- 01 7月, 2014 2 次提交
-
-
由 Stefan Hajnoczi 提交于
virtio-blk-pci, virtio-blk-s390, and virtio-blk-ccw all duplicate the qdev properties of their VirtIOBlock child. This approach does not work well with string or pointer properties since we must be careful about leaking or double-freeing them. Use the QOM alias property to forward property accesses to the VirtIOBlock child. This way no duplication is necessary. Remember to stop calling virtio_blk_set_conf() so that we don't clobber the values already set on the VirtIOBlock instance. Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com> Reviewed-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
-
由 Stefan Hajnoczi 提交于
Move the x-data-plane property. Originally it was outside since not every transport may wish to support dataplane. But that makes little sense when we have a dedicated CONFIG_VIRTIO_BLK_DATA_PLANE ifdef already. This move makes it easier to switch to property aliases in the next patch. Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com> Reviewed-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
-
- 30 6月, 2014 9 次提交
-
-
由 Rusty Russell 提交于
Signed-off-by: NRusty Russell <rusty@rustcorp.com.au> Reviewed-by: NAnthony Liguori <aliguori@us.ibm.com> [ pass VirtIODevice * to memory accessors, Greg Kurz <gkurz@linux.vnet.ibm.com> ] Signed-off-by: NGreg Kurz <gkurz@linux.vnet.ibm.com> Reviewed-by: NAlexander Graf <agraf@suse.de> Reviewed-by: NMichael S. Tsirkin <mst@redhat.com> Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
-
由 Rusty Russell 提交于
Quoting original text from Rusty: "This is based on a simpler patch by Anthony Liguouri". Signed-off-by: NRusty Russell <rusty@rustcorp.com.au> [ add VirtIODevice * argument to most helpers, Greg Kurz <gkurz@linux.vnet.ibm.com> ] Signed-off-by: NGreg Kurz <gkurz@linux.vnet.ibm.com> Reviewed-by: NThomas Huth <thuth@linux.vnet.ibm.com> Reviewed-by: NAlexander Graf <agraf@suse.de> Reviewed-by: NMichael S. Tsirkin <mst@redhat.com> Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
-
由 Greg Kurz 提交于
Some CPU families can dynamically change their endianness. This means we can have little endian ppc or big endian arm guests for example. This has an impact on legacy virtio data structures since they are target endian. We hence introduce a new property to track the endianness of each virtio device. It is reasonnably assumed that endianness won't change while the device is in use : we hence capture the device endianness when it gets reset. We migrate this property in a subsection, after the device descriptor. This means the load code must not rely on it until it is restored. As a consequence, the vring sanity checks had to be moved after the call to vmstate_load_state(). We enforce paranoia by poisoning the property at the begining of virtio_load(). Signed-off-by: NGreg Kurz <gkurz@linux.vnet.ibm.com> Reviewed-by: NMichael S. Tsirkin <mst@redhat.com> Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
-
由 Greg Kurz 提交于
We currently have a virtio_is_big_endian() helper that provides the target endianness to the virtio code. As of today, the helper returns a fixed compile-time value. Of course, this will have to change if we want to support target endianness changes at run-time. Let's move the TARGET_WORDS_BIGENDIAN bits out to a new helper and have virtio_is_big_endian() implemented on top of it. This patch doesn't change any functionality. Signed-off-by: NGreg Kurz <gkurz@linux.vnet.ibm.com> Reviewed-by: NMichael S. Tsirkin <mst@redhat.com> Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
-
由 Greg Kurz 提交于
There is a need to add some more fields to VirtIODevice that should be migrated (broken status, endianness). The problem is that we do not want to break compatibility while adding a new feature... This issue has been addressed in the generic VMState code with the use of optional subsections. As a *temporary* alternative to port the whole virtio migration code to VMState, this patch mimics a similar subsectionning ability for virtio, using the VMState code. Since each virtio device is streamed in its own section, the idea is to stream subsections between the end of the device section and the start of the next sections. This allows an older QEMU to complain and exit when fed with subsections: Unknown savevm section type 5 load of migration failed Suggested-by: NAlexander Graf <agraf@suse.de> Signed-off-by: NGreg Kurz <gkurz@linux.vnet.ibm.com> Reviewed-by: NAlexander Graf <agraf@suse.de> Reviewed-by: NMichael S. Tsirkin <mst@redhat.com> Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
