aboutsummaryrefslogtreecommitdiffstats
path: root/tools/ioemu
Commit message (Collapse)AuthorAgeFilesLines
...
* ioemu: Disable format auto-probing in monitor command changeKeir Fraser2008-06-181-1/+1
| | | | | | | | | Format auto-probing of writable images is a security hole. The last known remaining instance is monitor command change. Disable probing there and use raw. This breaks change for images in all other formats. Signed-off-by: Markus Armbruster <armbru@redhat.com>
* minios,stubdom: Add OBJ_DIR parameter to compile outside sources,Keir Fraser2008-06-171-7/+0
| | | | | | | which permits to easily compile mini-os in various flavors. Also clean some parts of stubdom build. Signed-off-by: Samuel Thibault <samuel.thibault@eu.citrix.com>
* ioemu: move xenfb frontend (used by stubdom) to its own file, since itKeir Fraser2008-06-174-315/+322
| | | | | | does not really belong to hw/, but to /, like sdl.c and vnc.c. Signed-off-by: Samuel Thibault <samuel.thibault@eu.citrix.com>
* ioemu: simplyfing vga_draw_text codeKeir Fraser2008-06-092-10/+6
| | | | Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
* stubdom: simplify xenfb resize handlerKeir Fraser2008-06-091-29/+9
| | | | Signed-off-by: Samuel Thibault <samuel.thibault@eu.citrix.com>
* stubdom: make non-VNC + stdvga workKeir Fraser2008-06-091-0/+5
| | | | Signed-off-by: Samuel Thibault <samuel.thibault@eu.citrix.com>
* ioemu: cleaning DisplayState->dpy_resize interfaceKeir Fraser2008-06-099-101/+144
| | | | | | | | | | | Bring the DisplayState dpy_resize interface back to how it is in qemu mainstream, thus making the code easier to merge. In order to support sharing the framebuffer, I am adding a new resize interface called dpy_resize_shared that also has a depth and a pixels parameters. As a consequence I could remove the dpy_colourdepth callback and make the code cleaner and easier to read. Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
* ioemu: set up all xenstore watches even if there are no VBDs.Keir Fraser2008-05-281-1/+1
| | | | Signed-off-by: Tim Deegan <Tim.Deegan@citrix.com>
* stubdom: make the build more generic by moving as many stubdom partsKeir Fraser2008-05-281-0/+7
| | | | | | | into stubdom/ as possible. That also permits to build all of ioemu, c and caml stubdoms at the same time. Signed-off-by: Samuel Thibault <samuel.thibault@eu.citrix.com>
* ioemu: Force floppy disk images to be interpreted as raw.Keir Fraser2008-05-271-2/+3
| | | | | Fixes specifying fda/fdb image names in domain configs. Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
* ioemu: drop unused shared_vram variableKeir Fraser2008-05-222-4/+0
| | | | Signed-off-by: Samuel Thibault <samuel.thibault@eu.citrix.com>
* ioemu: HVM virtual S3Keir Fraser2008-05-204-0/+24
| | | | | | | | | | | | | | - add S3 suspend logic in PM1A control register. when guest write specific value to this register, QEMU will trigger S3 sleep by * reset all qemu device * set CMOS shutdown status as S3 resume, so that rombios will do S3 resume later * request Xen to S3-suspend the guest Signed-off-by: Yu Ke <ke.yu@intel.com> Signed-off-by: Liping Ke <liping.ke@intel.com? Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
* ioemu: Fix interpretation of missing or zero vfb videoramKeir Fraser2008-05-201-1/+1
| | | | | | | | | | Changeset 17289:d97e61001d81: introduced vfb configuration parameter videoram, defaulting to zero. Value zero was interpreted as unlimited. Changeset 17630:53195719f762 accidentally dropped the special case for zero, which broke guests that don't specify videoram, or specify videoram=0. Restore the old behavior. Signed-off-by: Markus Armbruster <armbru@redhat.com>
* ioemu: Fix load of PCI-device IRQ state after save/restore.Keir Fraser2008-05-191-1/+1
| | | | | From: Ian Jackson <Ian.Jackson@eu.citrix.com> Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
* ioemu: serial save/load fixKeir Fraser2008-05-161-1/+7
