1. 12 5月, 2016 16 次提交
  2. 11 5月, 2016 1 次提交
  3. 09 5月, 2016 2 次提交
  4. 03 5月, 2016 2 次提交
  5. 02 5月, 2016 7 次提交
    • G
      vga: make sure vga register setup for vbe stays intact (CVE-2016-3712). · fd3c136b
      Gerd Hoffmann 提交于
      Call vbe_update_vgaregs() when the guest touches GFX, SEQ or CRT
      registers, to make sure the vga registers will always have the
      values needed by vbe mode.  This makes sure the sanity checks
      applied by vbe_fixup_regs() are effective.
      
      Without this guests can muck with shift_control, can turn on planar
      vga modes or text mode emulation while VBE is active, making qemu
      take code paths meant for CGA compatibility, but with the very
      large display widths and heigts settable using VBE registers.
      
      Which is good for one or another buffer overflow.  Not that
      critical as they typically read overflows happening somewhere
      in the display code.  So guests can DoS by crashing qemu with a
      segfault, but it is probably not possible to break out of the VM.
      
      Fixes: CVE-2016-3712
      Reported-by: NZuozhi Fzz <zuozhi.fzz@alibaba-inc.com>
      Reported-by: NP J P <ppandit@redhat.com>
      Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
      fd3c136b
    • G
      vga: update vga register setup on vbe changes · 2068192d
      Gerd Hoffmann 提交于
      Call the new vbe_update_vgaregs() function on vbe configuration
      changes, to make sure vga registers are up-to-date.
      Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
      2068192d
    • G
      vga: factor out vga register setup · 7fa5c2c5
      Gerd Hoffmann 提交于
      When enabling vbe mode qemu will setup a bunch of vga registers to make
      sure the vga emulation operates in correct mode for a linear
      framebuffer.  Move that code to a separate function so we can call it
      from other places too.
      Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
      7fa5c2c5
    • G
      vga: add vbe_enabled() helper · bfa0f151
      Gerd Hoffmann 提交于
      Makes code a bit easier to read.
      Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
      bfa0f151
    • G
      vga: fix banked access bounds checking (CVE-2016-3710) · 3bf18170
      Gerd Hoffmann 提交于
      vga allows banked access to video memory using the window at 0xa00000
      and it supports a different access modes with different address
      calculations.
      
      The VBE bochs extentions support banked access too, using the
      VBE_DISPI_INDEX_BANK register.  The code tries to take the different
      address calculations into account and applies different limits to
      VBE_DISPI_INDEX_BANK depending on the current access mode.
      
      Which is probably effective in stopping misprogramming by accident.
      But from a security point of view completely useless as an attacker
      can easily change access modes after setting the bank register.
      
      Drop the bogus check, add range checks to vga_mem_{readb,writeb}
      instead.
      
      Fixes: CVE-2016-3710
      Reported-by: NQinghao Tang <luodalongde@gmail.com>
      Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
      3bf18170
    • J
      configure: Check if struct fsxattr is available from linux header · 277abf15
      Jan Vesely 提交于
      Fixes build failure with --enable-xfsctl and
      new linux headers (>=4.5) and older xfsprogs(<4.5):
      In file included from /usr/include/xfs/xfs.h:38:0,
                       from /var/tmp/portage/app-emulation/qemu-2.5.0-r1/work/qemu-2.5.0/block/raw-posix.c:97:
      /usr/include/xfs/xfs_fs.h:42:8: error: redefinition of ‘struct fsxattr’
       struct fsxattr {
              ^
      In file included from /var/tmp/portage/app-emulation/qemu-2.5.0-r1/work/qemu-2.5.0/block/raw-posix.c:60:0:
      /usr/include/linux/fs.h:155:8: note: originally defined here
       struct fsxattr {
      
      This is really a bug in the system headers, but we can work around it
      by defining HAVE_FSXATTR in the QEMU headers if linux/fs.h provides
      the struct, so that xfs_fs.h doesn't try to define it as well.
      
      CC: qemu-trivial@nongnu.org
      CC: Markus Armbruster <armbru@redhat.com>
      CC: Peter Maydell <peter.maydell@linaro.org>
      CC: Stefan Weil <sw@weilnetz.de>
      Tested-by: NStefan Weil <sw@weilnetz.de>
      Signed-off-by: NJan Vesely <jano.vesely@gmail.com>
      [PMM: adjusted commit message, comments]
      Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
      277abf15
    • P
      Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging · 20b0f5fe
      Peter Maydell 提交于
      acpi: last minute fix for 2.6
      
      Minor, obvious fix only affecting BE hosts.
      Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
      
      # gpg: Signature made Sun 01 May 2016 13:43:28 BST using RSA key ID D28D5469
      # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
      # gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"
      
      * remotes/mst/tags/for_upstream:
        acpi: fix bios linker loadder COMMAND_ALLOCATE on bigendian host
      Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
      20b0f5fe
  6. 01 5月, 2016 1 次提交
  7. 29 4月, 2016 6 次提交
  8. 28 4月, 2016 5 次提交
    • P
      Merge remote-tracking branch 'remotes/lalrae/tags/mips-20160428' into staging · 8c4bf975
      Peter Maydell 提交于
      MIPS patches 2016-04-28
      
      Changes:
      * fixed RDHWR exception host PC
      
      # gpg: Signature made Thu 28 Apr 2016 10:11:18 BST using RSA key ID 0B29DA6B
      # gpg: Good signature from "Leon Alrae <leon.alrae@imgtec.com>"
      