-
由 Greg Kurz 提交于
While we are here, we also check virtio_load() return value. Signed-off-by: NGreg Kurz <gkurz@linux.vnet.ibm.com> Reviewed-by: NAlexander Graf <agraf@suse.de> Reviewed-by: NMichael S. Tsirkin <mst@redhat.com> Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
-
由 Greg Kurz 提交于
Signed-off-by: NGreg Kurz <gkurz@linux.vnet.ibm.com> Reviewed-by: NAlexander Graf <agraf@suse.de> Reviewed-by: NMichael S. Tsirkin <mst@redhat.com> Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
-
由 Greg Kurz 提交于
In order to migrate virtio subsections, they should be streamed after the device itself. We need the device specific code to be called from the common migration code to achieve this. This patch introduces load and save methods for this purpose. Suggested-by: NAndreas Färber <afaerber@suse.de> Signed-off-by: NGreg Kurz <gkurz@linux.vnet.ibm.com> Reviewed-by: NAlexander Graf <agraf@suse.de> Reviewed-by: NMichael S. Tsirkin <mst@redhat.com> Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
-
由 Damjan Marion 提交于
Old code was affected by memory gaps which resulted in buffer pointers pointing to address outside of the mapped regions. Here we are introducing following changes: - new function qemu_get_ram_block_host_ptr() returns host pointer to the ram block, it is needed to calculate offset of specific region in the host memory - new field mmap_offset is added to the VhostUserMemoryRegion. It contains offset where specific region starts in the mapped memory. As there is stil no wider adoption of vhost-user agreement was made that we will not bump version number due to this change - other fileds in VhostUserMemoryRegion struct are not changed, as they are all needed for usermode app implementation - region data is not taken from ram_list.blocks anymore, instead we use region data which is alredy calculated for use in vhost-net - Now multiple regions can have same FD and user applicaton can call mmap() multiple times with the same FD but with different offset (user needs to take care for offset page alignment) Signed-off-by: NDamjan Marion <damarion@cisco.com> Acked-by: NMichael S. Tsirkin <mst@redhat.com> Signed-off-by: NMichael S. Tsirkin <mst@redhat.com> Signed-off-by: NDamjan Marion <damarion@cisco.com>
-
- 29 6月, 2014 1 次提交
-
-
由 Dr. David Alan Gilbert 提交于
Commit 'virtio: validate config_len on load' restricted config_len loaded from the wire to match the config_len that the device had. Unfortunately, there are cases where this isn't true, the one we found it on was the wce addition in virtio-blk. Allow mismatched config-lengths: *) If the version on the wire is shorter then fine *) If the version on the wire is longer, load what we have space for and skip the rest. (This is mst@redhat.com's rework of what I originally posted) Signed-off-by: NDr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: NMichael S. Tsirkin <mst@redhat.com> Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
-
- 23 6月, 2014 4 次提交
-
-
由 Wenchao Xia 提交于
Signed-off-by: NWenchao Xia <wenchaoqemu@gmail.com> Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com> Reviewed-by: NEric Blake <eblake@redhat.com> Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>
-
由 Fam Zheng 提交于
Currently vectors silently cleared to 0 if the initialization is failed, but user should at least have one way to notice this. Signed-off-by: NFam Zheng <famz@redhat.com> Reviewed-by: NMichael S. Tsirkin <mst@redhat.com> Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
-
由 Michael S. Tsirkin 提交于
vhost_verify_ring_mappings leaks mappings on error. Fix this up. Cc: qemu-stable@nongnu.org Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
-
由 Michael S. Tsirkin 提交于
vhost user does not support LOG_ALL feature bit. Generally, we should not try to set this bit without checking that backend can support it first. Detect and block migration. Signed-off-by: NMichael S. Tsirkin <mst@redhat.com> Signed-off-by: NNikolay Nikolaev <n.nikolaev@virtualopensystems.com> Reviewed-by: NMichael S. Tsirkin <mst@redhat.com> Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
-
- 19 6月, 2014 7 次提交
-
-
由 Nikolay Nikolaev 提交于
