target_truncate64 244@@ -7278,7 +7203,7 @@ static inline abi_long target_truncate64(CPUArchState *cpu_env, const char *arg1
245 arg2 = arg3; 245 arg2 = arg3;
246 arg3 = arg4; 246 arg3 = arg4;
247 } 247 }
@@ -250,7 +250,7 @@ Index: qemu-8.0.0/linux-user/syscall.c
250 } 250 }
251 #endif 251 #endif
252 252
253@@ -7362,7 +7287,7 @@ static inline abi_long target_ftruncate6 253@@ -7292,7 +7217,7 @@ static inline abi_long target_ftruncate64(CPUArchState *cpu_env, abi_long arg1,
254 arg2 = arg3; 254 arg2 = arg3;
255 arg3 = arg4; 255 arg3 = arg4;
256 } 256 }
@@ -259,7 +259,7 @@ Index: qemu-8.0.0/linux-user/syscall.c
259 } 259 }
260 #endif 260 #endif
261 261
262@@ -8598,7 +8523,7 @@ static int do_getdents(abi_long dirfd, a 262@@ -8667,7 +8592,7 @@ static int do_getdents(abi_long dirfd, abi_long arg2, abi_long count)
263 void *tdirp; 263 void *tdirp;
264 int hlen, hoff, toff; 264 int hlen, hoff, toff;
265 int hreclen, treclen; 265 int hreclen, treclen;
@@ -268,7 +268,7 @@ Index: qemu-8.0.0/linux-user/syscall.c
268 268
269 hdirp = g_try_malloc(count); 269 hdirp = g_try_malloc(count);
270 if (!hdirp) { 270 if (!hdirp) {
271@@ -8651,7 +8576,7 @@ static int do_getdents(abi_long dirfd, a 271@@ -8720,7 +8645,7 @@ static int do_getdents(abi_long dirfd, abi_long arg2, abi_long count)
272 * Return what we have, resetting the file pointer to the 272 * Return what we have, resetting the file pointer to the
273 * location of the first record not returned. 273 * location of the first record not returned.
274 */ 274 */
@@ -277,7 +277,7 @@ Index: qemu-8.0.0/linux-user/syscall.c
277 break; 277 break;
278 } 278 }
279 279
280@@ -8685,7 +8610,7 @@ static int do_getdents64(abi_long dirfd, 280@@ -8754,7 +8679,7 @@ static int do_getdents64(abi_long dirfd, abi_long arg2, abi_long count)
281 void *tdirp; 281 void *tdirp;
282 int hlen, hoff, toff; 282 int hlen, hoff, toff;
283 int hreclen, treclen; 283 int hreclen, treclen;
@@ -286,7 +286,7 @@ Index: qemu-8.0.0/linux-user/syscall.c
286 286
287 hdirp = g_try_malloc(count); 287 hdirp = g_try_malloc(count);
288 if (!hdirp) { 288 if (!hdirp) {
289@@ -8727,7 +8652,7 @@ static int do_getdents64(abi_long dirfd, 289@@ -8796,7 +8721,7 @@ static int do_getdents64(abi_long dirfd, abi_long arg2, abi_long count)
290 * Return what we have, resetting the file pointer to the 290 * Return what we have, resetting the file pointer to the
291 * location of the first record not returned. 291 * location of the first record not returned.
292 */ 292 */
@@ -295,7 +295,7 @@ Index: qemu-8.0.0/linux-user/syscall.c
295 break; 295 break;
296 } 296 }
297 297
298@@ -11158,7 +11083,7 @@ static abi_long do_syscall1(CPUArchState 298@@ -11527,7 +11452,7 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
299 return -TARGET_EFAULT; 299 return -TARGET_EFAULT;
300 } 300 }
301 } 301 }
@@ -304,7 +304,7 @@ Index: qemu-8.0.0/linux-user/syscall.c
304 unlock_user(p, arg2, ret); 304 unlock_user(p, arg2, ret);
305 return ret; 305 return ret;
306 case TARGET_NR_pwrite64: 306 case TARGET_NR_pwrite64:
307@@ -11175,7 +11100,7 @@ static abi_long do_syscall1(CPUArchState 307@@ -11544,7 +11469,7 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
308 return -TARGET_EFAULT; 308 return -TARGET_EFAULT;
309 } 309 }
310 } 310 }
@@ -313,7 +313,7 @@ Index: qemu-8.0.0/linux-user/syscall.c
313 unlock_user(p, arg2, 0); 313 unlock_user(p, arg2, 0);
314 return ret; 314 return ret;
315 #endif 315 #endif
316@@ -11998,14 +11923,14 @@ static abi_long do_syscall1(CPUArchState 316@@ -12404,14 +12329,14 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
