summary refs log tree commit diff stats
path: root/docs/sphinx/qapidoc.py (unfollow)
Commit message (Collapse)AuthorFilesLines
2021-04-12exec: Fix overlap of PAGE_ANON and PAGE_TARGET_1Richard Henderson1-2/+2
Unfortuately, the elements of PAGE_* were not in numerical order and so PAGE_ANON was added to an "unused" bit. As an arbitrary choice, move PAGE_TARGET_{1,2} together. Cc: Laurent Vivier <laurent@vivier.eu> Fixes: 26bab757d41b ("linux-user: Introduce PAGE_ANON") Buglink: https://bugs.launchpad.net/bugs/1922617 Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Tested-by: Laurent Vivier <laurent@vivier.eu> Tested-by: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-12target/arm: Check PAGE_WRITE_ORG for MTE writeabilityRichard Henderson1-1/+1
We can remove PAGE_WRITE when (internally) marking a page read-only because it contains translated code. This can be triggered by tests/tcg/aarch64/bti-2, after having serviced SIGILL trampolines on the stack. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-12accel/tcg: Preserve PAGE_ANON when changing page permissionsRichard Henderson4-4/+53
Using mprotect() to change PROT_* does not change the MAP_ANON previously set with mmap(). Our linux-user version of MTE only works with MAP_ANON pages, so losing PAGE_ANON caused MTE to stop working. Reported-by: Stephen Long <steplong@quicinc.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Tested-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-12hw/arm/smmuv3: Emulate CFGI_STE_RANGE for an aligned range of StreamIDsZenghui Yu1-4/+8
In emulation of the CFGI_STE_RANGE command, we now take StreamID as the start of the invalidation range, regardless of whatever the Range is, whilst the spec clearly states that - "Invalidation is performed for an *aligned* range of 2^(Range+1) StreamIDs." - "The bottom Range+1 bits of the StreamID parameter are IGNORED, aligning the range to its size." Take CFGI_ALL (where Range == 31) as an example, if there are some random bits in the StreamID field, we'll fail to perform the full invalidation but get a strange range (e.g., SMMUSIDRange={.start=1, .end=0}) instead. Rework the emulation a bit to get rid of the discrepancy with the spec. Signed-off-by: Zenghui Yu <yuzenghui@huawei.com> Acked-by: Eric Auger <eric.auger@redhat.com> Message-id: 20210402100449.528-1-yuzenghui@huawei.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-12hw/arm/virt-acpi-build: Fix GSIV values of the {GERR, Sync} interruptsZenghui Yu1-2/+2
The GSIV values in SMMUv3 IORT node are not correct as they don't match the SMMUIrq enumeration, which describes the IRQ<->PIN mapping used by our emulated vSMMU. Fixes: a703b4f6c1ee ("hw/arm/virt-acpi-build: Add smmuv3 node in IORT table") Signed-off-by: Zenghui Yu <yuzenghui@huawei.com> Acked-by: Eric Auger <eric.auger@redhat.com> Message-id: 20210402084731.93-1-yuzenghui@huawei.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-12hw/block/nvme: drain namespaces on sq deletionKlaus Jensen1-2/+21
For most commands, when issuing an AIO, the BlockAIOCB is stored in the NvmeRequest aiocb pointer when the AIO is issued. The main use of this is cancelling AIOs when deleting submission queues (it is currently not used for Abort). However, some commands like Dataset Management Zone Management Send (zone reset) may involve more than one AIO and here the AIOs are issued without saving a reference to the BlockAIOCB. This is a problem since nvme_del_sq() will attempt to cancel outstanding AIOs, potentially with an invalid BlockAIOCB since the aiocb pointer is not NULL'ed when the request structure is recycled. Fix this by 1. making sure the aiocb pointer is NULL'ed when requests are recycled 2. only attempt to cancel the AIO if the aiocb is non-NULL 3. if any AIOs could not be cancelled, drain all aio as a last resort. Fixes: dc04d25e2f3f ("hw/block/nvme: add support for the format nvm command") Fixes: c94973288cd9 ("hw/block/nvme: add broadcast nsid support flush command") Fixes: e4e430b3d6ba ("hw/block/nvme: add simple copy command") Fixes: 5f5dc4c6a942 ("hw/block/nvme: zero out zones on reset") Fixes: 2605257a26b8 ("hw/block/nvme: add the dataset management command") Cc: Gollu Appalanaidu <anaidu.gollu@samsung.com> Cc: Minwoo Im <minwoo.im@samsung.com> Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Minwoo Im <minwoo.im.dev@gmail.com>
