Skip to content

Q
qemu

openeuler / qemu

通知 10
Star 0
Fork 0
Q
qemu

体验新版 GitCode，发现更多精彩内容 >>

切换分支/标签
  1. 24 6月, 2015 1 次提交
  3. 23 6月, 2015 2 次提交
  5. 12 6月, 2015 1 次提交
    • J
      migration: Use normal VMStateDescriptions for Subsections · 5cd8cada
      由 Juan Quintela 提交于 
      We create optional sections with this patch.  But we already have
optional subsections.  Instead of having two mechanism that do the
same, we can just generalize it.

For subsections we just change:

- Add a needed function to VMStateDescription
- Remove VMStateSubsection (after removal of the needed function
  it is just a VMStateDescription)
- Adjust the whole tree, moving the needed function to the corresponding
  VMStateDescription
Signed-off-by: NJuan Quintela <quintela@redhat.com>
      5cd8cada
  7. 05 6月, 2015 3 次提交
  9. 03 6月, 2015 7 次提交
    • K
      fdc: Fix MSR.RQM flag · 6cc8a11c
      由 Kevin Wolf 提交于 
      The RQM bit in MSR should be set whenever the guest is supposed to
access the FIFO, and it should be cleared in all other cases. This is
important so the guest can't continue writing/reading the FIFO beyond
the length that it's suppossed to access (see CVE-2015-3456).

Commit e9077462 fixed the CVE by adding code that avoids the buffer
overflow; however it doesn't correct the wrong behaviour of the floppy
controller which should already have cleared RQM.

Currently, RQM stays set all the time and during all phases while a
command is being processed. This is error-prone because the command has
to explicitly clear the flag if it doesn't need data (and indeed, the
two buggy commands that are the culprits for the CVE just forgot to do
that).

This patch clears RQM immediately as soon as all bytes that are expected
have been received. If the the FIFO is used in the next phase, the flag
has to be set explicitly there.

It also clear RQM after receiving all bytes even if the phase transition
immediately sets it again. While it's technically not necessary at the
moment because the state between clearing and setting RQM is not
observable by the guest, this is more explicit and matches how real
hardware works. It will actually become necessary in qemu once
asynchronous code paths are introduced.

This alone should have been enough to fix the CVE, but now we have two
lines of defense - even better.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NJohn Snow <jsnow@redhat.com>
Message-id: 1432214378-31891-8-git-send-email-kwolf@redhat.com
Signed-off-by: NJohn Snow <jsnow@redhat.com>
      6cc8a11c
    • K
      fdc: Disentangle phases in fdctrl_read_data() · f6c2d1d8
      由 Kevin Wolf 提交于 
      This commit makes similar improvements as have already been made to the
write function: Instead of relying on a flag in the MSR to distinguish
controller phases, use the explicit phase that we store now. Assertions
of the right MSR flags are added.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NJohn Snow <jsnow@redhat.com>
Message-id: 1432214378-31891-7-git-send-email-kwolf@redhat.com
Signed-off-by: NJohn Snow <jsnow@redhat.com>
      f6c2d1d8
    • K
      fdc: Code cleanup in fdctrl_write_data() · d275b33d
      由 Kevin Wolf 提交于 
      Factor out a few common lines of code, reformat, improve comments.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NJohn Snow <jsnow@redhat.com>
Message-id: 1432214378-31891-6-git-send-email-kwolf@redhat.com
Signed-off-by: NJohn Snow <jsnow@redhat.com>
      d275b33d
    • K
      fdc: Use phase in fdctrl_write_data() · 5b0a25e8
      由 Kevin Wolf 提交于 
      Instead of relying on a flag in the MSR to distinguish controller phases,
use the explicit phase that we store now. Assertions of the right MSR
flags are added.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NJohn Snow <jsnow@redhat.com>
Message-id: 1432214378-31891-5-git-send-email-kwolf@redhat.com
Signed-off-by: NJohn Snow <jsnow@redhat.com>
      5b0a25e8
    • K
      fdc: Introduce fdctrl->phase · 85d291a0
      由 Kevin Wolf 提交于 
      The floppy controller spec describes three different controller phases,
which are currently not explicitly modelled in our emulation. Instead,
each phase is represented by a combination of flags in registers.

This patch makes explicit in which phase the controller currently is.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Acked-by: NJohn Snow <jsnow@redhat.com>
Message-id: 1432214378-31891-4-git-send-email-kwolf@redhat.com
Signed-off-by: NJohn Snow <jsnow@redhat.com>
      85d291a0
    • K
      fdc: Rename fdctrl_set_fifo() to fdctrl_to_result_phase() · 83a26013
      由 Kevin Wolf 提交于 
      What callers really do with this function is to switch from execution
phase (including data transfers) to result phase where the guest can
read out one or more status bytes from the FIFO (the number depends on
the command).

