aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)AuthorFilesLines
2015-08-04rtl8139: check TCP Data Offset field (CVE-2015-5165)Stefan Hajnoczi1-0/+5
The TCP Data Offset field contains the length of the header. Make sure it is valid and does not exceed the IP data length. Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 8357946b15f0a31f73dd691b7da95f29318ed310) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-08-04rtl8139: skip offload on short TCP header (CVE-2015-5165)Stefan Hajnoczi1-0/+5
TCP Large Segment Offload accesses the TCP header in the packet. If the packet is too short we must not attempt to access header fields: tcp_header *p_tcp_hdr = (tcp_header*)(eth_payload_data + hlen); int tcp_hlen = TCP_HEADER_DATA_OFFSET(p_tcp_hdr); Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 4240be45632db7831129f124bcf53c1223825b0f) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-08-04rtl8139: check IP Total Length field (CVE-2015-5165)Stefan Hajnoczi1-1/+6
The IP Total Length field includes the IP header and data. Make sure it is valid and does not exceed the Ethernet payload size. Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit c6296ea88df040054ccd781f3945fe103f8c7c17) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-08-04rtl8139: check IP Header Length field (CVE-2015-5165)Stefan Hajnoczi1-11/+8
The IP Header Length field was only checked in the IP checksum case, but is used in other cases too. Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 03247d43c577dfea8181cd40177ad5ba77c8db76) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-08-04rtl8139: skip offload on short Ethernet/IP header (CVE-2015-5165)Stefan Hajnoczi1-0/+5
Transmit offload features access Ethernet and IP headers the packet. If the packet is too short we must not attempt to access header fields: int proto = be16_to_cpu(*(uint16_t *)(saved_buffer + 12)); ... eth_payload_data = saved_buffer + ETH_HLEN; ... ip = (ip_header*)eth_payload_data; if (IP_HEADER_VERSION(ip) != IP_HEADER_VERSION_4) { Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit e1c120a9c54872f8a538ff9129d928de4e865cbd) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-08-04rtl8139: drop tautologous if (ip) {...} statement (CVE-2015-5165)Stefan Hajnoczi1-154/+151
The previous patch stopped using the ip pointer as an indicator that the IP header is present. When we reach the if (ip) {...} statement we know ip is always non-NULL. Remove the if statement to reduce nesting. Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit d6812d60e7932de3cd0f602c0ee63dd3d09f1847) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-08-04rtl8139: avoid nested ifs in IP header parsing (CVE-2015-5165)Stefan Hajnoczi1-19/+22
Transmit offload needs to parse packet headers. If header fields have unexpected values the offload processing is skipped. The code currently uses nested ifs because there is relatively little input validation. The next patches will add missing input validation and a goto label is more appropriate to avoid deep if statement nesting. Reported-by: 朱东海(启路) <donghai.zdh@alibaba-inc.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit 39b8e7dcaf04cbdb926b478f825b160d852752b5) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-08-04Fix release_drive on unplugged devices (pci_piix3_xen_ide_unplug)Stefano Stabellini1-0/+7
pci_piix3_xen_ide_unplug should completely unhook the unplugged IDEDevice from the corresponding BlockBackend, otherwise the next call to release_drive will try to detach the drive again. Suggested-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> (cherry picked from commit 6cd387833d05e8ad31829d97e474dc420625aed9) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29ide: Clear DRQ after handling all expected accessesKevin Wolf1-4/+12
This is additional hardening against an end_transfer_func that fails to clear the DRQ status bit. The bit must be unset as soon as the PIO transfer has completed, so it's better to do this in a central place instead of duplicating the code in all commands (and forgetting it in some). Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> (cherry picked from commit cb72cba83021fa42719e73a5249c12096a4d1cfc) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29ide/atapi: Fix START STOP UNIT command completionKevin Wolf1-0/+1
