1. 02 11月, 2016 18 次提交
    • P
      qemu-char: do not forward events through the mux until QEMU has started · fffbd9cf
      Paolo Bonzini 提交于
      Otherwise, the CHR_EVENT_OPENED event is sent twice: first when the
      backend (for example "stdio") is opened, and second after processing
      the command line.
      
      The incorrect sending of the event prints the monitor banner when
      QEMU is started with "-serial mon:stdio".  This includes the "(qemu)"
      prompt; thus the monitor seems to be dead, whereas actually the
      active front-end is the serial port.
      Reported-by: NDr. David Alan Gilbert <dgilbert@redhat.com>
      Tested-by: NDr. David Alan Gilbert <dgilbert@redhat.com>
      Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      fffbd9cf
    • E
      nbd: Implement NBD_CMD_WRITE_ZEROES on client · fa778fff
      Eric Blake 提交于
      Upstream NBD protocol recently added the ability to efficiently
      write zeroes without having to send the zeroes over the wire,
      along with a flag to control whether the client wants a hole.
      
      The generic block code takes care of falling back to the obvious
      write of lots of zeroes if we return -ENOTSUP because the server
      does not have WRITE_ZEROES.
      
      Ideally, since NBD_CMD_WRITE_ZEROES does not involve any data
      over the wire, we want to support transactions that are much
      larger than the normal 32M limit imposed on NBD_CMD_WRITE.  But
      the server may still have a limit smaller than UINT_MAX, so
      until experimental NBD protocol additions for advertising various
      command sizes is finalized (see [1], [2]), for now we just stick to
      the same limits as normal writes.
      
      [1] https://github.com/yoe/nbd/blob/extension-info/doc/proto.md
      [2] https://sourceforge.net/p/nbd/mailman/message/35081223/Signed-off-by: NEric Blake <eblake@redhat.com>
      Message-Id: <1476469998-28592-17-git-send-email-eblake@redhat.com>
      Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      fa778fff
    • E
      nbd: Implement NBD_CMD_WRITE_ZEROES on server · 1f4d6d18
      Eric Blake 提交于
      Upstream NBD protocol recently added the ability to efficiently
      write zeroes without having to send the zeroes over the wire,
      along with a flag to control whether the client wants to allow
      a hole.
      
      Note that when it comes to requiring full allocation, vs.
      permitting optimizations, the NBD spec intentionally picked a
      different sense for the flag; the rules in qemu are:
      MAY_UNMAP == 0: must write zeroes
      MAY_UNMAP == 1: may use holes if reads will see zeroes
      
      while in NBD, the rules are:
      FLAG_NO_HOLE == 1: must write zeroes
      FLAG_NO_HOLE == 0: may use holes if reads will see zeroes
      
      In all cases, the 'may use holes' scenario is optional (the
      server need not use a hole, and must not use a hole if
      subsequent reads would not see zeroes).
      Signed-off-by: NEric Blake <eblake@redhat.com>
      Message-Id: <1476469998-28592-16-git-send-email-eblake@redhat.com>
      Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      1f4d6d18
    • E
      nbd: Improve server handling of shutdown requests · b6f5d3b5
      Eric Blake 提交于
      NBD commit 6d34500b clarified how clients and servers are supposed
      to behave before closing a connection. It added NBD_REP_ERR_SHUTDOWN
      (for the server to announce it is about to go away during option
      haggling, so the client should quit sending NBD_OPT_* other than
      NBD_OPT_ABORT) and ESHUTDOWN (for the server to announce it is about
      to go away during transmission, so the client should quit sending
      NBD_CMD_* other than NBD_CMD_DISC).  It also clarified that
      NBD_OPT_ABORT gets a reply, while NBD_CMD_DISC does not.
      
