summary refs log tree commit diff stats
Commit message (Collapse)AuthorAgeFilesLines
* tests: add qmp/qom-set-without-value testMarc-André Lureau2018-08-311-0/+14
| | | | | | | | | | | test_qom_set_without_value() is about a bug in infrastructure used by the QMP core, fixed in commit c489780203. We covered the bug in infrastructure unit tests (commit bce3035a44). I wrote that test earlier, to cover QMP level as well, the test could go into qmp-test. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
* tests: add qmp/object-add-without-props testMarc-André Lureau2018-08-311-0/+18
| | | | | | | | | | | test_object_add_without_props() tests a bug in qmp_object_add() we fixed in commit e64c75a975. Sadly, we don't have systematic object-add tests. This lone test can go into qmp-cmd-test for want of a better home. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
* tests: add qmp_assert_error_class()Marc-André Lureau2018-08-315-61/+46
| | | | | | | | | | This helper will simplify a bunch of code checking for QMP errors and can be shared by various tests. Note that test-qga does check for error description as well, so don't replace the code there for now. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
* tests/libqos: Utilize newer glib spawn checkEric Blake2018-08-311-11/+1
| | | | | | | | | | | | | | | | | | | | | | | | During development, I got a 'make check' failure that claimed: qemu-img returned status code 32512 ** ERROR:tests/libqos/libqos.c:202:mkimg: assertion failed: (!rc) But 32512 is too big for a normal exit status value, which means we failed to use WEXITSTATUS() to shift the bits to the desired value for printing. However, instead of worrying about how to portably parse g_spawn()'s rc in the proper platform-dependent manner, it's better to just rely on the fact that we now require glib 2.40 (since commit e7b3af815) and can therefore use glib's portable checker instead, where the message under my same condition improves to: Child process exited with code 127 ** ERROR:tests/libqos/libqos.c:192:mkimg: assertion failed: (ret && !err) Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
* net: Remove the deprecated -tftp, -bootp, -redir and -smb optionsThomas Huth2018-08-317-185/+29
| | | | | | | | | | | | | These options likely do not work as expected as soon as the user tries to use more than one network interface at once. The parameters have been marked as deprecated since QEMU v2.6, so users had plenty of time to move their scripts to the new syntax. Time to remove the old parameters now. Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Acked-by: Peter Krempa <pkrempa@redhat.com> Acked-by: Ján Tomko <jtomko@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
* Remove the deprecated options -startdate, -localtime and -rtc-td-hackThomas Huth2018-08-313-74/+22
| | | | | | | | | Deprecated since two releases, nobody complained, thus it's time to remove them now. Acked-by: Peter Krempa <pkrempa@redhat.com> Acked-by: Ján Tomko <jtomko@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
* Remove the deprecated -nodefconfig optionThomas Huth2018-08-314-10/+4
| | | | | | | | | It's the same as -no-user-config and marked as deprecated since three releases already. Time to remove it now. Acked-by: Peter Krempa <pkrempa@redhat.com> Acked-by: Ján Tomko <jtomko@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
* Remove the deprecated -balloon optionThomas Huth2018-08-314-54/+3
| | | | | | | | | | | | | | | The "-balloon" option has been replaced by "-device virtio-balloon". It's been marked as deprecated since two releases, and nobody complained, so let's remove it now. Acked-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: David Hildenbrand <david@redhat.com> Acked-by: Peter Krempa <pkrempa@redhat.com> Acked-by: Ján Tomko <jtomko@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
* Merge remote-tracking branch 'remotes/armbru/tags/pull-error-2018-08-27-v2' ↵Peter Maydell2018-08-273-59/+115
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging Error reporting patches for 2018-08-27 # gpg: Signature made Mon 27 Aug 2018 14:18:15 BST # gpg: using RSA key 3870B400EB918653 # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * remotes/armbru/tags/pull-error-2018-08-27-v2: intel-iommu: replace more vtd_err_* traces intel-iommu: start to use error_report_once qemu-error: introduce {error|warn}_report_once Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * intel-iommu: replace more vtd_err_* tracesPeter Xu2018-08-272-30/+46
