aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2017-10-17ppc: move '-cpu foo,compat=xxx' parsing into ppc_cpu_parse_featurestr()Igor Mammedov5-52/+59
there is a dedicated callback CPUClass::parse_features which purpose is to convert -cpu features into a set of global properties AND deal with compat/legacy features that couldn't be directly translated into CPU's properties. Create ppc variant of it (ppc_cpu_parse_featurestr) and move 'compat=val' handling from spapr_cpu_core.c into it. That removes a dependency of board/core code on cpu_model parsing and would let to reuse common -cpu parsing introduced by 6063d4c0 Set "max-cpu-compat" property only if it exists, in practice it should limit 'compat' hack to spapr machine and allow to avoid including machine/spapr headers in target/ppc/cpu.c Signed-off-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-10-17ppc: spapr: replace ppc_cpu_parse_features() with cpu_parse_cpu_model()Igor Mammedov3-32/+4
ppc_cpu_parse_features() is doing practically the same thing as generic cpu_parse_cpu_model(). So remove duplicated impl. and reuse generic one. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Greg Kurz <groug@kaod.org> Acked-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-10-17ppc: 40p/prep: replace cpu_model with cpu_typeIgor Mammedov1-8/+4
Signed-off-by: Igor Mammedov <imammedo@redhat.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-10-17ppc: virtex-ml507: replace cpu_model with cpu_typeIgor Mammedov1-7/+4
Signed-off-by: Igor Mammedov <imammedo@redhat.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-10-17ppc: replace cpu_model with cpu_type on ref405ep,taihu boardsIgor Mammedov2-4/+6
Signed-off-by: Igor Mammedov <imammedo@redhat.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-10-17ppc: bamboo: use generic cpu_model parsingIgor Mammedov1-5/+2
Signed-off-by: Igor Mammedov <imammedo@redhat.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-10-17ppc: mac_oldworld: use generic cpu_model parsingIgor Mammedov1-4/+2
Signed-off-by: Igor Mammedov <imammedo@redhat.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-10-17ppc: mac_newworld: use generic cpu_model parsingIgor Mammedov1-9/+6
Signed-off-by: Igor Mammedov <imammedo@redhat.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-10-17ppc: mpc8544ds/e500plat: use generic cpu_model parsingIgor Mammedov3-7/+4
Signed-off-by: Igor Mammedov <imammedo@redhat.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-10-17qom: add helper macro DEFINE_TYPES()Igor Mammedov1-0/+36
DEFINE_TYPES() will help to simplify following routine patterns: static void foo_register_types(void) { type_register_static(&foo1_type_info); type_register_static(&foo2_type_info); ... } type_init(foo_register_types) or static void foo_register_types(void) { int i; for (i = 0; i < ARRAY_SIZE(type_infos); i++) { type_register_static(&type_infos[i]); } } type_init(foo_register_types) with a single line DEFINE_TYPES(type_infos) where types have static definition which could be consolidated in a single array of TypeInfo structures. It saves us ~6-10LOC per use case and would help to replace imperative foo_register_types() there with declarative style of type registration. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-10-17qom: introduce type_register_static_array()Igor Mammedov2-0/+19
it will help to remove code duplication of registration static types in places that have open coded loop to perform batch type registering. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-10-17hw/ppc/spapr.c: abort unplug_request if previous unplug isn't doneDaniel Henrique Barboza1-2/+14
LMB removal is completed only when the spapr_lmb_release callback is called after all DRCs of the dimm are detached. During this time, it is possible that a unplug request for the same dimm arrives, trying to detach DRCs that were detached by the guest in the first unplug_request. BQL doesn't help in this case - the lock will prevent any concurrent removal from happening until the end of spapr_memory_unplug_request only. What happens is that the second unplug_request ends up calling spapr_drc_detach in a DRC that were detached already, causing an assert error in spapr_drc_detach (e.g https://bugs.launchpad.net/qemu/+bug/1718118). spapr_lmb_release uses a structure called sPAPRDIMMState, stored in the spapr->pending_dimm_unplugs QTAIL, to track how many LMB DRCs are left to be detached by the guest. When there are no more DRCs left, this structure is deleted and the pc-dimm unplug handler is called to finish the process. This patch reuses the sPAPRDIMMState to allow unplug_request to know if there is an ongoing unplug process for a given dimm, aborting the unplug request in this case, by doing the following changes: - in spapr_lmb_release callback, move the dimm state removal to the end, after pc-dimm unplug handler. With this change we can check for the existence of the dimm state to see if the unplug process is done. - use spapr_pending_dimm_unplugs_find in spapr_memory_unplug_request to check if the dimm state exists. If positive, there is an unplug operation already in progress for this dimm, meaning that we should abort it and warn the user about it. Fixes: https://bugs.launchpad.net/qemu/+bug/1718118 Signed-off-by: Daniel Henrique Barboza <danielhb@linux.vnet.