      This patch merely adds the missing reply to NBD_OPT_ABORT and teaches
      the client to recognize server errors.  Actually teaching the server
      to send NBD_REP_ERR_SHUTDOWN or ESHUTDOWN would require knowing that
      the server has been requested to shut down soon (maybe we could do
      that by installing a SIGINT handler in qemu-nbd, which transitions
      from RUNNING to a new state that waits for the client to react,
      rather than just out-right quitting - but that's a bigger task for
      another day).
      Signed-off-by: NEric Blake <eblake@redhat.com>
      Message-Id: <1476469998-28592-15-git-send-email-eblake@redhat.com>
      [Move dummy ESHUTDOWN to include/qemu/osdep.h. - Paolo]
      Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      b6f5d3b5
    • E
      nbd: Refactor conversion to errno to silence checkpatch · 8b34a9db
      Eric Blake 提交于
      Checkpatch complains that 'return EINVAL' is usually wrong
      (since we tend to favor 'return -EINVAL').  But it is a
      false positive for nbd_errno_to_system_errno().  Since NBD
      may add future defined wire values, refactor the code to
      keep checkpatch happy.
      Signed-off-by: NEric Blake <eblake@redhat.com>
      Message-Id: <1476469998-28592-14-git-send-email-eblake@redhat.com>
      Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      8b34a9db
    • E
      nbd: Support shorter handshake · c203c59a
      Eric Blake 提交于
      The NBD Protocol allows the server and client to mutually agree
      on a shorter handshake (omit the 124 bytes of reserved 0), via
      the server advertising NBD_FLAG_NO_ZEROES and the client
      acknowledging with NBD_FLAG_C_NO_ZEROES (only possible in
      newstyle, whether or not it is fixed newstyle).  It doesn't
      shave much off the wire, but we might as well implement it.
      Signed-off-by: NEric Blake <eblake@redhat.com>
      Reviewed-by: NAlex Bligh <alex@alex.org.uk>
      Message-Id: <1476469998-28592-13-git-send-email-eblake@redhat.com>
      Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      c203c59a
    • E
      nbd: Less allocation during NBD_OPT_LIST · 75368aab
      Eric Blake 提交于
      Since we know that the maximum name we are willing to accept
      is small enough to stack-allocate, rework the iteration over
      NBD_OPT_LIST responses to reuse a stack buffer rather than
      allocating every time.  Furthermore, we don't even have to
      allocate if we know the server's length doesn't match what
      we are searching for.
      Signed-off-by: NEric Blake <eblake@redhat.com>
      Message-Id: <1476469998-28592-12-git-send-email-eblake@redhat.com>
      Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      75368aab
    • E
      nbd: Let client skip portions of server reply · 7d3123e1
      Eric Blake 提交于
      The server has a nice helper function nbd_negotiate_drop_sync()
      which lets it easily ignore fluff from the client (such as the
      payload to an unknown option request).  We can't quite make it
      common, since it depends on nbd_negotiate_read() which handles
      coroutine magic, but we can copy the idea into the client where
      we have places where we want to ignore data (such as the
      description tacked on the end of NBD_REP_SERVER).
      Signed-off-by: NEric Blake <eblake@redhat.com>
      Message-Id: <1476469998-28592-11-git-send-email-eblake@redhat.com>
      Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      7d3123e1
    • E
      nbd: Let server know when client gives up negotiation · 2cdbf413
      Eric Blake 提交于
      The NBD spec says that a client should send NBD_OPT_ABORT
      rather than just dropping the connection, if the client doesn't
      like something the server sent during option negotiation.  This
      is a best-effort attempt only, and can only be done in places
      where we know the server is still in sync with what we've sent,
      whether or not we've read everything the server has sent.
      Technically, the server then has to reply with NBD_REP_ACK, but
