Vladimir Sementsov-Ogievskiy (1):

block: Factor out bdrv_run_co()

hw/block/Makefile.objs | 2 +-

include/exec/memory.h | 15 ++-

include/exec/ram_addr.h | 4 +-

include/sysemu/sysemu.h | 2 +

block/io.c | 193 +++++++++++-----------------

block/io_uring.c | 11 +-

exec.c | 2 +-

hw/block/nvme.c | 6 +-

memory.c | 12 +-

softmmu/vl.c | 2 +-

target/arm/helper.c | 2 +-

tests/qtest/fuzz/fuzz.c | 15 +++

tests/qtest/fuzz/i440fx_fuzz.c | 3 +-

tests/qtest/fuzz/virtio_net_fuzz.c | 2 +

tests/qtest/fuzz/virtio_scsi_fuzz.c | 2 +

tests/qtest/fuzz/fork_fuzz.ld | 5 +

16 files changed, 134 insertions(+), 144 deletions(-)

--=20

2.25.4

From: Stefano Garzarella <sgarzare@redhat.com>

As recently documented [1], io_uring_enter(2) syscall can return an

error (errno=EINTR) if the operation was interrupted by a delivery

of a signal before it could complete.

This should happen when IORING_ENTER_GETEVENTS flag is used, for

example during io_uring_submit_and_wait() or during io_uring_submit()

when IORING_SETUP_IOPOLL is enabled.

We shouldn't have this problem for now, but it's better to prevent it.

[1] https://github.com/axboe/liburing/commit/344355ec6619de8f4e64584c9736530b5346e4f4

Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>

Message-id: 20200519133041.112138-1-sgarzare@redhat.com

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

---

block/io_uring.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/block/io_uring.c b/block/io_uring.c

index XXXXXXX..XXXXXXX 100644

--- a/block/io_uring.c

+++ b/block/io_uring.c

@@ -XXX,XX +XXX,XX @@ static int ioq_submit(LuringState *s)

trace_luring_io_uring_submit(s, ret);

/* Prevent infinite loop if submission is refused */

if (ret <= 0) {

- if (ret == -EAGAIN) {

+ if (ret == -EAGAIN || ret == -EINTR) {

continue;

}

break;

--

2.25.4

From: Stefano Garzarella <sgarzare@redhat.com>

In qemu_luring_poll_cb() we are not using the cqe peeked from the

CQ ring. We are using io_uring_peek_cqe() only to see if there

are cqes ready, so we can replace it with io_uring_cq_ready().

Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>

Message-id: 20200519134942.118178-1-sgarzare@redhat.com

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

---

block/io_uring.c | 9 +++------

1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/block/io_uring.c b/block/io_uring.c

index XXXXXXX..XXXXXXX 100644

--- a/block/io_uring.c

+++ b/block/io_uring.c

@@ -XXX,XX +XXX,XX @@ static void qemu_luring_completion_cb(void *opaque)

static bool qemu_luring_poll_cb(void *opaque)

{

LuringState *s = opaque;

- struct io_uring_cqe *cqes;

- if (io_uring_peek_cqe(&s->ring, &cqes) == 0) {

- if (cqes) {

- luring_process_completions_and_submit(s);

- return true;

- }

+ if (io_uring_cq_ready(&s->ring)) {

+ luring_process_completions_and_submit(s);

+ return true;

}

return false;

--

2.25.4

From: Alexander Bulekov <alxndr@bu.edu>

This allows us to keep pc-bios in executable_dir/pc-bios, rather than

executable_dir/../pc-bios, which is incompatible with oss-fuzz' file

structure.

Signed-off-by: Alexander Bulekov <alxndr@bu.edu>

Reviewed-by: Darren Kenny <darren.kenny@oracle.com>

Message-id: 20200512030133.29896-2-alxndr@bu.edu

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

---

include/sysemu/sysemu.h | 2 ++

softmmu/vl.c | 2 +-

tests/qtest/fuzz/fuzz.c | 15 +++++++++++++++

3 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/include/sysemu/sysemu.h b/include/sysemu/sysemu.h

index XXXXXXX..XXXXXXX 100644

--- a/include/sysemu/sysemu.h

+++ b/include/sysemu/sysemu.h

@@ -XXX,XX +XXX,XX @@ extern const char *qemu_name;

extern QemuUUID qemu_uuid;

extern bool qemu_uuid_set;

+void qemu_add_data_dir(const char *path);

+

void qemu_add_exit_notifier(Notifier *notify);

void qemu_remove_exit_notifier(Notifier *notify);

diff --git a/softmmu/vl.c b/softmmu/vl.c

index XXXXXXX..XXXXXXX 100644

--- a/softmmu/vl.c

+++ b/softmmu/vl.c

@@ -XXX,XX +XXX,XX @@ char *qemu_find_file(int type, const char *name)

return NULL;