317 case TARGET_NR_fcntl64: 317 case TARGET_NR_fcntl64:
318 { 318 {
319 int cmd; 319 int cmd;
@@ -333,7 +333,7 @@ Index: qemu-8.0.0/linux-user/syscall.c
333 } 333 }
334 #endif 334 #endif
335 335
336@@ -12015,7 +11940,7 @@ static abi_long do_syscall1(CPUArchState 336@@ -12421,7 +12346,7 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
337 } 337 }
338 338
339 switch(arg2) { 339 switch(arg2) {
@@ -342,7 +342,7 @@ Index: qemu-8.0.0/linux-user/syscall.c
342 ret = copyfrom(&fl, arg3); 342 ret = copyfrom(&fl, arg3);
343 if (ret) { 343 if (ret) {
344 break; 344 break;
345@@ -12026,8 +11951,8 @@ static abi_long do_syscall1(CPUArchState 345@@ -12432,8 +12357,8 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
346 } 346 }
347 break; 347 break;
348 348
@@ -353,3 +353,6 @@ Index: qemu-8.0.0/linux-user/syscall.c
353 ret = copyfrom(&fl, arg3); 353 ret = copyfrom(&fl, arg3);
354 if (ret) { 354 if (ret) {
355 break; 355 break;
356--
3572.44.0
358
diff --git a/meta/recipes-devtools/qemu/qemu/fixedmeson.patch b/meta/recipes-devtools/qemu/qemu/0010-configure-lookup-meson-exutable-from-PATH.patch
index 9047f66dc3..98ce85a8cf 100644
--- a/meta/recipes-devtools/qemu/qemu/fixedmeson.patch
+++ b/meta/recipes-devtools/qemu/qemu/0010-configure-lookup-meson-exutable-from-PATH.patch
@@ -1,10 +1,18 @@
1From e12a93174f9b652604dda8d8464b9559b62b29d5 Mon Sep 17 00:00:00 2001
2From: =?UTF-8?q?Martin=20Hundeb=C3=B8ll?= <martin@geanix.com>
3Date: Wed, 22 May 2024 14:02:55 +0200
4Subject: [PATCH 10/11] configure: lookup meson exutable from PATH
5
1Upstream-Status: Inappropriate [workaround, would need a real fix for upstream] 6Upstream-Status: Inappropriate [workaround, would need a real fix for upstream]
7---
8 configure | 7 +------
9 1 file changed, 1 insertion(+), 6 deletions(-)
2 10
3Index: qemu-8.2.0/configure 11diff --git a/configure b/configure
4=================================================================== 12index 3cd736b139..482a1f8ef3 100755
5--- qemu-8.2.0.orig/configure 13--- a/configure
6+++ qemu-8.2.0/configure 14+++ b/configure
7@@ -955,12 +955,7 @@ fi 15@@ -956,12 +956,7 @@ fi
8 $mkvenv ensuregroup --dir "${source_path}/python/wheels" \ 16 $mkvenv ensuregroup --dir "${source_path}/python/wheels" \
9 ${source_path}/pythondeps.toml meson || exit 1 17 ${source_path}/pythondeps.toml meson || exit 1
10 18
@@ -18,3 +26,6 @@ Index: qemu-8.2.0/configure
18 26
19 # Conditionally ensure Sphinx is installed. 27 # Conditionally ensure Sphinx is installed.
20 28
29--
302.44.0
31
diff --git a/meta/recipes-devtools/qemu/qemu/0010-hw-pvrdma-Protect-against-buggy-or-malicious-guest-d.patch b/meta/recipes-devtools/qemu/qemu/0010-hw-pvrdma-Protect-against-buggy-or-malicious-guest-d.patch
deleted file mode 100644
index 6caf35b634..0000000000
--- a/meta/recipes-devtools/qemu/qemu/0010-hw-pvrdma-Protect-against-buggy-or-malicious-guest-d.patch
+++ /dev/null
@@ -1,40 +0,0 @@
1CVE: CVE-2022-1050
2Upstream-Status: Submitted [https://lore.kernel.org/qemu-devel/20220403095234.2210-1-yuval.shaia.ml@gmail.com/]
3Signed-off-by: Ross Burton <ross.burton@arm.com>
4
5From dbdef95c272e8f3ec037c3db4197c66002e30995 Mon Sep 17 00:00:00 2001
6From: Yuval Shaia <yuval.shaia.ml@gmail.com>
7Date: Sun, 3 Apr 2022 12:52:34 +0300
8Subject: [PATCH] hw/pvrdma: Protect against buggy or malicious guest driver
9
10Guest driver might execute HW commands when shared buffers are not yet
11allocated.
12This could happen on purpose (malicious guest) or because of some other
13guest/host address mapping error.
