Series comparison

-[Qemu-devel] [PULL 0/5] Block patches
+[Qemu-devel] [PULL 0/8] Block patches
-The following changes since commit a0def594286d9110a6035e02eef558cf3cf5d847:
+The following changes since commit 812b835fb4d23dd108b2f9802158472d50b73579:
-  Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging (2017-01-30 10:23:20 +0000)
+  Merge remote-tracking branch 'remotes/maxreitz/tags/pull-block-2019-05-07' into staging (2019-05-09 16:31:12 +0100)
-are available in the git repository at:
+are available in the Git repository at:
-  https://github.com/codyprime/qemu-kvm-jtc.git tags/block-pull-request
+  https://github.com/stefanha/qemu.git tags/block-pull-request
-for you to fetch changes up to acf6e5f0962c4be670d4a93ede77423512521876:
+for you to fetch changes up to e84125761f78919fe63616d9888ea45e72dc956f:
-  sheepdog: reorganize check for overlapping requests (2017-02-01 00:17:20 -0500)
+  docs: add Security chapter to the documentation (2019-05-10 10:53:52 +0100)
 ----------------------------------------------------------------
-Block patches
+Pull request
 ----------------------------------------------------------------
-Paolo Bonzini (5):
+Andrey Shinkevich (1):
-  sheepdog: remove unused cancellation support
+  block/io.c: fix for the allocation failure
   sheepdog: reorganize coroutine flow
   sheepdog: do not use BlockAIOCB
   sheepdog: simplify inflight_aio_head management
   sheepdog: reorganize check for overlapping requests
- block/sheepdog.c | 289 ++++++++++++++++---------------------------------------
+Jules Irenge (3):
-file changed, 84 insertions(+), 205 deletions(-)
+  util/readline: add a space to fix errors by checkpatch tool
   util: readline: replace tab indent by four spaces to fix checkpatch
     errors
   util/readline: Add braces to fix checkpatch errors
 Nikita Alekseev (1):
   block: Add coroutine_fn to bdrv_check_co_entry
 Paolo Bonzini (1):
   aio-posix: ensure poll mode is left when aio_notify is called
 Stefan Hajnoczi (2):
   docs: add Secure Coding Practices to developer docs
   docs: add Security chapter to the documentation
  Makefile                               |   2 +-
  block.c                                |   2 +-
  block/io.c                             |   2 +-
  util/aio-posix.c                       |  12 +-
  util/readline.c                        | 174 ++++++++++++++-----------
  docs/devel/index.rst                   |   1 +
  docs/devel/secure-coding-practices.rst | 106 +++++++++++++++
  docs/security.texi                     | 131 +++++++++++++++++++
  qemu-doc.texi                          |   3 +
 files changed, 347 insertions(+), 86 deletions(-)
  create mode 100644 docs/devel/secure-coding-practices.rst
  create mode 100644 docs/security.texi
 --
-.9.3
+.21.0

-New patch
+[Qemu-devel] [PULL 1/8] util/readline: add a space to fix errors by checkpatch tool
+From: Jules Irenge <jbi.octave@gmail.com>
+util/readline: add a space to fix errors reported by checkpatch.pl tool
+"ERROR: space required before the open parenthesis"
+"ERROR: space required after that ..."
+within "util/redline.c" file
+Signed-off-by: Jules Irenge <jbi.octave@gmail.com>
+Reviewed-by: Thomas Huth <thuth@redhat.com>
+Message-id: 20190401024406.10819-2-jbi.octave@gmail.com
+Message-Id: <20190401024406.10819-2-jbi.octave@gmail.com>
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ util/readline.c | 34 +++++++++++++++++-----------------
+file changed, 17 insertions(+), 17 deletions(-)
+diff --git a/util/readline.c b/util/readline.c
+index XXXXXXX..XXXXXXX 100644
+--- a/util/readline.c
++++ b/util/readline.c
+@@ -XXX,XX +XXX,XX @@ static void readline_update(ReadLineState *rs)
+     if (rs->cmd_buf_size != rs->last_cmd_buf_size ||
+         memcmp(rs->cmd_buf, rs->last_cmd_buf, rs->cmd_buf_size) != 0) {
+-        for(i = 0; i < rs->last_cmd_buf_index; i++) {
++        for (i = 0; i < rs->last_cmd_buf_index; i++) {
+             rs->printf_func(rs->opaque, "\033[D");
+         }
+         rs->cmd_buf[rs->cmd_buf_size] = '\0';
+         if (rs->read_password) {
+             len = strlen(rs->cmd_buf);
+-            for(i = 0; i < len; i++)
++            for (i = 0; i < len; i++)
+                 rs->printf_func(rs->opaque, "*");
+         } else {
+             rs->printf_func(rs->opaque, "%s", rs->cmd_buf);
+@@ -XXX,XX +XXX,XX @@ static void readline_update(ReadLineState *rs)
+     if (rs->cmd_buf_index != rs->last_cmd_buf_index) {
+         delta = rs->cmd_buf_index - rs->last_cmd_buf_index;
+         if (delta > 0) {
+-            for(i = 0;i < delta; i++) {
++            for (i = 0; i < delta; i++) {
+                 rs->printf_func(rs->opaque, "\033[C");
+             }
+         } else {
+             delta = -delta;
+-            for(i = 0;i < delta; i++) {
++            for (i = 0; i < delta; i++) {
+                 rs->printf_func(rs->opaque, "\033[D");
+             }
+         }
+@@ -XXX,XX +XXX,XX @@ static void readline_completion(ReadLineState *rs)
+         return;
+     if (rs->nb_completions == 1) {
+         len = strlen(rs->completions[0]);
+-        for(i = rs->completion_index; i < len; i++) {
++        for (i = rs->completion_index; i < len; i++) {
+             readline_insert_char(rs, rs->completions[0][i]);
+         }
+         /* extra space for next argument. XXX: make it more generic */
+@@ -XXX,XX +XXX,XX @@ static void readline_completion(ReadLineState *rs)
+               completion_comp);
+         rs->printf_func(rs->opaque, "\n");
+         max_width = 0;
+-        max_prefix = 0;
+-        for(i = 0; i < rs->nb_completions; i++) {
++        max_prefix = 0;
++        for (i = 0; i < rs->nb_completions; i++) {
+             len = strlen(rs->completions[i]);
+-            if (i==0) {
++            if (i == 0) {
+                 max_prefix = len;
+             } else {
+                 if (len < max_prefix)
+                     max_prefix = len;
+-                for(j=0; j<max_prefix; j++) {
++                for (j = 0; j < max_prefix; j++) {
+                     if (rs->completions[i][j] != rs->completions[0][j])
+                         max_prefix = j;
+                 }
+@@ -XXX,XX +XXX,XX @@ static void readline_completion(ReadLineState *rs)
+             if (len > max_width)
+                 max_width = len;
+         }
+-        if (max_prefix > 0)
+-            for(i = rs->completion_index; i < max_prefix; i++) {
++        if (max_prefix > 0)
++            for (i = rs->completion_index; i < max_prefix; i++) {
+                 readline_insert_char(rs, rs->completions[0][i]);
+             }
+         max_width += 2;
+@@ -XXX,XX +XXX,XX @@ static void readline_completion(ReadLineState *rs)
+             max_width = 80;
+         nb_cols = 80 / max_width;
+         j = 0;
+-        for(i = 0; i < rs->nb_completions; i++) {
++        for (i = 0; i < rs->nb_completions; i++) {
+             rs->printf_func(rs->opaque, "%-*s", max_width, rs->completions[i]);
+             if (++j == nb_cols || i == (rs->nb_completions - 1)) {
+                 rs->printf_func(rs->opaque, "\n");
+@@ -XXX,XX +XXX,XX @@ static void readline_clear_screen(ReadLineState *rs)
+ /* return true if command handled */
+ void readline_handle_byte(ReadLineState *rs, int ch)
+ {
+-    switch(rs->esc_state) {
++    switch (rs->esc_state) {
+     case IS_NORM:
+-        switch(ch) {
++        switch (ch) {
+         case 1:
+             readline_bol(rs);
+             break;
+@@ -XXX,XX +XXX,XX @@ void readline_handle_byte(ReadLineState *rs, int ch)
+         }
+         break;
+     case IS_CSI:
+-        switch(ch) {
++        switch (ch) {
+     case 'A':
+     case 'F':
+         readline_up_char(rs);
+@@ -XXX,XX +XXX,XX @@ void readline_handle_byte(ReadLineState *rs, int ch)
+             rs->esc_param = rs->esc_param * 10 + (ch - '0');
+             goto the_end;
+         case '~':
+-            switch(rs->esc_param) {
++            switch (rs->esc_param) {
+             case 1:
+                 readline_bol(rs);
+                 break;
+@@ -XXX,XX +XXX,XX @@ void readline_handle_byte(ReadLineState *rs, int ch)
+     the_end:
+         break;
+     case IS_SS3:
+-        switch(ch) {
++        switch (ch) {
+         case 'F':
+             readline_eol(rs);
+             break;
+--
+.21.0

-[Qemu-devel] [PULL 5/5] sheepdog: reorganize check for overlapping requests
+[Qemu-devel] [PULL 2/8] util: readline: replace tab indent by four spaces to fix checkpatch errors
-From: Paolo Bonzini <pbonzini@redhat.com>
+From: Jules Irenge <jbi.octave@gmail.com>
-Wrap the code that was copied repeatedly in the two functions,
+Replace tab indent by four spaces to fix errors issued by checkpatch.pl tool
-sd_aio_setup and sd_aio_complete.
+"ERROR: code indent should never use tabs" within "util/readline.c" file.
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Jules Irenge <jbi.octave@gmail.com>
-Message-id: 20161129113245.32724-6-pbonzini@redhat.com
+Reviewed-by: Thomas Huth <thuth@redhat.com>
-Signed-off-by: Jeff Cody <jcody@redhat.com>
+Message-id: 20190401024406.10819-3-jbi.octave@gmail.com
 Message-Id: <20190401024406.10819-3-jbi.octave@gmail.com>
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
- block/sheepdog.c | 66 ++++++++++++++++++++++++++------------------------------
+ util/readline.c | 98 ++++++++++++++++++++++++-------------------------
-file changed, 30 insertions(+), 36 deletions(-)
+file changed, 49 insertions(+), 49 deletions(-)
-diff --git a/block/sheepdog.c b/block/sheepdog.c
+diff --git a/util/readline.c b/util/readline.c
 index XXXXXXX..XXXXXXX 100644
---- a/block/sheepdog.c
+--- a/util/readline.c
-+++ b/block/sheepdog.c
++++ b/util/readline.c
-@@ -XXX,XX +XXX,XX @@ static inline AIOReq *alloc_aio_req(BDRVSheepdogState *s, SheepdogAIOCB *acb,
+@@ -XXX,XX +XXX,XX @@ static void readline_up_char(ReadLineState *rs)
-     return aio_req;
+     int idx;
- }
+     if (rs->hist_entry == 0)
-+static void wait_for_overlapping_aiocb(BDRVSheepdogState *s, SheepdogAIOCB *acb)
+-    return;
-+{
++        return;
-+    SheepdogAIOCB *cb;
+     if (rs->hist_entry == -1) {
-+
+-    /* Find latest entry */
-+retry:
+-    for (idx = 0; idx < READLINE_MAX_CMDS; idx++) {
-+    QLIST_FOREACH(cb, &s->inflight_aiocb_head, aiocb_siblings) {
+-        if (rs->history[idx] == NULL)
-+        if (AIOCBOverlapping(acb, cb)) {
+-        break;
-+            qemu_co_queue_wait(&s->overlapping_queue);
+-    }
-+            goto retry;
+-    rs->hist_entry = idx;
 +        /* Find latest entry */
 +        for (idx = 0; idx < READLINE_MAX_CMDS; idx++) {
 +            if (rs->history[idx] == NULL)
 +                break;
 +        }
-+    }
++        rs->hist_entry = idx;
-+}
+     }
-+
+     rs->hist_entry--;
- static void sd_aio_setup(SheepdogAIOCB *acb, BDRVSheepdogState *s,
+     if (rs->hist_entry >= 0) {
-                          QEMUIOVector *qiov, int64_t sector_num, int nb_sectors,
+-    pstrcpy(rs->cmd_buf, sizeof(rs->cmd_buf),
-                          int type)
++        pstrcpy(rs->cmd_buf, sizeof(rs->cmd_buf),
-@@ -XXX,XX +XXX,XX @@ static void sd_aio_setup(SheepdogAIOCB *acb, BDRVSheepdogState *s,
+                 rs->history[rs->hist_entry]);
-     acb->min_dirty_data_idx = UINT32_MAX;
+-    rs->cmd_buf_index = rs->cmd_buf_size = strlen(rs->cmd_buf);
-     acb->max_dirty_data_idx = 0;
++        rs->cmd_buf_index = rs->cmd_buf_size = strlen(rs->cmd_buf);
      acb->aiocb_type = type;
 +
 +    if (type == AIOCB_FLUSH_CACHE) {
 +        return;
 +    }
 +
 +    wait_for_overlapping_aiocb(s, acb);
 +    QLIST_INSERT_HEAD(&s->inflight_aiocb_head, acb, aiocb_siblings);
  }
  /* Return -EIO in case of error, file descriptor on success */
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn sd_co_rw_vector(SheepdogAIOCB *acb)
      }
  }
--static bool check_overlapping_aiocb(BDRVSheepdogState *s, SheepdogAIOCB *aiocb)
+@@ -XXX,XX +XXX,XX @@ static void readline_down_char(ReadLineState *rs)
-+static void sd_aio_complete(SheepdogAIOCB *acb)
+         return;
- {
+     if (rs->hist_entry < READLINE_MAX_CMDS - 1 &&
--    SheepdogAIOCB *cb;
+         rs->history[++rs->hist_entry] != NULL) {
--
+-    pstrcpy(rs->cmd_buf, sizeof(rs->cmd_buf),
--    QLIST_FOREACH(cb, &s->inflight_aiocb_head, aiocb_siblings) {
++        pstrcpy(rs->cmd_buf, sizeof(rs->cmd_buf),
--        if (AIOCBOverlapping(aiocb, cb)) {
+                 rs->history[rs->hist_entry]);
--            return true;
+     } else {
--        }
+         rs->cmd_buf[0] = 0;
-+    if (acb->aiocb_type == AIOCB_FLUSH_CACHE) {
+-    rs->hist_entry = -1;
 +        rs->hist_entry = -1;
      }
      rs->cmd_buf_index = rs->cmd_buf_size = strlen(rs->cmd_buf);
  }
@@ -XXX,XX +XXX,XX @@ static void readline_hist_add(ReadLineState *rs, const char *cmdline)
      int idx;
      if (cmdline[0] == '\0')
 -    return;
 +        return;
+     new_entry = NULL;
+     if (rs->hist_entry != -1) {
+-    /* We were editing an existing history entry: replace it */
+-    hist_entry = rs->history[rs->hist_entry];
+-    idx = rs->hist_entry;
+-    if (strcmp(hist_entry, cmdline) == 0) {
+-        goto same_entry;
+-    }
++        /* We were editing an existing history entry: replace it */
++        hist_entry = rs->history[rs->hist_entry];
++        idx = rs->hist_entry;
++        if (strcmp(hist_entry, cmdline) == 0) {
++            goto same_entry;
++        }
      }
+     /* Search cmdline in history buffers */
--    QLIST_INSERT_HEAD(&s->inflight_aiocb_head, aiocb, aiocb_siblings);
+     for (idx = 0; idx < READLINE_MAX_CMDS; idx++) {
--    return false;
+-    hist_entry = rs->history[idx];
-+    QLIST_REMOVE(acb, aiocb_siblings);
+-    if (hist_entry == NULL)
-+    qemu_co_queue_restart_all(&acb->s->overlapping_queue);
+-        break;
- }
+-    if (strcmp(hist_entry, cmdline) == 0) {
+-    same_entry:
- static coroutine_fn int sd_co_writev(BlockDriverState *bs, int64_t sector_num,
+-        new_entry = hist_entry;
-@@ -XXX,XX +XXX,XX @@ static coroutine_fn int sd_co_writev(BlockDriverState *bs, int64_t sector_num,
+-        /* Put this entry at the end of history */
 -        memmove(&rs->history[idx], &rs->history[idx + 1],
 -            (READLINE_MAX_CMDS - (idx + 1)) * sizeof(char *));
 -        rs->history[READLINE_MAX_CMDS - 1] = NULL;
 -        for (; idx < READLINE_MAX_CMDS; idx++) {
 -        if (rs->history[idx] == NULL)
 -            break;
 -        }
 -        break;
 -    }
 +        hist_entry = rs->history[idx];
 +        if (hist_entry == NULL)
 +            break;
 +        if (strcmp(hist_entry, cmdline) == 0) {
 +        same_entry:
 +            new_entry = hist_entry;
 +            /* Put this entry at the end of history */
 +            memmove(&rs->history[idx], &rs->history[idx + 1],
 +                    (READLINE_MAX_CMDS - (idx + 1)) * sizeof(char *));
 +            rs->history[READLINE_MAX_CMDS - 1] = NULL;
 +            for (; idx < READLINE_MAX_CMDS; idx++) {
 +                if (rs->history[idx] == NULL)
 +                    break;
 +            }
 +            break;
 +        }
      }
+     if (idx == READLINE_MAX_CMDS) {
-     sd_aio_setup(&acb, s, qiov, sector_num, nb_sectors, AIOCB_WRITE_UDATA);
+-    /* Need to get one free slot */
--
++        /* Need to get one free slot */
--retry:
+         g_free(rs->history[0]);
--    if (check_overlapping_aiocb(s, &acb)) {
+-    memmove(rs->history, &rs->history[1],
--        qemu_co_queue_wait(&s->overlapping_queue);
+-            (READLINE_MAX_CMDS - 1) * sizeof(char *));
--        goto retry;
+-    rs->history[READLINE_MAX_CMDS - 1] = NULL;
--    }
+-    idx = READLINE_MAX_CMDS - 1;
--
++        memmove(rs->history, &rs->history[1],
-     sd_co_rw_vector(&acb);
++                (READLINE_MAX_CMDS - 1) * sizeof(char *));
-     sd_write_done(&acb);
++        rs->history[READLINE_MAX_CMDS - 1] = NULL;
-+    sd_aio_complete(&acb);
++        idx = READLINE_MAX_CMDS - 1;
 -    QLIST_REMOVE(&acb, aiocb_siblings);
 -    qemu_co_queue_restart_all(&s->overlapping_queue);
      return acb.ret;
  }
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int sd_co_readv(BlockDriverState *bs, int64_t sector_num,
      BDRVSheepdogState *s = bs->opaque;
      sd_aio_setup(&acb, s, qiov, sector_num, nb_sectors, AIOCB_READ_UDATA);
 -
 -retry:
 -    if (check_overlapping_aiocb(s, &acb)) {
 -        qemu_co_queue_wait(&s->overlapping_queue);
 -        goto retry;
 -    }
 -
      sd_co_rw_vector(&acb);
 +    sd_aio_complete(&acb);
 -    QLIST_REMOVE(&acb, aiocb_siblings);
 -    qemu_co_queue_restart_all(&s->overlapping_queue);
      return acb.ret;
  }
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn sd_co_flush_to_disk(BlockDriverState *bs)
      if (--acb.nr_pending) {
          qemu_coroutine_yield();
      }
-+
+     if (new_entry == NULL)
-+    sd_aio_complete(&acb);
+         new_entry = g_strdup(cmdline);
-     return acb.ret;
+@@ -XXX,XX +XXX,XX @@ void readline_handle_byte(ReadLineState *rs, int ch)
- }
+         case 8:
+             readline_backspace(rs);
-@@ -XXX,XX +XXX,XX @@ static coroutine_fn int sd_co_pdiscard(BlockDriverState *bs, int64_t offset,
+             break;
-     }
+-    case 155:
-     sd_aio_setup(&acb, s, &discard_iov, offset >> BDRV_SECTOR_BITS,
++        case 155:
-                  count >> BDRV_SECTOR_BITS, AIOCB_DISCARD_OBJ);
+             rs->esc_state = IS_CSI;
--
+-        break;
--retry:
++            break;
--    if (check_overlapping_aiocb(s, &acb)) {
+         default:
--        qemu_co_queue_wait(&s->overlapping_queue);
+             if (ch >= 32) {
--        goto retry;
+                 readline_insert_char(rs, ch);
--    }
+@@ -XXX,XX +XXX,XX @@ void readline_handle_byte(ReadLineState *rs, int ch)
--
+         break;
-     sd_co_rw_vector(&acb);
+     case IS_CSI:
-+    sd_aio_complete(&acb);
+         switch (ch) {
+-    case 'A':
--    QLIST_REMOVE(&acb, aiocb_siblings);
+-    case 'F':
--    qemu_co_queue_restart_all(&s->overlapping_queue);
+-        readline_up_char(rs);
-     return acb.ret;
+-        break;
- }
+-    case 'B':
+-    case 'E':
 -        readline_down_char(rs);
 -        break;
 +        case 'A':
 +        case 'F':
 +            readline_up_char(rs);
 +            break;
 +        case 'B':
 +        case 'E':
 +            readline_down_char(rs);
 +            break;
          case 'D':
              readline_backward_char(rs);
              break;
 --
-.9.3
+.21.0