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-10-17target/ppc: Fix carry flag setting for shift algebraic instructionsSandipan Das2-8/+20
For POWER ISA v3.0, the XER bit CA32 needs to be set by the shift right algebraic instructions whenever the CA bit is to be set. This change affects the following instructions: * Shift Right Algebraic Word (sraw[.]) * Shift Right Algebraic Word Immediate (srawi[.]) * Shift Right Algebraic Doubleword (srad[.]) * Shift Right Algebraic Doubleword Immediate (sradi[.]) Signed-off-by: Sandipan Das <sandipan@linux.vnet.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-10-17target/ppc: Add POWER9 DD2.0 model informationDavid Gibson3-2/+6
At the moment the only POWER9 model which is listed in qemu is v1.0 (aka "DD1"). This is a very early (read, buggy) version which will never be released to the public - it was included in qemu only for the convenience of those doing bringup on the early silicon. For bonus points, we actually had its PVR incorrect in the table (0x004e0000 instead of 0x004e0100). We also never actually implemented the differences in behaviour (read, bugs) that marked DD1 in qemu. Now that we know the PVR for the substantially better v2.0 (DD2) chip, include it and make it the default POWER9 in qemu. For the time being we leave the DD1 definition in place for the poor souls (read, me) who still need to work with DD1 hardware. Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-10-17spapr: sanity check size of the CAS bufferGreg Kurz1-0/+7
The CAS buffer is provided by SLOF. A broken SLOF could pass a silly size: either smaller than the diff header, in which case the current code will try to allocate 16 Exabytes of memory and g_malloc0() will abort, or bigger than the maximum memory provisioned for SLOF (ie, 40 Megabytes), which doesn't make sense. Both cases indicate that SLOF has a bug. Let's print out an explicit error message and exit since rebooting as we do with other errors would only result in a reset loop. Signed-off-by: Greg Kurz <groug@kaod.org> [dwg: Fix format specifier that broke 32-bit builds] Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-10-17spapr: fix OF word name in commentGreg Kurz1-1/+2
Signed-off-by: Greg Kurz <groug@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-10-17target/ppc: Remove unused PPC 460 and 460F definitionsThomas Huth1-217/+0
We don't have any 460 or 460F CPUs in QEMU, so the init functions are just dead code. Let's simply remove them (translate_init.c is already big enough without them). Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-10-17hw/ppc: use 0 instead of fdt_path_offset(fdt, "/")Greg Kurz2-4/+2
The offset of the root node is guaranteed to be 0. This doesn't fix anything, it's just trivial cleanup of the two remaining places where this was done under hw/ppc. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Daniel Henrique Barboza <danielhb@linux.vnet.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-10-17macio: add missing registers to VMStateDescriptionMark Cave-Ayland1-1/+3
Commit 4f7265f "ppc/ide/macio: Add missing registers" added two extra macio registers but forgot to add them to the corresponding VMStateDescription. The version number is bumped accordingly, although this will have little effect given that the Mac machines are practically unmigratable. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Acked-by: John Snow <jsnow@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-10-16Add myself as maintainer for TPM codeStefan Berger1-1/+3
Also add backends/tpm.c to the list of files. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Acked-by: Markus Armbruster <armbru@redhat.com> Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2017-10-16filter-mirror: segfault when specifying non existent deviceEduardo Otubo1-0/+6
When using filter-mirror like the example below where the interface 'ndev0' does not exist on the host, QEMU crashes into segmentation fault. $ qemu-system-x86_64 -S -machine pc -netdev user,id=ndev0 -object filter-mirror,id=test-object,netdev=ndev0 This happens because the function filter_mirror_setup() does not check if the device actually exists and still keep on processing calling qemu_chr_find(). This patch fixes this issue. Signed-off-by: Eduardo Otubo <otubo@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2017-10-16MAINTAINERS: Track default-configs/pci.makFam Zheng1-0/+1
