Series comparison

-[Qemu-devel] [PULL 0/4] Block patches
+[Qemu-devel] [PULL 0/8] Block patches
-The following changes since commit c416eecea5f3aea863ab8fda5a36a24157b8f704:
+The following changes since commit 812b835fb4d23dd108b2f9802158472d50b73579:
-  Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging (2018-05-15 17:02:00 +0100)
+  Merge remote-tracking branch 'remotes/maxreitz/tags/pull-block-2019-05-07' into staging (2019-05-09 16:31:12 +0100)
-are available in the git repository at:
+are available in the Git repository at:
-  git://github.com/codyprime/qemu-kvm-jtc.git tags/block-pull-request
+  https://github.com/stefanha/qemu.git tags/block-pull-request
-for you to fetch changes up to c82be42cc803b36fd7aed5dceec68312c7056fd5:
+for you to fetch changes up to e84125761f78919fe63616d9888ea45e72dc956f:
-  nfs: Remove processed options from QDict (2018-05-16 13:37:47 -0400)
+  docs: add Security chapter to the documentation (2019-05-10 10:53:52 +0100)
 ----------------------------------------------------------------
-Block patches
+Pull request
 ----------------------------------------------------------------
-Kevin Wolf (2):
+Andrey Shinkevich (1):
-  nfs: Fix error path in nfs_options_qdict_to_qapi()
+  block/io.c: fix for the allocation failure
-  nfs: Remove processed options from QDict
 Jules Irenge (3):
   util/readline: add a space to fix errors by checkpatch tool
   util: readline: replace tab indent by four spaces to fix checkpatch
     errors
   util/readline: Add braces to fix checkpatch errors
 Nikita Alekseev (1):
   block: Add coroutine_fn to bdrv_check_co_entry
 Paolo Bonzini (1):
   aio-posix: ensure poll mode is left when aio_notify is called
 Stefan Hajnoczi (2):
-  qemu-iotests: reduce chance of races in 185
+  docs: add Secure Coding Practices to developer docs
-  blockjob: do not cancel timer in resume
+  docs: add Security chapter to the documentation
- block/nfs.c                |  8 ++++++++
+ Makefile                               |   2 +-
- blockjob.c                 | 22 +++++++++++++++-------
+ block.c                                |   2 +-
- tests/qemu-iotests/185     | 17 +++++++++++++----
+ block/io.c                             |   2 +-
- tests/qemu-iotests/185.out | 12 +++++-------
+ util/aio-posix.c                       |  12 +-
-files changed, 41 insertions(+), 18 deletions(-)
+ util/readline.c                        | 174 ++++++++++++++-----------
  docs/devel/index.rst                   |   1 +
  docs/devel/secure-coding-practices.rst | 106 +++++++++++++++
  docs/security.texi                     | 131 +++++++++++++++++++
  qemu-doc.texi                          |   3 +
 files changed, 347 insertions(+), 86 deletions(-)
  create mode 100644 docs/devel/secure-coding-practices.rst
  create mode 100644 docs/security.texi
 --
-.13.6
+.21.0

-New patch
+[Qemu-devel] [PULL 1/8] util/readline: add a space to fix errors by checkpatch tool
+From: Jules Irenge <jbi.octave@gmail.com>
+util/readline: add a space to fix errors reported by checkpatch.pl tool
+"ERROR: space required before the open parenthesis"
+"ERROR: space required after that ..."
+within "util/redline.c" file
+Signed-off-by: Jules Irenge <jbi.octave@gmail.com>
+Reviewed-by: Thomas Huth <thuth@redhat.com>
+Message-id: 20190401024406.10819-2-jbi.octave@gmail.com
+Message-Id: <20190401024406.10819-2-jbi.octave@gmail.com>
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ util/readline.c | 34 +++++++++++++++++-----------------
+file changed, 17 insertions(+), 17 deletions(-)
+diff --git a/util/readline.c b/util/readline.c
+index XXXXXXX..XXXXXXX 100644
+--- a/util/readline.c
++++ b/util/readline.c
+@@ -XXX,XX +XXX,XX @@ static void readline_update(ReadLineState *rs)
+     if (rs->cmd_buf_size != rs->last_cmd_buf_size ||
+         memcmp(rs->cmd_buf, rs->last_cmd_buf, rs->cmd_buf_size) != 0) {
+-        for(i = 0; i < rs->last_cmd_buf_index; i++) {
++        for (i = 0; i < rs->last_cmd_buf_index; i++) {
+             rs->printf_func(rs->opaque, "\033[D");
+         }
+         rs->cmd_buf[rs->cmd_buf_size] = '\0';
+         if (rs->read_password) {
+             len = strlen(rs->cmd_buf);
+-            for(i = 0; i < len; i++)
++            for (i = 0; i < len; i++)
+                 rs->printf_func(rs->opaque, "*");
+         } else {
+             rs->printf_func(rs->opaque, "%s", rs->cmd_buf);
+@@ -XXX,XX +XXX,XX @@ static void readline_update(ReadLineState *rs)
+     if (rs->cmd_buf_index != rs->last_cmd_buf_index) {
+         delta = rs->cmd_buf_index - rs->last_cmd_buf_index;
+         if (delta > 0) {
+-            for(i = 0;i < delta; i++) {
++            for (i = 0; i < delta; i++) {
+                 rs->printf_func(rs->opaque, "\033[C");
+             }
+         } else {
+             delta = -delta;
+-            for(i = 0;i < delta; i++) {
++            for (i = 0; i < delta; i++) {
+                 rs->printf_func(rs->opaque, "\033[D");
+             }
+         }
+@@ -XXX,XX +XXX,XX @@ static void readline_completion(ReadLineState *rs)
+         return;
+     if (rs->nb_completions == 1) {
+         len = strlen(rs->completions[0]);
+-        for(i = rs->completion_index; i < len; i++) {
++        for (i = rs->completion_index; i < len; i++) {
+             readline_insert_char(rs, rs->completions[0][i]);
+         }
+         /* extra space for next argument. XXX: make it more generic */
+@@ -XXX,XX +XXX,XX @@ static void readline_completion(ReadLineState *rs)
+               completion_comp);
+         rs->printf_func(rs->opaque, "\n");
+         max_width = 0;
+-        max_prefix = 0;
+-        for(i = 0; i < rs->nb_completions; i++) {
++        max_prefix = 0;
++        for (i = 0; i < rs->nb_completions; i++) {
+             len = strlen(rs->completions[i]);
+-            if (i==0) {
++            if (i == 0) {
+                 max_prefix = len;
+             } else {
+                 if (len < max_prefix)
+                     max_prefix = len;
+-                for(j=0; j<max_prefix; j++) {
++                for (j = 0; j < max_prefix; j++) {
+                     if (rs->completions[i][j] != rs->completions[0][j])
+                         max_prefix = j;
+                 }
+@@ -XXX,XX +XXX,XX @@ static void readline_completion(ReadLineState *rs)
+             if (len > max_width)
+                 max_width = len;
+         }
+-        if (max_prefix > 0)
+-            for(i = rs->completion_index; i < max_prefix; i++) {
++        if (max_prefix > 0)
++            for (i = rs->completion_index; i < max_prefix; i++) {
+                 readline_insert_char(rs, rs->completions[0][i]);
+             }
+         max_width += 2;
+@@ -XXX,XX +XXX,XX @@ static void readline_completion(ReadLineState *rs)
+             max_width = 80;
+         nb_cols = 80 / max_width;
+         j = 0;
+-        for(i = 0; i < rs->nb_completions; i++) {
++        for (i = 0; i < rs->nb_completions; i++) {
+             rs->printf_func(rs->opaque, "%-*s", max_width, rs->completions[i]);
+             if (++j == nb_cols || i == (rs->nb_completions - 1)) {
+                 rs->printf_func(rs->opaque, "\n");
+@@ -XXX,XX +XXX,XX @@ static void readline_clear_screen(ReadLineState *rs)
+ /* return true if command handled */
+ void readline_handle_byte(ReadLineState *rs, int ch)
+ {
+-    switch(rs->esc_state) {
++    switch (rs->esc_state) {
+     case IS_NORM:
+-        switch(ch) {
++        switch (ch) {
+         case 1:
+             readline_bol(rs);
+             break;
+@@ -XXX,XX +XXX,XX @@ void readline_handle_byte(ReadLineState *rs, int ch)
+         }
+         break;
+     case IS_CSI:
+-        switch(ch) {
++        switch (ch) {
+     case 'A':
+     case 'F':
+         readline_up_char(rs);
+@@ -XXX,XX +XXX,XX @@ void readline_handle_byte(ReadLineState *rs, int ch)
+             rs->esc_param = rs->esc_param * 10 + (ch - '0');
+             goto the_end;
+         case '~':
+-            switch(rs->esc_param) {
++            switch (rs->esc_param) {
+             case 1:
+                 readline_bol(rs);
+                 break;
+@@ -XXX,XX +XXX,XX @@ void readline_handle_byte(ReadLineState *rs, int ch)
+     the_end:
+         break;
+     case IS_SS3:
+-        switch(ch) {
++        switch (ch) {
+         case 'F':
+             readline_eol(rs);
+             break;
+--
+.21.0

