summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2012-02-01Add cap reduction support to enable use as SUIDCorey Bryant2-0/+70
The ideal way to use qemu-bridge-helper is to give it an fscap of using: setcap cap_net_admin=ep qemu-bridge-helper Unfortunately, most distros still do not have a mechanism to package files with fscaps applied. This means they'll have to SUID the qemu-bridge-helper binary. To improve security, use libcap to reduce our capability set to just cap_net_admin, then reduce privileges down to the calling user. This is hopefully close to equivalent to fscap support from a security perspective. Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> Signed-off-by: Richa Marwaha <rmarwah@linux.vnet.ibm.com> Signed-off-by: Corey Bryant <coreyb@linux.vnet.ibm.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-02-01Add access control support to qemu bridge helperCorey Bryant1-0/+153
We go to great lengths to restrict ourselves to just cap_net_admin as an OS enforced security mechanism. However, we further restrict what we allow users to do to simply adding a tap device to a bridge interface by virtue of the fact that this is the only functionality we expose. This is not good enough though. An administrator is likely to want to restrict the bridges that an unprivileged user can access, in particular, to restrict an unprivileged user from putting a guest on what should be isolated networks. This patch implements an ACL mechanism that is enforced by qemu-bridge-helper. The ACLs are fairly simple whitelist/blacklist mechanisms with a wildcard of 'all'. All users are blacklisted by default, and deny takes precedence over allow. An interesting feature of this ACL mechanism is that you can include external ACL files. The main reason to support this is so that you can set different file system permissions on those external ACL files. This allows an administrator to implement rather sophisticated ACL policies based on user/group policies via the file system. As an example: /etc/qemu/bridge.conf root:qemu 0640 allow br0 include /etc/qemu/alice.conf include /etc/qemu/bob.conf include /etc/qemu/charlie.conf /etc/qemu/alice.conf root:alice 0640 allow br1 /etc/qemu/bob.conf root:bob 0640 allow br2 /etc/qemu/charlie.conf root:charlie 0640 deny all This ACL pattern allows any user in the qemu group to get a tap device connected to br0 (which is bridged to the physical network). Users in the alice group can additionally get a tap device connected to br1. This allows br1 to act as a private bridge for the alice group. Users in the bob group can additionally get a tap device connected to br2. This allows br2 to act as a private bridge for the bob group. Users in the charlie group cannot get a tap device connected to any bridge. Under no circumstance can the bob group get access to br1 or can the alice group get access to br2. And under no cicumstance can the charlie group get access to any bridge. Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> Signed-off-by: Richa Marwaha <rmarwah@linux.vnet.ibm.com> Signed-off-by: Corey Bryant <coreyb@linux.vnet.ibm.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-02-01Add basic version of bridge helperCorey Bryant3-2/+232
This patch adds a helper that can be used to create a tap device attached to a bridge device. Since this helper is minimal in what it does, it can be given CAP_NET_ADMIN which allows qemu to avoid running as root while still satisfying the majority of what users tend to want to do with tap devices. The way this all works is that qemu launches this helper passing a bridge name and the name of an inherited file descriptor. The descriptor is one end of a socketpair() of domain sockets. This domain socket is used to transmit a file descriptor of the opened tap device from the helper to qemu. The helper can then exit and let qemu use the tap device. Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> Signed-off-by: Richa Marwaha <rmarwah@linux.vnet.ibm.com> Signed-off-by: Corey Bryant <coreyb@linux.vnet.ibm.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-02-01hw/vmmouse.c: Disable vmmouse after rebootGerhard Wiesinger1-0/+2
Bugfix after reboot when vmmouse was enabled and another OS which uses e.g. PS/2 mouse. Details: When a guest activated the vmmouse followed by a reboot the vmmouse was still enabled and the PS/2 mouse was therefore unsusable. When another guest is then booted without vmmouse support (e.g. PS/2 mouse) the mouse is not working. Reason is that VMMouse has priority and disables all other mouse entities and therefore must be disabled on reset. Testscenario: 1.) Boot e.g. OS with VMMouse support (e.g. Windows with VMMouse tools) 2.) reboot 3.) Boot e.g. OS without VMMouse support (e.g. DOS) => PS/2 mouse doesn't work any more. Fixes that issue. Testscenario 2 by Jan Kiszka <jan.kiszka@siemens.com>: Confirm that this patch fixes a real issue. Setup: qemu.git, opensuse 11.4 guest, SDL graphic, system_reset while guest is using the vmmouse. Without the patch, the vmmouse become unusable after the reboot. Also, the mouse stays in absolute mode even before X starts again. Fixed by: Disabling the vmmouse in its reset handler. Tested-by: Andreas F=E4rber <afaerber@suse.de> Signed-off-by: Gerhard Wiesinger <lists@wiesinger.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-02-01keep the PID file locked for the lifetime of the processLaszlo Ersek1-1/+1
