aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2021-07-06target/i386: Observe XSAVE state area offsetsDavid Edmondson1-62/+200
Rather than relying on the X86XSaveArea structure definition directly, the routines that manipulate the XSAVE state area should observe the offsets declared in the x86_ext_save_areas array. Currently the offsets declared in the array are derived from the structure definition, resulting in no functional change. Signed-off-by: David Edmondson <david.edmondson@oracle.com> Message-Id: <20210705104632.2902400-7-david.edmondson@oracle.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-07-06target/i386: Make x86_ext_save_areas visible outside cpu.cDavid Edmondson2-6/+10
Provide visibility of the x86_ext_save_areas array and associated type outside of cpu.c. Signed-off-by: David Edmondson <david.edmondson@oracle.com> Message-Id: <20210705104632.2902400-6-david.edmondson@oracle.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-07-06target/i386: Pass buffer and length to XSAVE helperDavid Edmondson5-28/+29
In preparation for removing assumptions about XSAVE area offsets, pass a buffer pointer and buffer length to the XSAVE helper functions. Signed-off-by: David Edmondson <david.edmondson@oracle.com> Message-Id: <20210705104632.2902400-5-david.edmondson@oracle.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-07-06target/i386: Clarify the padding requirements of X86XSaveAreaDavid Edmondson1-1/+7
Replace the hard-coded size of offsets or structure elements with defined constants or sizeof(). Signed-off-by: David Edmondson <david.edmondson@oracle.com> Message-Id: <20210705104632.2902400-4-david.edmondson@oracle.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-07-06target/i386: Consolidate the X86XSaveArea offset checksDavid Edmondson2-46/+15
Rather than having similar but different checks in cpu.h and kvm.c, move them all to cpu.h. Message-Id: <20210705104632.2902400-3-david.edmondson@oracle.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-07-06target/i386: Declare constants for XSAVE offsetsDavid Edmondson1-7/+23
Declare and use manifest constants for the XSAVE state component offsets. Signed-off-by: David Edmondson <david.edmondson@oracle.com> Message-Id: <20210705104632.2902400-2-david.edmondson@oracle.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-07-06coverity-scan: switch to vpath buildPaolo Bonzini1-3/+5
This is the patch that has been running on the coverity cronjob for a few weeks now. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-07-06coverity-scan: Remove lm32 / unicore32 targetsPhilippe Mathieu-Daudé1-6/+0
lm32 has been removed in commit 9d49bcf6992 ("Drop the deprecated lm32 target"), and unicore32 in 4369223902a ("Drop the deprecated unicore32 target"). Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210619091342.3660495-2-f4bug@amsat.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-07-05qemu-options: Improve the documentation of the -display optionsThomas Huth1-12/+33
The sdl and gtk display options support more parameters than currently documented. Also the "vnc" option got lost during a recent commit, add it again. Fixes: ddc717581c ("Add display suboptions to man pages") Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <20210630163231.467987-5-thuth@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-07-05ui: Mark the '-no-quit' option as deprecatedThomas Huth3-2/+11
It's just a wrapper around the -display ...,window-close=off parameter, and the name "no-quit" is rather confusing compared to "window-close" (since there are still other means to quit the emulator), so we should rather tell our users to use the "window-close" parameter instead. While we're at it, update the documentation to state that "-no-quit" is available for GTK, too, not only for SDL. Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <20210630163231.467987-4-thuth@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-07-05ui: Fix the "-display sdl,window_close=..." parameterThomas Huth3-2/+13
According to the QAPI schema, there is a "-" and not a "_" between "window" and "close", and we're also talking about "window-close" in the long parameter description in qemu-options.hx, so we should make sure that we rather use the variant with the "-" by default instead of only allowing the one with the "_" here. The old way still stays enabled for compatibility, but we deprecate it, so that we can switch to a QAPIfied parameter one day more easily. Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <20210630163231.467987-3-thuth@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-07-05softmmu/vl: Remove obsolete comment about the "frame" parameterThomas Huth1-2/+0