-[Qemu-devel] [PULL 2/5] sheepdog: reorganize coroutine flow
+[Qemu-devel] [PULL 3/8] util/readline: Add braces to fix checkpatch errors
-From: Paolo Bonzini <pbonzini@redhat.com>
+From: Jules Irenge <jbi.octave@gmail.com>
-Delimit co_recv's lifetime clearly in aio_read_response.
+Add braces to fix errors issued by checkpatch.pl tool
 "ERROR: braces {} are necessary for all arms of this statement"
 Within "util/readline.c" file
 Message-Id: <20190330112142.14082-1-jbi.octave@gmail.com>
-Do a simple qemu_coroutine_enter in aio_read_response, letting
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-sd_co_writev call sd_write_done.
+---
  util/readline.c | 50 ++++++++++++++++++++++++++++++++-----------------
 file changed, 33 insertions(+), 17 deletions(-)
-Handle nr_pending in the same way in sd_co_rw_vector,
+diff --git a/util/readline.c b/util/readline.c
 sd_write_done and sd_co_flush_to_disk.
 Remove sd_co_rw_vector's return value; just leave with no
 pending requests.
 [Jeff: added missing 'return' back, spotted by Paolo after
        series was applied.]
 Signed-off-by: Jeff Cody <jcody@redhat.com>
 ---
  block/sheepdog.c | 115 ++++++++++++++++++++-----------------------------------
 file changed, 42 insertions(+), 73 deletions(-)
 diff --git a/block/sheepdog.c b/block/sheepdog.c
 index XXXXXXX..XXXXXXX 100644
---- a/block/sheepdog.c
+--- a/util/readline.c
-+++ b/block/sheepdog.c
++++ b/util/readline.c
-@@ -XXX,XX +XXX,XX @@ struct SheepdogAIOCB {
+@@ -XXX,XX +XXX,XX @@ static void readline_update(ReadLineState *rs)
-     enum AIOCBState aiocb_type;
+         rs->cmd_buf[rs->cmd_buf_size] = '\0';
+         if (rs->read_password) {
-     Coroutine *coroutine;
+             len = strlen(rs->cmd_buf);
--    void (*aio_done_func)(SheepdogAIOCB *);
+-            for (i = 0; i < len; i++)
--
++            for (i = 0; i < len; i++) {
-     int nr_pending;
+                 rs->printf_func(rs->opaque, "*");
++            }
-     uint32_t min_affect_data_idx;
+         } else {
-@@ -XXX,XX +XXX,XX @@ static const char * sd_strerror(int err)
+             rs->printf_func(rs->opaque, "%s", rs->cmd_buf);
-  *
+         }
-  * 1. In sd_co_rw_vector, we send the I/O requests to the server and
+@@ -XXX,XX +XXX,XX @@ static void readline_up_char(ReadLineState *rs)
-  *    link the requests to the inflight_list in the
+ {
-- *    BDRVSheepdogState.  The function exits without waiting for
+     int idx;
-+ *    BDRVSheepdogState.  The function yields while waiting for
-  *    receiving the response.
+-    if (rs->hist_entry == 0)
-  *
++    if (rs->hist_entry == 0) {
-  * 2. We receive the response in aio_read_response, the fd handler to
+         return;
-- *    the sheepdog connection.  If metadata update is needed, we send
++    }
-- *    the write request to the vdi object in sd_write_done, the write
+     if (rs->hist_entry == -1) {
-- *    completion function.  We switch back to sd_co_readv/writev after
+         /* Find latest entry */
-- *    all the requests belonging to the AIOCB are finished.
+         for (idx = 0; idx < READLINE_MAX_CMDS; idx++) {
-+ *    the sheepdog connection.  We switch back to sd_co_readv/sd_writev
+-            if (rs->history[idx] == NULL)
-+ *    after all the requests belonging to the AIOCB are finished.  If
++            if (rs->history[idx] == NULL) {
-+ *    needed, sd_co_writev will send another requests for the vdi object.
+                 break;
-  */
++            }
+         }
- static inline AIOReq *alloc_aio_req(BDRVSheepdogState *s, SheepdogAIOCB *acb,
+         rs->hist_entry = idx;
-@@ -XXX,XX +XXX,XX @@ static inline void free_aio_req(BDRVSheepdogState *s, AIOReq *aio_req)
+     }
-     acb->nr_pending--;
+@@ -XXX,XX +XXX,XX @@ static void readline_up_char(ReadLineState *rs)
- }
+ static void readline_down_char(ReadLineState *rs)
--static void coroutine_fn sd_finish_aiocb(SheepdogAIOCB *acb)
+ {
--{
+-    if (rs->hist_entry == -1)
--    qemu_coroutine_enter(acb->coroutine);
++    if (rs->hist_entry == -1) {
--    qemu_aio_unref(acb);
+         return;
--}
++    }
--
+     if (rs->hist_entry < READLINE_MAX_CMDS - 1 &&
- static const AIOCBInfo sd_aiocb_info = {
+         rs->history[++rs->hist_entry] != NULL) {
-     .aiocb_size     = sizeof(SheepdogAIOCB),
+         pstrcpy(rs->cmd_buf, sizeof(rs->cmd_buf),
- };
+@@ -XXX,XX +XXX,XX @@ static void readline_hist_add(ReadLineState *rs, const char *cmdline)
-@@ -XXX,XX +XXX,XX @@ static SheepdogAIOCB *sd_aio_setup(BlockDriverState *bs, QEMUIOVector *qiov,
+     char *hist_entry, *new_entry;
-     acb->sector_num = sector_num;
+     int idx;
-     acb->nb_sectors = nb_sectors;
+-    if (cmdline[0] == '\0')
--    acb->aio_done_func = NULL;
++    if (cmdline[0] == '\0') {
-     acb->coroutine = qemu_coroutine_self();
+         return;
-     acb->ret = 0;
++    }
-     acb->nr_pending = 0;
+     new_entry = NULL;
-@@ -XXX,XX +XXX,XX @@ static void coroutine_fn aio_read_response(void *opaque)
+     if (rs->hist_entry != -1) {
+         /* We were editing an existing history entry: replace it */
-     switch (acb->aiocb_type) {
+@@ -XXX,XX +XXX,XX @@ static void readline_hist_add(ReadLineState *rs, const char *cmdline)
-     case AIOCB_WRITE_UDATA:
+     /* Search cmdline in history buffers */
--        /* this coroutine context is no longer suitable for co_recv
+     for (idx = 0; idx < READLINE_MAX_CMDS; idx++) {
--         * because we may send data to update vdi objects */
+         hist_entry = rs->history[idx];
--        s->co_recv = NULL;
+-        if (hist_entry == NULL)
-         if (!is_data_obj(aio_req->oid)) {
++        if (hist_entry == NULL) {
              break;
 +        }
          if (strcmp(hist_entry, cmdline) == 0) {
          same_entry:
              new_entry = hist_entry;
@@ -XXX,XX +XXX,XX @@ static void readline_hist_add(ReadLineState *rs, const char *cmdline)
                      (READLINE_MAX_CMDS - (idx + 1)) * sizeof(char *));
              rs->history[READLINE_MAX_CMDS - 1] = NULL;
              for (; idx < READLINE_MAX_CMDS; idx++) {
 -                if (rs->history[idx] == NULL)
 +                if (rs->history[idx] == NULL) {
                      break;
 +                }
              }
              break;
          }
-@@ -XXX,XX +XXX,XX @@ static void coroutine_fn aio_read_response(void *opaque)
+@@ -XXX,XX +XXX,XX @@ static void readline_hist_add(ReadLineState *rs, const char *cmdline)
          rs->history[READLINE_MAX_CMDS - 1] = NULL;
          idx = READLINE_MAX_CMDS - 1;
      }
 -    if (new_entry == NULL)
 +    if (new_entry == NULL) {
          new_entry = g_strdup(cmdline);
 +    }
      rs->history[idx] = new_entry;
      rs->hist_entry = -1;
  }
@@ -XXX,XX +XXX,XX @@ static void readline_completion(ReadLineState *rs)
      g_free(cmdline);
      /* no completion found */
 -    if (rs->nb_completions <= 0)
 +    if (rs->nb_completions <= 0) {
          return;
 +    }
      if (rs->nb_completions == 1) {
          len = strlen(rs->completions[0]);
          for (i = rs->completion_index; i < len; i++) {
              readline_insert_char(rs, rs->completions[0][i]);
          }
-     }
+         /* extra space for next argument. XXX: make it more generic */
+-        if (len > 0 && rs->completions[0][len - 1] != '/')
-+    /* No more data for this aio_req (reload_inode below uses its own file
++        if (len > 0 && rs->completions[0][len - 1] != '/') {
-+     * descriptor handler which doesn't use co_recv).
+             readline_insert_char(rs, ' ');
-+    */
++        }
-+    s->co_recv = NULL;
+     } else {
-+
+         qsort(rs->completions, rs->nb_completions, sizeof(char *),
-     switch (rsp.result) {
+               completion_comp);
-     case SD_RES_SUCCESS:
+@@ -XXX,XX +XXX,XX @@ static void readline_completion(ReadLineState *rs)
-         break;
+             if (i == 0) {
-@@ -XXX,XX +XXX,XX @@ static void coroutine_fn aio_read_response(void *opaque)
+                 max_prefix = len;
-             aio_req->oid = vid_to_vdi_oid(s->inode.vdi_id);
+             } else {
 -                if (len < max_prefix)
 +                if (len < max_prefix) {
                      max_prefix = len;
 +                }
                  for (j = 0; j < max_prefix; j++) {
 -                    if (rs->completions[i][j] != rs->completions[0][j])
 +                    if (rs->completions[i][j] != rs->completions[0][j]) {
                          max_prefix = j;
 +                    }
                  }
              }
 -            if (len > max_width)
 +            if (len > max_width) {
                  max_width = len;
 +            }
          }
-         resend_aioreq(s, aio_req);
+         if (max_prefix > 0)
--        goto out;
+             for (i = rs->completion_index; i < max_prefix; i++) {
-+        return;
+                 readline_insert_char(rs, rs->completions[0][i]);
-     default:
+             }
-         acb->ret = -EIO;
+         max_width += 2;
-         error_report("%s", sd_strerror(rsp.result));
+-        if (max_width < 10)
-@@ -XXX,XX +XXX,XX @@ static void coroutine_fn aio_read_response(void *opaque)
++        if (max_width < 10) {
-          * We've finished all requests which belong to the AIOCB, so
+             max_width = 10;
-          * we can switch back to sd_co_readv/writev now.
+-        else if (max_width > 80)
-          */
++        } else if (max_width > 80) {
--        acb->aio_done_func(acb);
+             max_width = 80;
-+        qemu_coroutine_enter(acb->coroutine);
++        }
-     }
+         nb_cols = 80 / max_width;
--out:
+         j = 0;
--    s->co_recv = NULL;
+         for (i = 0; i < rs->nb_completions; i++) {
-+
+@@ -XXX,XX +XXX,XX @@ void readline_handle_byte(ReadLineState *rs, int ch)
-     return;
+         case 10:
-+
+         case 13:
- err:
+             rs->cmd_buf[rs->cmd_buf_size] = '\0';
--    s->co_recv = NULL;
+-            if (!rs->read_password)
-     reconnect_to_sdog(opaque);
++            if (!rs->read_password) {
                  readline_hist_add(rs, rs->cmd_buf);
 +            }
              rs->printf_func(rs->opaque, "\n");
              rs->cmd_buf_index = 0;
              rs->cmd_buf_size = 0;
@@ -XXX,XX +XXX,XX @@ void readline_restart(ReadLineState *rs)
  const char *readline_get_history(ReadLineState *rs, unsigned int index)
  {
 -    if (index >= READLINE_MAX_CMDS)
 +    if (index >= READLINE_MAX_CMDS) {
          return NULL;
 +    }
      return rs->history[index];
  }
-@@ -XXX,XX +XXX,XX @@ static int sd_truncate(BlockDriverState *bs, int64_t offset)
- /*
-  * This function is called after writing data objects.  If we need to
-  * update metadata, this sends a write request to the vdi object.
-- * Otherwise, this switches back to sd_co_readv/writev.
-  */
- static void coroutine_fn sd_write_done(SheepdogAIOCB *acb)
- {
-@@ -XXX,XX +XXX,XX @@ static void coroutine_fn sd_write_done(SheepdogAIOCB *acb)
-     mx = acb->max_dirty_data_idx;
-     if (mn <= mx) {
-         /* we need to update the vdi object. */
-+        ++acb->nr_pending;
-         offset = sizeof(s->inode) - sizeof(s->inode.data_vdi_id) +
-             mn * sizeof(s->inode.data_vdi_id[0]);
-         data_len = (mx - mn + 1) * sizeof(s->inode.data_vdi_id[0]);
-@@ -XXX,XX +XXX,XX @@ static void coroutine_fn sd_write_done(SheepdogAIOCB *acb)
-                                 data_len, offset, 0, false, 0, offset);
-         QLIST_INSERT_HEAD(&s->inflight_aio_head, aio_req, aio_siblings);
-         add_aio_request(s, aio_req, &iov, 1, AIOCB_WRITE_UDATA);
--
--        acb->aio_done_func = sd_finish_aiocb;
--        acb->aiocb_type = AIOCB_WRITE_UDATA;
--        return;
-+        if (--acb->nr_pending) {
-+            qemu_coroutine_yield();
-+        }
-     }
--
--    sd_finish_aiocb(acb);
- }
- /* Delete current working VDI on the snapshot chain */
-@@ -XXX,XX +XXX,XX @@ out:
-  * Returns 1 when we need to wait a response, 0 when there is no sent
-  * request and -errno in error cases.
-  */
--static int coroutine_fn sd_co_rw_vector(void *p)
-+static void coroutine_fn sd_co_rw_vector(void *p)
- {
-     SheepdogAIOCB *acb = p;
-     int ret = 0;
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn sd_co_rw_vector(void *p)
-         ret = sd_create_branch(s);
-         if (ret) {
-             acb->ret = -EIO;
--            goto out;
-+            return;
-         }
-     }
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn sd_co_rw_vector(void *p)
-         idx++;
-         done += len;
-     }
--out:
--    if (!--acb->nr_pending) {
--        return acb->ret;
-+    if (--acb->nr_pending) {
-+        qemu_coroutine_yield();
-     }
--    return 1;
- }
- static bool check_overlapping_aiocb(BDRVSheepdogState *s, SheepdogAIOCB *aiocb)
-@@ -XXX,XX +XXX,XX @@ static coroutine_fn int sd_co_writev(BlockDriverState *bs, int64_t sector_num,
-     }
-     acb = sd_aio_setup(bs, qiov, sector_num, nb_sectors);
--    acb->aio_done_func = sd_write_done;
-     acb->aiocb_type = AIOCB_WRITE_UDATA;
- retry:
-@@ -XXX,XX +XXX,XX @@ retry:
-         goto retry;
-     }
--    ret = sd_co_rw_vector(acb);
--    if (ret <= 0) {
--        QLIST_REMOVE(acb, aiocb_siblings);
--        qemu_co_queue_restart_all(&s->overlapping_queue);
--        qemu_aio_unref(acb);
--        return ret;
--    }
--
--    qemu_coroutine_yield();
-+    sd_co_rw_vector(acb);
-+    sd_write_done(acb);
-     QLIST_REMOVE(acb, aiocb_siblings);
-     qemu_co_queue_restart_all(&s->overlapping_queue);
--
--    return acb->ret;
-+    ret = acb->ret;
-+    qemu_aio_unref(acb);
-+    return ret;
- }
- static coroutine_fn int sd_co_readv(BlockDriverState *bs, int64_t sector_num,
-@@ -XXX,XX +XXX,XX @@ static coroutine_fn int sd_co_readv(BlockDriverState *bs, int64_t sector_num,
-     acb = sd_aio_setup(bs, qiov, sector_num, nb_sectors);
-     acb->aiocb_type = AIOCB_READ_UDATA;
--    acb->aio_done_func = sd_finish_aiocb;
- retry:
-     if (check_overlapping_aiocb(s, acb)) {
-@@ -XXX,XX +XXX,XX @@ retry:
-         goto retry;
-     }
--    ret = sd_co_rw_vector(acb);
--    if (ret <= 0) {
--        QLIST_REMOVE(acb, aiocb_siblings);
--        qemu_co_queue_restart_all(&s->overlapping_queue);
--        qemu_aio_unref(acb);
--        return ret;
--    }
--
--    qemu_coroutine_yield();
-+    sd_co_rw_vector(acb);
-     QLIST_REMOVE(acb, aiocb_siblings);
-     qemu_co_queue_restart_all(&s->overlapping_queue);
--    return acb->ret;
-+    ret = acb->ret;
-+    qemu_aio_unref(acb);
-+    return ret;
- }
- static int coroutine_fn sd_co_flush_to_disk(BlockDriverState *bs)
- {
-     BDRVSheepdogState *s = bs->opaque;
-     SheepdogAIOCB *acb;
-+    int ret;
-     AIOReq *aio_req;
-     if (s->cache_flags != SD_FLAG_CMD_CACHE) {
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn sd_co_flush_to_disk(BlockDriverState *bs)
-     acb = sd_aio_setup(bs, NULL, 0, 0);
-     acb->aiocb_type = AIOCB_FLUSH_CACHE;
--    acb->aio_done_func = sd_finish_aiocb;
-+    acb->nr_pending++;
-     aio_req = alloc_aio_req(s, acb, vid_to_vdi_oid(s->inode.vdi_id),
-, 0, 0, false, 0, 0);
-     QLIST_INSERT_HEAD(&s->inflight_aio_head, aio_req, aio_siblings);
-     add_aio_request(s, aio_req, NULL, 0, acb->aiocb_type);
--    qemu_coroutine_yield();
--    return acb->ret;
-+    if (--acb->nr_pending) {
-+        qemu_coroutine_yield();
-+    }
-+    ret = acb->ret;
-+    qemu_aio_unref(acb);
-+    return ret;
- }
- static int sd_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
-@@ -XXX,XX +XXX,XX @@ static coroutine_fn int sd_co_pdiscard(BlockDriverState *bs, int64_t offset,
-     acb = sd_aio_setup(bs, &discard_iov, offset >> BDRV_SECTOR_BITS,
-                        count >> BDRV_SECTOR_BITS);
-     acb->aiocb_type = AIOCB_DISCARD_OBJ;
--    acb->aio_done_func = sd_finish_aiocb;
- retry:
-     if (check_overlapping_aiocb(s, acb)) {
-@@ -XXX,XX +XXX,XX @@ retry:
-         goto retry;
-     }
--    ret = sd_co_rw_vector(acb);
--    if (ret <= 0) {
--        QLIST_REMOVE(acb, aiocb_siblings);
--        qemu_co_queue_restart_all(&s->overlapping_queue);
--        qemu_aio_unref(acb);
--        return ret;
--    }
--
--    qemu_coroutine_yield();
-+    sd_co_rw_vector(acb);
-     QLIST_REMOVE(acb, aiocb_siblings);
-     qemu_co_queue_restart_all(&s->overlapping_queue);
--
--    return acb->ret;
-+    ret = acb->ret;
-+    qemu_aio_unref(acb);
-+    return ret;
- }
- static coroutine_fn int64_t
 --
-.9.3
+.21.0