2021-04-12hw/block/nvme: store aiocb in compareKlaus Jensen1-1/+2
nvme_compare() fails to store the aiocb from the blk_aio_preadv() call. Fix this. Fixes: 0a384f923f51 ("hw/block/nvme: add compare command") Cc: Gollu Appalanaidu <anaidu.gollu@samsung.com> Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Gollu Appalanaidu <anaidu.gollu@samsung.com> Reviewed-by: Minwoo Im <minwoo.im.dev@gmail.com>
2021-04-12hw/block/nvme: map prp fix if prp2 contains non-zero offsetPadmakar Kalghatgi1-3/+9
nvme_map_prp needs to calculate the number of list entries based on the offset value. For the subsequent PRP2 list, need to ensure the number of entries is within the MAX number of PRP entries for a page. Signed-off-by: Padmakar Kalghatgi <p.kalghatgi@samsung.com> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
2021-04-12docs: add nvme emulation documentationKlaus Jensen4-24/+227
Remove the docs/specs/nvme.txt and replace it with proper documentation in docs/system/nvme.rst. Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2021-04-09cpu/core: Fix "help" of CPU core device typesGreg Kurz1-2/+8
Calling qdev_get_machine() from a QOM instance_init function is fragile because we can't be sure the machine object actually exists. And this happens to break when passing ",help" on the command line to get the list of properties for a CPU core device types : $ ./qemu-system-ppc64 -device power8_v2.0-spapr-cpu-core,help qemu-system-ppc64: ../../hw/core/machine.c:1290: qdev_get_machine: Assertion `machine != NULL' failed. Aborted (core dumped) This used to work before QEMU 5.0, but commit 3df261b6676b unwillingly introduced a subtle regression : the above command line needs to create an instance but the instance_init function of the base class calls qdev_get_machine() before qemu_create_machine() has been called, which is a programming bug. Use current_machine instead. It is okay to skip the setting of nr_thread in this case since only its type is displayed. Fixes: 3df261b6676b ("softmmu/vl.c: Handle '-cpu help' and '-device help' before 'no default machine'") Reported-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Greg Kurz <groug@kaod.org> Cc: peter.maydell@linaro.org Message-Id: <20210409160339.500167-3-groug@kaod.org> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2021-04-09i386: Add missing cpu feature bits in EPYC-Rome modelBabu Moger1-0/+12
Found the following cpu feature bits missing from EPYC-Rome model. ibrs : Indirect Branch Restricted Speculation ssbd : Speculative Store Bypass Disable These new features will be added in EPYC-Rome-v2. The -cpu help output after the change. x86 EPYC-Rome (alias configured by machine type) x86 EPYC-Rome-v1 AMD EPYC-Rome Processor x86 EPYC-Rome-v2 AMD EPYC-Rome Processor Reported-by: Pankaj Gupta <pankaj.gupta@cloud.ionos.com> Signed-off-by: Babu Moger <babu.moger@amd.com> Signed-off-by: Pankaj Gupta <pankaj.gupta@cloud.ionos.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: David Edmondson <david.edmondson@oracle.com> Message-Id: <161478622280.16275.6399866734509127420.stgit@bmoger-ubuntu> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2021-04-09test-blockjob: Test job_wait_unpaused()Max Reitz1-0/+121
Create a job that remains on STANDBY after a drained section, and see that invoking job_wait_unpaused() will get it unstuck. Signed-off-by: Max Reitz <mreitz@redhat.com> Message-Id: <20210409120422.144040-5-mreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2021-04-09job: Allow complete for jobs on standbyMax Reitz1-2/+2
The only job that implements .complete is the mirror job, and it can handle completion requests just fine while the job is paused. Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1945635 Signed-off-by: Max Reitz <mreitz@redhat.com> Message-Id: <20210409120422.144040-4-mreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2021-04-09mirror: Do not enter a paused job on completionMax Reitz1-1/+5
