Skip to content
Snippets Groups Projects
Select Git revision
  • feature/libtcg-rebase default protected
1 result
Search by author
  • Any Author
  • Anton Anton anjo
1 author
  1. Apr 06, 2022
  3. Mar 28, 2022
  5. Mar 22, 2022
  7. Mar 21, 2022
  9. Mar 16, 2022
  11. Mar 07, 2022
  13. Mar 06, 2022
  15. Mar 04, 2022
  17. Feb 21, 2022
  19. Feb 16, 2022
    • Daniel P. Berrangé's avatar
      seccomp: block setns, unshare and execveat syscalls · 46380571
      Daniel P. Berrangé authored 
      
setns/unshare are used to change namespaces which is not something QEMU
needs to be able todo.

execveat is a new variant of execve so should be blocked just like
execve already is.

Acked-by: default avatarEduardo Otubo <otubo@redhat.com>
Signed-off-by: default avatarDaniel P. Berrangé <berrange@redhat.com>
      46380571
    • Daniel P. Berrangé's avatar
      seccomp: block use of clone3 syscall · c542b302
      Daniel P. Berrangé authored 
      
Modern glibc will use clone3 instead of clone, when it detects that it
is available. We need to compare flags in order to decide whether to
allow clone (thread create vs process fork), but in clone3 the flags
are hidden inside a struct. Seccomp can't currently match on data inside
a struct, so our only option is to block clone3 entirely. If we use
ENOSYS to block it, then glibc transparently falls back to clone.

This may need to be revisited if Linux adds a new architecture in
future and only provides clone3, without clone.

Acked-by: default avatarEduardo Otubo <otubo@redhat.com>
Signed-off-by: default avatarDaniel P. Berrangé <berrange@redhat.com>
      c542b302
    • Daniel P. Berrangé's avatar
      seccomp: fix blocking of process spawning · 5a2f693f
      Daniel P. Berrangé authored 
      
When '-sandbox on,spawn=deny' is given, we are supposed to block the
ability to spawn processes. We naively blocked the 'fork' syscall,
forgetting that any modern libc will use the 'clone' syscall instead.

We can't simply block the 'clone' syscall though, as that will break
thread creation. We thus list the set of flags used to create threads
and block anything that doesn't match this exactly.

Acked-by: default avatarEduardo Otubo <otubo@redhat.com>
Signed-off-by: default avatarDaniel P. Berrangé <berrange@redhat.com>
      5a2f693f
    • Daniel P. Berrangé's avatar
      seccomp: allow action to be customized per syscall · 8f46f562
      Daniel P. Berrangé authored 
      
We're currently tailoring whether to use kill process or return EPERM
based on the syscall set. This is not flexible enough for future
requirements where we also need to be able to return a variety of
actions on a per-syscall granularity.

Acked-by: default avatarEduardo Otubo <otubo@redhat.com>
Signed-off-by: default avatarDaniel P. Berrangé <berrange@redhat.com>
      8f46f562
    • Peter Xu's avatar
      memory: Fix qemu crash on starting dirty log twice with stopped VM · a5c90c61
      Peter Xu authored 
      QEMU can now easily crash with two continuous migration carried out:

(qemu) migrate -d exec:cat>out
(qemu) migrate_cancel
(qemu) migrate -d exec:cat>out
[crash] ../softmmu/memory.c:2782: memory_global_dirty_log_start: Assertion
`!(global_dirty_tracking & flags)' failed.

It's because memory API provides a way to postpone dirty log stop if the VM is
stopped, and that'll be re-done until the next VM start.  It was added in 2017
with commit 19310760 ("migration: optimize the downtime", 2017-08-01).

However the recent work on allowing dirty tracking to be bitmask broke it,
which is commit 63b41db4 ("memory: make global_dirty_tracking a bitmask",
2021-11-01).

The fix proposed in this patch contains two things:

  (1) Instead of passing over the flags to postpone stop dirty track, we add a
      global variable (along with current vmstate_change variable) to record
      what flags to stop dirty tracking.

  (2) When start dirty tracking, instead if remove the vmstate hook directly,
      we also execute the postponed stop process so that we make sure all the
      starts and stops will be paired.

This procedure is overlooked in the bitmask-ify work in 2021.

Cc: Hyman Huang <huangy81@chinatelecom.cn>
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2044818


Fixes: 63b41db4 ("memory: make global_dirty_tracking a bitmask")
Signed-off-by: default avatarPeter Xu <peterx@redhat.com>
Message-Id: <20220207123019.27223-1-peterx@redhat.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      a5c90c61
  21. Feb 08, 2022
  23. Jan 28, 2022
    • Peter Maydell's avatar
      rtc: Move RTC function prototypes to their own header · 2f93d8b0
      Peter Maydell authored 
      
softmmu/rtc.c defines two public functions: qemu_get_timedate() and
qemu_timedate_diff().  Currently we keep the prototypes for these in
qemu-common.h, but most files don't need them.  Move them to their
own header, a new include/sysemu/rtc.h.

Since the C files using these two functions did not need to include
qemu-common.h for any other reason, we can remove those include lines
when we add the include of the new rtc.h.

The license for the .h file follows that of the softmmu/rtc.c
where both the functions are defined.

Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: default avatarPhilippe Mathieu-Daudé <f4bug@amsat.org>
      2f93d8b0
  25. Jan 21, 2022