The command must be completed on all code paths. START STOP UNIT with pwrcnd set should succeed without doing anything. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> (cherry picked from commit 03441c3a4a42beb25460dd11592539030337d0f8) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29ide: Check array bounds before writing to io_buffer (CVE-2015-5154)Kevin Wolf1-0/+16
If the end_transfer_func of a command is called because enough data has been read or written for the current PIO transfer, and it fails to correctly call the command completion functions, the DRQ bit in the status register and s->end_transfer_func may remain set. This allows the guest to access further bytes in s->io_buffer beyond s->data_end, and eventually overflowing the io_buffer. One case where this currently happens is emulation of the ATAPI command START STOP UNIT. This patch fixes the problem by adding explicit array bounds checks before accessing the buffer instead of relying on end_transfer_func to function correctly. Cc: qemu-stable@nongnu.org Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> (cherry picked from commit d2ff85854512574e7209f295e87b0835d5b032c6) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29scsi: fix buffer overflow in scsi_req_parse_cdb (CVE-2015-5158)Paolo Bonzini1-1/+6
This is a guest-triggerable buffer overflow present in QEMU 2.2.0 and newer. scsi_cdb_length returns -1 as an error value, but the caller does not check it. Luckily, the massive overflow means that QEMU will just SIGSEGV, making the impact much smaller. Reported-by: Zhu Donghai (朱东海) <donghai.zdh@alibaba-inc.com> Fixes: 1894df02811f6b79ea3ffbf1084599d96f316173 Reviewed-by: Fam Zheng <famz@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit c170aad8b057223b1139d72e5ce7acceafab4fa9) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29vfio/pci: Fix bootindexAlex Williamson1-1/+0
bootindex was incorrectly changed to a device Property during the platform code split, resulting in it no longer working. Remove it. Signed-off-by: Alex Williamson <alex.williamson@redhat.com> Cc: qemu-stable@nongnu.org # v2.3+ (cherry picked from commit 759b484c5d7f92bd01f98797c07e8543ee187888) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29virtio-net: unbreak any layoutJason Wang1-5/+18
Commit 032a74a1c0fcdd5fd1c69e56126b4c857ee36611 ("virtio-net: byteswap virtio-net header") breaks any layout by requiring out_sg[0].iov_len >= n->guest_hdr_len. Fixing this by copying header to temporary buffer if swap is needed, and then use this buffer as part of out_sg. Fixes 032a74a1c0fcdd5fd1c69e56126b4c857ee36611 ("virtio-net: byteswap virtio-net header") Cc: qemu-stable@nongnu.org Cc: clg@fr.ibm.com Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> (cherry picked from commit feb93f361739071778ca2d23df3876db399548f7) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29vfio/pci: Fix RTL8168 NIC quirksAlex Williamson1-4/+5
The RTL8168 quirk correctly describes using bit 31 as a signal to mark a latch/completion, but the code mistakenly uses bit 28. This causes the Realtek driver to spin on this register for quite a while, 20k cycles on Windows 7 v7.092 driver. Then it gets frustrated and tries to set the bit itself and spins for another 20k cycles. For some this still results in a working driver, for others not. About the only thing the code really does in its current form is protect the guest from sneaking in writes to the real hardware MSI-X table. The fix is obviously to use bit 31 as we document that we should. The other problem doesn't seem to affect current drivers as nobody seems to use these window registers for writes to the MSI-X table, but we need to use the stored data when a write is triggered, not the value of the current write, which only provides the offset. Note that only the Windows drivers from Realtek seem to use these registers, the Microsoft drivers provided with Windows 8.1 do not access them, nor do Linux in-kernel drivers. Link: https://bugs.launchpad.net/qemu/+bug/1384892 Signed-off-by: Alex Williamson <alex.williamson@redhat.com> Cc: qemu-stable@nongnu.org # v2.1+ (cherry picked from commit 69970fcef937bddd7f745efe39501c7716fdfe56) Conflicts: hw/vfio/pci.c * removed dependency on 3b643495 Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29spapr_vty: lookup should only return valid VTY objectsDavid Gibson1-0/+4