14We need to protect againts such case.
15
16Fixes: CVE-2022-1050
17
18Reported-by: Raven <wxhusst@gmail.com>
19Signed-off-by: Yuval Shaia <yuval.shaia.ml@gmail.com>
20---
21 hw/rdma/vmw/pvrdma_cmd.c | 6 ++++++
22 1 file changed, 6 insertions(+)
23
24Index: qemu-8.0.0/hw/rdma/vmw/pvrdma_cmd.c
25===================================================================
26--- qemu-8.0.0.orig/hw/rdma/vmw/pvrdma_cmd.c
27+++ qemu-8.0.0/hw/rdma/vmw/pvrdma_cmd.c
28@@ -782,6 +782,12 @@ int pvrdma_exec_cmd(PVRDMADev *dev)
29 goto out;
30 }
31
32+ if (!dsr_info->dsr) {
33+ /* Buggy or malicious guest driver */
34+ rdma_error_report("Exec command without dsr, req or rsp buffers");
35+ goto out;
36+ }
37+
38 if (dsr_info->req->hdr.cmd >= sizeof(cmd_handlers) /
39 sizeof(struct cmd_handler)) {
40 rdma_error_report("Unsupported command");
diff --git a/meta/recipes-devtools/qemu/qemu/0011-linux-user-workaround-for-missing-MAP_FIXED_NOREPLAC.patch b/meta/recipes-devtools/qemu/qemu/0011-linux-user-workaround-for-missing-MAP_FIXED_NOREPLAC.patch
deleted file mode 100644
index cc53b1eedd..0000000000
--- a/meta/recipes-devtools/qemu/qemu/0011-linux-user-workaround-for-missing-MAP_FIXED_NOREPLAC.patch
+++ /dev/null
@@ -1,282 +0,0 @@
1From fa9bcabe2387bb230ef82d62827ad6f93b8a1e61 Mon Sep 17 00:00:00 2001
2From: Frederic Konrad <fkonrad@amd.com>
3Date: Wed, 17 Jan 2024 18:15:06 +0000
4Subject: [PATCH 1/2] linux-user/*: workaround for missing MAP_FIXED_NOREPLACE
5
6QEMU v8.1.0 recently requires MAP_FIXED_NOREPLACE flags implementation for mmap.
7
8This is missing from ubuntu 18.04, thus this patch catches the mmap calls which
9could use that new flag and forwards them to mmap when MAP_FIXED_NOREPLACE
10flag isn't set or emulates them by checking the returned address w.r.t the
11requested address.
12
13Signed-off-by: Frederic Konrad <fkonrad@amd.com>
14Signed-off-by: Francisco Iglesias <francisco.iglesias@amd.com>
15
16Upstream-Status: Inappropriate [OE specific]
17
18The upstream only supports the last two major releases of an OS. The ones
19they have declared all have kernel 4.17 or newer.
20
21See:
22https://xilinx.slack.com/archives/D04G2647CTV/p1705074697942019
23
24https://www.qemu.org/docs/master/about/build-platforms.html
25
26 The project aims to support the most recent major version at all times for up
27 to five years after its initial release. Support for the previous major
28 version will be dropped 2 years after the new major version is released or
29 when the vendor itself drops support, whichever comes first.
30
31Signed-off-by: Mark Hatle <mark.hatle@amd.com>
32---
33 linux-user/elfload.c | 7 +++--
34 linux-user/meson.build | 1 +
35 linux-user/mmap-fixed.c | 63 +++++++++++++++++++++++++++++++++++++++++
36 linux-user/mmap-fixed.h | 39 +++++++++++++++++++++++++
37 linux-user/mmap.c | 31 +++++++++++---------
38 linux-user/syscall.c | 1 +
39 6 files changed, 125 insertions(+), 17 deletions(-)
40 create mode 100644 linux-user/mmap-fixed.c
41 create mode 100644 linux-user/mmap-fixed.h
42
43Index: qemu-8.2.1/linux-user/elfload.c
44===================================================================
45--- qemu-8.2.1.orig/linux-user/elfload.c
46+++ qemu-8.2.1/linux-user/elfload.c
47@@ -22,6 +22,7 @@
48 #include "qemu/error-report.h"
49 #include "target_signal.h"
50 #include "accel/tcg/debuginfo.h"
51+#include "mmap-fixed.h"
52
53 #ifdef TARGET_ARM
54 #include "target/arm/cpu-features.h"
55@@ -2765,9 +2766,9 @@ static abi_ulong create_elf_tables(abi_u
56 static int pgb_try_mmap(uintptr_t addr, uintptr_t addr_last, bool keep)
57 {
58 size_t size = addr_last - addr + 1;
59- void *p = mmap((void *)addr, size, PROT_NONE,
60- MAP_ANONYMOUS | MAP_PRIVATE |
61- MAP_NORESERVE | MAP_FIXED_NOREPLACE, -1, 0);
62+ void *p = mmap_fixed_noreplace((void *)addr, size, PROT_NONE,
63+ MAP_ANONYMOUS | MAP_PRIVATE |
64+ MAP_NORESERVE | MAP_FIXED_NOREPLACE, -1, 0);
65 int ret;
66
67 if (p == MAP_FAILED) {
68Index: qemu-8.2.1/linux-user/meson.build
69===================================================================
70--- qemu-8.2.1.orig/linux-user/meson.build
71+++ qemu-8.2.1/linux-user/meson.build
72@@ -14,6 +14,7 @@ linux_user_ss.add(files(
73 'linuxload.c',
74 'main.c',
75 'mmap.c',
76+ 'mmap-fixed.c',
77 'signal.c',
78 'strace.c',
79 'syscall.c',
80Index: qemu-8.2.1/linux-user/mmap-fixed.c
81===================================================================
82--- /dev/null
83+++ qemu-8.2.1/linux-user/mmap-fixed.c
84@@ -0,0 +1,63 @@
85+/*
86+ * Workaround for MAP_FIXED_NOREPLACE
87+ *
88+ * Copyright (c) 2024, Advanced Micro Devices, Inc.
