aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2021-02-05vhost: Check for valid vdev in vhost_backend_handle_iotlb_msgEugenio Pérez
Not checking this can lead to invalid dev->vdev member access in vhost_device_iotlb_miss if backend issue an iotlb message in a bad timing, either maliciously or by a bug. Reproduced rebooting a guest with testpmd in txonly forward mode. #0 0x0000559ffff94394 in vhost_device_iotlb_miss ( dev=dev@entry=0x55a0012f6680, iova=10245279744, write=1) at ../hw/virtio/vhost.c:1013 #1 0x0000559ffff9ac31 in vhost_backend_handle_iotlb_msg ( imsg=0x7ffddcfd32c0, dev=0x55a0012f6680) at ../hw/virtio/vhost-backend.c:411 #2 vhost_backend_handle_iotlb_msg (dev=dev@entry=0x55a0012f6680, imsg=imsg@entry=0x7ffddcfd32c0) at ../hw/virtio/vhost-backend.c:404 #3 0x0000559fffeded7b in slave_read (opaque=0x55a0012f6680) at ../hw/virtio/vhost-user.c:1464 #4 0x000055a0000c541b in aio_dispatch_handler ( ctx=ctx@entry=0x55a0010a2120, node=0x55a0012d9e00) at ../util/aio-posix.c:329 Fixes: 020e571b8b ("vhost: rework IOTLB messaging") Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Message-Id: <20210129090728.831208-1-eperezma@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-02-05hw/virtio/virtio-balloon: Remove the "class" propertyThomas Huth
This property was only required for compatibility reasons in the pc-1.0 machine type and earlier. Now that these machine types have been removed, the property is not useful anymore. Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <20210203171832.483176-4-thuth@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: David Hildenbrand <david@redhat.com>
2021-02-05hw/i386: Remove the deprecated pc-1.x machine typesThomas Huth
They have been deprecated since QEMU v5.0, time to remove them now. Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <20210203171832.483176-2-thuth@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2021-02-05vhost: Unbreak SMMU and virtio-iommu on dev-iotlb supportPeter Xu
Previous work on dev-iotlb message broke vhost on either SMMU or virtio-iommu since dev-iotlb (or PCIe ATS) is not yet supported for those archs. An initial idea is that we can let IOMMU to export this information to vhost so that vhost would know whether the vIOMMU would support dev-iotlb, then vhost can conditionally register to dev-iotlb or the old iotlb way. We can work based on some previous patch to introduce PCIIOMMUOps as Yi Liu proposed [1]. However it's not as easy as I thought since vhost_iommu_region_add() does not have a PCIDevice context at all since it's completely a backend. It seems non-trivial to pass over a PCI device to the backend during init. E.g. when the IOMMU notifier registered hdev->vdev is still NULL. To make the fix smaller and easier, this patch goes the other way to leverage the flag_changed() hook of vIOMMUs so that SMMU and virtio-iommu can trap the dev-iotlb registration and fail it. Then vhost could try the fallback solution as using UNMAP invalidation for it's translations. [1] https://lore.kernel.org/qemu-devel/1599735398-6829-4-git-send-email-yi.l.liu@intel.com/ Reported-by: Eric Auger <eric.auger@redhat.com> Fixes: b68ba1ca57677acf870d5ab10579e6105c1f5338 Reviewed-by: Eric Auger <eric.auger@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Peter Xu <peterx@redhat.com> Message-Id: <20210204191228.187550-1-peterx@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-02-05virtio-pmem: add trace eventsPankaj Gupta
This patch adds trace events for virtio-pmem functionality. Adding trace events for virtio pmem request, reponse and host side fsync functionality. Signed-off-by: Pankaj Gupta <pankaj.gupta.linux@gmail.com> Message-Id: <20201117115705.32195-1-pankaj.gupta.linux@gmail.com> Reviewed-by: David Hildenbrand <david@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-02-05virtio: Add corresponding memory_listener_unregister to unrealizeEugenio Pérez