The frame parameter has been removed along with the support for SDL 1.2. Fixes: 09bd7ba9f5 ("Remove deprecated -no-frame option") Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <20210630163231.467987-2-thuth@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-07-05Makefile: Remove /usr/bin/env wrapper from the SHELL variableThomas Huth1-1/+1
The wrapper should not be needed here (it's not the shebang line of a shell script), and it is causing trouble on Haiku where "env" resides in a different directory. Reported-by: Richard Zak <richard.j.zak@gmail.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210705082542.936856-1-thuth@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-07-05Merge remote-tracking branch 'remotes/cschoenebeck/tags/pull-9p-20210705' ↵Peter Maydell19-48/+177
into staging 9pfs: misc patches * Add link to 9p developer docs. * Fix runtime check whether client supplied relative path is the export root. * Performance optimization of Twalk requests. * Code cleanup. # gpg: Signature made Mon 05 Jul 2021 12:13:34 BST # gpg: using RSA key 96D8D110CF7AF8084F88590134C2B58765A47395 # gpg: issuer "qemu_oss@crudebyte.com" # gpg: Good signature from "Christian Schoenebeck <qemu_oss@crudebyte.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: ECAB 1A45 4014 1413 BA38 4926 30DB 47C3 A012 D5F4 # Subkey fingerprint: 96D8 D110 CF7A F808 4F88 5901 34C2 B587 65A4 7395 * remotes/cschoenebeck/tags/pull-9p-20210705: 9pfs: reduce latency of Twalk 9pfs: drop root_qid 9pfs: replace not_same_qid() by same_stat_id() 9pfs: drop fid_to_qid() 9pfs: capture root stat 9pfs: fix not_same_qid() 9pfs: simplify v9fs_walk() 9pfs: add link to 9p developer docs Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-05Merge remote-tracking branch ↵Peter Maydell12-83/+423
'remotes/dgilbert-gitlab/tags/pull-migration-20210705a' into staging Migration and virtiofs pull 2021-07-01 v2 Dropped Peter Xu's migration-test fix to reenable most of the migration tests when uffd isn't available; we're seeing at least one seg in github CI (on qemu-system-i386) and Peter Maydell is reporting a hang on Openbsd. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> # gpg: Signature made Mon 05 Jul 2021 11:01:35 BST # gpg: using RSA key 45F5C71B4A0CB7FB977A9FA90516331EBC5BFDE7 # gpg: Good signature from "Dr. David Alan Gilbert (RH2) <dgilbert@redhat.com>" [full] # Primary key fingerprint: 45F5 C71B 4A0C B7FB 977A 9FA9 0516 331E BC5B FDE7 * remotes/dgilbert-gitlab/tags/pull-migration-20210705a: migration/rdma: Use error_report to suppress errno message tests/migration: fix "downtime_limit" type when "migrate-set-parameters" tests/migration: parse the thread-id key of CpuInfoFast virtiofsd: Add an option to enable/disable posix acls virtiofsd: Switch creds, drop FSETID for system.posix_acl_access xattr virtiofsd: Add capability to change/restore umask virtiofsd: Add umask to seccom allow list virtiofsd: Add support for extended setxattr virtiofsd: Fix xattr operations overwriting errno virtiofsd: Fix fuse setxattr() API change issue virtiofsd: Don't allow file creation with FUSE_OPEN docs: describe the security considerations with virtiofsd xattr mapping virtiofsd: use GDateTime for formatting timestamp for debug messages migration: failover: continue to wait card unplug on error migration: move wait-unplug loop to its own function migration: Allow reset of postcopy_recover_triggered when failed migration: Move yank outside qemu_start_incoming_migration() migration: fix the memory overwriting risk in add_to_iovec tests: migration-test: Add dirty ring test Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-059pfs: reduce latency of TwalkChristian Schoenebeck1-19/+70
As with previous performance optimization on Treaddir handling; reduce the overall latency, i.e. overall time spent on processing a Twalk request by reducing the amount of thread hops between the 9p server's main thread and fs worker thread(s). In fact this patch even reduces the thread hops for Twalk handling to its theoritical minimum of exactly 2 thread hops: main thread -> fs worker thread -> main thread This is achieved by doing all the required fs driver tasks altogether in a single v9fs_co_run_in_worker({ ... }); code block. Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <1a6701674afc4f08d40396e3aa2631e18a4dbb33.1622821729.git.qemu_oss@crudebyte.com>
2021-07-059pfs: drop root_qidChristian Schoenebeck2-2/+0