Currently, it is impossible to complete jobs on standby (i.e. paused ready jobs), but actually the only thing in mirror_complete() that does not work quite well with a paused job is the job_enter() at the end. If we make it conditional, this function works just fine even if the mirror job is paused. So technically this is a no-op, but obviously the intention is to accept block-job-complete even for jobs on standby, which we need this patch for first. Signed-off-by: Max Reitz <mreitz@redhat.com> Message-Id: <20210409120422.144040-3-mreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2021-04-09mirror: Move open_backing_file to exit_commonMax Reitz1-14/+8
This is a graph change and therefore should be done in job-finalize (which is what invokes mirror_exit_common()). Signed-off-by: Max Reitz <mreitz@redhat.com> Message-Id: <20210409120422.144040-2-mreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2021-04-09hw/block/fdc: Fix 'fallback' property on sysbus floppy disk controllersPhilippe Mathieu-Daudé1-2/+2
Setting the 'fallback' property corrupts the QOM instance state (FDCtrlSysBus) because it accesses an incorrect offset (it uses the offset of the FDCtrlISABus state). Cc: qemu-stable@nongnu.org Fixes: a73275dd6fc ("fdc: Add fallback option") Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210407133742.1680424-1-f4bug@amsat.org> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2021-04-09iotests: Test mirror-top filter permissionsMax Reitz2-0/+126
Add a test accompanying commit 53431b9086b2832ca1aeff0c55e186e9ed79bd11 ("block/mirror: Fix mirror_top's permissions"). Signed-off-by: Max Reitz <mreitz@redhat.com> Message-Id: <20210331122815.51491-1-mreitz@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2021-04-09iotests: add test for removing persistent bitmap from backing fileVladimir Sementsov-Ogievskiy2-0/+75
Just demonstrate one of x-blockdev-reopen usecases. We can't simply remove persistent bitmap from RO node (for example from backing file), as we need to remove it from the image too. So, we should reopen the node first. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Message-Id: <20210401161522.8001-1-vsementsov@virtuozzo.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2021-04-09iotests/qsd-jobs: Filter events in the first testMax Reitz2-11/+4
The job may or may not be ready before the 'quit' is issued. Whether it is is irrelevant; for the purpose of the test, it only needs to still be there. Filter the job status change and READY events from the output so it becomes reliable. Reported-by: Peter Maydell <peter.maydell@linaro.org> Suggested-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Signed-off-by: Max Reitz <mreitz@redhat.com> Message-Id: <20210401132839.139939-1-mreitz@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2021-04-09block/rbd: fix memory leak in qemu_rbd_co_create_opts()Stefano Garzarella1-0/+1
When we allocate 'q_namespace', we forgot to set 'has_q_namespace' to true. This can cause several issues, including a memory leak, since qapi_free_BlockdevCreateOptions() does not deallocate that memory, as reported by valgrind: 13 bytes in 1 blocks are definitely lost in loss record 7 of 96 at 0x4839809: malloc (vg_replace_malloc.c:307) by 0x48CEBB8: g_malloc (in /usr/lib64/libglib-2.0.so.0.6600.8) by 0x48E3FE3: g_strdup (in /usr/lib64/libglib-2.0.so.0.6600.8) by 0x180010: qemu_rbd_co_create_opts (rbd.c:446) by 0x1AE72C: bdrv_create_co_entry (block.c:492) by 0x241902: coroutine_trampoline (coroutine-ucontext.c:173) by 0x57530AF: ??? (in /usr/lib64/libc-2.32.so) by 0x1FFEFFFA6F: ??? Fix setting 'has_q_namespace' to true when we allocate 'q_namespace'. Fixes: 19ae9ae014 ("block/rbd: Add support for ceph namespaces") Signed-off-by: Stefano Garzarella <sgarzare@redhat.com> Message-Id: <20210329150129.121182-3-sgarzare@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2021-04-09block/rbd: fix memory leak in qemu_rbd_connect()Stefano Garzarella1-4/+5
