From 6a94f0c8779b5312be2fc946e2f605acd610d4c6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20F=C3=B6rster?= Date: Sat, 7 Nov 2015 13:15:41 +0100 Subject: [PATCH] [app-emulation/qemu] version bump --- app-emulation/qemu/Manifest | 2 +- .../qemu/files/qemu-2.4.0-CVE-2015-6855.patch | 146 ------------------ .../files/qemu-2.4.0-CVE-2015-7295-1.patch | 58 ------- .../files/qemu-2.4.0-CVE-2015-7295-2.patch | 54 ------- .../files/qemu-2.4.0-CVE-2015-7295-3.patch | 47 ------ .../files/qemu-2.4.0-block-mirror-crash.patch | 124 --------------- .../qemu/files/qemu-2.4.0-e1000-loop.patch | 39 ----- ...mu-2.4.0.1-r1.ebuild => qemu-2.4.1.ebuild} | 9 +- 8 files changed, 2 insertions(+), 477 deletions(-) delete mode 100644 app-emulation/qemu/files/qemu-2.4.0-CVE-2015-6855.patch delete mode 100644 app-emulation/qemu/files/qemu-2.4.0-CVE-2015-7295-1.patch delete mode 100644 app-emulation/qemu/files/qemu-2.4.0-CVE-2015-7295-2.patch delete mode 100644 app-emulation/qemu/files/qemu-2.4.0-CVE-2015-7295-3.patch delete mode 100644 app-emulation/qemu/files/qemu-2.4.0-block-mirror-crash.patch delete mode 100644 app-emulation/qemu/files/qemu-2.4.0-e1000-loop.patch rename app-emulation/qemu/{qemu-2.4.0.1-r1.ebuild => qemu-2.4.1.ebuild} (98%) diff --git a/app-emulation/qemu/Manifest b/app-emulation/qemu/Manifest index a283992..b054ec0 100644 --- a/app-emulation/qemu/Manifest +++ b/app-emulation/qemu/Manifest @@ -1 +1 @@ -DIST qemu-2.4.0.1.tar.bz2 25068555 SHA256 ecfe8b88037e41e817d72c460c56c6a0b573d540d6ba38b162d0de4fd22d1bdb SHA512 08eabe92fa9096386ef00f8e9d99eeec1508d15e5a98431e043a729cbaca2d96d6e3afc612e7c4a0fe5a6bba80006276185f1066b4c73105b2ea24b7e9133b84 WHIRLPOOL 1daaec23d6ada6af8bf4902e590fb96375e7149d2f53ff6bf6d8fb39722c182a2d2efcc0d40bee673a8316f621983c512daa54202bb4e632b3a4b09f0268cd09 +DIST qemu-2.4.1.tar.bz2 25087522 SHA256 e3d5cf4c8b1f9129c9c797329a515bfb6b3b1ded0ab8b394c8a316490fe3a177 SHA512 fde32b71a50d888c1055e61f4e6dfc45bb97e8e9ebee490c545965fbdcbd5ffd859fbf20648abed1f4fa9fcc5635e9b22e1829bbe802fc8aaf989d6013235917 WHIRLPOOL a698cfa5d2d138eeddb3c6bea57e3b89ca5d47165c04ed1cfd66a81647ac59cbdd594c919abef67bf198278da1160c5b9f3a0da84cd73827f3eb19a6e6f05436 diff --git a/app-emulation/qemu/files/qemu-2.4.0-CVE-2015-6855.patch b/app-emulation/qemu/files/qemu-2.4.0-CVE-2015-6855.patch deleted file mode 100644 index 69dd66a..0000000 --- a/app-emulation/qemu/files/qemu-2.4.0-CVE-2015-6855.patch +++ /dev/null @@ -1,146 +0,0 @@ -https://bugs.gentoo.org/560422 - -From d9033e1d3aa666c5071580617a57bd853c5d794a Mon Sep 17 00:00:00 2001 -From: John Snow -Date: Thu, 17 Sep 2015 14:17:05 -0400 -Subject: [PATCH] ide: fix ATAPI command permissions - -We're a little too lenient with what we'll let an ATAPI drive handle. -Clamp down on the IDE command execution table to remove CD_OK permissions -from commands that are not and have never been ATAPI commands. - -For ATAPI command validity, please see: -- ATA4 Section 6.5 ("PACKET Command feature set") -- ATA8/ACS Section 4.3 ("The PACKET feature set") -- ACS3 Section 4.3 ("The PACKET feature