There is no longer a user of root_qid, so drop it. Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <6896dd161d3257db6b0513842a14f87ca191fdf6.1622821729.git.qemu_oss@crudebyte.com>
2021-07-059pfs: replace not_same_qid() by same_stat_id()Christian Schoenebeck1-3/+3
As we are actually only comparing the filesystem ID (i.e. device number and inode number pair) let's use the POSIX stat buffer instead of QIDs, because resolving QIDs requires to be done on 9p server's main thread only as it might mutate the server state if inode remapping is enabled. Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <26aa465ff9cc9c07e053331554a02fdae3994417.1622821729.git.qemu_oss@crudebyte.com>
2021-07-059pfs: drop fid_to_qid()Christian Schoenebeck1-18/+5
There is only one user of fid_to_qid() which is v9fs_walk(). Let's open-code fid_to_qid() directly within v9fs_walk(), because fid_to_qid() hides the POSIX stat buffer which we are going to need in the subsequent patch. Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <e9a4c9c7a0792ed4db6578d105a0823ea05bc324.1622821729.git.qemu_oss@crudebyte.com>
2021-07-059pfs: capture root statChristian Schoenebeck2-1/+10
We already capture the QID of the exported 9p root path, i.e. to prevent client access outside the defined, exported filesystem's tree. This is currently checked by comparing the root QID with another FID's QID. The problem with the latter is that resolving a QID of any given 9p path can only be done on 9p server's main thread, that's because it might mutate the server's state if inode remapping is enabled. For that reason also capture the POSIX stat info of the root path for being able to identify on any (e.g. worker) thread whether an arbitrary given path is identical to the export root. Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <eb07d6c2e9925788454cfe33d3802e4ffb23ea9a.1622821729.git.qemu_oss@crudebyte.com>
2021-07-059pfs: fix not_same_qid()Christian Schoenebeck1-4/+1
There is only one user of not_same_qid() which is v9fs_walk() and the latter is using it for comparing a client supplied path with the 9p export root path, for the sole purpose to prevent a Twalk request from escaping from the exported 9p tree via "..". However for that specific purpose the implementation of not_same_qid() is wrong; if mtime of the 9p export root path changed between Tattach and Twalk then not_same_qid() returns true when actually comparing against the export root path. To fix for the actual semantic being used, only compare QID path members, but do not compare version or type members. Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <ca0abae4a899d81c6e87f683732d6c1f56915232.1622821729.git.qemu_oss@crudebyte.com>
2021-07-059pfs: simplify v9fs_walk()Christian Schoenebeck1-4/+5
There is only one comparison between nwnames and P9_MAXWELEM required. Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <E1liKiz-0006BC-Ja@lizzy.crudebyte.com>
2021-07-059pfs: add link to 9p developer docsChristian Schoenebeck18-0/+86
To lower the entry level for new developers, add a link to the 9p developer docs (i.e. qemu wiki) to MAINTAINERS and to the beginning of 9p source files, that is to: https://wiki.qemu.org/Documentation/9p Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Acked-by: Greg Kurz <groug@kaod.org> Message-Id: <E1leeDf-0008GZ-9q@lizzy.crudebyte.com>
2021-07-05util/async: print leaked BH name when AioContext finalizesStefan Hajnoczi1-2/+14
BHs must be deleted before the AioContext is finalized. If not, it's a bug and probably indicates that some part of the program still expects the BH to run in the future. That can lead to memory leaks, inconsistent state, or just hangs. Unfortunately the assert(flags & BH_DELETED) call in aio_ctx_finalize() is difficult to debug because the assertion failure contains no information about the BH! Use the QEMUBH name field added in the previous patch to show a useful error when a leaked BH is detected. Suggested-by: Eric Ernst <eric.g.ernst@gmail.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20210414200247.917496-3-stefanha@redhat.com>
2021-07-05util/async: add a human-readable name to BHs for debuggingStefan Hajnoczi5-9/+41
It can be difficult to debug issues with BHs in production environments. Although BHs can usually be identified by looking up their ->cb() function pointer, this requires debug information for the program. It is also not possible to print human-readable diagnostics about BHs because they have no identifier. This patch adds a name to each BH. The name is not unique per instance but differentiates between cb() functions, which is usually enough. It's done by changing aio_bh_new() and friends to macros that stringify cb. The next patch will use the name field when reporting leaked BHs. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210414200247.917496-2-stefanha@redhat.com>
