prove security, use libcap to reduce our capability set to just
cap_net_admin, then reduce privileges down to the calling user. This is
hopefully close to equivalent to fscap support from a security perspective.
Signed-off-by: Anthony Liguori
Signed-off-by: Richa Marwaha
Signed-off-by: Corey B
ny Liguori
Signed-off-by: Richa Marwaha
Signed-off-by: Corey Bryant
---
qemu-bridge-helper.c | 153 ++
1 files changed, 153 insertions(+), 0 deletions(-)
diff --git a/qemu-bridge-helper.c b/qemu-bridge-helper.c
index 1b78781..b5898a5 100644
--- a/q
io
or:
qemu linux.img -net
tap,helper=/usr/local/libexec/qemu-bridge-helper,br=qemubr0
-net nic,model=virtio
Signed-off-by: Anthony Liguori
Signed-off-by: Richa Marwaha
Signed-off-by: Corey Bryant
---
configure |2 +
net.c | 29 -
net.h
.
The helper can then exit and let qemu use the tap device.
Signed-off-by: Anthony Liguori
Signed-off-by: Richa Marwaha
Signed-off-by: Corey Bryant
---
Makefile | 12 +++-
configure|1 +
qemu-bridge-helper.c | 218
leted static analysis and memory analysis on helper
v4:
- Update has_vnet_hdr() to return bool
- Update helper's main() to prevent errno clobbering
- Let Kernel cleanup helper's file descriptors
Corey Bryant (4):
Add basic version of bridge helper
Add access control support to qem
On 11/02/2011 06:58 AM, Stefan Hajnoczi wrote:
On Tue, Nov 1, 2011 at 5:13 PM, Corey Bryant wrote:
+static bool has_vnet_hdr(int fd)
+{
+unsigned int features = 0;
+struct ifreq ifreq;
+
+if (ioctl(fd, TUNGETFEATURES,&features) == -1) {
+return false;
+}
+
+
On 11/02/2011 04:12 AM, Mark Wu wrote:
On 11/02/2011 01:13 AM, Corey Bryant wrote:
static int net_tap_init(QemuOpts *opts, int *vnet_hdr)
{
int fd, vnet_hdr_required;
@@ -433,8 +570,11 @@ int net_init_tap(QemuOpts *opts, Monitor *mon,
const char *name, VLANState *vlan
if (qemu_opt_get(opts
On 11/03/2011 03:54 AM, Stefan Hajnoczi wrote:
On Wed, Nov 2, 2011 at 3:12 PM, Corey Bryant wrote:
On 11/02/2011 06:58 AM, Stefan Hajnoczi wrote:
On Tue, Nov 1, 2011 at 5:13 PM, Corey Bryant
wrote:
+static bool has_vnet_hdr(int fd)
+{
+unsigned int features = 0;
+struct ifreq
On 11/02/2011 11:10 PM, Mark Wu wrote:
On 11/01/2011 02:36 AM, Corey Bryant wrote:
The default bridge that we attach to is br0. The thinking is that a
distro
could preconfigure such an interface to allow out-of-the-box bridged
networking.
Alternatively, if a user wants to use a different
ation/attaching of a
tap device should be handled by the helper.
Regards,
Corey
On Wed, Nov 2, 2011 at 1:13 AM, Corey Bryant wrote:
With qemu it is possible to run a guest from an unprivileged user but if
we wanted to communicate with the outside world we had to switch
to root.
We address this pr
ny Liguori
Signed-off-by: Richa Marwaha
Signed-off-by: Corey Bryant
---
qemu-bridge-helper.c | 153 ++
1 files changed, 153 insertions(+), 0 deletions(-)
diff --git a/qemu-bridge-helper.c b/qemu-bridge-helper.c
index e0ba917..2f137c2 100644
--- a/q
documentation
- Disallow vnet_hdr option with -net tap,helper
Corey Bryant (4):
Add basic version of bridge helper
Add access control support to qemu bridge helper
Add cap reduction support to enable use as SUID
Add support for net bridge
Makefile | 12 ++-
confi
prove security, use libcap to reduce our capability set to just
cap_net_admin, then reduce privileges down to the calling user. This is
hopefully close to equivalent to fscap support from a security perspective.
Signed-off-by: Anthony Liguori
Signed-off-by: Richa Marwaha
Signed-off-by: Corey B
.
The helper can then exit and let qemu use the tap device.