set") - -ACS3 has a historical command validity table in Table B.4 -("Historical Command Assignments") that can be referenced to find when -a command was introduced, deprecated, obsoleted, etc. - -The only reference for ATAPI command validity is by checking that -version's PACKET feature set section. - -ATAPI was introduced by T13 into ATA4, all commands retired prior to ATA4 -therefore are assumed to have never been ATAPI commands. - -Mandatory commands, as listed in ATA8-ACS3, are: - -- DEVICE RESET -- EXECUTE DEVICE DIAGNOSTIC -- IDENTIFY DEVICE -- IDENTIFY PACKET DEVICE -- NOP -- PACKET -- READ SECTOR(S) -- SET FEATURES - -Optional commands as listed in ATA8-ACS3, are: - -- FLUSH CACHE -- READ LOG DMA EXT -- READ LOG EXT -- WRITE LOG DMA EXT -- WRITE LOG EXT - -All other commands are illegal to send to an ATAPI device and should -be rejected by the device. - -CD_OK removal justifications: - -0x06 WIN_DSM Defined in ACS2. Not valid for ATAPI. -0x21 WIN_READ_ONCE Retired in ATA5. Not ATAPI in ATA4. -0x94 WIN_STANDBYNOW2 Retired in ATA4. Did not coexist with ATAPI. -0x95 WIN_IDLEIMMEDIATE2 Retired in ATA4. Did not coexist with ATAPI. -0x96 WIN_STANDBY2 Retired in ATA4. Did not coexist with ATAPI. -0x97 WIN_SETIDLE2 Retired in ATA4. Did not coexist with ATAPI. -0x98 WIN_CHECKPOWERMODE2 Retired in ATA4. Did not coexist with ATAPI. -0x99 WIN_SLEEPNOW2 Retired in ATA4. Did not coexist with ATAPI. -0xE0 WIN_STANDBYNOW1 Not part of ATAPI in ATA4, ACS or ACS3. -0xE1 WIN_IDLEIMMDIATE Not part of ATAPI in ATA4, ACS or ACS3. -0xE2 WIN_STANDBY Not part of ATAPI in ATA4, ACS or ACS3. -0xE3 WIN_SETIDLE1 Not part of ATAPI in ATA4, ACS or ACS3. -0xE4 WIN_CHECKPOWERMODE1 Not part of ATAPI in ATA4, ACS or ACS3. -0xE5 WIN_SLEEPNOW1 Not part of ATAPI in ATA4, ACS or ACS3. -0xF8 WIN_READ_NATIVE_MAX Obsoleted in ACS3. Not ATAPI in ATA4 or ACS. - -This patch fixes a divide by zero fault that can be caused by sending -the WIN_READ_NATIVE_MAX command to an ATAPI drive, which causes it to -attempt to use zeroed CHS values to perform sector arithmetic. - -Reported-by: Qinghao Tang -Signed-off-by: John Snow -Reviewed-by: Markus Armbruster -Message-id: 1441816082-21031-1-git-send-email-jsnow@redhat.com -CC: qemu-stable@nongnu.org ---- - hw/ide/core.c | 30 +++++++++++++++--------------- - 1 file changed, 15 insertions(+), 15 deletions(-) - -diff --git a/hw/ide/core.c b/hw/ide/core.c -index 8ba04df..1cc6945 100644 ---- a/hw/ide/core.c -+++ b/hw/ide/core.c -@@ -1746,11 +1746,11 @@ static const struct { - } ide_cmd_table[0x100] = { - /* NOP not implemented, mandatory for CD */ - [CFA_REQ_EXT_ERROR_CODE] = { cmd_cfa_req_ext_error_code, CFA_OK }, -- [WIN_DSM] = { cmd_data_set_management, ALL_OK }, -+ [WIN_DSM] = { cmd_data_set_management, HD_CFA_OK }, - [WIN_DEVICE_RESET] = { cmd_device_reset, CD_OK }, - [WIN_RECAL] = { cmd_nop, HD_CFA_OK | SET_DSC}, - [WIN_READ] = { cmd_read_pio, ALL_OK }, -- [WIN_READ_ONCE] = { cmd_read_pio, ALL_OK }, -+ [WIN_READ_ONCE] = { cmd_read_pio, HD_CFA_OK }, - [WIN_READ_EXT] = { cmd_read_pio, HD_CFA_OK }, - [WIN_READDMA_EXT] = { cmd_read_dma, HD_CFA_OK }, - [WIN_READ_NATIVE_MAX_EXT] = { cmd_read_native_max, HD_CFA_OK | SET_DSC }, -@@ -1769,12 +1769,12 @@ static const struct { - [CFA_TRANSLATE_SECTOR] = { cmd_cfa_translate_sector, CFA_OK }, - [WIN_DIAGNOSE] = { cmd_exec_dev_diagnostic, ALL_OK }, - [WIN_SPECIFY] = { cmd_nop, HD_CFA_OK | SET_DSC }, -- [WIN_STANDBYNOW2] = { cmd_nop, ALL_OK }, -- [WIN_IDLEIMMEDIATE2] = { cmd_nop, ALL_OK }, -- [WIN_STANDBY2] = { cmd_nop, ALL_OK }, -- [WIN_SETIDLE2] = { cmd_nop, ALL_OK }, -- [WIN_CHECKPOWERMODE2] = { cmd_check_power_mode, ALL_OK | SET_DSC }, -- [WIN_SLEEPNOW2] = { cmd_nop, ALL_OK }, -+ [WIN_STANDBYNOW2] = { cmd_nop, HD_CFA_OK }, -+ [WIN_IDLEIMMEDIATE2] = { cmd_nop, HD_CFA_OK }, -+ [WIN_STANDBY2] = { cmd_nop, HD_CFA_OK }, -+ [WIN_SETIDLE2] = { cmd_nop, HD_CFA_OK }, -+ [WIN_CHECKPOWERMODE2] = { cmd_check_power_mode, HD_CFA_OK | SET_DSC }, -+ [WIN_SLEEPNOW2] = { cmd_nop, HD_CFA_OK }, - [WIN_PACKETCMD] = { cmd_packet, CD_OK }, - [WIN_PIDENTIFY] = { cmd_identify_packet, CD_OK }, - [WIN_SMART] = { cmd_smart, HD_CFA_OK | SET_DSC }, -@@ -1788,19 +1788,19 @@ static const struct { - [WIN_WRITEDMA] = { cmd_write_dma, HD_CFA_OK }, - [WIN_WRITEDMA_ONCE] = { cmd_write_dma, HD_CFA_OK }, - [CFA_WRITE_MULTI_WO_ERASE] = { cmd_write_multiple, CFA_OK }, -- [WIN_STANDBYNOW1] = { cmd_nop, ALL_OK }, -- [WIN_IDLEIMMEDIATE] = { cmd_nop, ALL_OK }, -- [WIN_STANDBY] = { cmd_nop, ALL_OK }, -- [WIN_SETIDLE1] = { cmd_nop, ALL_OK }, -- [WIN_CHECKPOWERMODE1] = { cmd_check_power_mode, ALL_OK | SET_DSC }, -- [WIN_SLEEPNOW1] = { cmd_nop, ALL_OK }, -+ [WIN_STANDBYNOW1] = { cmd_nop, HD_CFA_OK }, -+ [WIN_IDLEIMMEDIATE] = { cmd_nop, HD_CFA_OK }, -+ [WIN_STANDBY] = { cmd_nop, HD_CFA_OK }, -+ [WIN_SETIDLE1] = { cmd_nop, HD_CFA_OK }, -+ [WIN_CHECKPOWERMODE1] = { cmd_check_power_mode, HD_CFA_OK | SET_DSC }, -+ [WIN_SLEEPNOW1] = { cmd_nop, HD_CFA_OK }, - [WIN_FLUSH_CACHE] = { cmd_flush_cache, ALL_OK }, - [WIN_FLUSH_CACHE_EXT] = { cmd_flush_cache, HD_CFA_OK }, - [WIN_IDENTIFY] = { cmd_identify, ALL_OK }, - [WIN_SETFEATURES] = { cmd_set_features, ALL_OK | SET_DSC }, - [IBM_SENSE_CONDITION] = { cmd_ibm_sense_condition, CFA_OK | SET_DSC }, - [CFA_WEAR_LEVEL] = { cmd_cfa_erase_sectors, HD_CFA_OK | SET_DSC }, -- [WIN_READ_NATIVE_MAX] = { cmd_read_native_max, ALL_OK | SET_DSC }, -+ [WIN_READ_NATIVE_MAX] = { cmd_read_native_max, HD_CFA_OK | SET_DSC }, - }; - - static bool ide_cmd_permitted(IDEState *s, uint32_t cmd) --- -2.6.0.rc2.230.g3dd15c0 - diff --git a/app-emulation/qemu/files/qemu-2.4.0-CVE-2015-7295-1.patch b/app-emulation/qemu/files/qemu-2.4.0-CVE-2015-7295-1.patch deleted file mode 100644 index 4ee46e1..0000000 --- a/app-emulation/qemu/files/qemu-2.4.0-CVE-2015-7295-1.patch +++ /dev/null @@ -1,58 +0,0 @@ -https://bugs.gentoo.org/560760 - -From ce317461573bac12b10d67699b4ddf1f97cf066c Mon Sep 17 00:00:00 2001 -From: Jason Wang -Date: Fri, 25 Sep 2015 13:21:28 +0800 -Subject: [PATCH 1/3] virtio: introduce virtqueue_unmap_sg() - -Factor out sg unmapping logic. This will be reused by the patch that -can discard descriptor. - -Cc: Michael S. Tsirkin -Cc: Andrew James -Signed-off-by: Jason Wang -Reviewed-by: Michael S. Tsirkin -Signed-off-by: Michael S. Tsirkin ---- - hw/virtio/virtio.c | 14 ++++++++++---- - 1 file changed, 10 insertions(+), 4 deletions(-) - -diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c -index 7504f8b..6f2b96c 100644 ---- a/hw/virtio/virtio.c -+++ b/hw/virtio/virtio.c -@@ -244,14 +244,12 @@ int virtio_queue_empty(VirtQueue *vq) - return vring_avail_idx(vq) == vq->last_avail_idx; - } - --void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem, -- unsigned int len, unsigned int idx) -+static void virtqueue_unmap_sg(VirtQueue *vq, const VirtQueueElement *elem, -+ unsigned int len) - { - unsigned int offset; - int i; - -- trace_virtqueue_fill(vq, elem, len, idx); -- - offset = 0; - for (i = 0; i < elem->in_num; i++) { - size_t size = MIN(len - offset, elem->in_sg[i].iov_len); -@@ -267,6 +265,14 @@ void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem, - cpu_physical_memory_unmap(elem->out_sg[i].iov_base, - elem->out_sg[i].iov_len, - 0, elem->out_sg[i].iov_len); -+} -+ -+void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem, -+ unsigned int len, unsigned int idx) -+{ -+ trace_virtqueue_fill(vq, elem, len, idx); -+ -+ virtqueue_unmap_sg(vq, elem, len); - - idx = (idx + vring_used_idx(vq)) % vq->vring.num; - --- -2.6.0.rc2.230.g3dd15c0 - diff --git a/app-emulation/qemu/files/qemu-2.4.0-CVE-2015-7295-2.patch b/app-emulation/qemu/files/qemu-2.4.0-CVE-2015-7295-2.patch deleted file mode 100644 index 8c73fcb..0000000 --- a/app-emulation/qemu/files/qemu-2.4.0-CVE-2015-7295-2.patch +++ /dev/null @@ -1,54 +0,0 @@ -https://bugs.gentoo.org/560760 - -From 29b9f5efd78ae0f9cc02dd169b6e80d2c404bade Mon Sep 17 00:00:00 2001 -From: Jason Wang -Date: Fri, 25 Sep 2015 13:21:29 +0800 -Subject: [PATCH 2/3] virtio: introduce virtqueue_discard() - -This patch introduces virtqueue_discard() to discard a descriptor and -unmap the sgs. This will be used by the patch that will discard -descriptor when packet is truncated. - -Cc: Michael S. Tsirkin -Signed-off-by: Jason Wang -Reviewed-by: Michael S. Tsirkin -Signed-off-by: Michael S. Tsirkin ---- - hw/virtio/virtio.c | 7 +++++++ - include/hw/virtio/virtio.h | 2 ++ - 2 files changed, 9 insertions(+) - -diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c -index 6f2b96c..d0bc72e 100644 ---- a/hw/virtio/virtio.c -+++ b/hw/virtio/virtio.c -@@ -267,6 +267,13 @@ static void virtqueue_unmap_sg(VirtQueue *vq, const VirtQueueElement *elem, - 0, elem->out_sg[i].iov_len); - } - -+void virtqueue_discard(VirtQueue *vq, const VirtQueueElement *elem, -+ unsigned int len) -+{ -+ vq->last_avail_idx--; -+ virtqueue_unmap_sg(vq, elem, len); -+} -+ - void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem, - unsigned int len, unsigned int idx) - { -diff --git a/include/hw/virtio/virtio.h b/include/hw/virtio/virtio.h -index 6201ee8..9d09115 100644 ---- a/include/hw/virtio/virtio.h -+++ b/include/hw/virtio/virtio.h -@@ -146,6 +146,8 @@ void virtio_del_queue(VirtIODevice *vdev, int n); - void virtqueue_push(VirtQueue *vq, const VirtQueueElement *elem, - unsigned int len); - void virtqueue_flush(VirtQueue *vq, unsigned int count); -+void virtqueue_discard(VirtQueue *vq, const VirtQueueElement *elem, -+ unsigned int len); - void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem, - unsigned int len, unsigned int idx); - --- -2.6.0.rc2.230.g3dd15c0 - diff --git a/app-emulation/qemu/files/qemu-2.4.0-CVE-2015-7295-3.patch b/app-emulation/qemu/files/qemu-2.4.0-CVE-2015-7295-3.patch deleted file mode 100644 index 96981e9..0000000 --- a/app-emulation/qemu/files/qemu-2.4.0-CVE-2015-7295-3.patch +++ /dev/null @@ -1,47 +0,0 @@ -https://bugs.gentoo.org/560760 - -From 0cf33fb6b49a19de32859e2cdc6021334f448fb3 Mon Sep 17 00:00:00 2001 -From: Jason Wang -Date: Fri, 25 Sep 2015 13:21:30 +0800 -Subject: [PATCH 3/3] virtio-net: correctly drop truncated packets - -When packet is truncated during receiving, we drop the packets but -neither discard the descriptor nor add and signal used -descriptor. This will lead several issues: - -- sg mappings are leaked -- rx will be stalled if a lots of packets were truncated - -In order to be consistent with vhost, fix by discarding the descriptor -in this case. - -Cc: Michael S. Tsirkin -Signed-off-by: Jason Wang -Reviewed-by: Michael S. Tsirkin -Signed-off-by: Michael S. Tsirkin ---- - hw/net/virtio-net.c | 8 +------- - 1 file changed, 1 insertion(+), 7 deletions(-) - -diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c -index d388c55..a877614 100644 ---- a/hw/net/virtio-net.c -+++ b/hw/net/virtio-net.c -@@ -1094,13 +1094,7 @@ static ssize_t virtio_net_receive(NetClientState *nc, const uint8_t *buf, size_t - * must have consumed the complete packet. - * Otherwise, drop it. */ - if (!n->mergeable_rx_bufs && offset < size) { --#if 0 -- error_report("virtio-net truncated non-mergeable packet: " -- "i %zd mergeable %d offset %zd, size %zd, " -- "guest hdr len %zd, host hdr len %zd", -- i, n->mergeable_rx_bufs, -- offset, size, n->guest_hdr_len, n->host_hdr_len); --#endif -+ virtqueue_discard(q->rx_vq, &elem, total); - return size; - } - --- -2.6.0.rc2.230.g3dd15c0 - diff --git a/app-emulation/qemu/files/qemu-2.4.0-block-mirror-crash.patch b/app-emulation/qemu/files/qemu-2.4.0-block-mirror-crash.patch deleted file mode 100644 index ad4051e..0000000 --- a/app-emulation/qemu/files/qemu-2.4.0-block-mirror-crash.patch +++ /dev/null @@ -1,124 +0,0 @@ -https://bugs.gentoo.org/558396 - -fix from upstream git - -From e424aff5f307227b1c2512bbb8ece891bb895cef Mon Sep 17 00:00:00 2001 -From: Kevin Wolf -Date: Thu, 13 Aug 2015 10:41:50 +0200 -Subject: [PATCH] mirror: Fix coroutine reentrance - -This fixes a regression introduced by commit dcfb3beb ("mirror: Do zero -write on target if sectors not allocated"), which was reported to cause -aborts with the message "Co-routine re-entered recursively". - -The cause for this bug is the following code in mirror_iteration_done(): - - if (s->common.busy) { - qemu_coroutine_enter(s->common.co, NULL); - } - -This has always been ugly because - unlike most places that reenter - it -doesn't have a specific yield that it pairs with, but is more -uncontrolled. What we really mean here is "reenter the coroutine if -it's in one of the four explicit yields in mirror.c". - -This used to be equivalent with s->common.busy because neither -mirror_run() nor mirror_iteration() call any function that could yield. -However since commit dcfb3beb this doesn't hold true any more: -bdrv_get_block_status_above() can yield. - -So what happens is that bdrv_get_block_status_above() wants to take a -lock that is already held, so it adds itself to the queue of waiting -coroutines and yields. Instead of being woken up by the unlock function, -however, it gets woken up by mirror_iteration_done(), which is obviously -wrong. - -In most cases the code actually happens to cope fairly well with such -cases, but in this specific case, the unlock must already have scheduled -the coroutine for wakeup when mirror_iteration_done() reentered it. And -then the coroutine happened to process the scheduled restarts and tried -to reenter itself recursively. - -This patch fixes the problem by pairing the reenter in -mirror_iteration_done() with specific yields instead of abusing -s->common.busy. - -Cc: qemu-stable@nongnu.org -Signed-off-by: Kevin Wolf -Reviewed-by: Paolo Bonzini -Reviewed-by: Stefan Hajnoczi -Reviewed-by: Jeff Cody -Message-id: 1439455310-11263-1-git-send-email-kwolf@redhat.com -Signed-off-by: Jeff Cody ---- - block/mirror.c | 15 ++++++++++----- - 1 file changed, 10 insertions(+), 5 deletions(-) - -diff --git a/block/mirror.c b/block/mirror.c -index 0841964..9474443 100644 ---- a/block/mirror.c -+++ b/block/mirror.c -@@ -60,6 +60,7 @@ typedef struct MirrorBlockJob { - int sectors_in_flight; - int ret; - bool unmap; -+ bool waiting_for_io; - } MirrorBlockJob; - - typedef struct MirrorOp { -@@ -114,11 +115,7 @@ static void mirror_iteration_done(MirrorOp *op, int ret) - qemu_iovec_destroy(&op->qiov); - g_slice_free(MirrorOp, op); - -- /* Enter coroutine when it is not sleeping. The coroutine sleeps to -- * rate-limit itself. The coroutine will eventually resume since there is -- * a sleep timeout so don't wake it early. -- */ -- if (s->common.busy) { -+ if (s->waiting_for_io) { - qemu_coroutine_enter(s->common.co, NULL); - } - } -@@ -203,7 +200,9 @@ static uint64_t coroutine_fn mirror_iteration(MirrorBlockJob *s) - /* Wait for I/O to this cluster (from a previous iteration) to be done. */ - while (test_bit(next_chunk, s->in_flight_bitmap)) { - trace_mirror_yield_in_flight(s, sector_num, s->in_flight); -+ s->waiting_for_io = true; - qemu_coroutine_yield(); -+ s->waiting_for_io = false; - } - - do { -@@ -239,7 +238,9 @@ static uint64_t coroutine_fn mirror_iteration(MirrorBlockJob *s) - */ - while (nb_chunks == 0 && s->buf_free_count < added_chunks) { - trace_mirror_yield_buf_busy(s, nb_chunks, s->in_flight); -+ s->waiting_for_io = true; - qemu_coroutine_yield(); -+ s->waiting_for_io = false; - } - if (s->buf_free_count < nb_chunks + added_chunks) { - trace_mirror_break_buf_busy(s, nb_chunks, s->in_flight); -@@ -337,7 +338,9 @@ static void mirror_free_init(MirrorBlockJob *s) - static void mirror_drain(MirrorBlockJob *s) - { - while (s->in_flight > 0) { -+ s->waiting_for_io = true; - qemu_coroutine_yield(); -+ s->waiting_for_io = false; - } - } - -@@ -510,7 +513,9 @@ static void coroutine_fn mirror_run(void *opaque) - if (s->in_flight == MAX_IN_FLIGHT || s->buf_free_count == 0 || - (cnt == 0 && s->in_flight > 0)) { - trace_mirror_yield(s, s->in_flight, s->buf_free_count, cnt); -+ s->waiting_for_io = true; - qemu_coroutine_yield(); -+ s->waiting_for_io = false; - continue; - } else if (cnt != 0) { - delay_ns = mirror_iteration(s); --- -2.5.0 - diff --git a/app-emulation/qemu/files/qemu-2.4.0-e1000-loop.patch b/app-emulation/qemu/files/qemu-2.4.0-e1000-loop.patch deleted file mode 100644 index f2538a7..0000000 --- a/app-emulation/qemu/files/qemu-2.4.0-e1000-loop.patch +++ /dev/null @@ -1,39 +0,0 @@ -https://bugs.gentoo.org/559656 - -https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg01199.html - -From: Stefan Hajnoczi -Subject: [PATCH] e1000: Avoid infinite loop in processing transmit descriptor -Newsgroups: gmane.comp.emulators.qemu -Date: 2015-09-04 16:21:06 GMT (2 days, 12 hours and 51 minutes ago) -From: P J P - -While processing transmit descriptors, it could lead to an infinite -loop if 'bytes' was to become zero; Add a check to avoid it. - -[The guest can force 'bytes' to 0 by setting the hdr_len and mss -descriptor fields to 0. ---Stefan] - -Signed-off-by: P J P -Signed-off-by: Stefan Hajnoczi ---- - hw/net/e1000.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/hw/net/e1000.c b/hw/net/e1000.c -index 5c6bcd0..09c9e9d 100644 ---- a/hw/net/e1000.c -+++ b/hw/net/e1000.c -@@ -740,7 +740,8 @@ process_tx_desc(E1000State *s, struct e1000_tx_desc *dp) - memmove(tp->data, tp->header, tp->hdr_len); - tp->size = tp->hdr_len; - } -- } while (split_size -= bytes); -+ split_size -= bytes; -+ } while (bytes && split_size); - } else if (!tp->tse && tp->cptse) { - // context descriptor TSE is not set, while data descriptor TSE is set - DBGOUT(TXERR, "TCP segmentation error\n"); --- -2.4.3 diff --git a/app-emulation/qemu/qemu-2.4.0.1-r1.ebuild b/app-emulation/qemu/qemu-2.4.1.ebuild similarity index 98% rename from app-emulation/qemu/qemu-2.4.0.1-r1.ebuild rename to app-emulation/qemu/qemu-2.4.1.ebuild index 2d793e9..ce84263 100644 --- a/app-emulation/qemu/qemu-2.4.0.1-r1.ebuild +++ b/app-emulation/qemu/qemu-2.4.1.ebuild @@ -303,18 +303,11 @@ src_prepare() { use nls || rm -f po/*.po epatch "${FILESDIR}"/qemu-1.7.0-cflags.patch - epatch "${FILESDIR}"/${PN}-2.4.0-block-mirror-crash.patch #558396 - epatch "${FILESDIR}"/${PN}-2.4.0-CVE-2015-7295-{1,2,3}.patch #560760 - epatch "${FILESDIR}"/${PN}-2.4.0-CVE-2015-6855.patch #560422 + epatch "${FILESDIR}"/${PN}-2.4-mips-* #563162 [[ -n ${BACKPORTS} ]] && \ EPATCH_FORCE=yes EPATCH_SUFFIX="patch" EPATCH_SOURCE="${S}/patches" \ epatch - # MIPS specific fixes. Bug #563162 - for x in "${FILESDIR}"/${PN}-2.4-mips-*; do - epatch "${x}" - done - # Fix ld and objcopy being called directly tc-export AR LD OBJCOPY