aboutsummaryrefslogtreecommitdiff
path: root/hw/xen
AgeCommit message (Collapse)Author
2015-04-09xen: limit guest control of PCI command registerJan Beulich
Otherwise the guest can abuse that control to cause e.g. PCIe Unsupported Request responses (by disabling memory and/or I/O decoding and subsequently causing [CPU side] accesses to the respective address ranges), which (depending on system configuration) may be fatal to the host. This is CVE-2015-2756 / XSA-126. Signed-off-by: Jan Beulich <jbeulich@suse.com> Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> Message-id: alpine.DEB.2.02.1503311510300.7690@kaball.uk.xensource.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-03-10xen-pt: fix Out-of-bounds readGonglei
The array length of s->real_device.io_regions[] is "PCI_NUM_REGIONS - 1". Signed-off-by: Gonglei <arei.gonglei@huawei.com> Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-03-10xen-pt: fix Negative array index readGonglei
Coverity spot: Function xen_pt_bar_offset_to_index() may return a negative value (-1) which is used as an index to d->io_regions[] down the line. Let's pass index directly as an argument to xen_pt_bar_reg_parse(). Signed-off-by: Gonglei <arei.gonglei@huawei.com> Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-01-13xen-pt: Fix PCI devices re-attach failedLiang Li
Use the 'xl pci-attach $DomU $BDF' command to attach more than one PCI devices to the guest, then detach the devices with 'xl pci-detach $DomU $BDF', after that, re-attach these PCI devices again, an error message will be reported like following: libxl: error: libxl_qmp.c:287:qmp_handle_error_response: receive an error message from QMP server: Duplicate ID 'pci-pt-03_10.1' for device. If using the 'address_space_memory' as the parameter of 'memory_listener_register', 'xen_pt_region_del' will not be called if the memory region's name is not 'xen-pci-pt-*' when the devices is detached. This will cause the device's related QemuOpts object not be released properly. Using the device's address space can avoid such issue, because the calling count of 'xen_pt_region_add' when attaching and the calling count of 'xen_pt_region_del' when detaching is the same, so all the memory region ref and unref by the 'xen_pt_region_add' and 'xen_pt_region_del' can be released properly. Signed-off-by: Liang Li <liang.z.li@intel.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reported-by: Longtao Pang <longtaox.pang@intel.com>
2014-10-20hw: Convert from BlockDriverState to BlockBackend, mostlyMarkus Armbruster
Device models should access their block backends only through the block-backend.h API. Convert them, and drop direct includes of inappropriate headers. Just four uses of BlockDriverState are left: * The Xen paravirtual block device backend (xen_disk.c) opens images itself when set up via xenbus, bypassing blockdev.c. I figure it should go through qmp_blockdev_add() instead. * Device model "usb-storage" prompts for keys. No other device model does, and this one probably shouldn't do it, either. * ide_issue_trim_cb() uses bdrv_aio_discard() instead of blk_aio_discard() because it fishes its backend out of a BlockAIOCB, which has only the BlockDriverState. * PC87312State has an unused BlockDriverState[] member. The next two commits take care of the latter two. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2014-08-18memory: remove memory_region_destroyPaolo Bonzini
The function is empty after the previous patch, so remove it. Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-07-07xen_backend: introduce xenstore_read_uint64 and xenstore_read_fe_uint64Stefano Stabellini
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
2014-05-07Merge remote-tracking branch 'remotes/mjt/tags/trivial-patches-2014-05-07' ↵Peter Maydell
into staging trivial patches for 2014-05-07 # gpg: Signature made Wed 07 May 2014 18:01:15 BST using RSA key ID A4C3D7DB # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>" # gpg: aka "Michael Tokarev <mjt@corpit.ru>" # gpg: aka "Michael Tokarev <mjt@debian.org>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 6EE1 95D1 886E 8FFB 810D 4324 457C E0A0 8044 65C5 # Subkey fingerprint: 6F67 E18E 7C91 C5B1 5514 66A7 BEE5 9D74 A4C3 D7DB * remotes/mjt/tags/trivial-patches-2014-05-07: (21 commits) libcacard: remove unnecessary EOL from debug prints docs/memory.txt: Fix document on MMIO operations readline: Sort completions before printing them. readline: use g_strndup instead of open-coding it qmp: report path ambiguity error libcacard: replace pstrcpy() with memcpy() glib: move g_poll() replacement into glib-compat.h do not call g_thread_init() for glib >= 2.31 hw/9pfs: Add include file for exported symbol xen: remove unused global, xen_xcg hw: Add missing 'static' attributes qemu-timer: Add missing 'static' attribute ui: Add missing 'static' attribute monitor: Add missing 'static' attribute hw/s390x: Add missing 'static' attribute hw/mips: Add missing 'static' and 'const' attributes hw/9pfs: Add missing 'static' attributes arch_init: Be sure of only one exit entry with DPRINTF() for ram_load() tests/tcg: Fix compilation of test_path qga: Fix typo (plural) in comment ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-05-07xen: remove unused global, xen_xcgJim Meyering
