Re: [Qemu-block] [PATCH] nvme: fix oob access issue(CVE-2018-16847)

Ping what't the status of this patch. I see Kevin's new pr doesn't contain this patch. Thanks, Li Qiang Li Qiang 于2018年11月2日周五 上午9:22写道： > Currently, the nvme_cmb_ops mr doesn't check the addr and size. > This can lead an oob access issue. This is triggerable in the guest. > Add check to

Re: [Qemu-block] [Qemu-devel] How to emulate block I/O timeout on qemu side?

On 11/13/2018 06:52 AM, Marc Olson via Qemu-devel wrote: > On 11/11/18 11:36 PM, Dongli Zhang wrote: >> On 11/12/2018 03:13 PM, Marc Olson via Qemu-devel wrote: >>> On 11/3/18 10:24 AM, Dongli Zhang wrote: The 'write' latency of sector=40960 is set to a very large value. When the I/O

Re: [Qemu-block] [Qemu-devel] [PATCH v2 07/11] block: Leave BDS.backing_file constant

On 8/9/18 5:31 PM, Max Reitz wrote: Parts of the block layer treat BDS.backing_file as if it were whatever the image header says (i.e., if it is a relative path, it is relative to the overlay), other parts treat it like a cache for bs->backing->bs->filename (relative paths are relative to the

Re: [Qemu-block] [Qemu-devel] [PATCH v2 06/11] iotests: Add tests for mirror @replaces loops

On 8/9/18 5:31 PM, Max Reitz wrote: This adds two tests for cases where our old check_to_replace_node() function failed to detect that executing this job with these parameters would result in a cyclic graph. Signed-off-by: Max Reitz --- tests/qemu-iotests/041 | 124

Re: [Qemu-block] [Qemu-devel] How to emulate block I/O timeout on qemu side?

On 11/11/18 11:36 PM, Dongli Zhang wrote: On 11/12/2018 03:13 PM, Marc Olson via Qemu-devel wrote: On 11/3/18 10:24 AM, Dongli Zhang wrote: The 'write' latency of sector=40960 is set to a very large value. When the I/O is stalled in guest due to that sector=40960 is accessed, I do see below

Re: [Qemu-block] [for 3.1? Qemu-devel] [PATCH v2 05/11] block: Fix check_to_replace_node()

On 8/9/18 5:31 PM, Max Reitz wrote: Currently, check_to_replace_node() only allows mirror to replace a node in the chain of the source node, and only if it is the first non-filter node below the source. Well, technically, the idea is that you can exactly replace a quorum child by mirroring from

Re: [Qemu-block] [Qemu-devel] [PATCH v2 04/11] block: Storage child access function

On 8/9/18 5:31 PM, Max Reitz wrote: For completeness' sake, add a function for accessing a node's storage child, too. For filters, this is there filtered child; for non-filters, s/there/their/ this is bs->file. Some places are deliberately left unconverted: - BDS opening/closing functions

Re: [Qemu-block] [Qemu-devel] [PATCH v2 03/11] block: Filtered children access functions

On 8/9/18 5:31 PM, Max Reitz wrote: What bs->file and bs->backing mean depends on the node. For filter nodes, both signify a node that will eventually receive all R/W accesses. For format nodes, bs->file contains metadata and data, and bs->backing will not receive writes -- instead, writes are

Re: [Qemu-block] [PATCH for-3.1] fdc: fix segfault in fdctrl_stop_transfer() when DMA is disabled

On 11/11/18 4:40 AM, Mark Cave-Ayland wrote: > Commit c8a35f1cf0f "fdc: use IsaDma interface instead of global DMA_* > functions" accidentally introduced a segfault in fdctrl_stop_transfer() for > non-DMA transfers. > > If fdctrl->dma_chann has not been configured then the fdctrl->dma

Re: [Qemu-block] [PATCH for-3.1] fdc: fix segfault in fdctrl_stop_transfer() when DMA is disabled

Le 11/11/2018 à 10:40, Mark Cave-Ayland a écrit : Commit c8a35f1cf0f "fdc: use IsaDma interface instead of global DMA_* functions" accidentally introduced a segfault in fdctrl_stop_transfer() for non-DMA transfers. If fdctrl->dma_chann has not been configured then the fdctrl->dma interface