| | | | | | | | | | | | | | | This patch fixes several bugs in serial.c (1) A typo in serial_save() where qemu_get_8s is called (should be qemu_put_8s) (2) No support provided in serial_load() for version_id == 1 (should unmarshal a 1 byte s->divider and should provide a default value for s->fcr) (3) Call serial_ioport_write() to initialize s->fcr. It is not sufficient to load its value; other hidden values (such as s->recv_fifo.itl) must be re-initialized. Signed-off-by: Ben Guthro <bguthro@virtualiron.com> Signed-off-by: Robert Phillips <rphillips@virtualiron.com>
* ioemu: Do not try to guess backing file format when using qcow vbds.Keir Fraser2008-05-152-7/+29
| | | | Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
* ioemu: Fix PVFB backend to limit frame buffer sizeKeir Fraser2008-05-151-0/+1
| | | | | | | | | | The recent fix to validate the frontend's frame buffer description neglected to limit the frame buffer size correctly. This lets a malicious frontend make the backend attempt to map an arbitrary amount of guest memory, which could be useful for a denial of service attack against dom0. Signed-off-by: Markus Armbruster <armbru@redhat.com>
* qemu: Fix shift-insert behaviorKeir Fraser2008-05-142-3/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch is related to Changeset 15635:7bdc9f6407d3 <http://xenbits.xensource.com/staging/xen-unstable.hg?rev/7bdc9f6407d3> [PVFB] Fix shift key for graphical vnc display. With above patch, if a user presses shift-insert, qemu sends shift down, shift up, insert down and then another shift key down (see trace below). This makes it impossible to do shift insert pasting or use guest hot shifted-Fkeys. Shift Insert trace: do_key_event():1135 keycode:2a shift down kbd_put_keycode():539 keycode:2a send shift down do_key_event():1135 keycode:d2 insert down kbd_put_keycode():539 keycode:aa send shift up kbd_put_keycode():539 keycode:e0 send insert down kbd_put_keycode():539 keycode:52 do_key_event():1135 keycode:d2 insert up kbd_put_keycode():539 keycode:e0 send insert up kbd_put_keycode():539 keycode:d2 kbd_put_keycode():539 keycode:2a send shift down do_key_event():1135 keycode:2a shift up kbd_put_keycode():539 keycode:aa send shift up This patch adds a check for the keycode being shiftable, something other than a keypad key, f1-12 , insert, del , etc. before allowing the press_shift_up() operation. Signed-off-by: Pat Campbell <plc@novell.com>
* qemu: Send unit_attention on cd-rom not_ready to ready transitionKeir Fraser2008-05-141-0/+6
| | | | | | | | | | | | | Patch sends a UNIT_ATTENTION(6), MEDIUM_MAY_HAVE_CHANGED(0x28) sense when cdrom transitions from not ready to ready. ATA Packet interface for CD-ROMS, SFF8020i.pdf. See state diagram Figure 12, page 82 and Table 44 -recommended Sense Key, ASC With patch in place HVM win2008 server guest sees the CD/DVD contents have changed when the media is switched. Signed-off-by: Pat Campbell <plc@novell.com>
* qemu: add 0xe0 prefix to r-ctrl and r-alt keycodesKeir Fraser2008-05-142-0/+3
| | | | | | | Patch puts 0xe0 prefix before putting right alt or right cntrl keycodes. Also adds keysm definition for ISO_Left_Tab. Signed-off-by: Pat Campbell <plc@novell.com>
* ioemu: Fix handling of phy: block devices.Keir Fraser2008-05-141-1/+1
| | | | Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
* ioemu: Fix PVFB backend to validate frontend's frame buffer descriptionKeir Fraser2008-05-131-28/+79
