diff --git a/Include-sysemu-sysemu.h-a-lot-less.patch b/Include-sysemu-sysemu.h-a-lot-less.patch new file mode 100644 index 0000000000000000000000000000000000000000..b0d06249d57af30f58efd5197e2dcd51218bb222 --- /dev/null +++ b/Include-sysemu-sysemu.h-a-lot-less.patch @@ -0,0 +1,427 @@ +From a848381352be1e0f2fe25ef0983e86a37c99dc87 Mon Sep 17 00:00:00 2001 +From: Markus Armbruster +Date: Mon, 12 Aug 2019 07:23:57 +0200 +Subject: [PATCH] Include sysemu/sysemu.h a lot less +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +In my "build everything" tree, changing sysemu/sysemu.h triggers a +recompile of some 5400 out of 6600 objects (not counting tests and +objects that don't depend on qemu/osdep.h). + +hw/qdev-core.h includes sysemu/sysemu.h since recent commit e965ffa70a +"qdev: add qdev_add_vm_change_state_handler()". This is a bad idea: +hw/qdev-core.h is widely included. + +Move the declaration of qdev_add_vm_change_state_handler() to +sysemu/sysemu.h, and drop the problematic include from hw/qdev-core.h. + +Touching sysemu/sysemu.h now recompiles some 1800 objects. +qemu/uuid.h also drops from 5400 to 1800. A few more headers show +smaller improvement: qemu/notify.h drops from 5600 to 5200, +qemu/timer.h from 5600 to 4500, and qapi/qapi-types-run-state.h from +5500 to 5000. + +Cc: Stefan Hajnoczi +Signed-off-by: Markus Armbruster +Reviewed-by: Alistair Francis +Reviewed-by: Stefan Hajnoczi +Message-Id: <20190812052359.30071-28-armbru@redhat.com> +Reviewed-by: Alex Bennée +Signed-off-by: liuxiangdong +--- + accel/kvm/kvm-all.c | 1 + + backends/hostmem.c | 1 + + cpus.c | 1 + + hw/arm/allwinner-a10.c | 1 + + hw/arm/aspeed_soc.c | 1 + + hw/arm/kzm.c | 1 + + hw/arm/msf2-soc.c | 1 + + hw/arm/stm32f205_soc.c | 1 + + hw/char/serial-isa.c | 1 + + hw/char/xen_console.c | 1 + + hw/core/numa.c | 1 + + hw/core/vm-change-state-handler.c | 1 + + hw/display/qxl-render.c | 1 + + hw/i386/xen/xen-hvm.c | 1 + + hw/i386/xen/xen-mapcache.c | 1 + + hw/intc/ioapic.c | 1 + + hw/riscv/sifive_e.c | 1 + + hw/riscv/sifive_u.c | 1 + + hw/riscv/spike.c | 1 + + hw/riscv/virt.c | 1 + + hw/sparc64/niagara.c | 2 +- + hw/xen/xen-common.c | 1 + + hw/xen/xen_devconfig.c | 1 + + hw/xenpv/xen_machine_pv.c | 1 + + include/hw/qdev-core.h | 5 ----- + include/sysemu/sysemu.h | 3 +++ + migration/global_state.c | 1 + + migration/migration.c | 1 + + migration/savevm.c | 1 + + 29 files changed, 30 insertions(+), 6 deletions(-) + +diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c +index 84edbe8bb1..5deac12aed 100644 +--- a/accel/kvm/kvm-all.c ++++ b/accel/kvm/kvm-all.c +@@ -30,6 +30,7 @@ + #include "exec/gdbstub.h" + #include "sysemu/kvm_int.h" + #include "sysemu/cpus.h" ++#include "sysemu/sysemu.h" + #include "qemu/bswap.h" + #include "exec/memory.h" + #include "exec/ram_addr.h" +diff --git a/backends/hostmem.c b/backends/hostmem.c +index 9e1b3a0afc..35b0c91467 100644 +--- a/backends/hostmem.c ++++ b/backends/hostmem.c +@@ -12,6 +12,7 @@ + + #include "qemu/osdep.h" + #include "sysemu/hostmem.h" ++#include "sysemu/sysemu.h" + #include "hw/boards.h" + #include "qapi/error.h" + #include "qapi/qapi-builtin-visit.h" +diff --git a/cpus.c b/cpus.c +index 927a00aa90..b2a26a1f11 100644 +--- a/cpus.c ++++ b/cpus.c +@@ -40,6 +40,7 @@ + #include "sysemu/kvm.h" + #include "sysemu/hax.h" + #include "sysemu/hvf.h" ++#include "sysemu/sysemu.h" + #include "sysemu/whpx.h" + #include "exec/exec-all.h" + +diff --git a/hw/arm/allwinner-a10.c b/hw/arm/allwinner-a10.c +index 35e906ca54..60e33efa0c 100644 +--- a/hw/arm/allwinner-a10.c ++++ b/hw/arm/allwinner-a10.c +@@ -22,6 +22,7 @@ + #include "hw/sysbus.h" + #include "hw/arm/allwinner-a10.h" + #include "hw/misc/unimp.h" ++#include "sysemu/sysemu.h" + + static void aw_a10_init(Object *obj) + { +diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c +index c6fb3700f2..9ee8104832 100644 +--- a/hw/arm/aspeed_soc.c ++++ b/hw/arm/aspeed_soc.c +@@ -22,6 +22,7 @@ + #include "qemu/error-report.h" + #include "hw/i2c/aspeed_i2c.h" + #include "net/net.h" ++#include "sysemu/sysemu.h" + + #define ASPEED_SOC_IOMEM_SIZE 0x00200000 + +diff --git a/hw/arm/kzm.c b/hw/arm/kzm.c +index 59d2102dc5..2f052e1f8c 100644 +--- a/hw/arm/kzm.c ++++ b/hw/arm/kzm.c +@@ -24,6 +24,7 @@ + #include "hw/net/lan9118.h" + #include "hw/char/serial.h" + #include "sysemu/qtest.h" ++#include "sysemu/sysemu.h" + + /* Memory map for Kzm Emulation Baseboard: + * 0x00000000-0x7fffffff See i.MX31 SOC for support +diff --git a/hw/arm/msf2-soc.c b/hw/arm/msf2-soc.c +index 1ccb644df7..3e479b8fa5 100644 +--- a/hw/arm/msf2-soc.c ++++ b/hw/arm/msf2-soc.c +@@ -30,6 +30,7 @@ + #include "hw/boards.h" + #include "hw/arm/msf2-soc.h" + #include "hw/misc/unimp.h" ++#include "sysemu/sysemu.h" + + #define MSF2_TIMER_BASE 0x40004000 + #define MSF2_SYSREG_BASE 0x40038000 +diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c +index c08041a1c5..634a527f04 100644 +--- a/hw/arm/stm32f205_soc.c ++++ b/hw/arm/stm32f205_soc.c +@@ -28,6 +28,7 @@ + #include "hw/arm/boot.h" + #include "exec/address-spaces.h" + #include "hw/arm/stm32f205_soc.h" ++#include "sysemu/sysemu.h" + + /* At the moment only Timer 2 to 5 are modelled */ + static const uint32_t timer_addr[STM_NUM_TIMERS] = { 0x40000000, 0x40000400, +diff --git a/hw/char/serial-isa.c b/hw/char/serial-isa.c +index 610426111a..ce48c80552 100644 +--- a/hw/char/serial-isa.c ++++ b/hw/char/serial-isa.c +@@ -26,6 +26,7 @@ + #include "qemu/osdep.h" + #include "qapi/error.h" + #include "qemu/module.h" ++#include "sysemu/sysemu.h" + #include "hw/char/serial.h" + #include "hw/isa/isa.h" + +diff --git a/hw/char/xen_console.c b/hw/char/xen_console.c +index 47e1092263..cd37454356 100644 +--- a/hw/char/xen_console.c ++++ b/hw/char/xen_console.c +@@ -25,6 +25,7 @@ + + #include "qapi/error.h" + #include "hw/hw.h" ++#include "sysemu/sysemu.h" + #include "chardev/char-fe.h" + #include "hw/xen/xen-legacy-backend.h" + +diff --git a/hw/core/numa.c b/hw/core/numa.c +index a11431483c..7010234cc3 100644 +--- a/hw/core/numa.c ++++ b/hw/core/numa.c +@@ -24,6 +24,7 @@ + + #include "qemu/osdep.h" + #include "sysemu/numa.h" ++#include "sysemu/sysemu.h" + #include "exec/cpu-common.h" + #include "exec/ramlist.h" + #include "qemu/bitmap.h" +diff --git a/hw/core/vm-change-state-handler.c b/hw/core/vm-change-state-handler.c +index f814813bdd..0097c6359d 100644 +--- a/hw/core/vm-change-state-handler.c ++++ b/hw/core/vm-change-state-handler.c +@@ -17,6 +17,7 @@ + + #include "qemu/osdep.h" + #include "hw/qdev.h" ++#include "sysemu/sysemu.h" + + static int qdev_get_dev_tree_depth(DeviceState *dev) + { +diff --git a/hw/display/qxl-render.c b/hw/display/qxl-render.c +index c2a619095b..bce29bb2d6 100644 +--- a/hw/display/qxl-render.c ++++ b/hw/display/qxl-render.c +@@ -21,6 +21,7 @@ + + #include "qemu/osdep.h" + #include "qxl.h" ++#include "sysemu/sysemu.h" + #include "trace.h" + + static void qxl_blit(PCIQXLDevice *qxl, QXLRect *rect) +diff --git a/hw/i386/xen/xen-hvm.c b/hw/i386/xen/xen-hvm.c +index e8e79e0917..f3e2e55175 100644 +--- a/hw/i386/xen/xen-hvm.c ++++ b/hw/i386/xen/xen-hvm.c +@@ -22,6 +22,7 @@ + #include "qapi/qapi-commands-misc.h" + #include "qemu/error-report.h" + #include "qemu/range.h" ++#include "sysemu/sysemu.h" + #include "sysemu/xen-mapcache.h" + #include "trace.h" + #include "exec/address-spaces.h" +diff --git a/hw/i386/xen/xen-mapcache.c b/hw/i386/xen/xen-mapcache.c +index dc73c86c61..09656f9f11 100644 +--- a/hw/i386/xen/xen-mapcache.c ++++ b/hw/i386/xen/xen-mapcache.c +@@ -17,6 +17,7 @@ + #include "hw/xen/xen-legacy-backend.h" + #include "qemu/bitmap.h" + ++#include "sysemu/sysemu.h" + #include "sysemu/xen-mapcache.h" + #include "trace.h" + +diff --git a/hw/intc/ioapic.c b/hw/intc/ioapic.c +index e99c37cceb..7947c5c2f2 100644 +--- a/hw/intc/ioapic.c ++++ b/hw/intc/ioapic.c +@@ -30,6 +30,7 @@ + #include "hw/i386/ioapic_internal.h" + #include "hw/pci/msi.h" + #include "sysemu/kvm.h" ++#include "sysemu/sysemu.h" + #include "hw/i386/apic-msidef.h" + #include "hw/i386/x86-iommu.h" + #include "trace.h" +diff --git a/hw/riscv/sifive_e.c b/hw/riscv/sifive_e.c +index 2a499d8ed2..f5b1c7bbf0 100644 +--- a/hw/riscv/sifive_e.c ++++ b/hw/riscv/sifive_e.c +@@ -47,6 +47,7 @@ + #include "hw/riscv/boot.h" + #include "chardev/char.h" + #include "sysemu/arch_init.h" ++#include "sysemu/sysemu.h" + #include "exec/address-spaces.h" + + static const struct MemmapEntry { +diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c +index 71b8083c05..aeddb09375 100644 +--- a/hw/riscv/sifive_u.c ++++ b/hw/riscv/sifive_u.c +@@ -45,6 +45,7 @@ + #include "chardev/char.h" + #include "sysemu/arch_init.h" + #include "sysemu/device_tree.h" ++#include "sysemu/sysemu.h" + #include "exec/address-spaces.h" + + #include +diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c +index 2991b341a2..f0cdc0daca 100644 +--- a/hw/riscv/spike.c ++++ b/hw/riscv/spike.c +@@ -41,6 +41,7 @@ + #include "sysemu/arch_init.h" + #include "sysemu/device_tree.h" + #include "sysemu/qtest.h" ++#include "sysemu/sysemu.h" + #include "exec/address-spaces.h" + + #include +diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c +index 25faf3b417..a9da15d360 100644 +--- a/hw/riscv/virt.c ++++ b/hw/riscv/virt.c +@@ -38,6 +38,7 @@ + #include "chardev/char.h" + #include "sysemu/arch_init.h" + #include "sysemu/device_tree.h" ++#include "sysemu/sysemu.h" + #include "exec/address-spaces.h" + #include "hw/pci/pci.h" + #include "hw/pci-host/gpex.h" +diff --git a/hw/sparc64/niagara.c b/hw/sparc64/niagara.c +index dc0ce7eda4..55656d7100 100644 +--- a/hw/sparc64/niagara.c ++++ b/hw/sparc64/niagara.c +@@ -36,7 +36,7 @@ + #include "sysemu/block-backend.h" + #include "qemu/error-report.h" + #include "sysemu/qtest.h" +- ++#include "sysemu/sysemu.h" + + typedef struct NiagaraBoardState { + MemoryRegion hv_ram; +diff --git a/hw/xen/xen-common.c b/hw/xen/xen-common.c +index 32503cfc1c..76621da2f5 100644 +--- a/hw/xen/xen-common.c ++++ b/hw/xen/xen-common.c +@@ -14,6 +14,7 @@ + #include "hw/xen/xen-legacy-backend.h" + #include "chardev/char.h" + #include "sysemu/accel.h" ++#include "sysemu/sysemu.h" + #include "migration/misc.h" + #include "migration/global_state.h" + +diff --git a/hw/xen/xen_devconfig.c b/hw/xen/xen_devconfig.c +index 315dbc9c51..46ee4a7f02 100644 +--- a/hw/xen/xen_devconfig.c ++++ b/hw/xen/xen_devconfig.c +@@ -2,6 +2,7 @@ + #include "hw/xen/xen-legacy-backend.h" + #include "qemu/option.h" + #include "sysemu/blockdev.h" ++#include "sysemu/sysemu.h" + + /* ------------------------------------------------------------- */ + +diff --git a/hw/xenpv/xen_machine_pv.c b/hw/xenpv/xen_machine_pv.c +index dcaf2a01a3..267bd60dfc 100644 +--- a/hw/xenpv/xen_machine_pv.c ++++ b/hw/xenpv/xen_machine_pv.c +@@ -29,6 +29,7 @@ + #include "hw/xen/xen-legacy-backend.h" + #include "hw/xen/xen-bus.h" + #include "sysemu/block-backend.h" ++#include "sysemu/sysemu.h" + + static void xen_init_pv(MachineState *machine) + { +diff --git a/include/hw/qdev-core.h b/include/hw/qdev-core.h +index 364771f3a2..02257cae78 100644 +--- a/include/hw/qdev-core.h ++++ b/include/hw/qdev-core.h +@@ -6,7 +6,6 @@ + #include "qom/object.h" + #include "hw/irq.h" + #include "hw/hotplug.h" +-#include "sysemu/sysemu.h" + + enum { + DEV_NVECTORS_UNSPECIFIED = -1, +@@ -461,8 +460,4 @@ static inline bool qbus_is_hotpluggable(BusState *bus) + void device_listener_register(DeviceListener *listener); + void device_listener_unregister(DeviceListener *listener); + +-VMChangeStateEntry *qdev_add_vm_change_state_handler(DeviceState *dev, +- VMChangeStateHandler *cb, +- void *opaque); +- + #endif +diff --git a/include/sysemu/sysemu.h b/include/sysemu/sysemu.h +index 984c439ac9..a8be0a2d82 100644 +--- a/include/sysemu/sysemu.h ++++ b/include/sysemu/sysemu.h +@@ -31,6 +31,9 @@ VMChangeStateEntry *qemu_add_vm_change_state_handler(VMChangeStateHandler *cb, + void *opaque); + VMChangeStateEntry *qemu_add_vm_change_state_handler_prio( + VMChangeStateHandler *cb, void *opaque, int priority); ++VMChangeStateEntry *qdev_add_vm_change_state_handler(DeviceState *dev, ++ VMChangeStateHandler *cb, ++ void *opaque); + void qemu_del_vm_change_state_handler(VMChangeStateEntry *e); + void vm_state_notify(int running, RunState state); + +diff --git a/migration/global_state.c b/migration/global_state.c +index 2c8c447239..7cba868979 100644 +--- a/migration/global_state.c ++++ b/migration/global_state.c +@@ -13,6 +13,7 @@ + #include "qemu/osdep.h" + #include "qemu/cutils.h" + #include "qemu/error-report.h" ++#include "sysemu/sysemu.h" + #include "qapi/error.h" + #include "migration.h" + #include "migration/global_state.h" +diff --git a/migration/migration.c b/migration/migration.c +index 8f2fc2b4ff..aec3060b0f 100644 +--- a/migration/migration.c ++++ b/migration/migration.c +@@ -20,6 +20,7 @@ + #include "exec.h" + #include "fd.h" + #include "socket.h" ++#include "sysemu/sysemu.h" + #include "rdma.h" + #include "ram.h" + #include "migration/global_state.h" +diff --git a/migration/savevm.c b/migration/savevm.c +index 480c511b19..23d6befed5 100644 +--- a/migration/savevm.c ++++ b/migration/savevm.c +@@ -55,6 +55,7 @@ + #include "io/channel-buffer.h" + #include "io/channel-file.h" + #include "sysemu/replay.h" ++#include "sysemu/sysemu.h" + #include "qjson.h" + #include "migration/colo.h" + #include "qemu/bitmap.h" +-- +2.27.0 + diff --git a/async-Add-an-optional-reentrancy-guard-to-the-BH-API.patch b/async-Add-an-optional-reentrancy-guard-to-the-BH-API.patch new file mode 100644 index 0000000000000000000000000000000000000000..703e1890b87ba2116c05edcb3218baa3feb4676d --- /dev/null +++ b/async-Add-an-optional-reentrancy-guard-to-the-BH-API.patch @@ -0,0 +1,214 @@ +From 2f762653da890d6edfda8a9337156e1ba83ab9d0 Mon Sep 17 00:00:00 2001 +From: Alexander Bulekov +Date: Thu, 27 Apr 2023 17:10:07 -0400 +Subject: [PATCH] async: Add an optional reentrancy guard to the BH API + +Devices can pass their MemoryReentrancyGuard (from their DeviceState), +when creating new BHes. Then, the async API will toggle the guard +before/after calling the BH call-back. This prevents bh->mmio reentrancy +issues. + +Signed-off-by: Alexander Bulekov +Reviewed-by: Darren Kenny +Message-Id: <20230427211013.2994127-3-alxndr@bu.edu> +[thuth: Fix "line over 90 characters" checkpatch.pl error] +Signed-off-by: Thomas Huth +Signed-off-by: liuxiangdong +--- + docs/devel/multiple-iothreads.txt | 7 +++++++ + include/block/aio.h | 17 +++++++++++++++-- + include/qemu/main-loop.h | 7 +++++-- + tests/ptimer-test-stubs.c | 3 ++- + util/async.c | 18 +++++++++++++++++- + util/main-loop.c | 6 ++++-- + util/trace-events | 1 + + 7 files changed, 51 insertions(+), 8 deletions(-) + +diff --git a/docs/devel/multiple-iothreads.txt b/docs/devel/multiple-iothreads.txt +index aeb997bed5..a11576bc74 100644 +--- a/docs/devel/multiple-iothreads.txt ++++ b/docs/devel/multiple-iothreads.txt +@@ -61,6 +61,7 @@ There are several old APIs that use the main loop AioContext: + * LEGACY qemu_aio_set_event_notifier() - monitor an event notifier + * LEGACY timer_new_ms() - create a timer + * LEGACY qemu_bh_new() - create a BH ++ * LEGACY qemu_bh_new_guarded() - create a BH with a device re-entrancy guard + * LEGACY qemu_aio_wait() - run an event loop iteration + + Since they implicitly work on the main loop they cannot be used in code that +@@ -72,8 +73,14 @@ Instead, use the AioContext functions directly (see include/block/aio.h): + * aio_set_event_notifier() - monitor an event notifier + * aio_timer_new() - create a timer + * aio_bh_new() - create a BH ++ * aio_bh_new_guarded() - create a BH with a device re-entrancy guard + * aio_poll() - run an event loop iteration + ++The qemu_bh_new_guarded/aio_bh_new_guarded APIs accept a "MemReentrancyGuard" ++argument, which is used to check for and prevent re-entrancy problems. For ++BHs associated with devices, the reentrancy-guard is contained in the ++corresponding DeviceState and named "mem_reentrancy_guard". ++ + The AioContext can be obtained from the IOThread using + iothread_get_aio_context() or for the main loop using qemu_get_aio_context(). + Code that takes an AioContext argument works both in IOThreads or the main +diff --git a/include/block/aio.h b/include/block/aio.h +index 93b6c9b352..349af978f4 100644 +--- a/include/block/aio.h ++++ b/include/block/aio.h +@@ -18,6 +18,7 @@ + #include "qemu/event_notifier.h" + #include "qemu/thread.h" + #include "qemu/timer.h" ++#include "hw/qdev-core.h" + + typedef struct BlockAIOCB BlockAIOCB; + typedef void BlockCompletionFunc(void *opaque, int ret); +@@ -221,9 +222,11 @@ void aio_bh_schedule_oneshot_full(AioContext *ctx, QEMUBHFunc *cb, void *opaque, + * is opaque and must be allocated prior to its use. + * + * @name: A human-readable identifier for debugging purposes. ++ * @reentrancy_guard: A guard set when entering a cb to prevent ++ * device-reentrancy issues + */ + QEMUBH *aio_bh_new_full(AioContext *ctx, QEMUBHFunc *cb, void *opaque, +- const char *name); ++ const char *name, MemReentrancyGuard *reentrancy_guard); + + /** + * aio_bh_new: Allocate a new bottom half structure +@@ -232,7 +235,17 @@ QEMUBH *aio_bh_new_full(AioContext *ctx, QEMUBHFunc *cb, void *opaque, + * string. + */ + #define aio_bh_new(ctx, cb, opaque) \ +- aio_bh_new_full((ctx), (cb), (opaque), (stringify(cb))) ++ aio_bh_new_full((ctx), (cb), (opaque), (stringify(cb)), NULL) ++ ++/** ++ * aio_bh_new_guarded: Allocate a new bottom half structure with a ++ * reentrancy_guard ++ * ++ * A convenience wrapper for aio_bh_new_full() that uses the cb as the name ++ * string. ++ */ ++#define aio_bh_new_guarded(ctx, cb, opaque, guard) \ ++ aio_bh_new_full((ctx), (cb), (opaque), (stringify(cb)), guard) + + /** + * aio_notify: Force processing of pending events. +diff --git a/include/qemu/main-loop.h b/include/qemu/main-loop.h +index b131a0edc5..cba048bc82 100644 +--- a/include/qemu/main-loop.h ++++ b/include/qemu/main-loop.h +@@ -299,9 +299,12 @@ void qemu_mutex_unlock_iothread(void); + + void qemu_fd_register(int fd); + ++#define qemu_bh_new_guarded(cb, opaque, guard) \ ++ qemu_bh_new_full((cb), (opaque), (stringify(cb)), guard) + #define qemu_bh_new(cb, opaque) \ +- qemu_bh_new_full((cb), (opaque), (stringify(cb))) +-QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name); ++ qemu_bh_new_full((cb), (opaque), (stringify(cb)), NULL) ++QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name, ++ MemReentrancyGuard *reentrancy_guard); + void qemu_bh_schedule_idle(QEMUBH *bh); + + enum { +diff --git a/tests/ptimer-test-stubs.c b/tests/ptimer-test-stubs.c +index bc813c27b6..2f6399c0b7 100644 +--- a/tests/ptimer-test-stubs.c ++++ b/tests/ptimer-test-stubs.c +@@ -107,7 +107,8 @@ int64_t qemu_clock_deadline_ns_all(QEMUClockType type) + return deadline; + } + +-QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name) ++QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name, ++ MemReentrancyGuard *reentrancy_guard) + { + QEMUBH *bh = g_new(QEMUBH, 1); + +diff --git a/util/async.c b/util/async.c +index 77f6a791a7..0627f1c201 100644 +--- a/util/async.c ++++ b/util/async.c +@@ -45,6 +45,7 @@ struct QEMUBH { + bool scheduled; + bool idle; + bool deleted; ++ MemReentrancyGuard *reentrancy_guard; + }; + + void aio_bh_schedule_oneshot_full(AioContext *ctx, QEMUBHFunc *cb, +@@ -70,7 +71,7 @@ void aio_bh_schedule_oneshot_full(AioContext *ctx, QEMUBHFunc *cb, + } + + QEMUBH *aio_bh_new_full(AioContext *ctx, QEMUBHFunc *cb, void *opaque, +- const char *name) ++ const char *name, MemReentrancyGuard *reentrancy_guard) + { + QEMUBH *bh; + bh = g_new(QEMUBH, 1); +@@ -79,6 +80,7 @@ QEMUBH *aio_bh_new_full(AioContext *ctx, QEMUBHFunc *cb, void *opaque, + .cb = cb, + .opaque = opaque, + .name = name, ++ .reentrancy_guard = reentrancy_guard, + }; + qemu_lockcnt_lock(&ctx->list_lock); + bh->next = ctx->first_bh; +@@ -91,7 +93,21 @@ QEMUBH *aio_bh_new_full(AioContext *ctx, QEMUBHFunc *cb, void *opaque, + + void aio_bh_call(QEMUBH *bh) + { ++ bool last_engaged_in_io = false; ++ ++ if (bh->reentrancy_guard) { ++ last_engaged_in_io = bh->reentrancy_guard->engaged_in_io; ++ if (bh->reentrancy_guard->engaged_in_io) { ++ trace_reentrant_aio(bh->ctx, bh->name); ++ } ++ bh->reentrancy_guard->engaged_in_io = true; ++ } ++ + bh->cb(bh->opaque); ++ ++ if (bh->reentrancy_guard) { ++ bh->reentrancy_guard->engaged_in_io = last_engaged_in_io; ++ } + } + + /* Multiple occurrences of aio_bh_poll cannot be called concurrently. +diff --git a/util/main-loop.c b/util/main-loop.c +index 382ceb8f8f..1003698f97 100644 +--- a/util/main-loop.c ++++ b/util/main-loop.c +@@ -526,9 +526,11 @@ void main_loop_wait(int nonblocking) + + /* Functions to operate on the main QEMU AioContext. */ + +-QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name) ++QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name, ++ MemReentrancyGuard *reentrancy_guard) + { +- return aio_bh_new_full(qemu_aio_context, cb, opaque, name); ++ return aio_bh_new_full(qemu_aio_context, cb, opaque, name, ++ reentrancy_guard); + } + + /* +diff --git a/util/trace-events b/util/trace-events +index 9dbd237dad..ed1868dba9 100644 +--- a/util/trace-events ++++ b/util/trace-events +@@ -9,6 +9,7 @@ poll_grow(void *ctx, int64_t old, int64_t new) "ctx %p old %"PRId64" new %"PRId6 + # async.c + aio_co_schedule(void *ctx, void *co) "ctx %p co %p" + aio_co_schedule_bh_cb(void *ctx, void *co) "ctx %p co %p" ++reentrant_aio(void *ctx, const char *name) "ctx %p name %s" + + # thread-pool.c + thread_pool_submit(void *pool, void *req, void *opaque) "pool %p req %p opaque %p" +-- +2.27.0 + diff --git a/async-avoid-use-after-free-on-re-entrancy-guard.patch b/async-avoid-use-after-free-on-re-entrancy-guard.patch new file mode 100644 index 0000000000000000000000000000000000000000..6cd4e392498ffff14e460b63f5a634e4fcb0083c --- /dev/null +++ b/async-avoid-use-after-free-on-re-entrancy-guard.patch @@ -0,0 +1,52 @@ +From ea76ea3f2c6c4fe41bec6d97678a94bf8e5363a2 Mon Sep 17 00:00:00 2001 +From: Alexander Bulekov +Date: Mon, 1 May 2023 10:19:56 -0400 +Subject: [PATCH] async: avoid use-after-free on re-entrancy guard + +A BH callback can free the BH, causing a use-after-free in aio_bh_call. +Fix that by keeping a local copy of the re-entrancy guard pointer. + +Buglink: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58513 +Fixes: 9c86c97f12 ("async: Add an optional reentrancy guard to the BH API") +Signed-off-by: Alexander Bulekov +Message-Id: <20230501141956.3444868-1-alxndr@bu.edu> +Reviewed-by: Thomas Huth +Signed-off-by: Thomas Huth +--- + util/async.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/util/async.c b/util/async.c +index 0627f1c201..a6b51c40c1 100644 +--- a/util/async.c ++++ b/util/async.c +@@ -95,18 +95,20 @@ void aio_bh_call(QEMUBH *bh) + { + bool last_engaged_in_io = false; + +- if (bh->reentrancy_guard) { +- last_engaged_in_io = bh->reentrancy_guard->engaged_in_io; +- if (bh->reentrancy_guard->engaged_in_io) { ++ /* Make a copy of the guard-pointer as cb may free the bh */ ++ MemReentrancyGuard *reentrancy_guard = bh->reentrancy_guard; ++ if (reentrancy_guard) { ++ last_engaged_in_io = reentrancy_guard->engaged_in_io; ++ if (reentrancy_guard->engaged_in_io) { + trace_reentrant_aio(bh->ctx, bh->name); + } +- bh->reentrancy_guard->engaged_in_io = true; ++ reentrancy_guard->engaged_in_io = true; + } + + bh->cb(bh->opaque); + +- if (bh->reentrancy_guard) { +- bh->reentrancy_guard->engaged_in_io = last_engaged_in_io; ++ if (reentrancy_guard) { ++ reentrancy_guard->engaged_in_io = last_engaged_in_io; + } + } + +-- +2.27.0 + diff --git a/checkpatch-add-qemu_bh_new-aio_bh_new-checks.patch b/checkpatch-add-qemu_bh_new-aio_bh_new-checks.patch new file mode 100644 index 0000000000000000000000000000000000000000..05a7f5aab98a1f02f70f84a4ec8a1addeb84ab18 --- /dev/null +++ b/checkpatch-add-qemu_bh_new-aio_bh_new-checks.patch @@ -0,0 +1,37 @@ +From 73e1e37d4853d94e580d285556f9015ade835093 Mon Sep 17 00:00:00 2001 +From: Alexander Bulekov +Date: Thu, 27 Apr 2023 17:10:08 -0400 +Subject: [PATCH] checkpatch: add qemu_bh_new/aio_bh_new checks + +Advise authors to use the _guarded versions of the APIs, instead. + +Signed-off-by: Alexander Bulekov +Reviewed-by: Darren Kenny +Message-Id: <20230427211013.2994127-4-alxndr@bu.edu> +Signed-off-by: Thomas Huth +--- + scripts/checkpatch.pl | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl +index d24c9441ee..067f6a4e48 100755 +--- a/scripts/checkpatch.pl ++++ b/scripts/checkpatch.pl +@@ -2811,6 +2811,14 @@ sub process { + if ($line =~ /\bsignal\s*\(/ && !($line =~ /SIG_(?:IGN|DFL)/)) { + ERROR("use sigaction to establish signal handlers; signal is not portable\n" . $herecurr); + } ++# recommend qemu_bh_new_guarded instead of qemu_bh_new ++ if ($realfile =~ /.*\/hw\/.*/ && $line =~ /\bqemu_bh_new\s*\(/) { ++ ERROR("use qemu_bh_new_guarded() instead of qemu_bh_new() to avoid reentrancy problems\n" . $herecurr); ++ } ++# recommend aio_bh_new_guarded instead of aio_bh_new ++ if ($realfile =~ /.