Skip to content

Q
qemu

openeuler / qemu

通知 10
Star 0
Fork 0
Q
qemu

体验新版 GitCode，发现更多精彩内容 >>

切换分支/标签
  1. 31 10月, 2014 1 次提交
  3. 27 10月, 2014 2 次提交
  5. 23 10月, 2014 1 次提交
  7. 20 10月, 2014 1 次提交
    • M
      hw: Convert from BlockDriverState to BlockBackend, mostly · 4be74634
      由 Markus Armbruster 提交于 
      Device models should access their block backends only through the
block-backend.h API.  Convert them, and drop direct includes of
inappropriate headers.

Just four uses of BlockDriverState are left:

* The Xen paravirtual block device backend (xen_disk.c) opens images
  itself when set up via xenbus, bypassing blockdev.c.  I figure it
  should go through qmp_blockdev_add() instead.

* Device model "usb-storage" prompts for keys.  No other device model
  does, and this one probably shouldn't do it, either.

* ide_issue_trim_cb() uses bdrv_aio_discard() instead of
  blk_aio_discard() because it fishes its backend out of a BlockAIOCB,
  which has only the BlockDriverState.

* PC87312State has an unused BlockDriverState[] member.

The next two commits take care of the latter two.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NMax Reitz <mreitz@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
      4be74634
  9. 15 10月, 2014 1 次提交
  11. 09 10月, 2014 1 次提交
  13. 30 9月, 2014 8 次提交
  15. 23 9月, 2014 7 次提交
  17. 26 8月, 2014 1 次提交
  19. 29 7月, 2014 1 次提交
  21. 01 7月, 2014 2 次提交
    • C
      virtio-scsi: scsi events must be converted to target endianness · 424baff5
      由 Cédric Le Goater 提交于 
      Virtio SCSI Events need to be byteswapped before being pushed
when host and guest have a different endianness. Not doing so
breaks hotplug of virtio scsi disks, with the following error
message being printed in the guest console:

virtio_scsi: Unsupport virtio scsi event 1000000

This issue got uncovered while testing disk hotplug with a PowerKVM
ppc64le guest. I have checked that this issue also affects a x86_64
guest run on a ppc64 host.
Signed-off-by: NCédric Le Goater <clg@fr.ibm.com>
[ Ported from PowerKVM,
  Greg Kurz <gkurz@linux.vnet.ibm.com> ]
Signed-off-by: NGreg Kurz <gkurz@linux.vnet.ibm.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      424baff5
    • G
      virtio-scsi: virtio_scsi_push_event() lacks VirtIOSCSIReq parsing · dfecbb95
      由 Greg Kurz 提交于 
      Hotplug of a virtio scsi disk is currently broken: no disk appears in the
guest (verified with a fedora 20 host running a fedora 20 guest with KVM).
Bisect leeds to Paolo's patches to support any_layout, especially this
commit:

commit 36b15c79
Author: Paolo Bonzini <pbonzini@redhat.com>
Date:   Tue Jun 10 16:21:18 2014 +0200

    virtio-scsi: start preparing for any_layout

It modifies virtio_scsi_pop_req() so that it is up to the callers to parse
the virtio scsi request. It seems that virtio_scsi_push_event() was not
modified accordingly...

This patch adds a call to virtio_scsi_parse_req(). It also drops some
sanity checks that are already performed by virtio_scsi_parse_req().
Signed-off-by: NGreg Kurz <gkurz@linux.vnet.ibm.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      dfecbb95
  23. 30 6月, 2014 2 次提交
  25. 19 6月, 2014 1 次提交
    • M
      virtio-scsi: define dummy handle_output for vhost-scsi vqs · 91d670fb
      由 Ming Lei 提交于 
      vhost userspace needn't to handle vq's notification from guest,
so define dummy handle_output callback for all vqs of vhost-scsi.

In some corner cases(such as when handling vq's reset from VM), virtio-pci
still trys to handle pending virtio-scsi events, then object check failure
inside virtio_scsi_handle_event() for vhost-scsi can be triggered.

The issue can be reproduced by 'rmmod virtio-scsi', 'system sleep' or reboot
inside VM.

Cc: qemu-stable@nongnu.org
Cc: Anthony Liguori <aliguori@amazon.com>
Cc: "Michael S. Tsirkin" <mst@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NMing Lei <ming.lei@canonical.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      91d670fb
  27. 18 6月, 2014 6 次提交
  29. 05 6月, 2014 1 次提交
  31. 16 5月, 2014 1 次提交
  33. 06 5月, 2014 1 次提交
    • M
      virtio-scsi: fix buffer overrun on invalid state load · 3c3ce981
      由 Michael S. Tsirkin 提交于 
      CVE-2013-4542

hw/scsi/scsi-bus.c invokes load_request.

 virtio_scsi_load_request does:
    qemu_get_buffer(f, (unsigned char *)&req->elem, sizeof(req->elem));

this probably can make elem invalid, for example,
make in_num or out_num huge, then:

    virtio_scsi_parse_req(s, vs->cmd_vqs[n], req);

will do:

    if (req->elem.out_num > 1) {
        qemu_sgl_init_external(req, &req->elem.out_sg[1],
                               &req->elem.out_addr[1],
                               req->elem.out_num - 1);
    } else {
        qemu_sgl_init_external(req, &req->elem.in_sg[1],
                               &req->elem.in_addr[1],
                               req->elem.in_num - 1);
    }

and this will access out of array bounds.

Note: this adds security checks within assert calls since
SCSIBusInfo's load_request cannot fail.
For now simply disable builds with NDEBUG - there seems
to be little value in supporting these.

Cc: Andreas Färber <afaerber@suse.de>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: NJuan Quintela <quintela@redhat.com>
      3c3ce981
  35. 14 3月, 2014 1 次提交
  37. 15 1月, 2014 1 次提交