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A buggy or malicious frontend can describe its shared framebuffer to the backend in a way that makes the backend map an arbitrary amount of guest memory, malloc an arbitrarily large internal buffer, copy arbitrary memory to that buffer, even beyond its end. A domU running a malicious frontend can abuse the former two for denial of service attacks against dom0. It can abuse the third to write arbitrary backend memory. It can abuse all three to terminate or crash the backend. Arbitrary code execution looks quite feasible. In more detail (ignoring #ifdef CONFIG_STUBDOM code): The frame buffer is described by the following parameters: * fb_len (size of shared framebuffer) * width, height, depth * row_stride, offset fb_len is fixed on startup. The frontend can modify the other parameters by sending a XENFB_TYPE_RESIZE event. xenfb_read_frontend_fb_config() limits fb_len according to backend configuration parameter videoram (from xenstore), if present. I believe videoram is not present by default. xenfb_map_fb() uses fb_len to map the frontend's framebuffer. The frontend can make it map arbitrarily much, unless limited by the videoram configuration parameter. This flaw always existed. xenfb_register_console() and xenfb_on_fb_event() pass width, height, depth and rowstride to QEMU's DisplayState object. The object sets itself up to work directly on the framebuffer (shared_buf true) if parameters allow that. Else it allocates an internal buffer of size height * width * depth / 8 (shared_buf false). The frontend can make it allocate arbitrarily much. This flaw always existed. xenfb_register_console() and xenfb_on_fb_event() pass width, height, depth and rowstride to QEMU's DisplayState object. The object sets itself up to work directly on the framebuffer (shared_buf true) if parameters allow that. Else it allocates an internal buffer of size height * width * depth / 8 (shared_buf false). The frontend can make it allocate arbitrarily much. This flaw was introduced by the move of PVFB into QEMU (xen-unstable cset 16220 ff). xenfb_on_fb_event() uses width and height to clip the area of an update event. It then passes that area to xenfb_guest_copy(). xenfb_invalidate() passes the complete screen area to xenfb_guest_copy(). xenfb_guest_copy() copies the argument area (x, y, w, h) into the internal buffer, unless shared_buf is true. This copies h blocks of memory. The i-th copy (counting from zero) copies w * depth / 8 bytes from shared framebuffer + offset + (y + i) * row_stride + x * depth / 8 to internal buffer + (y + i) * ds->linesize + x * ds->depth / 8 where ds->linesize and ds->depth are parameters of the internal buffer chosen by the backend. This copy can be made to read from the shared framebuffer and write to the internal buffer out of bounds. I believe the frontend can abuse this to write arbitrary backend memory. The flaw in its current form was introduced by the move of PVFB into QEMU (xen-unstable cset 16220 ff). Before, the framebuffer was always shared. From: Markus Armbruster <armbru@redhat.com> Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
* ioemu: Fix build: use uint64_t rather than u64.Keir Fraser2008-05-122-3/+3
| | | | Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
* pvfb/ioemu: transmit refresh interval advice from backend to frontendKeir Fraser2008-05-125-53/+171
| | | | | | which permits the frontend to avoid useless polls. Signed-off-by: Samuel Thibault <samuel.thibault@eu.citrix.com>
* ioemu: fix disk format security vulnerabilityKeir Fraser2008-05-122-5/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | * make the xenstore reader in qemu-dm's startup determine which of qemu's block drivers to use according to the xenstore backend `type' field. This `type' field typically comes from the front of the drive mapping string in ioemu. The supported cases are: xm config file string `type' image format qemu driver phy:[/dev/]<device> phy raw image bdrv_raw file:<filename> file raw image bdrv_raw tap:aio:<filename> tap raw image bdrv_raw tap:qcow:<image> tap not raw autoprobe tap:<cow-fmt>:<image> tap named format bdrv_<cow-fmt> It is still necessary to autoprobe when the image is specified as `tap:qcow:<image>', because qemu distinguishes `qcow' and `qcow2' whereas blktap doesn't; `qcow' in xenstore typically means what qemu calls qcow2. This is OK because qemu can safely distinguish the different cow formats provided we know it's not a raw image. * Make the format autoprobing machinery never return `raw'. This has two purposes: firstly, it arranges that the `tap:qcow:...' case above can be handled without accidentally falling back to raw format. Secondly it prevents accidents in case the code changes in future: autoprobing will now always fail on supposed cow files which actually contain junk, rather than giving the guest access to the underlying file. Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
