aboutsummaryrefslogtreecommitdiff
path: root/hw/net
AgeCommit message (Collapse)AuthorFilesLines
2021-09-17virtio-net: fix use after unmap/free for sgJason Wang1-7/+32
When mergeable buffer is enabled, we try to set the num_buffers after the virtqueue elem has been unmapped. This will lead several issues, E.g a use after free when the descriptor has an address which belongs to the non direct access region. In this case we use bounce buffer that is allocated during address_space_map() and freed during address_space_unmap(). Fixing this by storing the elems temporarily in an array and delay the unmap after we set the the num_buffers. This addresses CVE-2021-3748. Reported-by: Alexander Bulekov <alxndr@bu.edu> Fixes: fbe78f4f55c6 ("virtio-net support") Cc: qemu-stable@nongnu.org Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-09-04vhost_net: do not assume nvqs is always 2Jason Wang1-1/+1
This patch switches to initialize dev.nvqs from the VhostNetOptions instead of assuming it was 2. This is useful for implementing control virtqueue support which will be a single vhost_net structure with a single cvq. Note that nvqs is still set to 2 for all users and this patch does not change functionality. Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Reviewed-by: Eli Cohen <elic@nvidia.com> Signed-off-by: Jason Wang <jasowang@redhat.com> Message-Id: <20210903091031.47303-6-jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-09-04vhost_net: remove the meaningless assignment in vhost_net_start_one()Jason Wang1-3/+0
The nvqs and vqs have been initialized during vhost_net_init() and are not expected to change during the life cycle of vhost_net structure. So this patch removes the meaningless assignment. Reviewed-by: Eli Cohen <elic@nvidia.com> Signed-off-by: Jason Wang <jasowang@redhat.com> Message-Id: <20210903091031.47303-4-jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-08-02hw/net: e1000e: Don't zero out the VLAN tag in the legacy RX descriptorChristina Wang1-1/+0
In the legacy RX descriptor mode, VLAN tag was saved to d->special by e1000e_build_rx_metadata() in e1000e_write_lgcy_rx_descr(), but it was then zeroed out again at the end of the call, which is wrong. Fixes: c89d416a2b0f ("e1000e: Don't zero out buffer address in rx descriptor") Reported-by: Markus Carlstedt <markus.carlstedt@windriver.com> Signed-off-by: Christina Wang <christina.wang@windriver.com> Signed-off-by: Bin Meng <bin.meng@windriver.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-08-02hw/net: e1000e: Correct the initial value of VET registerChristina Wang2-6/+11
The initial value of VLAN Ether Type (VET) register is 0x8100, as per the manual and real hardware. While Linux e1000e driver always writes VET register to 0x8100, it is not always the case for everyone. Drivers relying on the reset value of VET won't be able to transmit and receive VLAN frames in QEMU. Unlike e1000 in QEMU, e1000e uses a field 'vet' in "struct E1000Core" to cache the value of VET register, but the cache only gets updated when VET register is written. To always get a consistent VET value no matter VET is written or remains its reset value, drop the 'vet' field and use 'core->mac[VET]' directly. Reported-by: Markus Carlstedt <markus.carlstedt@windriver.com> Signed-off-by: Christina Wang <christina.wang@windriver.com> Signed-off-by: Bin Meng <bin.meng@windriver.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-08-02hw/net: e1000: Correct the initial value of VET registerChristina Wang1-0/+17
The initial value of VLAN Ether Type (VET) register is 0x8100, as per the manual and real hardware. While Linux e1000 driver always writes VET register to 0x8100, it is not always the case for everyone. Drivers relying on the reset value of VET won't be able to transmit and receive VLAN frames in QEMU. Reported-by: Markus Carlstedt <markus.carlstedt@windriver.com> Signed-off-by: Christina Wang <christina.wang@windriver.com> Signed-off-by: Bin Meng <bin.meng@windriver.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-08-02hw/net/can: sja1000 fix buff2frame_bas and buff2frame_pel when dlc is out of ↵Pavel Pisa1-0/+8