*\/hw\/.*/ && $line =~ /\baio_bh_new\s*\(/) { ++ ERROR("use aio_bh_new_guarded() instead of aio_bh_new() to avoid reentrancy problems\n" . $herecurr); ++ } + # check for module_init(), use category-specific init macros explicitly please + if ($line =~ /^module_init\s*\(/) { + ERROR("please use block_init(), type_init() etc. instead of module_init()\n" . $herecurr); +-- +2.27.0 + diff --git a/hw-char-virtio-serial-bus-Protect-from-DMA-re-entran.patch b/hw-char-virtio-serial-bus-Protect-from-DMA-re-entran.patch new file mode 100644 index 0000000000000000000000000000000000000000..5be8a5b414327ea9d450e15469d43783993cd6b8 --- /dev/null +++ b/hw-char-virtio-serial-bus-Protect-from-DMA-re-entran.patch @@ -0,0 +1,43 @@ +From c4eb651db9b31a8c56395eb9f812bfc9d567a100 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= +Date: Thu, 4 Apr 2024 20:56:35 +0200 +Subject: [PATCH] hw/char/virtio-serial-bus: Protect from DMA re-entrancy + bugs(CVE-2024-3446) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Replace qemu_bh_new_guarded() by virtio_bh_new_guarded() +so the bus and device use the same guard. Otherwise the +DMA-reentrancy protection can be bypassed. + +Fixes: CVE-2024-3446 +Cc: qemu-stable@nongnu.org +Suggested-by: Alexander Bulekov +Reviewed-by: Gerd Hoffmann +Acked-by: Michael S. Tsirkin +Signed-off-by: Philippe Mathieu-Daudé +Reviewed-by: Michael S. Tsirkin +Message-Id: <20240409105537.18308-4-philmd@linaro.org> +Signed-off-by: liuxiangdong +--- + hw/char/virtio-serial-bus.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/hw/char/virtio-serial-bus.c b/hw/char/virtio-serial-bus.c +index a614810985..cb8417ee35 100644 +--- a/hw/char/virtio-serial-bus.c ++++ b/hw/char/virtio-serial-bus.c +@@ -940,8 +940,7 @@ static void virtser_port_device_realize(DeviceState *dev, Error **errp) + Error *err = NULL; + + port->vser = bus->vser; +- port->bh = qemu_bh_new_guarded(flush_queued_data_bh, port, +- &dev->mem_reentrancy_guard); ++ port->bh = virtio_bh_new_guarded(dev, flush_queued_data_bh, port); + + assert(vsc->have_data); + +-- +2.27.0 + diff --git a/hw-display-virtio-gpu-Protect-from-DMA-re-entrancy-b.patch b/hw-display-virtio-gpu-Protect-from-DMA-re-entrancy-b.patch new file mode 100644 index 0000000000000000000000000000000000000000..215a3d753cff815c5a773ca0abb1f3499d53450c --- /dev/null +++ b/hw-display-virtio-gpu-Protect-from-DMA-re-entrancy-b.patch @@ -0,0 +1,143 @@ +From cb074ccccacd539bed3897ce643ad9b3c80d141c Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= +Date: Thu, 4 Apr 2024 20:56:27 +0200 +Subject: [PATCH] hw/display/virtio-gpu: Protect from DMA re-entrancy + bugs(CVE-2024-3446) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Replace qemu_bh_new_guarded() by virtio_bh_new_guarded() +so the bus and device use the same guard. Otherwise the +DMA-reentrancy protection can be bypassed: + + $ cat << EOF | qemu-system-i386 -display none -nodefaults \ + -machine q35,accel=qtest \ + -m 512M \ + -device virtio-gpu \ + -qtest stdio + outl 0xcf8 0x80000820 + outl 0xcfc 0xe0004000 + outl 0xcf8 0x80000804 + outw 0xcfc 0x06 + write 0xe0004030 0x4 0x024000e0 + write 0xe0004028 0x1 0xff + write 0xe0004020 0x4 0x00009300 + write 0xe000401c 0x1 0x01 + write 0x101 0x1 0x04 + write 0x103 0x1 0x1c + write 0x9301c8 0x1 0x18 + write 0x105 0x1 0x1c + write 0x107 0x1 0x1c + write 0x109 0x1 0x1c + write 0x10b 0x1 0x00 + write 0x10d 0x1 0x00 + write 0x10f 0x1 0x00 + write 0x111 0x1 0x00 + write 0x113 0x1 0x00 + write 0x115 0x1 0x00 + write 0x117 0x1 0x00 + write 0x119 0x1 0x00 + write 0x11b 0x1 0x00 + write 0x11d 0x1 0x00 + write 0x11f 0x1 0x00 + write 0x121 0x1 0x00 + write 0x123 0x1 0x00 + write 0x125 0x1 0x00 + write 0x127 0x1 0x00 + write 0x129 0x1 0x00 + write 0x12b 0x1 0x00 + write 0x12d 0x1 0x00 + write 0x12f 0x1 0x00 + write 0x131 0x1 0x00 + write 0x133 0x1 0x00 + write 0x135 0x1 0x00 + write 0x137 0x1 0x00 + write 0x139 0x1 0x00 + write 0xe0007003 0x1 0x00 + EOF + ... + ================================================================= + ==276099==ERROR: AddressSanitizer: heap-use-after-free on address 0x60d000011178 + at pc 0x562cc3b736c7 bp 0x7ffed49dee60 sp 0x7ffed49dee58 + READ of size 8 at 0x60d000011178 thread T0 + #0 0x562cc3b736c6 in virtio_gpu_ctrl_response hw/display/virtio-gpu.c:180:42 + #1 0x562cc3b7c40b in virtio_gpu_ctrl_response_nodata hw/display/virtio-gpu.c:192:5 + #2 0x562cc3b7c40b in virtio_gpu_simple_process_cmd hw/display/virtio-gpu.c:1015:13 + #3 0x562cc3b82873 in virtio_gpu_process_cmdq hw/display/virtio-gpu.c:1050:9 + #4 0x562cc4a85514 in aio_bh_call util/async.c:169:5 + #5 0x562cc4a85c52 in aio_bh_poll util/async.c:216:13 + #6 0x562cc4a1a79b in aio_dispatch util/aio-posix.c:423:5 + #7 0x562cc4a8a2da in aio_ctx_dispatch util/async.c:358:5 + #8 0x7f36840547a8 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x547a8) + #9 0x562cc4a8b753 in glib_pollfds_poll util/main-loop.c:290:9 + #10 0x562cc4a8b753 in os_host_main_loop_wait util/main-loop.c:313:5 + #11 0x562cc4a8b753 in main_loop_wait util/main-loop.c:592:11 + #12 0x562cc3938186 in qemu_main_loop system/runstate.c:782:9 + #13 0x562cc43b7af5 in qemu_default_main system/main.c:37:14 + #14 0x7f3683a6c189 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 + #15 0x7f3683a6c244 in __libc_start_main csu/../csu/libc-start.c:381:3 + #16 0x562cc2a58ac0 in _start (qemu-system-i386+0x231bac0) + + 0x60d000011178 is located 56 bytes inside of 136-byte region [0x60d000011140,0x60d0000111c8) + freed by thread T0 here: + #0 0x562cc2adb662 in __interceptor_free (qemu-system-i386+0x239e662) + #1 0x562cc3b86b21 in virtio_gpu_reset hw/display/virtio-gpu.c:1524:9 + #2 0x562cc416e20e in virtio_reset hw/virtio/virtio.c:2145:9 + #3 0x562cc37c5644 in virtio_pci_reset hw/virtio/virtio-pci.c:2249:5 + #4 0x562cc4233758 in memory_region_write_accessor system/memory.c:497:5 + #5 0x562cc4232eea in access_with_adjusted_size system/memory.c:573:18 + + previously allocated by thread T0 here: + #0 0x562cc2adb90e in malloc (qemu-system-i386+0x239e90e) + #1 0x7f368405a678 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5a678) + #2 0x562cc4163ffc in virtqueue_split_pop hw/virtio/virtio.c:1612:12 + #3 0x562cc4163ffc in virtqueue_pop hw/virtio/virtio.c:1783:16 + #4 0x562cc3b91a95 in virtio_gpu_handle_ctrl hw/display/virtio-gpu.c:1112:15 + #5 0x562cc4a85514 in aio_bh_call util/async.c:169:5 + #6 0x562cc4a85c52 in aio_bh_poll util/async.c:216:13 + #7 0x562cc4a1a79b in aio_dispatch util/aio-posix.c:423:5 + + SUMMARY: AddressSanitizer: heap-use-after-free hw/display/virtio-gpu.c:180:42 in virtio_gpu_ctrl_response + +With this change, the same reproducer triggers: + + qemu-system-i386: warning: Blocked re-entrant IO on MemoryRegion: virtio-pci-common-virtio-gpu at addr: 0x6 + +Fixes: CVE-2024-3446 +Cc: qemu-stable@nongnu.org +Reported-by: Alexander Bulekov +Reported-by: Yongkang Jia +Reported-by: Xiao Lei +Reported-by: Yiming Tao +Buglink: https://bugs.launchpad.net/qemu/+bug/1888606 +Reviewed-by: Gerd Hoffmann +Acked-by: Michael S. Tsirkin +Signed-off-by: Philippe Mathieu-Daudé +Reviewed-by: Michael S. Tsirkin +Message-Id: <20240409105537.18308-3-philmd@linaro.org> +Signed-off-by: liuxiangdong +--- + hw/display/virtio-gpu.