* x86 hvm: Support MSI-X for HVM domains.Keir Fraser2008-05-124-27/+440
| | | | Signed-off-by: Shan Haitao <Haitao.shan@intel.com>
* shadow: track video RAM dirty bitsKeir Fraser2008-05-023-29/+104
| | | | | | | | | | This adds a new HVM op that enables tracking dirty bits of a range of video RAM. The idea is to optimize just for the most common case (only one guest mapping, with sometimes some temporary other mappings), which permits to keep the overhead on shadow as low as possible. Signed-off-by: Samuel Thibault <samuel.thibault@eu.citrix.com>
* ioemu: move VNC-specific switchbpp member to VncStateKeir Fraser2008-05-022-3/+3
| | | | Signed-off-by: Samuel Thibault <samuel.thibault@eu.citrix.com>
* ioemu: always disable shared buffer in text modeKeir Fraser2008-05-021-4/+3
| | | | | | | by not calling get_bpp() (which only makes sense in graphical mode) and always use 0 instead. Signed-off-by: Samuel Thibault <samuel.thibault@eu.citrix.com>
* ioemu: pump SDL events on resizeKeir Fraser2008-05-021-0/+3
| | | | | | | | | | | | | | When sdl_resize resizes the SDL window, some window manager send back a ConfigureNotify event, which triggers a SDL_VIDEORESIZE event. That event, however, is seen only much later, on the next VGA refresh round. If the guest quickly switches to another resolution in between, the SDL_VIDEORESIZE event makes us erroneously rescale that new resolution into the old one. This patch makes us pump that window manager event, so that no SDL_VIDEORESIZE event is generated. Signed-off-by: Samuel Thibault <samuel.thibault@eu.citrix.com>
* MSI 5/6: add MSI support to passthrough HVM domainKeir Fraser2008-05-015-2/+602
| | | | | | | Currently it only inercept access to MSI config space, no MSI-x support. Signed-off-by: Jiang Yunhong <yunhong.jiang@intel.com> Signed-off-by: Shan Haitao <haitao.shan@intel.com>
* MSI 2/6: change the pirq to be per-domainKeir Fraser2008-05-011-0/+14
| | | | | Signed-off-by: Jiang Yunhong <yunhong.jiang@intel.com> Signed-off-by: Shan Haitao <haitao.shan@intel.com>
* ioemu: Save PCI device INTx line states.Keir Fraser2008-04-241-2/+14
| | | | | | | | | | | Otherwise, ioemu can be out of sync with the hypervisor after restoring guest state, if INTx lines were asserted when the state was saved. This prevents ioemu from setting the line to zero in Xen (because it thinks the line is already zero). This can allow th eguest to enter an endless IRQ loop and hang. Signed-off-by: Kazuhiro Suzuki <kaz@jp.fujitsu.com> Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
* blktap: Automatically start tapdisk-ioemu on demandKeir Fraser2008-04-234-52/+17
| | | | | | | | | When a domain wants to use a tap:ioemu disk but has no device model, start a tapdisk-ioemu instance as provider. Also, move the creation and removal of communication pipes to xend so that qemu-dm doesn't need the unwanted SIGHUP handler anymore. Signed-off-by: Kevin Wolf <kwolf@suse.de>
* Revert 17499:451ae3b8e5c8Keir Fraser2008-04-234-17/+52
| | | | | | Breaks HVM guest creation (bugzilla #1221). Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
* blktap: Automatically start tapdisk-ioemu on demandKeir Fraser2008-04-224-52/+17
| | | | | | | | | When a domain wants to use a tap:ioemu disk but has no device model, start a tapdisk-ioemu instance as provider. Also, move the creation and removal of communication pipes to xend so that qemu-dm doesn't need the unwanted SIGHUP handler anymore. Signed-off-by: Kevin Wolf <kwolf@suse.de>