2021-07-05migration/rdma: Use error_report to suppress errno messageLi Zhijian1-2/+2
Since the prior calls are successful, in this case a errno doesn't indicate a real error which would just make us confused. before: (qemu) migrate -d rdma:192.168.22.23:8888 source_resolve_host RDMA Device opened: kernel name rxe_eth0 uverbs device name uverbs2, infiniband_verbs class device path /sys/class/infiniband_verbs/uverbs2, infiniband class device path /sys/class/infiniband/rxe_eth0, transport: (2) Ethernet rdma_get_cm_event != EVENT_ESTABLISHED after rdma_connect: No space left on device Signed-off-by: Li Zhijian <lizhijian@cn.fujitsu.com> Message-Id: <20210628071959.23455-1-lizhijian@cn.fujitsu.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2021-07-05tests/migration: fix "downtime_limit" type when "migrate-set-parameters"Hyman Huang(黄勇)1-1/+1
migrate-set-parameters parse "downtime_limit" as integer type when execute "migrate-set-parameters" before migration, and, the unit dowtime_limit is milliseconds, fix this two so that test can go smoothly. Signed-off-by: Hyman Huang(黄勇) <huangy81@chinatelecom.cn> Message-Id: <31d82df24cc0c468dbe4d2d86730158ebf248071.1622729934.git.huangy81@chinatelecom.cn> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2021-07-05tests/migration: parse the thread-id key of CpuInfoFastHyman Huang(黄勇)1-1/+1
thread_id in CpuInfoFast is deprecated, parse thread-id instead after execute qmp query-cpus-fast. fix this so that test can go smoothly. Signed-off-by: Hyman Huang(黄勇) <huangy81@chinatelecom.cn> Message-Id: <584578c0a0dd781cee45f72ddf517f6e6a41c504.1622729934.git.huangy81@chinatelecom.cn> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2021-07-05virtiofsd: Add an option to enable/disable posix aclsVivek Goyal3-1/+118
fuse has an option FUSE_POSIX_ACL which needs to be opted in by fuse server to enable posix acls. As of now we are not opting in for this, so posix acls are disabled on virtiofs by default. Add virtiofsd option "-o posix_acl/no_posix_acl" to let users enable/disable posix acl support. By default it is disabled as of now due to performance concerns with cache=none. Currently even if file server has not opted in for FUSE_POSIX_ACL, user can still query acl and set acl, and system.posix_acl_access and system.posix_acl_default xattrs show up listxattr response. Miklos said this is confusing. So he said lets block and filter system.posix_acl_access and system.posix_acl_default xattrs in getxattr/setxattr/listxattr if user has explicitly disabled posix acls using -o no_posix_acl. As of now continuing to keeping the existing behavior if user did not specify any option to disable acl support due to concerns about backward compatibility. Signed-off-by: Vivek Goyal <vgoyal@redhat.com> Message-Id: <20210622150852.1507204-8-vgoyal@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2021-07-05virtiofsd: Switch creds, drop FSETID for system.posix_acl_access xattrVivek Goyal1-0/+75
When posix access acls are set on a file, it can lead to adjusting file permissions (mode) as well. If caller does not have CAP_FSETID and it also does not have membership of owner group, this will lead to clearing SGID bit in mode. Current fuse code is written in such a way that it expects file server to take care of chaning file mode (permission), if there is a need. Right now, host kernel does not clear SGID bit because virtiofsd is running as root and has CAP_FSETID. For host kernel to clear SGID, virtiofsd need to switch to gid of caller in guest and also drop CAP_FSETID (if caller did not have it to begin with). If SGID needs to be cleared, client will set the flag FUSE_SETXATTR_ACL_KILL_SGID in setxattr request. In that case server should kill sgid. Currently just switch to uid/gid of the caller and drop CAP_FSETID and that should do it. This should fix the xfstest generic/375 test case. We don't have to switch uid for this to work. That could be one optimization that pass a parameter to lo_change_cred() to only switch gid and not uid. Also this will not work whenever (if ever) we support idmapped mounts. In that case it is possible that uid/gid in request are 0/0 but still we need to clear SGID. So we will have to pick a non-root sgid and switch to that instead. That's an TODO item for future when idmapped mount support is introduced. This patch only adds the capability to switch creds and drop FSETID when acl xattr is set. This does not take affect yet. It can take affect when next patch adds the capability to enable posix_acl. Reported-by: Luis Henriques <lhenriques@suse.de> Signed-off-by: Vivek Goyal <vgoyal@redhat.com> Message-Id: <20210622150852.1507204-7-vgoyal@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2021-07-05virtiofsd: Add capability to change/restore umaskVivek Goyal1-6/+16
