summaryrefslogtreecommitdiffstats
path: root/hw/virtio/virtio.c
Commit message (Collapse)AuthorAgeFilesLines
* virtio: allow byte swapping for vringRusty Russell2014-06-291-41/+48
| | | | | | | | | | | | | | Quoting original text from Rusty: "This is based on a simpler patch by Anthony Liguouri". Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> [ add VirtIODevice * argument to most helpers, Greg Kurz <gkurz@linux.vnet.ibm.com> ] Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com> Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com> Reviewed-by: Alexander Graf <agraf@suse.de> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* virtio: add endian-ambivalent support to VirtIODeviceGreg Kurz2014-06-291-12/+87
| | | | | | | | | | | | | | | | | | | Some CPU families can dynamically change their endianness. This means we can have little endian ppc or big endian arm guests for example. This has an impact on legacy virtio data structures since they are target endian. We hence introduce a new property to track the endianness of each virtio device. It is reasonnably assumed that endianness won't change while the device is in use : we hence capture the device endianness when it gets reset. We migrate this property in a subsection, after the device descriptor. This means the load code must not rely on it until it is restored. As a consequence, the vring sanity checks had to be moved after the call to vmstate_load_state(). We enforce paranoia by poisoning the property at the begining of virtio_load(). Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* virtio: add subsections to the migration streamGreg Kurz2014-06-291-2/+19
| | | | | | | | | | | | | | | | | | | | | | | | There is a need to add some more fields to VirtIODevice that should be migrated (broken status, endianness). The problem is that we do not want to break compatibility while adding a new feature... This issue has been addressed in the generic VMState code with the use of optional subsections. As a *temporary* alternative to port the whole virtio migration code to VMState, this patch mimics a similar subsectionning ability for virtio, using the VMState code. Since each virtio device is streamed in its own section, the idea is to stream subsections between the end of the device section and the start of the next sections. This allows an older QEMU to complain and exit when fed with subsections: Unknown savevm section type 5 load of migration failed Suggested-by: Alexander Graf <agraf@suse.de> Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com> Reviewed-by: Alexander Graf <agraf@suse.de> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* virtio: introduce device specific migration callsGreg Kurz2014-06-291-1/+12
| | | | | | | | | | | | | In order to migrate virtio subsections, they should be streamed after the device itself. We need the device specific code to be called from the common migration code to achieve this. This patch introduces load and save methods for this purpose. Suggested-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com> Reviewed-by: Alexander Graf <agraf@suse.de> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* Allow mismatched virtio config-lenDr. David Alan Gilbert2014-06-291-5/+11
| | | | | | | | | | | | | | | | | | | Commit 'virtio: validate config_len on load' restricted config_len loaded from the wire to match the config_len that the device had. Unfortunately, there are cases where this isn't true, the one we found it on was the wce addition in virtio-blk. Allow mismatched config-lengths: *) If the version on the wire is shorter then fine *) If the version on the wire is longer, load what we have space for and skip the rest. (This is mst@redhat.com's rework of what I originally posted) Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* virtio: Drop superfluous conditionals around g_strdup()Markus Armbruster2014-06-191-5/+1Star
| | | | | | | Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
* virtio: Drop superfluous conditionals around g_free()Markus Armbruster2014-06-191-8/+4Star
| | | | | | | Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
* virtio.c: fix error messageMichael Tokarev2014-06-101-1/+1
| | | | | Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
* virtio: allow mapping up to max queue sizeMichael S. Tsirkin2014-05-121-1/+1
| | | | | | | | | | | | It's a loop from i < num_sg and the array is VIRTQUEUE_MAX_SIZE - so it's OK if the value read is VIRTQUEUE_MAX_SIZE. Not a big problem in practice as people don't use such big queues, but it's inelegant. Reported-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* virtio: validate config_len on loadMichael S. Tsirkin2014-05-051-1/+7
| | | | | | | | | | | | | | | | | | | Malformed input can have config_len in migration stream exceed the array size allocated on destination, the result will be heap overflow. To fix, that config_len matches on both sides. CVE-2014-0182 Reported-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com> -- v2: use %ix and %zx to print config_len values Signed-off-by: Juan Quintela <quintela@redhat.com>
* virtio: validate num_sg when mappingMichael S. Tsirkin2014-05-051-0/+6
