2008-12-04 20:35:16 +00:00
|
|
|
/*
|
|
|
|
|
* Balloon
|
|
|
|
|
*
|
|
|
|
|
* Copyright IBM, Corp. 2008
|
|
|
|
|
*
|
|
|
|
|
* Authors:
|
|
|
|
|
* Anthony Liguori <aliguori@us.ibm.com>
|
|
|
|
|
*
|
|
|
|
|
* This work is licensed under the terms of the GNU GPL, version 2. See
|
|
|
|
|
* the COPYING file in the top-level directory.
|
|
|
|
|
*
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
#ifndef _QEMU_BALLOON_H
|
|
|
|
|
#define _QEMU_BALLOON_H
|
|
|
|
|
|
2010-04-01 19:57:12 +02:00
|
|
|
#include "monitor.h"
|
2011-10-21 11:41:37 -02:00
|
|
|
#include "qapi-types.h"
|
2010-04-01 19:57:12 +02:00
|
|
|
|
balloon: Separate out stat and balloon handling
Passing on '0' as ballooning target to indicate retrieval of stats is
bad API. It also makes 'balloon 0' in the monitor cause a segfault.
Have two different functions handle the different functionality instead.
Detailed explanation from Markus's review:
1. do_info_balloon() is an info_async() method. It receives a callback
with argument, to be called exactly once (callback frees the
argument). It passes the callback via qemu_balloon_status() and
indirectly through qemu_balloon_event to virtio_balloon_to_target().
virtio_balloon_to_target() executes its balloon stats half. It
stores the callback in the device state.
If it can't send a stats request, it resets stats and calls the
callback right away.
Else, it sends a stats request. The device model runs the callback
when it receives the answer.
Works.
2. do_balloon() is a cmd_async() method. It receives a callback with
argument, to be called when the command completes. do_balloon()
calls it right before it succeeds. Odd, but should work.
Nevertheless, it passes the callback on via qemu_ballon() and
indirectly through qemu_balloon_event to virtio_balloon_to_target().
a. If the argument is non-zero, virtio_balloon_to_target() executes
its balloon half, which doesn't use the callback in any way.
Odd, but works.
b. If the argument is zero, virtio_balloon_to_target() executes its
balloon stats half, just like in 1. It either calls the callback
right away, or arranges for it to be called later.
Thus, the callback runs twice: use after free and double free.
Test case: start with -S -device virtio-balloon, execute "balloon 0" in
human monitor. Runs the callback first from virtio_balloon_to_target(),
then again from do_balloon().
Reported-by: Mike Cao <bcao@redhat.com>
Signed-off-by: Amit Shah <amit.shah@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
2011-07-20 13:30:56 +05:30
|
|
|
typedef void (QEMUBalloonEvent)(void *opaque, ram_addr_t target);
|
2011-10-21 11:41:37 -02:00
|
|
|
typedef void (QEMUBalloonStatus)(void *opaque, BalloonInfo *info);
|
2008-12-04 20:35:16 +00:00
|
|
|
|
2011-07-27 12:28:19 +05:30
|
|
|
int qemu_add_balloon_handler(QEMUBalloonEvent *event_func,
|
|
|
|
|
QEMUBalloonStatus *stat_func, void *opaque);
|
2011-09-09 14:30:39 +05:30
|
|
|
void qemu_remove_balloon_handler(void *opaque);
|
2008-12-04 20:35:16 +00:00
|
|
|
|
|
|
|
|
#endif
|