std CAN 8 bytes Problem reported by openEuler fuzz-sig group. The buff2frame_bas function (hw\net\can\can_sja1000.c) infoleak(qemu5.x~qemu6.x) or stack-overflow(qemu 4.x). Reported-by: Qiang Ning <ningqiang1@huawei.com> Cc: qemu-stable@nongnu.org Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Pavel Pisa <pisa@cmp.felk.cvut.cz> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-08-02hw/net/vmxnet3: Do not abort QEMU if guest specified bad queue numbersThomas Huth1-12/+22
QEMU should never terminate unexpectedly just because the guest is doing something wrong like specifying wrong queue numbers. Let's simply refuse to set the device active in this case. Buglink: https://bugs.launchpad.net/qemu/+bug/1890160 Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-07-19hw/net/net_tx_pkt: Fix crash detected by fuzzerThomas Huth1-5/+7
QEMU currently crashes when it's started like this: cat << EOF | ./qemu-system-i386 -device vmxnet3 -nodefaults -qtest stdio outl 0xcf8 0x80001014 outl 0xcfc 0xe0001000 outl 0xcf8 0x80001018 outl 0xcf8 0x80001004 outw 0xcfc 0x7 outl 0xcf8 0x80001083 write 0x0 0x1 0xe1 write 0x1 0x1 0xfe write 0x2 0x1 0xbe write 0x3 0x1 0xba writeq 0xe0001020 0xefefff5ecafe0000 writeq 0xe0001020 0xffff5e5ccafe0002 EOF It hits this assertion: qemu-system-i386: ../qemu/hw/net/net_tx_pkt.c:453: net_tx_pkt_reset: Assertion `pkt->raw' failed. This happens because net_tx_pkt_init() is called with max_frags == 0 and thus the allocation p->raw = g_new(struct iovec, max_frags); results in a NULL pointer that causes the assert(pkt->raw); in net_tx_pkt_reset() to fail later. To fix this issue we can check that max_raw_frags was not zero before asserting that pkt->raw is a non-NULL pointer. Buglink: https://bugs.launchpad.net/qemu/+bug/1890157 Message-Id: <20210715193219.1132571-1-thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Pankaj Gupta <pankaj.gupta@ionos.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2021-07-19hw/net/vmxnet3: Do not abort if the guest is trying to use an invalid TX queueThomas Huth1-2/+7
QEMU should never abort just because the guest is doing something odd. Let's simply log the error and ignore the bad transmit queue instead. Buglink: https://bugs.launchpad.net/qemu/+bug/1926111 Message-Id: <20210715103755.1035566-1-thuth@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
2021-07-14net/rocker: use GDateTime for formatting timestamp in debug messagesDaniel P. Berrangé1-8/+3
The GDateTime APIs provided by GLib avoid portability pitfalls, such as some platforms where 'struct timeval.tv_sec' field is still 'long' instead of 'time_t'. When combined with automatic cleanup, GDateTime often results in simpler code too. Reviewed-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2021-07-11dp8393x: don't force 32-bit register accessMark Cave-Ayland1-5/+9
Commit 3fe9a838ec "dp8393x: Always use 32-bit accesses" set .impl.min_access_size and .impl.max_access_size to 4 to try and fix the Linux jazzsonic driver which uses 32-bit accesses. The problem with forcing the register access to 32-bit in this way is that since the dp8393x uses 16-bit registers, a manual endian swap is required for devices on big endian machines with 32-bit accesses. For both access sizes and machine endians the QEMU memory API can do the right thing automatically: all that is needed is to set .impl.min_access_size to 2 to declare that the dp8393x implements 16-bit registers. Normally .impl.max_access_size should also be set to 2, however that doesn't quite work in this case since the register stride is specified using a (dynamic) it_shift property which is applied during the MMIO access itself. The effect of this is that for a 32-bit access the memory API performs 2 x 16-bit accesses, but the use of it_shift within the MMIO access itself causes the register value to be repeated in both the top 16-bits and bottom 16-bits. The Linux jazzsonic driver expects the stride to be zero-extended up to access size and therefore fails to correctly detect the dp8393x device due to the extra data in the top 16-bits. The solution here is to remove .impl.max_access_size so that the memory API will correctly zero-extend the 16-bit registers to the access size up to and including it_shift. Since it_shift is never greater than 2 than this will always do the right thing for both 16-bit and 32-bit accesses regardless of the machine endian, allowing the manual endian swap code to be removed. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Fixes: 3fe9a838ec ("dp8393x: Always use 32-bit accesses") Message-Id: <20210705214929.17222-2-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Finn Thain <fthain@linux-m68k.org> Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2021-07-11dp8393x: Rewrite dp8393x_get() / dp8393x_put()Philippe Mathieu-Daudé1-97/+63