-[Qemu-devel] [PULL 2/4] blockjob: do not cancel timer in resume
+[Qemu-devel] [PULL 2/8] util: readline: replace tab indent by four spaces to fix checkpatch errors
-From: Stefan Hajnoczi <stefanha@redhat.com>
+From: Jules Irenge <jbi.octave@gmail.com>
-Currently the timer is cancelled and the block job is entered by
+Replace tab indent by four spaces to fix errors issued by checkpatch.pl tool
-block_job_resume().  This behavior causes drain to run extra blockjob
+"ERROR: code indent should never use tabs" within "util/readline.c" file.
 iterations when the job was sleeping due to the ratelimit.
-This patch leaves the job asleep when block_job_resume() is called.
+Signed-off-by: Jules Irenge <jbi.octave@gmail.com>
-Jobs can still be forcibly woken up using block_job_enter(), which is
+Reviewed-by: Thomas Huth <thuth@redhat.com>
-used to cancel jobs.
+Message-id: 20190401024406.10819-3-jbi.octave@gmail.com
 Message-Id: <20190401024406.10819-3-jbi.octave@gmail.com>
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
  util/readline.c | 98 ++++++++++++++++++++++++-------------------------
 file changed, 49 insertions(+), 49 deletions(-)
-After this patch drain no longer runs extra blockjob iterations.  This
+diff --git a/util/readline.c b/util/readline.c
 is the expected behavior that qemu-iotests 185 used to rely on.  We
 temporarily changed the 185 test output to make it pass for the QEMU
 .12 release but now it's time to address this issue.
 Cc: QingFeng Hao <haoqf@linux.vnet.ibm.com>
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Reviewed-by: Eric Blake <eblake@redhat.com>
 Reviewed-by: QingFeng Hao <haoqf@linux.vnet.ibm.com>
 Message-id: 20180508135436.30140-3-stefanha@redhat.com
 Reviewed-by: Jeff Cody <jcody@redhat.com>
 Signed-off-by: Jeff Cody <jcody@redhat.com>
 ---
  blockjob.c                 | 22 +++++++++++++++-------
  tests/qemu-iotests/185     |  5 +----
  tests/qemu-iotests/185.out | 12 +++++-------
 files changed, 21 insertions(+), 18 deletions(-)
 diff --git a/blockjob.c b/blockjob.c
 index XXXXXXX..XXXXXXX 100644
---- a/blockjob.c
+--- a/util/readline.c
-+++ b/blockjob.c
++++ b/util/readline.c
-@@ -XXX,XX +XXX,XX @@ static void block_job_txn_del_job(BlockJob *job)
+@@ -XXX,XX +XXX,XX @@ static void readline_up_char(ReadLineState *rs)
      int idx;
      if (rs->hist_entry == 0)
 -    return;
 +        return;
      if (rs->hist_entry == -1) {
 -    /* Find latest entry */
 -    for (idx = 0; idx < READLINE_MAX_CMDS; idx++) {
 -        if (rs->history[idx] == NULL)
 -        break;
 -    }
 -    rs->hist_entry = idx;
 +        /* Find latest entry */
 +        for (idx = 0; idx < READLINE_MAX_CMDS; idx++) {
 +            if (rs->history[idx] == NULL)
 +                break;
 +        }
 +        rs->hist_entry = idx;
      }
      rs->hist_entry--;
      if (rs->hist_entry >= 0) {
 -    pstrcpy(rs->cmd_buf, sizeof(rs->cmd_buf),
 +        pstrcpy(rs->cmd_buf, sizeof(rs->cmd_buf),
                  rs->history[rs->hist_entry]);
 -    rs->cmd_buf_index = rs->cmd_buf_size = strlen(rs->cmd_buf);
 +        rs->cmd_buf_index = rs->cmd_buf_size = strlen(rs->cmd_buf);
      }
  }
-+/* Assumes the block_job_mutex is held */
+@@ -XXX,XX +XXX,XX @@ static void readline_down_char(ReadLineState *rs)
 +static bool block_job_timer_pending(BlockJob *job)
 +{
 +    return timer_pending(&job->sleep_timer);
 +}
 +
 +/* Assumes the block_job_mutex is held */
 +static bool block_job_timer_not_pending(BlockJob *job)
 +{
 +    return !block_job_timer_pending(job);
 +}
 +
  static void block_job_pause(BlockJob *job)
  {
      job->pause_count++;
@@ -XXX,XX +XXX,XX @@ static void block_job_resume(BlockJob *job)
      if (job->pause_count) {
          return;
+     if (rs->hist_entry < READLINE_MAX_CMDS - 1 &&
+         rs->history[++rs->hist_entry] != NULL) {
+-    pstrcpy(rs->cmd_buf, sizeof(rs->cmd_buf),
++        pstrcpy(rs->cmd_buf, sizeof(rs->cmd_buf),
+                 rs->history[rs->hist_entry]);
+     } else {
+         rs->cmd_buf[0] = 0;
+-    rs->hist_entry = -1;
++        rs->hist_entry = -1;
      }
--    block_job_enter(job);
+     rs->cmd_buf_index = rs->cmd_buf_size = strlen(rs->cmd_buf);
 +
 +    /* kick only if no timer is pending */
 +    block_job_enter_cond(job, block_job_timer_not_pending);
  }
+@@ -XXX,XX +XXX,XX @@ static void readline_hist_add(ReadLineState *rs, const char *cmdline)
- void block_job_ref(BlockJob *job)
+     int idx;
-@@ -XXX,XX +XXX,XX @@ static void block_job_completed_txn_success(BlockJob *job)
      if (cmdline[0] == '\0')
 -    return;
 +        return;
      new_entry = NULL;
      if (rs->hist_entry != -1) {
 -    /* We were editing an existing history entry: replace it */
 -    hist_entry = rs->history[rs->hist_entry];
 -    idx = rs->hist_entry;
 -    if (strcmp(hist_entry, cmdline) == 0) {
 -        goto same_entry;
 -    }
 +        /* We were editing an existing history entry: replace it */
 +        hist_entry = rs->history[rs->hist_entry];
 +        idx = rs->hist_entry;
 +        if (strcmp(hist_entry, cmdline) == 0) {
 +            goto same_entry;
 +        }
      }
- }
+     /* Search cmdline in history buffers */
+     for (idx = 0; idx < READLINE_MAX_CMDS; idx++) {
--/* Assumes the block_job_mutex is held */
+-    hist_entry = rs->history[idx];
--static bool block_job_timer_pending(BlockJob *job)
+-    if (hist_entry == NULL)
--{
+-        break;
--    return timer_pending(&job->sleep_timer);
+-    if (strcmp(hist_entry, cmdline) == 0) {
--}
+-    same_entry:
--
+-        new_entry = hist_entry;
- void block_job_set_speed(BlockJob *job, int64_t speed, Error **errp)
+-        /* Put this entry at the end of history */
- {
+-        memmove(&rs->history[idx], &rs->history[idx + 1],
-     int64_t old_speed = job->speed;
+-            (READLINE_MAX_CMDS - (idx + 1)) * sizeof(char *));
-diff --git a/tests/qemu-iotests/185 b/tests/qemu-iotests/185
+-        rs->history[READLINE_MAX_CMDS - 1] = NULL;
-index XXXXXXX..XXXXXXX 100755
+-        for (; idx < READLINE_MAX_CMDS; idx++) {
---- a/tests/qemu-iotests/185
+-        if (rs->history[idx] == NULL)
-+++ b/tests/qemu-iotests/185
+-            break;
-@@ -XXX,XX +XXX,XX @@ echo
+-        }
- # command to be received (after receiving the command, the rest runs
+-        break;
- # synchronously, so jobs can arbitrarily continue or complete).
+-    }
- #
++        hist_entry = rs->history[idx];
--# Jobs present while QEMU is terminating iterate once more due to
++        if (hist_entry == NULL)
--# bdrv_drain_all().
++            break;
--#
++        if (strcmp(hist_entry, cmdline) == 0) {
- # The buffer size for commit and streaming is 512k (waiting for 8 seconds after
++        same_entry:
- # the first request), for active commit and mirror it's large enough to cover
++            new_entry = hist_entry;
- # the full 4M, and for backup it's the qcow2 cluster size, which we know is
++            /* Put this entry at the end of history */
- # 64k. As all of these are at least as large as the speed, we are sure that the
++            memmove(&rs->history[idx], &rs->history[idx + 1],
--# offset advances exactly twice before qemu exits.
++                    (READLINE_MAX_CMDS - (idx + 1)) * sizeof(char *));
-+# offset advances exactly once before qemu exits.
++            rs->history[READLINE_MAX_CMDS - 1] = NULL;
++            for (; idx < READLINE_MAX_CMDS; idx++) {
- _send_qemu_cmd $h \
++                if (rs->history[idx] == NULL)
-     "{ 'execute': 'block-commit',
++                    break;
-diff --git a/tests/qemu-iotests/185.out b/tests/qemu-iotests/185.out
++            }
-index XXXXXXX..XXXXXXX 100644
++            break;
---- a/tests/qemu-iotests/185.out
++        }
-+++ b/tests/qemu-iotests/185.out
+     }
-@@ -XXX,XX +XXX,XX @@ Formatting 'TEST_DIR/t.qcow2', fmt=qcow2 size=67108864 backing_file=TEST_DIR/t.q
+     if (idx == READLINE_MAX_CMDS) {
- {"return": {}}
+-    /* Need to get one free slot */
- {"return": {}}
++        /* Need to get one free slot */
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false}}
+         g_free(rs->history[0]);
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_CANCELLED", "data": {"device": "disk", "len": 67108864, "offset": 1048576, "speed": 65536, "type": "commit"}}
+-    memmove(rs->history, &rs->history[1],
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_CANCELLED", "data": {"device": "disk", "len": 67108864, "offset": 524288, "speed": 65536, "type": "commit"}}
+-            (READLINE_MAX_CMDS - 1) * sizeof(char *));
+-    rs->history[READLINE_MAX_CMDS - 1] = NULL;
- === Start active commit job and exit qemu ===
+-    idx = READLINE_MAX_CMDS - 1;
++        memmove(rs->history, &rs->history[1],
-@@ -XXX,XX +XXX,XX @@ Formatting 'TEST_DIR/t.qcow2', fmt=qcow2 size=67108864 backing_file=TEST_DIR/t.q
++                (READLINE_MAX_CMDS - 1) * sizeof(char *));
- {"return": {}}
++        rs->history[READLINE_MAX_CMDS - 1] = NULL;
- {"return": {}}
++        idx = READLINE_MAX_CMDS - 1;
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false}}
+     }
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_READY", "data": {"device": "disk", "len": 4194304, "offset": 4194304, "speed": 65536, "type": "commit"}}
+     if (new_entry == NULL)
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_COMPLETED", "data": {"device": "disk", "len": 4194304, "offset": 4194304, "speed": 65536, "type": "commit"}}
+         new_entry = g_strdup(cmdline);
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_CANCELLED", "data": {"device": "disk", "len": 4194304, "offset": 4194304, "speed": 65536, "type": "commit"}}
+@@ -XXX,XX +XXX,XX @@ void readline_handle_byte(ReadLineState *rs, int ch)
+         case 8:
- === Start mirror job and exit qemu ===
+             readline_backspace(rs);
+             break;
-@@ -XXX,XX +XXX,XX @@ Formatting 'TEST_DIR/t.qcow2.copy', fmt=qcow2 size=67108864 cluster_size=65536 l
+-    case 155:
- {"return": {}}
++        case 155:
- {"return": {}}
+             rs->esc_state = IS_CSI;
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false}}
+-        break;
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_READY", "data": {"device": "disk", "len": 4194304, "offset": 4194304, "speed": 65536, "type": "mirror"}}
++            break;
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_COMPLETED", "data": {"device": "disk", "len": 4194304, "offset": 4194304, "speed": 65536, "type": "mirror"}}
+         default:
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_CANCELLED", "data": {"device": "disk", "len": 4194304, "offset": 4194304, "speed": 65536, "type": "mirror"}}
+             if (ch >= 32) {
+                 readline_insert_char(rs, ch);
- === Start backup job and exit qemu ===
+@@ -XXX,XX +XXX,XX @@ void readline_handle_byte(ReadLineState *rs, int ch)
+         break;
-@@ -XXX,XX +XXX,XX @@ Formatting 'TEST_DIR/t.qcow2.copy', fmt=qcow2 size=67108864 cluster_size=65536 l
+     case IS_CSI:
- {"return": {}}
+         switch (ch) {
- {"return": {}}
+-    case 'A':
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false}}
+-    case 'F':
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_CANCELLED", "data": {"device": "disk", "len": 67108864, "offset": 131072, "speed": 65536, "type": "backup"}}
+-        readline_up_char(rs);
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_CANCELLED", "data": {"device": "disk", "len": 67108864, "offset": 65536, "speed": 65536, "type": "backup"}}
+-        break;
+-    case 'B':
- === Start streaming job and exit qemu ===
+-    case 'E':
+-        readline_down_char(rs);
-@@ -XXX,XX +XXX,XX @@ Formatting 'TEST_DIR/t.qcow2.copy', fmt=qcow2 size=67108864 cluster_size=65536 l
+-        break;
- {"return": {}}
++        case 'A':
- {"return": {}}
++        case 'F':
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false}}
++            readline_up_char(rs);
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_CANCELLED", "data": {"device": "disk", "len": 67108864, "offset": 1048576, "speed": 65536, "type": "stream"}}
++            break;
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_CANCELLED", "data": {"device": "disk", "len": 67108864, "offset": 524288, "speed": 65536, "type": "stream"}}
++        case 'B':
- No errors were found on the image.
++        case 'E':
- *** done
++            readline_down_char(rs);
 +            break;
          case 'D':
              readline_backward_char(rs);
              break;
 --
-.13.6
+.21.0