When parent directory has default acl and a file is created in that directory, then umask is ignored and final file permissions are determined using default acl instead. (man 2 umask). Currently, fuse applies the umask and sends modified mode in create request accordingly. fuse server can set FUSE_DONT_MASK and tell fuse client to not apply umask and fuse server will take care of it as needed. With posix acls enabled, requirement will be that we want umask to determine final file mode if parent directory does not have default acl. So if posix acls are enabled, opt in for FUSE_DONT_MASK. virtiofsd will set umask of the thread doing file creation. And host kernel should use that umask if parent directory does not have default acls, otherwise umask does not take affect. Miklos mentioned that we already call unshare(CLONE_FS) for every thread. That means umask has now become property of per thread and it should be ok to manipulate it in file creation path. This patch only adds capability to change umask and restore it. It does not enable it yet. Next few patches will add capability to enable it based on if user enabled posix_acl or not. This should fix fstest generic/099. Reported-by: Luis Henriques <lhenriques@suse.de> Signed-off-by: Vivek Goyal <vgoyal@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-Id: <20210622150852.1507204-6-vgoyal@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2021-07-05virtiofsd: Add umask to seccom allow listVivek Goyal1-0/+1
Patches in this series are going to make use of "umask" syscall. So allow it. Signed-off-by: Vivek Goyal <vgoyal@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20210622150852.1507204-5-vgoyal@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2021-07-05virtiofsd: Add support for extended setxattrVivek Goyal3-3/+14
Add the bits to enable support for setxattr_ext if fuse offers it. Do not enable it by default yet. Let passthrough_ll opt-in. Enabling it by deafult kind of automatically means that you are taking responsibility of clearing SGID if ACL is set. Signed-off-by: Vivek Goyal <vgoyal@redhat.com> Message-Id: <20210622150852.1507204-4-vgoyal@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Fixed up double def in fuse_common.h
2021-07-05virtiofsd: Fix xattr operations overwriting errnoVivek Goyal1-6/+10
getxattr/setxattr/removexattr/listxattr operations handle regualar and non-regular files differently. For the case of non-regular files we do fchdir(/proc/self/fd) and the xattr operation and then revert back to original working directory. After this we are saving errno and that's buggy because fchdir() will overwrite the errno. FCHDIR_NOFAIL(lo->proc_self_fd); ret = getxattr(procname, name, value, size); FCHDIR_NOFAIL(lo->root.fd); if (ret == -1) saverr = errno In above example, if getxattr() failed, we will still return 0 to caller as errno must have been written by FCHDIR_NOFAIL(lo->root.fd) call. Fix all such instances and capture "errno" early and save in "saverr" variable. Signed-off-by: Vivek Goyal <vgoyal@redhat.com> Message-Id: <20210622150852.1507204-3-vgoyal@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Greg Kurz <groug@kaod.org> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2021-07-05virtiofsd: Fix fuse setxattr() API change issueVivek Goyal2-1/+11
With kernel header updates fuse_setxattr_in struct has grown in size. But this new struct size only takes affect if user has opted in for fuse feature FUSE_SETXATTR_EXT otherwise fuse continues to send "fuse_setxattr_in" of older size. Older size is determined by FUSE_COMPAT_SETXATTR_IN_SIZE. Fix this. If we have not opted in for FUSE_SETXATTR_EXT, then expect that we will get fuse_setxattr_in of size FUSE_COMPAT_SETXATTR_IN_SIZE and not sizeof(struct fuse_sexattr_in). Fixes: 278f064e4524 ("Update Linux headers to 5.13-rc4") Signed-off-by: Vivek Goyal <vgoyal@redhat.com> Message-Id: <20210622150852.1507204-2-vgoyal@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Greg Kurz <groug@kaod.org> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2021-07-05virtiofsd: Don't allow file creation with FUSE_OPENGreg Kurz1-0/+6