Suggested-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2017-10-16MAINTAINERS: Fix Sun4v fileFam Zheng1-1/+1
Suggested-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Fam Zheng <famz@redhat.com> Acked-By: Artyom Tarasenko <atar4qemu@gmail.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2017-10-16MAINTAINERS: Clean up SCSI device sectionFam Zheng1-6/+0
1. Remove nonexistent file util/scsi*. 2. Drop useless section for LSI53C895A. 3. Leave include/scsi to "Block SCSI subsystem" section. Suggested-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2017-10-16include/hw/or-irq.h: Drop unused in_irqs fieldPeter Maydell1-1/+0
The struct OrIRQState has an unused member field in_irqs. This is a legacy of earlier versions of the patch; the code that used it was dropped from the final version of the code that went into master, but we forgot to delete the no-longer-used struct field. Do so now. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@xilinx.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2017-10-16io: Add missing GCC_FMT_ATTR (fix -Werror=suggest-attribute=format)Stefan Weil1-3/+4
This fixes a compiler warning: /qemu/io/channel-websock.c:163:5: error: function might be possible candidate for ‘gnu_printf’ format attribute [-Werror=suggest-attribute=format] Signed-off-by: Stefan Weil <sw@weilnetz.de> Acked-by: Daniel P. Berrange <berrange@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2017-10-16os-posix: Drop misleading commentMarkus Armbruster1-1/+0
Comments explaining why we include a header tend to go bad. This one's almost comical: not only doesn't qemu-options.hx use MAP_POPULATE anymore (since commit ef36fa1, v2.0.0, 2013), even the include it applies to got moved away in commit 02d0e09 (v2.7.0). Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2017-10-16linux-user: Add some random ioctlsMarco A L Barbosa3-0/+13
Signed-off-by: Marco A L Barbosa <malbarbo@gmail.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2017-10-16futex: add missing header guardsEmilio G. Cota1-0/+5
The header file was introduced by fbcc3e5 ("qemu-thread: optimize QemuLockCnt with futexes on Linux", 2017-01-16) without header guards. Add them. Signed-off-by: Emilio G. Cota <cota@braap.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2017-10-16ui/gtk: Fix deprecation of vte_terminal_copy_clipboardAnthony PERARD1-0/+5
vte_terminal_copy_clipboard() is deprecated in VTE 0.50. Signed-off-by: Anthony PERARD <anthony.perard@citrix.com> Reviewed-by: Daniel P. Berrange <berrange@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2017-10-16gitignore: ignore check-qlit testCarlo Marcelo Arenas Belón1-0/+1
test introduced in 382176b4d78e070d119af8e0dcd00884c11bbec2 Signed-off-by: Carlo Marcelo Arenas Belón <carenas@gmail.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2017-10-16linux-user: remove duplicate break in syscallCarlo Marcelo Arenas Belón1-1/+0
likely introduced in 3532fa7402cda16f7b95261b0339c58630051f0b Signed-off-by: Carlo Marcelo Arenas Belón <carenas@gmail.com> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2017-10-16qemu-doc.texi: remove trailing whitespaceMichael Tokarev1-1/+1
Remove trailing whitespace in qemu-doc.texi, as it causes reproducibility issues depending on the echo implementation used by the Makefile. Reported-By: Vagrant Cascadian <vagrant@debian.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-10-16Merge remote-tracking branch 'remotes/huth/tags/pull-request-2017-10-16' ↵Peter Maydell14-27/+32
into staging Some m68k, qtest and config improvements # gpg: Signature made Mon 16 Oct 2017 13:38:03 BST # gpg: using RSA key 0x2ED9D774FE702DB5 # gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" # gpg: aka "Thomas Huth <thuth@redhat.com>" # gpg: aka "Thomas Huth <huth@tuxfamily.org>" # gpg: aka "Thomas Huth <th.huth@posteo.de>" # Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5 * remotes/huth/tags/pull-request-2017-10-16: default-configs: Enable CONFIG_VMXNET3_PCI only on x86 tests/prom-env: Bump the timeout, and test pseries only in slow mode tests: use g_new() family of functions M68K: use g_new() family of functions hw/m68k: Replace fprintf(stderr, "*\n" with error_report() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-10-16Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell100-159/+985