      * remotes/lalrae/tags/mips-20160428:
        target-mips: Fix RDHWR exception host PC
      Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
      8c4bf975
    • P
      Merge remote-tracking branch 'remotes/armbru/tags/pull-error-2016-04-28' into staging · 736f85d5
      Peter Maydell 提交于
      Fix dangling pointers and error message regressions
      
      # gpg: Signature made Thu 28 Apr 2016 07:25:51 BST using RSA key ID EB918653
      # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
      # gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"
      
      * remotes/armbru/tags/pull-error-2016-04-28:
        qom: -object error messages lost location, restore it
        replay: Fix dangling location bug in replay_configure()
        QemuOpts: Fix qemu_opts_foreach() dangling location regression
      Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
      736f85d5
    • P
      Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.6-20160426' into staging · 61861eff
      Peter Maydell 提交于
      ppc patch queue for 2016-04-26 (last minute qemu-2.6 fix)
      
      This just has one, last-minute, fix for a serious regression of memory
      hotplug.
      
      Patch author's comment:
          Really sorry for the way last-minute fix, but without this memory
          hotplug is totally broken :( Hoping to get this in for Wednesday's
          RC4, which I think will be the final before release.
      
      # gpg: Signature made Tue 26 Apr 2016 03:52:20 BST using RSA key ID 20D9B392
      # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>"
      # gpg:                 aka "David Gibson (Red Hat) <dgibson@redhat.com>"
      # gpg:                 aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 75F4 6586 AE61 A66C C44E  87DC 6C38 CACA 20D9 B392
      
      * remotes/dgibson/tags/ppc-for-2.6-20160426:
        spapr_drc: fix aborts during DRC-count based hotplug
      Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
      61861eff
    • J
      target-mips: Fix RDHWR exception host PC · d96391c1
      James Hogan 提交于
      Commit b00c7218 ("target-mips: add PC, XNP reg numbers to RDHWR")
      changed the rdhwr helpers to use check_hwrena() to check the register
      being accessed is enabled in CP0_HWREna when used from user mode. If
      that check fails an EXCP_RI exception is raised at the host PC
      calculated with GETPC().
      
      However check_hwrena() may not be fully inlined as the
      do_raise_exception() part of it is common regardless of the arguments.
      This causes GETPC() to calculate the address in the call in the helper
      instead of the generated code calling the helper. No TB will be found
      and the EPC reported with the resulting guest RI exception points to the
      beginning of the TB instead of the RDHWR instruction.
      
      We can't reliably force check_hwrena() to be inlined, and converting it
      to a macro would be ugly, so instead pass the host PC in as an argument,
      with each rdhwr helper passing GETPC(). This should avoid any dependence
      on compiler behaviour, and in practice seems to ensure the full inlining
      of check_hwrena() on x86_64.
      
      This issue causes failures when running a MIPS KVM (trap & emulate)
      guest in a MIPS QEMU TCG guest, as the inner guest kernel will do a
      RDHWR of counter, which is disabled in the outer guest's CP0_HWREna by
      KVM so it can emulate the inner guest's counter. The emulation fails and
      the RI exception is passed to the inner guest.
      
      Fixes: b00c7218 ("target-mips: add PC, XNP reg numbers to RDHWR")
      Signed-off-by: NJames Hogan <james.hogan@imgtec.com>
      Cc: Leon Alrae <leon.alrae@imgtec.com>
      Cc: Yongbok Kim <yongbok.kim@imgtec.com>
      Cc: Aurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: NAurelien Jarno <aurelien@aurel32.net>
      Reviewed-by: NLeon Alrae <leon.alrae@imgtec.com>
      Signed-off-by: NLeon Alrae <leon.alrae@imgtec.com>
      d96391c1
    • M
      qom: -object error messages lost location, restore it · 51b9b478
      Markus Armbruster 提交于
      qemu_opts_foreach() runs its callback with the error location set to
      the option's location.  Any errors the callback reports use the
      option's location automatically.
      
      Commit 90998d58 moved the actual error reporting from "inside"
      qemu_opts_foreach() to after it.  Here's a typical hunk:
      
      	 if (qemu_opts_foreach(qemu_find_opts("object"),
          -                          object_create,
          -                          object_create_initial, NULL)) {
          +                          user_creatable_add_opts_foreach,
          +                          object_create_initial, &err)) {
          +        error_report_err(err);
      	     exit(1);
      	 }
      
      Before, object_create() reports from within qemu_opts_foreach(), using
      the option's location.  Afterwards, we do it after
      qemu_opts_foreach(), using whatever location happens to be current
      there.  Commonly a "none" location.
      
      This is because Error objects don't have location information.
      Problematic.
      
      Reproducer:
      
          $ qemu-system-x86_64 -nodefaults -display none -object secret,id=foo,foo=bar
          qemu-system-x86_64: Property '.foo' not found
      
      Note no location.  This commit restores it:
      
          qemu-system-x86_64: -object secret,id=foo,foo=bar: Property '.foo' not found
      
      Note that the qemu_opts_foreach() bug just fixed could mask the bug
      here: if the location it leaves dangling hasn't been clobbered, yet,
      it's the correct one.
      Reported-by: NEric Blake <eblake@redhat.com>
      Cc: Daniel P. Berrange <berrange@redhat.com>
      Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
      Message-Id: <1461767349-15329-4-git-send-email-armbru@redhat.com>
      Reviewed-by: NDaniel P. Berrange <berrange@redhat.com>
      Reviewed-by: NEric Blake <eblake@redhat.com>
      [Paragraph on Error added to commit message]
      51b9b478