| | | | | | | | | | | | | | | | | | | | | | Replace all the trace_vtd_err_*() hooks with the new error_report_once() since they are similar to trace_vtd_err() - dumping the first error would be mostly enough, then we have them on by default too. Signed-off-by: Peter Xu <peterx@redhat.com> Message-Id: <20180815095328.32414-4-peterx@redhat.com> [Use "%x" instead of "%" PRIx16 to print uint16_t, whitespace tidied up] Signed-off-by: Markus Armbruster <armbru@redhat.com>
| * intel-iommu: start to use error_report_oncePeter Xu2018-08-272-29/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Replace existing trace_vtd_err() with error_report_once() then stderr will capture something if any of the error happens, meanwhile we don't suffer from any DDOS. Then remove the trace point. Since at it, provide more information where proper (now we can pass parameters into the report function). Signed-off-by: Peter Xu <peterx@redhat.com> Message-Id: <20180815095328.32414-3-peterx@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> [Two format strings fixed, whitespace tidied up] Signed-off-by: Markus Armbruster <armbru@redhat.com>
| * qemu-error: introduce {error|warn}_report_oncePeter Xu2018-08-271-0/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are many error_report()s that can be used in frequently called functions, especially on IO paths. That can be unideal in that malicious guest can try to trigger the error tons of time which might use up the log space on the host (e.g., libvirt can capture the stderr of QEMU and put it persistently onto disk). In VT-d emulation code, we have trace_vtd_error() tracer. AFAIU all those places can be replaced by something like error_report() but trace points are mostly used to avoid the DDOS attack that mentioned above. However using trace points mean that errors are not dumped if trace not enabled. It's not a big deal in most modern server managements since we have things like logrotate to maintain the logs and make sure the quota is expected. However it'll still be nice that we just provide another way to restrict message generations. In most cases, this kind of error_report()s will only provide valid information on the first message sent, and all the rest of similar messages will be mostly talking about the same thing. This patch introduces *_report_once() helpers to allow a message to be dumped only once during one QEMU process's life cycle. It will make sure: (1) it's on by deffault, so we can even get something without turning the trace on and reproducing, and (2) it won't be affected by DDOS attack. To implement it, I stole the printk_once() macro from Linux. CC: Eric Blake <eblake@redhat.com> CC: Markus Armbruster <armbru@redhat.com> Signed-off-by: Peter Xu <peterx@redhat.com> Message-Id: <20180815095328.32414-2-peterx@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> [Whitespace adjusted, comments improved] Signed-off-by: Markus Armbruster <armbru@redhat.com>
* | Merge remote-tracking branch 'remotes/juanquintela/tags/check/20180827' into ↵Peter Maydell2018-08-273-92/+19
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging check/next for 20180827 # gpg: Signature made Mon 27 Aug 2018 10:58:51 BST # gpg: using RSA key F487EF185872D723 # gpg: Good signature from "Juan Quintela <quintela@redhat.com>" # gpg: aka "Juan Quintela <quintela@trasno.org>" # Primary key fingerprint: 1899 FF8E DEBF 58CC EE03 4B82 F487 EF18 5872 D723 * remotes/juanquintela/tags/check/20180827: check: Move wdt_ib700 test to common check: Move endianess test to common check: Move VMXNET3 test to common check: Only test boot-serial when sga is compiled in check: Only test ivshm when it is compiled in x86_64-softmmu: Configuration is identical to i386-softmmu check: Only test usb-xhci-nec when it is compiled in check: Only test isa-testdev when it is compiled in configure: We don't want to clean configuration files Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | check: Move wdt_ib700 test to commonJuan Quintela2018-08-271-2/+2
| | | | | | | | | | | | | | | | | | | | | It is protected by CONFIG_WDT_IB700. Signed-off-by: Juan Quintela <quintela@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com>
| * | check: Move endianess test to commonJuan Quintela2018-08-271-13/+1