89+ * Developed by Fred Konrad <fkonrad@amd.com>
90+ *
91+ * Permission is hereby granted, free of charge, to any person obtaining a copy
92+ * of this software and associated documentation files (the "Software"), to deal
93+ * in the Software without restriction, including without limitation the rights
94+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
95+ * copies of the Software, and to permit persons to whom the Software is
96+ * furnished to do so, subject to the following conditions:
97+ *
98+ * The above copyright notice and this permission notice shall be included in
99+ * all copies or substantial portions of the Software.
100+ *
101+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
102+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
103+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
104+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
105+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
106+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
107+ * THE SOFTWARE.
108+ */
109+
110+#include <sys/mman.h>
111+#include <errno.h>
112+
113+#ifndef MAP_FIXED_NOREPLACE
114+#include "mmap-fixed.h"
115+
116+void *mmap_fixed_noreplace(void *addr, size_t len, int prot, int flags,
117+ int fd, off_t offset)
118+{
119+ void *retaddr;
120+
121+ if (!(flags & MAP_FIXED_NOREPLACE)) {
122+ /* General case, use the regular mmap. */
123+ return mmap(addr, len, prot, flags, fd, offset);
124+ }
125+
126+ /* Since MAP_FIXED_NOREPLACE is not implemented, try to emulate it. */
127+ flags = flags & ~(MAP_FIXED_NOREPLACE | MAP_FIXED);
128+ retaddr = mmap(addr, len, prot, flags, fd, offset);
129+ if ((retaddr == addr) || (retaddr == MAP_FAILED)) {
130+ /*
131+ * Either the map worked and we get the good address so it can be
132+ * returned, or it failed and would have failed the same with
133+ * MAP_FIXED*, in which case return MAP_FAILED.
134+ */
135+ return retaddr;
136+ } else {
137+ /*
138+ * Page has been mapped but not at the requested address.. unmap it and
139+ * return EEXIST.
140+ */
141+ munmap(retaddr, len);
142+ errno = EEXIST;
143+ return MAP_FAILED;
144+ }
145+}
146+
147+#endif
148Index: qemu-8.2.1/linux-user/mmap-fixed.h
149===================================================================
150--- /dev/null
151+++ qemu-8.2.1/linux-user/mmap-fixed.h
152@@ -0,0 +1,39 @@
153+/*
154+ * Workaround for MAP_FIXED_NOREPLACE
155+ *
156+ * Copyright (c) 2024, Advanced Micro Devices, Inc.
157+ * Developed by Fred Konrad <fkonrad@amd.com>
158+ *
159+ * Permission is hereby granted, free of charge, to any person obtaining a copy
160+ * of this software and associated documentation files (the "Software"), to deal
161+ * in the Software without restriction, including without limitation the rights
162+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
163+ * copies of the Software, and to permit persons to whom the Software is
164+ * furnished to do so, subject to the following conditions:
165+ *
166+ * The above copyright notice and this permission notice shall be included in
167+ * all copies or substantial portions of the Software.
168+ *
169+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
170+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
171+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
172+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
173+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
174+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
175+ * THE SOFTWARE.