      it's not worth complicating the client to wait around for that
      reply.
      Signed-off-by: NEric Blake <eblake@redhat.com>
      Message-Id: <1476469998-28592-10-git-send-email-eblake@redhat.com>
      Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      2cdbf413
    • E
      nbd: Share common option-sending code in client · c8a3a1b6
      Eric Blake 提交于
      Rather than open-coding each option request, it's easier to
      have common helper functions do the work.  That in turn requires
      having convenient packed types for handling option requests
      and replies.
      Signed-off-by: NEric Blake <eblake@redhat.com>
      Message-Id: <1476469998-28592-9-git-send-email-eblake@redhat.com>
      Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      c8a3a1b6
    • E
      nbd: Send message along with server NBD_REP_ERR errors · 36683283
      Eric Blake 提交于
      The NBD Protocol allows us to send human-readable messages
      along with any NBD_REP_ERR error during option negotiation;
      make use of this fact for clients that know what to do with
      our message.
      Signed-off-by: NEric Blake <eblake@redhat.com>
      Message-Id: <1476469998-28592-8-git-send-email-eblake@redhat.com>
      Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      36683283
    • E
      nbd: Share common reply-sending code in server · 526e5c65
      Eric Blake 提交于
      Rather than open-coding NBD_REP_SERVER, reuse the code we
      already have by adding a length parameter.  Additionally,
      the refactoring will make adding NBD_OPT_GO in a later patch
      easier.
      Signed-off-by: NEric Blake <eblake@redhat.com>
      Message-Id: <1476469998-28592-7-git-send-email-eblake@redhat.com>
      Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      526e5c65
    • E
      nbd: Rename struct nbd_request and nbd_reply · ed2dd912
      Eric Blake 提交于
      Our coding convention prefers CamelCase names, and we already
      have other existing structs with NBDFoo naming.  Let's be
      consistent, before later patches add even more structs.
      Signed-off-by: NEric Blake <eblake@redhat.com>
      Message-Id: <1476469998-28592-6-git-send-email-eblake@redhat.com>
      Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      ed2dd912
    • E
      nbd: Rename NbdClientSession to NBDClientSession · 10676b81
      Eric Blake 提交于
      It's better to use consistent capitalization of the namespace
      used for NBD functions; we have more instances of NBD* than
      Nbd*.
      Signed-off-by: NEric Blake <eblake@redhat.com>
      Message-Id: <1476469998-28592-5-git-send-email-eblake@redhat.com>
      Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      10676b81
    • E
      nbd: Rename NBDRequest to NBDRequestData · 315f78ab
      Eric Blake 提交于
      We have both 'struct NBDRequest' and 'struct nbd_request'; making
      it confusing to see which does what.  Furthermore, we want to
      rename nbd_request to align with our normal CamelCase naming
      conventions.  So, rename the struct which is used to associate
      the data received during request callbacks, while leaving the
      shorter name for the description of the request sent over the
      wire in the NBD protocol.
      Signed-off-by: NEric Blake <eblake@redhat.com>
      Message-Id: <1476469998-28592-4-git-send-email-eblake@redhat.com>
      Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      315f78ab
    • E
      nbd: Treat flags vs. command type as separate fields · b626b51a
      Eric Blake 提交于
      Current upstream NBD documents that requests have a 16-bit flags,
      followed by a 16-bit type integer; although older versions mentioned
      only a 32-bit field with masking to find flags.  Since the protocol
      is in network order (big-endian over the wire), the ABI is unchanged;
      but dealing with the flags as a separate field rather than masking
      will make it easier to add support for upcoming NBD extensions that
      increase the number of both flags and commands.
      