-New patch
+[Qemu-devel] [PULL 4/8] block: Add coroutine_fn to bdrv_check_co_entry
+From: Nikita Alekseev <n.alekseev2104@gmail.com>
+bdrv_check_co_entry calls bdrv_co_check, which is a coroutine function.
+Thus, it also needs to be marked as a coroutine.
+Signed-off-by: Nikita Alekseev <n.alekseev2104@gmail.com>
+Message-id: 20190401093051.16488-1-n.alekseev2104@gmail.com
+Message-Id: <20190401093051.16488-1-n.alekseev2104@gmail.com>
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ block.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/block.c b/block.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block.c
++++ b/block.c
+@@ -XXX,XX +XXX,XX @@ typedef struct CheckCo {
+     int ret;
+ } CheckCo;
+-static void bdrv_check_co_entry(void *opaque)
++static void coroutine_fn bdrv_check_co_entry(void *opaque)
+ {
+     CheckCo *cco = opaque;
+     cco->ret = bdrv_co_check(cco->bs, cco->res, cco->fix);
+--
+.21.0

-New patch
+[Qemu-devel] [PULL 5/8] block/io.c: fix for the allocation failure
+From: Andrey Shinkevich <andrey.shinkevich@virtuozzo.com>
+On a file system used by the customer, fallocate() returns an error
+if the block is not properly aligned. So, bdrv_co_pwrite_zeroes()
+fails. We can handle that case the same way as it is done for the
+unsupported cases, namely, call to bdrv_driver_pwritev() that writes
+zeroes to an image for the unaligned chunk of the block.
+Suggested-by: Denis V. Lunev <den@openvz.org>
+Signed-off-by: Andrey Shinkevich <andrey.shinkevich@virtuozzo.com>
+Reviewed-by: John Snow <jsnow@redhat.com>
+Message-id: 1554474244-553661-1-git-send-email-andrey.shinkevich@virtuozzo.com
+Message-Id: <1554474244-553661-1-git-send-email-andrey.shinkevich@virtuozzo.com>
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ block/io.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/block/io.c b/block/io.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/io.c
++++ b/block/io.c
+@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_co_do_pwrite_zeroes(BlockDriverState *bs,
+             assert(!bs->supported_zero_flags);
+         }
+-        if (ret == -ENOTSUP && !(flags & BDRV_REQ_NO_FALLBACK)) {
++        if (ret < 0 && !(flags & BDRV_REQ_NO_FALLBACK)) {
+             /* Fall back to bounce buffer if write zeroes is unsupported */
+             BdrvRequestFlags write_flags = flags & ~BDRV_REQ_ZERO_WRITE;
+--
+.21.0

-[Qemu-devel] [PULL 4/5] sheepdog: simplify inflight_aio_head management
+[Qemu-devel] [PULL 6/8] aio-posix: ensure poll mode is left when aio_notify is called
 From: Paolo Bonzini <pbonzini@redhat.com>
-Add to the list in add_aio_request and, indirectly, resend_aioreq.  Inline
+With aio=thread, adaptive polling makes latency worse rather than
-free_aio_req in the caller, it does not simply undo alloc_aio_req's job.
+better, because it delays the execution of the ThreadPool's
 completion bottom half.
+event_notifier_poll() does run while polling, detecting that
+a bottom half was scheduled by a worker thread, but because
+ctx->notifier is explicitly ignored in run_poll_handlers_once(),
+scheduling the BH does not count as making progress and
+run_poll_handlers() keeps running.  Fix this by recomputing
+the deadline after *timeout could have changed.
+With this change, ThreadPool still cannot participate in polling
+but at least it does not suffer from extra latency.
+Reported-by: Sergio Lopez <slp@redhat.com>
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Message-id: 20161129113245.32724-5-pbonzini@redhat.com
+Message-id: 20190409122823.12416-1-pbonzini@redhat.com
-Signed-off-by: Jeff Cody <jcody@redhat.com>
+Cc: Stefan Hajnoczi <stefanha@gmail.com>
 Cc: Kevin Wolf <kwolf@redhat.com>
 Cc: qemu-block@nongnu.org
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 Message-Id: <1553692145-86728-1-git-send-email-pbonzini@redhat.com>
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 Message-Id: <20190409122823.12416-1-pbonzini@redhat.com>
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
- block/sheepdog.c | 23 ++++++-----------------
+ util/aio-posix.c | 12 ++++++++----
-file changed, 6 insertions(+), 17 deletions(-)
+file changed, 8 insertions(+), 4 deletions(-)
-diff --git a/block/sheepdog.c b/block/sheepdog.c
+diff --git a/util/aio-posix.c b/util/aio-posix.c
 index XXXXXXX..XXXXXXX 100644
---- a/block/sheepdog.c
+--- a/util/aio-posix.c
-+++ b/block/sheepdog.c
++++ b/util/aio-posix.c
-@@ -XXX,XX +XXX,XX @@ static inline AIOReq *alloc_aio_req(BDRVSheepdogState *s, SheepdogAIOCB *acb,
+@@ -XXX,XX +XXX,XX @@ static bool run_poll_handlers_once(AioContext *ctx, int64_t *timeout)
-     return aio_req;
+         if (!node->deleted && node->io_poll &&
- }
+             aio_node_check(ctx, node->is_external) &&
+             node->io_poll(node->opaque)) {
--static inline void free_aio_req(BDRVSheepdogState *s, AIOReq *aio_req)
++            /*
--{
++             * Polling was successful, exit try_poll_mode immediately
--    SheepdogAIOCB *acb = aio_req->aiocb;
++             * to adjust the next polling time.
--
++             */
--    QLIST_REMOVE(aio_req, aio_siblings);
+             *timeout = 0;
--    g_free(aio_req);
+             if (node->opaque != &ctx->notifier) {
--
+                 progress = true;
--    acb->nr_pending--;
+@@ -XXX,XX +XXX,XX @@ static bool run_poll_handlers(AioContext *ctx, int64_t max_ns, int64_t *timeout)
--}
+     do {
--
+         progress = run_poll_handlers_once(ctx, timeout);
- static void sd_aio_setup(SheepdogAIOCB *acb, BDRVSheepdogState *s,
+         elapsed_time = qemu_clock_get_ns(QEMU_CLOCK_REALTIME) - start_time;
-                          QEMUIOVector *qiov, int64_t sector_num, int nb_sectors,
+-    } while (!progress && elapsed_time < max_ns
-                          int type)
+-             && !atomic_read(&ctx->poll_disable_cnt));
-@@ -XXX,XX +XXX,XX @@ static coroutine_fn void reconnect_to_sdog(void *opaque)
++        max_ns = qemu_soonest_timeout(*timeout, max_ns);
-     while (!QLIST_EMPTY(&s->failed_aio_head)) {
++        assert(!(max_ns && progress));
-         aio_req = QLIST_FIRST(&s->failed_aio_head);
++    } while (elapsed_time < max_ns && !atomic_read(&ctx->poll_disable_cnt));
-         QLIST_REMOVE(aio_req, aio_siblings);
--        QLIST_INSERT_HEAD(&s->inflight_aio_head, aio_req, aio_siblings);
+     /* If time has passed with no successful polling, adjust *timeout to
-         resend_aioreq(s, aio_req);
+      * keep the same ending time.
-     }
+@@ -XXX,XX +XXX,XX @@ static bool run_poll_handlers(AioContext *ctx, int64_t max_ns, int64_t *timeout)
- }
+  */
-@@ -XXX,XX +XXX,XX @@ static void coroutine_fn aio_read_response(void *opaque)
+ static bool try_poll_mode(AioContext *ctx, int64_t *timeout)
-     */
+ {
-     s->co_recv = NULL;
+-    /* See qemu_soonest_timeout() uint64_t hack */
+-    int64_t max_ns = MIN((uint64_t)*timeout, (uint64_t)ctx->poll_ns);
-+    QLIST_REMOVE(aio_req, aio_siblings);
++    int64_t max_ns = qemu_soonest_timeout(*timeout, ctx->poll_ns);
-     switch (rsp.result) {
-     case SD_RES_SUCCESS:
+     if (max_ns && !atomic_read(&ctx->poll_disable_cnt)) {
-         break;
+         poll_set_started(ctx, true);
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn aio_read_response(void *opaque)
          break;
      }
 -    free_aio_req(s, aio_req);
 -    if (!acb->nr_pending) {
 +    g_free(aio_req);
 +
 +    if (!--acb->nr_pending) {
          /*
           * We've finished all requests which belong to the AIOCB, so
           * we can switch back to sd_co_readv/writev now.
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn add_aio_request(BDRVSheepdogState *s, AIOReq *aio_req,
      uint64_t old_oid = aio_req->base_oid;
      bool create = aio_req->create;
 +    QLIST_INSERT_HEAD(&s->inflight_aio_head, aio_req, aio_siblings);
 +
      if (!nr_copies) {
          error_report("bug");
      }
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn sd_write_done(SheepdogAIOCB *acb)
          iov.iov_len = sizeof(s->inode);
          aio_req = alloc_aio_req(s, acb, vid_to_vdi_oid(s->inode.vdi_id),
                                  data_len, offset, 0, false, 0, offset);
 -        QLIST_INSERT_HEAD(&s->inflight_aio_head, aio_req, aio_siblings);
          add_aio_request(s, aio_req, &iov, 1, AIOCB_WRITE_UDATA);
          if (--acb->nr_pending) {
              qemu_coroutine_yield();
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn sd_co_rw_vector(SheepdogAIOCB *acb)
                                  old_oid,
                                  acb->aiocb_type == AIOCB_DISCARD_OBJ ?
 : done);
 -        QLIST_INSERT_HEAD(&s->inflight_aio_head, aio_req, aio_siblings);
 -
          add_aio_request(s, aio_req, acb->qiov->iov, acb->qiov->niov,
                          acb->aiocb_type);
      done:
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn sd_co_flush_to_disk(BlockDriverState *bs)
      acb.nr_pending++;
      aio_req = alloc_aio_req(s, &acb, vid_to_vdi_oid(s->inode.vdi_id),
 , 0, 0, false, 0, 0);
 -    QLIST_INSERT_HEAD(&s->inflight_aio_head, aio_req, aio_siblings);
      add_aio_request(s, aio_req, NULL, 0, acb.aiocb_type);
      if (--acb.nr_pending) {
 --
-.9.3
+.21.0

