summaryrefslogtreecommitdiffstats
path: root/hw/i386/kvmvapic.c
Commit message (Collapse)AuthorAgeFilesLines
* i386: avoid null pointer dereferenceP J P2016-03-221-5/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Hello, A null pointer dereference issue was reported by Mr Ling Liu, CC'd here. It occurs while doing I/O port write operations via hmp interface. In that, 'current_cpu' remains null as it is not called from cpu_exec loop, which results in the said issue. Below is a proposed (tested)patch to fix this issue; Does it look okay? === From ae88a4947fab9a148cd794f8ad2d812e7f5a1d0f Mon Sep 17 00:00:00 2001 From: Prasad J Pandit <pjp@fedoraproject.org> Date: Fri, 18 Dec 2015 11:16:07 +0530 Subject: [PATCH] i386: avoid null pointer dereference When I/O port write operation is called from hmp interface, 'current_cpu' remains null, as it is not called from cpu_exec() loop. This leads to a null pointer dereference in vapic_write routine. Add check to avoid it. Reported-by: Ling Liu <liuling-it@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <alpine.LFD.2.20.1512181129320.9805@wniryva> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: P J P <ppandit@redhat.com> (cherry picked from commit 4c1396cb576c9b14425558b73de1584c7a9735d7) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
* kvmvapic: patch_instruction fixPavel Dovgalyuk2014-10-311-1/+0
| | | | | | | | | | | | | | | When QEMU works in icount mode cpu_restore_state function performs two actions: restoring the program counter and updating icount to the correct value. kvmvapic's patch_instruction function is called by cpu_report_tpr_access function which also invokes cpu_restore_state. It results to calling cpu_restore_state twice - in cpu_report_tpr_access and in patch_instruction. When icount is disabled second call is safe. But when icount is enabled, cpu_restore_state modifies instructions counter twice, which leads to incorrect behavior. This patch removes useless cpu_restore_state call from kvmvapic. Signed-off-by: Pavel Dovgalyuk <pavel.dovgaluk@ispras.ru> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
* kvmvapic: fix migration when VM paused and when not running WindowsPavel Dovgalyuk2014-09-261-2/+9
| | | | | | | | | | | This patch fixes migration by extending do_vapic_enable function. This function called vapic_enable which read cpu number from the guest memory. When cpu number could not be read, vapic was not enabled while loading the VM state. This patch adds required code for cpu_number=0 to do_vapic_enable function, because it is called only when cpu_number=0. Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* apic_common: vapic_paddr synchronization fixPavel Dovgalyuk2014-09-111-11/+26
| | | | | | | | | | | | | This patch postpones vapic_paddr initialization, which is performed during migration. When vapic_paddr is synchronized within the migration process, apic_common functions could operate with incorrect apic state, if it hadn't loaded yet. This patch postpones the synchronization until the virtual machine is started, ensuring that the whole virtual machine state has been loaded. Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru> Tested-by: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* memory: convert memory_region_destroy to object_unparentPaolo Bonzini2014-08-181-1/+1
| | | | | | | | | Explicitly call object_unparent in the few places where we will re-create the memory region. If the memory region is simply being destroyed as part of device teardown, let QOM handle it. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* savevm: Remove all the unneeded version_minimum_id_old (x86)Juan Quintela2014-06-161-3/+0
| | | | | | | | | | | | | | | | | | | | | After previous Peter patch, they are redundant. This way we don't assign them except when needed. Once there, there were lots of case where the ".fields" indentation was wrong: .fields = (VMStateField []) { and .fields = (VMStateField []) { Change all the combinations to: .fields = (VMStateField[]){ The biggest problem (appart from aesthetics) was that checkpatch complained when we copy&pasted the code from one place to another. Signed-off-by: Juan Quintela <quintela@redhat.com> Acked-by: Alexey Kardashevskiy <aik@ozlabs.ru> Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