      Improve some comments in nbd.h based on the current upstream
      NBD protocol (https://github.com/yoe/nbd/blob/master/doc/proto.md),
      and touch some nearby code to keep checkpatch.pl happy.
      Signed-off-by: NEric Blake <eblake@redhat.com>
      Message-Id: <1476469998-28592-3-git-send-email-eblake@redhat.com>
      Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      b626b51a
    • E
      nbd: Add qemu-nbd -D for human-readable description · b1a75b33
      Eric Blake 提交于
      The NBD protocol allows servers to advertise a human-readable
      description alongside an export name during NBD_OPT_LIST.  Add
      an option to pass through the user's string to the NBD client.
      
      Doing this also makes it easier to test commit 200650d4, which
      is the client counterpart of receiving the description.
      Signed-off-by: NEric Blake <eblake@redhat.com>
      Message-Id: <1476469998-28592-2-git-send-email-eblake@redhat.com>
      Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      b1a75b33
    • H
      exec.c: check memory backend file size with 'size' option · 1775f111
      Haozhong Zhang 提交于
      If the memory backend file is not large enough to hold the required 'size',
      Qemu will report error and exit.
      Signed-off-by: NHaozhong Zhang <haozhong.zhang@intel.com>
      Message-Id: <20161027042300.5929-3-haozhong.zhang@intel.com>
      Reviewed-by: NEduardo Habkost <ehabkost@redhat.com>
      Message-Id: <20161102010551.2723-1-haozhong.zhang@intel.com>
      Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      1775f111
  2. 01 11月, 2016 22 次提交
    • H
      exec.c: do not truncate non-empty memory backend file · d6af99c9
      Haozhong Zhang 提交于
      For '-object memory-backend-file,mem-path=foo,size=xyz', if the size of
      file 'foo' does not match the given size 'xyz', the current QEMU will
      truncate the file to the given size, which may corrupt the existing data
      in that file. To avoid such data corruption, this patch disables
      truncating non-empty backend files.
      Signed-off-by: NHaozhong Zhang <haozhong.zhang@intel.com>
      Message-Id: <20161027042300.5929-2-haozhong.zhang@intel.com>
      Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      d6af99c9
    • A
      exec.c: ensure all AddressSpaceDispatch updates under RCU · f35e44e7
      Alex Bennée 提交于
      The memory_dispatch field is meant to be protected by RCU so we should
      use the correct primitives when accessing it. This race was flagged up
      by the ThreadSanitizer.
      Signed-off-by: NAlex Bennée <alex.bennee@linaro.org>
      Message-Id: <20161021153418.21571-1-alex.bennee@linaro.org>
      Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      f35e44e7
    • P
      tests: send error_report to test log · 28017e01
      Paolo Bonzini 提交于
      Implement error_vprintf to send the output of error_report to
      the test log.  This silences test-vmstate.
      Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      Message-Id: <1477326663-67817-3-git-send-email-pbonzini@redhat.com>
      28017e01
    • P
      qemu-error: remove dependency of stubs on monitor · 397d30e9
      Paolo Bonzini 提交于
      Leave the implementation of error_vprintf and error_vprintf_unless_qmp
      (the latter now trivially wrapped by error_printf_unless_qmp) to
      libqemustub.a and monitor.c.  This has two advantages: it lets us
      remove the monitor_printf and monitor_vprintf stubs, and it lets
      tests provide a different implementation of the functions that uses
      g_test_message.
      Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      Message-Id: <1477326663-67817-2-git-send-email-pbonzini@redhat.com>
      397d30e9
    • C
      nbd: Use CoQueue for free_sema instead of CoMutex · 9bc9732f
      Changlong Xie 提交于
      NBD is using the CoMutex in a way that wasn't anticipated. For example, if there are
      N(N=26, MAX_NBD_REQUESTS=16) nbd write requests, so we will invoke nbd_client_co_pwritev
      N times.
      ----------------------------------------------------------------------------------------
      time request Actions
      1    1       in_flight=1, Coroutine=C1
      2    2       in_flight=2, Coroutine=C2
      ...
      15   15      in_flight=15, Coroutine=C15
      16   16      in_flight=16, Coroutine=C16, free_sema->holder=C16, mutex->locked=true
      17   17      in_flight=16, Coroutine=C17, queue C17 into free_sema->queue
      18   18      in_flight=16, Coroutine=C18, queue C18 into free_sema->queue
      ...
      26   N       in_flight=16, Coroutine=C26, queue C26 into free_sema->queue
      ----------------------------------------------------------------------------------------
      