In qemu_rbd_connect(), 'mon_host' is allocated by qemu_rbd_mon_host() using g_strjoinv(), but it's only freed in the error path, leaking memory in the success path as reported by valgrind: 80 bytes in 4 blocks are definitely lost in loss record 5,028 of 6,516 at 0x4839809: malloc (vg_replace_malloc.c:307) by 0x5315BB8: g_malloc (in /usr/lib64/libglib-2.0.so.0.6600.8) by 0x532B6FF: g_strjoinv (in /usr/lib64/libglib-2.0.so.0.6600.8) by 0x87D07E: qemu_rbd_mon_host (rbd.c:538) by 0x87D07E: qemu_rbd_connect (rbd.c:562) by 0x87E1CE: qemu_rbd_open (rbd.c:740) by 0x840EB1: bdrv_open_driver (block.c:1528) by 0x8453A9: bdrv_open_common (block.c:1802) by 0x8453A9: bdrv_open_inherit (block.c:3444) by 0x8464C2: bdrv_open (block.c:3537) by 0x8108CD: qmp_blockdev_add (blockdev.c:3569) by 0x8EA61B: qmp_marshal_blockdev_add (qapi-commands-block-core.c:1086) by 0x90B528: do_qmp_dispatch_bh (qmp-dispatch.c:131) by 0x907EA4: aio_bh_poll (async.c:164) Fix freeing 'mon_host' also when qemu_rbd_connect() ends correctly. Fixes: 0a55679b4a5061f4d74bdb1a0e81611ba3390b00 Signed-off-by: Stefano Garzarella <sgarzare@redhat.com> Message-Id: <20210329150129.121182-2-sgarzare@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2021-04-09s390x: css: report errors from ccw_dstream_read/writePierre Morel4-27/+69
ccw_dstream_read/write functions returned values are sometime not taking into account and reported back to the upper level of interpretation of CCW instructions. It follows that accessing an invalid address does not trigger a subchannel status program check to the guest as it should. Let's test the return values of ccw_dstream_write[_buf] and ccw_dstream_read[_buf] and report it to the caller. Cc: qemu-stable@nongnu.org Signed-off-by: Pierre Morel <pmorel@linux.ibm.com> Acked-by: Halil Pasic <pasic@linux.ibm.com> Message-Id: <1617899529-9329-2-git-send-email-pmorel@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2021-04-08tap-win32: correctly recycle buffersJason Wang1-2/+4
Commit 969e50b61a28 ("net: Pad short frames to minimum size before sending from SLiRP/TAP") tries to pad frames but try to recyle the local array that is used for padding to tap thread. This patch fixes this by recyling the original buffer. Fixes: 969e50b61a28 ("net: Pad short frames to minimum size before sending from SLiRP/TAP") Tested-by: Howard Spoelstra <hsp.cat7@gmail.com> Tested-by: Bin Meng <bmeng.cn@gmail.com> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-04-08Revert "qapi: net: Add query-netdev command"Jason Wang12-477/+9
Several issues has been reported for query-netdev series. Consider it's late in the rc, this reverts commit d32ad10a14d46dfe9304e3ed5858a11dcd5c71a0. Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-04-08Revert "tests: Add tests for query-netdev command"Jason Wang2-123/+0
Several issues has been reported for query-netdev series. Consider it's late in the rc, this reverts commit 3c3b656885473ef0d699290ba966177f17839aa5. Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-04-08Revert "net: Move NetClientState.info_str to dynamic allocations"Jason Wang11-47/+49
Several issues has been reported for query-netdev info series. Consider it's late in the rc, this reverts commit commit 59b5437eb732d6b103a9bc279c3482c834d1eff9. Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-04-08Revert "hmp: Use QAPI NetdevInfo in hmp_info_network"Jason Wang4-254/+1
Several issues has been reported for query-netdev info series. Consider it's late in the rc, this reverts commit a0724776c5a98a08fc946bb5a4ad16410ca64c0e. Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-04-08Revert "net: Do not fill legacy info_str for backends"Jason Wang8-0/+48
Several issues has been reported for query-netdev info series. Consider it's late in the rc, this reverts commit f2e8319d456724c3d8514d943dc4607e2f08e88a. Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-04-07tests/migration: fix parameter of auto-converge migrationHyman Huang(黄勇)1-2/+2