Address space is destroyed without proper removal of its listeners with current code. They are expected to be removed in virtio_device_instance_finalize [1], but qemu calls it through object_deinit, after address_space_destroy call through device_set_realized [2]. Move it to virtio_device_unrealize, called before device_set_realized [3] and making it symmetric with memory_listener_register in virtio_device_realize. v2: Delete no-op call of virtio_device_instance_finalize. Add backtraces. [1] #0 virtio_device_instance_finalize (obj=0x555557de5120) at /home/qemu/include/hw/virtio/virtio.h:71 #1 0x0000555555b703c9 in object_deinit (type=0x555556639860, obj=<optimized out>) at ../qom/object.c:671 #2 object_finalize (data=0x555557de5120) at ../qom/object.c:685 #3 object_unref (objptr=0x555557de5120) at ../qom/object.c:1184 #4 0x0000555555b4de9d in bus_free_bus_child (kid=0x555557df0660) at ../hw/core/qdev.c:55 #5 0x0000555555c65003 in call_rcu_thread (opaque=opaque@entry=0x0) at ../util/rcu.c:281 Queued by: #0 bus_remove_child (bus=0x555557de5098, child=child@entry=0x555557de5120) at ../hw/core/qdev.c:60 #1 0x0000555555b4ee31 in device_unparent (obj=<optimized out>) at ../hw/core/qdev.c:984 #2 0x0000555555b70465 in object_finalize_child_property ( obj=<optimized out>, name=<optimized out>, opaque=0x555557de5120) at ../qom/object.c:1725 #3 0x0000555555b6fa17 in object_property_del_child ( child=0x555557de5120, obj=0x555557ddcf90) at ../qom/object.c:645 #4 object_unparent (obj=0x555557de5120) at ../qom/object.c:664 #5 0x0000555555b4c071 in bus_unparent (obj=<optimized out>) at ../hw/core/bus.c:147 #6 0x0000555555b70465 in object_finalize_child_property ( obj=<optimized out>, name=<optimized out>, opaque=0x555557de5098) at ../qom/object.c:1725 #7 0x0000555555b6fa17 in object_property_del_child ( child=0x555557de5098, obj=0x555557ddcf90) at ../qom/object.c:645 #8 object_unparent (obj=0x555557de5098) at ../qom/object.c:664 #9 0x0000555555b4ee19 in device_unparent (obj=<optimized out>) at ../hw/core/qdev.c:981 #10 0x0000555555b70465 in object_finalize_child_property ( obj=<optimized out>, name=<optimized out>, opaque=0x555557ddcf90) at ../qom/object.c:1725 #11 0x0000555555b6fa17 in object_property_del_child ( child=0x555557ddcf90, obj=0x55555685da10) at ../qom/object.c:645 #12 object_unparent (obj=0x555557ddcf90) at ../qom/object.c:664 #13 0x00005555558dc331 in pci_for_each_device_under_bus ( opaque=<optimized out>, fn=<optimized out>, bus=<optimized out>) at ../hw/pci/pci.c:1654 [2] Optimizer omits pci_qdev_unrealize, called by device_set_realized, and do_pci_unregister_device, called by pci_qdev_unrealize and caller of address_space_destroy. #0 address_space_destroy (as=0x555557ddd1b8) at ../softmmu/memory.c:2840 #1 0x0000555555b4fc53 in device_set_realized (obj=0x555557ddcf90, value=<optimized out>, errp=0x7fffeea8f1e0) at ../hw/core/qdev.c:850 #2 0x0000555555b6eaa6 in property_set_bool (obj=0x555557ddcf90, v=<optimized out>, name=<optimized out>, opaque=0x555556650ba0, errp=0x7fffeea8f1e0) at ../qom/object.c:2255 #3 0x0000555555b70e07 in object_property_set ( obj=obj@entry=0x555557ddcf90, name=name@entry=0x555555db99df "realized", v=v@entry=0x7fffe46b7500, errp=errp@entry=0x5555565bbf38 <error_abort>) at ../qom/object.c:1400 #4 0x0000555555b73c5f in object_property_set_qobject ( obj=obj@entry=0x555557ddcf90, name=name@entry=0x555555db99df "realized", value=value@entry=0x7fffe44f6180, errp=errp@entry=0x5555565bbf38 <error_abort>) at ../qom/qom-qobject.c:28 #5 0x0000555555b71044 in object_property_set_bool ( obj=0x555557ddcf90, name=0x555555db99df "realized", value=<optimized out>, errp=0x5555565bbf38 <error_abort>) at ../qom/object.c:1470 #6 0x0000555555921cb7 in pcie_unplug_device (bus=<optimized out>, dev=0x555557ddcf90, opaque=<optimized out>) at /home/qemu/include/hw/qdev-core.h:17 #7 0x00005555558dc331 in pci_for_each_device_under_bus ( opaque=<optimized out>, fn=<optimized out>, bus=<optimized out>) at ../hw/pci/pci.c:1654 [3] #0 virtio_device_unrealize (dev=0x555557de5120) at ../hw/virtio/virtio.c:3680 #1 0x0000555555b4fc63 in device_set_realized (obj=0x555557de5120, value=<optimized out>, errp=0x7fffee28df90) at ../hw/core/qdev.c:850 #2 0x0000555555b6eab6 in property_set_bool (obj=0x555557de5120, v=<optimized out>, name=<optimized out>, opaque=0x555556650ba0, errp=0x7fffee28df90) at ../qom/object.c:2255 #3 0x0000555555b70e17 in object_property_set ( obj=obj@entry=0x555557de5120, name=name@entry=0x555555db99ff "realized", v=v@entry=0x7ffdd8035040, errp=errp@entry=0x5555565bbf38 <error_abort>) at ../qom/object.c:1400 #4 0x0000555555b73c6f in object_property_set_qobject ( obj=obj@entry=0x555557de5120, name=name@entry=0x555555db99ff "realized", value=value@entry=0x7ffdd8035020, errp=errp@entry=0x5555565bbf38 <error_abort>) at ../qom/qom-qobject.c:28 #5 0x0000555555b71054 in object_property_set_bool ( obj=0x555557de5120, name=name@entry=0x555555db99ff "realized", value=value@entry=false, errp=0x5555565bbf38 <error_abort>) at ../qom/object.c:1470 #6 0x0000555555b4edc5 in qdev_unrealize (dev=<optimized out>) at ../hw/core/qdev.c:403 #7 0x0000555555b4c2a9 in bus_set_realized (obj=<optimized out>, value=<optimized out>, errp=<optimized out>) at ../hw/core/bus.c:204 #8 0x0000555555b6eab6 in property_set_bool (obj=0x555557de5098, v=<optimized out>, name=<optimized out>, opaque=0x555557df04c0, errp=0x7fffee28e0a0) at ../qom/object.c:2255 #9 0x0000555555b70e17 in object_property_set ( obj=obj@entry=0x555557de5098, name=name@entry=0x555555db99ff "realized", v=v@entry=0x7ffdd8034f50, errp=errp@entry=0x5555565bbf38 <error_abort>) at ../qom/object.c:1400 #10 0x0000555555b73c6f in object_property_set_qobject ( obj=obj@entry=0x555557de5098, name=name@entry=0x555555db99ff "realized", value=value@entry=0x7ffdd8020630, errp=errp@entry=0x5555565bbf38 <error_abort>) at ../qom/qom-qobject.c:28 #11 0x0000555555b71054 in object_property_set_bool ( obj=obj@entry=0x555557de5098, name=name@entry=0x555555db99ff "realized", value=value@entry=false, errp=0x5555565bbf38 <error_abort>) at ../qom/object.c:1470 #12 0x0000555555b4c725 in qbus_unrealize ( bus=bus@entry=0x555557de5098) at ../hw/core/bus.c:178 #13 0x0000555555b4fc00 in device_set_realized (obj=0x555557ddcf90, value=<optimized out>, errp=0x7fffee28e1e0) at ../hw/core/qdev.c:844 #14 0x0000555555b6eab6 in property_set_bool (obj=0x555557ddcf90, v=<optimized out>, name=<optimized out>, opaque=0x555556650ba0, errp=0x7fffee28e1e0) at ../qom/object.c:2255 #15 0x0000555555b70e17 in object_property_set ( obj=obj@entry=0x555557ddcf90, name=name@entry=0x555555db99ff "realized", v=v@entry=0x7ffdd8020560, errp=errp@entry=0x5555565bbf38 <error_abort>) at ../qom/object.c:1400 #16 0x0000555555b73c6f in object_property_set_qobject ( obj=obj@entry=0x555557ddcf90, name=name@entry=0x555555db99ff "realized", value=value@entry=0x7ffdd8020540, errp=errp@entry=0x5555565bbf38 <error_abort>) at ../qom/qom-qobject.c:28 #17 0x0000555555b71054 in object_property_set_bool ( obj=0x555557ddcf90, name=0x555555db99ff "realized", value=<optimized out>, errp=0x5555565bbf38 <error_abort>) at ../qom/object.c:1470 #18 0x0000555555921cb7 in pcie_unplug_device (bus=<optimized out>, dev=0x555557ddcf90, opaque=<optimized out>) at /home/qemu/include/hw/qdev-core.h:17 #19 0x00005555558dc331 in pci_for_each_device_under_bus ( opaque=<optimized out>, fn=<optimized out>, bus=<optimized out>) at ../hw/pci/pci.c:1654 Fixes: c611c76417f ("virtio: add MemoryListener to cache ring translations") Buglink: https://bugs.launchpad.net/qemu/+bug/1912846 Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Message-Id: <20210125192505.390554-1-eperezma@redhat.com> Reviewed-by: Peter Xu <peterx@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-02-05virtio-mmio: fix guest kernel crash with SHM regionsLaurent Vivier
In the kernel, virtio_gpu_init() uses virtio_get_shm_region() since commit 6076a9711dc5 ("drm/virtio: implement blob resources: probe for host visible region") but vm_get_shm_region() unconditionally uses VIRTIO_MMIO_SHM_SEL to get the address and the length of the region. commit 38e895487afc ("virtio: Implement get_shm_region for MMIO transport" As this is not implemented in QEMU, address and length are 0 and passed as is to devm_request_mem_region() that triggers a crash: [drm:virtio_gpu_init] *ERROR* Could not reserve host visible region Unable to handle kernel NULL pointer dereference at virtual address (ptrval) According to the comments in the kernel, a non existent shared region has a length of (u64)-1. This is what we return now with this patch to disable the region. Signed-off-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20201220163539.2255963-1-laurent@vivier.eu> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-02-05virtio: move 'use-disabled-flag' property to hw_compat_4_2Stefano Garzarella