176+ */
177+
178+#ifndef MMAP_FIXED_H
179+#define MMAP_FIXED_H
180+
181+#ifndef MAP_FIXED_NOREPLACE
182+#define MAP_FIXED_NOREPLACE 0x100000
183+
184+void *mmap_fixed_noreplace(void *addr, size_t len, int prot, int flags,
185+ int fd, off_t offset);
186+
187+#else /* MAP_FIXED_NOREPLACE */
188+#define mmap_fixed_noreplace mmap
189+#endif /* MAP_FIXED_NOREPLACE */
190+
191+#endif /* MMAP_FIXED_H */
192Index: qemu-8.2.1/linux-user/mmap.c
193===================================================================
194--- qemu-8.2.1.orig/linux-user/mmap.c
195+++ qemu-8.2.1/linux-user/mmap.c
196@@ -25,6 +25,7 @@
197 #include "user-mmap.h"
198 #include "target_mman.h"
199 #include "qemu/interval-tree.h"
200+#include "mmap-fixed.h"
201
202 #ifdef TARGET_ARM
203 #include "target/arm/cpu-features.h"
204@@ -273,7 +274,7 @@ int target_mprotect(abi_ulong start, abi
205 static int do_munmap(void *addr, size_t len)
206 {
207 if (reserved_va) {
208- void *ptr = mmap(addr, len, PROT_NONE,
209+ void *ptr = mmap_fixed_noreplace(addr, len, PROT_NONE,
210 MAP_FIXED | MAP_ANONYMOUS
211 | MAP_PRIVATE | MAP_NORESERVE, -1, 0);
212 return ptr == addr ? 0 : -1;
213@@ -319,9 +320,9 @@ static bool mmap_frag(abi_ulong real_sta
214 * outside of the fragment we need to map. Allocate a new host
215 * page to cover, discarding whatever else may have been present.
216 */
217- void *p = mmap(host_start, qemu_host_page_size,
218- target_to_host_prot(prot),
219- flags | MAP_ANONYMOUS, -1, 0);
220+ void *p = mmap_fixed_noreplace(host_start, qemu_host_page_size,
221+ target_to_host_prot(prot),
222+ flags | MAP_ANONYMOUS, -1, 0);
223 if (p != host_start) {
224 if (p != MAP_FAILED) {
225 munmap(p, qemu_host_page_size);
226@@ -420,8 +421,9 @@ abi_ulong mmap_find_vma(abi_ulong start,
227 * - mremap() with MREMAP_FIXED flag
228 * - shmat() with SHM_REMAP flag
229 */
230- ptr = mmap(g2h_untagged(addr), size, PROT_NONE,
231- MAP_ANONYMOUS | MAP_PRIVATE | MAP_NORESERVE, -1, 0);
232+ ptr = mmap_fixed_noreplace(g2h_untagged(addr), size, PROT_NONE,
233+ MAP_ANONYMOUS | MAP_PRIVATE | MAP_NORESERVE,
234+ -1, 0);
235
236 /* ENOMEM, if host address space has no memory */
237 if (ptr == MAP_FAILED) {
238@@ -615,16 +617,16 @@ abi_long target_mmap(abi_ulong start, ab
239 * especially important if qemu_host_page_size >
240 * qemu_real_host_page_size.
241 */
242- p = mmap(g2h_untagged(start), host_len, host_prot,
243- flags | MAP_FIXED | MAP_ANONYMOUS, -1, 0);
244+ p = mmap_fixed_noreplace(g2h_untagged(start), host_len, host_prot,
245+ flags | MAP_FIXED | MAP_ANONYMOUS, -1, 0);
246 if (p == MAP_FAILED) {
247 goto fail;
248 }
249 /* update start so that it points to the file position at 'offset' */
250 host_start = (uintptr_t)p;
251 if (!(flags & MAP_ANONYMOUS)) {
252- p = mmap(g2h_untagged(start), len, host_prot,
253- flags | MAP_FIXED, fd, host_offset);
254+ p = mmap_fixed_noreplace(g2h_untagged(start), len, host_prot,
255+ flags | MAP_FIXED, fd, host_offset);
256 if (p == MAP_FAILED) {
257 munmap(g2h_untagged(start), host_len);
258 goto fail;
259@@ -749,8 +751,9 @@ abi_long target_mmap(abi_ulong start, ab
260 len1 = real_last - real_start + 1;
261 want_p = g2h_untagged(real_start);
262
263- p = mmap(want_p, len1, target_to_host_prot(target_prot),
264- flags, fd, offset1);
265+ p = mmap_fixed_noreplace(want_p, len1,
266+ target_to_host_prot(target_prot),
267+ flags, fd, offset1);
268 if (p != want_p) {
269 if (p != MAP_FAILED) {
270 munmap(p, len1);
271Index: qemu-8.2.1/linux-user/syscall.c
272===================================================================
273--- qemu-8.2.1.orig/linux-user/syscall.c
274+++ qemu-8.2.1/linux-user/syscall.c
275@@ -145,6 +145,7 @@
276 #include "qapi/error.h"
277 #include "fd-trans.h"
278 #include "cpu_loop-common.h"
279+#include "mmap-fixed.h"