Instead of accessing N registers via a single address_space API call using a temporary buffer (stored in the device state) and updating each register, move the address_space call in the register put/get. The load/store and word size checks are moved to put/get too. This simplifies a bit, making the code easier to read. Co-developed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Co-developed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Finn Thain <fthain@linux-m68k.org> Message-Id: <20210710174954.2577195-8-f4bug@amsat.org>
2021-07-11dp8393x: Store CAM registers as 16-bitPhilippe Mathieu-Daudé1-15/+12
Per the DP83932C datasheet from July 1995: 4.0 SONIC Registers 4.1 THE CAM UNIT The Content Addressable Memory (CAM) consists of sixteen 48-bit entries for complete address filtering of network packets. Each entry corresponds to a 48-bit destination address that is user programmable and can contain any combination of Multicast or Physical addresses. Each entry is partitioned into three 16-bit CAM cells accessible through CAM Address Ports (CAP 2, CAP 1 and CAP 0) with CAP0 corresponding to the least significant 16 bits of the Destination Address and CAP2 corresponding to the most significant bits. Store the CAM registers as 16-bit as it simplifies the code. Having now the CAM registers as arrays of 3 uint16_t, we can avoid using the VMSTATE_BUFFER_UNSAFE macro by using VMSTATE_UINT16_2DARRAY which is more appropriate. This breaks the migration stream however. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Finn Thain <fthain@linux-m68k.org> Message-Id: <20210710174954.2577195-5-f4bug@amsat.org> Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2021-07-11dp8393x: Replace 0x40 magic value by SONIC_REG_COUNT definitionPhilippe Mathieu-Daudé1-3/+4
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Finn Thain <fthain@linux-m68k.org> Message-Id: <20210710174954.2577195-3-f4bug@amsat.org> Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2021-07-11dp8393x: Replace address_space_rw(is_write=1) by address_space_write()Philippe Mathieu-Daudé1-4/+4
Replace address_space_rw(is_write=1) by address_space_write() and remove pointless cast. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Finn Thain <fthain@linux-m68k.org> Message-Id: <20210710174954.2577195-2-f4bug@amsat.org> Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2021-07-11dp8393x: fix CAM descriptor entry indexMark Cave-Ayland1-2/+2
Currently when a LOAD CAM command is executed the entries are loaded into the CAM from memory in order which is incorrect. According to the datasheet the first entry in the CAM descriptor is the entry index which means that each descriptor may update any single entry in the CAM rather than the Nth entry. Decode the CAM entry index and use it store the descriptor in the appropriate slot in the CAM. This fixes the issue where the MacOS toolbox loads a single CAM descriptor into the final slot in order to perform a loopback test which must succeed before the Ethernet port is enabled. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Finn Thain <fthain@linux-m68k.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210625065401.30170-10-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2021-07-09Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell1-0/+1