-[Qemu-devel] [PULL 3/5] sheepdog: do not use BlockAIOCB
+[Qemu-devel] [PULL 7/8] docs: add Secure Coding Practices to developer docs
-From: Paolo Bonzini <pbonzini@redhat.com>
+At KVM Forum 2018 I gave a presentation on security in QEMU:
 https://www.youtube.com/watch?v=YAdRf_hwxU8 (video)
 https://vmsplice.net/~stefan/stefanha-kvm-forum-2018.pdf (slides)
-Sheepdog's AIOCB are completely internal entities for a group of
+This patch adds a guide to secure coding practices.  This document
-requests and do not need dynamic allocation.
+covers things that developers should know about security in QEMU.  It is
 just a starting point that we can expand on later.  I hope it will be
 useful as a resource for new contributors and will save code reviewers
 from explaining the same concepts many times.
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20161129113245.32724-4-pbonzini@redhat.com
+Acked-by: Stefano Garzarella <sgarzare@redhat.com>
-Signed-off-by: Jeff Cody <jcody@redhat.com>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 Reviewed-by: Li Qiang <liq3ea@gmail.com>
 Message-id: 20190509121820.16294-2-stefanha@redhat.com
 Message-Id: <20190509121820.16294-2-stefanha@redhat.com>
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
- block/sheepdog.c | 99 ++++++++++++++++++++++----------------------------------
+ docs/devel/index.rst                   |   1 +
-file changed, 39 insertions(+), 60 deletions(-)
+ docs/devel/secure-coding-practices.rst | 106 +++++++++++++++++++++++++
 files changed, 107 insertions(+)
  create mode 100644 docs/devel/secure-coding-practices.rst
-diff --git a/block/sheepdog.c b/block/sheepdog.c
+diff --git a/docs/devel/index.rst b/docs/devel/index.rst
 index XXXXXXX..XXXXXXX 100644
---- a/block/sheepdog.c
+--- a/docs/devel/index.rst
-+++ b/block/sheepdog.c
++++ b/docs/devel/index.rst
-@@ -XXX,XX +XXX,XX @@ static inline size_t count_data_objs(const struct SheepdogInode *inode)
+@@ -XXX,XX +XXX,XX @@ Contents:
-     } while (0)
+    stable-process
+    testing
- typedef struct SheepdogAIOCB SheepdogAIOCB;
+    decodetree
-+typedef struct BDRVSheepdogState BDRVSheepdogState;
++   secure-coding-practices
+diff --git a/docs/devel/secure-coding-practices.rst b/docs/devel/secure-coding-practices.rst
- typedef struct AIOReq {
+new file mode 100644
-     SheepdogAIOCB *aiocb;
+index XXXXXXX..XXXXXXX
-@@ -XXX,XX +XXX,XX @@ enum AIOCBState {
+--- /dev/null
-        || y->max_affect_data_idx < x->min_affect_data_idx))
++++ b/docs/devel/secure-coding-practices.rst
+@@ -XXX,XX +XXX,XX @@
- struct SheepdogAIOCB {
++=======================
--    BlockAIOCB common;
++Secure Coding Practices
-+    BDRVSheepdogState *s;
++=======================
++This document covers topics that both developers and security researchers must
-     QEMUIOVector *qiov;
++be aware of so that they can develop safe code and audit existing code
++properly.
-@@ -XXX,XX +XXX,XX @@ struct SheepdogAIOCB {
++
-     QLIST_ENTRY(SheepdogAIOCB) aiocb_siblings;
++Reporting Security Bugs
- };
++-----------------------
++For details on how to report security bugs or ask questions about potential
--typedef struct BDRVSheepdogState {
++security bugs, see the `Security Process wiki page
-+struct BDRVSheepdogState {
++<https://wiki.qemu.org/SecurityProcess>`_.
-     BlockDriverState *bs;
++
-     AioContext *aio_context;
++General Secure C Coding Practices
++---------------------------------
-@@ -XXX,XX +XXX,XX @@ typedef struct BDRVSheepdogState {
++Most CVEs (security bugs) reported against QEMU are not specific to
++virtualization or emulation.  They are simply C programming bugs.  Therefore
-     CoQueue overlapping_queue;
++it's critical to be aware of common classes of security bugs.
-     QLIST_HEAD(inflight_aiocb_head, SheepdogAIOCB) inflight_aiocb_head;
++
--} BDRVSheepdogState;
++There is a wide selection of resources available covering secure C coding.  For
-+};
++example, the `CERT C Coding Standard
++<https://wiki.sei.cmu.edu/confluence/display/c/SEI+CERT+C+Coding+Standard>`_
- typedef struct BDRVSheepdogReopenState {
++covers the most important classes of security bugs.
-     int fd;
++
-@@ -XXX,XX +XXX,XX @@ static inline void free_aio_req(BDRVSheepdogState *s, AIOReq *aio_req)
++Instead of describing them in detail here, only the names of the most important
-     acb->nr_pending--;
++classes of security bugs are mentioned:
- }
++
++* Buffer overflows
--static const AIOCBInfo sd_aiocb_info = {
++* Use-after-free and double-free
--    .aiocb_size     = sizeof(SheepdogAIOCB),
++* Integer overflows
--};
++* Format string vulnerabilities
--
++
--static SheepdogAIOCB *sd_aio_setup(BlockDriverState *bs, QEMUIOVector *qiov,
++Some of these classes of bugs can be detected by analyzers.  Static analysis is
--                                   int64_t sector_num, int nb_sectors)
++performed regularly by Coverity and the most obvious of these bugs are even
-+static void sd_aio_setup(SheepdogAIOCB *acb, BDRVSheepdogState *s,
++reported by compilers.  Dynamic analysis is possible with valgrind, tsan, and
-+                         QEMUIOVector *qiov, int64_t sector_num, int nb_sectors,
++asan.
-+                         int type)
++
- {
++Input Validation
--    SheepdogAIOCB *acb;
++----------------
-     uint32_t object_size;
++Inputs from the guest or external sources (e.g. network, files) cannot be
--    BDRVSheepdogState *s = bs->opaque;
++trusted and may be invalid.  Inputs must be checked before using them in a way
++that could crash the program, expose host memory to the guest, or otherwise be
-     object_size = (UINT32_C(1) << s->inode.block_size_shift);
++exploitable by an attacker.
++
--    acb = qemu_aio_get(&sd_aiocb_info, bs, NULL, NULL);
++The most sensitive attack surface is device emulation.  All hardware register
-+    acb->s = s;
++accesses and data read from guest memory must be validated.  A typical example
++is a device that contains multiple units that are selectable by the guest via
-     acb->qiov = qiov;
++an index register::
++
-@@ -XXX,XX +XXX,XX @@ static SheepdogAIOCB *sd_aio_setup(BlockDriverState *bs, QEMUIOVector *qiov,
++  typedef struct {
++      ProcessingUnit unit[2];
-     acb->min_dirty_data_idx = UINT32_MAX;
++      ...
-     acb->max_dirty_data_idx = 0;
++  } MyDeviceState;
--
++
--    return acb;
++  static void mydev_writel(void *opaque, uint32_t addr, uint32_t val)
-+    acb->aiocb_type = type;
++  {
- }
++      MyDeviceState *mydev = opaque;
++      ProcessingUnit *unit;
- /* Return -EIO in case of error, file descriptor on success */
++
-@@ -XXX,XX +XXX,XX @@ static int sd_truncate(BlockDriverState *bs, int64_t offset)
++      switch (addr) {
-  */
++      case MYDEV_SELECT_UNIT:
- static void coroutine_fn sd_write_done(SheepdogAIOCB *acb)
++          unit = &mydev->unit[val];   <-- this input wasn't validated!
- {
++          ...
--    BDRVSheepdogState *s = acb->common.bs->opaque;
++      }
-+    BDRVSheepdogState *s = acb->s;
++  }
-     struct iovec iov;
++
-     AIOReq *aio_req;
++If ``val`` is not in range [0, 1] then an out-of-bounds memory access will take
-     uint32_t offset, data_len, mn, mx;
++place when ``unit`` is dereferenced.  The code must check that ``val`` is 0 or
-@@ -XXX,XX +XXX,XX @@ out:
++1 and handle the case where it is invalid.
-  * Returns 1 when we need to wait a response, 0 when there is no sent
++
-  * request and -errno in error cases.
++Unexpected Device Accesses
-  */
++--------------------------
--static void coroutine_fn sd_co_rw_vector(void *p)
++The guest may access device registers in unusual orders or at unexpected
-+static void coroutine_fn sd_co_rw_vector(SheepdogAIOCB *acb)
++moments.  Device emulation code must not assume that the guest follows the
- {
++typical "theory of operation" presented in driver writer manuals.  The guest
--    SheepdogAIOCB *acb = p;
++may make nonsense accesses to device registers such as starting operations
-     int ret = 0;
++before the device has been fully initialized.
-     unsigned long len, done = 0, total = acb->nb_sectors * BDRV_SECTOR_SIZE;
++
-     unsigned long idx;
++A related issue is that device emulation code must be prepared for unexpected
-     uint32_t object_size;
++device register accesses while asynchronous operations are in progress.  A
-     uint64_t oid;
++well-behaved guest might wait for a completion interrupt before accessing
-     uint64_t offset;
++certain device registers.  Device emulation code must handle the case where the
--    BDRVSheepdogState *s = acb->common.bs->opaque;
++guest overwrites registers or submits further requests before an ongoing
-+    BDRVSheepdogState *s = acb->s;
++request completes.  Unexpected accesses must not cause memory corruption or
-     SheepdogInode *inode = &s->inode;
++leaks in QEMU.
-     AIOReq *aio_req;
++
++Invalid device register accesses can be reported with
-@@ -XXX,XX +XXX,XX @@ static bool check_overlapping_aiocb(BDRVSheepdogState *s, SheepdogAIOCB *aiocb)
++``qemu_log_mask(LOG_GUEST_ERROR, ...)``.  The ``-d guest_errors`` command-line
- static coroutine_fn int sd_co_writev(BlockDriverState *bs, int64_t sector_num,
++option enables these log messages.
-                         int nb_sectors, QEMUIOVector *qiov)
++
- {
++Live Migration
--    SheepdogAIOCB *acb;
++--------------
-+    SheepdogAIOCB acb;
++Device state can be saved to disk image files and shared with other users.
-     int ret;
++Live migration code must validate inputs when loading device state so an
-     int64_t offset = (sector_num + nb_sectors) * BDRV_SECTOR_SIZE;
++attacker cannot gain control by crafting invalid device states.  Device state
-     BDRVSheepdogState *s = bs->opaque;
++is therefore considered untrusted even though it is typically generated by QEMU
-@@ -XXX,XX +XXX,XX @@ static coroutine_fn int sd_co_writev(BlockDriverState *bs, int64_t sector_num,
++itself.
-         }
++
-     }
++Guest Memory Access Races
++-------------------------
--    acb = sd_aio_setup(bs, qiov, sector_num, nb_sectors);
++Guests with multiple vCPUs may modify guest RAM while device emulation code is
--    acb->aiocb_type = AIOCB_WRITE_UDATA;
++running.  Device emulation code must copy in descriptors and other guest RAM
-+    sd_aio_setup(&acb, s, qiov, sector_num, nb_sectors, AIOCB_WRITE_UDATA);
++structures and only process the local copy.  This prevents
++time-of-check-to-time-of-use (TOCTOU) race conditions that could cause QEMU to
- retry:
++crash when a vCPU thread modifies guest RAM while device emulation is
--    if (check_overlapping_aiocb(s, acb)) {
++processing it.
 +    if (check_overlapping_aiocb(s, &acb)) {
          qemu_co_queue_wait(&s->overlapping_queue);
          goto retry;
      }
 -    sd_co_rw_vector(acb);
 -    sd_write_done(acb);
 +    sd_co_rw_vector(&acb);
 +    sd_write_done(&acb);
 -    QLIST_REMOVE(acb, aiocb_siblings);
 +    QLIST_REMOVE(&acb, aiocb_siblings);
      qemu_co_queue_restart_all(&s->overlapping_queue);
 -    ret = acb->ret;
 -    qemu_aio_unref(acb);
 -    return ret;
 +    return acb.ret;
  }
  static coroutine_fn int sd_co_readv(BlockDriverState *bs, int64_t sector_num,
                         int nb_sectors, QEMUIOVector *qiov)
  {
 -    SheepdogAIOCB *acb;
 -    int ret;
 +    SheepdogAIOCB acb;
      BDRVSheepdogState *s = bs->opaque;
 -    acb = sd_aio_setup(bs, qiov, sector_num, nb_sectors);
 -    acb->aiocb_type = AIOCB_READ_UDATA;
 +    sd_aio_setup(&acb, s, qiov, sector_num, nb_sectors, AIOCB_READ_UDATA);
  retry:
 -    if (check_overlapping_aiocb(s, acb)) {
 +    if (check_overlapping_aiocb(s, &acb)) {
          qemu_co_queue_wait(&s->overlapping_queue);
          goto retry;
      }
 -    sd_co_rw_vector(acb);
 +    sd_co_rw_vector(&acb);
 -    QLIST_REMOVE(acb, aiocb_siblings);
 +    QLIST_REMOVE(&acb, aiocb_siblings);
      qemu_co_queue_restart_all(&s->overlapping_queue);
 -    ret = acb->ret;
 -    qemu_aio_unref(acb);
 -    return ret;
 +    return acb.ret;
  }
  static int coroutine_fn sd_co_flush_to_disk(BlockDriverState *bs)
  {
      BDRVSheepdogState *s = bs->opaque;
 -    SheepdogAIOCB *acb;
 -    int ret;
 +    SheepdogAIOCB acb;
      AIOReq *aio_req;
      if (s->cache_flags != SD_FLAG_CMD_CACHE) {
          return 0;
      }
 -    acb = sd_aio_setup(bs, NULL, 0, 0);
 -    acb->aiocb_type = AIOCB_FLUSH_CACHE;
 +    sd_aio_setup(&acb, s, NULL, 0, 0, AIOCB_FLUSH_CACHE);
 -    acb->nr_pending++;
 -    aio_req = alloc_aio_req(s, acb, vid_to_vdi_oid(s->inode.vdi_id),
 +    acb.nr_pending++;
 +    aio_req = alloc_aio_req(s, &acb, vid_to_vdi_oid(s->inode.vdi_id),
 , 0, 0, false, 0, 0);
      QLIST_INSERT_HEAD(&s->inflight_aio_head, aio_req, aio_siblings);
 -    add_aio_request(s, aio_req, NULL, 0, acb->aiocb_type);
 +    add_aio_request(s, aio_req, NULL, 0, acb.aiocb_type);
 -    if (--acb->nr_pending) {
 +    if (--acb.nr_pending) {
          qemu_coroutine_yield();
      }
 -    ret = acb->ret;
 -    qemu_aio_unref(acb);
 -    return ret;
 +    return acb.ret;
  }
  static int sd_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
@@ -XXX,XX +XXX,XX @@ static int sd_load_vmstate(BlockDriverState *bs, QEMUIOVector *qiov,
  static coroutine_fn int sd_co_pdiscard(BlockDriverState *bs, int64_t offset,
                                        int count)
  {
 -    SheepdogAIOCB *acb;
 +    SheepdogAIOCB acb;
      BDRVSheepdogState *s = bs->opaque;
 -    int ret;
      QEMUIOVector discard_iov;
      struct iovec iov;
      uint32_t zero = 0;
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int sd_co_pdiscard(BlockDriverState *bs, int64_t offset,
      if (!QEMU_IS_ALIGNED(offset | count, BDRV_SECTOR_SIZE)) {
          return -ENOTSUP;
      }
 -    acb = sd_aio_setup(bs, &discard_iov, offset >> BDRV_SECTOR_BITS,
 -                       count >> BDRV_SECTOR_BITS);
 -    acb->aiocb_type = AIOCB_DISCARD_OBJ;
 +    sd_aio_setup(&acb, s, &discard_iov, offset >> BDRV_SECTOR_BITS,
 +                 count >> BDRV_SECTOR_BITS, AIOCB_DISCARD_OBJ);
  retry:
 -    if (check_overlapping_aiocb(s, acb)) {
 +    if (check_overlapping_aiocb(s, &acb)) {
          qemu_co_queue_wait(&s->overlapping_queue);
          goto retry;
      }
 -    sd_co_rw_vector(acb);
 +    sd_co_rw_vector(&acb);
 -    QLIST_REMOVE(acb, aiocb_siblings);
 +    QLIST_REMOVE(&acb, aiocb_siblings);
      qemu_co_queue_restart_all(&s->overlapping_queue);
 -    ret = acb->ret;
 -    qemu_aio_unref(acb);
 -    return ret;
 +    return acb.ret;
  }
  static coroutine_fn int64_t
 --
-.9.3
+.21.0

-[Qemu-devel] [PULL 1/5] sheepdog: remove unused cancellation support
+[Qemu-devel] [PULL 8/8] docs: add Security chapter to the documentation
-From: Paolo Bonzini <pbonzini@redhat.com>
+This new chapter in the QEMU documentation covers the security
 requirements that QEMU is designed to meet and principles for securely
 deploying QEMU.
-SheepdogAIOCB is internal to sheepdog.c, hence it is never canceled.
+It is just a starting point that can be extended in the future with more
 information.
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20161129113245.32724-2-pbonzini@redhat.com
+Acked-by: Stefano Garzarella <sgarzare@redhat.com>
-Signed-off-by: Jeff Cody <jcody@redhat.com>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 Reviewed-by: Li Qiang <liq3ea@gmail.com>
 Message-id: 20190509121820.16294-3-stefanha@redhat.com
 Message-Id: <20190509121820.16294-3-stefanha@redhat.com>
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
- block/sheepdog.c | 52 ----------------------------------------------------
+ Makefile           |   2 +-
-file changed, 52 deletions(-)
+ docs/security.texi | 131 +++++++++++++++++++++++++++++++++++++++++++++
  qemu-doc.texi      |   3 ++
 files changed, 135 insertions(+), 1 deletion(-)
  create mode 100644 docs/security.texi
-diff --git a/block/sheepdog.c b/block/sheepdog.c
+diff --git a/Makefile b/Makefile
 index XXXXXXX..XXXXXXX 100644
---- a/block/sheepdog.c
+--- a/Makefile
-+++ b/block/sheepdog.c
++++ b/Makefile
-@@ -XXX,XX +XXX,XX @@ struct SheepdogAIOCB {
+@@ -XXX,XX +XXX,XX @@ qemu-doc.html qemu-doc.info qemu-doc.pdf qemu-doc.txt: \
-     Coroutine *coroutine;
+     qemu-img.texi qemu-nbd.texi qemu-options.texi qemu-option-trace.texi \
-     void (*aio_done_func)(SheepdogAIOCB *);
+     qemu-deprecated.texi qemu-monitor.texi qemu-img-cmds.texi qemu-ga.texi \
+     qemu-monitor-info.texi docs/qemu-block-drivers.texi \
--    bool cancelable;
+-    docs/qemu-cpu-models.texi
-     int nr_pending;
++    docs/qemu-cpu-models.texi docs/security.texi
-     uint32_t min_affect_data_idx;
+ docs/interop/qemu-ga-ref.dvi docs/interop/qemu-ga-ref.html \
-@@ -XXX,XX +XXX,XX @@ static inline void free_aio_req(BDRVSheepdogState *s, AIOReq *aio_req)
+     docs/interop/qemu-ga-ref.info docs/interop/qemu-ga-ref.pdf \
- {
+diff --git a/docs/security.texi b/docs/security.texi
-     SheepdogAIOCB *acb = aio_req->aiocb;
+new file mode 100644
+index XXXXXXX..XXXXXXX
--    acb->cancelable = false;
+--- /dev/null
-     QLIST_REMOVE(aio_req, aio_siblings);
++++ b/docs/security.texi
-     g_free(aio_req);
+@@ -XXX,XX +XXX,XX @@
++@node Security
-@@ -XXX,XX +XXX,XX @@ static void coroutine_fn sd_finish_aiocb(SheepdogAIOCB *acb)
++@chapter Security
-     qemu_aio_unref(acb);
++
- }
++@section Overview
++
--/*
++This chapter explains the security requirements that QEMU is designed to meet
-- * Check whether the specified acb can be canceled
++and principles for securely deploying QEMU.
-- *
++
-- * We can cancel aio when any request belonging to the acb is:
++@section Security Requirements
-- *  - Not processed by the sheepdog server.
++
-- *  - Not linked to the inflight queue.
++QEMU supports many different use cases, some of which have stricter security
-- */
++requirements than others.  The community has agreed on the overall security
--static bool sd_acb_cancelable(const SheepdogAIOCB *acb)
++requirements that users may depend on.  These requirements define what is
--{
++considered supported from a security perspective.
--    BDRVSheepdogState *s = acb->common.bs->opaque;
++
--    AIOReq *aioreq;
++@subsection Virtualization Use Case
--
++
--    if (!acb->cancelable) {
++The virtualization use case covers cloud and virtual private server (VPS)
--        return false;
++hosting, as well as traditional data center and desktop virtualization.  These
--    }
++use cases rely on hardware virtualization extensions to execute guest code
--
++safely on the physical CPU at close-to-native speed.
--    QLIST_FOREACH(aioreq, &s->inflight_aio_head, aio_siblings) {
++
--        if (aioreq->aiocb == acb) {
++The following entities are untrusted, meaning that they may be buggy or
--            return false;
++malicious:
--        }
++
--    }
++@itemize
--
++@item Guest
--    return true;
++@item User-facing interfaces (e.g. VNC, SPICE, WebSocket)
--}
++@item Network protocols (e.g. NBD, live migration)
--
++@item User-supplied files (e.g. disk images, kernels, device trees)
--static void sd_aio_cancel(BlockAIOCB *blockacb)
++@item Passthrough devices (e.g. PCI, USB)
--{
++@end itemize
--    SheepdogAIOCB *acb = (SheepdogAIOCB *)blockacb;
++
--    BDRVSheepdogState *s = acb->common.bs->opaque;
++Bugs affecting these entities are evaluated on whether they can cause damage in
--    AIOReq *aioreq, *next;
++real-world use cases and treated as security bugs if this is the case.
--
++
--    if (sd_acb_cancelable(acb)) {
++@subsection Non-virtualization Use Case
--        /* Remove outstanding requests from failed queue.  */
++
--        QLIST_FOREACH_SAFE(aioreq, &s->failed_aio_head, aio_siblings,
++The non-virtualization use case covers emulation using the Tiny Code Generator
--                           next) {
++(TCG).  In principle the TCG and device emulation code used in conjunction with
--            if (aioreq->aiocb == acb) {
++the non-virtualization use case should meet the same security requirements as
--                free_aio_req(s, aioreq);
++the virtualization use case.  However, for historical reasons much of the
--            }
++non-virtualization use case code was not written with these security
--        }
++requirements in mind.
--
++
--        assert(acb->nr_pending == 0);
++Bugs affecting the non-virtualization use case are not considered security
--        if (acb->common.cb) {
++bugs at this time.  Users with non-virtualization use cases must not rely on
--            acb->common.cb(acb->common.opaque, -ECANCELED);
++QEMU to provide guest isolation or any security guarantees.
--        }
++
--        sd_finish_aiocb(acb);
++@section Architecture
--    }
++
--}
++This section describes the design principles that ensure the security
--
++requirements are met.
- static const AIOCBInfo sd_aiocb_info = {
++
-     .aiocb_size     = sizeof(SheepdogAIOCB),
++@subsection Guest Isolation
--    .cancel_async   = sd_aio_cancel,
++
- };
++Guest isolation is the confinement of guest code to the virtual machine.  When
++guest code gains control of execution on the host this is called escaping the
- static SheepdogAIOCB *sd_aio_setup(BlockDriverState *bs, QEMUIOVector *qiov,
++virtual machine.  Isolation also includes resource limits such as throttling of
-@@ -XXX,XX +XXX,XX @@ static SheepdogAIOCB *sd_aio_setup(BlockDriverState *bs, QEMUIOVector *qiov,
++CPU, memory, disk, or network.  Guests must be unable to exceed their resource
-     acb->nb_sectors = nb_sectors;
++limits.
++
-     acb->aio_done_func = NULL;
++QEMU presents an attack surface to the guest in the form of emulated devices.
--    acb->cancelable = true;
++The guest must not be able to gain control of QEMU.  Bugs in emulated devices
-     acb->coroutine = qemu_coroutine_self();
++could allow malicious guests to gain code execution in QEMU.  At this point the
-     acb->ret = 0;
++guest has escaped the virtual machine and is able to act in the context of the
-     acb->nr_pending = 0;
++QEMU process on the host.
 +
 +Guests often interact with other guests and share resources with them.  A
 +malicious guest must not gain control of other guests or access their data.
 +Disk image files and network traffic must be protected from other guests unless
 +explicitly shared between them by the user.
 +
 +@subsection Principle of Least Privilege
 +
 +The principle of least privilege states that each component only has access to
 +the privileges necessary for its function.  In the case of QEMU this means that
 +each process only has access to resources belonging to the guest.
 +
 +The QEMU process should not have access to any resources that are inaccessible
 +to the guest.  This way the guest does not gain anything by escaping into the
 +QEMU process since it already has access to those same resources from within
 +the guest.
 +
 +Following the principle of least privilege immediately fulfills guest isolation
 +requirements.  For example, guest A only has access to its own disk image file
 +@code{a.img} and not guest B's disk image file @code{b.img}.
 +
 +In reality certain resources are inaccessible to the guest but must be
 +available to QEMU to perform its function.  For example, host system calls are
 +necessary for QEMU but are not exposed to guests.  A guest that escapes into
 +the QEMU process can then begin invoking host system calls.
 +
 +New features must be designed to follow the principle of least privilege.
 +Should this not be possible for technical reasons, the security risk must be
 +clearly documented so users are aware of the trade-off of enabling the feature.
 +
 +@subsection Isolation mechanisms
 +
 +Several isolation mechanisms are available to realize this architecture of
 +guest isolation and the principle of least privilege.  With the exception of
 +Linux seccomp, these mechanisms are all deployed by management tools that
 +launch QEMU, such as libvirt.  They are also platform-specific so they are only
 +described briefly for Linux here.
 +
 +The fundamental isolation mechanism is that QEMU processes must run as
 +unprivileged users.  Sometimes it seems more convenient to launch QEMU as
 +root to give it access to host devices (e.g. @code{/dev/net/tun}) but this poses a
 +huge security risk.  File descriptor passing can be used to give an otherwise
 +unprivileged QEMU process access to host devices without running QEMU as root.
 +It is also possible to launch QEMU as a non-root user and configure UNIX groups
 +for access to @code{/dev/kvm}, @code{/dev/net/tun}, and other device nodes.
 +Some Linux distros already ship with UNIX groups for these devices by default.
 +
 +@itemize
 +@item SELinux and AppArmor make it possible to confine processes beyond the
 +traditional UNIX process and file permissions model.  They restrict the QEMU
 +process from accessing processes and files on the host system that are not
 +needed by QEMU.
 +
 +@item Resource limits and cgroup controllers provide throughput and utilization
 +limits on key resources such as CPU time, memory, and I/O bandwidth.
 +
 +@item Linux namespaces can be used to make process, file system, and other system
 +resources unavailable to QEMU.  A namespaced QEMU process is restricted to only
 +those resources that were granted to it.
 +
 +@item Linux seccomp is available via the QEMU @option{--sandbox} option.  It disables
 +system calls that are not needed by QEMU, thereby reducing the host kernel
 +attack surface.
 +@end itemize
 diff --git a/qemu-doc.texi b/qemu-doc.texi
 index XXXXXXX..XXXXXXX 100644
 --- a/qemu-doc.texi
 +++ b/qemu-doc.texi
@@ -XXX,XX +XXX,XX @@
  * QEMU Guest Agent::
  * QEMU User space emulator::
  * System requirements::
 +* Security::
  * Implementation notes::
  * Deprecated features::
  * Supported build platforms::
@@ -XXX,XX +XXX,XX @@ added with Linux 4.5 which is supported by the major distros. And even
  if RHEL7 has kernel 3.10, KVM there has the required functionality there
  to make it close to a 4.5 or newer kernel.
 +@include docs/security.texi
 +
  @include qemu-tech.texi
  @include qemu-deprecated.texi
 --
-.9.3
+.21.0