      Once nbd client recieves request No.16' reply, we will re-enter C16. It's ok, because
      it's equal to 'free_sema->holder'.
      ----------------------------------------------------------------------------------------
      time request Actions
      27   16      in_flight=15, Coroutine=C16, free_sema->holder=C16, mutex->locked=false
      ----------------------------------------------------------------------------------------
      
      Then nbd_coroutine_end invokes qemu_co_mutex_unlock what will pop coroutines from
      free_sema->queue's head and enter C17. More free_sema->holder is C17 now.
      ----------------------------------------------------------------------------------------
      time request Actions
      28   17      in_flight=16, Coroutine=C17, free_sema->holder=C17, mutex->locked=true
      ----------------------------------------------------------------------------------------
      
      In above scenario, we only recieves request No.16' reply. As time goes by, nbd client will
      almostly recieves replies from requests 1 to 15 rather than request 17 who owns C17. In this
      case, we will encounter assert "mutex->holder == self" failed since Kevin's commit 0e438cdc
      "coroutine: Let CoMutex remember who holds it". For example, if nbd client recieves request
      No.15' reply, qemu will stop unexpectedly:
      ----------------------------------------------------------------------------------------
      time request       Actions
      29   15(most case) in_flight=15, Coroutine=C15, free_sema->holder=C17, mutex->locked=false
      ----------------------------------------------------------------------------------------
      
      Per Paolo's suggestion "The simplest fix is to change it to CoQueue, which is like a condition
      variable", this patch replaces CoMutex with CoQueue.
      
      Cc: Wen Congyang <wency@cn.fujitsu.com>
      Reported-by: Nzhanghailiang <zhang.zhanghailiang@huawei.com>
      Suggested-by: NPaolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: NChanglong Xie <xiecl.fnst@cn.fujitsu.com>
      Message-Id: <1476267508-19499-1-git-send-email-xiecl.fnst@cn.fujitsu.com>
      Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      9bc9732f
    • P
      checkpatch: tweak "struct should normally be const" warning · e20e718c
      Paolo Bonzini 提交于
      Avoid triggering on
      
          typedef struct BlockJobDriver BlockJobDriver;
      
      or
      
          struct BlockJobDriver {
      
      Cc: John Snow <jsnow@redhat.com>
      Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      e20e718c
    • P
      Merge remote-tracking branch 'remotes/gkurz/tags/for-upstream' into staging · 39542105
      Peter Maydell 提交于
      This pull request mostly contains some more fixes to prevent buggy guests from
      breaking QEMU.
      
      # gpg: Signature made Tue 01 Nov 2016 11:26:42 GMT
      # gpg:                using DSA key 0x02FC3AEB0101DBC2
      # gpg: Good signature from "Greg Kurz <groug@kaod.org>"
      # gpg:                 aka "Greg Kurz <groug@free.fr>"
      # gpg:                 aka "Greg Kurz <gkurz@fr.ibm.com>"
      # gpg:                 aka "Greg Kurz <gkurz@linux.vnet.ibm.com>"
      # gpg:                 aka "Gregory Kurz (Groug) <groug@free.fr>"
      # gpg:                 aka "Gregory Kurz (Cimai Technology) <gkurz@cimai.com>"
      # gpg:                 aka "Gregory Kurz (Meiosys Technology) <gkurz@meiosys.com>"
      # gpg: WARNING: This key is not certified with a trusted signature!
      # gpg:          There is no indication that the signature belongs to the owner.
      # Primary key fingerprint: 2BD4 3B44 535E C0A7 9894  DBA2 02FC 3AEB 0101 DBC2
      
      * remotes/gkurz/tags/for-upstream:
        9pfs: drop excessive error message from virtfs_reset()
        9pfs: don't BUG_ON() if fid is already opened
        9pfs: xattrcreate requires non-opened fids
        9pfs: limit xattr size in xattrcreate
        9pfs: fix integer overflow issue in xattr read/write
        9pfs: convert 'len/copied_len' field in V9fsXattr to the type of uint64_t
        9pfs: add xattrwalk_fid field in V9fsXattr struct
      Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
      39542105
    • P
      Merge remote-tracking branch 'remotes/mdroth/tags/qga-pull-2016-10-31-tag' into staging · 38ab3596
      Peter Maydell 提交于
      qemu-ga patch queue for 2.8
      