* misc: Use cpu_physical_memory_read and cpu_physical_memory_writeStefan Weil2014-04-271-17/+14
| | | | | | | | These functions don't need type casts (as does cpu_physical_memory_rw) and also make the code better readable. Signed-off-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
* cpu-exec: Change cpu_resume_from_signal() argument to CPUStateAndreas Färber2014-03-131-1/+1
| | | | Signed-off-by: Andreas Färber <afaerber@suse.de>
* translate-all: Change tb_gen_code() argument to CPUStateAndreas Färber2014-03-131-1/+1
| | | | Signed-off-by: Andreas Färber <afaerber@suse.de>
* translate-all: Change cpu_restore_state() argument to CPUStateAndreas Färber2014-03-131-1/+1
| | | | | | This lets us drop some local variables in tlb_fill() functions. Signed-off-by: Andreas Färber <afaerber@suse.de>
* cpu: Move mem_io_{pc,vaddr} fields from CPU_COMMON to CPUStateAndreas Färber2014-03-131-1/+1
| | | | | | Reset them. Signed-off-by: Andreas Färber <afaerber@suse.de>
* Merge remote-tracking branch 'afaerber/tags/qom-cpu-for-anthony' into stagingAnthony Liguori2014-01-101-5/+3
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | QOM CPUState refactorings / X86CPU * TLB invalidation optimizations * X86CPU initialization cleanups * Preparations for X86CPU hot-unplug # gpg: Signature made Tue 24 Dec 2013 04:51:52 AM PST using RSA key ID 3E7E013F # gpg: Good signature from "Andreas Färber <afaerber@suse.de>" # gpg: aka "Andreas Färber <afaerber@suse.com>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 174F 0347 1BCC 221A 6175 6F96 FA2E D12D 3E7E 013F * afaerber/tags/qom-cpu-for-anthony: target-i386: Cleanup 'foo=val' feature handling target-i386: Cleanup 'foo' feature handling target-i386: Convert 'check' and 'enforce' to static properties target-i386: Convert 'hv_spinlocks' to static property target-i386: Convert 'hv_vapic' to static property target-i386: Convert 'hv_relaxed' to static property cpu-exec: Optimize X86CPU usage in cpu_exec() target-i386: Move apic_state field from CPUX86State to X86CPU cputlb: Tidy memset() of arrays cputlb: Use memset() when flushing entries
| * target-i386: Move apic_state field from CPUX86State to X86CPUChen Fan2013-12-231-5/+3
| | | | | | | | | | | | | | This motion is preparing for refactoring vCPU APIC subsequently. Signed-off-by: Chen Fan <chen.fan.fnst@cn.fujitsu.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
* | sysbus: Set cannot_instantiate_with_device_add_yetMarkus Armbruster2013-12-231-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | device_add plugs devices into suitable bus. For "real" buses, that actually connects the device. For sysbus, the connections need to be made separately, and device_add can't do that. The device would be left unconnected, and could not possibly work. Quite a few, but not all sysbus devices already set cannot_instantiate_with_device_add_yet in their class init function. Set it in their abstract base's class init function sysbus_device_class_init(), and remove the now redundant assignments from device class init functions. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Marcel Apfelbaum <marcel.a@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
* | qdev: Replace no_user by cannot_instantiate_with_device_add_yetMarkus Armbruster2013-12-231-1/+1
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In an ideal world, machines can be built by wiring devices together with configuration, not code. Unfortunately, that's not the world we live in right now. We still have quite a few devices that need to be wired up by code. If you try to device_add such a device, it'll fail in sometimes mysterious ways. If you're lucky, you get an unmysterious immediate crash. To protect users from such badness, DeviceClass member no_user used to make device models unavailable with -device / device_add, but that regressed in commit 18b6dad. The device model is still omitted from help, but is available anyway. Attempts to fix the regression have been rejected with the argument that the purpose of no_user isn't clear, and it's prone to misuse. This commit clarifies no_user's purpose. Anthony suggested to rename it cannot_instantiate_with_device_add_yet_due_to_internal_bugs, which I shorten somewhat to keep checkpatch happy. While there, make it bool. Every use of cannot_instantiate_with_device_add_yet gets a FIXME comment asking for rationale. The next few commits will clean them all up, either by providing a rationale, or by getting rid of the use. With that done, the regression fix is hopefully acceptable. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Marcel Apfelbaum <marcel.a@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