A well behaved FUSE client uses FUSE_CREATE to create files. It isn't supposed to pass O_CREAT along a FUSE_OPEN request, as documented in the "fuse_lowlevel.h" header : /** * Open a file * * Open flags are available in fi->flags. The following rules * apply. * * - Creation (O_CREAT, O_EXCL, O_NOCTTY) flags will be * filtered out / handled by the kernel. But if the client happens to do it anyway, the server ends up passing this flag to open() without the mandatory mode_t 4th argument. Since open() is a variadic function, glibc will happily pass whatever it finds on the stack to the syscall. If this file is compiled with -D_FORTIFY_SOURCE=2, glibc will even detect that and abort: *** invalid openat64 call: O_CREAT or O_TMPFILE without mode ***: terminated Specifying O_CREAT with FUSE_OPEN is a protocol violation. Check this in do_open(), print out a message and return an error to the client, EINVAL like we already do when fuse_mbuf_iter_advance() fails. The FUSE filesystem doesn't currently support O_TMPFILE, but the very same would happen if O_TMPFILE was passed in a FUSE_OPEN request. Check that as well. Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <20210624101809.48032-1-groug@kaod.org> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2021-07-05docs: describe the security considerations with virtiofsd xattr mappingDaniel P. Berrangé1-5/+50
Different guest xattr prefixes have distinct access control rules applied by the guest. When remapping a guest xattr care must be taken that the remapping does not allow the a guest user to bypass guest kernel access control rules. For example if 'trusted.*' which requires CAP_SYS_ADMIN is remapped to 'user.virtiofs.trusted.*', an unprivileged guest user which can write to 'user.*' can bypass the CAP_SYS_ADMIN control. Thus the target of any remapping must be explicitly blocked from read/writes by the guest, to prevent access control bypass. The examples shown in the virtiofsd man page already do the right thing and ensure safety, but the security implications of getting this wrong were not made explicit. This could lead to host admins and apps unwittingly creating insecure configurations. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20210611120427.49736-1-berrange@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2021-07-05virtiofsd: use GDateTime for formatting timestamp for debug messagesDaniel P. Berrangé1-21/+4
The GDateTime APIs provided by GLib avoid portability pitfalls, such as some platforms where 'struct timeval.tv_sec' field is still 'long' instead of 'time_t'. When combined with automatic cleanup, GDateTime often results in simpler code too. Localtime is changed to UTC to avoid the need to grant extra seccomp permissions for GLib's access of the timezone database. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-Id: <20210611164319.67762-1-berrange@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2021-07-05migration: failover: continue to wait card unplug on errorLaurent Vivier1-0/+11
If the user cancels the migration in the unplug-wait state, QEMU will try to plug back the card and this fails because the card is partially unplugged. To avoid the problem, continue to wait the card unplug, but to allow the migration to be canceled if the card never finishes to unplug use a timeout. Bug: https://bugzilla.redhat.com/show_bug.cgi?id=1976852 Signed-off-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-Id: <20210629155007.629086-3-lvivier@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2021-07-05migration: move wait-unplug loop to its own functionLaurent Vivier1-28/+26
The loop is used in migration_thread() and bg_migration_thread(), so we can move it to its own function and call it from these both places. Moreover, in migration_thread() we have a wrong state transition from SETUP to ACTIVE while state could be WAIT_UNPLUG. This is correctly managed in bg_migration_thread() so use this code instead. Signed-off-by: Laurent Vivier <lvivier@redhat.com> Message-Id: <20210629155007.629086-2-lvivier@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2021-07-05migration: Allow reset of postcopy_recover_triggered when failedPeter Xu1-0/+13
It's possible qemu_start_incoming_migration() failed at any point, when it happens we should reset postcopy_recover_triggered to false so that the user can still retry with a saner incoming port. Signed-off-by: Peter Xu <peterx@redhat.com> Message-Id: <20210629181356.217312-3-peterx@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2021-07-05migration: Move yank outside qemu_start_incoming_migration()Peter Xu1-6/+5