Rename the function accordingly.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NJohn Snow <jsnow@redhat.com>
Message-id: 1432214378-31891-3-git-send-email-kwolf@redhat.com
Signed-off-by: NJohn Snow <jsnow@redhat.com>
      83a26013
    • K
      fdc: Rename fdctrl_reset_fifo() to fdctrl_to_command_phase() · 07e415f2
      由 Kevin Wolf 提交于 
      What all callers of fdctrl_reset_fifo() really want to do is to start
the command phase, where writes to the data port initiate a new command.

The function doesn't only clear the FIFO, but also sets up the state so
that a new command can be received. Rename it to reflect this.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NJohn Snow <jsnow@redhat.com>
Message-id: 1432214378-31891-2-git-send-email-kwolf@redhat.com
Signed-off-by: NJohn Snow <jsnow@redhat.com>
      07e415f2
  11. 01 6月, 2015 1 次提交
  13. 22 5月, 2015 1 次提交
  15. 13 5月, 2015 1 次提交
  17. 30 4月, 2015 2 次提交
  19. 29 4月, 2015 1 次提交
  21. 28 4月, 2015 2 次提交
  23. 08 4月, 2015 1 次提交
  25. 02 4月, 2015 1 次提交
    • M
      hw: Mark devices picking up block backends actively FIXME · af9e40aa
      由 Markus Armbruster 提交于 
      Drives defined with if!=none are for board initialization to wire up.
Board code calls drive_get() or similar to find them, and creates
devices with their qdev drive properties set accordingly.

Except a few devices go on a fishing expedition for a suitable backend
instead of exposing a drive property for board code to set: they call
driver_get() or drive_get_next() in their realize() or init() method
to implicitly connect to the "next" backend with a certain interface
type.

Picking up backends that way works when the devices are created by
board code.  But it's inappropriate for -device or device_add.  Not
only is this inconsistent with how the other block device models work
(they connect to a backend explicitly identified by a "drive"
property), it breaks when the "next" backend has been picked up by the
board already.

Example:

    $ qemu-system-arm -S -M connex -pflash flash.img -device ssi-sd
    Aborted (core dumped)

Mark them with suitable FIXME comments.

Cc: Andrzej Zaborowski <balrogg@gmail.com>
Cc: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Cc: "Andreas Färber" <andreas.faerber@web.de>
Cc: Michael Walle <michael@walle.cc>
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
      af9e40aa
  27. 27 3月, 2015 1 次提交
  29. 10 3月, 2015 5 次提交
  31. 26 2月, 2015 3 次提交
  33. 18 2月, 2015 1 次提交
  35. 16 2月, 2015 2 次提交
  37. 10 2月, 2015 1 次提交
  39. 07 2月, 2015 3 次提交
    • P
      block: introduce BDRV_REQUEST_MAX_SECTORS · 75af1f34
      由 Peter Lieven 提交于 
      we check and adjust request sizes at several places with
sometimes inconsistent checks or default values:
 INT_MAX
 INT_MAX >> BDRV_SECTOR_BITS
 UINT_MAX >> BDRV_SECTOR_BITS
 SIZE_MAX >> BDRV_SECTOR_BITS

This patches introdocues a macro for the maximal allowed sectors
per request and uses it at several places.
Signed-off-by: NPeter Lieven <pl@kamp.de>
Reviewed-by: NDenis V. Lunev <den@openvz.org>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
      75af1f34
    • P
      virtio-blk: add a knob to disable request merging · c99495ac
      由 Peter Lieven 提交于 
      this adds a knob to disable request merging for debugging or benchmarks if dedired.
Signed-off-by: NPeter Lieven <pl@kamp.de>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
      c99495ac
    • P
      virtio-blk: introduce multiread · 95f7142a
      由 Peter Lieven 提交于 
      this patch finally introduces multiread support to virtio-blk. While
multiwrite support was there for a long time, read support was missing.

The complete merge logic is moved into virtio-blk.c which has
been the only user of request merging ever since. This is required
to be able to merge chunks of requests and immediately invoke callbacks
for those requests. Secondly, this is required to switch to
direct invocation of coroutines which is planned at a later stage.

The following benchmarks show the performance of running fio with
4 worker threads on a local ram disk. The numbers show the average
of 10 test runs after 1 run as warmup phase.

              |        4k        |       64k        |        4k
MB/s          | rd seq | rd rand | rd seq | rd rand | wr seq | wr rand
--------------+--------+---------+--------+---------+--------+--------
master        | 1221   | 1187    | 4178   | 4114    | 1745   | 1213
multiread     | 1829   | 1189    | 4639   | 4110    | 1894   | 1216
Signed-off-by: NPeter Lieven <pl@kamp.de>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
      95f7142a