| | | | | | | | | | | | | | | | | | | | | | | | It is already protected by CONFIG_ISA_TESTDEV in all architectures. Signed-off-by: Juan Quintela <quintela@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
| * | check: Move VMXNET3 test to commonJuan Quintela2018-08-271-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | We protect it with CONFIG_VMXNET3_PCI now, so no need to also put it on i386. Signed-off-by: Juan Quintela <quintela@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
| * | check: Only test boot-serial when sga is compiled inJuan Quintela2018-08-271-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | This is only for x86* architecture. Signed-off-by: Juan Quintela <quintela@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
| * | check: Only test ivshm when it is compiled inJuan Quintela2018-08-271-3/+4
| | | | | | | | | | | | | | | | | | Signed-off-by: Juan Quintela <quintela@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
| * | x86_64-softmmu: Configuration is identical to i386-softmmuJuan Quintela2018-08-271-66/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | If we ever changed that, just make the things that are different explicit. Signed-off-by: Juan Quintela <quintela@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
| * | check: Only test usb-xhci-nec when it is compiled inJuan Quintela2018-08-271-4/+6
| | | | | | | | | | | | | | | | | | Signed-off-by: Juan Quintela <quintela@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
| * | check: Only test isa-testdev when it is compiled inJuan Quintela2018-08-271-8/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Once there, untangle endianness-test and boot-serial-test. Signed-off-by: Juan Quintela <quintela@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> --- boot-serial-test don't depend on isa-testdev. Thanks Thomas.
| * | configure: We don't want to clean configuration filesJuan Quintela2018-08-271-1/+2
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | If you don't want to compile everything, you configure config-devices.mak. And then make clean remove it, and make will create a default one without your configuration. Fix it by not removing it on clean target. Remove it instead on distclean. Signed-off-by: Juan Quintela <quintela@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> --- Remove it instead on distclean.
* | Merge remote-tracking branch ↵Peter Maydell2018-08-2717-237/+139
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'remotes/kraxel/tags/ui-20180827-v4-pull-request' into staging ui: misc fixes which piled up during 3.0 release freeze # gpg: Signature made Mon 27 Aug 2018 09:53:07 BST # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/ui-20180827-v4-pull-request: util: promote qemu_egl_rendernode_open() to libqemuutil dmabuf: add y0_top, pass it to spice ui/vnc: Remove useless parenthesis around DIV_ROUND_UP macro ui/sdl2: Fix broken -full-screen CLI option spice-display: fix qemu_spice_cursor_refresh_bh locking spice-display: access ptr_x/ptr_y under Mutex vnc: remove support for deprecated tls, x509, x509verify options doc: switch to modern syntax for VNC TLS setup sdl2: redraw correctly when scanout_mode enabled. ui: use enum to string helpers vnc: fix memleak of the "vnc-worker-output" name ui/sdl2: Remove the obsolete SDL_INIT_NOPARACHUTE flag Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * util: promote qemu_egl_rendernode_open() to libqemuutilMarc-André Lureau2018-08-275-49/+76
| | | | | | | | | | | | | | | | | | | | | | vhost-user-gpu will share the same code to open a DRM node. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20180713130916.4153-20-marcandre.lureau@redhat.com> [ kraxel: buildfix: util/drm.o must be CONFIG_OPENGL not CONFIG_LINUX ] Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * dmabuf: add y0_top, pass it to spiceMarc-André Lureau2018-08-242-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Some scanouts during boot are top-down without it. y0_top is set from VHOST_USER_GPU_DMABUF_SCANOUT code path in the last patch of this series. In current QEMU code base, only vfio/display uses dmabuf API. But the VFIO query interface doesn't provide or need that detail so far. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20180713130916.4153-5-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * ui/vnc: Remove useless parenthesis around DIV_ROUND_UP macroPhilippe Mathieu-Daudé2018-08-242-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | Patch created mechanically by rerunning: $ spatch --sp-file scripts/coccinelle/round.cocci \ --macro-file scripts/cocci-macro-file.h \ --dir . --in-place Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20180704153919.12432-7-f4bug@amsat.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * ui/sdl2: Fix broken -full-screen CLI optionThomas Huth2018-08-241-5/+4