}

-static void qemu_add_data_dir(const char *path)

+void qemu_add_data_dir(const char *path)

{

int i;

diff --git a/tests/qtest/fuzz/fuzz.c b/tests/qtest/fuzz/fuzz.c

index XXXXXXX..XXXXXXX 100644

--- a/tests/qtest/fuzz/fuzz.c

+++ b/tests/qtest/fuzz/fuzz.c

@@ -XXX,XX +XXX,XX @@ int LLVMFuzzerInitialize(int *argc, char ***argv, char ***envp)

{

char *target_name;

+ char *dir;

/* Initialize qgraph and modules */

qos_graph_init();

@@ -XXX,XX +XXX,XX @@ int LLVMFuzzerInitialize(int *argc, char ***argv, char ***envp)

target_name = strstr(**argv, "-target-");

if (target_name) { /* The binary name specifies the target */

target_name += strlen("-target-");

+ /*

+ * With oss-fuzz, the executable is kept in the root of a directory (we

+ * cannot assume the path). All data (including bios binaries) must be

+ * in the same dir, or a subdir. Thus, we cannot place the pc-bios so

+ * that it would be in exec_dir/../pc-bios.

+ * As a workaround, oss-fuzz allows us to use argv[0] to get the

+ * location of the executable. Using this we add exec_dir/pc-bios to

+ * the datadirs.

+ */

+ dir = g_build_filename(g_path_get_dirname(**argv), "pc-bios", NULL);

+ if (g_file_test(dir, G_FILE_TEST_IS_DIR)) {

+ qemu_add_data_dir(dir);

+ }

+ g_free(dir);

} else if (*argc > 1) { /* The target is specified as an argument */

target_name = (*argv)[1];

if (!strstr(target_name, "--fuzz-target=")) {

--

2.25.4

From: Alexander Bulekov <alxndr@bu.edu>

Signed-off-by: Alexander Bulekov <alxndr@bu.edu>

Reviewed-by: Darren Kenny <darren.kenny@oracle.com>

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Message-id: 20200512030133.29896-3-alxndr@bu.edu

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

---

tests/qtest/fuzz/i440fx_fuzz.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/qtest/fuzz/i440fx_fuzz.c b/tests/qtest/fuzz/i440fx_fuzz.c

index XXXXXXX..XXXXXXX 100644

--- a/tests/qtest/fuzz/i440fx_fuzz.c

+++ b/tests/qtest/fuzz/i440fx_fuzz.c

@@ -XXX,XX +XXX,XX @@ static void i440fx_fuzz_qos_fork(QTestState *s,

}

static const char *i440fx_qtest_argv = TARGET_NAME " -machine accel=qtest"

- "-m 0 -display none";

+ " -m 0 -display none";

static const char *i440fx_argv(FuzzTarget *t)

{

return i440fx_qtest_argv;

--

2.25.4

From: Alexander Bulekov <alxndr@bu.edu>

Previously, we relied on "FuzzerTracePC*(.bss*)" to place libfuzzer's

fuzzer::TPC object into our contiguous shared-memory region. This does

not work for some libfuzzer builds, so this addition identifies the

region by its mangled name: *(.bss._ZN6fuzzer3TPCE);

Signed-off-by: Alexander Bulekov <alxndr@bu.edu>

Reviewed-by: Darren Kenny <darren.kenny@oracle.com>

Message-id: 20200512030133.29896-4-alxndr@bu.edu

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

---

tests/qtest/fuzz/fork_fuzz.ld | 5 +++++

1 file changed, 5 insertions(+)

diff --git a/tests/qtest/fuzz/fork_fuzz.ld b/tests/qtest/fuzz/fork_fuzz.ld

index XXXXXXX..XXXXXXX 100644

--- a/tests/qtest/fuzz/fork_fuzz.ld

+++ b/tests/qtest/fuzz/fork_fuzz.ld

@@ -XXX,XX +XXX,XX @@ SECTIONS

/* Internal Libfuzzer TracePC object which contains the ValueProfileMap */

FuzzerTracePC*(.bss*);

+ /*

+ * In case the above line fails, explicitly specify the (mangled) name of

+ * the object we care about

+ */

+ *(.bss._ZN6fuzzer3TPCE);

}

.data.fuzz_end : ALIGN(4K)

{

--

2.25.4

From: Alexander Bulekov <alxndr@bu.edu>

Without this, the time since the last main-loop keeps increasing, as the

fuzzer runs. The forked children need to handle all the "past-due"

timers, slowing them down, over time. With this change, the

parent/fork-server process runs the main-loop, while waiting on the

child, ensuring that the timer events do not pile up, over time.

