aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2017-02-289pfs: local: utimensat: don't follow symlinksGreg Kurz1-6/+13
The local_utimensat() callback is vulnerable to symlink attacks because it calls qemu_utimens()->utimensat(AT_SYMLINK_NOFOLLOW) which follows symbolic links in all path elements but the rightmost one or qemu_utimens()->utimes() which follows symbolic links for all path elements. This patch converts local_utimensat() to rely on opendir_nofollow() and utimensat(AT_SYMLINK_NOFOLLOW) directly instead of using qemu_utimens(). It is hence assumed that the OS supports utimensat(), i.e. has glibc 2.6 or higher and linux 2.6.22 or higher, which seems reasonable nowadays. This partly fixes CVE-2016-9602. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-02-289pfs: local: remove: don't follow symlinksGreg Kurz1-43/+21
The local_remove() callback is vulnerable to symlink attacks because it calls: (1) lstat() which follows symbolic links in all path elements but the rightmost one (2) remove() which follows symbolic links in all path elements but the rightmost one This patch converts local_remove() to rely on opendir_nofollow(), fstatat(AT_SYMLINK_NOFOLLOW) to fix (1) and unlinkat() to fix (2). This partly fixes CVE-2016-9602. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-02-289pfs: local: unlinkat: don't follow symlinksGreg Kurz1-43/+56
The local_unlinkat() callback is vulnerable to symlink attacks because it calls remove() which follows symbolic links in all path elements but the rightmost one. This patch converts local_unlinkat() to rely on opendir_nofollow() and unlinkat() instead. Most of the code is moved to a separate local_unlinkat_common() helper which will be reused in a subsequent patch to fix the same issue in local_remove(). This partly fixes CVE-2016-9602. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-02-289pfs: local: lremovexattr: don't follow symlinksGreg Kurz4-20/+36
The local_lremovexattr() callback is vulnerable to symlink attacks because it calls lremovexattr() which follows symbolic links in all path elements but the rightmost one. This patch introduces a helper to emulate the non-existing fremovexattrat() function: it is implemented with /proc/self/fd which provides a trusted path that can be safely passed to lremovexattr(). local_lremovexattr() is converted to use this helper and opendir_nofollow(). This partly fixes CVE-2016-9602. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-02-289pfs: local: lsetxattr: don't follow symlinksGreg Kurz5-27/+43
The local_lsetxattr() callback is vulnerable to symlink attacks because it calls lsetxattr() which follows symbolic links in all path elements but the rightmost one. This patch introduces a helper to emulate the non-existing fsetxattrat() function: it is implemented with /proc/self/fd which provides a trusted path that can be safely passed to lsetxattr(). local_lsetxattr() is converted to use this helper and opendir_nofollow(). This partly fixes CVE-2016-9602. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-02-289pfs: local: llistxattr: don't follow symlinksGreg Kurz1-6/+29
The local_llistxattr() callback is vulnerable to symlink attacks because it calls llistxattr() which follows symbolic links in all path elements but the rightmost one. This patch introduces a helper to emulate the non-existing flistxattrat() function: it is implemented with /proc/self/fd which provides a trusted path that can be safely passed to llistxattr(). local_llistxattr() is converted to use this helper and opendir_nofollow(). This partly fixes CVE-2016-9602. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-02-289pfs: local: lgetxattr: don't follow symlinksGreg Kurz6-28/+43
The local_lgetxattr() callback is vulnerable to symlink attacks because it calls lgetxattr() which follows symbolic links in all path elements but the rightmost one. This patch introduces a helper to emulate the non-existing fgetxattrat() function: it is implemented with /proc/self/fd which provides a trusted path that can be safely passed to lgetxattr(). local_lgetxattr() is converted to use this helper and opendir_nofollow(). This partly fixes CVE-2016-9602. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-02-289pfs: local: open/opendir: don't follow symlinksGreg Kurz2-10/+47