The initialization takes a chardev backed by a unix domain socket. It should implement qemu_fe_set_msgfds in order to be able to pass file descriptors to the remote process. Each ioctl request of vhost-kernel has a vhost-user message equivalent, which is sent over the control socket. The general approach is to copy the data from the supplied argument pointer to a designated field in the message. If a file descriptor is to be passed it will be placed in the fds array for inclusion in the sendmsg control header. VHOST_SET_MEM_TABLE ignores the supplied vhost_memory structure and scans the global ram_list for ram blocks with a valid fd field set. This would be set when the '-object memory-file' option with share=on property is used. Signed-off-by: NAntonios Motakis <a.motakis@virtualopensystems.com> Signed-off-by: NNikolay Nikolaev <n.nikolaev@virtualopensystems.com> Reviewed-by: NMichael S. Tsirkin <mst@redhat.com> Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
-
由 Nikolay Nikolaev 提交于
Use vhost_set_backend_type to initialise a proper vhost_ops structure. In vhost_net_init and vhost_net_start_one call conditionally TAP related initialisation depending on the vhost backend type. Signed-off-by: NAntonios Motakis <a.motakis@virtualopensystems.com> Signed-off-by: NNikolay Nikolaev <n.nikolaev@virtualopensystems.com> Reviewed-by: NMichael S. Tsirkin <mst@redhat.com> Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
-
由 Nikolay Nikolaev 提交于
Decouple vhost from the Linux kernel by introducing vhost_ops. The intention is to provide different backends - a 'kernel' backend based on the ioctl interface, and an 'user' backend based on a UNIX domain socket and shared memory interface. Signed-off-by: NAntonios Motakis <a.motakis@virtualopensystems.com> Signed-off-by: NNikolay Nikolaev <n.nikolaev@virtualopensystems.com> Reviewed-by: NMichael S. Tsirkin <mst@redhat.com> Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
-
由 Nikolay Nikolaev 提交于
vhost_dev_init will replace devfd and devpath with a single opaque argument. This is initialised with a file descriptor. When TAP is used (through vhost_net), open /dev/vhost-net and pass the fd as an opaque parameter in VhostNetOptions. The same applies to vhost-scsi - open /dev/vhost-scsi and pass the fd. Signed-off-by: NAntonios Motakis <a.motakis@virtualopensystems.com> Signed-off-by: NNikolay Nikolaev <n.nikolaev@virtualopensystems.com> Reviewed-by: NMichael S. Tsirkin <mst@redhat.com> Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
-
由 Nikolay Nikolaev 提交于
Generalize the features get/ack to be used for both vhost-net and vhost-scsi. In vhost-net add vhost_net_get_feature_bits to select the feature bit set depending on the NetClient kind. Signed-off-by: NNikolay Nikolaev <n.nikolaev@virtualopensystems.com> Reviewed-by: NMichael S. Tsirkin <mst@redhat.com> Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
-
由 Markus Armbruster 提交于
Signed-off-by: NMarkus Armbruster <armbru@redhat.com> Reviewed-by: NMichael S. Tsirkin <mst@redhat.com> Signed-off-by: NMichael S. Tsirkin <mst@redhat.com> Reviewed-by: NEric Blake <eblake@redhat.com>
-
由 Markus Armbruster 提交于
Signed-off-by: NMarkus Armbruster <armbru@redhat.com> Reviewed-by: NMichael S. Tsirkin <mst@redhat.com> Signed-off-by: NMichael S. Tsirkin <mst@redhat.com> Reviewed-by: NEric Blake <eblake@redhat.com>
-
- 11 6月, 2014 2 次提交
-
-
由 Natanael Copa 提交于
Avoid using the GNU extesion ffsl which is not implemented in musl libc. The atomic_xchg() means we know that vhost_log_chunk_t will never be larger than the 'long' type, so ctzl() is always sufficient. See also commit fbeadf50 (bitops: unify bitops_ffsl with the one in host-utils.h, call it bitops_ctzl) on why ctzl should be used instead of ffsl. Signed-off-by: NNatanael Copa <ncopa@alpinelinux.org> Reviewed-by: NPaolo Bonzini <pbonzini@redhat.com> Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
-
由 Michael Tokarev 提交于
Suggested-by: NPeter Maydell <peter.maydell@linaro.org> Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>
-
- 25 5月, 2014 1 次提交
-
-
由 Ján Tomko 提交于
If the guest hasn't updated the stats yet, instead of returning an error, return '-1' for the stats and '0' as 'last-update'. This lets applications ignore this without parsing the error message. Related libvirt patch and discussion: https://www.redhat.com/archives/libvir-list/2014-May/msg00460.html Tested against current upstream libvirt - stat reporting works and it no longer logs errors when the stats are queried on domain startup. (Note: libvirt doesn't use the last-update field for anything yet) Signed-off-by: NJán Tomko <jtomko@redhat.com> Reviewed-by: NMichael S. Tsirkin <mst@redhat.com> Signed-off-by: NMichael S. Tsirkin <mst@redhat.com> Reviewed-by: NEric Blake <eblake@redhat.com>
-
- 16 5月, 2014 2 次提交
-
-