If a guest passes the reg property of a valid VIO object that is not a VTY to either H_GET_TERM_CHAR or H_PUT_TERM_CHAR, QEMU hits a dynamic cast assertion and aborts. PAPR+ says "Hypervisor checks the termno parameter for validity against the Vterm IOA unit addresses assigned to the partition, else return H_Parameter." This patch adds a type check to ensure vty_lookup() either returns a pointer to a valid VTY object or NULL. H_GET_TERM_CHAR and H_PUT_TERM_CHAR will now return H_PARAMETER to the guest instead of crashing. The patch has no effect on the reg == 0 hack used to implement the RTAS call display-character. Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alexander Graf <agraf@suse.de> (cherry picked from commit 0f888bfaddfc5f55b0d82cde2e1164658a672375) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29s390x/ipl: Fix boot if no bootindex was specifiedChristian Borntraeger1-2/+2
commit fa92e218df1d ("s390x/ipl: avoid sign extension") introduced a regression: qemu-system-s390x -drive file=image.qcow,format=qcow2 does not boot, the bios states "No virtio-blk device found!" adding bootindex=1 does boot. The reason is that the uint32_t as return value will not do the right thing for the return -1 (default without bootindex). The bios itself, will interpret a 64bit -1 as autodetect (but it will interpret 32bit -1 as ccw device address ff.ff.ffff) Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Cornelia Huck <cornelia.huck@de.ibm.com> Cc: qemu-stable@nongnu.org # v2.3.0 Tested-by: Aurelien Jarno <aurelien@aurel32.net> Reviewed-by: Aurelien Jarno <aurelien@aurel32.net> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com> (cherry picked from commit 6efd2c2a125b4369b8def585b0dac35c849b5eb3) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29virtio-ccw: complete handling of guest-initiated resetsCornelia Huck1-17/+22
For a guest-initiated reset, we need to not only reset the virtio device, but also reset the VirtioCcwDevice into a clean state. This includes resetting the indicators, or else a guest will not be able to e.g. switch from classic interrupts to adapter interrupts. Split off this routine into a new function virtio_ccw_reset_virtio() to make the distinction between resetting the virtio-related devices and the base subchannel device clear. CC: qemu-stable@nongnu.org Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com> Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com> (cherry picked from commit fa8b0ca5d1b69975b715a259d3586cadf7a5280f) Conflicts: hw/s390x/virtio-ccw.c *removed context dependency on 0b352fd Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29vhost: correctly pass error to caller in vhost_dev_enable_notifiers()Jason Wang1-4/+4
We override the error value r in fail_vq, this will cause the caller can't detect the failure which may cause the caller may disable the notifiers twice if vhost is failed to start. Fix this by using another variable to keep track the return value of set_host_notifier(). Fixes b0b3db79559e57db340b292621c397e7a6cdbdc5 ("vhost-net: cleanup host notifiers at last step") Cc: qemu-stable@nongnu.org Cc: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit 16617e36b02ebdc83f215d89db9ac00f7d6d6d83) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29hw/core: rebase sysbus_get_fw_dev_path() to g_strdup_printf()Laszlo Ersek1-10/+6
This is done mainly for improving readability, and in preparation for the next patch, but Markus pointed out another bonus for the string being returned: "No arbitrary length limit. Before the patch, it's 39 characters, and the code breaks catastrophically when qdev_fw_name() is longer: the second snprintf() is called with its first argument pointing beyond path[], and its second argument underflowing to a huge size." Cc: qemu-stable@nongnu.org Signed-off-by: Laszlo Ersek <lersek@redhat.com> Tested-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit 5ba03e2dd785362026917e4cc8a1fd2c64e8e62c) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29i8254: fix out-of-bounds memory access in pit_ioport_read()Petr Matousek1-0/+6