-[Qemu-devel] [PULL 4/4] nfs: Remove processed options from QDict
+[Qemu-devel] [PULL 3/8] util/readline: Add braces to fix checkpatch errors
-From: Kevin Wolf <kwolf@redhat.com>
+From: Jules Irenge <jbi.octave@gmail.com>
-Commit c22a03454 QAPIfied option parsing in the NFS block driver, but
+Add braces to fix errors issued by checkpatch.pl tool
-forgot to remove all the options we processed. Therefore, we get an
+"ERROR: braces {} are necessary for all arms of this statement"
-error in bdrv_open_inherit(), which thinks the remaining options are
+Within "util/readline.c" file
-invalid. Trying to open an NFS image will result in an error like this:
+Message-Id: <20190330112142.14082-1-jbi.octave@gmail.com>
-    Block protocol 'nfs' doesn't support the option 'server.host'
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
  util/readline.c | 50 ++++++++++++++++++++++++++++++++-----------------
 file changed, 33 insertions(+), 17 deletions(-)
-Remove all options from the QDict to make the NFS driver work again.
+diff --git a/util/readline.c b/util/readline.c
 Cc: qemu-stable@nongnu.org
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 Message-id: 20180516160816.26259-1-kwolf@redhat.com
 Reviewed-by: Eric Blake <eblake@redhat.com>
 Reviewed-by: Jeff Cody <jcody@redhat.com>
 Signed-off-by: Jeff Cody <jcody@redhat.com>
 ---
  block/nfs.c | 7 +++++++
 file changed, 7 insertions(+)
 diff --git a/block/nfs.c b/block/nfs.c
 index XXXXXXX..XXXXXXX 100644
---- a/block/nfs.c
+--- a/util/readline.c
-+++ b/block/nfs.c
++++ b/util/readline.c
-@@ -XXX,XX +XXX,XX @@ static BlockdevOptionsNfs *nfs_options_qdict_to_qapi(QDict *options,
+@@ -XXX,XX +XXX,XX @@ static void readline_update(ReadLineState *rs)
-     BlockdevOptionsNfs *opts = NULL;
+         rs->cmd_buf[rs->cmd_buf_size] = '\0';
-     QObject *crumpled = NULL;
+         if (rs->read_password) {
-     Visitor *v;
+             len = strlen(rs->cmd_buf);
-+    const QDictEntry *e;
+-            for (i = 0; i < len; i++)
-     Error *local_err = NULL;
++            for (i = 0; i < len; i++) {
+                 rs->printf_func(rs->opaque, "*");
-     crumpled = qdict_crumple(options, errp);
++            }
-@@ -XXX,XX +XXX,XX @@ static BlockdevOptionsNfs *nfs_options_qdict_to_qapi(QDict *options,
+         } else {
              rs->printf_func(rs->opaque, "%s", rs->cmd_buf);
          }
@@ -XXX,XX +XXX,XX @@ static void readline_up_char(ReadLineState *rs)
  {
      int idx;
 -    if (rs->hist_entry == 0)
 +    if (rs->hist_entry == 0) {
          return;
 +    }
      if (rs->hist_entry == -1) {
          /* Find latest entry */
          for (idx = 0; idx < READLINE_MAX_CMDS; idx++) {
 -            if (rs->history[idx] == NULL)
 +            if (rs->history[idx] == NULL) {
                  break;
 +            }
          }
          rs->hist_entry = idx;
      }
@@ -XXX,XX +XXX,XX @@ static void readline_up_char(ReadLineState *rs)
  static void readline_down_char(ReadLineState *rs)
  {
 -    if (rs->hist_entry == -1)
 +    if (rs->hist_entry == -1) {
          return;
 +    }
      if (rs->hist_entry < READLINE_MAX_CMDS - 1 &&
          rs->history[++rs->hist_entry] != NULL) {
          pstrcpy(rs->cmd_buf, sizeof(rs->cmd_buf),
@@ -XXX,XX +XXX,XX @@ static void readline_hist_add(ReadLineState *rs, const char *cmdline)
      char *hist_entry, *new_entry;
      int idx;
 -    if (cmdline[0] == '\0')
 +    if (cmdline[0] == '\0') {
          return;
 +    }
      new_entry = NULL;
      if (rs->hist_entry != -1) {
          /* We were editing an existing history entry: replace it */
@@ -XXX,XX +XXX,XX @@ static void readline_hist_add(ReadLineState *rs, const char *cmdline)
      /* Search cmdline in history buffers */
      for (idx = 0; idx < READLINE_MAX_CMDS; idx++) {
          hist_entry = rs->history[idx];
 -        if (hist_entry == NULL)
 +        if (hist_entry == NULL) {
              break;
 +        }
          if (strcmp(hist_entry, cmdline) == 0) {
          same_entry:
              new_entry = hist_entry;
@@ -XXX,XX +XXX,XX @@ static void readline_hist_add(ReadLineState *rs, const char *cmdline)
                      (READLINE_MAX_CMDS - (idx + 1)) * sizeof(char *));
              rs->history[READLINE_MAX_CMDS - 1] = NULL;
              for (; idx < READLINE_MAX_CMDS; idx++) {
 -                if (rs->history[idx] == NULL)
 +                if (rs->history[idx] == NULL) {
                      break;
 +                }
              }
              break;
          }
@@ -XXX,XX +XXX,XX @@ static void readline_hist_add(ReadLineState *rs, const char *cmdline)
          rs->history[READLINE_MAX_CMDS - 1] = NULL;
          idx = READLINE_MAX_CMDS - 1;
      }
 -    if (new_entry == NULL)
 +    if (new_entry == NULL) {
          new_entry = g_strdup(cmdline);
 +    }
      rs->history[idx] = new_entry;
      rs->hist_entry = -1;
  }
@@ -XXX,XX +XXX,XX @@ static void readline_completion(ReadLineState *rs)
      g_free(cmdline);
      /* no completion found */
 -    if (rs->nb_completions <= 0)
 +    if (rs->nb_completions <= 0) {
          return;
 +    }
      if (rs->nb_completions == 1) {
          len = strlen(rs->completions[0]);
          for (i = rs->completion_index; i < len; i++) {
              readline_insert_char(rs, rs->completions[0][i]);
          }
          /* extra space for next argument. XXX: make it more generic */
 -        if (len > 0 && rs->completions[0][len - 1] != '/')
 +        if (len > 0 && rs->completions[0][len - 1] != '/') {
              readline_insert_char(rs, ' ');
 +        }
      } else {
          qsort(rs->completions, rs->nb_completions, sizeof(char *),
                completion_comp);
@@ -XXX,XX +XXX,XX @@ static void readline_completion(ReadLineState *rs)
              if (i == 0) {
                  max_prefix = len;
              } else {
 -                if (len < max_prefix)
 +                if (len < max_prefix) {
                      max_prefix = len;
 +                }
                  for (j = 0; j < max_prefix; j++) {
 -                    if (rs->completions[i][j] != rs->completions[0][j])
 +                    if (rs->completions[i][j] != rs->completions[0][j]) {
                          max_prefix = j;
 +                    }
                  }
              }
 -            if (len > max_width)
 +            if (len > max_width) {
                  max_width = len;
 +            }
          }
          if (max_prefix > 0)
              for (i = rs->completion_index; i < max_prefix; i++) {
                  readline_insert_char(rs, rs->completions[0][i]);
              }
          max_width += 2;
 -        if (max_width < 10)
 +        if (max_width < 10) {
              max_width = 10;
 -        else if (max_width > 80)
 +        } else if (max_width > 80) {
              max_width = 80;
 +        }
          nb_cols = 80 / max_width;
          j = 0;
          for (i = 0; i < rs->nb_completions; i++) {
@@ -XXX,XX +XXX,XX @@ void readline_handle_byte(ReadLineState *rs, int ch)
          case 10:
          case 13:
              rs->cmd_buf[rs->cmd_buf_size] = '\0';
 -            if (!rs->read_password)
 +            if (!rs->read_password) {
                  readline_hist_add(rs, rs->cmd_buf);
 +            }
              rs->printf_func(rs->opaque, "\n");
              rs->cmd_buf_index = 0;
              rs->cmd_buf_size = 0;
@@ -XXX,XX +XXX,XX @@ void readline_restart(ReadLineState *rs)
  const char *readline_get_history(ReadLineState *rs, unsigned int index)
  {
 -    if (index >= READLINE_MAX_CMDS)
 +    if (index >= READLINE_MAX_CMDS) {
          return NULL;
-     }
-+    /* Remove the processed options from the QDict (the visitor processes
-+     * _all_ options in the QDict) */
-+    while ((e = qdict_first(options))) {
-+        qdict_del(options, e->key);
 +    }
-+
+     return rs->history[index];
      return opts;
  }
 --
-.13.6
+.21.0

-New patch
+[Qemu-devel] [PULL 4/8] block: Add coroutine_fn to bdrv_check_co_entry
+From: Nikita Alekseev <n.alekseev2104@gmail.com>
+bdrv_check_co_entry calls bdrv_co_check, which is a coroutine function.
+Thus, it also needs to be marked as a coroutine.
+Signed-off-by: Nikita Alekseev <n.alekseev2104@gmail.com>
+Message-id: 20190401093051.16488-1-n.alekseev2104@gmail.com
+Message-Id: <20190401093051.16488-1-n.alekseev2104@gmail.com>
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ block.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/block.c b/block.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block.c
++++ b/block.c
+@@ -XXX,XX +XXX,XX @@ typedef struct CheckCo {
+     int ret;
+ } CheckCo;
+-static void bdrv_check_co_entry(void *opaque)
++static void coroutine_fn bdrv_check_co_entry(void *opaque)
+ {
+     CheckCo *cco = opaque;
+     cco->ret = bdrv_co_check(cco->bs, cco->res, cco->fix);
+--
+.21.0

-[Qemu-devel] [PULL 3/4] nfs: Fix error path in nfs_options_qdict_to_qapi()
+[Qemu-devel] [PULL 5/8] block/io.c: fix for the allocation failure
-From: Kevin Wolf <kwolf@redhat.com>
+From: Andrey Shinkevich <andrey.shinkevich@virtuozzo.com>
-Don't throw away local_err, but propagate it to errp.
+On a file system used by the customer, fallocate() returns an error
 if the block is not properly aligned. So, bdrv_co_pwrite_zeroes()
 fails. We can handle that case the same way as it is done for the
 unsupported cases, namely, call to bdrv_driver_pwritev() that writes
 zeroes to an image for the unaligned chunk of the block.
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+Suggested-by: Denis V. Lunev <den@openvz.org>
-Message-id: 20180516161034.27440-1-kwolf@redhat.com
+Signed-off-by: Andrey Shinkevich <andrey.shinkevich@virtuozzo.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
+Reviewed-by: John Snow <jsnow@redhat.com>
-Reviewed-by: Jeff Cody <jcody@redhat.com>
+Message-id: 1554474244-553661-1-git-send-email-andrey.shinkevich@virtuozzo.com
-Signed-off-by: Jeff Cody <jcody@redhat.com>
+Message-Id: <1554474244-553661-1-git-send-email-andrey.shinkevich@virtuozzo.com>
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
- block/nfs.c | 1 +
+ block/io.c | 2 +-
-file changed, 1 insertion(+)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/block/nfs.c b/block/nfs.c
+diff --git a/block/io.c b/block/io.c
 index XXXXXXX..XXXXXXX 100644
---- a/block/nfs.c
+--- a/block/io.c
-+++ b/block/nfs.c
++++ b/block/io.c
-@@ -XXX,XX +XXX,XX @@ static BlockdevOptionsNfs *nfs_options_qdict_to_qapi(QDict *options,
+@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_co_do_pwrite_zeroes(BlockDriverState *bs,
-     qobject_unref(crumpled);
+             assert(!bs->supported_zero_flags);
+         }
-     if (local_err) {
-+        error_propagate(errp, local_err);
+-        if (ret == -ENOTSUP && !(flags & BDRV_REQ_NO_FALLBACK)) {
-         return NULL;
++        if (ret < 0 && !(flags & BDRV_REQ_NO_FALLBACK)) {
-     }
+             /* Fall back to bounce buffer if write zeroes is unsupported */
              BdrvRequestFlags write_flags = flags & ~BDRV_REQ_ZERO_WRITE;
 --
-.13.6
+.21.0

-New patch
+[Qemu-devel] [PULL 6/8] aio-posix: ensure poll mode is left when aio_notify is called
+From: Paolo Bonzini <pbonzini@redhat.com>
+With aio=thread, adaptive polling makes latency worse rather than
+better, because it delays the execution of the ThreadPool's
+completion bottom half.
+event_notifier_poll() does run while polling, detecting that
+a bottom half was scheduled by a worker thread, but because
+ctx->notifier is explicitly ignored in run_poll_handlers_once(),
+scheduling the BH does not count as making progress and
+run_poll_handlers() keeps running.  Fix this by recomputing
+the deadline after *timeout could have changed.
+With this change, ThreadPool still cannot participate in polling
+but at least it does not suffer from extra latency.
+Reported-by: Sergio Lopez <slp@redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Message-id: 20190409122823.12416-1-pbonzini@redhat.com
+Cc: Stefan Hajnoczi <stefanha@gmail.com>
+Cc: Kevin Wolf <kwolf@redhat.com>
+Cc: qemu-block@nongnu.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Message-Id: <1553692145-86728-1-git-send-email-pbonzini@redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Message-Id: <20190409122823.12416-1-pbonzini@redhat.com>
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ util/aio-posix.c | 12 ++++++++----
+file changed, 8 insertions(+), 4 deletions(-)
+diff --git a/util/aio-posix.c b/util/aio-posix.c
+index XXXXXXX..XXXXXXX 100644
+--- a/util/aio-posix.c
++++ b/util/aio-posix.c
+@@ -XXX,XX +XXX,XX @@ static bool run_poll_handlers_once(AioContext *ctx, int64_t *timeout)
+         if (!node->deleted && node->io_poll &&
+             aio_node_check(ctx, node->is_external) &&
+             node->io_poll(node->opaque)) {
++            /*
++             * Polling was successful, exit try_poll_mode immediately
++             * to adjust the next polling time.
++             */
+             *timeout = 0;
+             if (node->opaque != &ctx->notifier) {
+                 progress = true;
+@@ -XXX,XX +XXX,XX @@ static bool run_poll_handlers(AioContext *ctx, int64_t max_ns, int64_t *timeout)
+     do {
+         progress = run_poll_handlers_once(ctx, timeout);
+         elapsed_time = qemu_clock_get_ns(QEMU_CLOCK_REALTIME) - start_time;
+-    } while (!progress && elapsed_time < max_ns
+-             && !atomic_read(&ctx->poll_disable_cnt));
++        max_ns = qemu_soonest_timeout(*timeout, max_ns);
++        assert(!(max_ns && progress));
++    } while (elapsed_time < max_ns && !atomic_read(&ctx->poll_disable_cnt));
+     /* If time has passed with no successful polling, adjust *timeout to
+      * keep the same ending time.
+@@ -XXX,XX +XXX,XX @@ static bool run_poll_handlers(AioContext *ctx, int64_t max_ns, int64_t *timeout)
+  */
+ static bool try_poll_mode(AioContext *ctx, int64_t *timeout)
+ {
+-    /* See qemu_soonest_timeout() uint64_t hack */
+-    int64_t max_ns = MIN((uint64_t)*timeout, (uint64_t)ctx->poll_ns);
++    int64_t max_ns = qemu_soonest_timeout(*timeout, ctx->poll_ns);
+     if (max_ns && !atomic_read(&ctx->poll_disable_cnt)) {
+         poll_set_started(ctx, true);
+--
+.21.0