pc,pci,virtio: bugfixes, improvements vhost-user-rng support. Fixes all over the place. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Wed 07 Jul 2021 14:29:30 BST # gpg: using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469 # gpg: issuer "mst@redhat.com" # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [full] # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" [full] # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: MAINTAINERS: Add maintainer for vhost-user RNG implementation docs: add slot when adding new PCIe root port acpi/ged: fix reset cause tests: acpi: pc: update expected DSDT blobs acpi: pc: revert back to v5.2 PCI slot enumeration tests: acpi: prepare for changing DSDT tables migration: failover: reset partially_hotplugged virtio-pci: Changed return values for "notify", "device" and "isr" read. virtio-pci: Added check for virtio device in PCI config cbs. virtio-pci: Added check for virtio device presence in mm callbacks. hw/pci-host/q35: Ignore write of reserved PCIEXBAR LENGTH field virtio: Clarify MR transaction optimization virtio: disable ioeventfd for record/replay Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-04Merge remote-tracking branch 'remotes/philmd/tags/mips-20210702' into stagingPeter Maydell2-164/+155
MIPS patches queue - Extract nanoMIPS, microMIPS, Code Compaction from translate.c - Allow PCI config accesses smaller than 32-bit on Bonito64 device - Fix migration of g364fb device on Jazz Magnum - Fix dp8393x PROM checksum on Jazz Magnum and Quadra 800 - Map the UART devices unconditionally on Jazz Magnum - Add functional test booting Linux on the Fuloong 2E # gpg: Signature made Fri 02 Jul 2021 16:36:19 BST # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * remotes/philmd/tags/mips-20210702: hw/mips/jazz: Map the UART devices unconditionally hw/mips/jazz: specify correct endian for dp8393x device hw/m68k/q800: fix PROM checksum and MAC address storage qemu/bitops.h: add bitrev8 implementation dp8393x: remove onboard PROM containing MAC address and checksum hw/m68k/q800: move PROM and checksum calculation from dp8393x device to board hw/mips/jazz: move PROM and checksum calculation from dp8393x device to board dp8393x: convert to trace-events dp8393x: checkpatch fixes g364fb: add VMStateDescription for G364SysBusState g364fb: use RAM memory region for framebuffer tests/acceptance: Test Linux on the Fuloong 2E machine hw/pci-host/bonito: Allow PCI config accesses smaller than 32-bit hw/pci-host/bonito: Trace PCI config accesses smaller than 32-bit target/mips: Extract nanoMIPS ISA translation routines target/mips: Extract the microMIPS ISA translation routines target/mips: Extract Code Compaction ASE translation routines target/mips: Add declarations for generic TCG helpers Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-03migration: failover: reset partially_hotpluggedLaurent Vivier1-0/+1
When the card is plugged back, reset the partially_hotplugged flag to false Bug: https://bugzilla.redhat.com/show_bug.cgi?id=1787194 Signed-off-by: Laurent Vivier <lvivier@redhat.com> Message-Id: <20210629152937.619193-1-lvivier@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-07-02dp8393x: remove onboard PROM containing MAC address and checksumMark Cave-Ayland1-24/+0
According to the datasheet the dp8393x chipset does not contain any NVRAM capable of storing a MAC address or checksum. Now that both the MIPS jazz and m68k q800 boards generate the PROM region and checksum themselves, remove the generated PROM from the dp8393x device itself. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Finn Thain <fthain@linux-m68k.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210625065401.30170-6-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2021-07-02dp8393x: convert to trace-eventsMark Cave-Ayland2-35/+37
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Finn Thain <fthain@linux-m68k.org> Message-Id: <20210625065401.30170-3-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2021-07-02dp8393x: checkpatch fixesMark Cave-Ayland1-109/+122
Also fix a simple comment typo of "constrainst" to "constraints". Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Finn Thain <fthain@linux-m68k.org> Message-Id: <20210625065401.30170-2-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2021-06-30vhost: Distinguish errors in vhost_dev_get_config()Kevin Wolf1-1/+1