Signed-off-by: Anthony Liguori
Signed-off-by: Richa Marwaha
Signed-off-by: Corey Bryant
---
Makefile | 12 +++-
configure|1 +
qemu-bridge-helper.c | 213
xec/qemu-bridge-helper,br=qemubr0,id=hn0
-device virtio-net-pci,netdev=hn0,id=nic1
Signed-off-by: Anthony Liguori
Signed-off-by: Richa Marwaha
Signed-off-by: Corey Bryant
---
configure |2 +
net.c | 29 -
net.h |3 +
net/tap
On 07/26/2011 08:51 AM, Corey Bryant wrote:
> +static int raw_open_fd(BlockDriverState *bs, const char *filename,
int flags)
> +{
> +BDRVRawState *s = bs->opaque;
> +const char *fd_str;
> +int fd;
> +
> +/* extract the file descriptor - fail if i
ned-off-by: Corey Bryant
---
block.c |9 ++---
block/raw-posix.c | 99
migration-fd.c|2 +-
monitor.c | 39
monitor.h |3 +-
net.c |2 +-
qemu-options.h
On 08/22/2011 11:38 AM, Christoph Hellwig wrote:
I'm still totally against this. FD passing is a nice feature for sandboxing,
but the passing should be between closely cooperating programs. We'll
need a tool shipped from the qemu source tree to open and set up the
FDs, and not someone external.
On 08/22/2011 01:25 PM, Anthony Liguori wrote:
On 08/22/2011 11:50 AM, Daniel P. Berrange wrote:
On Mon, Aug 22, 2011 at 11:29:12AM -0500, Anthony Liguori wrote:
I don't think it makes sense to have qemu-fe do dynamic labelling.
You certainly could avoid the fd passing by having qemu-fe do th
On 08/22/2011 03:25 PM, Anthony Liguori wrote:
On 08/22/2011 01:22 PM, Daniel P. Berrange wrote:
On Mon, Aug 22, 2011 at 12:25:25PM -0500, Anthony Liguori wrote:
On 08/22/2011 11:50 AM, Daniel P. Berrange wrote:
On Mon, Aug 22, 2011 at 11:29:12AM -0500, Anthony Liguori wrote:
I don't think it
On 08/22/2011 02:39 PM, Blue Swirl wrote:
On Mon, Aug 22, 2011 at 5:42 PM, Corey Bryant wrote:
>
>
> On 08/22/2011 01:25 PM, Anthony Liguori wrote:
>>
>> On 08/22/2011 11:50 AM, Daniel P. Berrange wrote:
>>>
>>> On Mon, Aug 22, 2011 at
On 08/23/2011 11:50 AM, Kevin Wolf wrote:
Am 23.08.2011 17:26, schrieb Daniel P. Berrange:
> On Tue, Aug 23, 2011 at 11:13:34AM -0400, Corey Bryant wrote:
>>
>>
>> On 08/22/2011 02:39 PM, Blue Swirl wrote:
>>> On Mon, Aug 22, 2011 at 5:42 PM, Corey Bryant
w
ing the fd: protocol from the command line
and the monitor. Tests were also run to verify existing file name
support and qemu-img were not regressed. Non-valid file descriptors,
fd: without format, snapshot and backing files were also tested.
Signed-off-by: Corey Bryant
---
block.c
On 06/14/2011 12:13 PM, Eric Blake wrote:
On 06/14/2011 07:31 AM, Corey Bryant wrote:
> - Starting Qemu with a backing file
What do you mean by this? Taking a guess:
In the case of a qcow2 image with a backing file, does that mean that
both the qcow2 image and it's backing
On 06/14/2011 04:18 PM, Eric Blake wrote:
On 06/14/2011 01:55 PM, Corey Bryant wrote:
>> So we would need something like -drive
>> file=fd:4,format=qcow2,backing=fd:5
>>
>> and since backing files can be nested, we'd need some way of specifying
>>
On 06/15/2011 03:12 PM, Blue Swirl wrote:
On Tue, Jun 14, 2011 at 4:31 PM, Corey Bryant wrote:
> sVirt provides SELinux MAC isolation for Qemu guest processes and their
> corresponding resources (image files). sVirt provides this support
> by labeling guests and resources with
On 06/18/2011 04:50 PM, Blue Swirl wrote:
On Thu, Jun 16, 2011 at 5:48 PM, Corey Bryant wrote:
On 06/15/2011 03:12 PM, Blue Swirl wrote:
On Tue, Jun 14, 2011 at 4:31 PM, Corey Bryantwrote:
sVirt provides SELinux MAC isolation for Qemu guest processes and
their
corresponding
valid file descriptors were also tested.