Commit 9d7bd0826f introduced a new 'use-disabled-flag' property set to true by default. To allow the migration, we set this property to false in the hw_compat, but in the wrong place (hw_compat_4_1). Since commit 9d7bd0826f was released with QEMU 5.0, we move 'use-disabled-flag' property to hw_compat_4_2, so 4.2 machine types will have the pre-patch behavior and the migration can work. The issue was discovered with vhost-vsock device and 4.2 machine type without running any kernel in the VM: $ qemu-4.2 -M pc-q35-4.2,accel=kvm \ -device vhost-vsock-pci,guest-cid=4 \ -monitor stdio -incoming tcp:0:3333 $ qemu-5.2 -M pc-q35-4.2,accel=kvm \ -device vhost-vsock-pci,guest-cid=3 \ -monitor stdio (qemu) migrate -d tcp:0:3333 # qemu-4.2 output qemu-system-x86_64: Failed to load virtio-vhost_vsock:virtio qemu-system-x86_64: error while loading state for instance 0x0 of device '0000:00:03.0/virtio-vhost_vsock' qemu-system-x86_64: load of migration failed: No such file or directory Reported-by: Jing Zhao <jinzhao@redhat.com> Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1907255 Fixes: 9d7bd0826f ("virtio-pci: disable vring processing when bus-mastering is disabled") Cc: mdroth@linux.vnet.ibm.com CC: qemu-stable@nongnu.org Signed-off-by: Stefano Garzarella <sgarzare@redhat.com> Message-Id: <20210108171252.209502-1-sgarzare@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2021-02-05pci: add romsize propertyPaolo Bonzini
This property can be useful for distros to set up known-good ROM sizes for migration purposes. The VM will fail to start if the ROM is too large, and migration compatibility will not be broken if the ROM is too small. Note that even though romsize is a uint32_t, it has to be between 1 (because empty ROM files are not accepted, and romsize must be greater than the file) and 2^31 (because values above are not powers of two and are rejected). Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Peter Xu <peterx@redhat.com> Message-Id: <20201218182736.1634344-1-pbonzini@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20210203131828.156467-3-pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: David Edmondson <david.edmondson@oracle.com> Acked-by: Laszlo Ersek <lersek@redhat.com>
2021-02-05pci: reject too large ROMsPaolo Bonzini
get_image_size() returns an int64_t, which pci_add_option_rom() assigns to an "int" without any range checking. A 32-bit BAR could be up to 2 GiB in size, so reject anything above it. In order to accomodate a rounded-up size of 2 GiB, change pci_patch_ids's size argument to unsigned. Reviewed-by: Peter Xu <peterx@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20210203131828.156467-2-pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: David Edmondson <david.edmondson@oracle.com>
2021-02-05Merge remote-tracking branch ↵Peter Maydell
'remotes/kraxel/tags/vga-ui-20210205-pull-request' into staging ui+virtio-gpu: opengl cleanups and fixes. qxl+spice: bugfixes # gpg: Signature made Fri 05 Feb 2021 06:56:04 GMT # gpg: using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/vga-ui-20210205-pull-request: (24 commits) tests: add some virtio-gpu & vhost-user-gpu acceptance test chardev: check if the chardev is registered for yanking display/ui: add a callback to indicate GL state is flushed virtio-gpu: avoid re-entering cmdq processing ui: add egl dmabuf import to gtkglarea ui: check gtk-egl dmabuf support ui: add qemu_egl_has_dmabuf helper ui: check hw requirements during DCL registration ui: add a DCLOps callback to check dmabuf support ui: add an optional get_flags callback to GraphicHwOps vhost-user-gpu: add a configuration flag for dmabuf usage ui: remove console_has_gl_dmabuf() ui: annotate DCLOps callback requirements ui: add gd_gl_area_scanout_disable ui: remove gl_ctx_get_current ui: remove extra #ifdef CONFIG_OPENGL vhost-user-gpu: handle display-info in a callback vhost-user-gpu: use an extandable state enum for commands vhost-user-gpu: handle vhost-user-gpu features in a callback vhost-user-gpu: check backend for EDID support ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-02-04Merge remote-tracking branch ↵Peter Maydell