From: Paolo Bonzini <pbonzini@redhat.com>

SheepdogAIOCB is internal to sheepdog.c, hence it is never canceled.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 20161129113245.32724-2-pbonzini@redhat.com
Signed-off-by: Jeff Cody <jcody@redhat.com>
---
 block/sheepdog.c | 52 ----------------------------------------------------
 1 file changed, 52 deletions(-)

From: Paolo Bonzini <pbonzini@redhat.com>

Delimit co_recv's lifetime clearly in aio_read_response.

Do a simple qemu_coroutine_enter in aio_read_response, letting
sd_co_writev call sd_write_done.

Handle nr_pending in the same way in sd_co_rw_vector,
sd_write_done and sd_co_flush_to_disk.

Remove sd_co_rw_vector's return value; just leave with no
pending requests.

[Jeff: added missing 'return' back, spotted by Paolo after
       series was applied.]

Signed-off-by: Jeff Cody <jcody@redhat.com>
---
 block/sheepdog.c | 115 ++++++++++++++++++++-----------------------------------
 1 file changed, 42 insertions(+), 73 deletions(-)

diff --git a/block/sheepdog.c b/block/sheepdog.c
index XXXXXXX..XXXXXXX 100644
--- a/block/sheepdog.c
+++ b/block/sheepdog.c
@@ -XXX,XX +XXX,XX @@ struct SheepdogAIOCB {
     enum AIOCBState aiocb_type;
 
     Coroutine *coroutine;
-    void (*aio_done_func)(SheepdogAIOCB *);
-
     int nr_pending;
 
     uint32_t min_affect_data_idx;
@@ -XXX,XX +XXX,XX @@ static const char * sd_strerror(int err)
  *
  * 1. In sd_co_rw_vector, we send the I/O requests to the server and
  *    link the requests to the inflight_list in the
- *    BDRVSheepdogState.  The function exits without waiting for
+ *    BDRVSheepdogState.  The function yields while waiting for
  *    receiving the response.
  *
  * 2. We receive the response in aio_read_response, the fd handler to
- *    the sheepdog connection.  If metadata update is needed, we send
- *    the write request to the vdi object in sd_write_done, the write
- *    completion function.  We switch back to sd_co_readv/writev after
- *    all the requests belonging to the AIOCB are finished.
+ *    the sheepdog connection.  We switch back to sd_co_readv/sd_writev
+ *    after all the requests belonging to the AIOCB are finished.  If
+ *    needed, sd_co_writev will send another requests for the vdi object.
  */
 
 static inline AIOReq *alloc_aio_req(BDRVSheepdogState *s, SheepdogAIOCB *acb,
@@ -XXX,XX +XXX,XX @@ static inline void free_aio_req(BDRVSheepdogState *s, AIOReq *aio_req)
     acb->nr_pending--;
 }
 
-static void coroutine_fn sd_finish_aiocb(SheepdogAIOCB *acb)
-{
-    qemu_coroutine_enter(acb->coroutine);
-    qemu_aio_unref(acb);
-}
-
 static const AIOCBInfo sd_aiocb_info = {
     .aiocb_size     = sizeof(SheepdogAIOCB),
 };
@@ -XXX,XX +XXX,XX @@ static SheepdogAIOCB *sd_aio_setup(BlockDriverState *bs, QEMUIOVector *qiov,
     acb->sector_num = sector_num;
     acb->nb_sectors = nb_sectors;
 
-    acb->aio_done_func = NULL;
     acb->coroutine = qemu_coroutine_self();
     acb->ret = 0;
     acb->nr_pending = 0;
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn aio_read_response(void *opaque)
 
     switch (acb->aiocb_type) {
     case AIOCB_WRITE_UDATA:
-        /* this coroutine context is no longer suitable for co_recv
-         * because we may send data to update vdi objects */
-        s->co_recv = NULL;
         if (!is_data_obj(aio_req->oid)) {
             break;
         }
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn aio_read_response(void *opaque)
         }
     }
 
+    /* No more data for this aio_req (reload_inode below uses its own file
+     * descriptor handler which doesn't use co_recv).
+    */
+    s->co_recv = NULL;
+
     switch (rsp.result) {
     case SD_RES_SUCCESS:
         break;
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn aio_read_response(void *opaque)
             aio_req->oid = vid_to_vdi_oid(s->inode.vdi_id);
         }
         resend_aioreq(s, aio_req);
-        goto out;
+        return;
     default:
         acb->ret = -EIO;
         error_report("%s", sd_strerror(rsp.result));
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn aio_read_response(void *opaque)
          * We've finished all requests which belong to the AIOCB, so
          * we can switch back to sd_co_readv/writev now.
          */
-        acb->aio_done_func(acb);
+        qemu_coroutine_enter(acb->coroutine);
     }
-out:
-    s->co_recv = NULL;
+
     return;
+
 err:
-    s->co_recv = NULL;
     reconnect_to_sdog(opaque);
 }
 
@@ -XXX,XX +XXX,XX @@ static int sd_truncate(BlockDriverState *bs, int64_t offset)
 /*
  * This function is called after writing data objects.  If we need to
  * update metadata, this sends a write request to the vdi object.
- * Otherwise, this switches back to sd_co_readv/writev.
  */
 static void coroutine_fn sd_write_done(SheepdogAIOCB *acb)
 {
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn sd_write_done(SheepdogAIOCB *acb)
     mx = acb->max_dirty_data_idx;
     if (mn <= mx) {
         /* we need to update the vdi object. */
+        ++acb->nr_pending;
         offset = sizeof(s->inode) - sizeof(s->inode.data_vdi_id) +
             mn * sizeof(s->inode.data_vdi_id[0]);
         data_len = (mx - mn + 1) * sizeof(s->inode.data_vdi_id[0]);
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn sd_write_done(SheepdogAIOCB *acb)
                                 data_len, offset, 0, false, 0, offset);
         QLIST_INSERT_HEAD(&s->inflight_aio_head, aio_req, aio_siblings);
         add_aio_request(s, aio_req, &iov, 1, AIOCB_WRITE_UDATA);
-
-        acb->aio_done_func = sd_finish_aiocb;
-        acb->aiocb_type = AIOCB_WRITE_UDATA;
-        return;
+        if (--acb->nr_pending) {
+            qemu_coroutine_yield();
+        }
     }
-
-    sd_finish_aiocb(acb);
 }
 
 /* Delete current working VDI on the snapshot chain */
@@ -XXX,XX +XXX,XX @@ out:
  * Returns 1 when we need to wait a response, 0 when there is no sent
  * request and -errno in error cases.
  */
-static int coroutine_fn sd_co_rw_vector(void *p)
+static void coroutine_fn sd_co_rw_vector(void *p)
 {
     SheepdogAIOCB *acb = p;
     int ret = 0;
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn sd_co_rw_vector(void *p)
         ret = sd_create_branch(s);
         if (ret) {
             acb->ret = -EIO;
-            goto out;
+            return;
         }
     }
 
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn sd_co_rw_vector(void *p)
         idx++;
         done += len;
     }
-out:
-    if (!--acb->nr_pending) {
-        return acb->ret;
+    if (--acb->nr_pending) {
+        qemu_coroutine_yield();
     }
-    return 1;
 }
 
 static bool check_overlapping_aiocb(BDRVSheepdogState *s, SheepdogAIOCB *aiocb)
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int sd_co_writev(BlockDriverState *bs, int64_t sector_num,
     }
 
     acb = sd_aio_setup(bs, qiov, sector_num, nb_sectors);
-    acb->aio_done_func = sd_write_done;
     acb->aiocb_type = AIOCB_WRITE_UDATA;
 
 retry:
@@ -XXX,XX +XXX,XX @@ retry:
         goto retry;
     }
 
-    ret = sd_co_rw_vector(acb);
-    if (ret <= 0) {
-        QLIST_REMOVE(acb, aiocb_siblings);
-        qemu_co_queue_restart_all(&s->overlapping_queue);
-        qemu_aio_unref(acb);
-        return ret;
-    }
-
-    qemu_coroutine_yield();
+    sd_co_rw_vector(acb);
+    sd_write_done(acb);
 
     QLIST_REMOVE(acb, aiocb_siblings);
     qemu_co_queue_restart_all(&s->overlapping_queue);
-
-    return acb->ret;
+    ret = acb->ret;
+    qemu_aio_unref(acb);
+    return ret;
 }
 
 static coroutine_fn int sd_co_readv(BlockDriverState *bs, int64_t sector_num,
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int sd_co_readv(BlockDriverState *bs, int64_t sector_num,
 
     acb = sd_aio_setup(bs, qiov, sector_num, nb_sectors);
     acb->aiocb_type = AIOCB_READ_UDATA;
-    acb->aio_done_func = sd_finish_aiocb;
 
 retry:
     if (check_overlapping_aiocb(s, acb)) {
@@ -XXX,XX +XXX,XX @@ retry:
         goto retry;
     }
 
-    ret = sd_co_rw_vector(acb);
-    if (ret <= 0) {
-        QLIST_REMOVE(acb, aiocb_siblings);
-        qemu_co_queue_restart_all(&s->overlapping_queue);
-        qemu_aio_unref(acb);
-        return ret;
-    }
-
-    qemu_coroutine_yield();
+    sd_co_rw_vector(acb);
 
     QLIST_REMOVE(acb, aiocb_siblings);
     qemu_co_queue_restart_all(&s->overlapping_queue);
-    return acb->ret;
+    ret = acb->ret;
+    qemu_aio_unref(acb);
+    return ret;
 }
 
 static int coroutine_fn sd_co_flush_to_disk(BlockDriverState *bs)
 {
     BDRVSheepdogState *s = bs->opaque;
     SheepdogAIOCB *acb;
+    int ret;
     AIOReq *aio_req;
 
     if (s->cache_flags != SD_FLAG_CMD_CACHE) {
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn sd_co_flush_to_disk(BlockDriverState *bs)
 
     acb = sd_aio_setup(bs, NULL, 0, 0);
     acb->aiocb_type = AIOCB_FLUSH_CACHE;
-    acb->aio_done_func = sd_finish_aiocb;
 
+    acb->nr_pending++;
     aio_req = alloc_aio_req(s, acb, vid_to_vdi_oid(s->inode.vdi_id),
                             0, 0, 0, false, 0, 0);
     QLIST_INSERT_HEAD(&s->inflight_aio_head, aio_req, aio_siblings);
     add_aio_request(s, aio_req, NULL, 0, acb->aiocb_type);
 
-    qemu_coroutine_yield();
-    return acb->ret;
+    if (--acb->nr_pending) {
+        qemu_coroutine_yield();
+    }
+    ret = acb->ret;
+    qemu_aio_unref(acb);
+    return ret;
 }
 
 static int sd_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int sd_co_pdiscard(BlockDriverState *bs, int64_t offset,
     acb = sd_aio_setup(bs, &discard_iov, offset >> BDRV_SECTOR_BITS,
                        count >> BDRV_SECTOR_BITS);
     acb->aiocb_type = AIOCB_DISCARD_OBJ;
-    acb->aio_done_func = sd_finish_aiocb;
 
 retry:
     if (check_overlapping_aiocb(s, acb)) {
@@ -XXX,XX +XXX,XX @@ retry:
         goto retry;
     }
 
-    ret = sd_co_rw_vector(acb);
-    if (ret <= 0) {
-        QLIST_REMOVE(acb, aiocb_siblings);
-        qemu_co_queue_restart_all(&s->overlapping_queue);
-        qemu_aio_unref(acb);
-        return ret;
-    }
-
-    qemu_coroutine_yield();
+    sd_co_rw_vector(acb);
 
     QLIST_REMOVE(acb, aiocb_siblings);
     qemu_co_queue_restart_all(&s->overlapping_queue);
-
-    return acb->ret;
+    ret = acb->ret;
+    qemu_aio_unref(acb);
+    return ret;
 }
 
 static coroutine_fn int64_t
-- 
2.9.3

From: Paolo Bonzini <pbonzini@redhat.com>

Sheepdog's AIOCB are completely internal entities for a group of
requests and do not need dynamic allocation.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 20161129113245.32724-4-pbonzini@redhat.com
Signed-off-by: Jeff Cody <jcody@redhat.com>
---
 block/sheepdog.c | 99 ++++++++++++++++++++++----------------------------------
 1 file changed, 39 insertions(+), 60 deletions(-)

diff --git a/block/sheepdog.c b/block/sheepdog.c
index XXXXXXX..XXXXXXX 100644
--- a/block/sheepdog.c
+++ b/block/sheepdog.c
@@ -XXX,XX +XXX,XX @@ static inline size_t count_data_objs(const struct SheepdogInode *inode)
     } while (0)
 
 typedef struct SheepdogAIOCB SheepdogAIOCB;
+typedef struct BDRVSheepdogState BDRVSheepdogState;
 
 typedef struct AIOReq {
     SheepdogAIOCB *aiocb;
@@ -XXX,XX +XXX,XX @@ enum AIOCBState {
        || y->max_affect_data_idx < x->min_affect_data_idx))
 
 struct SheepdogAIOCB {
-    BlockAIOCB common;
+    BDRVSheepdogState *s;
 
     QEMUIOVector *qiov;
 
@@ -XXX,XX +XXX,XX @@ struct SheepdogAIOCB {
     QLIST_ENTRY(SheepdogAIOCB) aiocb_siblings;
 };
 
-typedef struct BDRVSheepdogState {
+struct BDRVSheepdogState {
     BlockDriverState *bs;
     AioContext *aio_context;
 