Signed-off-by: Corey Bryant
---
block/raw-posix.c | 70 ++---
qemu-doc.texi | 12 +
qemu-options.hx |8 --
3 files changed, 78 insertions(+), 12 deletions(-)
diff --git a/block/raw-posix.c b
On 05/23/2011 11:24 AM, Markus Armbruster wrote:
Kevin Wolf writes:
Am 20.05.2011 21:53, schrieb Blue Swirl:
On Fri, May 20, 2011 at 10:42 PM, Anthony Liguori wrote:
On 05/20/2011 02:25 PM, Blue Swirl wrote:
On Fri, May 20, 2011 at 9:48 PM, Corey Bryant wrote:
sVirt provides
On 10/06/2011 01:42 PM, Anthony Liguori wrote:
On 10/06/2011 11:34 AM, Daniel P. Berrange wrote:
On Thu, Oct 06, 2011 at 11:38:27AM -0400, Richa Marwaha wrote:
The ideal way to use qemu-bridge-helper is to give it an fscap of using:
setcap cap_net_admin=ep qemu-bridge-helper
Unfortunately,
On 10/06/2011 01:42 PM, Anthony Liguori wrote:
On 10/06/2011 11:34 AM, Daniel P. Berrange wrote:
On Thu, Oct 06, 2011 at 11:38:27AM -0400, Richa Marwaha wrote:
The ideal way to use qemu-bridge-helper is to give it an fscap of using:
setcap cap_net_admin=ep qemu-bridge-helper
Unfortunately,
On 10/06/2011 01:44 PM, Anthony Liguori wrote:
On 10/06/2011 10:38 AM, Richa Marwaha wrote:
This patch adds a helper that can be used to create a tap device
attached to
a bridge device. Since this helper is minimal in what it does, it can be
given CAP_NET_ADMIN which allows qemu to avoid runni
On 10/06/2011 01:49 PM, Anthony Liguori wrote:
On 10/06/2011 10:38 AM, Richa Marwaha wrote:
The most common use of -net tap is to connect a tap device to a
bridge. This
requires the use of a script and running qemu as root in order to
allocate a
tap device to pass to the script.
This model is
On 10/06/2011 02:19 PM, Anthony Liguori wrote:
On 10/06/2011 01:15 PM, Corey Bryant wrote:
On 10/06/2011 01:49 PM, Anthony Liguori wrote:
On 10/06/2011 10:38 AM, Richa Marwaha wrote:
The most common use of -net tap is to connect a tap device to a
bridge. This
requires the use of a script
On 10/06/2011 02:04 PM, Anthony Liguori wrote:
On 10/06/2011 11:41 AM, Daniel P. Berrange wrote:
On Thu, Oct 06, 2011 at 11:38:25AM -0400, Richa Marwaha wrote:
This patch adds a helper that can be used to create a tap device
attached to
a bridge device. Since this helper is minimal in what it
On 10/07/2011 05:04 AM, Daniel P. Berrange wrote:
On Thu, Oct 06, 2011 at 02:38:56PM -0400, Corey Bryant wrote:
On 10/06/2011 02:04 PM, Anthony Liguori wrote:
On 10/06/2011 11:41 AM, Daniel P. Berrange wrote:
On Thu, Oct 06, 2011 at 11:38:25AM -0400, Richa Marwaha wrote:
This patch adds
On 10/07/2011 10:45 AM, Daniel P. Berrange wrote:
On Fri, Oct 07, 2011 at 10:40:56AM -0400, Corey Bryant wrote:
On 10/07/2011 05:04 AM, Daniel P. Berrange wrote:
On Thu, Oct 06, 2011 at 02:38:56PM -0400, Corey Bryant wrote:
On 10/06/2011 02:04 PM, Anthony Liguori wrote:
On 10/06/2011
On 10/07/2011 10:45 AM, Daniel P. Berrange wrote:
On Fri, Oct 07, 2011 at 10:40:56AM -0400, Corey Bryant wrote:
On 10/07/2011 05:04 AM, Daniel P. Berrange wrote:
On Thu, Oct 06, 2011 at 02:38:56PM -0400, Corey Bryant wrote:
On 10/06/2011 02:04 PM, Anthony Liguori wrote:
On 10/06/2011
.name = "type", \
+.type = QEMU_OPT_STRING, \
+.help = "Type of TPM backend", \
+}
+
struct tpm_req_hdr {
uint16_t tag;
uint32_t len;
--
Regards,
Corey Bryant
ne TPM_STANDARD_CMDLINE_OPTS \
+{ \
+.name = "type", \
+.type = QEMU_OPT_STRING, \
+.help = "Type of TPM backend", \
+}
+
struct tpm_req_hdr {
uint16_t tag;
uint32_t len;
Reviewed-by: Corey Bryant
--
Regards,
Corey Bryant
ingle denied syscall at a time today via the
audit log that the kernel issues. Eduardo, you may want to see if
there's a good place to document that for QEMU so that people know where
to look.