'remotes/dgilbert-gitlab/tags/pull-virtiofs-20210204' into staging virtiofs: Security pull 2021-02-04 This contains an important CVE fix for virtiofsd, together with two fixes for over-eager seccomp rules. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> # gpg: Signature made Thu 04 Feb 2021 18:30:37 GMT # gpg: using RSA key 45F5C71B4A0CB7FB977A9FA90516331EBC5BFDE7 # gpg: Good signature from "Dr. David Alan Gilbert (RH2) <dgilbert@redhat.com>" [full] # Primary key fingerprint: 45F5 C71B 4A0C B7FB 977A 9FA9 0516 331E BC5B FDE7 * remotes/dgilbert-gitlab/tags/pull-virtiofs-20210204: virtiofsd: Add restart_syscall to the seccomp whitelist virtiofsd: Add _llseek to the seccomp whitelist virtiofsd: prevent opening of special files (CVE-2020-35517) virtiofsd: optionally return inode pointer from lo_do_lookup() virtiofsd: extract lo_do_open() from lo_open() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-02-04virtiofsd: Add restart_syscall to the seccomp whitelistGreg Kurz
This is how linux restarts some system calls after SIGSTOP/SIGCONT. This is needed to avoid virtiofsd termination when resuming execution under GDB for example. Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <20210201193305.136390-1-groug@kaod.org> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2021-02-04virtiofsd: Add _llseek to the seccomp whitelistGreg Kurz
This is how glibc implements lseek(2) on POWER. BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1917692 Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <20210121171540.1449777-1-groug@kaod.org> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2021-02-04virtiofsd: prevent opening of special files (CVE-2020-35517)Stefan Hajnoczi
A well-behaved FUSE client does not attempt to open special files with FUSE_OPEN because they are handled on the client side (e.g. device nodes are handled by client-side device drivers). The check to prevent virtiofsd from opening special files is missing in a few cases, most notably FUSE_OPEN. A malicious client can cause virtiofsd to open a device node, potentially allowing the guest to escape. This can be exploited by a modified guest device driver. It is not exploitable from guest userspace since the guest kernel will handle special files inside the guest instead of sending FUSE requests. This patch fixes this issue by introducing the lo_inode_open() function to check the file type before opening it. This is a short-term solution because it does not prevent a compromised virtiofsd process from opening device nodes on the host. Restructure lo_create() to try O_CREAT | O_EXCL first. Note that O_CREAT | O_EXCL does not follow symlinks, so O_NOFOLLOW masking is not necessary here. If the file exists and the user did not specify O_EXCL, open it via lo_do_open(). Reported-by: Alex Xu <alex@alxu.ca> Fixes: CVE-2020-35517 Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Vivek Goyal <vgoyal@redhat.com> Reviewed-by: Greg Kurz <groug@kaod.org> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20210204150208.367837-4-stefanha@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2021-02-04virtiofsd: optionally return inode pointer from lo_do_lookup()Stefan Hajnoczi
lo_do_lookup() finds an existing inode or allocates a new one. It increments nlookup so that the inode stays alive until the client releases it. Existing callers don't need the struct lo_inode so the function doesn't return it. Extend the function to optionally return the inode. The next commit will need it. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <20210204150208.367837-3-stefanha@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2021-02-04virtiofsd: extract lo_do_open() from lo_open()Stefan Hajnoczi