The local_open() and local_opendir() callbacks are vulnerable to symlink attacks because they call: (1) open(O_NOFOLLOW) which follows symbolic links in all path elements but the rightmost one (2) opendir() which follows symbolic links in all path elements This patch converts both callbacks to use new helpers based on openat_nofollow() to only open files and directories if they are below the virtfs shared folder This partly fixes CVE-2016-9602. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-02-289pfs: local: keep a file descriptor on the shared folderGreg Kurz1-2/+28
This patch opens the shared folder and caches the file descriptor, so that it can be used to do symlink-safe path walk. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-02-289pfs: introduce relative_openat_nofollow() helperGreg Kurz3-1/+108
When using the passthrough security mode, symbolic links created by the guest are actual symbolic links on the host file system. Since the resolution of symbolic links during path walk is supposed to occur on the client side. The server should hence never receive any path pointing to an actual symbolic link. This isn't guaranteed by the protocol though, and malicious code in the guest can trick the server to issue various syscalls on paths whose one or more elements are symbolic links. In the case of the "local" backend using the "passthrough" or "none" security modes, the guest can directly create symbolic links to arbitrary locations on the host (as per spec). The "mapped-xattr" and "mapped-file" security modes are also affected to a lesser extent as they require some help from an external entity to create actual symbolic links on the host, i.e. another guest using "passthrough" mode for example. The current code hence relies on O_NOFOLLOW and "l*()" variants of system calls. Unfortunately, this only applies to the rightmost path component. A guest could maliciously replace any component in a trusted path with a symbolic link. This could allow any guest to escape a virtfs shared folder. This patch introduces a variant of the openat() syscall that successively opens each path element with O_NOFOLLOW. When passing a file descriptor pointing to a trusted directory, one is guaranteed to be returned a file descriptor pointing to a path which is beneath the trusted directory. This will be used by subsequent patches to implement symlink-safe path walk for any access to the backend. Symbolic links aren't the only threats actually: a malicious guest could change a path element to point to other types of file with undesirable effects: - a named pipe or any other thing that would cause openat() to block - a terminal device which would become QEMU's controlling terminal These issues can be addressed with O_NONBLOCK and O_NOCTTY. Two helpers are introduced: one to open intermediate path elements and one to open the rightmost path element. Suggested-by: Jann Horn <jannh@google.com> Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> (renamed openat_nofollow() to relative_openat_nofollow(), assert path is relative and doesn't contain '//', fixed side-effect in assert, Greg Kurz) Signed-off-by: Greg Kurz <groug@kaod.org>
2017-02-289pfs: remove side-effects in local_open() and local_opendir()Greg Kurz1-3/+10
If these functions fail, they should not change *fs. Let's use local variables to fix this. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-02-289pfs: remove side-effects in local_init()Greg Kurz1-18/+19
If this function fails, it should not modify *ctx. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-02-289pfs: local: move xattr security ops to 9p-xattr.cGreg Kurz2-66/+75
These functions are always called indirectly. It really doesn't make sense for them to sit in a header file. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-02-27Merge remote-tracking branch 'remotes/kraxel/tags/pull-ui-20170227-1' into ↵Peter Maydell14-97/+178