-New patch
+[Qemu-devel] [PULL 7/8] docs: add Secure Coding Practices to developer docs
+At KVM Forum 2018 I gave a presentation on security in QEMU:
+https://www.youtube.com/watch?v=YAdRf_hwxU8 (video)
+https://vmsplice.net/~stefan/stefanha-kvm-forum-2018.pdf (slides)
+This patch adds a guide to secure coding practices.  This document
+covers things that developers should know about security in QEMU.  It is
+just a starting point that we can expand on later.  I hope it will be
+useful as a resource for new contributors and will save code reviewers
+from explaining the same concepts many times.
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Acked-by: Stefano Garzarella <sgarzare@redhat.com>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
+Reviewed-by: Li Qiang <liq3ea@gmail.com>
+Message-id: 20190509121820.16294-2-stefanha@redhat.com
+Message-Id: <20190509121820.16294-2-stefanha@redhat.com>
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ docs/devel/index.rst                   |   1 +
+ docs/devel/secure-coding-practices.rst | 106 +++++++++++++++++++++++++
+files changed, 107 insertions(+)
+ create mode 100644 docs/devel/secure-coding-practices.rst
+diff --git a/docs/devel/index.rst b/docs/devel/index.rst
+index XXXXXXX..XXXXXXX 100644
+--- a/docs/devel/index.rst
++++ b/docs/devel/index.rst
+@@ -XXX,XX +XXX,XX @@ Contents:
+    stable-process
+    testing
+    decodetree
++   secure-coding-practices
+diff --git a/docs/devel/secure-coding-practices.rst b/docs/devel/secure-coding-practices.rst
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/docs/devel/secure-coding-practices.rst
+@@ -XXX,XX +XXX,XX @@
++=======================
++Secure Coding Practices
++=======================
++This document covers topics that both developers and security researchers must
++be aware of so that they can develop safe code and audit existing code
++properly.
++
++Reporting Security Bugs
++-----------------------
++For details on how to report security bugs or ask questions about potential
++security bugs, see the `Security Process wiki page
++<https://wiki.qemu.org/SecurityProcess>`_.
++
++General Secure C Coding Practices
++---------------------------------
++Most CVEs (security bugs) reported against QEMU are not specific to
++virtualization or emulation.  They are simply C programming bugs.  Therefore
++it's critical to be aware of common classes of security bugs.
++
++There is a wide selection of resources available covering secure C coding.  For
++example, the `CERT C Coding Standard
++<https://wiki.sei.cmu.edu/confluence/display/c/SEI+CERT+C+Coding+Standard>`_
++covers the most important classes of security bugs.
++
++Instead of describing them in detail here, only the names of the most important
++classes of security bugs are mentioned:
++
++* Buffer overflows
++* Use-after-free and double-free
++* Integer overflows
++* Format string vulnerabilities
++
++Some of these classes of bugs can be detected by analyzers.  Static analysis is
++performed regularly by Coverity and the most obvious of these bugs are even
++reported by compilers.  Dynamic analysis is possible with valgrind, tsan, and
++asan.
++
++Input Validation
++----------------
++Inputs from the guest or external sources (e.g. network, files) cannot be
++trusted and may be invalid.  Inputs must be checked before using them in a way
++that could crash the program, expose host memory to the guest, or otherwise be
++exploitable by an attacker.
++
++The most sensitive attack surface is device emulation.  All hardware register
++accesses and data read from guest memory must be validated.  A typical example
++is a device that contains multiple units that are selectable by the guest via
++an index register::
++
++  typedef struct {
++      ProcessingUnit unit[2];
++      ...
++  } MyDeviceState;
++
++  static void mydev_writel(void *opaque, uint32_t addr, uint32_t val)
++  {
++      MyDeviceState *mydev = opaque;
++      ProcessingUnit *unit;
++
++      switch (addr) {
++      case MYDEV_SELECT_UNIT:
++          unit = &mydev->unit[val];   <-- this input wasn't validated!
++          ...
++      }
++  }
++
++If ``val`` is not in range [0, 1] then an out-of-bounds memory access will take
++place when ``unit`` is dereferenced.  The code must check that ``val`` is 0 or
++1 and handle the case where it is invalid.
++
++Unexpected Device Accesses
++--------------------------
++The guest may access device registers in unusual orders or at unexpected
++moments.  Device emulation code must not assume that the guest follows the
++typical "theory of operation" presented in driver writer manuals.  The guest
++may make nonsense accesses to device registers such as starting operations
++before the device has been fully initialized.
++
++A related issue is that device emulation code must be prepared for unexpected
++device register accesses while asynchronous operations are in progress.  A
++well-behaved guest might wait for a completion interrupt before accessing
++certain device registers.  Device emulation code must handle the case where the
++guest overwrites registers or submits further requests before an ongoing
++request completes.  Unexpected accesses must not cause memory corruption or
++leaks in QEMU.
++
++Invalid device register accesses can be reported with
++``qemu_log_mask(LOG_GUEST_ERROR, ...)``.  The ``-d guest_errors`` command-line
++option enables these log messages.
++
++Live Migration
++--------------
++Device state can be saved to disk image files and shared with other users.
++Live migration code must validate inputs when loading device state so an
++attacker cannot gain control by crafting invalid device states.  Device state
++is therefore considered untrusted even though it is typically generated by QEMU
++itself.
++
++Guest Memory Access Races
++-------------------------
++Guests with multiple vCPUs may modify guest RAM while device emulation code is
++running.  Device emulation code must copy in descriptors and other guest RAM
++structures and only process the local copy.  This prevents
++time-of-check-to-time-of-use (TOCTOU) race conditions that could cause QEMU to
++crash when a vCPU thread modifies guest RAM while device emulation is
++processing it.
+--
+.21.0

-[Qemu-devel] [PULL 1/4] qemu-iotests: reduce chance of races in 185
+[Qemu-devel] [PULL 8/8] docs: add Security chapter to the documentation
-From: Stefan Hajnoczi <stefanha@redhat.com>
+This new chapter in the QEMU documentation covers the security
 requirements that QEMU is designed to meet and principles for securely
 deploying QEMU.
-Commit 8565c3ab537e78f3e69977ec2c609dc9417a806e ("qemu-iotests: fix
+It is just a starting point that can be extended in the future with more
-") identified a race condition in a sub-test.
+information.
-Similar issues also affect the other sub-tests.  If disk I/O completes
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-quickly, it races with the QMP 'quit' command.  This causes spurious
+Acked-by: Stefano Garzarella <sgarzare@redhat.com>
-test failures because QMP events are emitted in an unpredictable order.
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 Reviewed-by: Li Qiang <liq3ea@gmail.com>
 Message-id: 20190509121820.16294-3-stefanha@redhat.com
 Message-Id: <20190509121820.16294-3-stefanha@redhat.com>
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
  Makefile           |   2 +-
  docs/security.texi | 131 +++++++++++++++++++++++++++++++++++++++++++++
  qemu-doc.texi      |   3 ++
 files changed, 135 insertions(+), 1 deletion(-)
  create mode 100644 docs/security.texi
-This test relies on QEMU internals and there is no QMP API for getting
+diff --git a/Makefile b/Makefile
-deterministic behavior needed to make this test 100% reliable.  At the
+index XXXXXXX..XXXXXXX 100644
-same time, the test is useful and it would be a shame to remove it.
+--- a/Makefile
++++ b/Makefile
-Add sleep 0.5 to reduce the chance of races.  This is not a real fix but
+@@ -XXX,XX +XXX,XX @@ qemu-doc.html qemu-doc.info qemu-doc.pdf qemu-doc.txt: \
-appears to reduce spurious failures in practice.
+     qemu-img.texi qemu-nbd.texi qemu-options.texi qemu-option-trace.texi \
+     qemu-deprecated.texi qemu-monitor.texi qemu-img-cmds.texi qemu-ga.texi \
-Cc: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+     qemu-monitor-info.texi docs/qemu-block-drivers.texi \
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+-    docs/qemu-cpu-models.texi
-Reviewed-by: Eric Blake <eblake@redhat.com>
++    docs/qemu-cpu-models.texi docs/security.texi
-Message-id: 20180508135436.30140-2-stefanha@redhat.com
-Reviewed-by: Jeff Cody <jcody@redhat.com>
+ docs/interop/qemu-ga-ref.dvi docs/interop/qemu-ga-ref.html \
-Signed-off-by: Jeff Cody <jcody@redhat.com>
+     docs/interop/qemu-ga-ref.info docs/interop/qemu-ga-ref.pdf \
----
+diff --git a/docs/security.texi b/docs/security.texi
- tests/qemu-iotests/185 | 12 ++++++++++++
+new file mode 100644
-file changed, 12 insertions(+)
+index XXXXXXX..XXXXXXX
+--- /dev/null
-diff --git a/tests/qemu-iotests/185 b/tests/qemu-iotests/185
++++ b/docs/security.texi
-index XXXXXXX..XXXXXXX 100755
+@@ -XXX,XX +XXX,XX @@
---- a/tests/qemu-iotests/185
++@node Security
-+++ b/tests/qemu-iotests/185
++@chapter Security
@@ -XXX,XX +XXX,XX @@ _send_qemu_cmd $h \
                        'speed': 65536 } }" \
      "return"
 +# If we don't sleep here 'quit' command races with disk I/O
 +sleep 0.5
 +
- _send_qemu_cmd $h "{ 'execute': 'quit' }" "return"
++@section Overview
  wait=1 _cleanup_qemu
@@ -XXX,XX +XXX,XX @@ _send_qemu_cmd $h \
                        'speed': 65536 } }" \
      "return"
 +# If we don't sleep here 'quit' command races with disk I/O
 +sleep 0.5
 +
- _send_qemu_cmd $h "{ 'execute': 'quit' }" "return"
++This chapter explains the security requirements that QEMU is designed to meet
- wait=1 _cleanup_qemu
++and principles for securely deploying QEMU.
@@ -XXX,XX +XXX,XX @@ _send_qemu_cmd $h \
                        'speed': 65536 } }" \
      "return"
 +# If we don't sleep here 'quit' command races with disk I/O
 +sleep 0.5
 +
- _send_qemu_cmd $h "{ 'execute': 'quit' }" "return"
++@section Security Requirements
  wait=1 _cleanup_qemu
@@ -XXX,XX +XXX,XX @@ _send_qemu_cmd $h \
                        'speed': 65536 } }" \
      "return"
 +# If we don't sleep here 'quit' command races with disk I/O
 +sleep 0.5
 +
- _send_qemu_cmd $h "{ 'execute': 'quit' }" "return"
++QEMU supports many different use cases, some of which have stricter security
- wait=1 _cleanup_qemu
++requirements than others.  The community has agreed on the overall security
++requirements that users may depend on.  These requirements define what is
 +considered supported from a security perspective.
 +
 +@subsection Virtualization Use Case
 +
 +The virtualization use case covers cloud and virtual private server (VPS)
 +hosting, as well as traditional data center and desktop virtualization.  These
 +use cases rely on hardware virtualization extensions to execute guest code
 +safely on the physical CPU at close-to-native speed.
 +
 +The following entities are untrusted, meaning that they may be buggy or
 +malicious:
 +
 +@itemize
 +@item Guest
 +@item User-facing interfaces (e.g. VNC, SPICE, WebSocket)
 +@item Network protocols (e.g. NBD, live migration)
 +@item User-supplied files (e.g. disk images, kernels, device trees)
 +@item Passthrough devices (e.g. PCI, USB)
 +@end itemize
 +
 +Bugs affecting these entities are evaluated on whether they can cause damage in
 +real-world use cases and treated as security bugs if this is the case.
 +
 +@subsection Non-virtualization Use Case
 +
 +The non-virtualization use case covers emulation using the Tiny Code Generator
 +(TCG).  In principle the TCG and device emulation code used in conjunction with
 +the non-virtualization use case should meet the same security requirements as
 +the virtualization use case.  However, for historical reasons much of the
 +non-virtualization use case code was not written with these security
 +requirements in mind.
 +
 +Bugs affecting the non-virtualization use case are not considered security
 +bugs at this time.  Users with non-virtualization use cases must not rely on
 +QEMU to provide guest isolation or any security guarantees.
 +
 +@section Architecture
 +
 +This section describes the design principles that ensure the security
 +requirements are met.
 +
 +@subsection Guest Isolation
 +
 +Guest isolation is the confinement of guest code to the virtual machine.  When
 +guest code gains control of execution on the host this is called escaping the
 +virtual machine.  Isolation also includes resource limits such as throttling of
 +CPU, memory, disk, or network.  Guests must be unable to exceed their resource
 +limits.
 +
 +QEMU presents an attack surface to the guest in the form of emulated devices.
 +The guest must not be able to gain control of QEMU.  Bugs in emulated devices
 +could allow malicious guests to gain code execution in QEMU.  At this point the
 +guest has escaped the virtual machine and is able to act in the context of the
 +QEMU process on the host.
 +
 +Guests often interact with other guests and share resources with them.  A
 +malicious guest must not gain control of other guests or access their data.
 +Disk image files and network traffic must be protected from other guests unless
 +explicitly shared between them by the user.
 +
 +@subsection Principle of Least Privilege
 +
 +The principle of least privilege states that each component only has access to
 +the privileges necessary for its function.  In the case of QEMU this means that
 +each process only has access to resources belonging to the guest.
 +
 +The QEMU process should not have access to any resources that are inaccessible
 +to the guest.  This way the guest does not gain anything by escaping into the
 +QEMU process since it already has access to those same resources from within
 +the guest.
 +
 +Following the principle of least privilege immediately fulfills guest isolation
 +requirements.  For example, guest A only has access to its own disk image file
 +@code{a.img} and not guest B's disk image file @code{b.img}.
 +
 +In reality certain resources are inaccessible to the guest but must be
 +available to QEMU to perform its function.  For example, host system calls are
 +necessary for QEMU but are not exposed to guests.  A guest that escapes into
 +the QEMU process can then begin invoking host system calls.
 +
 +New features must be designed to follow the principle of least privilege.
 +Should this not be possible for technical reasons, the security risk must be
 +clearly documented so users are aware of the trade-off of enabling the feature.
 +
 +@subsection Isolation mechanisms
 +
 +Several isolation mechanisms are available to realize this architecture of
 +guest isolation and the principle of least privilege.  With the exception of
 +Linux seccomp, these mechanisms are all deployed by management tools that
 +launch QEMU, such as libvirt.  They are also platform-specific so they are only
 +described briefly for Linux here.
 +
 +The fundamental isolation mechanism is that QEMU processes must run as
 +unprivileged users.  Sometimes it seems more convenient to launch QEMU as
 +root to give it access to host devices (e.g. @code{/dev/net/tun}) but this poses a
 +huge security risk.  File descriptor passing can be used to give an otherwise
 +unprivileged QEMU process access to host devices without running QEMU as root.
 +It is also possible to launch QEMU as a non-root user and configure UNIX groups
 +for access to @code{/dev/kvm}, @code{/dev/net/tun}, and other device nodes.
 +Some Linux distros already ship with UNIX groups for these devices by default.
 +
 +@itemize
 +@item SELinux and AppArmor make it possible to confine processes beyond the
 +traditional UNIX process and file permissions model.  They restrict the QEMU
 +process from accessing processes and files on the host system that are not
 +needed by QEMU.
 +
 +@item Resource limits and cgroup controllers provide throughput and utilization
 +limits on key resources such as CPU time, memory, and I/O bandwidth.
 +
 +@item Linux namespaces can be used to make process, file system, and other system
 +resources unavailable to QEMU.  A namespaced QEMU process is restricted to only
 +those resources that were granted to it.
 +
 +@item Linux seccomp is available via the QEMU @option{--sandbox} option.  It disables
 +system calls that are not needed by QEMU, thereby reducing the host kernel
 +attack surface.
 +@end itemize
 diff --git a/qemu-doc.texi b/qemu-doc.texi
 index XXXXXXX..XXXXXXX 100644
 --- a/qemu-doc.texi
 +++ b/qemu-doc.texi
@@ -XXX,XX +XXX,XX @@
  * QEMU Guest Agent::
  * QEMU User space emulator::
  * System requirements::
 +* Security::
  * Implementation notes::
  * Deprecated features::
  * Supported build platforms::
@@ -XXX,XX +XXX,XX @@ added with Linux 4.5 which is supported by the major distros. And even
  if RHEL7 has kernel 3.10, KVM there has the required functionality there
  to make it close to a 4.5 or newer kernel.
 +@include docs/security.texi
 +
  @include qemu-tech.texi
  @include qemu-deprecated.texi
 --
-.13.6
+.21.0