280
281 #ifndef CLONE_IO
282 #define CLONE_IO 0x80000000 /* Clone io context */
diff --git a/meta/recipes-devtools/qemu/qemu/no-pip.patch b/meta/recipes-devtools/qemu/qemu/0011-qemu-Ensure-pip-and-the-python-venv-aren-t-used-for-.patch
index 92b2edbe9f..c7bb9b1b47 100644
--- a/meta/recipes-devtools/qemu/qemu/no-pip.patch
+++ b/meta/recipes-devtools/qemu/qemu/0011-qemu-Ensure-pip-and-the-python-venv-aren-t-used-for-.patch
@@ -1,4 +1,8 @@
1qemu: Ensure pip and the python venv aren't used for meson 1From a93c2a6b2c9db9c4bd30298da43c37c5e5c6236e Mon Sep 17 00:00:00 2001
2From: Richard Purdie <richard.purdie@linuxfoundation.org>
3Date: Wed, 22 May 2024 13:58:23 +0200
4Subject: [PATCH 11/11] qemu: Ensure pip and the python venv aren't used for
5 meson
2 6
3Qemu wants to use a supported python version and a specific meson version 7Qemu wants to use a supported python version and a specific meson version
4to "help" users and uses pip and creates a venv to do this. This is a nightmare 8to "help" users and uses pip and creates a venv to do this. This is a nightmare
@@ -21,12 +25,15 @@ as it stands is a workaround.
21 25
22Upstream-Status: Inappropriate [oe specific] 26Upstream-Status: Inappropriate [oe specific]
23Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 27Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
28---
29 configure | 4 ++--
30 1 file changed, 2 insertions(+), 2 deletions(-)
24 31
25Index: qemu-8.2.0/configure 32diff --git a/configure b/configure
26=================================================================== 33index 482a1f8ef3..0da4bf3e4d 100755
27--- qemu-8.2.0.orig/configure 34--- a/configure
28+++ qemu-8.2.0/configure 35+++ b/configure
29@@ -937,7 +937,7 @@ python="$(command -v "$python")" 36@@ -938,14 +938,14 @@ python="$(command -v "$python")"
30 echo "python determined to be '$python'" 37 echo "python determined to be '$python'"
31 echo "python version: $($python --version)" 38 echo "python version: $($python --version)"
32 39
@@ -35,11 +42,14 @@ Index: qemu-8.2.0/configure
35 if test "$?" -ne 0 ; then 42 if test "$?" -ne 0 ; then
36 error_exit "python venv creation failed" 43 error_exit "python venv creation failed"
37 fi 44 fi
38@@ -945,6 +945,7 @@ fi 45
39 # Suppress writing compiled files 46 # Suppress writing compiled files
40 python="$python -B" 47 python="$python -B"
41 mkvenv="$python ${source_path}/python/scripts/mkvenv.py" 48-mkvenv="$python ${source_path}/python/scripts/mkvenv.py"
42+mkvenv=true 49+mkvenv=true
43 50
44 # Finish preparing the virtual environment using vendored .whl files 51 # Finish preparing the virtual environment using vendored .whl files
45 52
53--
542.44.0
55
diff --git a/meta/recipes-devtools/qemu/qemu/0012-linux-user-workaround-for-missing-MAP_SHARED_VALIDAT.patch b/meta/recipes-devtools/qemu/qemu/0012-linux-user-workaround-for-missing-MAP_SHARED_VALIDAT.patch
deleted file mode 100644
index 48034a4680..0000000000
--- a/meta/recipes-devtools/qemu/qemu/0012-linux-user-workaround-for-missing-MAP_SHARED_VALIDAT.patch
+++ /dev/null
@@ -1,51 +0,0 @@
1From 5c73e53997df800a742f9cd7355f3045861984bb Mon Sep 17 00:00:00 2001
2From: Frederic Konrad <fkonrad@amd.com>
3Date: Thu, 18 Jan 2024 10:43:44 +0000
4Subject: [PATCH 2/2] linux-user/*: workaround for missing MAP_SHARED_VALIDATE
5
6QEMU v8.1.0 recently requires MAP_SHARED_VALIDATE flags implementation for mmap.
7
8This is missing from the Ubuntu 18.04 compiler but looks like to be in the
9kernel source.
10
11Signed-off-by: Frederic Konrad <fkonrad@amd.com>
12Signed-off-by: Francisco Iglesias <francisco.iglesias@amd.com>
13
14Upstream-Status: Inappropriate [OE specific]
15
16The upstream only supports the last two major releases of an OS. The ones
17they have declared all have kernel 4.17 or newer.