--
Regards,
Corey Bryant
e() is denied, open() is denied (once the pre-req's are in
place for fd passing), and potentially other "dangerous" syscalls are
denied.
If the whitelist for #2 was passed from libvirt to qemu then libvirt
could define the syscalls and syscall parameters that are denied.
--
Regards,
Corey Bryant
"
+#include "tpm.h"
#include "dma.h"
#include "audio/audio.h"
#include "migration.h"
@@ -2674,6 +2675,13 @@ int main(int argc, char **argv, char **envp)
ram_size = value;
break;
}
+#ifdef CONFIG_TPM
+case QEMU_OPTION_tpmdev:
+if (tpm_config_parse(qemu_find_opts("tpmdev"), optarg) < 0) {
+exit(1);
+}
+break;
+#endif
case QEMU_OPTION_mempath:
mem_path = optarg;
break;
@@ -3405,6 +3413,12 @@ int main(int argc, char **argv, char **envp)
exit(1);
}
+#ifdef CONFIG_TPM
+if (tpm_init() < 0) {
+exit(1);
+}
+#endif
+
/* init the bluetooth world */
if (foreach_device_config(DEV_BT, bt_parse))
exit(1);
@@ -3657,6 +3671,9 @@ int main(int argc, char **argv, char **envp)
pause_all_vcpus();
net_cleanup();
res_free();
+#ifdef CONFIG_TPM
+tpm_cleanup();
+#endif
return 0;
}
--
Regards,
Corey Bryant
a register of the TIS interface
* See specs pages 33-63 for description of the registers
@@ -400,6 +465,11 @@ static uint64_t tpm_tis_mmio_read(void *opaque,
target_phys_addr_t addr,
case TPM_TIS_REG_RID:
val = TPM_TIS_TPM_RID;
break;
+#ifdef DEBUG_TIS
+case TPM_TIS_REG_DEBUG:
+tpm_tis_dump_state(opaque, addr);
+break;
+#endif
}
if (shift) {
This patch looks okay to me.
--
Regards,
Corey Bryant
e SDL support"
@@ -3911,6 +3916,12 @@ if test "$gprof" = "yes" ; then
fi
fi
+if test "$tpm" = "yes"; then
+ if test "$target_softmmu" = "yes" ; then
+echo "CONFIG_TPM=y" >> $config_host_mak
+ fi
+fi
+
if test "$ARCH" = "tci"; then
linker_script=""
else
This patch looks okay to me.
--
Regards,
Corey Bryant
goto err_exit;
+}
+
+ isa_init_irq(dev, &tis->irq, tis->irq_num);
+
+memory_region_init_io(&s->mmio, &tpm_tis_memory_ops, s, "tpm-tis-mmio",
+ TPM_TIS_NUM_LOCALITIES << TPM_TIS_LOCALITY_SHIFT);
+memory_region_add_subregion(get_system_memory(), TPM_TIS_ADDR_BASE,
+&s->mmio);
+
+rc = tpm_tis_do_startup_tpm(s);
+if (rc != 0) {
+goto err_destroy_memory;
+}
+
+return 0;
+
+ err_destroy_memory:
+memory_region_del_subregion(get_system_memory(), &s->mmio);
+memory_region_destroy(&s->mmio);
+
+ err_exit:
+return -1;
+}
+
+static const VMStateDescription vmstate_tpm_tis = {
+.name = "tpm",
+.unmigratable = 1,
+};
+
+static Property tpm_tis_properties[] = {
+DEFINE_PROP_UINT32("irq", TPMState,
+ s.tis.irq_num, TPM_TIS_IRQ),
+DEFINE_PROP_STRING("tpmdev", TPMState, backend),
+DEFINE_PROP_END_OF_LIST(),
+};
+
+static void tpm_tis_class_initfn(ObjectClass *klass, void *data)
+{
+DeviceClass *dc = DEVICE_CLASS(klass);
+ISADeviceClass *ic = ISA_DEVICE_CLASS(klass);
+
+ic->init = tpm_tis_init;
+
+dc->props = tpm_tis_properties;
+dc->reset = tpm_tis_reset;
+dc->vmsd = &vmstate_tpm_tis;
+}
+
+static TypeInfo tpm_tis_info = {
+.name= "tpm-tis",
+.parent = TYPE_ISA_DEVICE,
+.class_init = tpm_tis_class_initfn,
+.instance_size = sizeof(TPMState),
+};
+
+static void tpm_tis_register(void)
+{
+type_register_static(&tpm_tis_info);
+}
+
+type_init(tpm_tis_register)
--
Regards,
Corey Bryant
nt tpm_config_parse(QemuOptsList *opts_list, const char *optarg);
int tpm_init(void);
void tpm_cleanup(void);
TPMBackend *qemu_find_tpm(const char *id);