staging gtk: fix kbd on xwayland vnc: fix double free issues opengl improvements # gpg: Signature made Mon 27 Feb 2017 16:11:30 GMT # gpg: using RSA key 0x4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/pull-ui-20170227-1: vnc: fix double free issues spice: add display & head options ui: Use XkbGetMap and XkbGetNames instead of XkbGetKeyboard gtk-egl: add scanout_disable support sdl2: add scanout_disable support spice: add scanout_disable support virtio-gpu: use dpy_gl_scanout_disable console: add dpy_gl_scanout_disable console: rename dpy_gl_scanout to dpy_gl_scanout_texture Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-27Merge remote-tracking branch ↵Peter Maydell2-6/+3
'remotes/berrange/tags/pull-qcrypto-2017-02-27-1' into staging Merge qcrypto 2017/02/27 v1 # gpg: Signature made Mon 27 Feb 2017 13:37:34 GMT # gpg: using RSA key 0xBE86EBB415104FDF # gpg: Good signature from "Daniel P. Berrange <dan@berrange.com>" # gpg: aka "Daniel P. Berrange <berrange@redhat.com>" # Primary key fingerprint: DAF3 A6FD B26B 6291 2D0E 8E3F BE86 EBB4 1510 4FDF * remotes/berrange/tags/pull-qcrypto-2017-02-27-1: crypto: assert cipher algorithm is always valid crypto: fix leak in ivgen essiv init Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-27vnc: fix double free issuesGerd Hoffmann1-0/+3
Reported by Coverity: CID 1371242, 1371243, 1371244. Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Peter Maydell <peter.maydell@linaro.org> Cc: Daniel P. Berrange <berrange@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 1487682332-29154-1-git-send-email-kraxel@redhat.com
2017-02-27spice: add display & head optionsGerd Hoffmann2-1/+27
This allows to specify display and head to use, simliar to vnc. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1487663858-11731-1-git-send-email-kraxel@redhat.com
2017-02-27ui: Use XkbGetMap and XkbGetNames instead of XkbGetKeyboardDaniel P. Berrange2-7/+10
XkbGetKeyboard does not work in XWayland and even on non-Wayland X11 servers its use is discouraged: https://bugs.freedesktop.org/show_bug.cgi?id=89240 This resolves a problem whereby QEMU prints "could not lookup keycode name" on startup when running under XWayland. Keymap handling is however still broken after this commit, since Xwayland is reporting a keymap we can't handle "unknown keycodes `(unnamed)', please report to qemu-devel@nongnu.org" NB, native Wayland support (which is the default under GTK3) is not affected - only XWayland (which can be requested with GDK_BACKEND on GTK3, and is the only option for GTK2). Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-id: 20170227132343.30824-1-berrange@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-02-27gtk-egl: add scanout_disable supportGerd Hoffmann3-5/+12
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 1487669841-13668-7-git-send-email-kraxel@redhat.com
2017-02-27sdl2: add scanout_disable supportGerd Hoffmann3-5/+13
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 1487669841-13668-6-git-send-email-kraxel@redhat.com
2017-02-27spice: add scanout_disable supportGerd Hoffmann1-15/+21
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 1487669841-13668-5-git-send-email-kraxel@redhat.com
2017-02-27virtio-gpu: use dpy_gl_scanout_disableGerd Hoffmann1-3/+2
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 1487669841-13668-4-git-send-email-kraxel@redhat.com
2017-02-27console: add dpy_gl_scanout_disableGerd Hoffmann2-0/+13
Helper function (and DisplayChangeListenerOps ptr) to disable scanouts. Replaces using dpy_gl_scanout_texture with 0x0 size and no texture specified. Allows cleanups to make the io and gfx emulation code more readable. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 1487669841-13668-3-git-send-email-kraxel@redhat.com
2017-02-27console: rename dpy_gl_scanout to dpy_gl_scanout_textureGerd Hoffmann11-64/+80
We'll add a variant which accepts dmabufs soon. Change the name so we can easily disturgish the two variants. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 1487669841-13668-2-git-send-email-kraxel@redhat.com
2017-02-27crypto: assert cipher algorithm is always validPrasad J Pandit1-6/+2