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c +index b35d3da965..29024596b1 100644 +--- a/hw/display/virtio-gpu.c ++++ b/hw/display/virtio-gpu.c +@@ -1128,10 +1128,8 @@ static void virtio_gpu_device_realize(DeviceState *qdev, Error **errp) + + g->ctrl_vq = virtio_get_queue(vdev, 0); + g->cursor_vq = virtio_get_queue(vdev, 1); +- g->ctrl_bh = qemu_bh_new_guarded(virtio_gpu_ctrl_bh, g, +- &qdev->mem_reentrancy_guard); +- g->cursor_bh = qemu_bh_new_guarded(virtio_gpu_cursor_bh, g, +- &qdev->mem_reentrancy_guard); ++ g->ctrl_bh = virtio_bh_new_guarded(qdev, virtio_gpu_ctrl_bh, g); ++ g->cursor_bh = virtio_bh_new_guarded(qdev, virtio_gpu_cursor_bh, g); + QTAILQ_INIT(&g->reslist); + QTAILQ_INIT(&g->cmdq); + QTAILQ_INIT(&g->fenceq); +-- +2.27.0 + diff --git a/hw-replace-most-qemu_bh_new-calls-with-qemu_bh_new_g.patch b/hw-replace-most-qemu_bh_new-calls-with-qemu_bh_new_g.patch new file mode 100644 index 0000000000000000000000000000000000000000..895bcdbf79f0872a269ca3becb3797d0964b5f1b --- /dev/null +++ b/hw-replace-most-qemu_bh_new-calls-with-qemu_bh_new_g.patch @@ -0,0 +1,391 @@ +From bf6fa0d4f900e85ac073ae63d444fbb5ffad0c98 Mon Sep 17 00:00:00 2001 +From: Alexander Bulekov +Date: Thu, 27 Apr 2023 17:10:09 -0400 +Subject: [PATCH] hw: replace most qemu_bh_new calls with qemu_bh_new_guarded + +This protects devices from bh->mmio reentrancy issues. + +Thanks: Thomas Huth for diagnosing OS X test failure. +Signed-off-by: Alexander Bulekov +Reviewed-by: Darren Kenny +Reviewed-by: Stefan Hajnoczi +Reviewed-by: Michael S. Tsirkin +Reviewed-by: Paul Durrant +Reviewed-by: Thomas Huth +Message-Id: <20230427211013.2994127-5-alxndr@bu.edu> +Signed-off-by: Thomas Huth +Signed-off-by: liuxiangdong +--- + hw/9pfs/xen-9p-backend.c | 5 ++++- + hw/block/dataplane/virtio-blk.c | 3 ++- + hw/block/dataplane/xen-block.c | 5 +++-- + hw/char/virtio-serial-bus.c | 3 ++- + hw/display/qxl.c | 9 ++++++--- + hw/display/virtio-gpu.c | 6 ++++-- + hw/ide/ahci.c | 3 ++- + hw/ide/ahci_internal.h | 1 + + hw/ide/core.c | 4 +++- + hw/misc/macio/mac_dbdma.c | 2 +- + hw/net/virtio-net.c | 3 ++- + hw/scsi/mptsas.c | 3 ++- + hw/scsi/scsi-bus.c | 3 ++- + hw/scsi/vmw_pvscsi.c | 3 ++- + hw/usb/dev-uas.c | 3 ++- + hw/usb/hcd-ehci.c | 3 ++- + hw/usb/hcd-uhci.c | 2 +- + hw/usb/host-libusb.c | 6 ++++-- + hw/usb/redirect.c | 6 ++++-- + hw/usb/xen-usb.c | 3 ++- + hw/virtio/virtio-balloon.c | 5 +++-- + hw/virtio/virtio-crypto.c | 3 ++- + 22 files changed, 56 insertions(+), 28 deletions(-) + +diff --git a/hw/9pfs/xen-9p-backend.c b/hw/9pfs/xen-9p-backend.c +index 25ab04d95a..df7bf8bd2e 100644 +--- a/hw/9pfs/xen-9p-backend.c ++++ b/hw/9pfs/xen-9p-backend.c +@@ -54,6 +54,7 @@ typedef struct Xen9pfsDev { + + int num_rings; + Xen9pfsRing *rings; ++ MemReentrancyGuard mem_reentrancy_guard; + } Xen9pfsDev; + + static void xen_9pfs_disconnect(struct XenLegacyDevice *xendev); +@@ -416,7 +417,9 @@ static int xen_9pfs_connect(struct XenLegacyDevice *xendev) + xen_9pdev->rings[i].ring.out = xen_9pdev->rings[i].data + + XEN_FLEX_RING_SIZE(ring_order); + +- xen_9pdev->rings[i].bh = qemu_bh_new(xen_9pfs_bh, &xen_9pdev->rings[i]); ++ xen_9pdev->rings[i].bh = qemu_bh_new_guarded(xen_9pfs_bh, ++ &xen_9pdev->rings[i], ++ &xen_9pdev->mem_reentrancy_guard); + xen_9pdev->rings[i].out_cons = 0; + xen_9pdev->rings[i].out_size = 0; + xen_9pdev->rings[i].inprogress = false; +diff --git a/hw/block/dataplane/virtio-blk.c b/hw/block/dataplane/virtio-blk.c +index 4476f97960..84b42d6ab6 100644 +--- a/hw/block/dataplane/virtio-blk.c ++++ b/hw/block/dataplane/virtio-blk.c +@@ -126,7 +126,8 @@ bool virtio_blk_data_plane_create(VirtIODevice *vdev, VirtIOBlkConf *conf, + } else { + s->ctx = qemu_get_aio_context(); + } +- s->bh = aio_bh_new(s->ctx, notify_guest_bh, s); ++ s->bh = aio_bh_new_guarded(s->ctx, notify_guest_bh, s, ++ &DEVICE(vdev)->mem_reentrancy_guard); + s->batch_notify_vqs = bitmap_new(conf->num_queues); + + *dataplane = s; +diff --git a/hw/block/dataplane/xen-block.c b/hw/block/dataplane/xen-block.c +index 0f200c5fb0..e9ae8f76da 100644 +--- a/hw/block/dataplane/xen-block.c ++++ b/hw/block/dataplane/xen-block.c +@@ -647,8 +647,9 @@ XenBlockDataPlane *xen_block_dataplane_create(XenDevice *xendev, + } else { + dataplane->ctx = qemu_get_aio_context(); + } +- dataplane->bh = aio_bh_new(dataplane->ctx, xen_block_dataplane_bh, +- dataplane); ++ dataplane->bh = aio_bh_new_guarded(dataplane->ctx, xen_block_dataplane_bh, ++ dataplane, ++ &DEVICE(xendev)->mem_reentrancy_guard); + + return dataplane; + } +diff --git a/hw/char/virtio-serial-bus.c b/hw/char/virtio-serial-bus.c +index f7a54f261b..a614810985 100644 +--- a/hw/char/virtio-serial-bus.c ++++ b/hw/char/virtio-serial-bus.c +@@ -940,7 +940,8 @@ static void virtser_port_device_realize(DeviceState *dev, Error **errp) + Error *err = NULL; + + port->vser = bus->vser; +- port->bh = qemu_bh_new(flush_queued_data_bh, port); ++ port->bh = qemu_bh_new_guarded(flush_queued_data_bh, port, ++ &dev->mem_reentrancy_guard); + + assert(vsc->have_data); + +diff --git a/hw/display/qxl.c b/hw/display/qxl.c +index 3442e66dcd..aa6d4aaff5 100644 +--- a/hw/display/qxl.c ++++ b/hw/display/qxl.c +@@ -2223,11 +2223,14 @@ static void qxl_realize_common(PCIQXLDevice *qxl, Error **errp) + + qemu_add_vm_change_state_handler(qxl_vm_change_state_handler, qxl); + +- qxl->update_irq = qemu_bh_new(qxl_update_irq_bh, qxl); ++ qxl->update_irq = qemu_bh_new_guarded(qxl_update_irq_bh, qxl, ++ &DEVICE(qxl)->mem_reentrancy_guard); + qxl_reset_state(qxl); + +- qxl->update_area_bh = qemu_bh_new(qxl_render_update_area_bh, qxl); +- qxl->ssd.cursor_bh = qemu_bh_new(qemu_spice_cursor_refresh_bh, &qxl->ssd); ++ qxl->update_area_bh = qemu_bh_new_guarded(qxl_render_update_area_bh, qxl, ++ &DEVICE(qxl)->mem_reentrancy_guard); ++ qxl->ssd.cursor_bh = qemu_bh_new_guarded(qemu_spice_cursor_refresh_bh, &qxl->ssd, ++ &DEVICE(qxl)->mem_reentrancy_guard); + } + + static void qxl_realize_primary(PCIDevice *dev, Error **errp) +diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c +index 25d9e327fc..b35d3da965 100644 +--- a/hw/display/virtio-gpu.c ++++ b/hw/display/virtio-gpu.c +@@ -1128,8 +1128,10 @@ static void virtio_gpu_device_realize(DeviceState *qdev, Error **errp) + + g->ctrl_vq = virtio_get_queue(vdev, 0); + g->cursor_vq = virtio_get_queue(vdev, 1); +- g->ctrl_bh = qemu_bh_new(virtio_gpu_ctrl_bh, g); +- g->cursor_bh = qemu_bh_new(virtio_gpu_cursor_bh, g); ++ g->ctrl_bh = qemu_bh_new_guarded(virtio_gpu_ctrl_bh, g, ++ &qdev->mem_reentrancy_guard); ++ g->cursor_bh = qemu_bh_new_guarded(virtio_gpu_cursor_bh, g, ++ &qdev->mem_reentrancy_guard); + QTAILQ_INIT(&g->reslist); + QTAILQ_INIT(&g->cmdq); + QTAILQ_INIT(&g->fenceq); +diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c +index a7be0ae4fe..4ffaab9526 100644 +--- a/hw/ide/ahci.c ++++ b/hw/ide/ahci.c +@@ -1502,7 +1502,8 @@ static void ahci_cmd_done(IDEDMA *dma) + ahci_write_fis_d2h(ad); + + if (ad->port_regs.cmd_issue && !ad->check_bh) { +- ad->check_bh = qemu_bh_new(ahci_check_cmd_bh, ad); ++ ad->check_bh = qemu_bh_new_guarded(ahci_check_cmd_bh, ad, ++ &ad->mem_reentrancy_guard); + qemu_bh_schedule(ad->check_bh); + } + } +diff --git a/hw/ide/ahci_internal.h b/hw/ide/ahci_internal.h +index 95ecddcd3c..caac0ad3ba 100644 +--- a/hw/ide/ahci_internal.h ++++ b/hw/ide/ahci_internal.h +@@ -320,6 +320,7 @@ struct AHCIDevice { + bool init_d2h_sent; + AHCICmdHdr *cur_cmd; + NCQTransferState ncq_tfs[AHCI_MAX_CMDS]; ++ MemReentrancyGuard mem_reentrancy_guard; + }; + + struct AHCIPCIState { +diff --git a/hw/ide/core.c b/hw/ide/core.c +index 1bedad29de..cf8468ce90 100644 +--- a/hw/ide/core.c ++++ b/hw/ide/core.c +@@ -489,11 +489,13 @@ BlockAIOCB *ide_issue_trim( + BlockCompletionFunc *cb, void *cb_opaque, void *opaque) + { + IDEState *s = opaque; ++ IDEDevice *dev = s->unit ? s->bus->slave : s->bus->master; + TrimAIOCB *iocb; + + iocb = blk_aio_get(&trim_aiocb_info, s->blk, cb, cb_opaque); + iocb->s = s; +- iocb->bh = qemu_bh_new(ide_trim_bh_cb, iocb); ++ iocb->bh = qemu_bh_new_guarded(ide_trim_bh_cb, iocb, ++ &DEVICE(dev)->mem_reentrancy_guard); + iocb->ret = 0; + iocb->qiov = qiov; + iocb->i = -1; +diff --git a/hw/misc/macio/mac_dbdma.c b/hw/misc/macio/mac_dbdma.c +index 548625a5f0..dfce15a971 100644 +--- a/hw/misc/macio/mac_dbdma.c ++++ b/hw/misc/macio/mac_dbdma.c +@@ -911,7 +911,7 @@ static void mac_dbdma_realize(DeviceState *dev, Error **errp) + { + DBDMAState *s = MAC_DBDMA(dev); + +- s->bh = qemu_bh_new(DBDMA_run_bh, s); ++ s->bh = qemu_bh_new_guarded(DBDMA_run_bh, s, &dev->mem_reentrancy_guard); + } + + static void mac_dbdma_class_init(ObjectClass *oc, void *data) +diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c +index b7fc688b4f..d2ff2c8ef2 100644 +--- a/hw/net/virtio-net.c ++++ b/hw/net/virtio-net.c +@@ -2263,7 +2263,8 @@ static void virtio_net_add_queue(VirtIONet *n, int index) + n->vqs[index].tx_vq = + virtio_add_queue(vdev, n->net_conf.tx_queue_size, + virtio_net_handle_tx_bh); +- n->vqs[index].tx_bh = qemu_bh_new(virtio_net_tx_bh, &n->vqs[index]); ++ n->vqs[index].tx_bh = qemu_bh_new_guarded(virtio_net_tx_bh, &n->vqs[index], ++ &DEVICE(vdev)->mem_reentrancy_guard); + } + + n->vqs[index].tx_waiting = 0; +diff --git a/hw/scsi/mptsas.c b/hw/scsi/mptsas.c +index 4d23f045d7..c3f0a81c15 100644 +--- a/hw/scsi/mptsas.c ++++ b/hw/scsi/mptsas.c +@@ -1318,7 +1318,8 @@ static void mptsas_scsi_realize(PCIDevice *dev, Error **errp) + } + s->max_devices = MPTSAS_NUM_PORTS; + +- s->request_bh = qemu_bh_new(mptsas_fetch_requests, s); ++ s->request_bh = qemu_bh_new_guarded(mptsas_fetch_requests, s, ++ &DEVICE(dev)->mem_reentrancy_guard); + + QTAILQ_INIT(&s->pending); + +diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c +index 9dc09b5f3e..d8ed80511e 100644 +--- a/hw/scsi/scsi-bus.c ++++ b/hw/scsi/scsi-bus.c +@@ -150,7 +150,8 @@ static void scsi_dma_restart_cb(void *opaque, int running, RunState state) + } + if (!s->bh) { + AioContext *ctx = blk_get_aio_context(s->conf.blk); +- s->bh = aio_bh_new(ctx, scsi_dma_restart_bh, s); ++ s->bh = aio_bh_new_guarded(ctx, scsi_dma_restart_bh, s, ++ &DEVICE(s)->mem_reentrancy_guard); + qemu_bh_schedule(s->bh); + } + } +diff --git a/hw/scsi/vmw_pvscsi.c b/hw/scsi/vmw_pvscsi.c +index 14641df1c8..fafaca62fc 100644 +--- a/hw/scsi/vmw_pvscsi.c ++++ b/hw/scsi/vmw_pvscsi.c +@@ -1138,7 +1138,8 @@ pvscsi_realizefn(PCIDevice *pci_dev, Error **errp) + pcie_endpoint_cap_init(pci_dev, PVSCSI_EXP_EP_OFFSET); + } + +- s->completion_worker = qemu_bh_new(pvscsi_process_completion_queue, s); ++ s->completion_worker = qemu_bh_new_guarded(pvscsi_process_completion_queue, s, ++ &DEVICE(pci_dev)->mem_reentrancy_guard); + + scsi_bus_new(&s->bus, sizeof(s->bus), DEVICE(pci_dev), + &pvscsi_scsi_info, NULL); +diff --git a/hw/usb/dev-uas.c b/hw/usb/dev-uas.c +index 82bbc0d083..bc216fa66d 100644 +--- a/hw/usb/dev-uas.c ++++ b/hw/usb/dev-uas.c +@@ -922,7 +922,8 @@ static void usb_uas_realize(USBDevice *dev, Error **errp) + + QTAILQ_INIT(&uas->results); + QTAILQ_INIT(&uas->requests); +- uas->status_bh = qemu_bh_new(usb_uas_send_status_bh, uas); ++ uas->status_bh = qemu_bh_new_guarded(usb_uas_send_status_bh, uas, ++ &d->mem_reentrancy_guard); + + scsi_bus_new(&uas->bus, sizeof(uas->bus), DEVICE(dev), + &usb_uas_scsi_info, NULL); +diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c +index 433e6a4fc0..218877491f 100644 +--- a/hw/usb/hcd-ehci.c ++++ b/hw/usb/hcd-ehci.c +@@ -2521,7 +2521,8 @@ void usb_ehci_realize(EHCIState *s, DeviceState *dev, Error **errp) + } + + s->frame_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, ehci_work_timer, s); +- s->async_bh = qemu_bh_new(ehci_work_bh, s); ++ s->async_bh = qemu_bh_new_guarded(ehci_work_bh, s, ++ &dev->mem_reentrancy_guard); + s->device = dev; + + s->vmstate = qemu_add_vm_change_state_handler(usb_ehci_vm_state_change, s); +diff --git a/hw/usb/hcd-uhci.c b/hw/usb/hcd-uhci.c +index 98bd5cf49d..333413acdd 100644 +--- a/hw/usb/hcd-uhci.c ++++ b/hw/usb/hcd-uhci.c +@@ -1245,7 +1245,7 @@ static void usb_uhci_common_realize(PCIDevice *dev, Error **errp) + USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL); + } + } +- s->bh = qemu_bh_new(uhci_bh, s); ++ s->bh = qemu_bh_new_guarded(uhci_bh, s, &DEVICE(dev)->mem_reentrancy_guard); + s->frame_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, uhci_frame_timer, s); + s->num_ports_vmstate = NB_PORTS; + QTAILQ_INIT(&s->queues); +diff --git a/hw/usb/host-libusb.c b/hw/usb/host-libusb.c +index 83ebc51620..6353a0e862 100644 +--- a/hw/usb/host-libusb.c ++++ b/hw/usb/host-libusb.c +@@ -977,7 +977,8 @@ static void usb_host_nodev_bh(void *opaque) + static void usb_host_nodev(USBHostDevice *s) + { + if (!s->bh_nodev) { +- s->bh_nodev = qemu_bh_new(usb_host_nodev_bh, s); ++ s->bh_nodev = qemu_bh_new_guarded(usb_host_nodev_bh, s, ++ &DEVICE(s)->mem_reentrancy_guard); + } + qemu_bh_schedule(s->bh_nodev); + } +@@ -1556,7 +1557,8 @@ static int usb_host_post_load(void *opaque, int version_id) + USBHostDevice *dev = opaque; + + if (!dev->bh_postld) { +- dev->bh_postld = qemu_bh_new(usb_host_post_load_bh, dev); ++ dev->bh_postld = qemu_bh_new_guarded(usb_host_post_load_bh, dev, ++ &DEVICE(dev)->mem_reentrancy_guard); + } + qemu_bh_schedule(dev->bh_postld); + dev->bh_postld_pending = true; +diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c +index 87338f76da..56f2d487df 100644 +--- a/hw/usb/redirect.c ++++ b/hw/usb/redirect.c +@@ -1383,8 +1383,10 @@ static void usbredir_realize(USBDevice *udev, Error **errp) + } + } + +- dev->chardev_close_bh = qemu_bh_new(usbredir_chardev_close_bh, dev); +- dev->device_reject_bh = qemu_bh_new(usbredir_device_reject_bh, dev); ++ dev->chardev_close_bh = qemu_bh_new_guarded(usbredir_chardev_close_bh, dev, ++ &DEVICE(dev)->mem_reentrancy_guard); ++ dev->device_reject_bh = qemu_bh_new_guarded(usbredir_device_reject_bh, dev, ++ &DEVICE(dev)->mem_reentrancy_guard); + dev->attach_timer = timer_new_ms(QEMU_CLOCK_VIRTUAL, usbredir_do_attach, dev); + + packet_id_queue_init(&dev->cancelled, dev, "cancelled"); +diff --git a/hw/usb/xen-usb.c b/hw/usb/xen-usb.c +index dfbb418e77..47f068e506 100644 +--- a/hw/usb/xen-usb.c ++++ b/hw/usb/xen-usb.c +@@ -1024,7 +1024,8 @@ static void usbback_alloc(struct XenLegacyDevice *xendev) + + QTAILQ_INIT(&usbif->req_free_q); + QSIMPLEQ_INIT(&usbif->hotplug_q); +- usbif->bh = qemu_bh_new(usbback_bh, usbif); ++ usbif->bh = qemu_bh_new_guarded(usbback_bh, usbif, ++ &DEVICE(xendev)->mem_reentrancy_guard); + } + + static int usbback_free(struct XenLegacyDevice *xendev) +diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c +index ae56c0d906..859260143f 100644 +--- a/hw/virtio/virtio-balloon.c ++++ b/hw/virtio/virtio-balloon.c +@@ -804,8 +804,9 @@ static void virtio_balloon_device_realize(DeviceState *dev, Error **errp) + precopy_add_notifier(&s->free_page_report_notify); + if (s->iothread) { + object_ref(OBJECT(s->iothread)); +- s->free_page_bh = aio_bh_new(iothread_get_aio_context(s->iothread), +- virtio_ballloon_get_free_page_hints, s); ++ s->free_page_bh = aio_bh_new_guarded(iothread_get_aio_context(s->iothread), ++ virtio_ballloon_get_free_page_hints, s, ++ &dev->mem_reentrancy_guard); + qemu_mutex_init(&s->free_page_lock); + qemu_cond_init(&s->free_page_cond); + s->block_iothread = false; +diff --git a/hw/virtio/virtio-crypto.c b/hw/virtio/virtio-crypto.c +index 5e112a2402..46dab3d6c4 100644 +--- a/hw/virtio/virtio-crypto.c ++++ b/hw/virtio/virtio-crypto.c +@@ -811,7 +811,8 @@ static void virtio_crypto_device_realize(DeviceState *dev, Error **errp) + vcrypto->vqs[i].dataq = + virtio_add_queue(vdev, 1024, virtio_crypto_handle_dataq_bh); + vcrypto->vqs[i].dataq_bh = +- qemu_bh_new(virtio_crypto_dataq_bh, &vcrypto->vqs[i]); ++ qemu_bh_new_guarded(virtio_crypto_dataq_bh, &vcrypto->vqs[i], ++ &dev->mem_reentrancy_guard); + vcrypto->vqs[i].vcrypto = vcrypto; + } + +-- +2.27.0 + diff --git a/hw-sd-sdhci-Do-not-update-TRNMOD-when-Command-Inhibi.patch b/hw-sd-sdhci-Do-not-update-TRNMOD-when-Command-Inhibi.patch new file mode 100644 index 0000000000000000000000000000000000000000..cd83961ff6edee372bfbfe77f18ee3d2c66b9d66 --- /dev/null +++ b/hw-sd-sdhci-Do-not-update-TRNMOD-when-Command-Inhibi.patch @@ -0,0 +1,135 @@ +From 6b400ef8cc18b9b89aa643ca2924533b2cdd337a Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= +Date: Tue, 9 Apr 2024 16:19:27 +0200 +Subject: [PATCH] hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) + is set +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Per "SD Host Controller Standard Specification Version 3.00": + + * 2.2.5 Transfer Mode Register (Offset 00Ch) + + Writes to this register shall be ignored when the Command + Inhibit (DAT) in the Present State register is 1. + +Do not update the TRNMOD register when Command Inhibit (DAT) +bit is set to avoid the present-status register going out of +sync, leading to malicious guest using DMA mode and overflowing +the FIFO buffer: + + $ cat << EOF | qemu-system-i386 \ + -display none -nographic -nodefaults \ + -machine accel=qtest -m 512M \ + -device sdhci-pci,sd-spec-version=3 \ + -device sd-card,drive=mydrive \ + -drive if=none,index=0,file=null-co://,format=raw,id=mydrive \ + -qtest stdio + outl 0xcf8 0x80001013 + outl 0xcfc 0x91 + outl 0xcf8 0x80001001 + outl 0xcfc 0x06000000 + write 0x9100002c 0x1 0x05 + write 0x91000058 0x1 0x16 + write 0x91000005 0x1 0x04 + write 0x91000028 0x1 0x08 + write 0x16 0x1 0x21 + write 0x19 0x1 0x20 + write 0x9100000c 0x1 0x01 + write 0x9100000e 0x1 0x20 + write 0x9100000f 0x1 0x00 + write 0x9100000c 0x1 0x00 + write 0x91000020 0x1 0x00 + EOF + +Stack trace (part): +================================================================= +==89993==ERROR: AddressSanitizer: heap-buffer-overflow on address +0x615000029900 at pc 0x55d5f885700d bp 0x7ffc1e1e9470 sp 0x7ffc1e1e9468 +WRITE of size 1 at 0x615000029900 thread T0 + #0 0x55d5f885700c in sdhci_write_dataport hw/sd/sdhci.c:564:39 + #1 0x55d5f8849150 in sdhci_write hw/sd/sdhci.c:1223:13 + #2 0x55d5fa01db63 in memory_region_write_accessor system/memory.c:497:5 + #3 0x55d5fa01d245 in access_with_adjusted_size system/memory.c:573:18 + #4 0x55d5fa01b1a9 in memory_region_dispatch_write system/memory.c:1521:16 + #5 0x55d5fa09f5c9 in flatview_write_continue system/physmem.c:2711:23 + #6 0x55d5fa08f78b in flatview_write system/physmem.c:2753:12 + #7 0x55d5fa08f258 in address_space_write system/physmem.c:2860:18 + ... +0x615000029900 is located 0 bytes to the right of 512-byte region +[0x615000029700,0x615000029900) allocated by thread T0 here: + #0 0x55d5f7237b27 in __interceptor_calloc + #1 0x7f9e36dd4c50 in g_malloc0 + #2 0x55d5f88672f7 in sdhci_pci_realize hw/sd/sdhci-pci.c:36:5 + #3 0x55d5f844b582 in pci_qdev_realize hw/pci/pci.c:2092:9 + #4 0x55d5fa2ee74b in device_set_realized hw/core/qdev.c:510:13 + #5 0x55d5fa325bfb in property_set_bool qom/object.c:2358:5 + #6 0x55d5fa31ea45 in object_property_set qom/object.c:1472:5 + #7 0x55d5fa332509 in object_property_set_qobject om/qom-qobject.c:28:10 + #8 0x55d5fa31f6ed in object_property_set_bool qom/object.c:1541:15 + #9 0x55d5fa2e2948 in qdev_realize hw/core/qdev.c:292:12 + #10 0x55d5f8eed3f1 in qdev_device_add_from_qdict system/qdev-monitor.c:719:10 + #11 0x55d5f8eef7ff in qdev_device_add system/qdev-monitor.c:738:11 + #12 0x55d5f8f211f0 in device_init_func system/vl.c:1200:11 + #13 0x55d5fad0877d in qemu_opts_foreach util/qemu-option.c:1135:14 + #14 0x55d5f8f0df9c in qemu_create_cli_devices system/vl.c:2638:5 + #15 0x55d5f8f0db24 in qmp_x_exit_preconfig system/vl.c:2706:5 + #16 0x55d5f8f14dc0 in qemu_init system/vl.c:3737:9 + ... +SUMMARY: AddressSanitizer: heap-buffer-overflow hw/sd/sdhci.c:564:39 +in sdhci_write_dataport + +Add assertions to ensure the fifo_buffer[] is not overflowed by +malicious accesses to the Buffer Data Port register. + +Fixes: CVE-2024-3447 +Cc: qemu-stable@nongnu.org +Fixes: d7dfca0807 ("hw/sdhci: introduce standard SD host controller") +Buglink: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58813 +Reported-by: Alexander Bulekov +Reported-by: Chuhong Yuan +Signed-off-by: Peter Maydell +Message-Id: +Signed-off-by: Philippe Mathieu-Daudé +Message-Id: <20240409145524.27913-1-philmd@linaro.org> +--- + hw/sd/sdhci.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c +index bcfba25691..de16eaa3ef 100644 +--- a/hw/sd/sdhci.c ++++ b/hw/sd/sdhci.c +@@ -464,6 +464,7 @@ static uint32_t sdhci_read_dataport(SDHCIState *s, unsigned size) + } + + for (i = 0; i < size; i++) { ++ assert(s->data_count < s->buf_maxsz); + value |= s->fifo_buffer[s->data_count] << i * 8; + s->data_count++; + /* check if we've read all valid data (blksize bytes) from buffer */ +@@ -556,6 +557,7 @@ static void sdhci_write_dataport(SDHCIState *s, uint32_t value, unsigned size) + } + + for (i = 0; i < size; i++) { ++ assert(s->data_count < s->buf_maxsz); + s->fifo_buffer[s->data_count] = value & 0xFF; + s->data_count++; + value >>= 8; +@@ -1170,6 +1172,12 @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size) + if (!(s->capareg & R_SDHC_CAPAB_SDMA_MASK)) { + value &= ~SDHC_TRNS_DMA; + } ++ ++ /* TRNMOD writes are inhibited while Command Inhibit (DAT) is true */ ++ if (s->prnsts & SDHC_DATA_INHIBIT) { ++ mask |= 0xffff; ++ } ++ + MASKED_WRITE(s->trnmod, mask, value & SDHC_TRNMOD_MASK); + MASKED_WRITE(s->cmdreg, mask >> 16, value >> 16); + +-- +2.27.0 + diff --git a/hw-virtio-Introduce-virtio_bh_new_guarded-helper.patch b/hw-virtio-Introduce-virtio_bh_new_guarded-helper.patch new file mode 100644 index 0000000000000000000000000000000000000000..ad081b130939865e46670f8239663372f3458cec --- /dev/null +++ b/hw-virtio-Introduce-virtio_bh_new_guarded-helper.patch @@ -0,0 +1,69 @@ +From 3735895ad5697b52f7af90bb2e37d5f792b01072 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= +Date: Thu, 4 Apr 2024 20:56:11 +0200 +Subject: [PATCH] hw/virtio: Introduce virtio_bh_new_guarded() helper +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Introduce virtio_bh_new_guarded(), similar to qemu_bh_new_guarded() +but using the transport memory guard, instead of the device one +(there can only be one virtio device per virtio bus). + +Inspired-by: Gerd Hoffmann +Reviewed-by: Gerd Hoffmann +Acked-by: Michael S. Tsirkin +Signed-off-by: Philippe Mathieu-Daudé +Reviewed-by: Michael S. Tsirkin +Message-Id: <20240409105537.18308-2-philmd@linaro.org> +Signed-off-by: liuxiangdong +--- + hw/virtio/virtio.c | 10 ++++++++++ + include/hw/virtio/virtio.h | 8 ++++++++ + 2 files changed, 18 insertions(+) + +diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c +index 79c2dcf54a..cd6757ba98 100644 +--- a/hw/virtio/virtio.c ++++ b/hw/virtio/virtio.c +@@ -2850,3 +2850,13 @@ static void virtio_register_types(void) + } + + type_init(virtio_register_types) ++ ++QEMUBH *virtio_bh_new_guarded_full(DeviceState *dev, ++ QEMUBHFunc *cb, void *opaque, ++ const char *name) ++{ ++ DeviceState *transport = qdev_get_parent_bus(dev)->parent; ++ ++ return qemu_bh_new_full(cb, opaque, name, ++ &transport->mem_reentrancy_guard); ++} +diff --git a/include/hw/virtio/virtio.h b/include/hw/virtio/virtio.h +index f9f62370e9..80f03e5ac9 100644 +--- a/include/hw/virtio/virtio.h ++++ b/include/hw/virtio/virtio.h +@@ -21,6 +21,7 @@ + #include "qemu/event_notifier.h" + #include "standard-headers/linux/virtio_config.h" + #include "standard-headers/linux/virtio_ring.h" ++#include "block/aio.h" + + /* A guest should never accept this. It implies negotiation is broken. */ + #define VIRTIO_F_BAD_FEATURE 30 +@@ -378,4 +379,11 @@ static inline void virtio_set_started(VirtIODevice *vdev, bool started) + vdev->started = started; + } + } ++ ++QEMUBH *virtio_bh_new_guarded_full(DeviceState *dev, ++ QEMUBHFunc *cb, void *opaque, ++ const char *name); ++#define virtio_bh_new_guarded(dev, cb, opaque) \ ++ virtio_bh_new_guarded_full((dev), (cb), (opaque), (stringify(cb))) ++ + #endif +-- +2.27.0 + diff --git a/hw-virtio-virtio-crypto-Protect-from-DMA-re-entrancy.patch b/hw-virtio-virtio-crypto-Protect-from-DMA-re-entrancy.patch new file mode 100644 index 0000000000000000000000000000000000000000..572140e343f162dcce2013a112bee53e17a0706d --- /dev/null +++ b/hw-virtio-virtio-crypto-Protect-from-DMA-re-entrancy.patch @@ -0,0 +1,43 @@ +From 3cd3f9141255fd896cc10abedefab81f1724d53b Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= +Date: Thu, 4 Apr 2024 20:56:41 +0200 +Subject: [PATCH] hw/virtio/virtio-crypto: Protect from DMA re-entrancy + bugs(CVE-2024-3446) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Replace qemu_bh_new_guarded() by virtio_bh_new_guarded() +so the bus and device use the same guard. Otherwise the +DMA-reentrancy protection can be bypassed. + +Fixes: CVE-2024-3446 +Cc: qemu-stable@nongnu.org +Suggested-by: Alexander Bulekov +Reviewed-by: Gerd Hoffmann +Acked-by: Michael S. Tsirkin +Signed-off-by: Philippe Mathieu-Daudé +Reviewed-by: Michael S. Tsirkin +Message-Id: <20240409105537.18308-5-philmd@linaro.org> +--- + hw/virtio/virtio-crypto.