Starting from commit b5eea99ec2f5c, qmp_migrate_recover() calls unregister before calling qemu_start_incoming_migration(). I believe it wanted to mitigate the next call to yank_register_instance(), but I think that's wrong. Firstly, if during recover, we should keep the yank instance there, not "quickly removing and adding it back". Meanwhile, calling qmp_migrate_recover() twice with b5eea99ec2f5c will directly crash the dest qemu (right now it can't; but it'll start to work right after the next patch) because the 1st call of qmp_migrate_recover() will unregister permanently when the channel failed to establish, then the 2nd call of qmp_migrate_recover() crashes at yank_unregister_instance(). This patch fixes it by moving yank ops out of qemu_start_incoming_migration() into qmp_migrate_incoming. For qmp_migrate_recover(), drop the unregister of yank instance too since we keep it there during the recovery phase. Signed-off-by: Peter Xu <peterx@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-Id: <20210629181356.217312-2-peterx@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2021-07-05migration: fix the memory overwriting risk in add_to_iovecFeng Lin1-0/+5
When testing migration, a Segmentation fault qemu core is generated. 0 error_free (err=0x1) 1 0x00007f8b862df647 in qemu_fclose (f=f@entry=0x55e06c247640) 2 0x00007f8b8516d59a in migrate_fd_cleanup (s=s@entry=0x55e06c0e1ef0) 3 0x00007f8b8516d66c in migrate_fd_cleanup_bh (opaque=0x55e06c0e1ef0) 4 0x00007f8b8626a47f in aio_bh_poll (ctx=ctx@entry=0x55e06b5a16d0) 5 0x00007f8b8626e71f in aio_dispatch (ctx=0x55e06b5a16d0) 6 0x00007f8b8626a33d in aio_ctx_dispatch (source=<optimized out>, callback=<optimized out>, user_data=<optimized out>) 7 0x00007f8b866bdba4 in g_main_context_dispatch () 8 0x00007f8b8626cde9 in glib_pollfds_poll () 9 0x00007f8b8626ce62 in os_host_main_loop_wait (timeout=<optimized out>) 10 0x00007f8b8626cffd in main_loop_wait (nonblocking=nonblocking@entry=0) 11 0x00007f8b862ef01f in main_loop () Using gdb print the struct QEMUFile f = { ..., iovcnt = 65, last_error = 21984, last_error_obj = 0x1, shutdown = true } Well iovcnt is overflow, because the max size of MAX_IOV_SIZE is 64. struct QEMUFile { ...; struct iovec iov[MAX_IOV_SIZE]; unsigned int iovcnt; int last_error; Error *last_error_obj; bool shutdown; }; iovcnt and last_error is overwrited by add_to_iovec(). Right now, add_to_iovec() increase iovcnt before check the limit. And it seems that add_to_iovec() assumes that iovcnt will set to zero in qemu_fflush(). But qemu_fflush() will directly return when f->shutdown is true. The situation may occur when libvirtd restart during migration, after f->shutdown is set, before calling qemu_file_set_error() in qemu_file_shutdown(). So the safiest way is checking the iovcnt before increasing it. Signed-off-by: Feng Lin <linfeng23@huawei.com> Message-Id: <20210625062138.1899-1-linfeng23@huawei.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Fix typo in 'writeable' which is actually misnamed 'writable'
2021-07-05tests: migration-test: Add dirty ring testPeter Xu1-3/+55
Add dirty ring test if kernel supports it. Add the dirty ring parameter on source should be mostly enough, but let's change the dest too to make them match always. Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Peter Xu <peterx@redhat.com> Message-Id: <20210615175523.439830-3-peterx@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2021-07-05Merge remote-tracking branch 'remotes/marcel/tags/pvrdma-04-07-2021-v2' into ↵Peter Maydell3-1/+13
staging PVRDMA queue Several CVE fixes for the PVRDMA device. # gpg: Signature made Sun 04 Jul 2021 20:56:05 BST # gpg: using RSA key 36D4C0F0CF2FE46D # gpg: Good signature from "Marcel Apfelbaum <marcel.apfelbaum@zoho.com>" [marginal] # gpg: aka "Marcel Apfelbaum <marcel@redhat.com>" [marginal] # gpg: aka "Marcel Apfelbaum <marcel.apfelbaum@gmail.com>" [marginal] # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: B1C6 3A57 F92E 08F2 640F 31F5 36D4 C0F0 CF2F E46D * remotes/marcel/tags/pvrdma-04-07-2021-v2: pvrdma: Fix the ring init error flow (CVE-2021-3608) pvrdma: Ensure correct input on ring init (CVE-2021-3607) hw/rdma: Fix possible mremap overflow in the pvrdma device (CVE-2021-3582) Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-04pvrdma: Fix the ring init error flow (CVE-2021-3608)Marcel Apfelbaum1-1/+1
Do not unmap uninitialized dma addresses. Fixes: CVE-2021-3608 Reviewed-by: VictorV (Kunlun Lab) <vv474172261@gmail.com> Tested-by: VictorV (Kunlun Lab) <vv474172261@gmail.com> Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Message-Id: <20210630115246.2178219-1-marcel@redhat.com> Tested-by: Yuval Shaia <yuval.shaia.ml@gmail.com> Reviewed-by: Yuval Shaia <yuval.shaia.ml@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
