Jean Guyader [Thu, 9 Oct 2008 16:51:19 +0000 (17:51 +0100)]
- Pass through some value of the real host in case of intel graphic
card. The graphic card need the know how much merroy has been stolen
from the physical RAM.
Ian Jackson [Thu, 23 Oct 2008 09:21:41 +0000 (10:21 +0100)]
Battery management - compilation fixes
* xenstore_refresh_battery_status declaration and definition
was missing void (interpreted in C as K&R syntax)
* a couple of functions returning int returned NULL on failure
Ian Jackson [Thu, 16 Oct 2008 17:31:04 +0000 (18:31 +0100)]
cirrus vga save/restore and lfb_addr/lfb_end
Cirrus VGA save and restore functions cast lfb_addr into an uint64_t
pointer while lfb_addr is only an unsigned long.
Same thing happened to lfb_end, causing pci_dev to be partially
overwritten by mistake.
Ian Jackson [Thu, 16 Oct 2008 09:29:00 +0000 (10:29 +0100)]
enable usb uhci save/restore
enables the usb uhci save and restore functions that
for some reasons were commented out.
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
[ These were commented out in 1e4146791b46f0a798589c58a09f18b2841a9212
aka svn://svn.savannah.nongnu.org/qemu/trunk@3609 c046a42c-6fe2-441c-8c8c-71466251a162
apparently by mistake. This commit reverts 1e414679
-Ian Jackson ]
Ian Jackson [Thu, 16 Oct 2008 09:29:00 +0000 (10:29 +0100)]
enable usb uhci save/restore
enables the usb uhci save and restore functions that
for some reasons were commented out.
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
[ These were commented out in 1e4146791b46f0a798589c58a09f18b2841a9212
aka svn://svn.savannah.nongnu.org/qemu/trunk@3609 c046a42c-6fe2-441c-8c8c-71466251a162
apparently by mistake. This commit reverts 1e414679
-Ian Jackson ]
Ian Jackson [Tue, 14 Oct 2008 10:46:53 +0000 (11:46 +0100)]
Fix blktap device backend patch check
Regarding http://bugzilla.xensource.com/bugzilla/show_bug.cgi?id=1367,
it appears that the expected backend path check is too strict for'
blktap devices. Therefore if the devtype is `vbd' we allow the
backend to be `tap'.
Thanks to report and inspiration from Yosuke Iwamatsu.
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Jean Guyader [Thu, 9 Oct 2008 16:51:19 +0000 (17:51 +0100)]
- Pass through some value of the real host in case of intel graphic
card. The graphic card need the know how much merroy has been stolen
from the physical RAM.
Ian Jackson [Thu, 9 Oct 2008 13:50:51 +0000 (14:50 +0100)]
Fix open_disk for blktap disks to use real bdrv_new
If blktap drives are registered properly, qemu code is much less likely
to get confused by them. Use bdrv_new(), assign a device name and create
an entry in drives_table for them.
Ian Jackson [Thu, 2 Oct 2008 13:22:41 +0000 (14:22 +0100)]
Avoid trusting client-controlled areas of xenstore.
Various parts of xenstore, specifically /local/GUEST/devices, are
writeable by the guest. Information from these areas must be used
with care, to avoid the guest tricking qemu-dm into improperly using
its privileged access to dom0 resources.
To this end:
* Variables and functions referring to client-controlled data have
had `danger' added to their names.
* There is a new sanitisation/checking arrangement for getting
backend paths and information about the configuration of device
backends, given the frontend information. This is so that when
qemu is providing a data path which is parallel to the PV
frontend/backend arrangements, it only uses the configuration from
a genuine backend which is really configured to serve qemu's own
guest.
* For information which should be read from or written to the `vm'
tree, we obtain the guest's uuid from the hypervisor (the `label'
as the hypercall interface calls it) rather than reading it from
the guest-controlled areas of xenstore.
* The `phantom vbd' feature is disabled. It relies on
guest-controlled xenstore areas indicating device paths on the
guest. We do not believe this feature is currently very relevant.
* We _do_ allow the guest of a stubdom qemu to mess up the
correspondence between pv backends and emulated devices, in the
sense that we don't mind if the guest directs qemu to use a `wrong'
frontend.
Ian Jackson [Wed, 1 Oct 2008 11:12:57 +0000 (12:12 +0100)]
vnc integer overflow check fix overzealous zero checking
In a83c1174b942d0f0f0e05927eb5b69fe8489b7ab, we arranged to avoid
integer overflow and calls to realloc(nonzero,0). However
vs->depth==0 is legitimate on entry to vnc_dpy_resize_shared.
We need to move the check for vs->depth until after vnc_colourdepth.
Ian Jackson [Fri, 26 Sep 2008 14:40:11 +0000 (15:40 +0100)]
vnc and xenfb integer overflow and division by zero vuln fixes
row_stride_div0.patch: a malicious frontend can send row_stride==0 and force
qemu-dm to perform division by 0
vnc_resize_doublecheck.patch: there is an unchecked multiplication when
calculating framebuffer size. Cs 17630 sanitizes framebuffer dimensions
passed by the frontend, so most probably no integer overflow can happen, but
there should be a check for overflow close to the actual computation (to
make code review easier and to cope with other codepaths in the future).