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/hw/virtio/virtio-crypto.c b/hw/virtio/virtio-crypto.c +index 46dab3d6c4..22d0a9a446 100644 +--- a/hw/virtio/virtio-crypto.c ++++ b/hw/virtio/virtio-crypto.c +@@ -811,8 +811,8 @@ static void virtio_crypto_device_realize(DeviceState *dev, Error **errp) + vcrypto->vqs[i].dataq = + virtio_add_queue(vdev, 1024, virtio_crypto_handle_dataq_bh); + vcrypto->vqs[i].dataq_bh = +- qemu_bh_new_guarded(virtio_crypto_dataq_bh, &vcrypto->vqs[i], +- &dev->mem_reentrancy_guard); ++ virtio_bh_new_guarded(dev, virtio_crypto_dataq_bh, ++ &vcrypto->vqs[i]); + vcrypto->vqs[i].vcrypto = vcrypto; + } + +-- +2.27.0 + diff --git a/qemu.spec b/qemu.spec index 34f0f64a3f261edeeee5ce3a2514ec417ef11291..21ac2fead44cd054e93b9ccab9b251d233213dd4 100644 --- a/qemu.spec +++ b/qemu.spec @@ -1,6 +1,6 @@ Name: qemu Version: 4.1.0 -Release: 82 +Release: 83 Epoch: 10 Summary: QEMU is a generic and open source machine emulator and virtualizer License: GPLv2 and BSD and MIT and CC-BY-SA-4.0 @@ -398,6 +398,17 @@ Patch0385: net-Provide-MemReentrancyGuard-to-qemu_new_nic.patch Patch0386: net-Update-MemReentrancyGuard-for-NIC-CVE-2023-3019.patch Patch0387: hw-scsi-lsi53c895a-Fix-reentrancy-issues-in-the-LSI-.patch Patch0388: hw-scsi-lsi53c895a-add-missing-decrement-of-reentran.patch +Patch0389: Include-sysemu-sysemu.h-a-lot-less.patch +Patch0390: hw-sd-sdhci-Do-not-update-TRNMOD-when-Command-Inhibi.patch +Patch0391: util-async-add-a-human-readable-name-to-BHs-for-debu.patch +Patch0392: async-Add-an-optional-reentrancy-guard-to-the-BH-API.patch +Patch0393: async-avoid-use-after-free-on-re-entrancy-guard.patch +Patch0394: checkpatch-add-qemu_bh_new-aio_bh_new-checks.patch +Patch0395: hw-replace-most-qemu_bh_new-calls-with-qemu_bh_new_g.patch +Patch0396: hw-virtio-Introduce-virtio_bh_new_guarded-helper.patch +Patch0397: hw-display-virtio-gpu-Protect-from-DMA-re-entrancy-b.patch +Patch0398: hw-char-virtio-serial-bus-Protect-from-DMA-re-entran.patch +Patch0399: hw-virtio-virtio-crypto-Protect-from-DMA-re-entrancy.patch BuildRequires: flex BuildRequires: bison @@ -798,6 +809,19 @@ getent passwd qemu >/dev/null || \ %endif %changelog +* Tue Apr 23 2024 Jiabo Feng +- hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs(CVE-2024-3446) +- hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs(CVE-2024-3446) +- hw/display/virtio-gpu: Protect from DMA re-entrancy bugs(CVE-2024-3446) +- hw/virtio: Introduce virtio_bh_new_guarded() helper +- hw: replace most qemu_bh_new calls with qemu_bh_new_guarded +- checkpatch: add qemu_bh_new/aio_bh_new checks +- async: avoid use-after-free on re-entrancy guard +- async: Add an optional reentrancy guard to the BH API +- util/async: add a human-readable name to BHs for debugging +- hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set +- Include sysemu/sysemu.h a lot less + * Sat Mar 9 2024 Jiabo Feng - hw/scsi/lsi53c895a: add missing decrement of reentrancy counter - hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) diff --git a/util-async-add-a-human-readable-name-to-BHs-for-debu.patch b/util-async-add-a-human-readable-name-to-BHs-for-debu.patch new file mode 100644 index 0000000000000000000000000000000000000000..8f0c53068256b0cff66a57dd1b04194b2660e0a3 --- /dev/null +++ b/util-async-add-a-human-readable-name-to-BHs-for-debu.patch @@ -0,0 +1,180 @@ +From 149020a75cf4a711db3d0fcd68b85b7deb0f3760 Mon Sep 17 00:00:00 2001 +From: Stefan Hajnoczi +Date: Wed, 14 Apr 2021 21:02:46 +0100 +Subject: [PATCH] util/async: add a human-readable name to BHs for debugging +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +It can be difficult to debug issues with BHs in production environments. +Although BHs can usually be identified by looking up their ->cb() +function pointer, this requires debug information for the program. It is +also not possible to print human-readable diagnostics about BHs because +they have no identifier. + +This patch adds a name to each BH. The name is not unique per instance +but differentiates between cb() functions, which is usually enough. It's +done by changing aio_bh_new() and friends to macros that stringify cb. + +The next patch will use the name field when reporting leaked BHs. + +Signed-off-by: Stefan Hajnoczi +Reviewed-by: Philippe Mathieu-Daudé +Message-Id: <20210414200247.917496-2-stefanha@redhat.com> +Signed-off-by: liuxiangdong +--- + include/block/aio.h | 31 ++++++++++++++++++++++++++++--- + include/qemu/main-loop.h | 4 +++- + tests/ptimer-test-stubs.c | 2 +- + util/async.c | 9 +++++++-- + util/main-loop.c | 4 ++-- + 5 files changed, 41 insertions(+), 9 deletions(-) + +diff --git a/include/block/aio.h b/include/block/aio.h +index 9d28e247df..93b6c9b352 100644 +--- a/include/block/aio.h ++++ b/include/block/aio.h +@@ -194,20 +194,45 @@ void aio_context_acquire(AioContext *ctx); + /* Relinquish ownership of the AioContext. */ + void aio_context_release(AioContext *ctx); + ++/** ++ * aio_bh_schedule_oneshot_full: Allocate a new bottom half structure that will ++ * run only once and as soon as possible. ++ * ++ * @name: A human-readable identifier for debugging purposes. ++ */ ++void aio_bh_schedule_oneshot_full(AioContext *ctx, QEMUBHFunc *cb, void *opaque, ++ const char *name); ++ + /** + * aio_bh_schedule_oneshot: Allocate a new bottom half structure that will run + * only once and as soon as possible. ++ * ++ * A convenience wrapper for aio_bh_schedule_oneshot_full() that uses cb as the ++ * name string. + */ +-void aio_bh_schedule_oneshot(AioContext *ctx, QEMUBHFunc *cb, void *opaque); ++#define aio_bh_schedule_oneshot(ctx, cb, opaque) \ ++ aio_bh_schedule_oneshot_full((ctx), (cb), (opaque), (stringify(cb))) + + /** +- * aio_bh_new: Allocate a new bottom half structure. ++ * aio_bh_new_full: Allocate a new bottom half structure. + * + * Bottom halves are lightweight callbacks whose invocation is guaranteed + * to be wait-free, thread-safe and signal-safe. The #QEMUBH structure + * is opaque and must be allocated prior to its use. ++ * ++ * @name: A human-readable identifier for debugging purposes. ++ */ ++QEMUBH *aio_bh_new_full(AioContext *ctx, QEMUBHFunc *cb, void *opaque, ++ const char *name); ++ ++/** ++ * aio_bh_new: Allocate a new bottom half structure ++ * ++ * A convenience wrapper for aio_bh_new_full() that uses the cb as the name ++ * string. + */ +-QEMUBH *aio_bh_new(AioContext *ctx, QEMUBHFunc *cb, void *opaque); ++#define aio_bh_new(ctx, cb, opaque) \ ++ aio_bh_new_full((ctx), (cb), (opaque), (stringify(cb))) + + /** + * aio_notify: Force processing of pending events. +diff --git a/include/qemu/main-loop.h b/include/qemu/main-loop.h +index f6ba78ea73..b131a0edc5 100644 +--- a/include/qemu/main-loop.h ++++ b/include/qemu/main-loop.h +@@ -299,7 +299,9 @@ void qemu_mutex_unlock_iothread(void); + + void qemu_fd_register(int fd); + +-QEMUBH *qemu_bh_new(QEMUBHFunc *cb, void *opaque); ++#define qemu_bh_new(cb, opaque) \ ++ qemu_bh_new_full((cb), (opaque), (stringify(cb))) ++QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name); + void qemu_bh_schedule_idle(QEMUBH *bh); + + enum { +diff --git a/tests/ptimer-test-stubs.c b/tests/ptimer-test-stubs.c +index 54b3fd26f6..bc813c27b6 100644 +--- a/tests/ptimer-test-stubs.c ++++ b/tests/ptimer-test-stubs.c +@@ -107,7 +107,7 @@ int64_t qemu_clock_deadline_ns_all(QEMUClockType type) + return deadline; + } + +-QEMUBH *qemu_bh_new(QEMUBHFunc *cb, void *opaque) ++QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name) + { + QEMUBH *bh = g_new(QEMUBH, 1); + +diff --git a/util/async.c b/util/async.c +index 5448e22dd1..77f6a791a7 100644 +--- a/util/async.c ++++ b/util/async.c +@@ -38,6 +38,7 @@ + + struct QEMUBH { + AioContext *ctx; ++ const char *name; + QEMUBHFunc *cb; + void *opaque; + QEMUBH *next; +@@ -46,7 +47,8 @@ struct QEMUBH { + bool deleted; + }; + +-void aio_bh_schedule_oneshot(AioContext *ctx, QEMUBHFunc *cb, void *opaque) ++void aio_bh_schedule_oneshot_full(AioContext *ctx, QEMUBHFunc *cb, ++ void *opaque, const char *name) + { + QEMUBH *bh; + bh = g_new(QEMUBH, 1); +@@ -54,6 +56,7 @@ void aio_bh_schedule_oneshot(AioContext *ctx, QEMUBHFunc *cb, void *opaque) + .ctx = ctx, + .cb = cb, + .opaque = opaque, ++ .name = name, + }; + qemu_lockcnt_lock(&ctx->list_lock); + bh->next = ctx->first_bh; +@@ -66,7 +69,8 @@ void aio_bh_schedule_oneshot(AioContext *ctx, QEMUBHFunc *cb, void *opaque) + aio_notify(ctx); + } + +-QEMUBH *aio_bh_new(AioContext *ctx, QEMUBHFunc *cb, void *opaque) ++QEMUBH *aio_bh_new_full(AioContext *ctx, QEMUBHFunc *cb, void *opaque, ++ const char *name) + { + QEMUBH *bh; + bh = g_new(QEMUBH, 1); +@@ -74,6 +78,7 @@ QEMUBH *aio_bh_new(AioContext *ctx, QEMUBHFunc *cb, void *opaque) + .ctx = ctx, + .cb = cb, + .opaque = opaque, ++ .name = name, + }; + qemu_lockcnt_lock(&ctx->list_lock); + bh->next = ctx->first_bh; +diff --git a/util/main-loop.c b/util/main-loop.c +index e3eaa55866..382ceb8f8f 100644 +--- a/util/main-loop.c ++++ b/util/main-loop.c +@@ -526,9 +526,9 @@ void main_loop_wait(int nonblocking) + + /* Functions to operate on the main QEMU AioContext. */ + +-QEMUBH *qemu_bh_new(QEMUBHFunc *cb, void *opaque) ++QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name) + { +- return aio_bh_new(qemu_aio_context, cb, opaque); ++ return aio_bh_new_full(qemu_aio_context, cb, opaque, name); + } + + /* +-- +2.27.0 +