Due converting PIO to the new memory read/write api we no longer provide separate I/O region lenghts for read and write operations. As a result, reading from PIT Mode/Command register will end with accessing pit->channels with invalid index. Fix this by ignoring read from the Mode/Command register. This is CVE-2015-3214. Reported-by: Matt Tait <matttait@google.com> Fixes: 0505bcdec8228d8de39ab1a02644e71999e7c052 Cc: qemu-stable@nongnu.org Signed-off-by: Petr Matousek <pmatouse@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit d4862a87e31a51de9eb260f25c9e99a75efe3235) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-29hw/acpi/aml-build: Fix memory leakShannon Zhao1-0/+1
Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> (cherry picked from commit afcf905cff7971324c2706600ead35a1f41f417a) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-28fdc: force the fifo access to be in bounds of the allocated bufferPetr Matousek1-6/+11
During processing of certain commands such as FD_CMD_READ_ID and FD_CMD_DRIVE_SPECIFICATION_COMMAND the fifo memory access could get out of bounds leading to memory corruption with values coming from the guest. Fix this by making sure that the index is always bounded by the allocated memory. This is CVE-2015-3456. Signed-off-by: Petr Matousek <pmatouse@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com> (cherry picked from commit e907746266721f305d67bc0718795fedee2e824c) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-28virtio-net: fix the upper bound when trying to delete queuesJason Wang1-1/+1
Virtqueue were indexed from zero, so don't delete virtqueue whose index is n->max_queues * 2 + 1. Cc: Michael S. Tsirkin <mst@redhat.com> Cc: qemu-stable <qemu-stable@nongnu.org> Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit 27a46dcf5038e20451101ed2d5414aebf3846e27) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-28usb: fix usb-net segfaultMichal Kazior1-0/+4
The dev->config pointer isn't set until guest system initializes usb devices (via usb_desc_set_config). However qemu networking can go through some motions prior to that, e.g.: #0 is_rndis (s=0x555557261970) at hw/usb/dev-network.c:653 #1 0x000055555585f723 in usbnet_can_receive (nc=0x55555641e820) at hw/usb/dev-network.c:1315 #2 0x000055555587635e in qemu_can_send_packet (sender=0x5555572660a0) at net/net.c:470 #3 0x0000555555878e34 in net_hub_port_can_receive (nc=0x5555562d7800) at net/hub.c:101 #4 0x000055555587635e in qemu_can_send_packet (sender=0x5555562d7980) at net/net.c:470 #5 0x000055555587dbca in tap_can_send (opaque=0x5555562d7980) at net/tap.c:172 The command to reproduce most reliably was: qemu-system-i386 -usb -device usb-net,vlan=0 -net tap,vlan=0 This wasn't strictly a problem with tap. Other networking endpoints (vde, user) could trigger this problem as well. Fixes: https://bugs.launchpad.net/qemu/+bug/1050823 Cc: qemu-stable@nongnu.org Signed-off-by: Michal Kazior <michal.kazior@tieto.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit 278412d0e710e2e848c6e510f8308e5b1ed4d03e) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-07-28bt-sdp: fix broken uuids power-of-2 calculationStefan Hajnoczi1-1/+1
The binary search in sdp_uuid_match() only works when the number of elements to search is a power of two. lo = record->uuid; hi = record->uuids; while (hi >>= 1) if (lo[hi] <= val) lo += hi; return *lo == val; I noticed that the record->uuids calculation in sdp_service_record_build() was suspect: record->uuids = 1 << ffs(record->uuids - 1); Unlike most ffs(val) - 1 users, the expression is ffs(val - 1)! Actually ffs() is the wrong function to use for power-of-2. Use pow2ceil() to achieve the correct effect. Now the record->uuid[] array is sized correctly and the binary search in sdp_uuid_match() should work. I'm not sure how to run/test this code. Cc: Andrzej Zaborowski <balrog@zabor.org> Cc: qemu-stable@nongnu.org Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 1427124571-28598-2-git-send-email-stefanha@redhat.com Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit 588ef9d411339012fc3c94bfad8911e9d0a517a2) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2015-04-20vhost: fix log base addressMichael S. Tsirkin1-2/+5
VHOST_SET_LOG_BASE got an incorrect address, causing migration errors and potentially even memory corruption. Reported-by: Wen Congyang <wency@cn.fujitsu.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Amos Kong <akong@redhat.com> Message-id: 1429283565-32265-1-git-send-email-mst@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-04-17mips: fix broken fulong2e machinePaolo Bonzini1-2/+2