      * add guest-fstrim support for w32
      * add support for using virtio-vsock as the communication channel
      
      # gpg: Signature made Tue 01 Nov 2016 00:55:40 GMT
      # gpg:                using RSA key 0x3353C9CEF108B584
      # gpg: Good signature from "Michael Roth <flukshun@gmail.com>"
      # gpg:                 aka "Michael Roth <mdroth@utexas.edu>"
      # gpg:                 aka "Michael Roth <mdroth@linux.vnet.ibm.com>"
      # Primary key fingerprint: CEAC C9E1 5534 EBAB B82D  3FA0 3353 C9CE F108 B584
      
      * remotes/mdroth/tags/qga-pull-2016-10-31-tag:
        qga: add vsock-listen method
        sockets: add AF_VSOCK support
        qga: drop unnecessary GA_CHANNEL_UNIX_LISTEN checks
        qga: drop unused sockaddr in accept(2) call
        qga: minimal support for fstrim for Windows guests
      Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
      38ab3596
    • P
      Merge remote-tracking branch 'remotes/rth/tags/pull-sparc-20161031-2' into staging · bf99fd39
      Peter Maydell 提交于
      target-sparc updates for atomics and alignment
      
      # gpg: Signature made Mon 31 Oct 2016 20:47:57 GMT
      # gpg:                using RSA key 0xAD1270CC4DD0279B
      # gpg: Good signature from "Richard Henderson <rth7680@gmail.com>"
      # gpg:                 aka "Richard Henderson <rth@redhat.com>"
      # gpg:                 aka "Richard Henderson <rth@twiddle.net>"
      # Primary key fingerprint: 9CB1 8DDA F8E8 49AD 2AFC  16A4 AD12 70CC 4DD0 279B
      
      * remotes/rth/tags/pull-sparc-20161031-2:
        target-sparc: Use tcg_gen_atomic_cmpxchg_tl
        target-sparc: Use tcg_gen_atomic_xchg_tl
        target-sparc: Remove MMU_MODE*_SUFFIX
        target-sparc: Allow 4-byte alignment on fp mem ops
        target-sparc: Implement ldqf and stqf inline
        target-sparc: Remove asi helper code handled inline
        target-sparc: Implement BCOPY/BFILL inline
        target-sparc: Implement cas_asi/casx_asi inline
        target-sparc: Implement ldstub_asi inline
        target-sparc: Implement swap_asi inline
        target-sparc: Handle more twinx asis
        target-sparc: Use MMU_PHYS_IDX for bypass asis
        target-sparc: Add MMU_PHYS_IDX
        target-sparc: Introduce cpu_raise_exception_ra
        target-sparc: Use overalignment flags for twinx and block asis
      Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
      bf99fd39
    • G
      9pfs: drop excessive error message from virtfs_reset() · 79decce3
      Greg Kurz 提交于
      The virtfs_reset() function is called either when the virtio-9p device
      gets reset, or when the client starts a new 9P session. In both cases,
      if it finds fids from a previous session, the following is printed in
      the monitor:
      
      9pfs:virtfs_reset: One or more uncluncked fids found during reset
      
      For example, if a linux guest with a mounted 9P share is reset from the
      monitor with system_reset, the message will be printed. This is excessive
      since these fids are now clunked and the state is clean.
      Signed-off-by: NGreg Kurz <groug@kaod.org>
      Reviewed-by: NEric Blake <eblake@redhat.com>
      79decce3
    • G
      9pfs: don't BUG_ON() if fid is already opened · 49dd946b
      Greg Kurz 提交于
      A buggy or malicious guest could pass the id of an already opened fid and
      cause QEMU to abort. Let's return EINVAL to the guest instead.
      Signed-off-by: NGreg Kurz <groug@kaod.org>
      Reviewed-by: NEric Blake <eblake@redhat.com>
      49dd946b
    • G
      9pfs: xattrcreate requires non-opened fids · dd654e03
      Greg Kurz 提交于
      The xattrcreate operation only makes sense on a freshly cloned fid
      actually, since any open state would be leaked because of the fid_type
      change. This is indeed what the linux kernel client does:
      