Crypto routines 'qcrypto_cipher_get_block_len' and 'qcrypto_cipher_get_key_len' return non-zero cipher block and key lengths from static arrays 'alg_block_len[]' and 'alg_key_len[]' respectively. Returning 'zero(0)' value from either of them would likely lead to an error condition. Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2017-02-27crypto: fix leak in ivgen essiv initLi Qiang1-0/+1
On error path, the 'salt' doesn't been freed thus leading a memory leak. This patch avoid this. Signed-off-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2017-02-27tests-aio-multithread: use atomic_read properlyPaolo Bonzini1-2/+2
nodes[id].next is written by other threads. If atomic_read is not used (matching atomic_set in mcs_mutex_lock!) the compiler can optimize the whole "if" away! Reported-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Tested-by: Greg Kurz <groug@kaod.org> Message-id: 20170227111726.9237-1-pbonzini@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-26Merge remote-tracking branch 'remotes/artyom/tags/pull-sun4v-20170226' into ↵Peter Maydell1-10/+23
staging Pull request for Niagara patches 2017 02 26 # gpg: Signature made Sun 26 Feb 2017 21:56:06 GMT # gpg: using RSA key 0x3360C3F7411A125F # gpg: Good signature from "Artyom Tarasenko <atar4qemu@gmail.com>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 2AD8 6149 17F4 B2D7 05C0 BB12 3360 C3F7 411A 125F * remotes/artyom/tags/pull-sun4v-20170226: niagara: check if a serial port is available niagara: fail if a firmware file is missing Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-26niagara: check if a serial port is availableArtyom Tarasenko1-3/+4
Reported-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Artyom Tarasenko <atar4qemu@gmail.com>
2017-02-26niagara: fail if a firmware file is missingArtyom Tarasenko1-7/+19
fail if a firmware file is missing and not qtest_enabled(), the later is necessary to allow some basic tests if firmware is not available Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Artyom Tarasenko <atar4qemu@gmail.com>
2017-02-26Merge remote-tracking branch 'remotes/thibault/tags/samuel-thibault' into ↵Peter Maydell3-17/+21
staging slirp updates # gpg: Signature made Sun 26 Feb 2017 14:40:00 GMT # gpg: using RSA key 0xB0A51BF58C9179C5 # gpg: Good signature from "Samuel Thibault <samuel.thibault@aquilenet.fr>" # gpg: aka "Samuel Thibault <sthibault@debian.org>" # gpg: aka "Samuel Thibault <samuel.thibault@gnu.org>" # gpg: aka "Samuel Thibault <samuel.thibault@inria.fr>" # gpg: aka "Samuel Thibault <samuel.thibault@labri.fr>" # gpg: aka "Samuel Thibault <samuel.thibault@ens-lyon.org>" # gpg: aka "Samuel Thibault <samuel.thibault@u-bordeaux.fr>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 900C B024 B679 31D4 0F82 304B D017 8C76 7D06 9EE6 # Subkey fingerprint: AEBF 7448 FAB9 453A 4552 390E B0A5 1BF5 8C91 79C5 * remotes/thibault/tags/samuel-thibault: slirp: tcp_listen(): Don't try to close() an fd we never opened slirp: Convert mbufs to use g_malloc() and g_free() slirp: Check qemu_socket() return value in udp_listen() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-26slirp: tcp_listen(): Don't try to close() an fd we never openedPeter Maydell1-1/+3
Coverity points out (CID 1005725) that an error-exit path in tcp_listen() will try to close(s) even if the reason it got there was that the qemu_socket() failed and s was never opened. Not only that, this isn't even the right function to use, because we need closesocket() to do the right thing on Windows. Change to using the right function and only calling it if needed. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
2017-02-26slirp: Convert mbufs to use g_malloc() and g_free()Peter Maydell1-16/+14
The mbuf code currently doesn't check the result of doing a malloc() or realloc() of its data (spotted by Coverity, CID 1238946). Since the m_inc() API assumes that extending an mbuf must succeed, just convert to g_malloc() and g_free(). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
2017-02-26slirp: Check qemu_socket() return value in udp_listen()Peter Maydell1-0/+4