Both lo_open() and lo_create() have similar code to open a file. Extract a common lo_do_open() function from lo_open() that will be used by lo_create() in a later commit. Since lo_do_open() does not otherwise need fuse_req_t req, convert lo_add_fd_mapping() to use struct lo_data *lo instead. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20210204150208.367837-2-stefanha@redhat.com> Reviewed-by: Greg Kurz <groug@kaod.org> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2021-02-04tests: add some virtio-gpu & vhost-user-gpu acceptance testMarc-André Lureau
This will check virtio/vhost-user-vga & virgl are correctly initialized by the Linux kernel on an egl-headless display. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210204105232.834642-21-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-02-04chardev: check if the chardev is registered for yankingMarc-André Lureau
Not all chardevs are created via qmp_chardev_open_socket(), and those should not call the yank function registration, as this will eventually assert() not being registered. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210204105232.834642-20-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-02-04display/ui: add a callback to indicate GL state is flushedMarc-André Lureau
Displaying rendered resources requires blocking qemu GPU to avoid extra framebuffer copies. For an external display, via Spice currently, there is a callback to block/unblock the rendering in the same thread. But with the vhost-user-gpu backend, the qemu process doesn't handle the rendering itself, and the blocking callback isn't effective. Instead, the backend must be notified when the display code is done. Fix this by adding a new GraphicHwOps callback to indicate the GL state is flushed, and we are done manipulating the shared GL resources. Call it from gtk and spice display. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210204105232.834642-19-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-02-04virtio-gpu: avoid re-entering cmdq processingMarc-André Lureau
The next patch will notify the GL context got flush, which will resume the queue processing. However, if this happens within the caller context, it will end up with a stack overflow flush/update loop. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210204105232.834642-18-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-02-04ui: add egl dmabuf import to gtkglareaMarc-André Lureau
GtkGLArea is used on wayland, where EGL is usually available. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210204105232.834642-17-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-02-04ui: check gtk-egl dmabuf supportMarc-André Lureau
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210204105232.834642-16-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-02-04ui: add qemu_egl_has_dmabuf helperMarc-André Lureau
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210204105232.834642-15-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-02-04ui: check hw requirements during DCL registrationMarc-André Lureau
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210204105232.834642-14-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-02-04ui: add a DCLOps callback to check dmabuf supportMarc-André Lureau
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210204105232.834642-13-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-02-04ui: add an optional get_flags callback to GraphicHwOpsMarc-André Lureau
Those flags can be used to express different requirements for the display or other needs. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210204105232.834642-12-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-02-04vhost-user-gpu: add a configuration flag for dmabuf usageMarc-André Lureau
Let's inform VirtioGPUBase that vhost-user-gpu require DMABUF messages. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210204105232.834642-11-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-02-04ui: remove console_has_gl_dmabuf()Marc-André Lureau