The following changes since commit c416eecea5f3aea863ab8fda5a36a24157b8f704:

Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging (2018-05-15 17:02:00 +0100)

are available in the git repository at:

git://github.com/codyprime/qemu-kvm-jtc.git tags/block-pull-request

for you to fetch changes up to c82be42cc803b36fd7aed5dceec68312c7056fd5:

nfs: Remove processed options from QDict (2018-05-16 13:37:47 -0400)

----------------------------------------------------------------
Block patches
----------------------------------------------------------------

Kevin Wolf (2):
  nfs: Fix error path in nfs_options_qdict_to_qapi()
  nfs: Remove processed options from QDict

Stefan Hajnoczi (2):
  qemu-iotests: reduce chance of races in 185
  blockjob: do not cancel timer in resume

block/nfs.c                |  8 ++++++++
 blockjob.c                 | 22 +++++++++++++++-------
 tests/qemu-iotests/185     | 17 +++++++++++++----
 tests/qemu-iotests/185.out | 12 +++++-------
 4 files changed, 41 insertions(+), 18 deletions(-)

-- 
2.13.6

From: Stefan Hajnoczi <stefanha@redhat.com>

Commit 8565c3ab537e78f3e69977ec2c609dc9417a806e ("qemu-iotests: fix
185") identified a race condition in a sub-test.

Similar issues also affect the other sub-tests.  If disk I/O completes
quickly, it races with the QMP 'quit' command.  This causes spurious
test failures because QMP events are emitted in an unpredictable order.

This test relies on QEMU internals and there is no QMP API for getting
deterministic behavior needed to make this test 100% reliable.  At the
same time, the test is useful and it would be a shame to remove it.

Add sleep 0.5 to reduce the chance of races.  This is not a real fix but
appears to reduce spurious failures in practice.

Cc: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id: 20180508135436.30140-2-stefanha@redhat.com
Reviewed-by: Jeff Cody <jcody@redhat.com>
Signed-off-by: Jeff Cody <jcody@redhat.com>
---
 tests/qemu-iotests/185 | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/tests/qemu-iotests/185 b/tests/qemu-iotests/185
index XXXXXXX..XXXXXXX 100755
--- a/tests/qemu-iotests/185
+++ b/tests/qemu-iotests/185
@@ -XXX,XX +XXX,XX @@ _send_qemu_cmd $h \
                       'speed': 65536 } }" \
     "return"
 
+# If we don't sleep here 'quit' command races with disk I/O
+sleep 0.5
+
 _send_qemu_cmd $h "{ 'execute': 'quit' }" "return"
 wait=1 _cleanup_qemu
 
@@ -XXX,XX +XXX,XX @@ _send_qemu_cmd $h \
                       'speed': 65536 } }" \
     "return"
 
+# If we don't sleep here 'quit' command races with disk I/O
+sleep 0.5
+
 _send_qemu_cmd $h "{ 'execute': 'quit' }" "return"
 wait=1 _cleanup_qemu
 
@@ -XXX,XX +XXX,XX @@ _send_qemu_cmd $h \
                       'speed': 65536 } }" \
     "return"
 
+# If we don't sleep here 'quit' command races with disk I/O
+sleep 0.5
+
 _send_qemu_cmd $h "{ 'execute': 'quit' }" "return"
 wait=1 _cleanup_qemu
 
@@ -XXX,XX +XXX,XX @@ _send_qemu_cmd $h \
                       'speed': 65536 } }" \
     "return"
 
+# If we don't sleep here 'quit' command races with disk I/O
+sleep 0.5
+
 _send_qemu_cmd $h "{ 'execute': 'quit' }" "return"
 wait=1 _cleanup_qemu
 
-- 
2.13.6

From: Stefan Hajnoczi <stefanha@redhat.com>

Currently the timer is cancelled and the block job is entered by
block_job_resume().  This behavior causes drain to run extra blockjob
iterations when the job was sleeping due to the ratelimit.

This patch leaves the job asleep when block_job_resume() is called.
Jobs can still be forcibly woken up using block_job_enter(), which is
used to cancel jobs.

After this patch drain no longer runs extra blockjob iterations.  This
is the expected behavior that qemu-iotests 185 used to rely on.  We
temporarily changed the 185 test output to make it pass for the QEMU
2.12 release but now it's time to address this issue.

Cc: QingFeng Hao <haoqf@linux.vnet.ibm.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: QingFeng Hao <haoqf@linux.vnet.ibm.com>
Message-id: 20180508135436.30140-3-stefanha@redhat.com
Reviewed-by: Jeff Cody <jcody@redhat.com>
Signed-off-by: Jeff Cody <jcody@redhat.com>
---
 blockjob.c                 | 22 +++++++++++++++-------
 tests/qemu-iotests/185     |  5 +----
 tests/qemu-iotests/185.out | 12 +++++-------
 3 files changed, 21 insertions(+), 18 deletions(-)

diff --git a/blockjob.c b/blockjob.c
index XXXXXXX..XXXXXXX 100644
--- a/blockjob.c
+++ b/blockjob.c
@@ -XXX,XX +XXX,XX @@ static void block_job_txn_del_job(BlockJob *job)
     }
 }
 
+/* Assumes the block_job_mutex is held */
+static bool block_job_timer_pending(BlockJob *job)
+{
+    return timer_pending(&job->sleep_timer);
+}
+
+/* Assumes the block_job_mutex is held */
+static bool block_job_timer_not_pending(BlockJob *job)
+{
+    return !block_job_timer_pending(job);
+}
+
 static void block_job_pause(BlockJob *job)
 {
     job->pause_count++;
@@ -XXX,XX +XXX,XX @@ static void block_job_resume(BlockJob *job)
     if (job->pause_count) {
         return;
     }
-    block_job_enter(job);
+
+    /* kick only if no timer is pending */
+    block_job_enter_cond(job, block_job_timer_not_pending);
 }
 
 void block_job_ref(BlockJob *job)
@@ -XXX,XX +XXX,XX @@ static void block_job_completed_txn_success(BlockJob *job)
     }
 }
 
-/* Assumes the block_job_mutex is held */
-static bool block_job_timer_pending(BlockJob *job)
-{
-    return timer_pending(&job->sleep_timer);
-}
-
 void block_job_set_speed(BlockJob *job, int64_t speed, Error **errp)
 {
     int64_t old_speed = job->speed;
diff --git a/tests/qemu-iotests/185 b/tests/qemu-iotests/185
index XXXXXXX..XXXXXXX 100755
--- a/tests/qemu-iotests/185
+++ b/tests/qemu-iotests/185
@@ -XXX,XX +XXX,XX @@ echo
 # command to be received (after receiving the command, the rest runs
 # synchronously, so jobs can arbitrarily continue or complete).
 #
-# Jobs present while QEMU is terminating iterate once more due to
-# bdrv_drain_all().
-#
 # The buffer size for commit and streaming is 512k (waiting for 8 seconds after
 # the first request), for active commit and mirror it's large enough to cover
 # the full 4M, and for backup it's the qcow2 cluster size, which we know is
 # 64k. As all of these are at least as large as the speed, we are sure that the
-# offset advances exactly twice before qemu exits.
+# offset advances exactly once before qemu exits.
 
 _send_qemu_cmd $h \
     "{ 'execute': 'block-commit',
diff --git a/tests/qemu-iotests/185.out b/tests/qemu-iotests/185.out
index XXXXXXX..XXXXXXX 100644
--- a/tests/qemu-iotests/185.out
+++ b/tests/qemu-iotests/185.out
@@ -XXX,XX +XXX,XX @@ Formatting 'TEST_DIR/t.qcow2', fmt=qcow2 size=67108864 backing_file=TEST_DIR/t.q
 {"return": {}}
 {"return": {}}
 {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false}}
-{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_CANCELLED", "data": {"device": "disk", "len": 67108864, "offset": 1048576, "speed": 65536, "type": "commit"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_CANCELLED", "data": {"device": "disk", "len": 67108864, "offset": 524288, "speed": 65536, "type": "commit"}}
 
 === Start active commit job and exit qemu ===
 
@@ -XXX,XX +XXX,XX @@ Formatting 'TEST_DIR/t.qcow2', fmt=qcow2 size=67108864 backing_file=TEST_DIR/t.q
 {"return": {}}
 {"return": {}}
 {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false}}
-{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_READY", "data": {"device": "disk", "len": 4194304, "offset": 4194304, "speed": 65536, "type": "commit"}}
-{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_COMPLETED", "data": {"device": "disk", "len": 4194304, "offset": 4194304, "speed": 65536, "type": "commit"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_CANCELLED", "data": {"device": "disk", "len": 4194304, "offset": 4194304, "speed": 65536, "type": "commit"}}
 
 === Start mirror job and exit qemu ===
 
@@ -XXX,XX +XXX,XX @@ Formatting 'TEST_DIR/t.qcow2.copy', fmt=qcow2 size=67108864 cluster_size=65536 l
 {"return": {}}
 {"return": {}}
 {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false}}
-{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_READY", "data": {"device": "disk", "len": 4194304, "offset": 4194304, "speed": 65536, "type": "mirror"}}
-{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_COMPLETED", "data": {"device": "disk", "len": 4194304, "offset": 4194304, "speed": 65536, "type": "mirror"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_CANCELLED", "data": {"device": "disk", "len": 4194304, "offset": 4194304, "speed": 65536, "type": "mirror"}}
 
 === Start backup job and exit qemu ===
 
@@ -XXX,XX +XXX,XX @@ Formatting 'TEST_DIR/t.qcow2.copy', fmt=qcow2 size=67108864 cluster_size=65536 l
 {"return": {}}
 {"return": {}}
 {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false}}
-{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_CANCELLED", "data": {"device": "disk", "len": 67108864, "offset": 131072, "speed": 65536, "type": "backup"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_CANCELLED", "data": {"device": "disk", "len": 67108864, "offset": 65536, "speed": 65536, "type": "backup"}}
 
 === Start streaming job and exit qemu ===
 
@@ -XXX,XX +XXX,XX @@ Formatting 'TEST_DIR/t.qcow2.copy', fmt=qcow2 size=67108864 cluster_size=65536 l
 {"return": {}}
 {"return": {}}
 {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false}}
-{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_CANCELLED", "data": {"device": "disk", "len": 67108864, "offset": 1048576, "speed": 65536, "type": "stream"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_CANCELLED", "data": {"device": "disk", "len": 67108864, "offset": 524288, "speed": 65536, "type": "stream"}}
 No errors were found on the image.
 *** done
-- 
2.13.6

From: Kevin Wolf <kwolf@redhat.com>

Commit c22a03454 QAPIfied option parsing in the NFS block driver, but
forgot to remove all the options we processed. Therefore, we get an
error in bdrv_open_inherit(), which thinks the remaining options are
invalid. Trying to open an NFS image will result in an error like this:

Block protocol 'nfs' doesn't support the option 'server.host'

Remove all options from the QDict to make the NFS driver work again.