由 Markus Armbruster 提交于
We commonly use the error API like this: err = NULL; foo(..., &err); if (err) { goto out; } bar(..., &err); Every error source is checked separately. The second function is only called when the first one succeeds. Both functions are free to pass their argument to error_set(). Because error_set() asserts no error has been set, this effectively means they must not be called with an error set. The qapi-generated code uses the error API differently: // *errp was initialized to NULL somewhere up the call chain frob(..., errp); gnat(..., errp); Errors accumulate in *errp: first error wins, subsequent errors get dropped. To make this work, the second function does nothing when called with an error set. Requires non-null errp, or else the second function can't see the first one fail. This usage has also bled into visitor tests, and two device model object property getters rtc_get_date() and balloon_stats_get_all(). With the "accumulate" technique, you need fewer error checks in callers, and buy that with an error check in every callee. Can be nice. However, mixing the two techniques is confusing. You can't use the "accumulate" technique with functions designed for the "check separately" technique. You can use the "check separately" technique with functions designed for the "accumulate" technique, but then error_set() can't catch you setting an error more than once. Standardize on the "check separately" technique for now, because it's overwhelmingly prevalent. Signed-off-by: NMarkus Armbruster <armbru@redhat.com> Reviewed-by: NEric Blake <eblake@redhat.com> Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>
-
由 Markus Armbruster 提交于
When visit_start_struct() fails, visit_end_struct() must not be called. rtc_get_date() and balloon_stats_all() call it anyway. As far as I can tell, they're only used with the string output visitor, which doesn't care. Fix them anyway. Signed-off-by: NMarkus Armbruster <armbru@redhat.com> Reviewed-by: NEric Blake <eblake@redhat.com> Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>
-
- 12 5月, 2014 1 次提交
-
-
由 Michael S. Tsirkin 提交于
It's a loop from i < num_sg and the array is VIRTQUEUE_MAX_SIZE - so it's OK if the value read is VIRTQUEUE_MAX_SIZE. Not a big problem in practice as people don't use such big queues, but it's inelegant. Reported-by: N"Dr. David Alan Gilbert" <dgilbert@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
-
- 06 5月, 2014 5 次提交
-
-
由 Michael S. Tsirkin 提交于
Malformed input can have config_len in migration stream exceed the array size allocated on destination, the result will be heap overflow. To fix, that config_len matches on both sides. CVE-2014-0182 Reported-by: N"Dr. David Alan Gilbert" <dgilbert@redhat.com> Signed-off-by: NMichael S. Tsirkin <mst@redhat.com> Signed-off-by: NJuan Quintela <quintela@redhat.com> -- v2: use %ix and %zx to print config_len values Signed-off-by: NJuan Quintela <quintela@redhat.com>
-
由 Michael S. Tsirkin 提交于
CVE-2013-4535 CVE-2013-4536 Both virtio-block and virtio-serial read, VirtQueueElements are read in as buffers, and passed to virtqueue_map_sg(), where num_sg is taken from the wire and can force writes to indicies beyond VIRTQUEUE_MAX_SIZE. To fix, validate num_sg. Reported-by: NMichael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: NMichael S. Tsirkin <mst@redhat.com> Cc: Amit Shah <amit.shah@redhat.com> Signed-off-by: NJuan Quintela <quintela@redhat.com>
-
由 Michael Roth 提交于
CVE-2013-6399 vdev->queue_sel is read from the wire, and later used in the emulation code as an index into vdev->vq[]. If the value of vdev->queue_sel exceeds the length of vdev->vq[], currently allocated to be VIRTIO_PCI_QUEUE_MAX elements, subsequent PIO operations such as VIRTIO_PCI_QUEUE_PFN can be used to overrun the buffer with arbitrary data originating from the source. Fix this by failing migration if the value from the wire exceeds VIRTIO_PCI_QUEUE_MAX. Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: NMichael S. Tsirkin <mst@redhat.com> Reviewed-by: NPeter Maydell <peter.maydell@linaro.org> Signed-off-by: NJuan Quintela <quintela@redhat.com>
-
由 Michael S. Tsirkin 提交于
CVE-2013-4151 QEMU 1.0 out-of-bounds buffer write in virtio_load@hw/virtio/virtio.c So we have this code since way back when: num = qemu_get_be32(f); for (i = 0; i < num; i++) { vdev->vq[i].vring.num = qemu_get_be32(f); array of vqs has size VIRTIO_PCI_QUEUE_MAX, so on invalid input this will write beyond end of buffer. Signed-off-by: NMichael S. Tsirkin <mst@redhat.com> Reviewed-by: NMichael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: NJuan Quintela <quintela@redhat.com>