when execute the following test command: $ ./guestperf-batch.py --auto-converge \ --auto-converge-step {percent} ... test aborts and error message be throwed as the following: "Parameter 'x-cpu-throttle-increment' is unexpected" The reason is that 'x-cpu-throttle-increment' has been deprecated and 'cpu-throttle-increment' was introduced Since v2.7. Use the new parameter instead. Signed-off-by: Hyman Huang(黄勇) <huangy81@chinatelecom.cn> Message-Id: <0195d34a317ce3cc417b3efd275e30cad35a7618.1616513998.git.huangy81@chinatelecom.cn> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2021-04-07migration: Rename 'bs' to 'block' in background snapshot codeAndrey Gruzdev1-42/+44
Rename 'bs' to commonly used 'block' in migration/ram.c background snapshot code. Signed-off-by: Andrey Gruzdev <andrey.gruzdev@virtuozzo.com> Reported-by: David Hildenbrand <david@redhat.com> Message-Id: <20210401092226.102804-5-andrey.gruzdev@virtuozzo.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2021-04-07migration: Pre-fault memory before starting background snasphotAndrey Gruzdev3-0/+58
This commit solves the issue with userfault_fd WP feature that background snapshot is based on. For any never poluated or discarded memory page, the UFFDIO_WRITEPROTECT ioctl() would skip updating PTE for that page, thereby loosing WP setting for it. So we need to pre-fault pages for each RAM block to be protected before making a userfault_fd wr-protect ioctl(). Fixes: 278e2f551a095b234de74dca9c214d5502a1f72c (migration: support UFFD write fault processing in ram_save_iterate()) Signed-off-by: Andrey Gruzdev <andrey.gruzdev@virtuozzo.com> Reported-by: David Hildenbrand <david@redhat.com> Reviewed-by: David Hildenbrand <david@redhat.com> Message-Id: <20210401092226.102804-4-andrey.gruzdev@virtuozzo.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> dgilbert: Bodged ifdef __linux__ on ram_write_tracking_prepare, should really go in a stub
2021-04-07linux-user: Use signed lengths in uaccess.cRichard Henderson2-12/+15
Partially revert 09f679b62dff, but only for the length arguments. Instead of reverting to long, use ssize_t. Reinstate the > 0 check in unlock_user. Fixes: 09f679b62dff Reported-by: Coverity (CID 1446711) Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210315204004.2025219-1-richard.henderson@linaro.org> [lv: remove superfluous semicolon] Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-04-07hw/block/nvme: fix out-of-bounds read in nvme_subsys_ctrlKlaus Jensen1-1/+1
nvme_subsys_ctrl() is used in contexts where the given controller identifier is from an untrusted source. Like its friends nvme_ns() and nvme_subsys_ns(), nvme_subsys_ctrl() should just return NULL if an invalid identifier is given. Fixes: 645ce1a70cb6 ("hw/block/nvme: support namespace attachment command") Cc: Minwoo Im <minwoo.im.dev@gmail.com> Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Minwoo Im <minwoo.im.dev@gmail.com>
2021-04-07hw/block/nvme: fix assert crash in nvme_subsys_nsKlaus Jensen1-3/+1
nvme_subsys_ns() is used in contexts where the namespace identifier is taken from an untrusted source. Commit 3921756dee6d ("hw/block/nvme: assert namespaces array indices") tried to guard against this by introducing an assert on the namespace identifier. This is wrong since it is perfectly valid to call the function with an invalid namespace identifier and like nvme_ns(), nvme_subsys_ns() should simply return NULL. Fixes: 3921756dee6d ("hw/block/nvme: assert namespaces array indices") Fixes: 94d8d6d16781 ("hw/block/nvme: support allocated namespace type") Cc: Minwoo Im <minwoo.im.dev@gmail.com> Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Minwoo Im <minwoo.im.dev@gmail.com>
2021-04-07hw/block/nvme: fix ns attachment out-of-bounds readKlaus Jensen1-0/+1
nvme_ns_attachment() does not verify the contents of the host-supplied 16 bit "Number of Identifiers" field in the command payload. Make sure the value is capped at 2047 and fix the out-of-bounds read. Fixes: 645ce1a70cb6 ("hw/block/nvme: support namespace attachment command") Cc: Minwoo Im <minwoo.im.dev@gmail.com> Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Minwoo Im <minwoo.im.dev@gmail.com>