| | | | | | | | | | | | | | | | | | | | | | We've got to set the gui_fullscreen variable before creating the SDL2 window, otherwise the initial window will not be created in fullscreen mode. Buglink: https://bugs.launchpad.net/bugs/1780812 Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 1531161850-6860-1-git-send-email-thuth@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * spice-display: fix qemu_spice_cursor_refresh_bh lockingPaolo Bonzini2018-08-241-12/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | spice-display should not call the ui/console.c functions dpy_cursor_define and dpy_moues_set with the SimpleSpiceDisplay lock taken. That will cause a deadlock, because the DisplayChangeListener callbacks will take the lock again. It is also in general a bad idea to invoke generic callbacks with a lock taken, because it can cause AB-BA deadlocks in the long run. The only thing that requires care is that the cursor may disappear as soon as the mutex is released, so you need an extra cursor_get/cursor_put pair. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20180720063109.4631-3-pbonzini@redhat.com [ kraxel: fix dpy_cursor_define() call ] Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * spice-display: access ptr_x/ptr_y under MutexPaolo Bonzini2018-08-241-1/+8
| | | | | | | | | | | | | | | | | | | | The OpenGL-enabled SPICE code was not accessing the cursor position under the SimpleSpiceDisplay lock. Fix this. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20180720063109.4631-2-pbonzini@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * vnc: remove support for deprecated tls, x509, x509verify optionsDaniel P. Berrangé2018-08-243-154/+0
| | | | | | | | | | | | | | | | | | | | | | | | The 'tls-creds' option accepts the name of a TLS credentials object. This replaced the usage of 'tls', 'x509' and 'x509verify' options in 2.5.0. These deprecated options were grandfathered in when the deprecation policy was introduded in 2.10.0, so can now finally be removed. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-id: 20180725092751.21767-3-berrange@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * doc: switch to modern syntax for VNC TLS setupDaniel P. Berrangé2018-08-241-5/+15
| | | | | | | | | | | | | | | | | | The use of 'tls', 'x509' and 'x509verify' properties is the deprecated backcompat syntax, replaced by use of TLS creds objects. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-id: 20180725092751.21767-2-berrange@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * sdl2: redraw correctly when scanout_mode enabled.Tao Wu2018-08-241-0/+5
| | | | | | | | | | | | | | | | | | | | | | When scanout_mode enabled, surface is out of sync with actual screen. In such case, we just call sdl2_gl_scanout_flush to do redraw. This fixes bug reported in https://lists.freedesktop.org/archives/virglrenderer-devel/2018-July/001330.html Signed-off-by: Tao Wu <lepton@google.com> Message-id: 20180726225900.180698-1-lepton@google.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * ui: use enum to string helpersMarc-André Lureau2018-08-242-4/+4
| | | | | | | | | | | | | | | | | | Minor code simplification. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-id: 20180801092508.4927-1-marcandre.lureau@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * vnc: fix memleak of the "vnc-worker-output" namePeter Wu2018-08-241-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes repeated memory leaks of 18 bytes when using VNC: Direct leak of 831024 byte(s) in 46168 object(s) allocated from: ... #4 0x7f6d2f919bdd in g_strdup_vprintf glib/gstrfuncs.c:514 #5 0x56085cdcf660 in buffer_init util/buffer.c:59 #6 0x56085ca6a7ec in vnc_async_encoding_start ui/vnc-jobs.c:177 #7 0x56085ca6b815 in vnc_worker_thread_loop ui/vnc-jobs.c:240 Fixes: 543b95801f98 ("vnc: attach names to buffers") Cc: Gerd Hoffmann <kraxel@redhat.com> CC: qemu-stable@nongnu.org Signed-off-by: Peter Wu <peter@lekensteyn.nl> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20180807221830.3844-1-peter@lekensteyn.nl Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| * ui/sdl2: Remove the obsolete SDL_INIT_NOPARACHUTE flagThomas Huth2018-08-241-3/+1