18
19See:
20https://xilinx.slack.com/archives/D04G2647CTV/p1705074697942019
21
22https://www.qemu.org/docs/master/about/build-platforms.html
23
24 The project aims to support the most recent major version at all times for up
25 to five years after its initial release. Support for the previous major
26 version will be dropped 2 years after the new major version is released or
27 when the vendor itself drops support, whichever comes first.
28
29Signed-off-by: Mark Hatle <mark.hatle@amd.com>
30---
31 linux-user/mmap-fixed.h | 4 ++++
32 1 file changed, 4 insertions(+)
33
34diff --git a/linux-user/mmap-fixed.h b/linux-user/mmap-fixed.h
35index ef6eef5114..ec86586c1f 100644
36--- a/linux-user/mmap-fixed.h
37+++ b/linux-user/mmap-fixed.h
38@@ -26,6 +26,10 @@
39 #ifndef MMAP_FIXED_H
40 #define MMAP_FIXED_H
41
42+#ifndef MAP_SHARED_VALIDATE
43+#define MAP_SHARED_VALIDATE 0x03
44+#endif
45+
46 #ifndef MAP_FIXED_NOREPLACE
47 #define MAP_FIXED_NOREPLACE 0x100000
48
49--
502.34.1
51
diff --git a/meta/recipes-devtools/qemu/qemu/4a8579ad8629b57a43daa62e46cc7af6e1078116.patch b/meta/recipes-devtools/qemu/qemu/4a8579ad8629b57a43daa62e46cc7af6e1078116.patch
deleted file mode 100644
index 5ad859ebe6..0000000000
--- a/meta/recipes-devtools/qemu/qemu/4a8579ad8629b57a43daa62e46cc7af6e1078116.patch
+++ /dev/null
@@ -1,60 +0,0 @@
1From 4a8579ad8629b57a43daa62e46cc7af6e1078116 Mon Sep 17 00:00:00 2001
2From: Richard Henderson <richard.henderson@linaro.org>
3Date: Tue, 13 Feb 2024 10:20:27 -1000
4Subject: [PATCH] linux-user: Split out do_munmap
5MIME-Version: 1.0
6Content-Type: text/plain; charset=UTF-8
7Content-Transfer-Encoding: 8bit
8
9Upstream-Status: Submitted [https://gitlab.com/rth7680/qemu/-/commit/4a8579ad8629b57a43daa62e46cc7af6e1078116]
10
11Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
12Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
13---
14 linux-user/mmap.c | 23 ++++++++++++++++-------
15 1 file changed, 16 insertions(+), 7 deletions(-)
16
17diff --git a/linux-user/mmap.c b/linux-user/mmap.c
18index 1bbfeb25b14..8ebcca44444 100644
19--- a/linux-user/mmap.c
20+++ b/linux-user/mmap.c
21@@ -267,6 +267,21 @@ int target_mprotect(abi_ulong start, abi_ulong len, int target_prot)
22 return ret;
23 }
24
25+/*
26+ * Perform munmap on behalf of the target, with host parameters.
27+ * If reserved_va, we must replace the memory reservation.
28+ */
29+static int do_munmap(void *addr, size_t len)
30+{
31+ if (reserved_va) {
32+ void *ptr = mmap(addr, len, PROT_NONE,
33+ MAP_FIXED | MAP_ANONYMOUS
34+ | MAP_PRIVATE | MAP_NORESERVE, -1, 0);
35+ return ptr == addr ? 0 : -1;
36+ }
37+ return munmap(addr, len);
38+}
39+
40 /* map an incomplete host page */
41 static bool mmap_frag(abi_ulong real_start, abi_ulong start, abi_ulong last,
42 int prot, int flags, int fd, off_t offset)
43@@ -854,13 +869,7 @@ static int mmap_reserve_or_unmap(abi_ulong start, abi_ulong len)
44 real_len = real_last - real_start + 1;
45 host_start = g2h_untagged(real_start);
46
47- if (reserved_va) {
48- void *ptr = mmap(host_start, real_len, PROT_NONE,
49- MAP_FIXED | MAP_ANONYMOUS
50- | MAP_PRIVATE | MAP_NORESERVE, -1, 0);
51- return ptr == host_start ? 0 : -1;
52- }
53- return munmap(host_start, real_len);
54+ return do_munmap(host_start, real_len);
55 }
56
57 int target_munmap(abi_ulong start, abi_ulong len)
58--
59GitLab
60
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2023-6683.patch b/meta/recipes-devtools/qemu/qemu/CVE-2023-6683.patch
deleted file mode 100644
index 732cb6af18..0000000000
--- a/meta/recipes-devtools/qemu/qemu/CVE-2023-6683.patch
+++ /dev/null
@@ -1,91 +0,0 @@
1From 405484b29f6548c7b86549b0f961b906337aa68a Mon Sep 17 00:00:00 2001
2From: Fiona Ebner <f.ebner@proxmox.com>
3Date: Wed, 24 Jan 2024 11:57:48 +0100
4Subject: [PATCH] ui/clipboard: mark type as not available when there is no
5 data
6MIME-Version: 1.0
7Content-Type: text/plain; charset=UTF-8
8Content-Transfer-Encoding: 8bit
9
10With VNC, a client can send a non-extended VNC_MSG_CLIENT_CUT_TEXT
11message with len=0. In qemu_clipboard_set_data(), the clipboard info
12will be updated setting data to NULL (because g_memdup(data, size)
13returns NULL when size is 0). If the client does not set the
14VNC_ENCODING_CLIPBOARD_EXT feature when setting up the encodings, then
15the 'request' callback for the clipboard peer is not initialized.