After commit 5312bd8 the bonito_readl() and bonito_writel() have been accessing incorrect addresses. Consequently QEMU is crashing when trying to boot Linux kernel on fulong2e machine. Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
2015-04-13pci: Fix crash with illegal "-net nic, model=xxx" optionThomas Huth1-1/+3
Current QEMU crashes when specifying an illegal model with the "-net nic,model=xxx" option, e.g.: $ qemu-system-x86_64 -net nic,model=n/a qemu-system-x86_64: Unsupported NIC model: n/a Program received signal SIGSEGV, Segmentation fault. The gdb backtrace looks like this: 0x0000555555965fe0 in error_get_pretty (err=0x0) at util/error.c:152 152 return err->msg; (gdb) bt 0 0x0000555555965fe0 in error_get_pretty (err=0x0) at util/error.c:152 1 0x0000555555965ffd in error_report_err (err=0x0) at util/error.c:157 2 0x0000555555809c90 in pci_nic_init_nofail (nd=0x555555e49860 <nd_table>, rootbus=0x5555564409b0, default_model=0x55555598c37b "e1000", default_devaddr=0x0) at hw/pci/pci.c:1663 3 0x0000555555691e42 in pc_nic_init (isa_bus=0x555556f71900, pci_bus=0x5555564409b0) at hw/i386/pc.c:1506 4 0x000055555569396b in pc_init1 (machine=0x5555562abbf0, pci_enabled=1, kvmclock_enabled=1) at hw/i386/pc_piix.c:248 5 0x0000555555693d27 in pc_init_pci (machine=0x5555562abbf0) at hw/i386/pc_piix.c:310 6 0x000055555572ddf5 in main (argc=3, argv=0x7fffffffe018, envp=0x7fffffffe038) at vl.c:4226 The problem is that pci_nic_init_nofail() does not check whether the err parameter from pci_nic_init has been set up and thus passes a NULL pointer to error_report_err(). Fix it by correctly checking the err parameter. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-04-11cris: memory: Replace memory_region_init_ram with ↵Dirk Müller1-3/+2
memory_region_allocate_system_memory Commit 0b183fc871:"memory: move mem_path handling to memory_region_allocate_system_memory" split memory_region_init_ram and memory_region_init_ram_from_file. Also it moved mem-path handling a step up from memory_region_init_ram to memory_region_allocate_system_memory. Therefore for any board that uses memory_region_init_ram directly, -mem-path is not supported. Fix this by replacing memory_region_init_ram with memory_region_allocate_system_memory. Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Cc: Edgar E. Iglesias <edgar.iglesias@gmail.com> Signed-off-by: Dirk Mueller <dmueller@suse.com> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
2015-04-10alpha: memory: Replace memory_region_init_ram with ↵Dirk Müller1-3/+2
memory_region_allocate_system_memory Commit 0b183fc871:"memory: move mem_path handling to memory_region_allocate_system_memory" split memory_region_init_ram and memory_region_init_ram_from_file. Also it moved mem-path handling a step up from memory_region_init_ram to memory_region_allocate_system_memory. Therefore for any board that uses memory_region_init_ram directly, -mem-path is not supported. Fix this by replacing memory_region_init_ram with memory_region_allocate_system_memory. Cc: Richard Henderson <rth@twiddle.net> Signed-off-by: Dirk Mueller <dmueller@suse.com> Acked-by: Richard Henderson <rth@twiddle.net> Message-id: CAL5wTH64_ykF17cw2T1Axq8P3vCWm=6WbUJ3qJrLF-u+-MmzUw@mail.gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-04-10lm32: memory: Replace memory_region_init_ram with ↵Dirk Müller2-9/+6
memory_region_allocate_system_memory Commit 0b183fc871:"memory: move mem_path handling to memory_region_allocate_system_memory" split memory_region_init_ram and memory_region_init_ram_from_file. Also it moved mem-path handling a step up from memory_region_init_ram to memory_region_allocate_system_memory. Therefore for any board that uses memory_region_init_ram directly, -mem-path is not supported. Fix this by replacing memory_region_init_ram with memory_region_allocate_system_memory. Cc: Michael Walle <michael@walle.cc> Signed-off-by: Dirk Mueller <dmueller@suse.com> Acked-by: Michael Walle <michael@walle.cc> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-04-09xen: limit guest control of PCI command registerJan Beulich2-27/+13