The lockf() call in qemu_create_pidfile() aims at ensuring mutual exclusion. We shouldn't close the pidfile on success (as introduced by commit 1bbd1592), because that drops the lock as well [1]: "File locks shall be released on first close by the locking process of any file descriptor for the file." Coverity may complain again about the leaked file descriptor; let's worry about that later. v1->v2: - add reference to 1bbd1592 - explain the intentional fd leak in the source [1] http://pubs.opengroup.org/onlinepubs/9699919799/functions/lockf.html Signed-off-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-02-01main-loop: For tools, initialize timers as part of qemu_init_main_loop()Michael Roth4-2/+20
In some cases initializing the alarm timers can lead to non-negligable overhead from programs that link against qemu-tool.o. At least, setting a max-resolution WinMM alarm timer via mm_start_timer() (the current default for Windows) can increase the "tick rate" on Windows OSs and affect frequency scaling, and in the case of tools that run in guest OSs such has qemu-ga, the impact can be fairly dramatic (+20%/20% user/sys time on a core 2 processor was observed from an idle Windows XP guest). This patch doesn't address the issue directly (not sure what a good solution would be for Windows, or what other situations it might be noticeable), but it at least limits the scope of the issue to programs that "opt-in" to using the main-loop.c functions by only enabling alarm timers when qemu_init_main_loop() is called, which is already required to make use of those facilities, so existing users shouldn't be affected. Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-02-01main-loop: Fix SetEvent() on uninitialized handle on win32Michael Roth1-1/+4
The __attribute__((constructor)) init_main_loop() automatically get called if qemu-tool.o is linked in. On win32, this leads to a qemu_notify_event() call which attempts to SetEvent() on a HANDLE that won't be initialized until qemu_init_main_loop() is manually called, breaking qemu-tools.o programs on Windows at runtime. This patch checks for an initialized event handle before attempting to set it, which is analoguous to how we deal with an unitialized io_thread_fd in the posix implementation. Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-02-01optionroms: Silence intermediate file removalJan Kiszka1-0/+3
The build process of optionroms spits out an "rm ..." line. Moreover, it removes all .o files that can be handy for debugging purposes. So disable automatic intermediate removal. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-02-01sdl: Limit sdl_grab_end in handle_activation to Windows hostsJan Kiszka1-0/+4
There are scenarios on Linux with some SDL versions where handle_activation is continuous invoked with state = SDL_APPINPUTFOCUS and gain = 0 while we grabbed the input. This causes a ping-pong when we grab the input after an absolute mouse entered the window. As this sdl_grab_end was once introduced to work around a Windows-only issue (0294ffb9c8), limit it to that platform. CC: Erik Rull <erik.rull@rdsoftware.de> Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-02-01sdl: Grab input on end of non-absolute mouse clickJan Kiszka1-2/+1
By grabbing the input already on button down, we leave the button in that state for the host GUI. Thus it takes another click after releasing the input again to synchronize the mouse button state. Avoid this by grabbing on button up. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-02-01Revert "Handle SDL grabs failing (Mark McLoughlin)"Jan Kiszka1-6/+3
This reverts commit 6bb816031f8bc0aafc3476e6dfa4293ee3a5f106. SDL_WM_GrabInput does not reliably bail out if grabbing is impossible. So if we get here, we already lost and will block. But this can no longer happen due to the check in sdl_grab_start. So this patch became obsolete. Conflicts: sdl.c Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-02-01sdl: Fix block prevention of SDL_WM_GrabInputJan Kiszka1-12/+14
Consistently check for SDL_APPINPUTFOCUS before trying to grab the input focus. Just checking for SDL_APPACTIVE doesn't work. Moving the check to sdl_grab_start allows for some consolidation. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-02-01sdl: Do not grab mouse on mode switch while in backgroundJan Kiszka1-14/+16
When the mouse mode changes to absolute while the SDL windows is not in focus, refrain from grabbing the input. It would steal from some other window. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-02-01Improve default machine options usabilityJan Kiszka1-15/+2