* kvmvapic: Prevent reading beyond the end of guest RAMJan Kiszka2013-10-041-0/+3
| | | | | | | | | | | | | | rom_state_paddr is guest provided (caller address of outw(VAPIC_PORT) + writen 16-bit value) and can be influenced to point beyond the end of the host memory backing the guest's RAM. Make sure we do not use this pointer to actually read beyond the limits. Reading arbitrary guest bytes is harmless, the guest kernel has to manage access to this I/O port anyway. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Gleb Natapov <gleb@redhat.com>
* kvmvapic: Clear also physical ROM address when entering INACTIVE stateJan Kiszka2013-09-201-0/+2
| | | | | | | | | To avoid misinterpreting INACTIVE after migration as old qemu-kvm's STANDBY, also clear rom_state_paddr when going back to this state. CC: qemu-stable@nongnu.org Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* kvmvapic: Enter inactive state on hardware resetJan Kiszka2013-09-201-3/+1
| | | | | | | | | | ROM layout may change after reset of devices are hotplugged, so we have to pick up the physical address again when the ROM is initialized. This is best achieved by resetting the state to INACTIVE. CC: qemu-stable@nongnu.org Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* kvmvapic: Catch invalid ROM sizeJan Kiszka2013-09-201-2/+9
| | | | | | | | | | If not caught early, a zero-length ROM will cause a NULL-pointer access later on in patch_hypercalls when allocating a zero-length ROM copy and trying to read from it. CC: qemu-stable@nongnu.org Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* cpu: Use QTAILQ for CPU listAndreas Färber2013-09-031-1/+1
| | | | | | | Introduce CPU_FOREACH(), CPU_FOREACH_SAFE() and CPU_NEXT() shorthand macros. Signed-off-by: Andreas Färber <afaerber@suse.de>
* kvmvapic: QOM cast cleanupAndreas Färber2013-07-291-2/+2
| | | | Signed-off-by: Andreas Färber <afaerber@suse.de>
* Merge remote-tracking branch 'afaerber/tags/qom-cpu-for-anthony' into stagingAnthony Liguori2013-07-231-37/+41
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | QOM CPUState refactorings * Fix NULL pointer dereference in gdbstub * Introduce vaddr type * Introduce CPUClass::set_pc() * Introduce CPUClass::synchronize_from_tb() * Introduce CPUClass::get_phys_page_debug() * Introduce CPUClass::memory_rw_debug() * Move singlestep_enabled and gdb_regs fields out of CPU_COMMON * Adopt CPUState in more APIs * Propagate CPUState in gdbstub # gpg: Signature made Mon 22 Jul 2013 07:50:17 PM CDT using RSA key ID 3E7E013F # gpg: Can't check signature: public key not found # By Andreas Färber (21) and others # Via Andreas Färber * afaerber/tags/qom-cpu-for-anthony: (24 commits) linux-user: Use X86CPU property to retrieve CPUID family gdbstub: Change gdb_register_coprocessor() argument to CPUState cpu: Move gdb_regs field from CPU_COMMON to CPUState gdbstub: Change GDBState::{c,g}_cpu and find_cpu() to CPUState cpu: Introduce CPUClass::memory_rw_debug() for target_memory_rw_debug() exec: Change cpu_memory_rw_debug() argument to CPUState cpu: Turn cpu_get_phys_page_debug() into a CPUClass hook gdbstub: Change gdb_{read,write}_register() argument to CPUState gdbstub: Change gdb_handlesig() argument to CPUState gdbstub: Change syscall callback argument to CPUState kvm: Change kvm_{insert,remove}_breakpoint() argument to CPUState cpu: Change cpu_single_step() argument to CPUState gdbstub: Update gdb_handlesig() and gdb_signalled() Coding Style cpu: Move singlestep_enabled field from CPU_COMMON to CPUState target-alpha: Copy implver to DisasContext target-alpha: Copy singlestep_enabled to DisasContext cpu: Introduce CPUClass::synchronize_from_tb() for cpu_pc_from_tb() target-unicore32: Implement CPUClass::set_pc() target-moxie: Implement CPUClass::set_pc() target-m68k: Implement CPUClass::set_pc() ...