| | | | | | | | | | | | | | | | | CVE-2013-4535 CVE-2013-4536 Both virtio-block and virtio-serial read, VirtQueueElements are read in as buffers, and passed to virtqueue_map_sg(), where num_sg is taken from the wire and can force writes to indicies beyond VIRTQUEUE_MAX_SIZE. To fix, validate num_sg. Reported-by: Michael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Cc: Amit Shah <amit.shah@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
* virtio: avoid buffer overrun on incoming migrationMichael Roth2014-05-051-0/+3
| | | | | | | | | | | | | | | | | | | CVE-2013-6399 vdev->queue_sel is read from the wire, and later used in the emulation code as an index into vdev->vq[]. If the value of vdev->queue_sel exceeds the length of vdev->vq[], currently allocated to be VIRTIO_PCI_QUEUE_MAX elements, subsequent PIO operations such as VIRTIO_PCI_QUEUE_PFN can be used to overrun the buffer with arbitrary data originating from the source. Fix this by failing migration if the value from the wire exceeds VIRTIO_PCI_QUEUE_MAX. Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Juan Quintela <quintela@redhat.com>
* virtio: out-of-bounds buffer write on invalid state loadMichael S. Tsirkin2014-05-051-1/+7
| | | | | | | | | | | | | | | | | | | CVE-2013-4151 QEMU 1.0 out-of-bounds buffer write in virtio_load@hw/virtio/virtio.c So we have this code since way back when: num = qemu_get_be32(f); for (i = 0; i < num; i++) { vdev->vq[i].vring.num = qemu_get_be32(f); array of vqs has size VIRTIO_PCI_QUEUE_MAX, so on invalid input this will write beyond end of buffer. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
* exec: Make stw_*_phys input an AddressSpaceEdgar E. Iglesias2014-02-111-4/+6
| | | | | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
* exec: Make stl_*_phys input an AddressSpaceEdgar E. Iglesias2014-02-111-2/+2
| | | | | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
* exec: Make lduw_*_phys input an AddressSpaceEdgar E. Iglesias2014-02-111-8/+8
| | | | | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
* exec: Make ldq/ldub_*_phys input an AddressSpaceEdgar E. Iglesias2014-02-111-1/+1
| | | | | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
* exec: Make ldl_*_phys input an AddressSpaceEdgar E. Iglesias2014-02-111-1/+2
| | | | | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
* virtio: add back call to virtio_bus_device_unpluggedPaolo Bonzini2013-12-231-0/+2
| | | | | | | | This got lost in a rebase. Reported-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* virtio: Convert exit to unrealizeAndreas Färber2013-12-091-5/+8
| | | | | Signed-off-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* virtio: Complete converting VirtioDevice to QOM realizeAndreas Färber2013-12-091-6/+0Star
| | | | | | | Drop VirtioDeviceClass::init. Signed-off-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* virtio: Start converting VirtioDevice to QOM realizeAndreas Färber2013-12-091-15/+27
| | | | | | | | | | Temporarily allow either VirtioDeviceClass::init or VirtioDeviceClass::realize. Introduce VirtioDeviceClass::unrealize for symmetry. Signed-off-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* virtio-bus: cleanup plug/unplug interfacePaolo Bonzini2013-12-091-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Right now we have these pairs: - virtio_bus_plug_device/virtio_bus_destroy_device. The first takes a VirtIODevice, the second takes a VirtioBusState - device_plugged/device_unplug callbacks in the VirtioBusClass (here it's just the naming that is inconsistent) - virtio_bus_destroy_device is not called by anyone (and since it calls qdev_free, it would be called by the proxies---but then the callback is useless since the proxies can do whatever they want before calling virtio_bus_destroy_device) And there is a k->init but no k->exit, hence virtio_device_exit is overwritten by subclasses (except virtio-9p). This cleans it up by: - renaming the device_unplug callback to device_unplugged - renaming virtio_bus_plug_device to virtio_bus_device_plugged, matching the callback name - renaming virtio_bus_destroy_device to virtio_bus_device_unplugged, removing the qdev_free, making it take a VirtIODevice and calling it from virtio_device_exit - adding a k->exit callback virtio_device_exit is still overwritten, the next patches will fix that. Cc: qemu-stable@nongnu.org Acked-by: Andreas Faerber <afaerber@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* virtio: virtqueue_get_avail_bytes: fix desc_pa when loop over the indirect ↵yinyin2013-08-251-1/+1
| | | | | | | | | | | | | | | | | | | descriptor table virtqueue_get_avail_bytes: when found a indirect desc, we need loop over it. /* loop over the indirect descriptor table */ indirect = 1; max = vring_desc_len(desc_pa, i) / sizeof(VRingDesc); num_bufs = i = 0; desc_pa = vring_desc_addr(desc_pa, i); But, It init i to 0, then use i to update desc_pa. so we will always get: desc_pa = vring_desc_addr(desc_pa, 0); the last two line should swap. Cc: qemu-stable@nongnu.org Signed-off-by: Yin Yin <yin.yin@cs2c.com.cn> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* Merge remote-tracking branch 'mst/tags/for_anthony' into stagingAnthony Liguori2013-08-121-0/+5