Instead of just returning 0/-1 and letting the caller make up a meaningless error message, add an Error parameter to allow reporting the real error and switch to 0/-errno so that different kind of errors can be distinguished in the caller. config_len in vhost_user_get_config() is defined by the device, so if it's larger than VHOST_USER_MAX_CONFIG_SIZE, this is a programming error. Turn the corresponding check into an assertion. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Message-Id: <20210609154658.350308-6-kwolf@redhat.com> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Reviewed-by: Raphael Norwitz <raphael.norwitz@nutanix.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2021-06-30vhost: Add Error parameter to vhost_dev_init()Kevin Wolf1-1/+5
This allows callers to return better error messages instead of making one up while the real error ends up on stderr. Most callers can immediately make use of this because they already have an Error parameter themselves. The others just keep printing the error with error_report_err(). Signed-off-by: Kevin Wolf <kwolf@redhat.com> Message-Id: <20210609154658.350308-2-kwolf@redhat.com> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Reviewed-by: Raphael Norwitz <raphael.norwitz@nutanix.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2021-06-04Merge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into ↵Peter Maydell2-3/+116
staging # gpg: Signature made Fri 04 Jun 2021 08:26:16 BST # gpg: using RSA key EF04965B398D6211 # gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>" [marginal] # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 215D 46F4 8246 689E C77F 3562 EF04 965B 398D 6211 * remotes/jasowang/tags/net-pull-request: MAINTAINERS: Added eBPF maintainers information. docs: Added eBPF documentation. virtio-net: Added eBPF RSS to virtio-net. ebpf: Added eBPF RSS loader. ebpf: Added eBPF RSS program. net: Added SetSteeringEBPF method for NetClientState. net/tap: Added TUNSETSTEERINGEBPF code. Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-06-04virtio-net: Added eBPF RSS to virtio-net.Andrew Melnychenko2-3/+116
When RSS is enabled the device tries to load the eBPF program to select RX virtqueue in the TUN. If eBPF can be loaded the RSS will function also with vhost (works with kernel 5.8 and later). Software RSS is used as a fallback with vhost=off when eBPF can't be loaded or when hash population requested by the guest. Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com> Signed-off-by: Andrew Melnychenko <andrew@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-06-02docs: fix references to docs/devel/tracing.rstStefano Garzarella1-1/+1
Commit e50caf4a5c ("tracing: convert documentation to rST") converted docs/devel/tracing.txt to docs/devel/tracing.rst. We still have several references to the old file, so let's fix them with the following command: sed -i s/tracing.txt/tracing.rst/ $(git grep -l docs/devel/tracing.txt) Signed-off-by: Stefano Garzarella <sgarzare@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210517151702.109066-2-sgarzare@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2021-05-28Merge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into ↵Peter Maydell3-5/+6
staging # gpg: Signature made Thu 27 May 2021 04:06:17 BST # gpg: using RSA key EF04965B398D6211 # gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>" [marginal] # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 215D 46F4 8246 689E C77F 3562 EF04 965B 398D 6211 * remotes/jasowang/tags/net-pull-request: tap-bsd: Remove special casing for older OpenBSD releases virtio-net: failover: add missing remove_migration_state_change_notifier() hw/net/imx_fec: return 0xffff when accessing non-existing PHY Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-05-27virtio-net: failover: add missing remove_migration_state_change_notifier()Laurent Vivier1-0/+1