| | | | | | | | | | | | | | | | | | | | | | SDL_INIT_NOPARACHUTE is not used in SDL2 anymore, and the define is just a dummy (see https://wiki.libsdl.org/MigrationGuide#Some_general_truths for example). So we can remove it and get rid of the "flags" variable nowadays. Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 1533721602-15763-1-git-send-email-thuth@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | Merge remote-tracking branch 'remotes/otubo/tags/pull-seccomp-20180823' into ↵Peter Maydell2018-08-252-6/+37
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging pull-seccomp-20180823 # gpg: Signature made Thu 23 Aug 2018 15:46:13 BST # gpg: using RSA key DF32E7C0F0FFF9A2 # gpg: Good signature from "Eduardo Otubo (Senior Software Engineer) <otubo@redhat.com>" # Primary key fingerprint: D67E 1B50 9374 86B4 0723 DBAB DF32 E7C0 F0FF F9A2 * remotes/otubo/tags/pull-seccomp-20180823: seccomp: set the seccomp filter to all threads configure: require libseccomp 2.2.0 seccomp: prefer SCMP_ACT_KILL_PROCESS if available seccomp: use SIGSYS signal instead of killing the thread Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | seccomp: set the seccomp filter to all threadsMarc-André Lureau2018-08-231-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When using "-seccomp on", the seccomp policy is only applied to the main thread, the vcpu worker thread and other worker threads created after seccomp policy is applied; the seccomp policy is not applied to e.g. the RCU thread because it is created before the seccomp policy is applied and SECCOMP_FILTER_FLAG_TSYNC isn't used. This can be verified with for task in /proc/`pidof qemu`/task/*; do cat $task/status | grep Secc ; done Seccomp: 2 Seccomp: 0 Seccomp: 0 Seccomp: 2 Seccomp: 2 Seccomp: 2 Starting with libseccomp 2.2.0 and kernel >= 3.17, we can use seccomp_attr_set(ctx, > SCMP_FLTATR_CTL_TSYNC, 1) to update the policy on all threads. libseccomp requirement was bumped to 2.2.0 in previous patch. libseccomp should fail to set the filter if it can't honour SCMP_FLTATR_CTL_TSYNC (untested), and thus -sandbox will now fail on kernel < 3.17. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Acked-by: Eduardo Otubo <otubo@redhat.com>
| * | configure: require libseccomp 2.2.0Marc-André Lureau2018-08-231-5/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The following patch is going to require TSYNC, which is only available since libseccomp 2.2.0. libseccomp 2.2.0 was released February 12, 2015. According to repology, libseccomp version in different distros: RHEL-7: 2.3.1 Debian (Stretch): 2.3.1 OpenSUSE Leap 15: 2.3.2 Ubuntu (Xenial): 2.3.1 This will drop support for -sandbox on: Debian (Jessie): 2.1.1 (but 2.2.3 in backports) Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Acked-by: Eduardo Otubo <otubo@redhat.com>
| * | seccomp: prefer SCMP_ACT_KILL_PROCESS if availableMarc-André Lureau2018-08-231-1/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The upcoming libseccomp release should have SCMP_ACT_KILL_PROCESS action (https://github.com/seccomp/libseccomp/issues/96). SCMP_ACT_KILL_PROCESS is preferable to immediately terminate the offending process, rather than having the SIGSYS handler running. Use SECCOMP_GET_ACTION_AVAIL to check availability of kernel support, as libseccomp will fallback on SCMP_ACT_KILL otherwise, and we still prefer SCMP_ACT_TRAP. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Acked-by: Eduardo Otubo <otubo@redhat.com>
| * | seccomp: use SIGSYS signal instead of killing the threadMarc-André Lureau2018-08-231-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The seccomp action SCMP_ACT_KILL results in immediate termination of the thread that made the bad system call. However, qemu being multi-threaded, it keeps running. There is no easy way for parent process / management layer (libvirt) to know about that situation. Instead, the default SIGSYS handler when invoked with SCMP_ACT_TRAP will terminate the program and core dump. This may not be the most secure solution, but probably better than just killing the offending thread. SCMP_ACT_KILL_PROCESS has been added in Linux 4.14 to improve the situation, which I propose to use by default if available in the next patch. Related to: https://bugzilla.redhat.com/show_bug.cgi?id=1594456 Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Acked-by: Eduardo Otubo <otubo@redhat.com>