Re: [Qemu-block] [RFC PATCH 0/2] Acceptance tests for qemu-img

On 11/12/18 11:00 AM, Kevin Wolf wrote: > Am 12.11.2018 um 15:59 hat Cleber Rosa geschrieben: >> >> On 11/12/18 5:49 AM, Kevin Wolf wrote: >>> Am 09.11.2018 um 23:12 hat Cleber Rosa geschrieben: The initial goal of this RFC is to get feedback on tests not specific to the QEMU main

[Qemu-block] [PULL 13/14] block: Fix potential Null pointer dereferences in vvfat.c

From: Liam Merwick The calls to find_mapping_for_cluster() may return NULL but it isn't always checked for before dereferencing the value returned. Additionally, add some asserts to cover cases where NULL can't be returned but which might not be obvious at first glance. Signed-off-by: Liam

[Qemu-block] [PULL 08/14] tests: Add unit tests for image locking

From: Fam Zheng Signed-off-by: Fam Zheng Signed-off-by: Kevin Wolf --- tests/test-image-locking.c | 157 + tests/Makefile.include | 2 + 2 files changed, 159 insertions(+) create mode 100644 tests/test-image-locking.c diff --git

[Qemu-block] [PULL 09/14] block: Make more block drivers compile-time configurable

From: Jeff Cody This adds configure options to control the following block drivers: * Bochs * Cloop * Dmg * Qcow (V1) * Vdi * Vvfat * qed * parallels * sheepdog Each of these defaults to being enabled. Signed-off-by: Jeff Cody Signed-off-by: Markus Armbruster Message-id:

[Qemu-block] [PULL 12/14] qemu-img: assert block_job_get() does not return NULL in img_commit()

From: Liam Merwick Although the function block_job_get() can return NULL, it would be a serious bug if it did so (because the job yields before executing anything (if it started successfully); but otherwise, commit_active_start() would have returned an error). However, as a precaution, before

[Qemu-block] [PULL 06/14] file-posix: Skip effectiveless OFD lock operations

From: Fam Zheng If we know we've already locked the bytes, don't do it again; similarly don't unlock a byte if we haven't locked it. This doesn't change the behavior, but fixes a corner case explained below. Libvirt had an error handling bug that an image can get its (ownership, file mode,

[Qemu-block] [PULL 04/14] nvme: don't unref ctrl_mem when device unrealized

From: Li Qiang Currently, when hotplug/unhotplug nvme device, it will cause an assert in object.c. Following is the backtrack: ERROR:qom/object.c:981:object_unref: assertion failed: (obj->ref > 0) Thread 2 "qemu-system-x86" received signal SIGABRT, Aborted. [Switching to Thread 0x7fffcbd32700

[Qemu-block] [PULL 10/14] job: Fix off-by-one assert checks for JobSTT and JobVerbTable

From: Liam Merwick In the assert checking the array dereference of JobVerbTable[verb] in job_apply_verb() the check of the index, verb, allows an overrun because an index equal to the array size is permitted. Similarly, in the assert check of JobSTT[s0][s1] with index s1 in

[Qemu-block] [PULL 05/14] nvme: free cmbuf in nvme_exit

From: Li Qiang This avoid a memory leak in unhotplug nvme device. Signed-off-by: Li Qiang Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Kevin Wolf --- hw/block/nvme.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/hw/block/nvme.c b/hw/block/nvme.c index 359a06d0ad..09d7c90259

[Qemu-block] [PULL 14/14] qcow2: Read outside array bounds in qcow2_pre_write_overlap_check()

From: Liam Merwick The commit for 0e4e4318eaa5 increments QCOW2_OL_MAX_BITNR but does not add an array entry for QCOW2_OL_BITMAP_DIRECTORY_BITNR to metadata_ol_names[]. As a result, an array dereference of metadata_ol_names[8] in qcow2_pre_write_overlap_check() could result in a read outside of