@@ -XXX,XX +XXX,XX @@ typedef struct BDRVSheepdogState {
 
     CoQueue overlapping_queue;
     QLIST_HEAD(inflight_aiocb_head, SheepdogAIOCB) inflight_aiocb_head;
-} BDRVSheepdogState;
+};
 
 typedef struct BDRVSheepdogReopenState {
     int fd;
@@ -XXX,XX +XXX,XX @@ static inline void free_aio_req(BDRVSheepdogState *s, AIOReq *aio_req)
     acb->nr_pending--;
 }
 
-static const AIOCBInfo sd_aiocb_info = {
-    .aiocb_size     = sizeof(SheepdogAIOCB),
-};
-
-static SheepdogAIOCB *sd_aio_setup(BlockDriverState *bs, QEMUIOVector *qiov,
-                                   int64_t sector_num, int nb_sectors)
+static void sd_aio_setup(SheepdogAIOCB *acb, BDRVSheepdogState *s,
+                         QEMUIOVector *qiov, int64_t sector_num, int nb_sectors,
+                         int type)
 {
-    SheepdogAIOCB *acb;
     uint32_t object_size;
-    BDRVSheepdogState *s = bs->opaque;
 
     object_size = (UINT32_C(1) << s->inode.block_size_shift);
 
-    acb = qemu_aio_get(&sd_aiocb_info, bs, NULL, NULL);
+    acb->s = s;
 
     acb->qiov = qiov;
 
@@ -XXX,XX +XXX,XX @@ static SheepdogAIOCB *sd_aio_setup(BlockDriverState *bs, QEMUIOVector *qiov,
 
     acb->min_dirty_data_idx = UINT32_MAX;
     acb->max_dirty_data_idx = 0;
-
-    return acb;
+    acb->aiocb_type = type;
 }
 
 /* Return -EIO in case of error, file descriptor on success */
@@ -XXX,XX +XXX,XX @@ static int sd_truncate(BlockDriverState *bs, int64_t offset)
  */
 static void coroutine_fn sd_write_done(SheepdogAIOCB *acb)
 {
-    BDRVSheepdogState *s = acb->common.bs->opaque;
+    BDRVSheepdogState *s = acb->s;
     struct iovec iov;
     AIOReq *aio_req;
     uint32_t offset, data_len, mn, mx;
@@ -XXX,XX +XXX,XX @@ out:
  * Returns 1 when we need to wait a response, 0 when there is no sent
  * request and -errno in error cases.
  */
-static void coroutine_fn sd_co_rw_vector(void *p)
+static void coroutine_fn sd_co_rw_vector(SheepdogAIOCB *acb)
 {
-    SheepdogAIOCB *acb = p;
     int ret = 0;
     unsigned long len, done = 0, total = acb->nb_sectors * BDRV_SECTOR_SIZE;
     unsigned long idx;
     uint32_t object_size;
     uint64_t oid;
     uint64_t offset;
-    BDRVSheepdogState *s = acb->common.bs->opaque;
+    BDRVSheepdogState *s = acb->s;
     SheepdogInode *inode = &s->inode;
     AIOReq *aio_req;
 
@@ -XXX,XX +XXX,XX @@ static bool check_overlapping_aiocb(BDRVSheepdogState *s, SheepdogAIOCB *aiocb)
 static coroutine_fn int sd_co_writev(BlockDriverState *bs, int64_t sector_num,
                         int nb_sectors, QEMUIOVector *qiov)
 {
-    SheepdogAIOCB *acb;
+    SheepdogAIOCB acb;
     int ret;
     int64_t offset = (sector_num + nb_sectors) * BDRV_SECTOR_SIZE;
     BDRVSheepdogState *s = bs->opaque;
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int sd_co_writev(BlockDriverState *bs, int64_t sector_num,
         }
     }
 
-    acb = sd_aio_setup(bs, qiov, sector_num, nb_sectors);
-    acb->aiocb_type = AIOCB_WRITE_UDATA;
+    sd_aio_setup(&acb, s, qiov, sector_num, nb_sectors, AIOCB_WRITE_UDATA);
 
 retry:
-    if (check_overlapping_aiocb(s, acb)) {
+    if (check_overlapping_aiocb(s, &acb)) {
         qemu_co_queue_wait(&s->overlapping_queue);
         goto retry;
     }
 
-    sd_co_rw_vector(acb);
-    sd_write_done(acb);
+    sd_co_rw_vector(&acb);
+    sd_write_done(&acb);
 
-    QLIST_REMOVE(acb, aiocb_siblings);
+    QLIST_REMOVE(&acb, aiocb_siblings);
     qemu_co_queue_restart_all(&s->overlapping_queue);
-    ret = acb->ret;
-    qemu_aio_unref(acb);
-    return ret;
+    return acb.ret;
 }
 
 static coroutine_fn int sd_co_readv(BlockDriverState *bs, int64_t sector_num,
                        int nb_sectors, QEMUIOVector *qiov)
 {
-    SheepdogAIOCB *acb;
-    int ret;
+    SheepdogAIOCB acb;
     BDRVSheepdogState *s = bs->opaque;
 
-    acb = sd_aio_setup(bs, qiov, sector_num, nb_sectors);
-    acb->aiocb_type = AIOCB_READ_UDATA;
+    sd_aio_setup(&acb, s, qiov, sector_num, nb_sectors, AIOCB_READ_UDATA);
 
 retry:
-    if (check_overlapping_aiocb(s, acb)) {
+    if (check_overlapping_aiocb(s, &acb)) {
         qemu_co_queue_wait(&s->overlapping_queue);
         goto retry;
     }
 
-    sd_co_rw_vector(acb);
+    sd_co_rw_vector(&acb);
 
-    QLIST_REMOVE(acb, aiocb_siblings);
+    QLIST_REMOVE(&acb, aiocb_siblings);
     qemu_co_queue_restart_all(&s->overlapping_queue);
-    ret = acb->ret;
-    qemu_aio_unref(acb);
-    return ret;
+    return acb.ret;
 }
 
 static int coroutine_fn sd_co_flush_to_disk(BlockDriverState *bs)
 {
     BDRVSheepdogState *s = bs->opaque;
-    SheepdogAIOCB *acb;
-    int ret;
+    SheepdogAIOCB acb;
     AIOReq *aio_req;
 
     if (s->cache_flags != SD_FLAG_CMD_CACHE) {
         return 0;
     }
 
-    acb = sd_aio_setup(bs, NULL, 0, 0);
-    acb->aiocb_type = AIOCB_FLUSH_CACHE;
+    sd_aio_setup(&acb, s, NULL, 0, 0, AIOCB_FLUSH_CACHE);
 
-    acb->nr_pending++;
-    aio_req = alloc_aio_req(s, acb, vid_to_vdi_oid(s->inode.vdi_id),
+    acb.nr_pending++;
+    aio_req = alloc_aio_req(s, &acb, vid_to_vdi_oid(s->inode.vdi_id),
                             0, 0, 0, false, 0, 0);
     QLIST_INSERT_HEAD(&s->inflight_aio_head, aio_req, aio_siblings);
-    add_aio_request(s, aio_req, NULL, 0, acb->aiocb_type);
+    add_aio_request(s, aio_req, NULL, 0, acb.aiocb_type);
 
-    if (--acb->nr_pending) {
+    if (--acb.nr_pending) {
         qemu_coroutine_yield();
     }
-    ret = acb->ret;
-    qemu_aio_unref(acb);
-    return ret;
+    return acb.ret;
 }
 
 static int sd_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
@@ -XXX,XX +XXX,XX @@ static int sd_load_vmstate(BlockDriverState *bs, QEMUIOVector *qiov,
 static coroutine_fn int sd_co_pdiscard(BlockDriverState *bs, int64_t offset,
                                       int count)
 {
-    SheepdogAIOCB *acb;
+    SheepdogAIOCB acb;
     BDRVSheepdogState *s = bs->opaque;
-    int ret;
     QEMUIOVector discard_iov;
     struct iovec iov;
     uint32_t zero = 0;
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int sd_co_pdiscard(BlockDriverState *bs, int64_t offset,
     if (!QEMU_IS_ALIGNED(offset | count, BDRV_SECTOR_SIZE)) {
         return -ENOTSUP;
     }
-    acb = sd_aio_setup(bs, &discard_iov, offset >> BDRV_SECTOR_BITS,
-                       count >> BDRV_SECTOR_BITS);
-    acb->aiocb_type = AIOCB_DISCARD_OBJ;
+    sd_aio_setup(&acb, s, &discard_iov, offset >> BDRV_SECTOR_BITS,
+                 count >> BDRV_SECTOR_BITS, AIOCB_DISCARD_OBJ);
 
 retry:
-    if (check_overlapping_aiocb(s, acb)) {
+    if (check_overlapping_aiocb(s, &acb)) {
         qemu_co_queue_wait(&s->overlapping_queue);
         goto retry;
     }
 
-    sd_co_rw_vector(acb);
+    sd_co_rw_vector(&acb);
 
-    QLIST_REMOVE(acb, aiocb_siblings);
+    QLIST_REMOVE(&acb, aiocb_siblings);
     qemu_co_queue_restart_all(&s->overlapping_queue);
-    ret = acb->ret;
-    qemu_aio_unref(acb);
-    return ret;
+    return acb.ret;
 }
 
 static coroutine_fn int64_t
-- 
2.9.3

From: Paolo Bonzini <pbonzini@redhat.com>

Add to the list in add_aio_request and, indirectly, resend_aioreq.  Inline
free_aio_req in the caller, it does not simply undo alloc_aio_req's job.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 20161129113245.32724-5-pbonzini@redhat.com
Signed-off-by: Jeff Cody <jcody@redhat.com>
---
 block/sheepdog.c | 23 ++++++-----------------
 1 file changed, 6 insertions(+), 17 deletions(-)

diff --git a/block/sheepdog.c b/block/sheepdog.c
index XXXXXXX..XXXXXXX 100644
--- a/block/sheepdog.c
+++ b/block/sheepdog.c
@@ -XXX,XX +XXX,XX @@ static inline AIOReq *alloc_aio_req(BDRVSheepdogState *s, SheepdogAIOCB *acb,
     return aio_req;
 }
 
-static inline void free_aio_req(BDRVSheepdogState *s, AIOReq *aio_req)
-{
-    SheepdogAIOCB *acb = aio_req->aiocb;
-
-    QLIST_REMOVE(aio_req, aio_siblings);
-    g_free(aio_req);
-
-    acb->nr_pending--;
-}
-
 static void sd_aio_setup(SheepdogAIOCB *acb, BDRVSheepdogState *s,
                          QEMUIOVector *qiov, int64_t sector_num, int nb_sectors,
                          int type)
@@ -XXX,XX +XXX,XX @@ static coroutine_fn void reconnect_to_sdog(void *opaque)
     while (!QLIST_EMPTY(&s->failed_aio_head)) {
         aio_req = QLIST_FIRST(&s->failed_aio_head);
         QLIST_REMOVE(aio_req, aio_siblings);
-        QLIST_INSERT_HEAD(&s->inflight_aio_head, aio_req, aio_siblings);
         resend_aioreq(s, aio_req);
     }
 }
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn aio_read_response(void *opaque)
     */
     s->co_recv = NULL;
 
+    QLIST_REMOVE(aio_req, aio_siblings);
     switch (rsp.result) {
     case SD_RES_SUCCESS:
         break;
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn aio_read_response(void *opaque)
         break;
     }
 
-    free_aio_req(s, aio_req);
-    if (!acb->nr_pending) {
+    g_free(aio_req);
+
+    if (!--acb->nr_pending) {
         /*
          * We've finished all requests which belong to the AIOCB, so
          * we can switch back to sd_co_readv/writev now.
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn add_aio_request(BDRVSheepdogState *s, AIOReq *aio_req,
     uint64_t old_oid = aio_req->base_oid;
     bool create = aio_req->create;
 
+    QLIST_INSERT_HEAD(&s->inflight_aio_head, aio_req, aio_siblings);
+
     if (!nr_copies) {
         error_report("bug");
     }
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn sd_write_done(SheepdogAIOCB *acb)
         iov.iov_len = sizeof(s->inode);
         aio_req = alloc_aio_req(s, acb, vid_to_vdi_oid(s->inode.vdi_id),
                                 data_len, offset, 0, false, 0, offset);
-        QLIST_INSERT_HEAD(&s->inflight_aio_head, aio_req, aio_siblings);
         add_aio_request(s, aio_req, &iov, 1, AIOCB_WRITE_UDATA);
         if (--acb->nr_pending) {
             qemu_coroutine_yield();
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn sd_co_rw_vector(SheepdogAIOCB *acb)
                                 old_oid,
                                 acb->aiocb_type == AIOCB_DISCARD_OBJ ?
                                 0 : done);
-        QLIST_INSERT_HEAD(&s->inflight_aio_head, aio_req, aio_siblings);
-
         add_aio_request(s, aio_req, acb->qiov->iov, acb->qiov->niov,
                         acb->aiocb_type);
     done:
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn sd_co_flush_to_disk(BlockDriverState *bs)
     acb.nr_pending++;
     aio_req = alloc_aio_req(s, &acb, vid_to_vdi_oid(s->inode.vdi_id),
                             0, 0, 0, false, 0, 0);
-    QLIST_INSERT_HEAD(&s->inflight_aio_head, aio_req, aio_siblings);
     add_aio_request(s, aio_req, NULL, 0, acb.aiocb_type);
 
     if (--acb.nr_pending) {
-- 
2.9.3

From: Paolo Bonzini <pbonzini@redhat.com>

Wrap the code that was copied repeatedly in the two functions,
sd_aio_setup and sd_aio_complete.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 20161129113245.32724-6-pbonzini@redhat.com
Signed-off-by: Jeff Cody <jcody@redhat.com>
---
 block/sheepdog.c | 66 ++++++++++++++++++++++++++------------------------------
 1 file changed, 30 insertions(+), 36 deletions(-)

diff --git a/block/sheepdog.c b/block/sheepdog.c
index XXXXXXX..XXXXXXX 100644
--- a/block/sheepdog.c
+++ b/block/sheepdog.c
@@ -XXX,XX +XXX,XX @@ static inline AIOReq *alloc_aio_req(BDRVSheepdogState *s, SheepdogAIOCB *acb,
     return aio_req;
 }
 
+static void wait_for_overlapping_aiocb(BDRVSheepdogState *s, SheepdogAIOCB *acb)
+{
+    SheepdogAIOCB *cb;
+
+retry:
+    QLIST_FOREACH(cb, &s->inflight_aiocb_head, aiocb_siblings) {
+        if (AIOCBOverlapping(acb, cb)) {
+            qemu_co_queue_wait(&s->overlapping_queue);
+            goto retry;
+        }
+    }
+}
+
 static void sd_aio_setup(SheepdogAIOCB *acb, BDRVSheepdogState *s,
                          QEMUIOVector *qiov, int64_t sector_num, int nb_sectors,
                          int type)
@@ -XXX,XX +XXX,XX @@ static void sd_aio_setup(SheepdogAIOCB *acb, BDRVSheepdogState *s,
     acb->min_dirty_data_idx = UINT32_MAX;
     acb->max_dirty_data_idx = 0;
     acb->aiocb_type = type;
+
+    if (type == AIOCB_FLUSH_CACHE) {
+        return;
+    }
+
+    wait_for_overlapping_aiocb(s, acb);
+    QLIST_INSERT_HEAD(&s->inflight_aiocb_head, acb, aiocb_siblings);
 }
 
 /* Return -EIO in case of error, file descriptor on success */
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn sd_co_rw_vector(SheepdogAIOCB *acb)
     }
 }
 
-static bool check_overlapping_aiocb(BDRVSheepdogState *s, SheepdogAIOCB *aiocb)
+static void sd_aio_complete(SheepdogAIOCB *acb)
 {
-    SheepdogAIOCB *cb;
-
-    QLIST_FOREACH(cb, &s->inflight_aiocb_head, aiocb_siblings) {
-        if (AIOCBOverlapping(aiocb, cb)) {
-            return true;
-        }
+    if (acb->aiocb_type == AIOCB_FLUSH_CACHE) {
+        return;
     }
 
-    QLIST_INSERT_HEAD(&s->inflight_aiocb_head, aiocb, aiocb_siblings);
-    return false;
+    QLIST_REMOVE(acb, aiocb_siblings);
+    qemu_co_queue_restart_all(&acb->s->overlapping_queue);
 }
 
 static coroutine_fn int sd_co_writev(BlockDriverState *bs, int64_t sector_num,
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int sd_co_writev(BlockDriverState *bs, int64_t sector_num,
     }
 
     sd_aio_setup(&acb, s, qiov, sector_num, nb_sectors, AIOCB_WRITE_UDATA);
-
-retry:
-    if (check_overlapping_aiocb(s, &acb)) {
-        qemu_co_queue_wait(&s->overlapping_queue);
-        goto retry;
-    }
-
     sd_co_rw_vector(&acb);
     sd_write_done(&acb);
+    sd_aio_complete(&acb);
 
-    QLIST_REMOVE(&acb, aiocb_siblings);
-    qemu_co_queue_restart_all(&s->overlapping_queue);
     return acb.ret;
 }
 
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int sd_co_readv(BlockDriverState *bs, int64_t sector_num,
     BDRVSheepdogState *s = bs->opaque;
 
     sd_aio_setup(&acb, s, qiov, sector_num, nb_sectors, AIOCB_READ_UDATA);
-
-retry:
-    if (check_overlapping_aiocb(s, &acb)) {
-        qemu_co_queue_wait(&s->overlapping_queue);
-        goto retry;
-    }
-
     sd_co_rw_vector(&acb);
+    sd_aio_complete(&acb);
 
-    QLIST_REMOVE(&acb, aiocb_siblings);
-    qemu_co_queue_restart_all(&s->overlapping_queue);
     return acb.ret;
 }
 
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn sd_co_flush_to_disk(BlockDriverState *bs)
     if (--acb.nr_pending) {
         qemu_coroutine_yield();
     }
+
+    sd_aio_complete(&acb);
     return acb.ret;
 }
 
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int sd_co_pdiscard(BlockDriverState *bs, int64_t offset,
     }
     sd_aio_setup(&acb, s, &discard_iov, offset >> BDRV_SECTOR_BITS,
                  count >> BDRV_SECTOR_BITS, AIOCB_DISCARD_OBJ);
-
-retry:
-    if (check_overlapping_aiocb(s, &acb)) {
-        qemu_co_queue_wait(&s->overlapping_queue);
-        goto retry;
-    }
-
     sd_co_rw_vector(&acb);
+    sd_aio_complete(&acb);
 
-    QLIST_REMOVE(&acb, aiocb_siblings);
-    qemu_co_queue_restart_all(&s->overlapping_queue);
     return acb.ret;
 }
 