void tpm_display_backend_drivers(void);
const TPMDriverOps *tpm_get_backend_driver(const char *id);
+void tpm_write_fatal_error_response(uint8_t *out, uint32_t out_len);
+
+extern const TPMDriverOps tpm_passthrough_driver;
#endif /* QEMU_TPM_H */
diff --git a/vl.c b/vl.c
index 3e784f5..6928e67 100644
--- a/vl.c
+++ b/vl.c
@@ -2676,11 +2676,13 @@ int main(int argc, char **argv, char **envp)
break;
}
#ifdef CONFIG_TPM
+# ifdef CONFIG_TPM_PASSTHROUGH
case QEMU_OPTION_tpmdev:
if (tpm_config_parse(qemu_find_opts("tpmdev"), optarg) < 0) {
exit(1);
}
break;
+# endif
#endif
case QEMU_OPTION_mempath:
mem_path = optarg;
--
Regards,
Corey Bryant
ase upgrade to have SDL support"
@@ -3919,7 +3931,9 @@ fi
if test "$tpm" = "yes"; then
if test "$target_softmmu" = "yes" ; then
if test "$linux" = "yes" ; then
- echo "CONFIG_TPM_PASSTHROUGH=y" >> $config_host_mak
+ if test "$tpm_passthrough" = "yes" ; then
+echo "CONFIG_TPM_PASSTHROUGH=y" >> $config_host_mak
+ fi
fi
echo "CONFIG_TPM=y" >> $config_host_mak
fi
This patch looks okay to me.
--
Regards,
Corey Bryant
is optional.
+
Some notes about using the host's TPM with the passthrough driver:
The TPM device accessed by the passthrough driver must not be
diff --git a/tpm.c b/tpm.c
index 79530c9..64d3140 100644
--- a/tpm.c
+++ b/tpm.c
@@ -201,6 +201,10 @@ static TPMInfo *qmp_query_tpm_inst(TPMBackend *drv)
res->path = g_strdup(drv->path);
res->has_path = true;
}
+if (drv->tpm_fd != NULL && *drv->tpm_fd >= 0) {
+res->fd = *drv->tpm_fd;
+res->has_fd = true;
+}
res->type = g_strdup(drv->ops->id);
return res;
diff --git a/tpm.h b/tpm.h
index bacaff3..00f7600 100644
--- a/tpm.h
+++ b/tpm.h
@@ -24,6 +24,7 @@ typedef struct TPMBackend {
char *id;
const char *fe_model;
char *path;
+int *tpm_fd;
const TPMDriverOps *ops;
union {
This patch looks okay to me.
--
Regards,
Corey Bryant
couple of general questions:
I understand that the passthrough driver won't support migration. What
happens on a migration attempt? Does it fail gracefully?
What happens when a 2nd guest attempts to use the passthrough vTPM after
the 1st guest is already using it? Does it also fail
()/
--
Regards,
Corey Bryant
Testing the proper functioning of the different flags and localities
cannot be done from user space when running in Linux for example, since
access to the address space of the TPM TIS interface is not possible. Also
the Linux driver itself does not exercise all functio
x27;s TPM using the passthrough
driver.
@@ -2049,6 +2050,10 @@ driver.
a Linux host this would be @code{/dev/tpm0}.
@option{path} is optional and by default @code{/dev/tpm0} is used.
+@option{fd} specifies the file descriptor of the host's TPM device.
+@option{fd} and @option{path} ar
opaque option is also available with
add-fd, and allows a free-form string to be stored in the fd set
along with the fd.
Signed-off-by: Corey Bryant
---
qemu-config.c | 8
qemu-options.hx | 15 +--
2 files changed, 21 insertions(+), 2 deletions(-)
diff --git a/qemu
() already knows how to handle a
filename of this format. qemu_open() searches the corresponding
fd set for an fd and when it finds a match, QEMU goes on to use a
dup of that fd just like it would have used an fd that it opened
itself.
Corey Bryant (4):
monitor: Less restrictive fd matching f
allows the fd to remain in the fd set after
probing of the image file.