* | | Merge remote-tracking branch 'remotes/awilliam/tags/vfio-fixes-20180823.1' ↵Peter Maydell2018-08-253-3/+18
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging VFIO fixes 2018-08-23 - Fix coverity reported issue with use of realpath (Alex Williamson) - Cleanup file descriptor in error path (Alex Williamson) - Fix postcopy use of new balloon inhibitor (Alex Williamson) # gpg: Signature made Thu 23 Aug 2018 17:46:41 BST # gpg: using RSA key 239B9B6E3BB08B22 # gpg: Good signature from "Alex Williamson <alex.williamson@redhat.com>" # gpg: aka "Alex Williamson <alex@shazbot.org>" # gpg: aka "Alex Williamson <alwillia@redhat.com>" # gpg: aka "Alex Williamson <alex.l.williamson@gmail.com>" # Primary key fingerprint: 42F6 C04E 540B D1A9 9E7B 8A90 239B 9B6E 3BB0 8B22 * remotes/awilliam/tags/vfio-fixes-20180823.1: postcopy: Synchronize usage of the balloon inhibitor vfio/pci: Fix failure to close file descriptor on error vfio/pci: Handle subsystem realpath() returning NULL Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | | postcopy: Synchronize usage of the balloon inhibitorAlex Williamson2018-08-231-2/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | While the qemu_balloon_inhibit() interface appears rather general purpose, postcopy uses it in a last-caller-wins approach with no guarantee of balanced inhibits and de-inhibits. Wrap postcopy's usage of the inhibitor to give it one vote overall, using the same last-caller-wins approach as previously implemented at the balloon level. Fixes: 01ccbec7bdf6 ("balloon: Allow multiple inhibit users") Reported-by: Christian Borntraeger <borntraeger@de.ibm.com> Tested-by: Christian Borntraeger <borntraeger@de.ibm.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
| * | | vfio/pci: Fix failure to close file descriptor on errorAlex Williamson2018-08-231-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A new error path fails to close the device file descriptor when triggered by a ballooning incompatibility within the group. Fix it. Fixes: 238e91728503 ("vfio/ccw/pci: Allow devices to opt-in for ballooning") Reviewed-by: Peter Xu <peterx@redhat.com> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
| * | | vfio/pci: Handle subsystem realpath() returning NULLAlex Williamson2018-08-231-1/+1
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix error reported by Coverity where realpath can return NULL, resulting in a segfault in strcmp(). This should never happen given that we're working through regularly structured sysfs paths, but trivial enough to easily avoid. Fixes: 238e91728503 ("vfio/ccw/pci: Allow devices to opt-in for ballooning") Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
* | | Merge remote-tracking branch 'remotes/armbru/tags/pull-qobject-2018-08-24' ↵Peter Maydell2018-08-2534-1329/+1472
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging QObject patches for 2018-08-24 # gpg: Signature made Fri 24 Aug 2018 20:28:53 BST # gpg: using RSA key 3870B400EB918653 # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * remotes/armbru/tags/pull-qobject-2018-08-24: (58 commits) json: Update references to RFC 7159 to RFC 8259 json: Support %% in JSON strings when interpolating json: Improve safety of qobject_from_jsonf_nofail() & friends json: Keep interpolation state in JSONParserContext tests/drive_del-test: Fix harmless JSON interpolation bug json: Clean up headers qobject: Drop superfluous includes of qemu-common.h json: Make JSONToken opaque outside json-parser.c json: Unbox tokens queue in JSONMessageParser json: Streamline json_message_process_token() json: Enforce token count and size limits more tightly qjson: Have qobject_from_json() & friends reject empty and blank json: Assert json_parser_parse() consumes all tokens on success json: Fix streamer not to ignore trailing unterminated structures json: Fix latent parser aborts at end of input qjson: Fix qobject_from_json() & friends for multiple values json: Improve names of lexer states related to numbers json: Replace %I64d, %I64u by %PRId64, %PRIu64 json: Leave rejecting invalid interpolation to parser json: Pass lexical errors and limit violations to callback ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | | json: Update references to RFC 7159 to RFC 8259Markus Armbruster2018-08-243-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | RFC 8259 (December 2017) obsoletes RFC 7159 (March 2014). Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20180823164025.12553-59-armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