pc, pci, virtio: fixes, features A bunch of fixes all over the place. A new vmcore device - the user interface around it is still somewhat controversial, but I feel most of the code is fine, suggestions can be addressed by adding patches on top. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Sun 15 Oct 2017 04:02:23 BST # gpg: using RSA key 0x281F0DB8D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: (26 commits) tests/pxe: Test more NICs when running in SPEED=slow mode pc: remove useless hot_add_cpu initialisation isapc: Remove unnecessary migration compatibility code virtio-pci: Replace modern_as with direct access to modern_bar virtio: fix descriptor counting in virtqueue_pop hw/gen_pcie_root_port: make IO RO 0 on IO disabled pci: Validate interfaces on base_class_init xen/pt: Mark TYPE_XEN_PT_DEVICE as hybrid pci: Add INTERFACE_CONVENTIONAL_PCI_DEVICE to Conventional PCI devices pci: Add INTERFACE_PCIE_DEVICE to all PCIe devices pci: Add interface names to hybrid PCI devices pci: conventional-pci-device and pci-express-device interfaces PCI: PCIe access should always be little endian virtio/pci/migration: Convert to VMState hw/pci-bridge/pcie_pci_bridge: properly handle MSI unavailability case pci: allow 32-bit PCI IO accesses to pass through the PCI bridge virtio/vhost: reset dev->log after syncing MAINTAINERS: add Dump maintainers scripts/dump-guest-memory.py: add vmcoreinfo kdump: set vmcoreinfo location ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-10-16target/i386: trap on instructions longer than >15 bytesPaolo Bonzini1-7/+22
Besides being more correct, arbitrarily long instruction allow the generation of a translation block that spans three pages. This confuses the generator and even allows ring 3 code to poison the translation block cache and inject code into other processes that are in guest ring 3. This is an improved (and more invasive) fix for commit 30663fd ("tcg/i386: Check the size of instruction being translated", 2017-03-24). In addition to being more precise (and generating the right exception, which is #GP rather than #UD), it distinguishes better between page faults and too long instructions, as shown by this test case: #include <sys/mman.h> #include <string.h> #include <stdio.h> int main() { char *x = mmap(NULL, 8192, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANON, -1, 0); memset(x, 0x66, 4096); x[4096] = 0x90; x[4097] = 0xc3; char *i = x + 4096 - 15; mprotect(x + 4096, 4096, PROT_READ|PROT_WRITE); ((void(*)(void)) i) (); } ... which produces a #GP without the mprotect, and a #PF with it. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-10-16target/i386: introduce x86_ld*_codePaolo Bonzini1-103/+125
These take care of advancing s->pc, and will provide a unified point where to check for the 15-byte instruction length limit. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-10-16tco: add trace eventsPaolo Bonzini2-2/+13
Add trace events to the PCH watchdog timer, it can be useful to see how the guest is using it. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <1507816448-86665-1-git-send-email-pbonzini@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-10-16docs/devel/loads-stores.rst: Document our various load and store APIsPeter Maydell1-0/+396
QEMU has a wide selection of different functions for doing loads and stores; provide some overview documentation of what they do and how to pick which one to use. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Eric Blake <eblake@redhat.com> Message-Id: <1507813181-11860-1-git-send-email-peter.maydell@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-10-16nios2: define tcg_envPaolo Bonzini1-0/+1
This should be done by all target and, since commit 53f6672bcf ("gen-icount: use tcg_ctx.tcg_env instead of cpu_env", 2017-06-30), is causing the NIOS2 target to hang. This is because the test for "should I exit to the main loop" was being done with the correct offset to the icount decrementer, but using TCG temporary 0 (the frame pointer) rather than the env pointer. Cc: qemu-stable@nongnu.org Cc: Marek Vasut <marex@denx.de> Reported-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-10-16build: remove CONFIG_LIBDECNUMBERPaolo Bonzini10-13/+6
It is used by all PPC targets; we can give the directory its own Makefile.objs file, and include it directly from target/ppc. target/s390 can do the same when it starts using it. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-10-16io: fix mem leak in websock error pathDaniel P. Berrange1-1/+2
Coverity pointed out the 'date' is not free()d in the error path Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2017-10-16io: add trace points for websocket HTTP protocol headersDaniel P. Berrange2-0/+6
Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2017-10-16io: cope with websock 'Connection' header having multiple valuesDaniel P. Berrange1-1/+13