Signed-off-by: Alexander Bulekov <alxndr@bu.edu>

Reviewed-by: Darren Kenny <darren.kenny@oracle.com>

Message-id: 20200512030133.29896-5-alxndr@bu.edu

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

---

tests/qtest/fuzz/i440fx_fuzz.c | 1 +

tests/qtest/fuzz/virtio_net_fuzz.c | 2 ++

tests/qtest/fuzz/virtio_scsi_fuzz.c | 2 ++

3 files changed, 5 insertions(+)

diff --git a/tests/qtest/fuzz/i440fx_fuzz.c b/tests/qtest/fuzz/i440fx_fuzz.c

index XXXXXXX..XXXXXXX 100644

--- a/tests/qtest/fuzz/i440fx_fuzz.c

+++ b/tests/qtest/fuzz/i440fx_fuzz.c

@@ -XXX,XX +XXX,XX @@ static void i440fx_fuzz_qos_fork(QTestState *s,

i440fx_fuzz_qos(s, Data, Size);

_Exit(0);

} else {

+ flush_events(s);

wait(NULL);

}

}

diff --git a/tests/qtest/fuzz/virtio_net_fuzz.c b/tests/qtest/fuzz/virtio_net_fuzz.c

index XXXXXXX..XXXXXXX 100644

--- a/tests/qtest/fuzz/virtio_net_fuzz.c

+++ b/tests/qtest/fuzz/virtio_net_fuzz.c

@@ -XXX,XX +XXX,XX @@ static void virtio_net_fork_fuzz(QTestState *s,

flush_events(s);

_Exit(0);

} else {

+ flush_events(s);

wait(NULL);

}

}

@@ -XXX,XX +XXX,XX @@ static void virtio_net_fork_fuzz_check_used(QTestState *s,

flush_events(s);

_Exit(0);

} else {

+ flush_events(s);

wait(NULL);

}

}

diff --git a/tests/qtest/fuzz/virtio_scsi_fuzz.c b/tests/qtest/fuzz/virtio_scsi_fuzz.c

index XXXXXXX..XXXXXXX 100644

--- a/tests/qtest/fuzz/virtio_scsi_fuzz.c

+++ b/tests/qtest/fuzz/virtio_scsi_fuzz.c

@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_fork_fuzz(QTestState *s,

flush_events(s);

_Exit(0);

} else {

+ flush_events(s);

wait(NULL);

}

}

@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_with_flag_fuzz(QTestState *s,

}

_Exit(0);

} else {

+ flush_events(s);

wait(NULL);

}

}

--

2.25.4

From: Philippe Mathieu-Daudé <philmd@redhat.com>

We usually use '_do_' for internal functions. Rename

memory_region_do_writeback() as memory_region_writeback().

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Acked-by: Paolo Bonzini <pbonzini@redhat.com>

Message-id: 20200508062456.23344-2-philmd@redhat.com

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

---

include/exec/memory.h | 4 ++--

memory.c | 2 +-

target/arm/helper.c | 2 +-

3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/include/exec/memory.h b/include/exec/memory.h

index XXXXXXX..XXXXXXX 100644

--- a/include/exec/memory.h

+++ b/include/exec/memory.h

@@ -XXX,XX +XXX,XX @@ void *memory_region_get_ram_ptr(MemoryRegion *mr);

void memory_region_ram_resize(MemoryRegion *mr, ram_addr_t newsize,

Error **errp);

/**

- * memory_region_do_writeback: Trigger cache writeback or msync for

+ * memory_region_writeback: Trigger cache writeback or msync for

* selected address range

*

* @mr: the memory region to be updated

* @addr: the initial address of the range to be written back

* @size: the size of the range to be written back

*/

-void memory_region_do_writeback(MemoryRegion *mr, hwaddr addr, hwaddr size);

+void memory_region_writeback(MemoryRegion *mr, hwaddr addr, hwaddr size);

/**

* memory_region_set_log: Turn dirty logging on or off for a region.

diff --git a/memory.c b/memory.c

index XXXXXXX..XXXXXXX 100644

--- a/memory.c

+++ b/memory.c

@@ -XXX,XX +XXX,XX @@ void memory_region_ram_resize(MemoryRegion *mr, ram_addr_t newsize, Error **errp

}

-void memory_region_do_writeback(MemoryRegion *mr, hwaddr addr, hwaddr size)

+void memory_region_writeback(MemoryRegion *mr, hwaddr addr, hwaddr size)

{

/*

* Might be extended case needed to cover

diff --git a/target/arm/helper.c b/target/arm/helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ static void dccvap_writefn(CPUARMState *env, const ARMCPRegInfo *opaque,

mr = memory_region_from_host(haddr, &offset);

if (mr) {

- memory_region_do_writeback(mr, offset, dline_size);