In the failover case configuration, virtio_net_device_realize() uses an add_migration_state_change_notifier() to add a state notifier, but this notifier is not removed by the unrealize function when the virtio-net card is unplugged. If the card is unplugged and a migration is started, the notifier is called and as it is not valid anymore QEMU crashes. This patch fixes the problem by adding the remove_migration_state_change_notifier() in virtio_net_device_unrealize(). The problem can be reproduced with: $ qemu-system-x86_64 -enable-kvm -m 1g -M q35 \ -device pcie-root-port,slot=4,id=root1 \ -device pcie-root-port,slot=5,id=root2 \ -device virtio-net-pci,id=net1,mac=52:54:00:6f:55:cc,failover=on,bus=root1 \ -monitor stdio disk.qcow2 (qemu) device_del net1 (qemu) migrate "exec:gzip -c > STATEFILE.gz" Thread 1 "qemu-system-x86" received signal SIGSEGV, Segmentation fault. 0x0000000000000000 in ?? () (gdb) bt #0 0x0000000000000000 in () #1 0x0000555555d726d7 in notifier_list_notify (...) at .../util/notify.c:39 #2 0x0000555555842c1a in migrate_fd_connect (...) at .../migration/migration.c:3975 #3 0x0000555555950f7d in migration_channel_connect (...) error@entry=0x0) at .../migration/channel.c:107 #4 0x0000555555910922 in exec_start_outgoing_migration (...) at .../migration/exec.c:42 Reported-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Laurent Vivier <lvivier@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-05-27hw/net/imx_fec: return 0xffff when accessing non-existing PHYGuenter Roeck2-5/+5
If a PHY does not exist, attempts to read from it should return 0xffff. Otherwise the Linux kernel will believe that a PHY is there and select the non-existing PHY. This in turn will result in network errors later on since the real PHY is not selected or configured. Since reading from or writing to a non-existing PHY is not an emulation error, replace guest error messages with traces. Fixes: 461c51ad4275 ("Add a phy-num property to the i.MX FEC emulator") Cc: Jean-Christophe Dubois <jcd@tribudubois.net> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Tested-by: Bin Meng <bmeng.cn@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-05-16Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell1-1/+1
pc,pci,virtio: bugfixes, improvements Fixes all over the place. Faster boot for virtio. ioeventfd support for mmio. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Fri 14 May 2021 15:27:13 BST # gpg: using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469 # gpg: issuer "mst@redhat.com" # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [full] # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" [full] # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: Fix build with 64 bits time_t vhost-vdpa: Make vhost_vdpa_get_device_id() static hw/virtio: enable ioeventfd configuring for mmio hw/smbios: support for type 41 (onboard devices extended information) checkpatch: Fix use of uninitialized value virtio-scsi: Configure all host notifiers in a single MR transaction virtio-scsi: Set host notifiers and callbacks separately virtio-blk: Configure all host notifiers in a single MR transaction virtio-blk: Fix rollback path in virtio_blk_data_plane_start() pc-dimm: remove unnecessary get_vmstate_memory_region() method amd_iommu: fix wrong MMIO operations virtio-net: Constify VirtIOFeature feature_sizes[] virtio-blk: Constify VirtIOFeature feature_sizes[] hw/virtio: Pass virtio_feature_get_config_size() a const argument x86: acpi: use offset instead of pointer when using build_header() amd_iommu: Fix pte_override_page_mask() Signed-off-by: Peter Maydell <peter.maydell@linaro.org> # Conflicts: # hw/arm/virt.c
2021-05-14virtio-net: Constify VirtIOFeature feature_sizes[]Philippe Mathieu-Daudé1-1/+1
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210511104157.2880306-4-philmd@redhat.com>
2021-05-12Drop the deprecated lm32 targetMarkus Armbruster3-560/+0
Target lm32 was deprecated in commit d8498005122, v5.2.0. See there for rationale. Some of its code lives on in device models derived from milkymist ones: hw/char/digic-uart.c and hw/display/bcm2835_fb.c. Cc: Michael Walle <michael@walle.cc> Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20210503084034.3804963-2-armbru@redhat.com> Acked-by: Michael Walle <michael@walle.cc> [Trivial conflicts resolved, reST markup fixed]
2021-05-02Do not include exec/address-spaces.h if it's not really necessaryThomas Huth1-1/+0
Stop including exec/address-spaces.h in files that don't need it. Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <20210416171314.2074665-5-thuth@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-05-02Do not include cpu.h if it's not really necessaryThomas Huth1-1/+0