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | pci,virtio fixes for 1.6 This includes some last-minute bugfixes for 1.6. All very small patches that also look very safe to me. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Mon 12 Aug 2013 04:28:57 AM CDT using RSA key ID D28D5469 # gpg: Can't check signature: public key not found # By Michael S. Tsirkin (2) and others # Via Michael S. Tsirkin * mst/tags/for_anthony: vhost: clear signalled_used_valid on vhost stop virtio: clear signalled_used_valid when switching from dataplane i82801b11: Fix i82801b11 PCI host bridge config space pc: disable pci-info for 1.6 Message-id: 1376308831-19978-1-git-send-email-mst@redhat.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
| * virtio: clear signalled_used_valid when switching from dataplaneStefan Hajnoczi2013-08-121-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | When the dataplane thread stops, its vring.c implementation synchronizes vring state back to virtio.c so we can continue emulating the virtio device. This patch ensures that virtio.c's signalled_used_valid flag is reset so that we do not suppress guest notifications due to stale signalled_used values. Suggested-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* | hw/virtio/virtio: Don't allow guests to add/remove queuesPeter Maydell2013-08-091-3/+9
|/ | | | | | | | | | | A queue size of 0 is used to indicate a nonexistent queue, so don't allow the guest to flip a queue between zero-size and non-zero-size. Don't permit setting of negative queue sizes either. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1374853288-9912-2-git-send-email-peter.maydell@linaro.org Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
* virtio: Support transports which can specify the vring alignmentPeter Maydell2013-07-191-3/+29
| | | | | | | | | | | | | | | Support virtio transports which can specify the vring alignment (ie where the guest communicates this to the host) by providing a new virtio_queue_set_align() function. (The default alignment remains as before.) Transports which wish to make use of this must set the has_variable_vring_alignment field in their VirtioBusClass struct to true; they can then change the alignment via virtio_queue_set_align(). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1373977512-28932-5-git-send-email-peter.maydell@linaro.org
* virtio: Add support for guest setting of queue sizePeter Maydell2013-07-191-0/+8
| | | | | | | | | The MMIO virtio transport spec allows the guest to tell the host how large the queue size is. Add virtio_queue_set_num() function which implements this in the QEMU common virtio support code. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1373977512-28932-4-git-send-email-peter.maydell@linaro.org
* virtio: properly validate address before accessing configJason Wang2013-05-081-12/+18
| | | | | | | | | | | | | | | | | | | | | | There are several several issues in the current checking: - The check was based on the minus of unsigned values which can overflow - It was done after .{set|get}_config() which can lead crash when config_len is zero since vdev->config is NULL Fix this by: - Validate the address in virtio_pci_config_{read|write}() before .{set|get}_config - Use addition instead minus to do the validation Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Petr Matousek <pmatouse@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Petr Matousek <pmatouse@redhat.com> Message-id: 1367905369-10765-1-git-send-email-jasowang@redhat.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
* virtio: add virtio_device_set_child_bus_name.KONRAD Frederic2013-05-031-0/+24
| | | | | | | | | | | | Add virtio_device_set_child_bus_name function. It will be used with virtio-serial-x and virtio-scsi-x to set the child bus name before calling virtio-x-device's init. Signed-off-by: KONRAD Frederic <fred.konrad@greensocs.com> Tested-by: Cornelia Huck <cornelia.huck@de.ibm.com> Message-id: 1367330931-12994-3-git-send-email-fred.konrad@greensocs.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
* virtio: cleanup: init and exit function.KONRAD Frederic2013-04-241-16/+1Star
| | | | | | | | | This clean the init and the exit functions and rename virtio_common_cleanup to virtio_cleanup. Signed-off-by: KONRAD Frederic <fred.konrad@greensocs.com> Message-id: 1366791683-5350-7-git-send-email-fred.konrad@greensocs.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
* virtio: remove virtiobindings.KONRAD Frederic2013-04-241-22/+27
| | | | | | | | This remove virtio-bindings, and use class instead. Signed-off-by: KONRAD Frederic <fred.konrad@greensocs.com> Message-id: 1366791683-5350-6-git-send-email-fred.konrad@greensocs.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
* virtio: remove the function pointer.KONRAD Frederic2013-04-241-15/+28
| | | | | | | | | This remove the function pointer in VirtIODevice, and use only VirtioDeviceClass function pointer. Signed-off-by: KONRAD Frederic <fred.konrad@greensocs.com> Message-id: 1366791683-5350-5-git-send-email-fred.konrad@greensocs.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
* hw: move virtio devices to hw/ subdirectoriesPaolo Bonzini2013-04-081-0/+1121
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2026-05-01 02:09:06 +0200