* ioemu: Fix cross-build of tapdisk-ioemuKeir Fraser2008-04-181-1/+1
| | | | | | | | changeset e1962ac0fb1c breaks cross-builds because it assumes the system strip tool applies to the generated binaries. This assumption isn't made anywhere else in the xen tools build. Signed-off-by: Aron Griffis <aron@hp.com>
* stubdom: make use of PVFB resize eventKeir Fraser2008-04-164-45/+111
| | | | | | | | which with the offset support also permits to expose the VGA vram and non-shared vram throught PVFB at the same time, switching between both as appropriate. Signed-off-by: Samuel Thibault <samuel.thibault@eu.citrix.com>
* ioemu: drop reschedule of handle_buffered_io on I/O reqsKeir Fraser2008-04-161-1/+1
| | | | | | | | | | | Rescheduling the call to handle_buffered_io costs the system call to qemu_get_clock(), which is very expensive considering the the latency we would like to achieve for I/O reqs, so we should avoid it. That means that handle_buffered_io may be called as often as every 0.1s, but that's not so costly. Signed-off-by: Samuel Thibault <samuel.thibault@eu.citrix.com>
* stubdom: sparse application's BSS by linking it separately first, putKeir Fraser2008-04-161-6/+3
| | | | | | | markers at its beginning and end, and then link with mini-os. That permits to stick a bit more to upstream qemu. Signed-off-by: Samuel Thibault <samuel.thibault@eu.citrix.com>
* tools: Build fixes for *BSD.Keir Fraser2008-04-152-0/+3
| | | | Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
* ioemu: COW driver flush method should return an int.Keir Fraser2008-04-151-1/+2
| | | | Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
* hvm: Add HVM_PARAM_DM_DOMAIN to let ioreq events go to a stub domainKeir Fraser2008-04-111-0/+1
| | | | | | | instead of dom0. Signed-off-by: Samuel Thibault <samuel.thibault@eu.citrix.com> Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
* tools: Make xend set time offset for all kinds of domains, so thatKeir Fraser2008-04-111-2/+0
| | | | | | ioemu doesn't need to do it. Signed-off-by: Samuel Thibault <samuel.thibault@eu.citrix.com>
* ioemu: Fix rtl8139 emulation so that reboot works correctly in 64-bitKeir Fraser2008-04-091-0/+18
| | | | | | | | Windows VMs. Return an error if the guest OS tries to transmit a packet with the transmitter disabled, so that it doesn't spin forever waiting for it to complete. Signed-off-by: Steven Smith <Steven.Smith@eu.citrix.com>
* ioemu: Add tapdisk-ioemu toolKeir Fraser2008-04-084-4/+153
| | | | | | | | | | | | | | | | | Currently, tap:ioemu can only be used for domains which have a device model running. This isn't the case for all domains. The most important of the missing domains is Dom0 which needs acces e.g. to extract the kernel from the domain's image. tapdisk-ioemu is a tool compiled from ioemu source plus a small wrapper which handles tap:ioemu access for domains without device model (currently Dom0). You must start tapdisk-ioemu manually before trying to attach a tap:ioemu disk to Dom0 at the moment. A patch to blktapctrl will follow to automatically start tapdisk-ioemu when needed. Signed-off-by: Kevin Wolf <kwolf@suse.de> Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
* ioemu: drop duplicate memory reservationKeir Fraser2008-04-051-23/+0
| | | | Signed-off-by: Samuel Thibault <samuel.thibault@eu.citrix.com>
* stubdom: trivial warning fixupKeir Fraser2008-04-051-5/+7
| | | | Signed-off-by: Samuel Thibault <samuel.thibault@eu.citrix.com>
* stubdom: add asynchronous disk flush supportKeir Fraser2008-04-051-10/+34
| | | | Signed-off-by: Samuel Thibault <samuel.thibault@eu.citrix.com>
* ioemu: advertise write cache featureKeir Fraser2008-04-041-1/+2
| | | | Signed-off-by: Samuel Thibault <samuel.thibault@eu.citrix.com>
generated by cgit v1.2.3 (git 2.25.1) at 2025-04-20 05:16:53 +0000