This check is currently limited. It only is used by vhost-user-gpu (not by vfio-display), and will print an error repeatedly during run-time. We are going to dissociate the GL context from the DisplayChangeListener, and listeners may come and go. The following patches will address this differently. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210204105232.834642-10-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-02-04ui: annotate DCLOps callback requirementsMarc-André Lureau
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210204105232.834642-9-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-02-04ui: add gd_gl_area_scanout_disableMarc-André Lureau
Require the callback, drop the fallback path. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210204105232.834642-8-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-02-04ui: remove gl_ctx_get_currentMarc-André Lureau
There are no users left. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210204105232.834642-7-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-02-04ui: remove extra #ifdef CONFIG_OPENGLMarc-André Lureau
Since commit 5cb69566daa8081abb82a13403dcc0fffed02007 ("gtk: remove CONFIG_GTK_GL"), some #ifdef are redundants. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210204105232.834642-6-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-02-04vhost-user-gpu: handle display-info in a callbackMarc-André Lureau
Fixes a deadlock where the backend calls QEMU, while QEMU also calls the backend simultaneously, both ends waiting for each other. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210204105232.834642-5-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-02-04vhost-user-gpu: use an extandable state enum for commandsMarc-André Lureau
Introduce a pending state for commands which aren't finished yet, but are being handled. See following patch. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210204105232.834642-4-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-02-04vhost-user-gpu: handle vhost-user-gpu features in a callbackMarc-André Lureau
Fixes a deadlock where the backend calls QEMU, while QEMU also calls the backend simultaneously, both ends waiting for each other. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210204105232.834642-3-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-02-04vhost-user-gpu: check backend for EDID supportMarc-André Lureau
EDID has been enabled by default, but the backend may not implement it (such as the contrib backend). This results in extra warnings and potentially other issues in the guest. The option shouldn't probably have been added to VIRTIO_GPU_BASE, but it's a bit too late now, report an error and disable EDID when it's not available. Fixes: 0a7196625 ("edid: flip the default to enabled") Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210204105232.834642-2-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-02-04Merge remote-tracking branch 'remotes/armbru/tags/pull-qmp-2021-02-04' into ↵Peter Maydell
staging QMP patches patches for 2021-02-04 # gpg: Signature made Thu 04 Feb 2021 12:21:47 GMT # gpg: using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653 # gpg: issuer "armbru@redhat.com" # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" [full] # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" [full] # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * remotes/armbru/tags/pull-qmp-2021-02-04: qmp: Resume OOB-enabled monitor before processing the request qmp: Add more tracepoints qmp: Fix up comments after commit 9ce44e2ce2 docs/interop/qmp-spec: Document the request queue limit qobject: braces {} are necessary for all arms of this statement qobject: spaces required around that operators qobject: code indent should never use tabs qobject: open brace '{' following struct go on the same line monitor/qmp-cmds.c: Don't include ui/vnc.h Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-02-04spice: delay starting until display are initializedMarc-André Lureau