Signed-off-by: Corey Bryant
---
monitor.c | 125 +++---
monitor.h | 3 ++
2 files changed, 74 insertions(+), 54 deletions(-)
diff --git a/monitor.c b/monitor.c
index
;/dev/fdset/2" with O_RDONLY or O_WRONLY,
and an fd in fd set 2 has O_RDWR, the call will now be successful.
Signed-off-by: Corey Bryant
---
monitor.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/monitor.c b/monitor.c
index a0e3ffb..34a968c 100644
--- a/monitor.c
+++ b
) searches the corresponding
fd set for an fd and when it finds a match, QEMU goes on to use a
dup of that fd just like it would have used an fd that it opened
itself.
Signed-off-by: Corey Bryant
---
blockdev.c | 40 ++--
1 file changed, 38 insertions(+), 2
On 10/05/2012 02:26 PM, Eric Blake wrote:
On 10/05/2012 12:07 PM, Corey Bryant wrote:
This series adds command line file descriptor passing support
to the -drive option. This is a follow-on to the existing
QMP fd passing support provided in the following patch series:
comments.gmane.org
On 10/05/2012 02:30 PM, Eric Blake wrote:
On 10/05/2012 12:25 PM, Blue Swirl wrote:
On Fri, Oct 5, 2012 at 6:07 PM, Corey Bryant wrote:
These new options can be used for passing drive file descriptors
on the command line, instead of using the file option to specify
a file name.
These new
On 10/05/2012 02:25 PM, Blue Swirl wrote:
On Fri, Oct 5, 2012 at 6:07 PM, Corey Bryant wrote:
These new options can be used for passing drive file descriptors
on the command line, instead of using the file option to specify
a file name.
These new command line options mirror the existing add
On 10/05/2012 02:35 PM, Eric Blake wrote:
On 10/05/2012 12:07 PM, Corey Bryant wrote:
Currently, in order to use a file descriptor that resides in an
fd set, the access mode flag of the qemu_open() call has to be
an exact match of the access mode flag of an fd in the requested
fd set.
This
On 10/05/2012 02:51 PM, Eric Blake wrote:
On 10/05/2012 12:44 PM, Corey Bryant wrote:
Yes, this makes more sense. I'd like to mirror the add-fd QMP command
as much as possible:
{ 'command': 'add-fd', 'data': {'*fdset-id': 'int',
QMP
option as much as possible.
Corey Bryant (3):
monitor: Allow add-fd to any specified fd set
monitor: Enable adding an inherited fd to an fd set
qemu-config: Add new -add-fd command line option
monitor.c| 131 +++
monitor.h
allows the fd to remain in the fd set after
probing of the image file.
Signed-off-by: Corey Bryant
---
v2:
- Removed Error** parameter from monitor_fdset_add_fd()
monitor.c | 142 +-
monitor.h | 2 +
2 files changed, 77 insertions(+), 67
The first call to add an fd to an fd set was previously not
allowed to choose the fd set ID. The ID was generated as
the first available and ensuing calls could add more fds by
specifying the fd set ID. This change allows users to
choose the fd set ID on the first call.
Signed-off-by: Corey
open() already knows how
to handle a filename of this format. qemu_open() searches the
corresponding fd set for an fd and when it finds a match, QEMU
goes on to use a dup of that fd just like it would have used an
fd that it opened itself.
Signed-off-by: Corey Bryant
---
v2:
- The -add-fd opti
On 10/10/2012 06:01 PM, Eric Blake wrote:
On 10/10/2012 08:20 AM, Corey Bryant wrote:
qmp_add_fd() gets an fd that was received over a socket with
SCM_RIGHTS and adds it to an fd set. This patch adds support
that will enable adding an fd that was inherited on the
command line to an fd set
On 10/10/2012 05:49 PM, Eric Blake wrote:
On 10/10/2012 08:20 AM, Corey Bryant wrote:
The first call to add an fd to an fd set was previously not
allowed to choose the fd set ID. The ID was generated as
the first available and ensuing calls could add more fds by
specifying the fd set ID
On 10/10/2012 06:31 PM, Eric Blake wrote:
On 10/10/2012 08:20 AM, Corey Bryant wrote:
This option can be used for passing file descriptors on the
command line. It mirrors the existing add-fd QMP command which
allows an fd to be passed to QEMU via SCM_RIGHTS and added to an
fd set.