Cc: qemu-stable@nongnu.org
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-id: 20180516160816.26259-1-kwolf@redhat.com
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Jeff Cody <jcody@redhat.com>
Signed-off-by: Jeff Cody <jcody@redhat.com>
---
 block/nfs.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/block/nfs.c b/block/nfs.c
index XXXXXXX..XXXXXXX 100644
--- a/block/nfs.c
+++ b/block/nfs.c
@@ -XXX,XX +XXX,XX @@ static BlockdevOptionsNfs *nfs_options_qdict_to_qapi(QDict *options,
     BlockdevOptionsNfs *opts = NULL;
     QObject *crumpled = NULL;
     Visitor *v;
+    const QDictEntry *e;
     Error *local_err = NULL;
 
     crumpled = qdict_crumple(options, errp);
@@ -XXX,XX +XXX,XX @@ static BlockdevOptionsNfs *nfs_options_qdict_to_qapi(QDict *options,
         return NULL;
     }
 
+    /* Remove the processed options from the QDict (the visitor processes
+     * _all_ options in the QDict) */
+    while ((e = qdict_first(options))) {
+        qdict_del(options, e->key);
+    }
+
     return opts;
 }
 
-- 
2.13.6

The following changes since commit 812b835fb4d23dd108b2f9802158472d50b73579:

Merge remote-tracking branch 'remotes/maxreitz/tags/pull-block-2019-05-07' into staging (2019-05-09 16:31:12 +0100)

are available in the Git repository at:

https://github.com/stefanha/qemu.git tags/block-pull-request

for you to fetch changes up to e84125761f78919fe63616d9888ea45e72dc956f:

docs: add Security chapter to the documentation (2019-05-10 10:53:52 +0100)

----------------------------------------------------------------
Pull request

----------------------------------------------------------------

Andrey Shinkevich (1):
  block/io.c: fix for the allocation failure

Jules Irenge (3):
  util/readline: add a space to fix errors by checkpatch tool
  util: readline: replace tab indent by four spaces to fix checkpatch
    errors
  util/readline: Add braces to fix checkpatch errors

Nikita Alekseev (1):
  block: Add coroutine_fn to bdrv_check_co_entry

Paolo Bonzini (1):
  aio-posix: ensure poll mode is left when aio_notify is called

Stefan Hajnoczi (2):
  docs: add Secure Coding Practices to developer docs
  docs: add Security chapter to the documentation

-- 
2.21.0

From: Jules Irenge <jbi.octave@gmail.com>

util/readline: add a space to fix errors reported by checkpatch.pl tool
"ERROR: space required before the open parenthesis"
"ERROR: space required after that ..."
within "util/redline.c" file

Signed-off-by: Jules Irenge <jbi.octave@gmail.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20190401024406.10819-2-jbi.octave@gmail.com
Message-Id: <20190401024406.10819-2-jbi.octave@gmail.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 util/readline.c | 34 +++++++++++++++++-----------------
 1 file changed, 17 insertions(+), 17 deletions(-)

diff --git a/util/readline.c b/util/readline.c
index XXXXXXX..XXXXXXX 100644
--- a/util/readline.c
+++ b/util/readline.c
@@ -XXX,XX +XXX,XX @@ static void readline_update(ReadLineState *rs)
 
     if (rs->cmd_buf_size != rs->last_cmd_buf_size ||
         memcmp(rs->cmd_buf, rs->last_cmd_buf, rs->cmd_buf_size) != 0) {
-        for(i = 0; i < rs->last_cmd_buf_index; i++) {
+        for (i = 0; i < rs->last_cmd_buf_index; i++) {
             rs->printf_func(rs->opaque, "\033[D");
         }
         rs->cmd_buf[rs->cmd_buf_size] = '\0';
         if (rs->read_password) {
             len = strlen(rs->cmd_buf);
-            for(i = 0; i < len; i++)
+            for (i = 0; i < len; i++)
                 rs->printf_func(rs->opaque, "*");
         } else {
             rs->printf_func(rs->opaque, "%s", rs->cmd_buf);
@@ -XXX,XX +XXX,XX @@ static void readline_update(ReadLineState *rs)
     if (rs->cmd_buf_index != rs->last_cmd_buf_index) {
         delta = rs->cmd_buf_index - rs->last_cmd_buf_index;
         if (delta > 0) {
-            for(i = 0;i < delta; i++) {
+            for (i = 0; i < delta; i++) {
                 rs->printf_func(rs->opaque, "\033[C");
             }
         } else {
             delta = -delta;
-            for(i = 0;i < delta; i++) {
+            for (i = 0; i < delta; i++) {
                 rs->printf_func(rs->opaque, "\033[D");
             }
         }
@@ -XXX,XX +XXX,XX @@ static void readline_completion(ReadLineState *rs)
         return;
     if (rs->nb_completions == 1) {
         len = strlen(rs->completions[0]);
-        for(i = rs->completion_index; i < len; i++) {
+        for (i = rs->completion_index; i < len; i++) {
             readline_insert_char(rs, rs->completions[0][i]);
         }
         /* extra space for next argument. XXX: make it more generic */
@@ -XXX,XX +XXX,XX @@ static void readline_completion(ReadLineState *rs)
               completion_comp);
         rs->printf_func(rs->opaque, "\n");
         max_width = 0;
-        max_prefix = 0;	
-        for(i = 0; i < rs->nb_completions; i++) {
+        max_prefix = 0;
+        for (i = 0; i < rs->nb_completions; i++) {
             len = strlen(rs->completions[i]);
-            if (i==0) {
+            if (i == 0) {
                 max_prefix = len;
             } else {
                 if (len < max_prefix)
                     max_prefix = len;
-                for(j=0; j<max_prefix; j++) {
+                for (j = 0; j < max_prefix; j++) {
                     if (rs->completions[i][j] != rs->completions[0][j])
                         max_prefix = j;
                 }
@@ -XXX,XX +XXX,XX @@ static void readline_completion(ReadLineState *rs)
             if (len > max_width)
                 max_width = len;
         }
-        if (max_prefix > 0) 
-            for(i = rs->completion_index; i < max_prefix; i++) {
+        if (max_prefix > 0)
+            for (i = rs->completion_index; i < max_prefix; i++) {
                 readline_insert_char(rs, rs->completions[0][i]);
             }
         max_width += 2;
@@ -XXX,XX +XXX,XX @@ static void readline_completion(ReadLineState *rs)
             max_width = 80;
         nb_cols = 80 / max_width;
         j = 0;
-        for(i = 0; i < rs->nb_completions; i++) {
+        for (i = 0; i < rs->nb_completions; i++) {
             rs->printf_func(rs->opaque, "%-*s", max_width, rs->completions[i]);
             if (++j == nb_cols || i == (rs->nb_completions - 1)) {
                 rs->printf_func(rs->opaque, "\n");
@@ -XXX,XX +XXX,XX @@ static void readline_clear_screen(ReadLineState *rs)
 /* return true if command handled */
 void readline_handle_byte(ReadLineState *rs, int ch)
 {
-    switch(rs->esc_state) {
+    switch (rs->esc_state) {
     case IS_NORM:
-        switch(ch) {
+        switch (ch) {
         case 1:
             readline_bol(rs);
             break;
@@ -XXX,XX +XXX,XX @@ void readline_handle_byte(ReadLineState *rs, int ch)
         }
         break;
     case IS_CSI:
-        switch(ch) {
+        switch (ch) {
 	case 'A':
 	case 'F':
 	    readline_up_char(rs);
@@ -XXX,XX +XXX,XX @@ void readline_handle_byte(ReadLineState *rs, int ch)
             rs->esc_param = rs->esc_param * 10 + (ch - '0');
             goto the_end;
         case '~':
-            switch(rs->esc_param) {
+            switch (rs->esc_param) {
             case 1:
                 readline_bol(rs);
                 break;
@@ -XXX,XX +XXX,XX @@ void readline_handle_byte(ReadLineState *rs, int ch)
     the_end:
         break;
     case IS_SS3:
-        switch(ch) {
+        switch (ch) {
         case 'F':
             readline_eol(rs);
             break;
-- 
2.21.0

From: Jules Irenge <jbi.octave@gmail.com>

Replace tab indent by four spaces to fix errors issued by checkpatch.pl tool
"ERROR: code indent should never use tabs" within "util/readline.c" file.

Signed-off-by: Jules Irenge <jbi.octave@gmail.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20190401024406.10819-3-jbi.octave@gmail.com
Message-Id: <20190401024406.10819-3-jbi.octave@gmail.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 util/readline.c | 98 ++++++++++++++++++++++++-------------------------
 1 file changed, 49 insertions(+), 49 deletions(-)

diff --git a/util/readline.c b/util/readline.c
index XXXXXXX..XXXXXXX 100644
--- a/util/readline.c
+++ b/util/readline.c
@@ -XXX,XX +XXX,XX @@ static void readline_up_char(ReadLineState *rs)
     int idx;
 
     if (rs->hist_entry == 0)
-	return;
+        return;
     if (rs->hist_entry == -1) {
-	/* Find latest entry */
-	for (idx = 0; idx < READLINE_MAX_CMDS; idx++) {
-	    if (rs->history[idx] == NULL)
-		break;
-	}
-	rs->hist_entry = idx;
+        /* Find latest entry */
+        for (idx = 0; idx < READLINE_MAX_CMDS; idx++) {
+            if (rs->history[idx] == NULL)
+                break;
+        }
+        rs->hist_entry = idx;
     }
     rs->hist_entry--;
     if (rs->hist_entry >= 0) {
-	pstrcpy(rs->cmd_buf, sizeof(rs->cmd_buf),
+        pstrcpy(rs->cmd_buf, sizeof(rs->cmd_buf),
                 rs->history[rs->hist_entry]);
-	rs->cmd_buf_index = rs->cmd_buf_size = strlen(rs->cmd_buf);
+        rs->cmd_buf_index = rs->cmd_buf_size = strlen(rs->cmd_buf);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void readline_down_char(ReadLineState *rs)
         return;
     if (rs->hist_entry < READLINE_MAX_CMDS - 1 &&
         rs->history[++rs->hist_entry] != NULL) {
-	pstrcpy(rs->cmd_buf, sizeof(rs->cmd_buf),
+        pstrcpy(rs->cmd_buf, sizeof(rs->cmd_buf),
                 rs->history[rs->hist_entry]);
     } else {
         rs->cmd_buf[0] = 0;
-	rs->hist_entry = -1;
+        rs->hist_entry = -1;
     }
     rs->cmd_buf_index = rs->cmd_buf_size = strlen(rs->cmd_buf);
 }
@@ -XXX,XX +XXX,XX @@ static void readline_hist_add(ReadLineState *rs, const char *cmdline)
     int idx;
 