      	fid = clone_fid(fid);
      	[...]
      	retval = p9_client_xattrcreate(fid, name, value_len, flags);
      
      This patch also reverts commit ff55e94d since we are sure that a fid
      with type P9_FID_NONE doesn't have a previously allocated xattr.
      Signed-off-by: NGreg Kurz <groug@kaod.org>
      dd654e03
    • G
      9pfs: limit xattr size in xattrcreate · 3b79ef2c
      Greg Kurz 提交于
      We shouldn't allow guests to create extended attribute with arbitrary sizes.
      On linux hosts, the limit is XATTR_SIZE_MAX. Let's use it.
      Signed-off-by: NGreg Kurz <groug@kaod.org>
      3b79ef2c
    • L
      9pfs: fix integer overflow issue in xattr read/write · 7e55d65c
      Li Qiang 提交于
      The v9fs_xattr_read() and v9fs_xattr_write() are passed a guest
      originated offset: they must ensure this offset does not go beyond
      the size of the extended attribute that was set in v9fs_xattrcreate().
      Unfortunately, the current code implement these checks with unsafe
      calculations on 32 and 64 bit values, which may allow a malicious
      guest to cause OOB access anyway.
      
      Fix this by comparing the offset and the xattr size, which are
      both uint64_t, before trying to compute the effective number of bytes
      to read or write.
      Suggested-by: NGreg Kurz <groug@kaod.org>
      Signed-off-by: NLi Qiang <liqiang6-s@360.cn>
      Reviewed-by: NGreg Kurz <groug@kaod.org>
      Reviewed-By: NGuido Günther <agx@sigxcpu.org>
      Signed-off-by: NGreg Kurz <groug@kaod.org>
      7e55d65c
    • L
      9pfs: convert 'len/copied_len' field in V9fsXattr to the type of uint64_t · 8495f9ad
      Li Qiang 提交于
      The 'len' in V9fsXattr comes from the 'size' argument in setxattr()
      function in guest. The setxattr() function's declaration is this:
      
      int setxattr(const char *path, const char *name,
                   const void *value, size_t size, int flags);
      
      and 'size' is treated as u64 in linux kernel client code:
      
      int p9_client_xattrcreate(struct p9_fid *fid, const char *name,
                                u64 attr_size, int flags)
      
      So the 'len' should have an type of 'uint64_t'.
      The 'copied_len' in V9fsXattr is used to account for copied bytes, it
      should also have an type of 'uint64_t'.
      Suggested-by: NGreg Kurz <groug@kaod.org>
      Signed-off-by: NLi Qiang <liqiang6-s@360.cn>
      Reviewed-by: NGreg Kurz <groug@kaod.org>
      Signed-off-by: NGreg Kurz <groug@kaod.org>
      8495f9ad
    • L
      9pfs: add xattrwalk_fid field in V9fsXattr struct · dd28fbbc
      Li Qiang 提交于
      Currently, 9pfs sets the 'copied_len' field in V9fsXattr
      to -1 to tag xattr walk fid. As the 'copied_len' is also
      used to account for copied bytes, this may make confusion. This patch
      add a bool 'xattrwalk_fid' to tag the xattr walk fid.
      Suggested-by: NGreg Kurz <groug@kaod.org>
      Signed-off-by: NLi Qiang <liqiang6-s@360.cn>
      Reviewed-by: NGreg Kurz <groug@kaod.org>
      Signed-off-by: NGreg Kurz <groug@kaod.org>
      dd28fbbc
    • P
      Merge remote-tracking branch 'remotes/mcayland/tags/qemu-openbios-signed' into staging · 0e356366
      Peter Maydell 提交于
      Update OpenBIOS images
      