This can
On 10/11/2012 07:25 AM, Kevin Wolf wrote:
Am 10.10.2012 16:20, schrieb Corey Bryant:
qmp_add_fd() gets an fd that was received over a socket with
SCM_RIGHTS and adds it to an fd set. This patch adds support
that will enable adding an fd that was inherited on the
command line to an fd set
s not specified then we can default to
tap0, etc.
Richa, do you want to handle this?
--
Regards,
Corey Bryant
On 10/11/2012 11:55 AM, Eric Blake wrote:
On 10/11/2012 08:45 AM, Corey Bryant wrote:
Another missing validation check is for duplicate use. With the monitor
command, you ALWAYS have a unique fd (thanks to SCM_RIGHTS). But with
the command line, I can type 'qemu -add-fd fd=4,set=1 -a
gs will be even more important when passing
fds on the command line.
--
Regards,
Corey Bryant
The first call to add an fd to an fd set was previously not
allowed to choose the fd set ID. The ID was generated as
the first available and ensuing calls could add more fds by
specifying the fd set ID. This change allows users to
choose the fd set ID on the first call.
Signed-off-by: Corey
for non-valid fdset-id, is code motion
from qmp_add_fd().
Signed-off-by: Corey Bryant
---
v2:
-Removed Error** parameter from monitor_fdset_add_fd()
v3:
-Added Error** parameter back to monitor_fdset_add_fd()
-Move 'if (!mon_fdset_cur)' change to patch 1 (kw...@redhat.com)
ith ID=2. qemu_open() already knows how
to handle a filename of this format. qemu_open() searches the
corresponding fd set for an fd and when it finds a match, QEMU
goes on to use a dup of that fd just like it would have used an
fd that it opened itself.
Signed-off-by: Corey Bryant
---
v2:
- The -add-fd
QMP
option as much as possible.
Corey Bryant (4):
monitor: Allow add-fd to any specified fd set
monitor: Enable adding an inherited fd to an fd set
monitor: Prevent removing fd from set during init
qemu-config: Add new -add-fd command line option
monitor.c| 142
If an fd is added to an fd set via the command line, and it is not
referenced by another command line option (ie. -drive), then clean
it up after QEMU initialization is complete.
Signed-off-by: Corey Bryant
---
v3:
- This patch was split into it's own patch in v3
(ebl...@redhat.co
On 10/16/2012 03:26 PM, Eric Blake wrote:
On 10/16/2012 11:51 AM, Corey Bryant wrote:
This series adds command line file descriptor passing support
via a new -add-fd option. This is a follow-on to the existing
QMP fd passing support provided in the following patch series:
comments.gmane.org
this:
-net tap,helper="/usr/local/libexec/qemu-bridge-helper --br=br0"
--
Regards,
Corey Bryant
On 04/30/2013 02:47 PM, Eduardo Otubo wrote:
On 04/29/2013 07:02 PM, Corey Bryant wrote:
On 04/29/2013 02:39 PM, Eduardo Otubo wrote:
On 04/26/2013 06:07 PM, Paul Moore wrote:
On Friday, April 26, 2013 03:39:33 PM Eduardo Otubo wrote:
Hello folks,
Resuming the sandboxing work, I&#
On 05/01/2013 10:13 AM, Paul Moore wrote:
On Tuesday, April 30, 2013 04:28:54 PM Corey Bryant wrote:
Just to be clear, I'm thinking you could launch guests in one of two
different seccomp sandboxed environments:
1) Using the existing and more permissive whitelist where every QEMU
fe
On 05/01/2013 01:25 PM, Eduardo Otubo wrote:
On 04/30/2013 12:24 PM, Paul Moore wrote:
On Monday, April 29, 2013 05:52:10 PM Corey Bryant wrote:
On 04/26/2013 05:07 PM, Paul Moore wrote:
[snip]
3. Debugging and/or learning mode - third party libraries still
have the
problem of
Provides support for in-memory VNVRAM entries. The in-memory
entries are used for fast access to entry data such as the
current or max size of an entry and the disk offset where an
entry's binary blob data is stored.
Signed-off-by: Corey Bryant
---
vnvram.c |
Provides VNVRAM APIs that can be used by other areas of QEMU to
provide persistent storage.
Signed-off-by: Corey Bryant
---
vnvram.c | 266 ++
vnvram.h | 14 +++
2 files changed, 280 insertions(+), 0 deletions(-)
diff --git a
de0-0-0", false, &errcode);
strcpy((char *)entry_name, "first-entry");
vnvram_register_entry(vnvram, &entry_name, 1024);
vnvram_write_entry(vnvram, &entry_name, (char *)blob_w, strlen(blob_w)+1);
vnvram_read_entry(vnvram, &entry_name, &blob_r, &blob_r_size);
v
Provides support that schedules and executes VNVRAM read/write
requests. A bottom-half is used to perform reads/writes from
the QEMU main thread.