Check the return value from qemu_socket() rather than trying to pass it to bind() as an fd argument even if it's negative. This wouldn't have caused any negative consequences, because it won't be a valid fd number and the bind call will fail; but Coverity complains (CID 1005723). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
2017-02-26Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into stagingPeter Maydell34-168/+461
Block layer patches # gpg: Signature made Fri 24 Feb 2017 18:08:26 GMT # gpg: using RSA key 0x7F09B272C88F2FD6 # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" # Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6 * remotes/kevin/tags/for-upstream: tests: Use opened block node for block job tests vvfat: Use opened node as backing file block: Add bdrv_new_open_driver() block: Factor out bdrv_open_driver() block: Use BlockBackend for image probing block: Factor out bdrv_open_child_bs() block: Attach bs->file only during .bdrv_open() block: Pass BdrvChild to bdrv_truncate() mirror: Resize active commit base in mirror_run() qcow2: Use BB for resizing in qcow2_amend_options() blockdev: Use BlockBackend to resize in qmp_block_resize() iotests: Fix another race in 030 qemu-img: Improve documentation for PREALLOC_MODE_FALLOC qemu-img: Truncate before full preallocation qemu-img: Add tests for raw image preallocation qemu-img: Do not truncate before preallocation qemu-iotests: redirect nbd server stdout to /dev/null qemu-iotests: add ability to exclude certain protocols from tests qemu-iotests: Test 137 only supports 'file' protocol Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-26Merge remote-tracking branch 'remotes/cody/tags/block-pull-request' into stagingPeter Maydell2-46/+84
# gpg: Signature made Fri 24 Feb 2017 17:45:53 GMT # gpg: using RSA key 0xBDBE7B27C0DE3057 # gpg: Good signature from "Jeffrey Cody <jcody@redhat.com>" # gpg: aka "Jeffrey Cody <jeff@codyprime.org>" # gpg: aka "Jeffrey Cody <codyprime@gmail.com>" # Primary key fingerprint: 9957 4B4D 3474 90E7 9D98 D624 BDBE 7B27 C0DE 3057 * remotes/cody/tags/block-pull-request: RBD: Add support readv,writev for rbd block/nfs: try to avoid the bounce buffer in pwritev block/nfs: convert to preadv / pwritev Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-25Merge remote-tracking branch 'remotes/yongbok/tags/mips-20170224-2' into stagingPeter Maydell4-1/+582
MIPS patches 2017-02-24-2 CHanges: * Add the Boston board with fixing the make check issue on 32-bit hosts. # gpg: Signature made Fri 24 Feb 2017 11:43:45 GMT # gpg: using RSA key 0x2238EB86D5F797C2 # gpg: Good signature from "Yongbok Kim <yongbok.kim@imgtec.com>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 8600 4CF5 3415 A5D9 4CFA 2B5C 2238 EB86 D5F7 97C2 * remotes/yongbok/tags/mips-20170224-2: hw/mips: MIPS Boston board support Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-25Merge remote-tracking branch 'remotes/stsquad/tags/pull-mttcg-240217-1' into ↵Peter Maydell40-476/+1878
staging This is the MTTCG pull-request as posted yesterday. # gpg: Signature made Fri 24 Feb 2017 11:17:51 GMT # gpg: using RSA key 0xFBD0DB095A9E2A44 # gpg: Good signature from "Alex Bennée (Master Work Key) <alex.bennee@linaro.org>" # Primary key fingerprint: 6685 AE99 E751 67BC AFC8 DF35 FBD0 DB09 5A9E 2A44 * remotes/stsquad/tags/pull-mttcg-240217-1: (24 commits) tcg: enable MTTCG by default for ARM on x86 hosts hw/misc/imx6_src: defer clearing of SRC_SCR reset bits target-arm: ensure all cross vCPUs TLB flushes complete target-arm: don't generate WFE/YIELD calls for MTTCG target-arm/powerctl: defer cpu reset work to CPU context cputlb: introduce tlb_flush_*_all_cpus[_synced] cputlb: atomically update tlb fields used by tlb_reset_dirty cputlb: add tlb_flush_by_mmuidx async routines cputlb and arm/sparc targets: convert mmuidx flushes from varg to bitmap cputlb: introduce tlb_flush_* async work. cputlb: tweak qemu_ram_addr_from_host_nofail reporting cputlb: add assert_cpu_is_self checks tcg: handle EXCP_ATOMIC exception for system emulation tcg: enable thread-per-vCPU tcg: enable tb_lock() for SoftMMU tcg: remove global exit_request tcg: drop global lock during TCG code execution tcg: rename tcg_current_cpu to tcg_current_rr_cpu tcg: add kick timer for single-threaded vCPU emulation tcg: add options for enabling MTTCG ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-25Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20170224' into stagingPeter Maydell10-60/+250