[Qemu-block] [PULL 07/14] file-posix: Drop s->lock_fd

From: Fam Zheng The lock_fd field is not strictly necessary because transferring locked bytes from old fd to the new one shouldn't fail anyway. This spares the user one fd per image. Signed-off-by: Fam Zheng Reviewed-by: Max Reitz Signed-off-by: Kevin Wolf --- block/file-posix.c | 37

[Qemu-block] [PULL 02/14] blockdev: handle error on block latency histogram set error

From: zhenwei pi Function block_latency_histogram_set may return error, but qapi ignore this. This can be reproduced easily by qmp command: virsh qemu-monitor-command INSTANCE '{"execute":"x-block-latency-histogram-set", "arguments":{"device":"drive-virtio-disk1","boundaries":[10,200,40]}}' In

[Qemu-block] [PULL 11/14] block: Null pointer dereference in blk_root_get_parent_desc()

From: Liam Merwick The dev_id returned by the call to blk_get_attached_dev_id() in blk_root_get_parent_desc() can be NULL (an internal call to object_get_canonical_path may have returned NULL). Instead of just checking this case before before dereferencing, adjust blk_get_attached_dev_id() to

[Qemu-block] [PULL 01/14] file-posix: Use error API properly

From: Fam Zheng Use error_report for situations that affect user operation (i.e. we're actually returning error), and warn_report/warn_report_err when some less critical error happened but the user operation can still carry on. For raw_normalize_devicepath, add Error parameter to propagate to

[Qemu-block] [PULL 00/14] Block layer patches

The following changes since commit 5704c36d25ee84e7129722cb0db53df9faefe943: Merge remote-tracking branch 'remotes/kraxel/tags/fixes-31-20181112-pull-request' into staging (2018-11-12 15:55:40 +) are available in the Git repository at: git://repo.or.cz/qemu/kevin.git tags/for-upstream

[Qemu-block] [PULL 03/14] blockdev: Consistently use snapshot_node_name in external_snapshot_prepare()

From: Peter Maydell In the function external_snapshot_prepare() we have a BlockdevSnapshotSync struct, which has the usual combination of has_snapshot_node_name and snapshot_node_name fields for an optional field. We set up a local variable const char *snapshot_node_name =

Re: [Qemu-block] [PATCH 00/12] file-posix: Simplify delegation to worker thread

Am 31.10.2018 um 22:56 hat Kevin Wolf geschrieben: > This series cleans up and simplifies the code that calls worker thread > functions for the various operations in the file-posix driver. This > results in less indirection and better readability as well as reduced > heap allocations because we

Re: [Qemu-block] [PATCH 0/7] qcow2 decompress in threads

12.11.2018 18:32, Kevin Wolf wrote: > Am 01.11.2018 um 19:27 hat Vladimir Sementsov-Ogievskiy geschrieben: >> Hi all! >> >> The series brings threads to qcow2 decompression path, like it is >> already done for compression. > > Thanks! Nice series, I like it a lot. Thank you! > > I fixed some

Re: [Qemu-block] KVM Forum block no[td]es

On Mon, Nov 12, 2018 at 5:26 PM Max Reitz wrote: > On 12.11.18 00:36, Nir Soffer wrote: > > On Mon, Nov 12, 2018 at 12:25 AM Max Reitz > > wrote: > > > > This is what I’ve taken from two or three BoF-like get-togethers on > > blocky things. Amendments are more

Re: [Qemu-block] [RFC PATCH 0/2] Acceptance tests for qemu-img

Am 12.11.2018 um 15:59 hat Cleber Rosa geschrieben: > > On 11/12/18 5:49 AM, Kevin Wolf wrote: > > Am 09.11.2018 um 23:12 hat Cleber Rosa geschrieben: > >> The initial goal of this RFC is to get feedback on tests not specific > >> to the QEMU main binary, but specific to other components such as

Re: [Qemu-block] [PATCH v5 1/9] qapi: group BlockDeviceStats fields

On Wed 31 Oct 2018 12:34:40 PM CET, Anton Nefedov wrote: > Make the stat fields definition slightly more readable. > Also reorder total_time_ns stats read-write-flush as done elsewhere. > Cosmetic change only. > > Signed-off-by: Anton Nefedov Reviewed-by: Alberto Garcia Berto