(Patches submitted by Rafal Wojtczuk <rafal@invisiblethingslab.com>
against xen-3.2 ioemu; adapted for xen-unstable by Ian Jackson and also
edited to actually compile and do be correct.)
Contributed-by: Rafal Wojtczuk <rafal@invisiblethingslab.com> Modified-by: Ian Jackson <ian.jackson@eu.citrix.com> Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Ian Jackson [Wed, 17 Sep 2008 11:02:13 +0000 (12:02 +0100)]
few compile time warnings removed
Few small changes to remove some compile time warnings:
- we are not initializing the qemu_alarm_timer pointer in
init_timer_alarm, so I am adding a NULL initialization;
- in the headers include code, we are doing something like:
/* BSD stuff */
/* linux stuff */
/* sun stuff */
that works most of the times but it fails when you try to compile qemu
on mini-os, that is posix but it doesn't define either __sun__ or
__linux__, so I am changing it to:
Ian Jackson [Fri, 12 Sep 2008 15:35:04 +0000 (16:35 +0100)]
vram_addr is 64-bit so print it that way in log messages
Various log messages would print it as %lx. We add a cast to unsigned
long long and use %llx, which makes the output accurate and gets rid
of some warnings.
Ian Jackson [Thu, 11 Sep 2008 11:41:14 +0000 (12:41 +0100)]
hvm: Use main memory for video memory.
qemu allocates video memory, the extra 8MB memory ballooning is not
available any more, because it got consumed by the other domain.
This fixes it by taking video memory from the main memory:
- make hvmloader use e820_malloc to reserve some of the main memory
and notify ioemu of its address through the Xen platform PCI card.
- add XENMAPSPACE_mfn to the xen_add_to_physmap memory op, to allow
ioemu to move the MFNs between the original position and the PCI
mapping, when LFB acceleration is disabled/enabled
- add a remove_from_physmap memory op, to allow ioemu to unmap it
completely for the case of old guests with acceleration disabled.
- add xc_domain_memory_translate_gpfn_list to libxc to allow ioemu to
get the MFNs of the video memory.
- have xend save the PCI memory space instead of ioemu: if a memory
page is there, the guest can access it like usual memory, so xend
can safely be responsible to save it. The extra benefit is that
live migration will apply the logdirty optimization there too.
- handle old saved images, populating the video memory from ioemu if
really needed.
Signed-off-by: Samuel Thibault <samuel.thibault@eu.citrix.com>
Cross-ported from xen-unstable
18383:dade7f0bdc8d6b36b1914598d83c616ee5ce97cb
using patch -l, with only one fixup needed: [un]set_mm_mapping needed
to be removed from hw/cirrus_vga.c rather than vl.c
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Ian Jackson [Tue, 9 Sep 2008 13:02:03 +0000 (14:02 +0100)]
Fix map cache low/high/low bug
This small patch fixes an issue leading to a crash (segfault, although
with earlier changesets I was seeing sigbus - not sure what changed)
in qemu-dm when the following conditions occur:
1. A valid mapping for a bucket on a low address exists
2. Immediately after accessing memory mapped in this bucket, an access
occurs to a high (beyond assigned ram) address beyond the 1GB limit
for 32bit map cache wrapping around to the previous bucket's entry
number.
3. The next call to map cache again accesses the low address.
In this scenario, the guest mem for the low bucket has been unmapped
by the remap_bucket caused by 2., but because the valid_mapping
bit-test fails, map_cache returns before last_address_index has been
updated. The subsequent call to map_cache therefore never remaps the
low, valid bucket and instead returns a vaddr pointing to memory that
has failed to get mapped.
Ian Jackson [Mon, 8 Sep 2008 16:04:58 +0000 (17:04 +0100)]
remove QEMU_OPTION_pci
QEMU_OPTION_pci is no longer handled in the switch() in vl.c and is
therefore obsolete. Therefore remove it. QEMU_OPTION_direct_pci is
the current mechanism.
Ian Jackson [Fri, 5 Sep 2008 09:32:49 +0000 (10:32 +0100)]
fix offset of MSI-X memory mapped table.
This patch fixes offset of MSI-X memory mapped table.
Current code does not set dev->msix->table_off variable.
The offset of MSI-X memory mapped table is treated as 0.
The wrong region is unmapped from guest physical memory space.
As a result, guest device driver can't access memory mapped resource.
The patch fixes this issue. My MegaRAID SAS assigned to guest domain
becomes working with the patch.
Ian Jackson [Wed, 3 Sep 2008 10:26:06 +0000 (11:26 +0100)]
support PCI Express Capability Structure version 1
Suppport PCI Express Capability Structure version 1. The format of
PCI Express Capability Structure is different between version 1 and
version 2. Current code supports only version 2. This might cause
conflict with other capability structure if device implement
version 1.
Ian Jackson [Tue, 22 Jul 2008 15:28:06 +0000 (16:28 +0100)]
Nicer fix for spurious messages from configure when GCC3 is missing.
This reverts b5123e05cce4be4c6c8c822fad0f0df4c053da06 and replaces it
with a nice simple change, namely to change test ... -a ... with
test ... && test ... . That provides shortcut evaluation.
Thanks to Andre Przywara who provided this one-line change as an
update to the previous commit.
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
projects / xenclient / ioemu.git / log