Reviewed-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Jim Meyering <meyering@redhat.com> Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2014-05-07xen: move Xen HVM files under hw/i386/xenWei Liu
Signed-off-by: Wei Liu <wei.liu2@citrix.com> Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
2014-05-07qemu-xen: free all the pirqs for msi/msix when driver unloadZhenzhong Duan
Pirqs are not freed when driver unload, then new pirqs are allocated when driver reload. This could exhaust pirqs if do it in a loop. This patch fixes the bug by freeing pirqs when ENABLE bit is cleared in msi/msix control reg. There is also other way of fixing it such as reuse pirqs between driver reload, but this way is better. Xen-devel: http://marc.info/?l=xen-devel&m=136800120304275&w=2 Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
2014-02-20Call pci_piix3_xen_ide_unplug from unplug_disksStefano Stabellini
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com>
2014-01-17xen_pt: Fix passthrough of device with ROM.Anthony PERARD
QEMU does not need and should not allocate memory for the ROM of a passthrough PCI device. So this patch initialize the particular region like any other PCI BAR of a passthrough device. When a guest will access the ROM, Xen will take care of the IO, QEMU will not be involved in it. Xen set a limit of memory available for each guest, allocating memory for a ROM can hit this limit. Signed-off-by: Anthony PERARD <anthony.perard@citrix.com> Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Reported-and-Tested-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
2014-01-17xen_pt: Fix debug output.Anthony PERARD
Signed-off-by: Anthony PERARD <anthony.perard@citrix.com> Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
2013-12-24apic: QOM'ify APICxiaoqiang zhao
Convert 'init' function to QOM's 'realize' for apic, kvm/apic and xen/xen_apic. Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
2013-12-01xen-pvdevice: make device-id property compulsoryPaul Durrant
The intention of the Xen PV device is that it is used as a parent device for PV drivers in Xen HVM guests and the set of PV drivers that bind to the device is determined by its device ID (and possibly vendor ID and revision). As such, the device should not have a default device ID, it should always be supplied by the Xen toolstack. Signed-off-by: Paul Durrant <paul.durrant@citrix.com> Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
2013-12-01xen: fix two errors when debug is enabledWei Liu
This patch fixes: 1. build error in xen_pt.c when XEN_PT_LOGGING_ENABLED is defined 2. debug output format string error when DEBUG_XEN is defined In the second case I also have the output info in consistent with the output in mapping function - that is, print start_addr instead of phys_offset. Signed-off-by: Sander Eikelenboom <linux@eikelenboom.it> Signed-off-by: Wei Liu <wei.liu2@citrix.com> Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
2013-11-05qdev: Drop misleading qdev_free() functionStefan Hajnoczi
The qdev_free() function name is misleading since all the function does is unlink the device from its parent. The device is not necessarily freed. The device will be freed when its QObject refcount reaches zero. It is usual for the parent (bus) to hold the final reference but there are cases where something else holds a reference so "free" is a misleading name. Call object_unparent(obj) directly instead of having a qdev wrapper function. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
2013-10-10qemu/xen: make use of xenstore relative pathsRoger Pau Monné
Qemu has several hardcoded xenstore paths that are only valid on Dom0. Attempts to launch a Qemu instance (to act as a userspace backend for PV disks) will fail because Qemu is not able to access those paths when running on a domain different than Dom0. Instead make the xenstore paths relative to the domain where Qemu is actually running. Signed-off-by: Roger Pau Monné <roger.pau@citrix.com> Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Reviewed-by: Anthony PERARD <anthony.perard@citrix.com> Cc: xen-devel@lists.xenproject.org Cc: Anthony PERARD <anthony.perard@citrix.com>