A selection of s390x patches: - cleanups, fixes and improvements - program check loop detection (useful with the corresponding kernel patch) - wire up virtio-crypto for ccw - and finally support many virtqueues for virtio-ccw # gpg: Signature made Fri 24 Feb 2017 09:19:19 GMT # gpg: using RSA key 0xDECF6B93C6F02FAF # gpg: Good signature from "Cornelia Huck <huckc@linux.vnet.ibm.com>" # gpg: aka "Cornelia Huck <cornelia.huck@de.ibm.com>" # Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0 18CE DECF 6B93 C6F0 2FAF * remotes/cohuck/tags/s390x-20170224: s390x/css: handle format-0 TIC CCW correctly s390x/arch_dump: pass cpuid into notes sections s390x/arch_dump: use proper note name and note size virtio-ccw: support VIRTIO_QUEUE_MAX virtqueues s390x: bump ADAPTER_ROUTES_MAX_GSI virtio-ccw: check flic->adapter_routes_max_batch s390x: add property adapter_routes_max_batch virtio-ccw: Check the number of vqs in CCW_CMD_SET_IND virtio-ccw: add virtio-crypto-ccw device virtio-ccw: handle virtio 1 only devices s390x/flic: fail migration on source already s390x/kvm: detect some program check loops s390x/s390-virtio: get rid of DPRINTF Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-25Merge remote-tracking branch 'remotes/famz/tags/for-upstream' into stagingPeter Maydell9-11/+102
Docker testing and shippable patches Hi Peter, These are testing and build automation patches: - Shippable.com powered CI config - Docker cross build - Fixes and MAINTAINERS tweaks. # gpg: Signature made Fri 24 Feb 2017 06:31:10 GMT # gpg: using RSA key 0xCA35624C6A9171C6 # gpg: Good signature from "Fam Zheng <famz@redhat.com>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 5003 7CB7 9706 0F76 F021 AD56 CA35 624C 6A91 71C6 * remotes/famz/tags/for-upstream: docker: Install python2 explicitly in docker image MAINTAINERS: merge Build and test automation with Docker tests .shippable.yml: new CI provider new: debian docker targets for cross-compiling tests/docker: add basic user mapping support Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-24Merge remote-tracking branch 'remotes/armbru/tags/pull-util-2017-02-23' into ↵Peter Maydell15-498/+1000
staging option cutils: Fix and clean up number conversions # gpg: Signature made Thu 23 Feb 2017 19:41:17 GMT # gpg: using RSA key 0x3870B400EB918653 # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * remotes/armbru/tags/pull-util-2017-02-23: (24 commits) option: Fix checking of sizes for overflow and trailing crap util/cutils: Change qemu_strtosz*() from int64_t to uint64_t util/cutils: Return qemu_strtosz*() error and value separately util/cutils: Let qemu_strtosz*() optionally reject trailing crap qemu-img: Wrap cvtnum() around qemu_strtosz() test-cutils: Drop suffix from test_qemu_strtosz_simple() test-cutils: Use qemu_strtosz() more often util/cutils: Drop QEMU_STRTOSZ_DEFSUFFIX_* macros util/cutils: New qemu_strtosz() util/cutils: Rename qemu_strtosz() to qemu_strtosz_MiB() util/cutils: New qemu_strtosz_metric() test-cutils: Cover qemu_strtosz() around range limits test-cutils: Cover qemu_strtosz() with trailing crap test-cutils: Cover qemu_strtosz() invalid input test-cutils: Add missing qemu_strtosz()... endptr checks option: Fix to reject invalid and overflowing numbers util/cutils: Clean up control flow around qemu_strtol() a bit util/cutils: Clean up variable names around qemu_strtol() util/cutils: Rename qemu_strtoll(), qemu_strtoull() util/cutils: Rewrite documentation of qemu_strtol() & friends ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-24RBD: Add support readv,writev for rbdtianqing1-24/+56