2021-04-07hw/block/nvme: add missing copyright headersKlaus Jensen2-0/+20
Add missing license/copyright headers to the nvme-dif.{c,h} files. Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Keith Busch <kbusch@kernel.org>
2021-04-07hw/block/nvme: fix handling of private namespacesKlaus Jensen8-170/+115
Prior to this patch, if a private nvme-ns device (that is, a namespace that is not linked to a subsystem) is wired up to an nvme-subsys linked nvme controller device, the device fails to verify that the namespace id is unique within the subsystem. NVM Express v1.4b, Section 6.1.6 ("NSID and Namespace Usage") states that because the device supports Namespace Management, "NSIDs *shall* be unique within the NVM subsystem". Additionally, prior to this patch, private namespaces are not known to the subsystem and the namespace is considered exclusive to the controller with which it is initially wired up to. However, this is not the definition of a private namespace; per Section 1.6.33 ("private namespace"), a private namespace is just a namespace that does not support multipath I/O or namespace sharing, which means "that it is only able to be attached to one controller at a time". Fix this by always allocating namespaces in the subsystem (if one is linked to the controller), regardless of the shared/private status of the namespace. Whether or not the namespace is shareable is controlled by a new `shared` nvme-ns parameter. Finally, this fix allows the nvme-ns `subsys` parameter to be removed, since the `shared` parameter now serves the purpose of attaching the namespace to all controllers in the subsystem upon device realization. It is invalid to have an nvme-ns namespace device with a linked subsystem without the parent nvme controller device also being linked to one and since the nvme-ns devices will unconditionally be "attached" (in QEMU terms that is) to an nvme controller device through an NvmeBus, the nvme-ns namespace device can always get a reference to the subsystem of the controller it is explicitly (using 'bus=' parameter) or implicitly attaching to. Fixes: e570768566b3 ("hw/block/nvme: support for shared namespace in subsystem") Cc: Minwoo Im <minwoo.im.dev@gmail.com> Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Gollu Appalanaidu <anaidu.gollu@samsung.com> Reviewed-by: Keith Busch <kbusch@kernel.org> Reviewed-by: Minwoo Im <minwoo.im.dev@gmail.com>
2021-04-07hw/block/nvme: update dmsrl limit on namespace detachmentKlaus Jensen1-0/+17
The Non-MDTS DMSRL limit must be recomputed when namespaces are detached. Fixes: 645ce1a70cb6 ("hw/block/nvme: support namespace attachment command") Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Gollu Appalanaidu <anaidu.gollu@samsung.com> Reviewed-by: Keith Busch <kbusch@kernel.org>
2021-04-07hw/block/nvme: fix warning about legacy namespace configurationKlaus Jensen2-6/+0
Remove the unused BlockConf from the controller structure and remove the noop constraint checking. Device works just fine with both legacy drive parameter namespace and nvme-ns namespace definitions. Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Gollu Appalanaidu <anaidu.gollu@samsung.com>
2021-04-06hw/block/nvme: fix the nsid 'invalid' valueKlaus Jensen1-1/+1
The `nvme_nsid()` function returns '-1' (FFFFFFFFh) when the given namespace is NULL. Since FFFFFFFFh is actually a valid namespace identifier (the "broadcast" value), change this to be '0' since that actually *is* the invalid value. Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Gollu Appalanaidu <anaidu.gollu@samsung.com> Reviewed-by: Keith Busch <kbusch@kernel.org>
2021-04-06hw/block/nvme: fix missing string representation for ns attachmentKlaus Jensen1-0/+1
Add the missing nvme_adm_opc_str entry for the Namespace Attachment command. Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Gollu Appalanaidu <anaidu.gollu@samsung.com> Reviewed-by: Keith Busch <kbusch@kernel.org>
2021-04-06hw/block/nvme: fix pi constraint checkKlaus Jensen1-1/+1