Stop including cpu.h in files that don't need it. Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <20210416171314.2074665-4-thuth@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-05-02Do not include sysemu/sysemu.h if it's not really necessaryThomas Huth3-3/+0
Stop including sysemu/sysemu.h in files that don't need it. Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <20210416171314.2074665-2-thuth@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-05-02hw: Do not include qemu/log.h if it is not necessaryThomas Huth1-1/+0
Many files include qemu/log.h without needing it. Remove the superfluous include statements. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20210328054833.2351597-1-thuth@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-04-08Revert "net: Move NetClientState.info_str to dynamic allocations"Jason Wang1-2/+3
Several issues has been reported for query-netdev info series. Consider it's late in the rc, this reverts commit commit 59b5437eb732d6b103a9bc279c3482c834d1eff9. Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-03-31hw/net: fsl_etsec: Tx padding length should exclude CRCBin Meng1-1/+1
As the comment of tx_padding_and_crc() says: "Never add CRC in QEMU", min_frame_len should excluce CRC, so it should be 60 instead of 64. Signed-off-by: Bin Meng <bmeng.cn@gmail.com> Message-Id: <20210316081505.72898-1-bmeng.cn@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-03-30net/npcm7xx_emc.c: Fix handling of receiving packets when RSDR not setDoug Evans1-1/+3
Turning REG_MCMDR_RXON is enough to start receiving packets. Signed-off-by: Doug Evans <dje@google.com> Message-id: 20210319195044.741821-1-dje@google.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-03-22hw/net: virtio-net: Initialize nc->do_not_pad to trueBin Meng1-0/+4
For virtio-net, there is no need to pad the Ethernet frame size to 60 bytes before sending to it. Signed-off-by: Bin Meng <bmeng.cn@gmail.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-03-15net: Move NetClientState.info_str to dynamic allocationsAlexey Kirillov1-3/+2
The info_str field of the NetClientState structure is static and has a size of 256 bytes. This amount is often unclaimed, and the field itself is used exclusively for HMP "info network". The patch translates info_str to dynamic memory allocation. This action is also allows us to painlessly discard usage of this field for backend devices. Signed-off-by: Alexey Kirillov <lekiravi@yandex-team.ru> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-03-15lan9118: switch to use qemu_receive_packet() for loopbackAlexander Bulekov1-1/+1
This patch switches to use qemu_receive_packet() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-03-15cadence_gem: switch to use qemu_receive_packet() for loopbackAlexander Bulekov1-2/+2
This patch switches to use qemu_receive_packet() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-03-15pcnet: switch to use qemu_receive_packet() for loopbackAlexander Bulekov1-1/+1
This patch switches to use qemu_receive_packet() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Buglink: https://bugs.launchpad.net/qemu/+bug/1917085 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-03-15rtl8139: switch to use qemu_receive_packet() for loopbackAlexander Bulekov1-1/+1
This patch switches to use qemu_receive_packet() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Buglink: https://bugs.launchpad.net/qemu/+bug/1910826 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-03-15tx_pkt: switch to use qemu_receive_packet_iov() for loopbackJason Wang1-1/+1
This patch switches to use qemu_receive_receive_iov() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-03-15sungem: switch to use qemu_receive_packet() for loopbackJason Wang1-1/+1
This patch switches to use qemu_receive_packet() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-03-15msf2-mac: switch to use qemu_receive_packet() for loopbackJason Wang1-1/+1
This patch switches to use qemu_receive_packet() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
generated by cgit v1.1 at 2024-11-02 23:42:19 +0000