     if (cmdline[0] == '\0')
-	return;
+        return;
     new_entry = NULL;
     if (rs->hist_entry != -1) {
-	/* We were editing an existing history entry: replace it */
-	hist_entry = rs->history[rs->hist_entry];
-	idx = rs->hist_entry;
-	if (strcmp(hist_entry, cmdline) == 0) {
-	    goto same_entry;
-	}
+        /* We were editing an existing history entry: replace it */
+        hist_entry = rs->history[rs->hist_entry];
+        idx = rs->hist_entry;
+        if (strcmp(hist_entry, cmdline) == 0) {
+            goto same_entry;
+        }
     }
     /* Search cmdline in history buffers */
     for (idx = 0; idx < READLINE_MAX_CMDS; idx++) {
-	hist_entry = rs->history[idx];
-	if (hist_entry == NULL)
-	    break;
-	if (strcmp(hist_entry, cmdline) == 0) {
-	same_entry:
-	    new_entry = hist_entry;
-	    /* Put this entry at the end of history */
-	    memmove(&rs->history[idx], &rs->history[idx + 1],
-		    (READLINE_MAX_CMDS - (idx + 1)) * sizeof(char *));
-	    rs->history[READLINE_MAX_CMDS - 1] = NULL;
-	    for (; idx < READLINE_MAX_CMDS; idx++) {
-		if (rs->history[idx] == NULL)
-		    break;
-	    }
-	    break;
-	}
+        hist_entry = rs->history[idx];
+        if (hist_entry == NULL)
+            break;
+        if (strcmp(hist_entry, cmdline) == 0) {
+        same_entry:
+            new_entry = hist_entry;
+            /* Put this entry at the end of history */
+            memmove(&rs->history[idx], &rs->history[idx + 1],
+                    (READLINE_MAX_CMDS - (idx + 1)) * sizeof(char *));
+            rs->history[READLINE_MAX_CMDS - 1] = NULL;
+            for (; idx < READLINE_MAX_CMDS; idx++) {
+                if (rs->history[idx] == NULL)
+                    break;
+            }
+            break;
+        }
     }
     if (idx == READLINE_MAX_CMDS) {
-	/* Need to get one free slot */
+        /* Need to get one free slot */
         g_free(rs->history[0]);
-	memmove(rs->history, &rs->history[1],
-	        (READLINE_MAX_CMDS - 1) * sizeof(char *));
-	rs->history[READLINE_MAX_CMDS - 1] = NULL;
-	idx = READLINE_MAX_CMDS - 1;
+        memmove(rs->history, &rs->history[1],
+                (READLINE_MAX_CMDS - 1) * sizeof(char *));
+        rs->history[READLINE_MAX_CMDS - 1] = NULL;
+        idx = READLINE_MAX_CMDS - 1;
     }
     if (new_entry == NULL)
         new_entry = g_strdup(cmdline);
@@ -XXX,XX +XXX,XX @@ void readline_handle_byte(ReadLineState *rs, int ch)
         case 8:
             readline_backspace(rs);
             break;
-	case 155:
+        case 155:
             rs->esc_state = IS_CSI;
-	    break;
+            break;
         default:
             if (ch >= 32) {
                 readline_insert_char(rs, ch);
@@ -XXX,XX +XXX,XX @@ void readline_handle_byte(ReadLineState *rs, int ch)
         break;
     case IS_CSI:
         switch (ch) {
-	case 'A':
-	case 'F':
-	    readline_up_char(rs);
-	    break;
-	case 'B':
-	case 'E':
-	    readline_down_char(rs);
-	    break;
+        case 'A':
+        case 'F':
+            readline_up_char(rs);
+            break;
+        case 'B':
+        case 'E':
+            readline_down_char(rs);
+            break;
         case 'D':
             readline_backward_char(rs);
             break;
-- 
2.21.0

From: Jules Irenge <jbi.octave@gmail.com>

Add braces to fix errors issued by checkpatch.pl tool
"ERROR: braces {} are necessary for all arms of this statement"
Within "util/readline.c" file
Message-Id: <20190330112142.14082-1-jbi.octave@gmail.com>

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 util/readline.c | 50 ++++++++++++++++++++++++++++++++-----------------
 1 file changed, 33 insertions(+), 17 deletions(-)

diff --git a/util/readline.c b/util/readline.c
index XXXXXXX..XXXXXXX 100644
--- a/util/readline.c
+++ b/util/readline.c
@@ -XXX,XX +XXX,XX @@ static void readline_update(ReadLineState *rs)
         rs->cmd_buf[rs->cmd_buf_size] = '\0';
         if (rs->read_password) {
             len = strlen(rs->cmd_buf);
-            for (i = 0; i < len; i++)
+            for (i = 0; i < len; i++) {
                 rs->printf_func(rs->opaque, "*");
+            }
         } else {
             rs->printf_func(rs->opaque, "%s", rs->cmd_buf);
         }
@@ -XXX,XX +XXX,XX @@ static void readline_up_char(ReadLineState *rs)
 {
     int idx;
 
-    if (rs->hist_entry == 0)
+    if (rs->hist_entry == 0) {
         return;
+    }
     if (rs->hist_entry == -1) {
         /* Find latest entry */
         for (idx = 0; idx < READLINE_MAX_CMDS; idx++) {
-            if (rs->history[idx] == NULL)
+            if (rs->history[idx] == NULL) {
                 break;
+            }
         }
         rs->hist_entry = idx;
     }
@@ -XXX,XX +XXX,XX @@ static void readline_up_char(ReadLineState *rs)
 
 static void readline_down_char(ReadLineState *rs)
 {
-    if (rs->hist_entry == -1)
+    if (rs->hist_entry == -1) {
         return;
+    }
     if (rs->hist_entry < READLINE_MAX_CMDS - 1 &&
         rs->history[++rs->hist_entry] != NULL) {
         pstrcpy(rs->cmd_buf, sizeof(rs->cmd_buf),
@@ -XXX,XX +XXX,XX @@ static void readline_hist_add(ReadLineState *rs, const char *cmdline)
     char *hist_entry, *new_entry;
     int idx;
 
-    if (cmdline[0] == '\0')
+    if (cmdline[0] == '\0') {
         return;
+    }
     new_entry = NULL;
     if (rs->hist_entry != -1) {
         /* We were editing an existing history entry: replace it */
@@ -XXX,XX +XXX,XX @@ static void readline_hist_add(ReadLineState *rs, const char *cmdline)
     /* Search cmdline in history buffers */
     for (idx = 0; idx < READLINE_MAX_CMDS; idx++) {
         hist_entry = rs->history[idx];
-        if (hist_entry == NULL)
+        if (hist_entry == NULL) {
             break;
+        }
         if (strcmp(hist_entry, cmdline) == 0) {
         same_entry:
             new_entry = hist_entry;
@@ -XXX,XX +XXX,XX @@ static void readline_hist_add(ReadLineState *rs, const char *cmdline)
                     (READLINE_MAX_CMDS - (idx + 1)) * sizeof(char *));
             rs->history[READLINE_MAX_CMDS - 1] = NULL;
             for (; idx < READLINE_MAX_CMDS; idx++) {
-                if (rs->history[idx] == NULL)
+                if (rs->history[idx] == NULL) {
                     break;
+                }
             }
             break;
         }
@@ -XXX,XX +XXX,XX @@ static void readline_hist_add(ReadLineState *rs, const char *cmdline)
         rs->history[READLINE_MAX_CMDS - 1] = NULL;
         idx = READLINE_MAX_CMDS - 1;
     }
-    if (new_entry == NULL)
+    if (new_entry == NULL) {
         new_entry = g_strdup(cmdline);
+    }
     rs->history[idx] = new_entry;
     rs->hist_entry = -1;
 }
@@ -XXX,XX +XXX,XX @@ static void readline_completion(ReadLineState *rs)
     g_free(cmdline);
 
     /* no completion found */
-    if (rs->nb_completions <= 0)
+    if (rs->nb_completions <= 0) {
         return;
+    }
     if (rs->nb_completions == 1) {
         len = strlen(rs->completions[0]);
         for (i = rs->completion_index; i < len; i++) {
             readline_insert_char(rs, rs->completions[0][i]);
         }
         /* extra space for next argument. XXX: make it more generic */
-        if (len > 0 && rs->completions[0][len - 1] != '/')
+        if (len > 0 && rs->completions[0][len - 1] != '/') {
             readline_insert_char(rs, ' ');
+        }
     } else {
         qsort(rs->completions, rs->nb_completions, sizeof(char *),
               completion_comp);
@@ -XXX,XX +XXX,XX @@ static void readline_completion(ReadLineState *rs)
             if (i == 0) {
                 max_prefix = len;
             } else {
-                if (len < max_prefix)
+                if (len < max_prefix) {
                     max_prefix = len;
+                }
                 for (j = 0; j < max_prefix; j++) {
-                    if (rs->completions[i][j] != rs->completions[0][j])
+                    if (rs->completions[i][j] != rs->completions[0][j]) {
                         max_prefix = j;
+                    }
                 }
             }
-            if (len > max_width)
+            if (len > max_width) {
                 max_width = len;
+            }
         }
         if (max_prefix > 0)
             for (i = rs->completion_index; i < max_prefix; i++) {
                 readline_insert_char(rs, rs->completions[0][i]);
             }
         max_width += 2;
-        if (max_width < 10)
+        if (max_width < 10) {
             max_width = 10;
-        else if (max_width > 80)
+        } else if (max_width > 80) {
             max_width = 80;
+        }
         nb_cols = 80 / max_width;
         j = 0;
         for (i = 0; i < rs->nb_completions; i++) {
@@ -XXX,XX +XXX,XX @@ void readline_handle_byte(ReadLineState *rs, int ch)
         case 10:
         case 13:
             rs->cmd_buf[rs->cmd_buf_size] = '\0';
-            if (!rs->read_password)
+            if (!rs->read_password) {
                 readline_hist_add(rs, rs->cmd_buf);
+            }
             rs->printf_func(rs->opaque, "\n");
             rs->cmd_buf_index = 0;
             rs->cmd_buf_size = 0;
@@ -XXX,XX +XXX,XX @@ void readline_restart(ReadLineState *rs)
 
 const char *readline_get_history(ReadLineState *rs, unsigned int index)
 {
-    if (index >= READLINE_MAX_CMDS)
+    if (index >= READLINE_MAX_CMDS) {
         return NULL;
+    }
     return rs->history[index];
 }
 
-- 
2.21.0

From: Andrey Shinkevich <andrey.shinkevich@virtuozzo.com>

On a file system used by the customer, fallocate() returns an error
if the block is not properly aligned. So, bdrv_co_pwrite_zeroes()
fails. We can handle that case the same way as it is done for the
unsupported cases, namely, call to bdrv_driver_pwritev() that writes
zeroes to an image for the unaligned chunk of the block.

Suggested-by: Denis V. Lunev <den@openvz.org>
Signed-off-by: Andrey Shinkevich <andrey.shinkevich@virtuozzo.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Message-id: 1554474244-553661-1-git-send-email-andrey.shinkevich@virtuozzo.com
Message-Id: <1554474244-553661-1-git-send-email-andrey.shinkevich@virtuozzo.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/io.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/block/io.c b/block/io.c
index XXXXXXX..XXXXXXX 100644
--- a/block/io.c
+++ b/block/io.c
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_co_do_pwrite_zeroes(BlockDriverState *bs,
             assert(!bs->supported_zero_flags);
         }
 
-        if (ret == -ENOTSUP && !(flags & BDRV_REQ_NO_FALLBACK)) {
+        if (ret < 0 && !(flags & BDRV_REQ_NO_FALLBACK)) {
             /* Fall back to bounce buffer if write zeroes is unsupported */
             BdrvRequestFlags write_flags = flags & ~BDRV_REQ_ZERO_WRITE;
 
-- 
2.21.0

From: Paolo Bonzini <pbonzini@redhat.com>

With aio=thread, adaptive polling makes latency worse rather than
better, because it delays the execution of the ThreadPool's
completion bottom half.

event_notifier_poll() does run while polling, detecting that
a bottom half was scheduled by a worker thread, but because
ctx->notifier is explicitly ignored in run_poll_handlers_once(),
scheduling the BH does not count as making progress and
run_poll_handlers() keeps running.  Fix this by recomputing
the deadline after *timeout could have changed.

With this change, ThreadPool still cannot participate in polling
but at least it does not suffer from extra latency.

Reported-by: Sergio Lopez <slp@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 20190409122823.12416-1-pbonzini@redhat.com
Cc: Stefan Hajnoczi <stefanha@gmail.com>
Cc: Kevin Wolf <kwolf@redhat.com>
Cc: qemu-block@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <1553692145-86728-1-git-send-email-pbonzini@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <20190409122823.12416-1-pbonzini@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 util/aio-posix.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/util/aio-posix.c b/util/aio-posix.c
index XXXXXXX..XXXXXXX 100644
--- a/util/aio-posix.c
+++ b/util/aio-posix.c
@@ -XXX,XX +XXX,XX @@ static bool run_poll_handlers_once(AioContext *ctx, int64_t *timeout)
         if (!node->deleted && node->io_poll &&
             aio_node_check(ctx, node->is_external) &&
             node->io_poll(node->opaque)) {
+            /*
+             * Polling was successful, exit try_poll_mode immediately
+             * to adjust the next polling time.
+             */
             *timeout = 0;
             if (node->opaque != &ctx->notifier) {
                 progress = true;
@@ -XXX,XX +XXX,XX @@ static bool run_poll_handlers(AioContext *ctx, int64_t max_ns, int64_t *timeout)
     do {
         progress = run_poll_handlers_once(ctx, timeout);
         elapsed_time = qemu_clock_get_ns(QEMU_CLOCK_REALTIME) - start_time;
-    } while (!progress && elapsed_time < max_ns
-             && !atomic_read(&ctx->poll_disable_cnt));
+        max_ns = qemu_soonest_timeout(*timeout, max_ns);
+        assert(!(max_ns && progress));
+    } while (elapsed_time < max_ns && !atomic_read(&ctx->poll_disable_cnt));
 
     /* If time has passed with no successful polling, adjust *timeout to
      * keep the same ending time.
@@ -XXX,XX +XXX,XX @@ static bool run_poll_handlers(AioContext *ctx, int64_t max_ns, int64_t *timeout)
  */
 static bool try_poll_mode(AioContext *ctx, int64_t *timeout)
 {
-    /* See qemu_soonest_timeout() uint64_t hack */
-    int64_t max_ns = MIN((uint64_t)*timeout, (uint64_t)ctx->poll_ns);
+    int64_t max_ns = qemu_soonest_timeout(*timeout, ctx->poll_ns);
 
     if (max_ns && !atomic_read(&ctx->poll_disable_cnt)) {
         poll_set_started(ctx, true);
-- 
2.21.0