16Later, because data is NULL, qemu_clipboard_request() can be reached
17via vdagent_chr_write() and vdagent_clipboard_recv_request() and
18there, the clipboard owner's 'request' callback will be attempted to
19be called, but that is a NULL pointer.
20
21In particular, this can happen when using the KRDC (22.12.3) VNC
22client.
23
24Another scenario leading to the same issue is with two clients (say
25noVNC and KRDC):
26
27The noVNC client sets the extension VNC_FEATURE_CLIPBOARD_EXT and
28initializes its cbpeer.
29
30The KRDC client does not, but triggers a vnc_client_cut_text() (note
31it's not the _ext variant)). There, a new clipboard info with it as
32the 'owner' is created and via qemu_clipboard_set_data() is called,
33which in turn calls qemu_clipboard_update() with that info.
34
35In qemu_clipboard_update(), the notifier for the noVNC client will be
36called, i.e. vnc_clipboard_notify() and also set vs->cbinfo for the
37noVNC client. The 'owner' in that clipboard info is the clipboard peer
38for the KRDC client, which did not initialize the 'request' function.
39That sounds correct to me, it is the owner of that clipboard info.
40
41Then when noVNC sends a VNC_MSG_CLIENT_CUT_TEXT message (it did set
42the VNC_FEATURE_CLIPBOARD_EXT feature correctly, so a check for it
43passes), that clipboard info is passed to qemu_clipboard_request() and
44the original segfault still happens.
45
46Fix the issue by handling updates with size 0 differently. In
47particular, mark in the clipboard info that the type is not available.
48
49While at it, switch to g_memdup2(), because g_memdup() is deprecated.
50
51Cc: qemu-stable@nongnu.org
52Fixes: CVE-2023-6683
53Reported-by: Markus Frank <m.frank@proxmox.com>
54Suggested-by: Marc-André Lureau <marcandre.lureau@redhat.com>
55Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
56Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
57Tested-by: Markus Frank <m.frank@proxmox.com>
58Message-ID: <20240124105749.204610-1-f.ebner@proxmox.com>
59
60CVE: CVE-2023-6683
61
62Upstream-Status: Backport [https://github.com/qemu/qemu/commit/405484b29f6548c7b86549b0f961b906337aa68a]
63Signed-off-by: Simone Weiß <simone.p.weiss@posteo.com>
64
65---
66 ui/clipboard.c | 12 +++++++++---
67 1 file changed, 9 insertions(+), 3 deletions(-)
68
69diff --git a/ui/clipboard.c b/ui/clipboard.c
70index 3d14bffaf80f..b3f6fa3c9e1f 100644
71--- a/ui/clipboard.c
72+++ b/ui/clipboard.c
73@@ -163,9 +163,15 @@ void qemu_clipboard_set_data(QemuClipboardPeer *peer,
74 }
75
76 g_free(info->types[type].data);
77- info->types[type].data = g_memdup(data, size);
78- info->types[type].size = size;
79- info->types[type].available = true;
80+ if (size) {
81+ info->types[type].data = g_memdup2(data, size);
82+ info->types[type].size = size;
83+ info->types[type].available = true;
84+ } else {
85+ info->types[type].data = NULL;
86+ info->types[type].size = 0;
87+ info->types[type].available = false;
88+ }
89
90 if (update) {
91 qemu_clipboard_update(info);
diff --git a/meta/recipes-devtools/qemu/qemu_8.2.1.bb b/meta/recipes-devtools/qemu/qemu_9.0.0.bb
index dc1352232e..dc1352232e 100644
--- a/meta/recipes-devtools/qemu/qemu_8.2.1.bb
+++ b/meta/recipes-devtools/qemu/qemu_9.0.0.bb
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-11-24 13:01:44 +0000