Otherwise the guest can abuse that control to cause e.g. PCIe Unsupported Request responses (by disabling memory and/or I/O decoding and subsequently causing [CPU side] accesses to the respective address ranges), which (depending on system configuration) may be fatal to the host. This is CVE-2015-2756 / XSA-126. Signed-off-by: Jan Beulich <jbeulich@suse.com> Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> Message-id: alpine.DEB.2.02.1503311510300.7690@kaball.uk.xensource.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-04-09Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into ↵Peter Maydell2-3/+13
staging # gpg: Signature made Thu Apr 9 10:55:11 2015 BST using RSA key ID 81AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" * remotes/stefanha/tags/block-pull-request: block/iscsi: handle zero events from iscsi_which_events aio: strengthen memory barriers for bottom half scheduling virtio-blk: correctly dirty guest memory qcow2: Fix header update with overridden backing file Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-04-08arm: memory: Replace memory_region_init_ram with ↵Dirk Müller13-37/+30
memory_region_allocate_system_memory Commit 0b183fc871:"memory: move mem_path handling to memory_region_allocate_system_memory" split memory_region_init_ram and memory_region_init_ram_from_file. Also it moved mem-path handling a step up from memory_region_init_ram to memory_region_allocate_system_memory. Therefore for any board that uses memory_region_init_ram directly, -mem-path is not supported. Fix this by replacing memory_region_init_ram with memory_region_allocate_system_memory. Signed-off-by: Dirk Mueller <dmueller@suse.com> Message-id: CAL5wTH4UHYKpJF=dLJfFzxpufjY189chnCow47-ySuLf8GLbug@mail.gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-04-08virtio-blk: correctly dirty guest memoryPaolo Bonzini2-3/+13
After qemu_iovec_destroy, the QEMUIOVector's size is zeroed and the zero size ultimately is used to compute virtqueue_push's len argument. Therefore, reads from virtio-blk devices did not migrate their results correctly. (Writes were okay). Save the size in virtio_blk_handle_request, and use it when the request is completed. Based on a patch by Wen Congyang. Signed-off-by: Wen Congyang <wency@cn.fujitsu.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Tested-by: Li Zhijian <lizhijian@cn.fujitsu.com> Message-id: 1427997044-392-1-git-send-email-pbonzini@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2015-04-04pcspk: Fix I/O port nameJan Kiszka1-1/+1
Probably a copy&paste bug. Fixing it helps identifying the device model behind port 0x61. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Reviewed-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-04-02Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell1-2/+6
Another round of small fixes. I am not including the virtio-blk fix, because Wen only posted a prototype and the changes I made were pretty large. It definitely needs another pair of eyes (but it is a 2.3 regression and a blocker). # gpg: Signature made Thu Apr 2 14:59:56 2015 BST using RSA key ID 78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: Use $(MAKE) for recursive make kvm-all: Sync dirty-bitmap from kvm before kvm destroy the corresponding dirty_bitmap util/qemu-config: fix regression of qmp_query_command_line_options target-i386: clear bsp bit when designating bsp qga: fitering out -fstack-protector-strong target-i386: save 64-bit CR3 in 64-bit SMM state save area Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-04-02target-i386: clear bsp bit when designating bspNadav Amit1-2/+6
Since the BSP bit is writable on real hardware, during reset all the CPUs which were not chosen to be the BSP should have their BSP bit cleared. This fix is required for KVM to work correctly when it changes the BSP bit. An additional fix is required for QEMU tcg to allow software to change the BSP bit. Signed-off-by: Nadav Amit <namit@cs.technion.ac.il> Message-Id: <1427932716-11800-1-git-send-email-namit@cs.technion.ac.il> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-04-02Merge remote-tracking branch 'remotes/armbru/tags/pull-hw-2015-04-02' into ↵Peter Maydell17-0/+49
staging hw: Contain drive, serial, parallel, net misuse # gpg: Signature made Thu Apr 2 14:32:00 2015 BST using RSA key ID EB918653 # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" * remotes/armbru/tags/pull-hw-2015-04-02: sysbus: Make devices picking up backends unavailable with -device sdhci: Make device "sdhci-pci" unavailable with -device hw: Mark device misusing nd_table[] FIXME hw: Mark devices picking up char backends actively FIXME hw: Mark devices picking up block backends actively FIXME Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-04-02sysbus: Make devices picking up backends unavailable with -deviceMarkus Armbruster13-0/+26