QEMU used to run qemu_spice.display_init() before vm_start(), and QXL/display interfaces where started then. Now, vm_start() happens before QXL/display interfaces are added and Spice server doesn't automatically start them in this case (fixed in spice git) Fixes Spice regression introduced after 5.2, with refactoring commits b4e1a34211 ("vl: remove separate preconfig main_loop") and facf7c60ee ("vl: initialize displays _after_ exiting preconfiguration"), probably others. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210129152351.161971-1-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-02-04qxl: also notify the rendering is done when skipping itMarc-André Lureau
Asynchronous handlers may be waiting for the graphic_hw_update_done() to be called in this case too. Fixes: 4d6316218 ("console: add graphic_hw_update_done()") Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210201201422.446552-3-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-02-04qxl: set qxl.ssd.dcl.con on secondary devicesMarc-André Lureau
On secondary QXL devices, the console is only set on qxl.vga.con. But graphic_hw_update_done() is called with qxl.ssd.dcl.con. Like for primary QXL devices, set qxl.sdd.dcl.con = qxl.vga.con. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210201201422.446552-2-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-02-04hw/display/qxl: Fix bad printf format specifiersAlex Chen
We should use printf format specifier "%u" instead of "%d" for argument of type "unsigned int". Reported-by: Euler Robot <euler.robot@huawei.com> Signed-off-by: Alex Chen <alex.chen@huawei.com> Message-id: 20201119025851.56487-1-alex.chen@huawei.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-02-04qmp: Resume OOB-enabled monitor before processing the requestMarkus Armbruster
monitor_qmp_dispatcher_co() needs to resume the monitor if handle_qmp_command() suspended it. Two cases: 1. OOB enabled: suspended if mon->qmp_requests has no more space 2. OOB disabled: suspended always We resume only after we processed the request. Which can take a long time. Resume the monitor right when the queue has space to keep the monitor available for out-of-band commands even in this corner case. Leave the "OOB disabled" case alone. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20210201161504.1976989-4-armbru@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> [Trailing whitespace tidied up]
2021-02-04qmp: Add more tracepointsMarkus Armbruster
Add tracepoints for in-band request enqueue and dequeue, processing of queued in-band errors, and responses. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20210201161504.1976989-3-armbru@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com>
2021-02-04qmp: Fix up comments after commit 9ce44e2ce2Markus Armbruster
Commit 9ce44e2ce2 "qmp: Move dispatcher to a coroutine" replaced monitor_qmp_bh_dispatcher() by monitor_qmp_dispatcher_co(), but neglected to update comments. Do that now. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20210201161504.1976989-2-armbru@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com>
2021-02-04docs/interop/qmp-spec: Document the request queue limitMarkus Armbruster
Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20210127144734.2367693-1-armbru@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com>
2021-02-04qobject: braces {} are necessary for all arms of this statementZhang Han
Add braces {} for arms of if/for statement Signed-off-by: Zhang Han <zhanghan64@huawei.com> Message-Id: <20201228071129.24563-5-zhanghan64@huawei.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2021-02-04qobject: spaces required around that operatorsZhang Han
Add spaces around operators. Signed-off-by: Zhang Han <zhanghan64@huawei.com> Message-Id: <20201228071129.24563-4-zhanghan64@huawei.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2021-02-04qobject: code indent should never use tabsZhang Han
Transfer tabs to spaces. Signed-off-by: Zhang Han <zhanghan64@huawei.com> Message-Id: <20201228071129.24563-3-zhanghan64@huawei.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2021-02-04qobject: open brace '{' following struct go on the same lineZhang Han
Put open brace '{' on the same line of struct. Signed-off-by: Zhang Han <zhanghan64@huawei.com> Message-Id: <20201228071129.24563-2-zhanghan64@huawei.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
generated by cgit v1.2.3 (git 2.26.2) at 2025-01-09 02:19:01 +0000