Re: [Qemu-block] [PATCH 0/7] qcow2 decompress in threads

Am 01.11.2018 um 19:27 hat Vladimir Sementsov-Ogievskiy geschrieben: > Hi all! > > The series brings threads to qcow2 decompression path, like it is > already done for compression. Thanks! Nice series, I like it a lot. I fixed some non-function stuff like the coroutine_fn tags and comment

Re: [Qemu-block] KVM Forum block no[td]es

On 12.11.18 00:36, Nir Soffer wrote: > On Mon, Nov 12, 2018 at 12:25 AM Max Reitz > wrote: > > This is what I’ve taken from two or three BoF-like get-togethers on > blocky things.  Amendments are more than welcome, of course. > > ...  > > Bitmaps > >

Re: [Qemu-block] [PATCH v4 14/15] block: Remove assertions from update_flags_from_options()

On 12.11.18 11:26, Alberto Garcia wrote: > On Sun 11 Nov 2018 10:01:05 PM CET, Max Reitz wrote: >> On 07.11.18 13:59, Alberto Garcia wrote: >>> This function takes three options (cache.direct, cache.no-flush and >>> read-only) from a QemuOpts object and updates the flags accordingly. >> >> and

Re: [Qemu-block] [Qemu-devel] [RFC PATCH 0/2] Acceptance tests for qemu-img

On Mon, Nov 12, 2018 at 09:59:56AM -0500, Cleber Rosa wrote: > > On 11/12/18 5:49 AM, Kevin Wolf wrote: > > Am 09.11.2018 um 23:12 hat Cleber Rosa geschrieben: > >> The initial goal of this RFC is to get feedback on tests not specific > >> to the QEMU main binary, but specific to other components

Re: [Qemu-block] [RFC PATCH 2/2] qemu-img: consider a zero number of I/O requests an invalid count

On 11/12/18 9:38 AM, Philippe Mathieu-Daudé wrote: > On 9/11/18 23:12, Cleber Rosa wrote: >> It's debatable whether it makes sense to consider the bench command >> successful when no I/O requests will be performed.  This changes the >> behavior to consider a zero count of I/O requests an

Re: [Qemu-block] [RFC PATCH 0/2] Acceptance tests for qemu-img

On 11/12/18 5:49 AM, Kevin Wolf wrote: > Am 09.11.2018 um 23:12 hat Cleber Rosa geschrieben: >> The initial goal of this RFC is to get feedback on tests not specific >> to the QEMU main binary, but specific to other components such as >> qemu-img. >> >> For this experiment, a small issue with

Re: [Qemu-block] [PATCH] crypto: Fix defaults in QCryptoBlockCreateOptionsLUKS

On Mon, Nov 12, 2018 at 03:45:45PM +0100, Alberto Garcia wrote: > ping Sorry, I should have said I queued this patch when adding my previous R-b. > On Fri 05 Oct 2018 04:52:02 PM CEST, Alberto Garcia wrote: > > The values specified in the documentation don't match the actual > > defaults set in

Re: [Qemu-block] [PATCH] crypto: Fix defaults in QCryptoBlockCreateOptionsLUKS

ping On Fri 05 Oct 2018 04:52:02 PM CEST, Alberto Garcia wrote: > The values specified in the documentation don't match the actual > defaults set in qcrypto_block_luks_create(). > > Signed-off-by: Alberto Garcia > --- > qapi/crypto.json | 6 +++--- > 1 file changed, 3 insertions(+), 3

Re: [Qemu-block] [RFC PATCH 2/2] qemu-img: consider a zero number of I/O requests an invalid count

On 9/11/18 23:12, Cleber Rosa wrote: It's debatable whether it makes sense to consider the bench command successful when no I/O requests will be performed. This changes the behavior to consider a zero count of I/O requests an invalid value. While at it, avoid using signed types for number of

[Qemu-block] [PATCH v5 04/16] block: Use bdrv_reopen_set_read_only() in bdrv_commit()

This patch replaces the bdrv_reopen() calls that set and remove the BDRV_O_RDWR flag with the new bdrv_reopen_set_read_only() function. Signed-off-by: Alberto Garcia Reviewed-by: Max Reitz --- block/commit.c | 7 +++ 1 file changed, 3 insertions(+), 4 deletions(-) diff --git