Device models aren't supposed to go on fishing expeditions for backends. They should expose suitable properties for the user to set. For onboard devices, board code sets them. A number of sysbus devices pick up block backends in their init() / instance_init() methods with drive_get_next() instead: sl-nand, milkymist-memcard, pl181, generic-sdhci. Likewise, a number of sysbus devices pick up character backends in their init() / realize() methods with qemu_char_get_next_serial(): cadence_uart, digic-uart, etraxfs,serial, lm32-juart, lm32-uart, milkymist-uart, pl011, stm32f2xx-usart, xlnx.xps-uartlite. All these mistakes are already marked FIXME. See the commit that added these FIXMEs for a more detailed explanation of what's wrong. Fortunately, only machines ppce500 and pseries-* support -device with sysbus devices, and none of the devices above is supported with these machines. Set cannot_instantiate_with_device_add_yet to preserve our luck. Cc: Andrzej Zaborowski <balrogg@gmail.com> Cc: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Cc: Antony Pavlov <antonynpavlov@gmail.com> Cc: "Edgar E. Iglesias" <edgar.iglesias@gmail.com> Cc: Michael Walle <michael@walle.cc> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2015-04-02sdhci: Make device "sdhci-pci" unavailable with -deviceMarkus Armbruster1-0/+2
Device models aren't supposed to go on fishing expeditions for backends. They should expose suitable properties for the user to set. For onboard devices, board code sets them. "sdhci-pci" picks up its block backend in its realize() method with drive_get_next() instead. Already marked FIXME. See the commit that added the FIXME for a more detailed explanation of what's wrong. We can't fix this in time for the release, but since the device is new in 2.3, we can set cannot_instantiate_with_device_add_yet to disable it before this mistake becomes ABI, and we have to support command lines like $ qemu -drive if=sd -drive if=sd,file=sd.img -device sdhci-pci -device sdhci-pci forever. Signed-off-by: Markus Armbruster <armbru@redhat.com>
2015-04-02hw: Mark device misusing nd_table[] FIXMEMarkus Armbruster1-0/+1
NICs defined with -net nic are for board initialization to wire up. Board code examines nd_table[] to find them, and creates devices with their qdev NIC properties set accordingly. Except "allwinner-a10" goes on a fishing expedition for NIC configuration instead of exposing the usual NIC properties for board code to set: it uses nd_table[0] in its instance_init() method. Picking up the first -net nic option's configuration that way works when the device is created by board code. But it's inappropriate for -device and device_add. Not only is it inconsistent with how the other block device models work (they get their configuration from properties "mac", "vlan", "netdev"), it breaks when nd_table[0] has been picked up by the board or a previous -device / device_add already. Example: $ qemu-system-arm -S -M cubieboard -device allwinner-a10 qemu-system-arm: -device allwinner-a10: Property 'allwinner-emac.netdev' can't take value 'hub0port0', it's in use Aborted (core dumped) It also breaks in other entertaining ways: $ qemu-system-arm -M highbank -device allwinner-a10 qemu-system-arm: -device allwinner-a10: Unsupported NIC model: xgmac $ qemu-system-arm -M highbank -net nic,model=allwinner-emac -device allwinner-a10 qemu-system-arm: Unsupported NIC model: allwinner-emac Mark the mistake with a FIXME comment. Cc: Li Guang <lig.fnst@cn.fujitsu.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2015-04-02hw: Mark devices picking up char backends actively FIXMEMarkus Armbruster11-0/+12