Rbd can do readv and writev directly, so wo do not need to transform iov to buf or vice versa any more. Signed-off-by: tianqing <tianqing@unitedstack.com> Reviewed-by: Jeff Cody <jcody@redhat.com> Signed-off-by: Jeff Cody <jcody@redhat.com>
2017-02-24block/nfs: try to avoid the bounce buffer in pwritevPeter Lieven1-7/+16
if the passed qiov contains exactly one iov we can pass the buffer directly. Signed-off-by: Peter Lieven <pl@kamp.de> Reviewed-by: Jeff Cody <jcody@redhat.com> Message-id: 1487349541-10201-3-git-send-email-pl@kamp.de Signed-off-by: Jeff Cody <jcody@redhat.com>
2017-02-24block/nfs: convert to preadv / pwritevPeter Lieven1-18/+15
Signed-off-by: Peter Lieven <pl@kamp.de> Reviewed-by: Jeff Cody <jcody@redhat.com> Message-id: 1487349541-10201-2-git-send-email-pl@kamp.de Signed-off-by: Jeff Cody <jcody@redhat.com>
2017-02-24Merge remote-tracking branch 'remotes/awilliam/tags/vfio-updates-20170223.0' ↵Peter Maydell2-38/+64
into staging VFIO updates 2017-02-23 - Report qdev_unplug errors (Alex Williamson) - Fix ecap ID 0 handling, improve comment (Alex Williamson) - Disable IGD stolen memory in UPT mode too (Xiong Zhang) # gpg: Signature made Thu 23 Feb 2017 19:04:17 GMT # gpg: using RSA key 0x239B9B6E3BB08B22 # gpg: Good signature from "Alex Williamson <alex.williamson@redhat.com>" # gpg: aka "Alex Williamson <alex@shazbot.org>" # gpg: aka "Alex Williamson <alwillia@redhat.com>" # gpg: aka "Alex Williamson <alex.l.williamson@gmail.com>" # Primary key fingerprint: 42F6 C04E 540B D1A9 9E7B 8A90 239B 9B6E 3BB0 8B22 * remotes/awilliam/tags/vfio-updates-20170223.0: vfio/pci-quirks.c: Disable stolen memory for igd VFIO vfio/pci: Improve extended capability comments, skip masked caps vfio/pci: Report errors from qdev_unplug() via device request Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-24tests: Use opened block node for block job testsKevin Wolf2-2/+10
blk_insert_bs() and block job related functions will soon require an opened block node (permission calculations will involve the block driver), so let our tests be consistent with the real users in this respect. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com>
2017-02-24vvfat: Use opened node as backing fileKevin Wolf1-5/+5
We should not try to assign a not yet opened node as the backing file, because as soon as the permission system is added it will fail. The just added bdrv_new_open_driver() function is the right tool to open a file with an internal driver, use it. In case anyone wonders whether that magic fake backing file to trigger a special action on 'commit' actually works today: No, not for me. One reason is that we've been adding a raw format driver on top for several years now and raw doesn't support commit. Other reasons include that the backing file isn't writable and the driver doesn't support reopen, and it's also size 0 and the driver doesn't support bdrv_truncate. All of these are easily fixable, but then 'commit' ended up in an infinite loop deep in the vvfat code for me, so I thought I'd best leave it alone. I'm not really sure what it was supposed to do anyway. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com>
2017-02-24block: Add bdrv_new_open_driver()Kevin Wolf2-1/+31
This function allows to create more or less normal BlockDriverStates even for BlockDrivers that aren't globally registered (e.g. helper filters for block jobs). Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com>
2017-02-24block: Factor out bdrv_open_driver()Kevin Wolf1-47/+65
This is a function that doesn't do any option parsing, but just does some basic BlockDriverState setup and calls the .bdrv_open() function of the block driver. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com>
2017-02-24block: Use BlockBackend for image probingKevin Wolf1-17/+19
This fixes the use of a parent-less BdrvChild in bdrv_open_inherit() by converting it into a BlockBackend. Which is exactly what it should be, image probing is an external, standalone user of a node. The requests can't be considered to originate from the format driver node because that one isn't even opened yet. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com>
generated by cgit v1.1 at 2024-08-21 03:52:27 +0000