[Qemu-block] [PATCH v5 00/16] Don't pass flags to bdrv_reopen_queue()

Hi all, when reopening a BlockDriverState using bdrv_reopen() and friends the new options can be specified either with a QDict or with flags. Both methods overlap and that makes the semantics and the implementation unnecessarily complicated. This series removes the 'flags' parameter from these

[Qemu-block] [PATCH v5 07/16] block: Use bdrv_reopen_set_read_only() in external_snapshot_commit()

This patch replaces the bdrv_reopen() call that set and remove the BDRV_O_RDWR flag with the new bdrv_reopen_set_read_only() function. Signed-off-by: Alberto Garcia Reviewed-by: Max Reitz --- blockdev.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/blockdev.c

[Qemu-block] [PATCH v5 01/16] block: Add bdrv_reopen_set_read_only()

Most callers of bdrv_reopen() only use it to switch a BlockDriverState between read-only and read-write, so this patch adds a new function that does just that. We also want to get rid of the flags parameter in the bdrv_reopen() API, so this function sets the "read-only" option and passes the

[Qemu-block] [PATCH v5 10/16] qemu-io: Put flag changes in the options QDict in reopen_f()

When reopen_f() puts a block device in the reopen queue, some of the new options are passed using a QDict, but others ("read-only" and the cache options) are passed as flags. This patch puts those flags in the QDict. This way the flags parameter becomes redundant and we'll be able to get rid of

[Qemu-block] [PATCH v5 06/16] block: Use bdrv_reopen_set_read_only() in qmp_change_backing_file()

This patch replaces the bdrv_reopen() calls that set and remove the BDRV_O_RDWR flag with the new bdrv_reopen_set_read_only() function. Signed-off-by: Alberto Garcia Reviewed-by: Max Reitz --- blockdev.c | 8 ++-- 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/blockdev.c

[Qemu-block] [PATCH v5 13/16] block: Stop passing flags to bdrv_reopen_queue_child()

Now that all callers are passing the new options using the QDict we no longer need the 'flags' parameter. This patch makes the following changes: 1) The update_options_from_flags() call is no longer necessary so it can be removed. 2) The update_flags_from_options() call is now used

[Qemu-block] [PATCH v5 15/16] block: Assert that flags are up-to-date in bdrv_reopen_prepare()

Towards the end of bdrv_reopen_queue_child(), before starting to process the children, the update_flags_from_options() function is called in order to have BDRVReopenState.flags in sync with the options from the QDict. This is necessary because during the reopen process flags must be updated for

[Qemu-block] [PATCH v5 03/16] block: Use bdrv_reopen_set_read_only() in commit_start/complete()

This patch replaces the bdrv_reopen() calls that set and remove the BDRV_O_RDWR flag with the new bdrv_reopen_set_read_only() function. Signed-off-by: Alberto Garcia Reviewed-by: Max Reitz --- block/commit.c | 16 ++-- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git

[Qemu-block] [PATCH v5 14/16] block: Remove assertions from update_flags_from_options()

This function takes four options (cache.direct, cache.no-flush, read-only and auto-read-only) from a QemuOpts object and updates the flags accordingly. If any of those options is not set (because it was missing from the original QDict or because it had an invalid value) then the function aborts

[Qemu-block] [PATCH v5 11/16] block: Clean up reopen_backing_file() in block/replication.c

This function is used to put the hidden and secondary disks in read-write mode before launching the backup job, and back in read-only mode afterwards. This patch does the following changes: - Use an options QDict with the "read-only" option instead of passing the changes as flags only.