The noVNC server sends a header "Connection: keep-alive, Upgrade" which fails our simple equality test. Split the header on ',', trim whitespace and then check for 'upgrade' token. Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2017-10-16io: get rid of bounce buffering in websock write pathDaniel P. Berrange2-37/+28
Currently most outbound I/O on the websock channel gets copied into the rawoutput buffer, and then immediately copied again into the encoutput buffer, with a header prepended. Now that qio_channel_websock_encode accepts a struct iovec, we can trivially remove this bounce buffering and write directly to encoutput. In doing so, we also now correctly validate the encoutput size against the QIO_CHANNEL_WEBSOCK_MAX_BUFFER limit. Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2017-10-16io: pass a struct iovec into qio_channel_websock_encodeDaniel P. Berrange1-27/+44
Instead of requiring use of another Buffer, pass a struct iovec into qio_channel_websock_encode, which gives callers more flexibility in how they process data. Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2017-10-16io: get rid of qio_channel_websock_encode helper methodDaniel P. Berrange1-14/+6
The qio_channel_websock_encode method is only used in one place, everything else calls qio_channel_websock_encode_buffer directly. It can also be pushed up a level into the qio_channel_websock_writev method, since every other caller of qio_channel_websock_write_wire has already filled encoutput. Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2017-10-16io: simplify websocket ping reply handlingDaniel P. Berrange2-14/+16
We must ensure we don't get flooded with ping replies if the outbound channel is slow. Currently we do this by keeping the ping reply in a separate temporary buffer and only writing it if the encoutput buffer is completely empty. This is overly pessimistic, as it is reasonable to add a ping reply to the encoutput buffer even if it has previous data in it, as long as that previous data doesn't include a ping reply. To track this better, put the ping reply directly into the encoutput buffer, and then record the size of encoutput at this time in pong_remain. As we write encoutput to the underlying channel, we can decrement the pong_remain counter. Once it hits zero, we can accept further ping replies for transmission. Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2017-10-16io: monitor encoutput buffer size from websocket GSourceDaniel P. Berrange1-2/+2
The websocket GSource is monitoring the size of the rawoutput buffer to determine if the channel can accepts more writes. The rawoutput buffer, however, is merely a temporary staging buffer before data is copied into the encoutput buffer. Thus its size will always be zero when the GSource runs. This flaw causes the encoutput buffer to grow without bound if the other end of the underlying data channel doesn't read data being sent. This can be seen with VNC if a client is on a slow WAN link and the guest OS is sending many screen updates. A malicious VNC client can act like it is on a slow link by playing a video in the guest and then reading data very slowly, causing QEMU host memory to expand arbitrarily. This issue is assigned CVE-2017-15268, publically reported in https://bugs.launchpad.net/qemu/+bug/1718964 Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2017-10-16sockets: Handle race condition between binds to the same portKnut Omang1-17/+41
If an offset of ports is specified to the inet_listen_saddr function(), and two or more processes tries to bind from these ports at the same time, occasionally more than one process may be able to bind to the same port. The condition is detected by listen() but too late to avoid a failure. This function is called by socket_listen() and used by all socket listening code in QEMU, so all cases where any form of dynamic port selection is used should be subject to this issue. Add code to close and re-establish the socket when this condition is observed, hiding the race condition from the user. Also clean up some issues with error handling to allow more accurate reporting of the cause of an error. This has been developed and tested by means of the test-listen unit test in the previous commit. Enable the test for make check now that it passes. Reviewed-by: Bhavesh Davda <bhavesh.davda@oracle.com> Reviewed-by: Yuval Shaia <yuval.shaia@oracle.com> Reviewed-by: Girish Moodalbail <girish.moodalbail@oracle.com> Signed-off-by: Knut Omang <knut.omang@oracle.com> Reviewed-by: Daniel P. Berrange <berrange@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
generated by cgit v1.1 at 2025-02-06 08:28:33 +0000