So far we overwrite the machine options completely with defaults if no accel=value is provided. More user friendly is to fill in only unspecified options. The new qemu_opts_set_defaults enables this. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-02-01mc146818rtc: Use lost_tick_policy propertyJan Kiszka3-13/+42
Allow to configure the MC146818 RTC via the new lost tick policy property and replace rtc_td_hack with this mechanism. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-02-01qemu-option: Introduce default mechanismJan Kiszka2-8/+52
This adds qemu_opts_set_defaults, an interface provide default values for a QemuOpts set. Default options are parsed from a string and then prepended to the list of existing options, or they serve as the sole QemuOpts set. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-02-01qdev: Introduce lost tick policy propertyJan Kiszka3-0/+69
Potentially tick-generating timer devices will gain a common property: lock_tick_policy. It allows to encode 4 different ways how to deal with tick events the guest did not process in time: discard - ignore lost ticks (e.g. if the guest compensates for them already) delay - replay all lost ticks in a row once the guest accepts them again merge - if multiple ticks are lost, all of them are merged into one which is replayed once the guest accepts it again slew - lost ticks are gradually replayed at a higher frequency than the original tick Not all timer device will need to support all modes. However, all need to accept the configuration via this common property. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-02-01Makefile: Remove linux-headers/asm symlink on distcleanPeter Maydell1-0/+1
configure creates a linux-headers/asm symlink. Remove this when doing a distclean. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-02-01exec.c: Clarify comment about tlb_flush() flush_global parameterPeter Maydell1-2/+12
Clarify the comment about tlb_flush()'s flush_global parameter, so it is clearer what it does and why it is OK that the implementation currently ignores it. Reviewed-by: Andreas F=C3=A4rber <afaerber@suse.de> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-02-01hw/9pfs: Update MAINTAINERS fileAneesh Kumar K.V1-2/+4
Acked-by: Venkateswararao Jujjuri <jvrao@linux.vnet.ibm.com> Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-02-01MAINTAINERS: Add a section for the host OS and a W32 maintainerStefan Weil1-0/+20
Up to now, there was no special section for the different host operating systems used with QEMU. scripts/get_maintainer.pl did not show a maintainer for OS specific files and patches. Therefore I added three hosts systems: * POSIX for the majority of host systems which are supported. This includes BSD and Linux host systems. * LINUX is a special case of POSIX needed for some Linux specific files and directories. * W32, W64 for a well known family of closed source operating systems. I also added myself as a maintainer for W32, W64. Signed-off-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-02-01./configure: add link check for nss-smartcardSergei Trofimovich1-4/+9
Current './configure --static && make' fails for me: LINK qemu-nbd /usr/lib/gcc/x86_64-pc-linux-gnu/4.5.3/../../../../x86_64-pc-linux-gnu/bin/ld: cannot find -lssl3 /usr/lib/gcc/x86_64-pc-linux-gnu/4.5.3/../../../../x86_64-pc-linux-gnu/bin/ld: cannot find -lsmime3 /usr/lib/gcc/x86_64-pc-linux-gnu/4.5.3/../../../../x86_64-pc-linux-gnu/bin/ld: cannot find -lnssutil3 /usr/lib/gcc/x86_64-pc-linux-gnu/4.5.3/../../../../x86_64-pc-linux-gnu/bin/ld: cannot find -lnss3 /usr/lib/gcc/x86_64-pc-linux-gnu/4.5.3/../../../../x86_64-pc-linux-gnu/bin/ld: cannot find -lplds4 /usr/lib/gcc/x86_64-pc-linux-gnu/4.5.3/../../../../x86_64-pc-linux-gnu/bin/ld: cannot find -lplc4 /usr/lib/gcc/x86_64-pc-linux-gnu/4.5.3/../../../../x86_64-pc-linux-gnu/bin/ld: cannot find -lnspr4 My system does not provide static libraries for nss, so fix autoconfiguration by link checking. Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org> CC: qemu-trivial <qemu-trivial@nongnu.org> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-02-01./configure: request pkg-config to provide private libs when static linkingSergei Trofimovich1-3/+8
Added wrapper around pkg-config to allow: - safe options injection via ${QEMU_PKG_CONFIG_FLAGS} - spaces in path to pkg-config Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org> CC: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-01-30m48t59: use rtc_clock for alarm timerPaolo Bonzini1-2/+2
This lets the RTC get adjustments from the host NTP client. The watchdog still uses the vm_clock. The previous behavior is available with "-rtc clock=vm". Cc: Andreas Färber <afaerber@suse.de> Reviewed-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2012-01-30GRLIB UART: Add RX channelFabien Chouteau2-17/+90
This patch implements the RX channel of GRLIB UART with a FIFO to improve data rate. Signed-off-by: Fabien Chouteau <chouteau@adacore.com> Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2012-01-29Fix off-by-one in dirty bitmap functionsAvi Kivity1-4/+6