[Qemu-block] [PATCH v5 09/16] block: Drop bdrv_reopen()

No one is using this function anymore, so we can safely remove it. Signed-off-by: Alberto Garcia Reviewed-by: Max Reitz --- block.c | 21 - include/block/block.h | 1 - 2 files changed, 22 deletions(-) diff --git a/block.c b/block.c index

[Qemu-block] [PATCH v5 05/16] block: Use bdrv_reopen_set_read_only() in stream_start/complete()

This patch replaces the bdrv_reopen() calls that set and remove the BDRV_O_RDWR flag with the new bdrv_reopen_set_read_only() function. Signed-off-by: Alberto Garcia Reviewed-by: Max Reitz --- block/stream.c | 20 ++-- 1 file changed, 10 insertions(+), 10 deletions(-) diff

[Qemu-block] [PATCH v5 02/16] block: Use bdrv_reopen_set_read_only() in bdrv_backing_update_filename()

This patch replaces the bdrv_reopen() calls that set and remove the BDRV_O_RDWR flag with the new bdrv_reopen_set_read_only() function. Signed-off-by: Alberto Garcia Reviewed-by: Max Reitz --- block.c | 10 +- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/block.c

[Qemu-block] [PATCH v5 12/16] block: Remove flags parameter from bdrv_reopen_queue()

Now that all callers are passing all flag changes as QDict options, the flags parameter is no longer necessary, so we can get rid of it. Signed-off-by: Alberto Garcia Reviewed-by: Max Reitz --- block.c | 5 +++-- block/replication.c | 6 ++ include/block/block.h | 3 +--

[Qemu-block] [PATCH v5 16/16] block: Fix update of BDRV_O_AUTO_RDONLY in update_flags_from_options()

Commit e35bdc123a4ace9f4d3fcca added the auto-read-only option and the code to update its corresponding flag in update_flags_from_options(), but forgot to clear the flag if auto-read-only is false. Signed-off-by: Alberto Garcia Reported-by: Max Reitz --- block.c | 4 +--- 1 file changed, 1

[Qemu-block] [PATCH v5 08/16] block: Use bdrv_reopen_set_read_only() in the mirror driver

The 'block-commit' QMP command is implemented internally using two different drivers. If the source image is the active layer then the mirror driver is used (commit_active_start()), otherwise the commit driver is used (commit_start()). In both cases the destination image must be put temporarily

Re: [Qemu-block] [Qemu-devel] [PATCH v3 1/3] blkdebug: fix one shot rule processing

Hi Marc, When I play with the v3 patch set, the qemu hangs again and I need to kill it with "kill -9". I got below from guest: [ 104.828127] nvme nvme0: I/O 52 QID 1 timeout, aborting [ 104.828470] nvme nvme0: Abort status: 0x4001 nvme abort is not supported by qemu and therefore 0x4001

Re: [Qemu-block] [RFC PATCH 0/2] Acceptance tests for qemu-img

Am 09.11.2018 um 23:12 hat Cleber Rosa geschrieben: > The initial goal of this RFC is to get feedback on tests not specific > to the QEMU main binary, but specific to other components such as > qemu-img. > > For this experiment, a small issue with the zero and negative number > of I/O operations

Re: [Qemu-block] [PATCH v4 14/15] block: Remove assertions from update_flags_from_options()

On Sun 11 Nov 2018 10:01:05 PM CET, Max Reitz wrote: >> -assert(qemu_opt_find(opts, BDRV_OPT_CACHE_DIRECT)); >> if (qemu_opt_get_bool_del(opts, BDRV_OPT_CACHE_DIRECT, false)) { >> *flags |= BDRV_O_NOCACHE; >> } >> >> *flags &= ~BDRV_O_RDWR; > > Unrelated to this

Re: [Qemu-block] [PATCH v4 14/15] block: Remove assertions from update_flags_from_options()

On Sun 11 Nov 2018 10:01:05 PM CET, Max Reitz wrote: > On 07.11.18 13:59, Alberto Garcia wrote: >> This function takes three options (cache.direct, cache.no-flush and >> read-only) from a QemuOpts object and updates the flags accordingly. > > and auto-read-only now Oops, will update. > Hm, seems

Re: [Qemu-block] [Qemu-devel] [PATCH] tests: Fix Python 3 detection on older GNU make versions

Max Reitz writes: > On 08.11.18 13:43, Markus Armbruster wrote: >> Philippe Mathieu-Daudé writes: >> >>> Hi Markus, >>> >>> >>> Le jeu. 8 nov. 2018 09:46, Markus Armbruster a écrit : >>> Cleber Rosa writes: > On 11/7/18 1:05 AM, Markus Armbruster wrote: >> [...] >> PEP 394