Signed-off-by: Corey Bryant
---
vnvram.c | 142 ++
1 files changed, 142 insertions
Provides debug support that dumps the disk and in-memory VNVRAM
contents to stderr.
Signed-off-by: Corey Bryant
---
vnvram.c | 94 ++
1 files changed, 94 insertions(+), 0 deletions(-)
diff --git a/vnvram.c b/vnvram.c
index 357923d
Signed-off-by: Corey Bryant
---
vl.c |6 ++
1 files changed, 6 insertions(+), 0 deletions(-)
diff --git a/vl.c b/vl.c
index 59dc0b4..5da88e6 100644
--- a/vl.c
+++ b/vl.c
@@ -171,6 +171,8 @@ int main(int argc, char **argv)
#include "ui/qemu-spice.h"
#include "qa
Signed-off-by: Corey Bryant
---
hmp.c| 32
hmp.h|1 +
monitor.c|7 +
qapi-schema.json | 47 +++
qmp-commands.hx | 41 +++
vnvram.c | 71
Provides low-level VNVRAM functionality that reads and writes data,
such as an entry's binary blob, to a drive image using the block
driver.
Signed-off-by: Corey Bryant
---
Makefile.objs |2 +
vnvram.c | 487 +
vnv
On 05/23/2013 01:59 PM, Eric Blake wrote:
On 05/23/2013 11:44 AM, Corey Bryant wrote:
Signed-off-by: Corey Bryant
---
Might help to list a sample HMP or QMP usage in the commit message.
+++ b/qapi-schema.json
@@ -3619,3 +3619,50 @@
'*cpuid-input-ecx&#
On 05/23/2013 02:03 PM, Anthony Liguori wrote:
Corey Bryant writes:
This patch series provides VNVRAM persistent storage support that
QEMU can use internally. The initial target user will be a software
vTPM 1.2 backend that needs to store keys in VNVRAM and be able to
reboot/migrate and
On 05/24/2013 09:06 AM, Kevin Wolf wrote:
Am 23.05.2013 um 19:44 hat Corey Bryant geschrieben:
Provides low-level VNVRAM functionality that reads and writes data,
such as an entry's binary blob, to a drive image using the block
driver.
Signed-off-by: Corey Bryant
+/*
+ * Increas
On 05/23/2013 03:15 PM, Anthony Liguori wrote:
Corey Bryant writes:
On 05/23/2013 02:03 PM, Anthony Liguori wrote:
Corey Bryant writes:
One of the difficulties in virtualizing a TPM is that it doesn't support
SR-IOV. So the existing passthrough vTPM can only be used by one
On 05/24/2013 08:36 AM, Stefan Hajnoczi wrote:
On Fri, May 24, 2013 at 08:13:27AM -0400, Stefan Berger wrote:
On 05/24/2013 05:59 AM, Stefan Hajnoczi wrote:
On Thu, May 23, 2013 at 01:44:40PM -0400, Corey Bryant wrote:
This patch series provides VNVRAM persistent storage support that
QEMU
On 05/24/2013 11:37 AM, Kevin Wolf wrote:
Am 24.05.2013 um 17:33 hat Corey Bryant geschrieben:
On 05/24/2013 09:06 AM, Kevin Wolf wrote:
Am 23.05.2013 um 19:44 hat Corey Bryant geschrieben:
Provides low-level VNVRAM functionality that reads and writes data,
such as an entry's binary
On 10/17/2012 12:02 AM, Eric Blake wrote:
On 10/16/2012 12:08 PM, Corey Bryant wrote:
If an fd is added to an fd set via the command line, and it is not
referenced by another command line option (ie. -drive), then clean
it up after QEMU initialization is complete.
Signed-off-by: Corey Bryant
On 10/17/2012 12:16 AM, Eric Blake wrote:
On 10/16/2012 12:10 PM, Corey Bryant wrote:
This option can be used for passing file descriptors on the
command line. It mirrors the existing add-fd QMP command which
allows an fd to be passed to QEMU via SCM_RIGHTS and added to an
fd set.
This can
On 10/17/2012 09:45 AM, Kevin Wolf wrote:
Am 16.10.2012 20:08, schrieb Corey Bryant:
qmp_add_fd() gets an fd that was received over a socket with
SCM_RIGHTS and adds it to an fd set. This patch adds support
that will enable adding an fd that was inherited on the
command line to an fd set
301 - 400 of 565 matches
Mail list logo