-
由 Markus Armbruster 提交于
Using error_is_set(ERRP) to find out whether a function failed is either wrong, fragile, or unnecessarily opaque. It's wrong when ERRP may be null, because errors go undetected when it is. It's fragile when proving ERRP non-null involves a non-local argument. Else, it's unnecessarily opaque (see commit 84d18f06). I guess the error_is_set(errp) in the ObjectProperty set() methods are merely fragile right now, because I can't find a call chain that passes a null errp argument. Make the code more robust and more obviously correct: receive the error in a local variable, then propagate it through the parameter. Signed-off-by: NMarkus Armbruster <armbru@redhat.com> Signed-off-by: NAndreas Färber <afaerber@suse.de>
-
- 20 3月, 2014 3 次提交
-
-
由 Stefan Hajnoczi 提交于
QOM child properties take a reference to the object and release it when the property is deleted. Therefore we should unref the default_backend after we have added it as a child property. Cc: KONRAD Frederic <fred.konrad@greensocs.com> Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com> Reviewed-by: NPaolo Bonzini <pbonzini@redhat.com> Signed-off-by: NAndreas Färber <afaerber@suse.de>
-
由 Stefan Hajnoczi 提交于
There are currently three types of object_property_add_link() callers: 1. The link property may be set at any time. 2. The link property of a DeviceState instance may only be set before realize. 3. The link property may never be set, it is read-only. Something similar can already be achieved with object_property_add_str()'s set() argument. Follow its example and add a check() argument to object_property_add_link(). Also provide default check() functions for case #1 and #2. Case #3 is covered by passing a NULL function pointer. Cc: Peter Crosthwaite <peter.crosthwaite@petalogix.com> Cc: Alexander Graf <agraf@suse.de> Cc: Anthony Liguori <aliguori@amazon.com> Cc: "Michael S. Tsirkin" <mst@redhat.com> Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com> Reviewed-by: NPaolo Bonzini <pbonzini@redhat.com> [AF: Tweaked documentation comment] Signed-off-by: NAndreas Färber <afaerber@suse.de>
-
由 Stefan Hajnoczi 提交于
Some object_property_add_link() callers expect property deletion to unref the link property object. Other callers expect to manage the refcount themselves. The former are currently broken and therefore leak the link property object. This patch adds a flags argument to object_property_add_link() so the caller can specify which refcount behavior they require. The new OBJ_PROP_LINK_UNREF_ON_RELEASE flag causes the link pointer to be unreferenced when the property is deleted. This fixes refcount leaks in qdev.c, xilinx_axidma.c, xilinx_axienet.c, s390-virtio-bus.c, virtio-pci.c, virtio-rng.c, and ui/console.c. Rationale for refcount behavior: * hw/core/qdev.c - bus children are explicitly unreferenced, don't interfere - parent_bus is essentially a read-only property that doesn't hold a refcount, don't unref - hotplug_handler is leaked, do unref * hw/dma/xilinx_axidma.c - rx stream "dma" links are set using set_link, therefore they need unref - tx streams are set using set_link, therefore they need unref * hw/net/xilinx_axienet.c - same reasoning as hw/dma/xilinx_axidma.c * hw/pcmcia/pxa2xx.c - pxa2xx bypasses set_link and therefore does not use refcounts * hw/s390x/s390-virtio-bus.c * hw/virtio/virtio-pci.c * hw/virtio/virtio-rng.c * ui/console.c - set_link is used and there is no explicit unref, do unref Cc: Peter Crosthwaite <peter.crosthwaite@petalogix.com> Cc: Alexander Graf <agraf@suse.de> Cc: Anthony Liguori <aliguori@amazon.com> Cc: "Michael S. Tsirkin" <mst@redhat.com> Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com> Reviewed-by: NPaolo Bonzini <pbonzini@redhat.com> Signed-off-by: NAndreas Färber <afaerber@suse.de>
-
- 15 2月, 2014 1 次提交
-
-
由 Paolo Bonzini 提交于
Replace them with uint8/32/64. Reviewed-by: NIgor Mammedov <imammedo@redhat.com> Reviewed-by: NEric Blake <eblake@redhat.com> Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com> Signed-off-by: NAndreas Färber <afaerber@suse.de>
-
- 11 2月, 2014 2 次提交
-
-
由 Edgar E. Iglesias 提交于
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org> Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@xilinx.com>
-
由 Edgar E. Iglesias 提交于
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org> Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@xilinx.com>
-