| * exec: Change cpu_memory_rw_debug() argument to CPUStateAndreas Färber2013-07-231-35/+37
| | | | | | | | | | | | Propagate X86CPU in kvmvapic for simplicity. Signed-off-by: Andreas Färber <afaerber@suse.de>
| * cpu: Turn cpu_get_phys_page_debug() into a CPUClass hookAndreas Färber2013-07-231-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | Change breakpoint_invalidate() argument to CPUState alongside. Since all targets now assign a softmmu-only field, we can drop helpers cpu_class_set_{do_unassigned_access,vmsd}() and device_class_set_vmsd(). Prepares for changing cpu_memory_rw_debug() argument to CPUState. Acked-by: Max Filippov <jcmvbkbc@gmail.com> (for xtensa) Signed-off-by: Andreas Färber <afaerber@suse.de>
* | kvmvapic: Use QOM realizeHu Tao2013-07-231-7/+5
|/ | | | | | Signed-off-by: Hu Tao <hutao@cn.fujitsu.com> [AF: Renamed variable] Signed-off-by: Andreas Färber <afaerber@suse.de>
* cpu: Make first_cpu and next_cpu CPUStateAndreas Färber2013-07-091-5/+8
| | | | | | | | | | | | Move next_cpu from CPU_COMMON to CPUState. Move first_cpu variable to qom/cpu.h. gdbstub needs to use CPUState::env_ptr for now. cpu_copy() no longer needs to save and restore cpu_next. Acked-by: Paolo Bonzini <pbonzini@redhat.com> [AF: Rebased, simplified cpu_copy()] Signed-off-by: Andreas Färber <afaerber@suse.de>
* cpu: Replace cpu_single_env with CPUState current_cpuAndreas Färber2013-07-091-2/+4
| | | | | | Move it to qom/cpu.h. Signed-off-by: Andreas Färber <afaerber@suse.de>
* hw/i*: pass owner to memory_region_init* functionsPaolo Bonzini2013-07-041-3/+3
| | | | Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* memory: add ref/unref callsPaolo Bonzini2013-07-041-0/+1
| | | | | | | | | | | | | | | | | Add ref/unref calls at the following places: - places where memory regions are stashed by a listener and used outside the BQL (including in Xen or KVM). - memory_region_find callsites - creation of aliases and containers (only the aliased/contained region gets a reference to avoid loops) - around calls to del_subregion/add_subregion, where the region could disappear after the first call Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* memory: add owner argument to initialization functionsPaolo Bonzini2013-07-041-2/+2
| | | | Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* kvm: Change cpu_synchronize_state() argument to CPUStateAndreas Färber2013-06-281-2/+2
| | | | | | | | Change Monitor::mon_cpu to CPUState as well. Reviewed-by: liguang <lig.fnst@cn.fujitsu.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
* kvmvapic: add ioport read accessorMarcelo Tosatti2013-05-061-0/+6
| | | | | | | | | | | Necessary since memory region accessor assumes read and write methods are registered. Otherwise reading I/O port 0x7e segfaults. https://bugzilla.redhat.com/show_bug.cgi?id=954306 Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com> Reviewed-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Gleb Natapov <gleb@redhat.com>
* kvmvapic: Make dependency on sysbus.h explicitIgor Mammedov2013-05-011-0/+1
| | | | | | | | | | Allows kvmvapic to compile if sysbus.h is removed from apic_internal.h, from which it is indirectly included. sysbus.h will be removed from apic_internal.h after converting APICs to ICCDevice. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
* kvmvapic: Replace FROM_SYSBUS() with QOM type castIgor Mammedov2013-04-161-2/+5
| | | | | | | | ... and define type name and type cast macro for kvmvapic according to accepted convention. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
* hw: move headers to include/Paolo Bonzini2013-04-081-1/+1
| | | | | | | | | Many of these should be cleaned up with proper qdev-/QOM-ification. Right now there are many catch-all headers in include/hw/ARCH depending on cpu.h, and this makes it necessary to compile these files per-target. However, fixing this does not belong in these patches. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* extract/unify the constant 0xfee00000 as APIC_DEFAULT_ADDRESSLaszlo Ersek2013-04-041-2/+0
| | | | | | | | | | | | | A common dependency of the constant's current users: - hw/apic_common.c - hw/i386/kvmvapic.c - target-i386/cpu.c is "target-i386/cpu.h". Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Anthony Liguori <aliguori@us.ibm.com> Message-id: 1363821803-3380-9-git-send-email-lersek@redhat.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
* i386: move files referencing CPU to hw/i386/Paolo Bonzini2013-03-011-0/+822
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
OpenPOWER on IntegriCloud