-- 
2.9.3

The following changes since commit 812b835fb4d23dd108b2f9802158472d50b73579:

Merge remote-tracking branch 'remotes/maxreitz/tags/pull-block-2019-05-07' into staging (2019-05-09 16:31:12 +0100)

are available in the Git repository at:

https://github.com/stefanha/qemu.git tags/block-pull-request

for you to fetch changes up to e84125761f78919fe63616d9888ea45e72dc956f:

docs: add Security chapter to the documentation (2019-05-10 10:53:52 +0100)

----------------------------------------------------------------
Pull request

----------------------------------------------------------------

Andrey Shinkevich (1):
  block/io.c: fix for the allocation failure

Jules Irenge (3):
  util/readline: add a space to fix errors by checkpatch tool
  util: readline: replace tab indent by four spaces to fix checkpatch
    errors
  util/readline: Add braces to fix checkpatch errors

Nikita Alekseev (1):
  block: Add coroutine_fn to bdrv_check_co_entry

Paolo Bonzini (1):
  aio-posix: ensure poll mode is left when aio_notify is called

Stefan Hajnoczi (2):
  docs: add Secure Coding Practices to developer docs
  docs: add Security chapter to the documentation

-- 
2.21.0

From: Jules Irenge <jbi.octave@gmail.com>

util/readline: add a space to fix errors reported by checkpatch.pl tool
"ERROR: space required before the open parenthesis"
"ERROR: space required after that ..."
within "util/redline.c" file

Signed-off-by: Jules Irenge <jbi.octave@gmail.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20190401024406.10819-2-jbi.octave@gmail.com
Message-Id: <20190401024406.10819-2-jbi.octave@gmail.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 util/readline.c | 34 +++++++++++++++++-----------------
 1 file changed, 17 insertions(+), 17 deletions(-)

diff --git a/util/readline.c b/util/readline.c
index XXXXXXX..XXXXXXX 100644
--- a/util/readline.c
+++ b/util/readline.c
@@ -XXX,XX +XXX,XX @@ static void readline_update(ReadLineState *rs)
 
     if (rs->cmd_buf_size != rs->last_cmd_buf_size ||
         memcmp(rs->cmd_buf, rs->last_cmd_buf, rs->cmd_buf_size) != 0) {
-        for(i = 0; i < rs->last_cmd_buf_index; i++) {
+        for (i = 0; i < rs->last_cmd_buf_index; i++) {
             rs->printf_func(rs->opaque, "\033[D");
         }
         rs->cmd_buf[rs->cmd_buf_size] = '\0';
         if (rs->read_password) {
             len = strlen(rs->cmd_buf);
-            for(i = 0; i < len; i++)
+            for (i = 0; i < len; i++)
                 rs->printf_func(rs->opaque, "*");
         } else {
             rs->printf_func(rs->opaque, "%s", rs->cmd_buf);
@@ -XXX,XX +XXX,XX @@ static void readline_update(ReadLineState *rs)
     if (rs->cmd_buf_index != rs->last_cmd_buf_index) {
         delta = rs->cmd_buf_index - rs->last_cmd_buf_index;
         if (delta > 0) {
-            for(i = 0;i < delta; i++) {
+            for (i = 0; i < delta; i++) {
                 rs->printf_func(rs->opaque, "\033[C");
             }
         } else {
             delta = -delta;
-            for(i = 0;i < delta; i++) {
+            for (i = 0; i < delta; i++) {
                 rs->printf_func(rs->opaque, "\033[D");
             }
         }
@@ -XXX,XX +XXX,XX @@ static void readline_completion(ReadLineState *rs)
         return;
     if (rs->nb_completions == 1) {
         len = strlen(rs->completions[0]);
-        for(i = rs->completion_index; i < len; i++) {
+        for (i = rs->completion_index; i < len; i++) {
             readline_insert_char(rs, rs->completions[0][i]);
         }
         /* extra space for next argument. XXX: make it more generic */
@@ -XXX,XX +XXX,XX @@ static void readline_completion(ReadLineState *rs)
               completion_comp);
         rs->printf_func(rs->opaque, "\n");
         max_width = 0;
-        max_prefix = 0;	
-        for(i = 0; i < rs->nb_completions; i++) {
+        max_prefix = 0;
+        for (i = 0; i < rs->nb_completions; i++) {
             len = strlen(rs->completions[i]);
-            if (i==0) {
+            if (i == 0) {
                 max_prefix = len;
             } else {
                 if (len < max_prefix)
                     max_prefix = len;
-                for(j=0; j<max_prefix; j++) {
+                for (j = 0; j < max_prefix; j++) {
                     if (rs->completions[i][j] != rs->completions[0][j])
                         max_prefix = j;
                 }
@@ -XXX,XX +XXX,XX @@ static void readline_completion(ReadLineState *rs)
             if (len > max_width)
                 max_width = len;
         }
-        if (max_prefix > 0) 
-            for(i = rs->completion_index; i < max_prefix; i++) {
+        if (max_prefix > 0)
+            for (i = rs->completion_index; i < max_prefix; i++) {
                 readline_insert_char(rs, rs->completions[0][i]);
             }
         max_width += 2;
@@ -XXX,XX +XXX,XX @@ static void readline_completion(ReadLineState *rs)
             max_width = 80;
         nb_cols = 80 / max_width;
         j = 0;
-        for(i = 0; i < rs->nb_completions; i++) {
+        for (i = 0; i < rs->nb_completions; i++) {
             rs->printf_func(rs->opaque, "%-*s", max_width, rs->completions[i]);
             if (++j == nb_cols || i == (rs->nb_completions - 1)) {
                 rs->printf_func(rs->opaque, "\n");
@@ -XXX,XX +XXX,XX @@ static void readline_clear_screen(ReadLineState *rs)
 /* return true if command handled */
 void readline_handle_byte(ReadLineState *rs, int ch)
 {
-    switch(rs->esc_state) {
+    switch (rs->esc_state) {
     case IS_NORM:
-        switch(ch) {
+        switch (ch) {
         case 1:
             readline_bol(rs);
             break;
@@ -XXX,XX +XXX,XX @@ void readline_handle_byte(ReadLineState *rs, int ch)
         }
         break;
     case IS_CSI:
-        switch(ch) {
+        switch (ch) {
 	case 'A':
 	case 'F':
 	    readline_up_char(rs);
@@ -XXX,XX +XXX,XX @@ void readline_handle_byte(ReadLineState *rs, int ch)
             rs->esc_param = rs->esc_param * 10 + (ch - '0');
             goto the_end;
         case '~':
-            switch(rs->esc_param) {
+            switch (rs->esc_param) {
             case 1:
                 readline_bol(rs);
                 break;
@@ -XXX,XX +XXX,XX @@ void readline_handle_byte(ReadLineState *rs, int ch)
     the_end:
         break;
     case IS_SS3:
-        switch(ch) {
+        switch (ch) {
         case 'F':
             readline_eol(rs);
             break;
-- 
2.21.0

From: Jules Irenge <jbi.octave@gmail.com>

Replace tab indent by four spaces to fix errors issued by checkpatch.pl tool
"ERROR: code indent should never use tabs" within "util/readline.c" file.

Signed-off-by: Jules Irenge <jbi.octave@gmail.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20190401024406.10819-3-jbi.octave@gmail.com
Message-Id: <20190401024406.10819-3-jbi.octave@gmail.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 util/readline.c | 98 ++++++++++++++++++++++++-------------------------
 1 file changed, 49 insertions(+), 49 deletions(-)

diff --git a/util/readline.c b/util/readline.c
index XXXXXXX..XXXXXXX 100644
--- a/util/readline.c
+++ b/util/readline.c
@@ -XXX,XX +XXX,XX @@ static void readline_up_char(ReadLineState *rs)
     int idx;
 
     if (rs->hist_entry == 0)
-	return;
+        return;
     if (rs->hist_entry == -1) {
-	/* Find latest entry */
-	for (idx = 0; idx < READLINE_MAX_CMDS; idx++) {
-	    if (rs->history[idx] == NULL)
-		break;
-	}
-	rs->hist_entry = idx;
+        /* Find latest entry */
+        for (idx = 0; idx < READLINE_MAX_CMDS; idx++) {
+            if (rs->history[idx] == NULL)
+                break;
+        }
+        rs->hist_entry = idx;
     }
     rs->hist_entry--;
     if (rs->hist_entry >= 0) {
-	pstrcpy(rs->cmd_buf, sizeof(rs->cmd_buf),
+        pstrcpy(rs->cmd_buf, sizeof(rs->cmd_buf),
                 rs->history[rs->hist_entry]);
-	rs->cmd_buf_index = rs->cmd_buf_size = strlen(rs->cmd_buf);
+        rs->cmd_buf_index = rs->cmd_buf_size = strlen(rs->cmd_buf);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void readline_down_char(ReadLineState *rs)
         return;
     if (rs->hist_entry < READLINE_MAX_CMDS - 1 &&
         rs->history[++rs->hist_entry] != NULL) {
-	pstrcpy(rs->cmd_buf, sizeof(rs->cmd_buf),
+        pstrcpy(rs->cmd_buf, sizeof(rs->cmd_buf),
                 rs->history[rs->hist_entry]);
     } else {
         rs->cmd_buf[0] = 0;
-	rs->hist_entry = -1;
+        rs->hist_entry = -1;
     }
     rs->cmd_buf_index = rs->cmd_buf_size = strlen(rs->cmd_buf);
 }
@@ -XXX,XX +XXX,XX @@ static void readline_hist_add(ReadLineState *rs, const char *cmdline)
     int idx;
 
     if (cmdline[0] == '\0')
-	return;
+        return;
     new_entry = NULL;
     if (rs->hist_entry != -1) {
-	/* We were editing an existing history entry: replace it */
-	hist_entry = rs->history[rs->hist_entry];
-	idx = rs->hist_entry;
-	if (strcmp(hist_entry, cmdline) == 0) {
-	    goto same_entry;
-	}
+        /* We were editing an existing history entry: replace it */
+        hist_entry = rs->history[rs->hist_entry];
+        idx = rs->hist_entry;
+        if (strcmp(hist_entry, cmdline) == 0) {
+            goto same_entry;
+        }
     }
     /* Search cmdline in history buffers */
     for (idx = 0; idx < READLINE_MAX_CMDS; idx++) {
-	hist_entry = rs->history[idx];
-	if (hist_entry == NULL)
-	    break;
-	if (strcmp(hist_entry, cmdline) == 0) {
-	same_entry:
-	    new_entry = hist_entry;
-	    /* Put this entry at the end of history */
-	    memmove(&rs->history[idx], &rs->history[idx + 1],
-		    (READLINE_MAX_CMDS - (idx + 1)) * sizeof(char *));
-	    rs->history[READLINE_MAX_CMDS - 1] = NULL;
-	    for (; idx < READLINE_MAX_CMDS; idx++) {
-		if (rs->history[idx] == NULL)
-		    break;
-	    }
-	    break;
-	}
+        hist_entry = rs->history[idx];
+        if (hist_entry == NULL)
+            break;
+        if (strcmp(hist_entry, cmdline) == 0) {
+        same_entry:
+            new_entry = hist_entry;
+            /* Put this entry at the end of history */
+            memmove(&rs->history[idx], &rs->history[idx + 1],
+                    (READLINE_MAX_CMDS - (idx + 1)) * sizeof(char *));
+            rs->history[READLINE_MAX_CMDS - 1] = NULL;
+            for (; idx < READLINE_MAX_CMDS; idx++) {
+                if (rs->history[idx] == NULL)
+                    break;
+            }
+            break;
+        }
     }
     if (idx == READLINE_MAX_CMDS) {
-	/* Need to get one free slot */
+        /* Need to get one free slot */
         g_free(rs->history[0]);
-	memmove(rs->history, &rs->history[1],
-	        (READLINE_MAX_CMDS - 1) * sizeof(char *));
-	rs->history[READLINE_MAX_CMDS - 1] = NULL;
-	idx = READLINE_MAX_CMDS - 1;
+        memmove(rs->history, &rs->history[1],
+                (READLINE_MAX_CMDS - 1) * sizeof(char *));
+        rs->history[READLINE_MAX_CMDS - 1] = NULL;
+        idx = READLINE_MAX_CMDS - 1;
     }
     if (new_entry == NULL)
         new_entry = g_strdup(cmdline);
@@ -XXX,XX +XXX,XX @@ void readline_handle_byte(ReadLineState *rs, int ch)
         case 8:
             readline_backspace(rs);
             break;
-	case 155:
+        case 155:
             rs->esc_state = IS_CSI;
-	    break;
+            break;
         default:
             if (ch >= 32) {
                 readline_insert_char(rs, ch);
@@ -XXX,XX +XXX,XX @@ void readline_handle_byte(ReadLineState *rs, int ch)
         break;
     case IS_CSI:
         switch (ch) {
-	case 'A':
-	case 'F':
-	    readline_up_char(rs);
-	    break;
-	case 'B':
-	case 'E':
-	    readline_down_char(rs);
-	    break;
+        case 'A':
+        case 'F':
+            readline_up_char(rs);
+            break;
+        case 'B':
+        case 'E':
+            readline_down_char(rs);
+            break;
         case 'D':
             readline_backward_char(rs);
             break;
-- 
2.21.0

From: Jules Irenge <jbi.octave@gmail.com>

Add braces to fix errors issued by checkpatch.pl tool
"ERROR: braces {} are necessary for all arms of this statement"
Within "util/readline.c" file
Message-Id: <20190330112142.14082-1-jbi.octave@gmail.com>

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 util/readline.c | 50 ++++++++++++++++++++++++++++++++-----------------
 1 file changed, 33 insertions(+), 17 deletions(-)

diff --git a/util/readline.c b/util/readline.c
index XXXXXXX..XXXXXXX 100644
--- a/util/readline.c
+++ b/util/readline.c
@@ -XXX,XX +XXX,XX @@ static void readline_update(ReadLineState *rs)
         rs->cmd_buf[rs->cmd_buf_size] = '\0';
         if (rs->read_password) {
             len = strlen(rs->cmd_buf);
-            for (i = 0; i < len; i++)
+            for (i = 0; i < len; i++) {
                 rs->printf_func(rs->opaque, "*");
+            }
         } else {
             rs->printf_func(rs->opaque, "%s", rs->cmd_buf);
         }
@@ -XXX,XX +XXX,XX @@ static void readline_up_char(ReadLineState *rs)
 {
     int idx;
 
-    if (rs->hist_entry == 0)
+    if (rs->hist_entry == 0) {
         return;
+    }
     if (rs->hist_entry == -1) {
         /* Find latest entry */
         for (idx = 0; idx < READLINE_MAX_CMDS; idx++) {
-            if (rs->history[idx] == NULL)
+            if (rs->history[idx] == NULL) {
                 break;
+            }
         }
         rs->hist_entry = idx;
     }
@@ -XXX,XX +XXX,XX @@ static void readline_up_char(ReadLineState *rs)
 
 static void readline_down_char(ReadLineState *rs)
 {
-    if (rs->hist_entry == -1)
+    if (rs->hist_entry == -1) {
         return;
+    }
     if (rs->hist_entry < READLINE_MAX_CMDS - 1 &&
         rs->history[++rs->hist_entry] != NULL) {
         pstrcpy(rs->cmd_buf, sizeof(rs->cmd_buf),
@@ -XXX,XX +XXX,XX @@ static void readline_hist_add(ReadLineState *rs, const char *cmdline)
     char *hist_entry, *new_entry;
     int idx;
 
-    if (cmdline[0] == '\0')
+    if (cmdline[0] == '\0') {
         return;
+    }
     new_entry = NULL;
     if (rs->hist_entry != -1) {
         /* We were editing an existing history entry: replace it */
@@ -XXX,XX +XXX,XX @@ static void readline_hist_add(ReadLineState *rs, const char *cmdline)
     /* Search cmdline in history buffers */
     for (idx = 0; idx < READLINE_MAX_CMDS; idx++) {
         hist_entry = rs->history[idx];
-        if (hist_entry == NULL)
+        if (hist_entry == NULL) {
             break;
+        }
         if (strcmp(hist_entry, cmdline) == 0) {
         same_entry:
             new_entry = hist_entry;
@@ -XXX,XX +XXX,XX @@ static void readline_hist_add(ReadLineState *rs, const char *cmdline)
                     (READLINE_MAX_CMDS - (idx + 1)) * sizeof(char *));
             rs->history[READLINE_MAX_CMDS - 1] = NULL;
             for (; idx < READLINE_MAX_CMDS; idx++) {
-                if (rs->history[idx] == NULL)
+                if (rs->history[idx] == NULL) {
                     break;
+                }
             }
             break;
         }
@@ -XXX,XX +XXX,XX @@ static void readline_hist_add(ReadLineState *rs, const char *cmdline)
         rs->history[READLINE_MAX_CMDS - 1] = NULL;
         idx = READLINE_MAX_CMDS - 1;
     }
-    if (new_entry == NULL)
+    if (new_entry == NULL) {
         new_entry = g_strdup(cmdline);
+    }
     rs->history[idx] = new_entry;
     rs->hist_entry = -1;
 }
@@ -XXX,XX +XXX,XX @@ static void readline_completion(ReadLineState *rs)
     g_free(cmdline);
 
     /* no completion found */
-    if (rs->nb_completions <= 0)
+    if (rs->nb_completions <= 0) {
         return;
+    }
     if (rs->nb_completions == 1) {
         len = strlen(rs->completions[0]);
         for (i = rs->completion_index; i < len; i++) {
             readline_insert_char(rs, rs->completions[0][i]);
         }
         /* extra space for next argument. XXX: make it more generic */
-        if (len > 0 && rs->completions[0][len - 1] != '/')
+        if (len > 0 && rs->completions[0][len - 1] != '/') {
             readline_insert_char(rs, ' ');
+        }
     } else {
         qsort(rs->completions, rs->nb_completions, sizeof(char *),
               completion_comp);
@@ -XXX,XX +XXX,XX @@ static void readline_completion(ReadLineState *rs)
             if (i == 0) {
                 max_prefix = len;
             } else {
-                if (len < max_prefix)
+                if (len < max_prefix) {
                     max_prefix = len;
+                }
                 for (j = 0; j < max_prefix; j++) {
-                    if (rs->completions[i][j] != rs->completions[0][j])
+                    if (rs->completions[i][j] != rs->completions[0][j]) {
                         max_prefix = j;
+                    }
                 }
             }
-            if (len > max_width)
+            if (len > max_width) {
                 max_width = len;
+            }
         }
         if (max_prefix > 0)
             for (i = rs->completion_index; i < max_prefix; i++) {
                 readline_insert_char(rs, rs->completions[0][i]);
             }
         max_width += 2;
-        if (max_width < 10)
+        if (max_width < 10) {
             max_width = 10;
-        else if (max_width > 80)
+        } else if (max_width > 80) {
             max_width = 80;
+        }
         nb_cols = 80 / max_width;
         j = 0;
         for (i = 0; i < rs->nb_completions; i++) {
@@ -XXX,XX +XXX,XX @@ void readline_handle_byte(ReadLineState *rs, int ch)
         case 10:
         case 13:
             rs->cmd_buf[rs->cmd_buf_size] = '\0';
-            if (!rs->read_password)
+            if (!rs->read_password) {
                 readline_hist_add(rs, rs->cmd_buf);
+            }
             rs->printf_func(rs->opaque, "\n");
             rs->cmd_buf_index = 0;
             rs->cmd_buf_size = 0;
@@ -XXX,XX +XXX,XX @@ void readline_restart(ReadLineState *rs)
 
 const char *readline_get_history(ReadLineState *rs, unsigned int index)
 {
-    if (index >= READLINE_MAX_CMDS)
+    if (index >= READLINE_MAX_CMDS) {
         return NULL;
+    }
     return rs->history[index];
 }
 
-- 
2.21.0

From: Andrey Shinkevich <andrey.shinkevich@virtuozzo.com>

On a file system used by the customer, fallocate() returns an error
if the block is not properly aligned. So, bdrv_co_pwrite_zeroes()
fails. We can handle that case the same way as it is done for the
unsupported cases, namely, call to bdrv_driver_pwritev() that writes
zeroes to an image for the unaligned chunk of the block.