2021-07-04pvrdma: Ensure correct input on ring init (CVE-2021-3607)Marcel Apfelbaum1-0/+5
Check the guest passed a non zero page count for pvrdma device ring buffers. Fixes: CVE-2021-3607 Reported-by: VictorV (Kunlun Lab) <vv474172261@gmail.com> Reviewed-by: VictorV (Kunlun Lab) <vv474172261@gmail.com> Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Message-Id: <20210630114634.2168872-1-marcel@redhat.com> Reviewed-by: Yuval Shaia <yuval.shaia.ml@gmail.com> Tested-by: Yuval Shaia <yuval.shaia.ml@gmail.com> Signed-off-by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
2021-07-04hw/rdma: Fix possible mremap overflow in the pvrdma device (CVE-2021-3582)Marcel Apfelbaum1-0/+7
Ensure mremap boundaries not trusting the guest kernel to pass the correct buffer length. Fixes: CVE-2021-3582 Reported-by: VictorV (Kunlun Lab) <vv474172261@gmail.com> Tested-by: VictorV (Kunlun Lab) <vv474172261@gmail.com> Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Message-Id: <20210616110600.20889-1-marcel.apfelbaum@gmail.com> Reviewed-by: Yuval Shaia <yuval.shaia.ml@gmail.com> Tested-by: Yuval Shaia <yuval.shaia.ml@gmail.com> Reviewed-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
2021-07-04Merge remote-tracking branch 'remotes/philmd/tags/mips-20210702' into stagingPeter Maydell15-9456/+9603
MIPS patches queue - Extract nanoMIPS, microMIPS, Code Compaction from translate.c - Allow PCI config accesses smaller than 32-bit on Bonito64 device - Fix migration of g364fb device on Jazz Magnum - Fix dp8393x PROM checksum on Jazz Magnum and Quadra 800 - Map the UART devices unconditionally on Jazz Magnum - Add functional test booting Linux on the Fuloong 2E # gpg: Signature made Fri 02 Jul 2021 16:36:19 BST # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * remotes/philmd/tags/mips-20210702: hw/mips/jazz: Map the UART devices unconditionally hw/mips/jazz: specify correct endian for dp8393x device hw/m68k/q800: fix PROM checksum and MAC address storage qemu/bitops.h: add bitrev8 implementation dp8393x: remove onboard PROM containing MAC address and checksum hw/m68k/q800: move PROM and checksum calculation from dp8393x device to board hw/mips/jazz: move PROM and checksum calculation from dp8393x device to board dp8393x: convert to trace-events dp8393x: checkpatch fixes g364fb: add VMStateDescription for G364SysBusState g364fb: use RAM memory region for framebuffer tests/acceptance: Test Linux on the Fuloong 2E machine hw/pci-host/bonito: Allow PCI config accesses smaller than 32-bit hw/pci-host/bonito: Trace PCI config accesses smaller than 32-bit target/mips: Extract nanoMIPS ISA translation routines target/mips: Extract the microMIPS ISA translation routines target/mips: Extract Code Compaction ASE translation routines target/mips: Add declarations for generic TCG helpers Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-07-03Merge remote-tracking branch ↵Peter Maydell20-209/+1760
'remotes/pmaydell/tags/pull-target-arm-20210702' into staging target-arm queue: * more MVE instructions * hw/gpio/gpio_pwr: use shutdown function for reboot * target/arm: Check NaN mode before silencing NaN * tests: Boot and halt a Linux guest on the Raspberry Pi 2 machine * hw/arm: Add basic power management to raspi. * docs/system/arm: Add quanta-gbs-bmc, quanta-q7l1-bmc # gpg: Signature made Fri 02 Jul 2021 13:59:19 BST # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20210702: (24 commits) target/arm: Implement MVE shifts by register target/arm: Implement MVE shifts by immediate target/arm: Implement MVE long shifts by register target/arm: Implement MVE long shifts by immediate target/arm: Implement MVE VADDLV target/arm: Implement MVE VSHLC target/arm: Implement MVE saturating narrowing shifts target/arm: Implement MVE VSHRN, VRSHRN target/arm: Implement MVE VSRI, VSLI target/arm: Implement MVE VSHLL target/arm: Implement MVE vector shift right by immediate insns target/arm: Implement MVE vector shift left by immediate insns target/arm: Implement MVE logical immediate insns target/arm: Use dup_const() instead of bitfield_replicate() target/arm: Use asimd_imm_const for A64 decode target/arm: Make asimd_imm_const() public target/arm: Fix bugs in MVE VRMLALDAVH, VRMLSLDAVH target/arm: Fix MVE widening/narrowing VLDR/VSTR offset calculation hw/gpio/gpio_pwr: use shutdown function for reboot target/arm: Check NaN mode before silencing NaN ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
generated by cgit v1.1 at 2024-11-03 13:43:02 +0000