At KVM Forum 2018 I gave a presentation on security in QEMU:
https://www.youtube.com/watch?v=YAdRf_hwxU8 (video)
https://vmsplice.net/~stefan/stefanha-kvm-forum-2018.pdf (slides)

This patch adds a guide to secure coding practices.  This document
covers things that developers should know about security in QEMU.  It is
just a starting point that we can expand on later.  I hope it will be
useful as a resource for new contributors and will save code reviewers
from explaining the same concepts many times.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Acked-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Li Qiang <liq3ea@gmail.com>
Message-id: 20190509121820.16294-2-stefanha@redhat.com
Message-Id: <20190509121820.16294-2-stefanha@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 docs/devel/index.rst                   |   1 +
 docs/devel/secure-coding-practices.rst | 106 +++++++++++++++++++++++++
 2 files changed, 107 insertions(+)
 create mode 100644 docs/devel/secure-coding-practices.rst

diff --git a/docs/devel/index.rst b/docs/devel/index.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/devel/index.rst
+++ b/docs/devel/index.rst
@@ -XXX,XX +XXX,XX @@ Contents:
    stable-process
    testing
    decodetree
+   secure-coding-practices
diff --git a/docs/devel/secure-coding-practices.rst b/docs/devel/secure-coding-practices.rst
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/devel/secure-coding-practices.rst
@@ -XXX,XX +XXX,XX @@
+=======================
+Secure Coding Practices
+=======================
+This document covers topics that both developers and security researchers must
+be aware of so that they can develop safe code and audit existing code
+properly.
+
+Reporting Security Bugs
+-----------------------
+For details on how to report security bugs or ask questions about potential
+security bugs, see the `Security Process wiki page
+<https://wiki.qemu.org/SecurityProcess>`_.
+
+General Secure C Coding Practices
+---------------------------------
+Most CVEs (security bugs) reported against QEMU are not specific to
+virtualization or emulation.  They are simply C programming bugs.  Therefore
+it's critical to be aware of common classes of security bugs.
+
+There is a wide selection of resources available covering secure C coding.  For
+example, the `CERT C Coding Standard
+<https://wiki.sei.cmu.edu/confluence/display/c/SEI+CERT+C+Coding+Standard>`_
+covers the most important classes of security bugs.
+
+Instead of describing them in detail here, only the names of the most important
+classes of security bugs are mentioned:
+
+* Buffer overflows
+* Use-after-free and double-free
+* Integer overflows
+* Format string vulnerabilities
+
+Some of these classes of bugs can be detected by analyzers.  Static analysis is
+performed regularly by Coverity and the most obvious of these bugs are even
+reported by compilers.  Dynamic analysis is possible with valgrind, tsan, and
+asan.
+
+Input Validation
+----------------
+Inputs from the guest or external sources (e.g. network, files) cannot be
+trusted and may be invalid.  Inputs must be checked before using them in a way
+that could crash the program, expose host memory to the guest, or otherwise be
+exploitable by an attacker.
+
+The most sensitive attack surface is device emulation.  All hardware register
+accesses and data read from guest memory must be validated.  A typical example
+is a device that contains multiple units that are selectable by the guest via
+an index register::
+
+  typedef struct {
+      ProcessingUnit unit[2];
+      ...
+  } MyDeviceState;
+
+  static void mydev_writel(void *opaque, uint32_t addr, uint32_t val)
+  {
+      MyDeviceState *mydev = opaque;
+      ProcessingUnit *unit;
+
+      switch (addr) {
+      case MYDEV_SELECT_UNIT:
+          unit = &mydev->unit[val];   <-- this input wasn't validated!
+          ...
+      }
+  }
+
+If ``val`` is not in range [0, 1] then an out-of-bounds memory access will take
+place when ``unit`` is dereferenced.  The code must check that ``val`` is 0 or
+1 and handle the case where it is invalid.
+
+Unexpected Device Accesses
+--------------------------
+The guest may access device registers in unusual orders or at unexpected
+moments.  Device emulation code must not assume that the guest follows the
+typical "theory of operation" presented in driver writer manuals.  The guest
+may make nonsense accesses to device registers such as starting operations
+before the device has been fully initialized.
+
+A related issue is that device emulation code must be prepared for unexpected
+device register accesses while asynchronous operations are in progress.  A
+well-behaved guest might wait for a completion interrupt before accessing
+certain device registers.  Device emulation code must handle the case where the
+guest overwrites registers or submits further requests before an ongoing
+request completes.  Unexpected accesses must not cause memory corruption or
+leaks in QEMU.
+
+Invalid device register accesses can be reported with
+``qemu_log_mask(LOG_GUEST_ERROR, ...)``.  The ``-d guest_errors`` command-line
+option enables these log messages.
+
+Live Migration
+--------------
+Device state can be saved to disk image files and shared with other users.
+Live migration code must validate inputs when loading device state so an
+attacker cannot gain control by crafting invalid device states.  Device state
+is therefore considered untrusted even though it is typically generated by QEMU
+itself.
+
+Guest Memory Access Races
+-------------------------
+Guests with multiple vCPUs may modify guest RAM while device emulation code is
+running.  Device emulation code must copy in descriptors and other guest RAM
+structures and only process the local copy.  This prevents
+time-of-check-to-time-of-use (TOCTOU) race conditions that could cause QEMU to
+crash when a vCPU thread modifies guest RAM while device emulation is
+processing it.
-- 
2.21.0

This new chapter in the QEMU documentation covers the security
requirements that QEMU is designed to meet and principles for securely
deploying QEMU.

It is just a starting point that can be extended in the future with more
information.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Acked-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Li Qiang <liq3ea@gmail.com>
Message-id: 20190509121820.16294-3-stefanha@redhat.com
Message-Id: <20190509121820.16294-3-stefanha@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 Makefile           |   2 +-
 docs/security.texi | 131 +++++++++++++++++++++++++++++++++++++++++++++
 qemu-doc.texi      |   3 ++
 3 files changed, 135 insertions(+), 1 deletion(-)
 create mode 100644 docs/security.texi

diff --git a/Makefile b/Makefile
index XXXXXXX..XXXXXXX 100644
--- a/Makefile
+++ b/Makefile
@@ -XXX,XX +XXX,XX @@ qemu-doc.html qemu-doc.info qemu-doc.pdf qemu-doc.txt: \
 	qemu-img.texi qemu-nbd.texi qemu-options.texi qemu-option-trace.texi \
 	qemu-deprecated.texi qemu-monitor.texi qemu-img-cmds.texi qemu-ga.texi \
 	qemu-monitor-info.texi docs/qemu-block-drivers.texi \
-	docs/qemu-cpu-models.texi
+	docs/qemu-cpu-models.texi docs/security.texi
 
 docs/interop/qemu-ga-ref.dvi docs/interop/qemu-ga-ref.html \
     docs/interop/qemu-ga-ref.info docs/interop/qemu-ga-ref.pdf \
diff --git a/docs/security.texi b/docs/security.texi
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/security.texi
@@ -XXX,XX +XXX,XX @@
+@node Security
+@chapter Security
+
+@section Overview
+
+This chapter explains the security requirements that QEMU is designed to meet
+and principles for securely deploying QEMU.
+
+@section Security Requirements
+
+QEMU supports many different use cases, some of which have stricter security
+requirements than others.  The community has agreed on the overall security
+requirements that users may depend on.  These requirements define what is
+considered supported from a security perspective.
+
+@subsection Virtualization Use Case
+
+The virtualization use case covers cloud and virtual private server (VPS)
+hosting, as well as traditional data center and desktop virtualization.  These
+use cases rely on hardware virtualization extensions to execute guest code
+safely on the physical CPU at close-to-native speed.
+
+The following entities are untrusted, meaning that they may be buggy or
+malicious:
+
+@itemize
+@item Guest
+@item User-facing interfaces (e.g. VNC, SPICE, WebSocket)
+@item Network protocols (e.g. NBD, live migration)
+@item User-supplied files (e.g. disk images, kernels, device trees)
+@item Passthrough devices (e.g. PCI, USB)
+@end itemize
+
+Bugs affecting these entities are evaluated on whether they can cause damage in
+real-world use cases and treated as security bugs if this is the case.
+
+@subsection Non-virtualization Use Case
+
+The non-virtualization use case covers emulation using the Tiny Code Generator
+(TCG).  In principle the TCG and device emulation code used in conjunction with
+the non-virtualization use case should meet the same security requirements as
+the virtualization use case.  However, for historical reasons much of the
+non-virtualization use case code was not written with these security
+requirements in mind.
+
+Bugs affecting the non-virtualization use case are not considered security
+bugs at this time.  Users with non-virtualization use cases must not rely on
+QEMU to provide guest isolation or any security guarantees.
+
+@section Architecture
+
+This section describes the design principles that ensure the security
+requirements are met.
+
+@subsection Guest Isolation
+
+Guest isolation is the confinement of guest code to the virtual machine.  When
+guest code gains control of execution on the host this is called escaping the
+virtual machine.  Isolation also includes resource limits such as throttling of
+CPU, memory, disk, or network.  Guests must be unable to exceed their resource
+limits.
+
+QEMU presents an attack surface to the guest in the form of emulated devices.
+The guest must not be able to gain control of QEMU.  Bugs in emulated devices
+could allow malicious guests to gain code execution in QEMU.  At this point the
+guest has escaped the virtual machine and is able to act in the context of the
+QEMU process on the host.
+
+Guests often interact with other guests and share resources with them.  A
+malicious guest must not gain control of other guests or access their data.
+Disk image files and network traffic must be protected from other guests unless
+explicitly shared between them by the user.
+
+@subsection Principle of Least Privilege
+
+The principle of least privilege states that each component only has access to
+the privileges necessary for its function.  In the case of QEMU this means that
+each process only has access to resources belonging to the guest.
+
+The QEMU process should not have access to any resources that are inaccessible
+to the guest.  This way the guest does not gain anything by escaping into the
+QEMU process since it already has access to those same resources from within
+the guest.
+
+Following the principle of least privilege immediately fulfills guest isolation
+requirements.  For example, guest A only has access to its own disk image file
+@code{a.img} and not guest B's disk image file @code{b.img}.
+
+In reality certain resources are inaccessible to the guest but must be
+available to QEMU to perform its function.  For example, host system calls are
+necessary for QEMU but are not exposed to guests.  A guest that escapes into
+the QEMU process can then begin invoking host system calls.
+
+New features must be designed to follow the principle of least privilege.
+Should this not be possible for technical reasons, the security risk must be
+clearly documented so users are aware of the trade-off of enabling the feature.
+
+@subsection Isolation mechanisms
+
+Several isolation mechanisms are available to realize this architecture of
+guest isolation and the principle of least privilege.  With the exception of
+Linux seccomp, these mechanisms are all deployed by management tools that
+launch QEMU, such as libvirt.  They are also platform-specific so they are only
+described briefly for Linux here.
+
+The fundamental isolation mechanism is that QEMU processes must run as
+unprivileged users.  Sometimes it seems more convenient to launch QEMU as
+root to give it access to host devices (e.g. @code{/dev/net/tun}) but this poses a
+huge security risk.  File descriptor passing can be used to give an otherwise
+unprivileged QEMU process access to host devices without running QEMU as root.
+It is also possible to launch QEMU as a non-root user and configure UNIX groups
+for access to @code{/dev/kvm}, @code{/dev/net/tun}, and other device nodes.
+Some Linux distros already ship with UNIX groups for these devices by default.
+
+@itemize
+@item SELinux and AppArmor make it possible to confine processes beyond the
+traditional UNIX process and file permissions model.  They restrict the QEMU
+process from accessing processes and files on the host system that are not
+needed by QEMU.
+
+@item Resource limits and cgroup controllers provide throughput and utilization
+limits on key resources such as CPU time, memory, and I/O bandwidth.
+
+@item Linux namespaces can be used to make process, file system, and other system
+resources unavailable to QEMU.  A namespaced QEMU process is restricted to only
+those resources that were granted to it.
+
+@item Linux seccomp is available via the QEMU @option{--sandbox} option.  It disables
+system calls that are not needed by QEMU, thereby reducing the host kernel
+attack surface.
+@end itemize
diff --git a/qemu-doc.texi b/qemu-doc.texi
index XXXXXXX..XXXXXXX 100644
--- a/qemu-doc.texi
+++ b/qemu-doc.texi
@@ -XXX,XX +XXX,XX @@
 * QEMU Guest Agent::
 * QEMU User space emulator::
 * System requirements::
+* Security::
 * Implementation notes::
 * Deprecated features::
 * Supported build platforms::
@@ -XXX,XX +XXX,XX @@ added with Linux 4.5 which is supported by the major distros. And even
 if RHEL7 has kernel 3.10, KVM there has the required functionality there
 to make it close to a 4.5 or newer kernel.
 
+@include docs/security.texi
+
 @include qemu-tech.texi
 
 @include qemu-deprecated.texi
-- 
2.21.0