| * | | json: Support %% in JSON strings when interpolatingMarkus Armbruster2018-08-242-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The previous commit makes JSON strings containing '%' awkward to express in templates: you'd have to mask the '%' with an Unicode escape \u0025. No template currently contains such JSON strings. Support the printf conversion specification %% in JSON strings as a convenience anyway, because it's trivially easy to do. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-Id: <20180823164025.12553-58-armbru@redhat.com>
| * | | json: Improve safety of qobject_from_jsonf_nofail() & friendsMarkus Armbruster2018-08-242-12/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The JSON parser optionally supports interpolation. This is used to build QObjects by parsing string templates. The templates are C literals, so parse errors (such as invalid interpolation specifications) are actually programming errors. Consequently, the functions providing parsing with interpolation (qobject_from_jsonf_nofail(), qobject_from_vjsonf_nofail(), qdict_from_jsonf_nofail(), qdict_from_vjsonf_nofail()) pass &error_abort to the parser. However, there's another, more dangerous kind of programming error: since we use va_arg() to get the value to interpolate, behavior is undefined when the variable argument isn't consistent with the interpolation specification. The same problem exists with printf()-like functions, and the solution is to have the compiler check consistency. This is what GCC_FMT_ATTR() is about. To enable this type checking for interpolation as well, we carefully chose our interpolation specifications to match printf conversion specifications, and decorate functions parsing templates with GCC_FMT_ATTR(). Note that this only protects against undefined behavior due to type errors. It can't protect against use of invalid interpolation specifications that happen to be valid printf conversion specifications. However, there's still a gaping hole in the type checking: GCC recognizes '%' as start of printf conversion specification anywhere in the template, but the parser recognizes it only outside JSON strings. For instance, if someone were to pass a "{ '%s': %d }" template, GCC would require a char * and an int argument, but the parser would va_arg() only an int argument, resulting in undefined behavior. Avoid undefined behavior by catching the programming error at run time: have the parser recognize and reject '%' in JSON strings. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-Id: <20180823164025.12553-57-armbru@redhat.com>
| * | | json: Keep interpolation state in JSONParserContextMarkus Armbruster2018-08-241-29/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The recursive descent parser passes along a pointer to JSONParserContext. It additionally passes a pointer to interpolation state (a va_alist *) as needed to reach its consumer parse_interpolation(). Stuffing the latter pointer into JSONParserContext saves us the trouble of passing it along, so do that. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-Id: <20180823164025.12553-56-armbru@redhat.com>
| * | | tests/drive_del-test: Fix harmless JSON interpolation bugMarkus Armbruster2018-08-241-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | test_after_failed_device_add() does this: response = qmp("{'execute': 'device_add'," " 'arguments': {" " 'driver': 'virtio-blk-%s'," " 'drive': 'drive0'" "}}", qvirtio_get_dev_type()); Wrong. An interpolation specification must be a JSON token, it doesn't work within JSON string tokens. The code above doesn't use the value of qvirtio_get_dev_type(), and sends arguments {"driver": "virtio-blk-%s", "drive": "drive0"}} The command fails because there is no driver named "virtio-blk-%". Harmless, since the test wants the command to fail. Screwed up in commit 2f84a92ec63. Fix the obvious way. The command now fails because the drive is empty, like it did before commit 2f84a92ec63. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-Id: <20180823164025.12553-55-armbru@redhat.com>