Protection Information can only be enabled if there is at least 8 bytes of metadata. Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Reviewed-by: Gollu Appalanaidu <anaidu.gollu@samsung.com> Reviewed-by: Keith Busch <kbusch@kernel.org>
2021-04-06migration: Inhibit virtio-balloon for the duration of background snapshotAndrey Gruzdev3-2/+16
The same thing as for incoming postcopy - we cannot deal with concurrent RAM discards when using background snapshot feature in outgoing migration. Fixes: 8518278a6af589ccc401f06e35f171b1e6fae800 (migration: implementation of background snapshot thread) Signed-off-by: Andrey Gruzdev <andrey.gruzdev@virtuozzo.com> Reported-by: David Hildenbrand <david@redhat.com> Reviewed-by: David Hildenbrand <david@redhat.com> Message-Id: <20210401092226.102804-3-andrey.gruzdev@virtuozzo.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2021-04-06migration: Fix missing qemu_fflush() on buffer file in bg_migration_threadAndrey Gruzdev1-1/+7
Added missing qemu_fflush() on buffer file holding precopy device state. Increased initial QIOChannelBuffer allocation to 512KB to avoid reallocs. Typical configurations often require >200KB for device state and VMDESC. Fixes: 8518278a6af589ccc401f06e35f171b1e6fae800 (migration: implementation of background snapshot thread) Signed-off-by: Andrey Gruzdev <andrey.gruzdev@virtuozzo.com> Message-Id: <20210401092226.102804-2-andrey.gruzdev@virtuozzo.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2021-04-06virtiofsd: Fix security.capability comparisonDr. David Alan Gilbert1-1/+2
My security fix for the security.capability remap has a silly early segfault in a simple case where there is an xattrmapping but it doesn't remap the security.capability. Fixes: e586edcb41054 ("virtiofs: drop remapped security.capability xattr as needed") Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-Id: <20210401145845.78445-1-dgilbert@redhat.com> Reviewed-by: Connor Kuehl <ckuehl@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2021-04-06Update version for v6.0.0-rc2 releasePeter Maydell1-1/+1
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-04-06gitlab-ci.yml: Test the dtrace backend in one of the jobsThomas Huth2-1/+2
We are using the dtrace backend in downstream RHEL, so testing this in the CentOS 8 task seems to be a good fit. Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Willian Rampazzo <willianr@redhat.com> Message-Id: <20210331160351.3071279-1-thuth@redhat.com> Message-Id: <20210401102530.12030-12-alex.bennee@linaro.org>
2021-04-06gitlab-ci.yml: Fix the filtering for the git submodulesThomas Huth1-1/+1
Commit 7d7dbf9dc15be6e introduced a new line starting with "GIT_SUBMODULES_ACTION=" in the config-host.mak file. The grep that tries to determine the submodules in the gitlab-ci.yml file matches this new line, too, causing a warning message when updating the modules: warn: ignoring non-existent submodule GIT_SUBMODULES_ACTION=update Fix it by matching the "GIT_SUBMODULES=..." line only. Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Willian Rampazzo <willianr@redhat.com> Message-Id: <20210331073316.2965928-1-thuth@redhat.com> Message-Id: <20210401102530.12030-11-alex.bennee@linaro.org>
2021-04-06docs/system/gdb.rst: Document how to debug multicore machinesPeter Maydell1-0/+55
Document how multicore machines appear to GDB when debugged via the debug stub. This is particularly non-intuitive for the "multiple heterogenous clusters" case, but unfortunately as far as I know there is no way with the remote protocol for the stub to tell gdb "I have 2 inferiors, please connect to both", so the user must set it all up manually. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210325175023.13838-3-peter.maydell@linaro.org> Message-Id: <20210401102530.12030-10-alex.bennee@linaro.org>
2021-04-06docs/system/gdb.rst: Add some more heading structurePeter Maydell1-1/+7
We're about to add a new section to gdb.rst. In preparation, add some more headings so it isn't just one huge run-on section. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210325175023.13838-2-peter.maydell@linaro.org> Message-Id: <20210401102530.12030-9-alex.bennee@linaro.org>