Reported-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2012-01-28Merge branch 'target-arm.for-upstream' of ↵Blue Swirl2-15/+73
git://git.linaro.org/people/pmaydell/qemu-arm * 'target-arm.for-upstream' of git://git.linaro.org/people/pmaydell/qemu-arm: Add Cortex-A15 CPU definition Add dummy implementation of generic timer cp15 registers arm: store the config_base_register during cpu_reset target-arm/helper.c: Don't assume softfloat int32 is 32 bits only target-arm: Fix implementation of TLB invalidate operations
2012-01-27unin_pci: Fix typos in device namesAndreas Färber1-2/+2
Commit 999e12bbe85c5dcf49bef13bce4f97399c7105f4 (sysbus: apic: ioapic: convert to QEMU Object Model) introduced two typos, one of which broke the mac99 machine. Signed-off-by: Andreas Färber <afaerber@suse.de> Cc: Anthony Liguori <aliguori@us.ibm.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-01-27qdev: change ambiguous qdev namesAnthony Liguori4-4/+9
Reported-by: Blue Swirl <blauwirbel@gmail.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-01-27virtio-s390: convert to QEMU Object ModelAnthony Liguori1-28/+65
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-01-27sysbus: apic: ioapic: convert to QEMU Object ModelAnthony Liguori131-1296/+2733
This converts three devices because apic and ioapic are subclasses of sysbus. Converting subclasses independently of their base class is prohibitively hard. Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-01-27pci: convert to QEMU Object ModelAnthony Liguori53-1050/+1599
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-01-27unin_pci: Drop unused reset handlerAndreas Färber1-7/+0
Signed-off-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Alexander Graf <agraf@suse.de>
2012-01-27unin_pci: Drop duplicate busdevAndreas Färber1-9/+20
PCIHostState already has a busdev. Signed-off-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Alexander Graf <agraf@suse.de>
2012-01-27unin_pci: Clean up qdev namesAndreas Färber1-15/+39
Add -pcihost to SysBus devices to resolve name conflicts, and clarify PCI vs. Internal PCI. Signed-off-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Alexander Graf <agraf@suse.de>
2012-01-27virtio-serial: convert to QEMU Object ModelAnthony Liguori3-90/+128
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-01-27spapr: convert to QEMU Object Model (v2)Anthony Liguori5-71/+126
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> --- v1 -> v2 - use QOM to check for the default console
2012-01-27scsi: convert to QEMU Object ModelAnthony Liguori4-113/+201
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-01-27ide: convert to QEMU Object ModelAnthony Liguori2-49/+82
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-01-27hda-codec: convert to QEMU Object ModelAnthony Liguori3-44/+71
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-01-27i2c: smbus: convert to QEMU Object ModelAnthony Liguori15-164/+331
This converts two types because smbus is implemented as a subclass of i2c. It's extremely difficult to convert these two independently. Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-01-27i2c: rename i2c_slave -> I2CSlaveAnthony Liguori15-86/+88
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-01-27ssi: convert to QEMU Object ModelAnthony Liguori10-70/+150
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-01-27ccid: convert to QEMU Object ModelAnthony Liguori4-49/+109
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-01-27usb: convert to QEMU Object ModelAnthony Liguori17-303/+528
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-01-27isa: pic: convert to QEMU Object ModelAnthony Liguori28-192/+390
This converts two devices at once because PIC subclasses ISA and converting subclasses independently is extremely hard. Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-01-27qdev: prepare source tree for code conversionAnthony Liguori15-312/+304
These are various small stylistic changes which help make things more consistent such that the automated conversion script can be simpler. It's not necessary to agree or disagree with these style changes because all of this code is going to be rewritten by the patch monkey script anyway. Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-01-27qdev: add class_init to DeviceInfoAnthony Liguori2-0/+9
Since we are still dynamically creating TypeInfo, we need to chain the class_init function in order to be able to make use of it within subclasses of TYPE_DEVICE. This will disappear once we register TypeInfos directly. Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-01-27qdev: add a interface to register subclassesAnthony Liguori2-2/+8
In order to introduce inheritance while still using the qdev registration interfaces, we need to be able to use a parent other than TYPE_DEVICE. Add a new interface that allows this. Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-01-27qdev: use a wrapper to access reset and promote reset to a class methodAnthony Liguori4-9/+27
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
generated by cgit v1.2.1 (git 2.18.0) at 2024-07-01 22:17:06 +0000