2013-07-29devices: Associate devices to their logical categoryMarcel Apfelbaum
The category will be used to sort the devices displayed in the command line help. Signed-off-by: Marcel Apfelbaum <marcel.a@redhat.com> Message-id: 1375107465-25767-4-git-send-email-marcel.a@redhat.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2013-07-29Xen PV DevicePaul Durrant
Introduces a new Xen PV PCI device which will act as a binding point for PV drivers for Xen. The device has parameterized vendor-id, device-id and revision to allow to be configured as a binding point for any vendor's PV drivers. Signed-off-by: Paul Durrant <paul.durrant@citrix.com> Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Reviewed-by: Andreas Färber <afaerber@suse.de>
2013-07-27misc: Fix new typos in comments and stringsStefan Weil
All these typos were found by codespell. sould -> should emperical -> empirical intialization -> initialization successfuly -> successfully gaurantee -> guarantee Fix also another error (before before) in the same context. Signed-off-by: Stefan Weil <sw@weilnetz.de> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2013-07-23xen/xen_platform: QOM parent field cleanupAndreas Färber
Replace direct uses of PCIXenPlatformState::pci_dev field with QOM casts and rename it to parent_obj. Acked-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
2013-07-23xen/xen_platform: QOM casting sweepPeter Crosthwaite
Define and use standard QOM cast macro. Remove usages of DO_UPCAST() and direct -> style upcasting. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> [AF: Dropped opaque casts] Signed-off-by: Andreas Färber <afaerber@suse.de>
2013-07-04hw/[u-x]*: pass owner to memory_region_init* functionsPaolo Bonzini
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2013-07-04memory: add ref/unref callsPaolo Bonzini
Add ref/unref calls at the following places: - places where memory regions are stashed by a listener and used outside the BQL (including in Xen or KVM). - memory_region_find callsites - creation of aliases and containers (only the aliased/contained region gets a reference to avoid loops) - around calls to del_subregion/add_subregion, where the region could disappear after the first call Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2013-07-04memory: add owner argument to initialization functionsPaolo Bonzini
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2013-07-04xen: Mark fixed platform I/O as unalignedJan Kiszka
Before switching to the memory core dispatcher, we need to make sure that this pv-device will continue to receive unaligned portio accesses. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2013-06-20memory: make section size a 128-bit integerPaolo Bonzini
So far, the size of all regions passed to listeners could fit in 64 bits, because artificial regions (containers and aliases) are eliminated by the memory core, leaving only device regions which have reasonable sizes An IOMMU however cannot be eliminated by the memory core, and may have an artificial size, hence we may need 65 bits to represent its size. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2013-06-11hw/xen: Use g_free instead of free and fix potential memory leaksStefan Weil
The wrong functions and the missing calls of g_free were reported by cppcheck. Signed-off-by: Stefan Weil <sw@weilnetz.de> Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2013-05-01target-i386: Replace MSI_SPACE_SIZE with APIC_SPACE_SIZEIgor Mammedov
Put APIC_SPACE_SIZE in a public header so that it can be reused elsewhere later. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
2013-04-15sysemu: avoid proliferation of include/ subdirectoriesPaolo Bonzini
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2013-04-08hw: move private headers to hw/ subdirectories.Paolo Bonzini
Many headers are used only in a single directory. These can be kept in hw/. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2013-04-08hw: move more files to hw/xen/Paolo Bonzini
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2013-04-08hw: move target-independent files to subdirectoriesPaolo Bonzini
This patch tackles all files that are compiled once, moving them to subdirectories of hw/. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2013-04-08hw: make subdirectories for devicesPaolo Bonzini
Prepare the new directory structure. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
generated by cgit v1.2.3 (git 2.26.2) at 2024-12-17 07:21:10 +0000