Character devices defined with -serial and -parallel are for board initialization to wire up. Board code examines serial_hds[] and parallel_hds[] to find them, and creates devices with their qdev chardev properties set accordingly. Except a few devices go on a fishing expedition for a suitable backend instead of exposing a chardev property for board code to set: they use serial_hds[] (often via qemu_char_get_next_serial()) or parallel_hds[] in their realize() or init() method to connect to a backend. Picking up backends that way works when the devices are created by board code. But it's inappropriate for -device or device_add. Not only is it inconsistent with how the other characrer device models work (they connect to a backend explicitly identified by a "chardev" property), it breaks when the backend has been picked up by the board or a previous -device / device_add already. Example: $ qemu-system-ppc64 -M bamboo -S -device i82378 -device pc87312 -device pc87312 qemu-system-ppc64: -device pc87312: Property 'isa-parallel.chardev' can't take value 'parallel0', it's in use Mark them with suitable FIXME comments. Cc: Li Guang <lig.fnst@cn.fujitsu.com> Cc: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Cc: Antony Pavlov <antonynpavlov@gmail.com> Cc: "Edgar E. Iglesias" <edgar.iglesias@gmail.com> Cc: Michael Walle <michael@walle.cc> Cc: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Cc: "Andreas Färber" <andreas.faerber@web.de> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2015-04-02hw: Mark devices picking up block backends actively FIXMEMarkus Armbruster7-0/+8
Drives defined with if!=none are for board initialization to wire up. Board code calls drive_get() or similar to find them, and creates devices with their qdev drive properties set accordingly. Except a few devices go on a fishing expedition for a suitable backend instead of exposing a drive property for board code to set: they call driver_get() or drive_get_next() in their realize() or init() method to implicitly connect to the "next" backend with a certain interface type. Picking up backends that way works when the devices are created by board code. But it's inappropriate for -device or device_add. Not only is this inconsistent with how the other block device models work (they connect to a backend explicitly identified by a "drive" property), it breaks when the "next" backend has been picked up by the board already. Example: $ qemu-system-arm -S -M connex -pflash flash.img -device ssi-sd Aborted (core dumped) Mark them with suitable FIXME comments. Cc: Andrzej Zaborowski <balrogg@gmail.com> Cc: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Cc: "Andreas Färber" <andreas.faerber@web.de> Cc: Michael Walle <michael@walle.cc> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2015-04-02hw/arm/vexpress: Don't double-free flash filenamePeter Maydell1-1/+0
Commits 6e05a12f8f7f and db25a1581 both attempt to fix the same "failed to free memory containing flash filename" bug, with the effect that when they were both applied we ended up freeing the memory twice. Delete the spurious extra free. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Stefan Weil <sw@weilnetz.de> Message-id: 1427968334-14527-1-git-send-email-peter.maydell@linaro.org
2015-04-02hw/arm/virt: Fix corruption due to double freeShannon Zhao1-1/+0
As 4de9a88(hw/arm/virt: Fix memory leak reported by Coverity) and 6e05a12(arm: fix memory leak) both handle the memory leak reported by Coverity, this cause qemu corruption due to double free. Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Reviewed-by: Stefan Weil <sw@weilnetz.de> Message-id: 1427944026-8968-1-git-send-email-zhaoshenglong@huawei.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-04-01hw/intc: arm_gic_kvm.c restore config firstAlex Bennée1-2/+5
As there is logic to deal with the difference between edge and level triggered interrupts in the kernel we must ensure it knows the configuration of the IRQs before we restore the pending state. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Acked-by: Christoffer Dall <christoffer.dall@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-04-01hw/arm/virt: Fix memory leak reported by CoverityStefan Weil1-1/+8
As the conditional statement had to be split anyway, we can also add a better error report message. Signed-off-by: Stefan Weil <sw@weilnetz.de> Message-id: 1426877982-3603-1-git-send-email-sw@weilnetz.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-04-01hw/arm/vexpress: Fix memory leak reported by CoverityStefan Weil1-2/+9
As the conditional statement had to be split anyway, we can also add a better error report message. Signed-off-by: Stefan Weil <sw@weilnetz.de> Message-id: 1426877963-3556-1-git-send-email-sw@weilnetz.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
generated by cgit v1.1 at 2025-09-18 08:57:03 +0000