      # gpg: Signature made Mon 31 Oct 2016 20:19:53 GMT
      # gpg:                using RSA key 0x5BC2C56FAE0F321F
      # gpg: Good signature from "Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>"
      # Primary key fingerprint: CC62 1AB9 8E82 200D 915C  C9C4 5BC2 C56F AE0F 321F
      
      * remotes/mcayland/tags/qemu-openbios-signed:
        Update OpenBIOS images to 1dc4f16 built from submodule.
      Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
      0e356366
    • J
      migration: fix compiler warning on uninitialized variable · 02ba9265
      Jeff Cody 提交于
      Some older GCC versions (e.g. 4.4.7) report a warning on an
      uninitialized variable for 'request', even though all possible code
      paths that reference 'request' will be initialized.   To appease
      these versions, initialize the variable to 0.
      Reported-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
      Signed-off-by: NJeff Cody <jcody@redhat.com>
      Reviewed-by: Nzhanghailiang <zhang.zhanghailiang@huawei.com>
      Message-id: 259818682e41b95ae60f1423b87954a3fe377639.1477950393.git.jcody@redhat.com
      Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
      02ba9265
    • S
      qga: add vsock-listen method · 586ef5de
      Stefan Hajnoczi 提交于
      Add AF_VSOCK (virtio-vsock) support as an alternative to virtio-serial.
      
        $ qemu-system-x86_64 -device vhost-vsock-pci,guest-cid=3 ...
        (guest)# qemu-ga -m vsock-listen -p 3:1234
      Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: NMichael Roth <mdroth@linux.vnet.ibm.com>
      Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>
      586ef5de
    • S
      sockets: add AF_VSOCK support · 6a02c806
      Stefan Hajnoczi 提交于
      Add the AF_VSOCK address family so that qemu-ga will be able to use
      virtio-vsock.
      
      The AF_VSOCK address family uses <cid, port> address tuples.  The cid is
      the unique identifier comparable to an IP address.  AF_VSOCK does not
      use name resolution so it's easy to convert between struct sockaddr_vm
      and strings.
      
      This patch defines a VsockSocketAddress instead of trying to piggy-back
      on InetSocketAddress.  This is cleaner in the long run since it avoids
      lots of IPv4 vs IPv6 vs vsock special casing.
      Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
      * treat trailing commas as garbage when parsing (Eric Blake)
      * add configure check instead of checking AF_VSOCK directly
      Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>
      6a02c806
    • S
      qga: drop unnecessary GA_CHANNEL_UNIX_LISTEN checks · f06b2031
      Stefan Hajnoczi 提交于
      Throughout the code there are c->listen_channel checks which manage the
      listen socket file descriptor (waiting for accept(2), closing the file
      descriptor, etc).  These checks are currently preceded by explicit
      c->method == GA_CHANNEL_UNIX_LISTEN checks.
      
      Explicit GA_CHANNEL_UNIX_LISTEN checks are not necessary since serial
      channel types do not create the listen channel (c->listen_channel).
      
      As more listen channel types are added, explicitly checking all of them
      becomes messy.  Rely on c->listen_channel to determine whether or not a
      listen socket file descriptor is used.
      Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: NMichael Roth <mdroth@linux.vnet.ibm.com>
      Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>
      f06b2031
    • S
      qga: drop unused sockaddr in accept(2) call · b8093d38
      Stefan Hajnoczi 提交于
      ga_channel_listen_accept() is currently hard-coded to support only
      AF_UNIX because the struct sockaddr_un type is used.  This function
      should work with any address family.
      
      Drop the sockaddr since the client address is unused and is an optional
      argument to accept(2).
      Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
      Reviewed-by: NMichael Roth <mdroth@linux.vnet.ibm.com>
      Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>
      b8093d38