Suggested-by: Denis V. Lunev <den@openvz.org>
Signed-off-by: Andrey Shinkevich <andrey.shinkevich@virtuozzo.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Message-id: 1554474244-553661-1-git-send-email-andrey.shinkevich@virtuozzo.com
Message-Id: <1554474244-553661-1-git-send-email-andrey.shinkevich@virtuozzo.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/io.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/block/io.c b/block/io.c
index XXXXXXX..XXXXXXX 100644
--- a/block/io.c
+++ b/block/io.c
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_co_do_pwrite_zeroes(BlockDriverState *bs,
             assert(!bs->supported_zero_flags);
         }
 
-        if (ret == -ENOTSUP && !(flags & BDRV_REQ_NO_FALLBACK)) {
+        if (ret < 0 && !(flags & BDRV_REQ_NO_FALLBACK)) {
             /* Fall back to bounce buffer if write zeroes is unsupported */
             BdrvRequestFlags write_flags = flags & ~BDRV_REQ_ZERO_WRITE;
 
-- 
2.21.0

From: Paolo Bonzini <pbonzini@redhat.com>

With aio=thread, adaptive polling makes latency worse rather than
better, because it delays the execution of the ThreadPool's
completion bottom half.

event_notifier_poll() does run while polling, detecting that
a bottom half was scheduled by a worker thread, but because
ctx->notifier is explicitly ignored in run_poll_handlers_once(),
scheduling the BH does not count as making progress and
run_poll_handlers() keeps running.  Fix this by recomputing
the deadline after *timeout could have changed.

With this change, ThreadPool still cannot participate in polling
but at least it does not suffer from extra latency.

Reported-by: Sergio Lopez <slp@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 20190409122823.12416-1-pbonzini@redhat.com
Cc: Stefan Hajnoczi <stefanha@gmail.com>
Cc: Kevin Wolf <kwolf@redhat.com>
Cc: qemu-block@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <1553692145-86728-1-git-send-email-pbonzini@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <20190409122823.12416-1-pbonzini@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 util/aio-posix.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/util/aio-posix.c b/util/aio-posix.c
index XXXXXXX..XXXXXXX 100644
--- a/util/aio-posix.c
+++ b/util/aio-posix.c
@@ -XXX,XX +XXX,XX @@ static bool run_poll_handlers_once(AioContext *ctx, int64_t *timeout)
         if (!node->deleted && node->io_poll &&
             aio_node_check(ctx, node->is_external) &&
             node->io_poll(node->opaque)) {
+            /*
+             * Polling was successful, exit try_poll_mode immediately
+             * to adjust the next polling time.
+             */
             *timeout = 0;
             if (node->opaque != &ctx->notifier) {
                 progress = true;
@@ -XXX,XX +XXX,XX @@ static bool run_poll_handlers(AioContext *ctx, int64_t max_ns, int64_t *timeout)
     do {
         progress = run_poll_handlers_once(ctx, timeout);
         elapsed_time = qemu_clock_get_ns(QEMU_CLOCK_REALTIME) - start_time;
-    } while (!progress && elapsed_time < max_ns
-             && !atomic_read(&ctx->poll_disable_cnt));
+        max_ns = qemu_soonest_timeout(*timeout, max_ns);
+        assert(!(max_ns && progress));
+    } while (elapsed_time < max_ns && !atomic_read(&ctx->poll_disable_cnt));
 
     /* If time has passed with no successful polling, adjust *timeout to
      * keep the same ending time.
@@ -XXX,XX +XXX,XX @@ static bool run_poll_handlers(AioContext *ctx, int64_t max_ns, int64_t *timeout)
  */
 static bool try_poll_mode(AioContext *ctx, int64_t *timeout)
 {
-    /* See qemu_soonest_timeout() uint64_t hack */
-    int64_t max_ns = MIN((uint64_t)*timeout, (uint64_t)ctx->poll_ns);
+    int64_t max_ns = qemu_soonest_timeout(*timeout, ctx->poll_ns);
 
     if (max_ns && !atomic_read(&ctx->poll_disable_cnt)) {
         poll_set_started(ctx, true);
-- 
2.21.0

At KVM Forum 2018 I gave a presentation on security in QEMU:
https://www.youtube.com/watch?v=YAdRf_hwxU8 (video)
https://vmsplice.net/~stefan/stefanha-kvm-forum-2018.pdf (slides)

This patch adds a guide to secure coding practices.  This document
covers things that developers should know about security in QEMU.  It is
just a starting point that we can expand on later.  I hope it will be
useful as a resource for new contributors and will save code reviewers
from explaining the same concepts many times.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Acked-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Li Qiang <liq3ea@gmail.com>
Message-id: 20190509121820.16294-2-stefanha@redhat.com
Message-Id: <20190509121820.16294-2-stefanha@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 docs/devel/index.rst                   |   1 +
 docs/devel/secure-coding-practices.rst | 106 +++++++++++++++++++++++++
 2 files changed, 107 insertions(+)
 create mode 100644 docs/devel/secure-coding-practices.rst

diff --git a/docs/devel/index.rst b/docs/devel/index.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/devel/index.rst
+++ b/docs/devel/index.rst
@@ -XXX,XX +XXX,XX @@ Contents:
    stable-process
    testing
    decodetree
+   secure-coding-practices
diff --git a/docs/devel/secure-coding-practices.rst b/docs/devel/secure-coding-practices.rst
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/devel/secure-coding-practices.rst
@@ -XXX,XX +XXX,XX @@
+=======================
+Secure Coding Practices
+=======================
+This document covers topics that both developers and security researchers must
+be aware of so that they can develop safe code and audit existing code
+properly.
+
+Reporting Security Bugs
+-----------------------
+For details on how to report security bugs or ask questions about potential
+security bugs, see the `Security Process wiki page
+<https://wiki.qemu.org/SecurityProcess>`_.
+
+General Secure C Coding Practices
+---------------------------------
+Most CVEs (security bugs) reported against QEMU are not specific to
+virtualization or emulation.  They are simply C programming bugs.  Therefore
+it's critical to be aware of common classes of security bugs.
+
+There is a wide selection of resources available covering secure C coding.  For
+example, the `CERT C Coding Standard
+<https://wiki.sei.cmu.edu/confluence/display/c/SEI+CERT+C+Coding+Standard>`_
+covers the most important classes of security bugs.
+
+Instead of describing them in detail here, only the names of the most important
+classes of security bugs are mentioned:
+
+* Buffer overflows
+* Use-after-free and double-free
+* Integer overflows
+* Format string vulnerabilities
+
+Some of these classes of bugs can be detected by analyzers.  Static analysis is
+performed regularly by Coverity and the most obvious of these bugs are even
+reported by compilers.  Dynamic analysis is possible with valgrind, tsan, and
+asan.
+
+Input Validation
+----------------
+Inputs from the guest or external sources (e.g. network, files) cannot be
+trusted and may be invalid.  Inputs must be checked before using them in a way
+that could crash the program, expose host memory to the guest, or otherwise be
+exploitable by an attacker.
+
+The most sensitive attack surface is device emulation.  All hardware register
+accesses and data read from guest memory must be validated.  A typical example
+is a device that contains multiple units that are selectable by the guest via
+an index register::
+
+  typedef struct {
+      ProcessingUnit unit[2];
+      ...
+  } MyDeviceState;
+
+  static void mydev_writel(void *opaque, uint32_t addr, uint32_t val)
+  {
+      MyDeviceState *mydev = opaque;
+      ProcessingUnit *unit;
+
+      switch (addr) {
+      case MYDEV_SELECT_UNIT:
+          unit = &mydev->unit[val];   <-- this input wasn't validated!
+          ...
+      }
+  }
+
+If ``val`` is not in range [0, 1] then an out-of-bounds memory access will take
+place when ``unit`` is dereferenced.  The code must check that ``val`` is 0 or
+1 and handle the case where it is invalid.
+
+Unexpected Device Accesses
+--------------------------
+The guest may access device registers in unusual orders or at unexpected
+moments.  Device emulation code must not assume that the guest follows the
+typical "theory of operation" presented in driver writer manuals.  The guest
+may make nonsense accesses to device registers such as starting operations
+before the device has been fully initialized.
+
+A related issue is that device emulation code must be prepared for unexpected
+device register accesses while asynchronous operations are in progress.  A
+well-behaved guest might wait for a completion interrupt before accessing
+certain device registers.  Device emulation code must handle the case where the
+guest overwrites registers or submits further requests before an ongoing
+request completes.  Unexpected accesses must not cause memory corruption or
+leaks in QEMU.
+
+Invalid device register accesses can be reported with
+``qemu_log_mask(LOG_GUEST_ERROR, ...)``.  The ``-d guest_errors`` command-line
+option enables these log messages.
+
+Live Migration
+--------------
+Device state can be saved to disk image files and shared with other users.
+Live migration code must validate inputs when loading device state so an
+attacker cannot gain control by crafting invalid device states.  Device state
+is therefore considered untrusted even though it is typically generated by QEMU
+itself.
+
+Guest Memory Access Races
+-------------------------
+Guests with multiple vCPUs may modify guest RAM while device emulation code is
+running.  Device emulation code must copy in descriptors and other guest RAM
+structures and only process the local copy.  This prevents
+time-of-check-to-time-of-use (TOCTOU) race conditions that could cause QEMU to
+crash when a vCPU thread modifies guest RAM while device emulation is
+processing it.
-- 
2.21.0

This new chapter in the QEMU documentation covers the security
requirements that QEMU is designed to meet and principles for securely
deploying QEMU.

It is just a starting point that can be extended in the future with more
information.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Acked-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Li Qiang <liq3ea@gmail.com>
Message-id: 20190509121820.16294-3-stefanha@redhat.com
Message-Id: <20190509121820.16294-3-stefanha@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 Makefile           |   2 +-
 docs/security.texi | 131 +++++++++++++++++++++++++++++++++++++++++++++
 qemu-doc.texi      |   3 ++
 3 files changed, 135 insertions(+), 1 deletion(-)
 create mode 100644 docs/security.texi

diff --git a/Makefile b/Makefile
index XXXXXXX..XXXXXXX 100644
--- a/Makefile
+++ b/Makefile
@@ -XXX,XX +XXX,XX @@ qemu-doc.html qemu-doc.info qemu-doc.pdf qemu-doc.txt: \
 	qemu-img.texi qemu-nbd.texi qemu-options.texi qemu-option-trace.texi \
 	qemu-deprecated.texi qemu-monitor.texi qemu-img-cmds.texi qemu-ga.texi \
 	qemu-monitor-info.texi docs/qemu-block-drivers.texi \
-	docs/qemu-cpu-models.texi
+	docs/qemu-cpu-models.texi docs/security.texi
 
 docs/interop/qemu-ga-ref.dvi docs/interop/qemu-ga-ref.html \
     docs/interop/qemu-ga-ref.info docs/interop/qemu-ga-ref.pdf \
diff --git a/docs/security.texi b/docs/security.texi
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/security.texi
@@ -XXX,XX +XXX,XX @@
+@node Security
+@chapter Security
+
+@section Overview
+
+This chapter explains the security requirements that QEMU is designed to meet
+and principles for securely deploying QEMU.
+
+@section Security Requirements
+
+QEMU supports many different use cases, some of which have stricter security
+requirements than others.  The community has agreed on the overall security
+requirements that users may depend on.  These requirements define what is
+considered supported from a security perspective.
+
+@subsection Virtualization Use Case
+
+The virtualization use case covers cloud and virtual private server (VPS)
+hosting, as well as traditional data center and desktop virtualization.  These
+use cases rely on hardware virtualization extensions to execute guest code
+safely on the physical CPU at close-to-native speed.
+
+The following entities are untrusted, meaning that they may be buggy or
+malicious:
+
+@itemize
+@item Guest
+@item User-facing interfaces (e.g. VNC, SPICE, WebSocket)
+@item Network protocols (e.g. NBD, live migration)
+@item User-supplied files (e.g. disk images, kernels, device trees)
+@item Passthrough devices (e.g. PCI, USB)
+@end itemize
+
+Bugs affecting these entities are evaluated on whether they can cause damage in
+real-world use cases and treated as security bugs if this is the case.
+
+@subsection Non-virtualization Use Case
+
+The non-virtualization use case covers emulation using the Tiny Code Generator
+(TCG).  In principle the TCG and device emulation code used in conjunction with
+the non-virtualization use case should meet the same security requirements as
+the virtualization use case.  However, for historical reasons much of the
+non-virtualization use case code was not written with these security
+requirements in mind.
+
+Bugs affecting the non-virtualization use case are not considered security
+bugs at this time.  Users with non-virtualization use cases must not rely on
+QEMU to provide guest isolation or any security guarantees.
+
+@section Architecture
+
+This section describes the design principles that ensure the security
+requirements are met.
+
+@subsection Guest Isolation
+
+Guest isolation is the confinement of guest code to the virtual machine.  When
+guest code gains control of execution on the host this is called escaping the
+virtual machine.  Isolation also includes resource limits such as throttling of
+CPU, memory, disk, or network.  Guests must be unable to exceed their resource
+limits.
+
+QEMU presents an attack surface to the guest in the form of emulated devices.
+The guest must not be able to gain control of QEMU.  Bugs in emulated devices
+could allow malicious guests to gain code execution in QEMU.  At this point the
+guest has escaped the virtual machine and is able to act in the context of the
+QEMU process on the host.
+
+Guests often interact with other guests and share resources with them.  A
+malicious guest must not gain control of other guests or access their data.
+Disk image files and network traffic must be protected from other guests unless
+explicitly shared between them by the user.
+
+@subsection Principle of Least Privilege
+
+The principle of least privilege states that each component only has access to
+the privileges necessary for its function.  In the case of QEMU this means that
+each process only has access to resources belonging to the guest.
+
+The QEMU process should not have access to any resources that are inaccessible
+to the guest.  This way the guest does not gain anything by escaping into the
+QEMU process since it already has access to those same resources from within
+the guest.
+
+Following the principle of least privilege immediately fulfills guest isolation
+requirements.  For example, guest A only has access to its own disk image file
+@code{a.img} and not guest B's disk image file @code{b.img}.
+
+In reality certain resources are inaccessible to the guest but must be
+available to QEMU to perform its function.  For example, host system calls are
+necessary for QEMU but are not exposed to guests.  A guest that escapes into
+the QEMU process can then begin invoking host system calls.
+
+New features must be designed to follow the principle of least privilege.
+Should this not be possible for technical reasons, the security risk must be
+clearly documented so users are aware of the trade-off of enabling the feature.
+
+@subsection Isolation mechanisms
+
+Several isolation mechanisms are available to realize this architecture of
+guest isolation and the principle of least privilege.  With the exception of
+Linux seccomp, these mechanisms are all deployed by management tools that
+launch QEMU, such as libvirt.  They are also platform-specific so they are only
+described briefly for Linux here.
+
+The fundamental isolation mechanism is that QEMU processes must run as
+unprivileged users.  Sometimes it seems more convenient to launch QEMU as
+root to give it access to host devices (e.g. @code{/dev/net/tun}) but this poses a
+huge security risk.  File descriptor passing can be used to give an otherwise
+unprivileged QEMU process access to host devices without running QEMU as root.
+It is also possible to launch QEMU as a non-root user and configure UNIX groups
+for access to @code{/dev/kvm}, @code{/dev/net/tun}, and other device nodes.
+Some Linux distros already ship with UNIX groups for these devices by default.
+
+@itemize
+@item SELinux and AppArmor make it possible to confine processes beyond the
+traditional UNIX process and file permissions model.  They restrict the QEMU
+process from accessing processes and files on the host system that are not
+needed by QEMU.
+
+@item Resource limits and cgroup controllers provide throughput and utilization
+limits on key resources such as CPU time, memory, and I/O bandwidth.
+
+@item Linux namespaces can be used to make process, file system, and other system
+resources unavailable to QEMU.  A namespaced QEMU process is restricted to only
+those resources that were granted to it.
+
+@item Linux seccomp is available via the QEMU @option{--sandbox} option.  It disables
+system calls that are not needed by QEMU, thereby reducing the host kernel
+attack surface.
+@end itemize
diff --git a/qemu-doc.texi b/qemu-doc.texi
index XXXXXXX..XXXXXXX 100644
--- a/qemu-doc.texi
+++ b/qemu-doc.texi
@@ -XXX,XX +XXX,XX @@
 * QEMU Guest Agent::
 * QEMU User space emulator::
 * System requirements::
+* Security::
 * Implementation notes::
 * Deprecated features::
 * Supported build platforms::
@@ -XXX,XX +XXX,XX @@ added with Linux 4.5 which is supported by the major distros. And even
 if RHEL7 has kernel 3.10, KVM there has the required functionality there
 to make it close to a 4.5 or newer kernel.
 
+@include docs/security.texi
+
 @include qemu-tech.texi
 
 @include qemu-deprecated.texi
-- 
2.21.0