+ memory_region_writeback(mr, offset, dline_size);

}

}

}

--

2.25.4

From: Philippe Mathieu-Daudé <philmd@redhat.com>

Suggested-by: Paolo Bonzini <pbonzini@redhat.com>

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Acked-by: Paolo Bonzini <pbonzini@redhat.com>

Message-id: 20200508062456.23344-3-philmd@redhat.com

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

---

include/exec/memory.h | 13 ++++++++++++-

memory.c | 10 ++++++++--

2 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/include/exec/memory.h b/include/exec/memory.h

index XXXXXXX..XXXXXXX 100644

--- a/include/exec/memory.h

+++ b/include/exec/memory.h

@@ -XXX,XX +XXX,XX @@ void *memory_region_get_ram_ptr(MemoryRegion *mr);

*/

void memory_region_ram_resize(MemoryRegion *mr, ram_addr_t newsize,

Error **errp);

+

/**

- * memory_region_writeback: Trigger cache writeback or msync for

+ * memory_region_msync: Synchronize selected address range of

+ * a memory mapped region

+ *

+ * @mr: the memory region to be msync

+ * @addr: the initial address of the range to be sync

+ * @size: the size of the range to be sync

+ */

+void memory_region_msync(MemoryRegion *mr, hwaddr addr, hwaddr size);

+

+/**

+ * memory_region_writeback: Trigger cache writeback for

* selected address range

*

* @mr: the memory region to be updated

diff --git a/memory.c b/memory.c

index XXXXXXX..XXXXXXX 100644

--- a/memory.c

+++ b/memory.c

@@ -XXX,XX +XXX,XX @@ void memory_region_ram_resize(MemoryRegion *mr, ram_addr_t newsize, Error **errp

qemu_ram_resize(mr->ram_block, newsize, errp);

}

+void memory_region_msync(MemoryRegion *mr, hwaddr addr, hwaddr size)

+{

+ if (mr->ram_block) {

+ qemu_ram_writeback(mr->ram_block, addr, size);

+ }

+}

void memory_region_writeback(MemoryRegion *mr, hwaddr addr, hwaddr size)

{

@@ -XXX,XX +XXX,XX @@ void memory_region_writeback(MemoryRegion *mr, hwaddr addr, hwaddr size)

* Might be extended case needed to cover

* different types of memory regions

*/

- if (mr->ram_block && mr->dirty_log_mask) {

- qemu_ram_writeback(mr->ram_block, addr, size);

+ if (mr->dirty_log_mask) {

+ memory_region_msync(mr, addr, size);

}

}

--

2.25.4

From: Philippe Mathieu-Daudé <philmd@redhat.com>

Now than the non-target specific memory_region_msync() function

is available, use it to make this device target-agnostic.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Acked-by: Paolo Bonzini <pbonzini@redhat.com>

Message-id: 20200508062456.23344-4-philmd@redhat.com

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

---

hw/block/Makefile.objs | 2 +-

hw/block/nvme.c | 6 ++----

2 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/hw/block/Makefile.objs b/hw/block/Makefile.objs

index XXXXXXX..XXXXXXX 100644

--- a/hw/block/Makefile.objs

+++ b/hw/block/Makefile.objs

@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_SH4) += tc58128.o

obj-$(CONFIG_VIRTIO_BLK) += virtio-blk.o

obj-$(CONFIG_VHOST_USER_BLK) += vhost-user-blk.o

-obj-$(CONFIG_NVME_PCI) += nvme.o

+common-obj-$(CONFIG_NVME_PCI) += nvme.o

obj-y += dataplane/

diff --git a/hw/block/nvme.c b/hw/block/nvme.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/block/nvme.c

+++ b/hw/block/nvme.c

@@ -XXX,XX +XXX,XX @@

#include "qapi/visitor.h"

#include "sysemu/hostmem.h"

#include "sysemu/block-backend.h"

-#include "exec/ram_addr.h"

-

+#include "exec/memory.h"

#include "qemu/log.h"

#include "qemu/module.h"

#include "qemu/cutils.h"

@@ -XXX,XX +XXX,XX @@ static uint64_t nvme_mmio_read(void *opaque, hwaddr addr, unsigned size)

*/

if (addr == 0xE08 &&

(NVME_PMRCAP_PMRWBM(n->bar.pmrcap) & 0x02)) {

- qemu_ram_writeback(n->pmrdev->mr.ram_block,

- 0, n->pmrdev->size);

+ memory_region_msync(&n->pmrdev->mr, 0, n->pmrdev->size);

}

memcpy(&val, ptr + addr, size);

} else {

--

2.25.4

From: Philippe Mathieu-Daudé <philmd@redhat.com>

Rename qemu_ram_writeback() as qemu_ram_msync() to better

match what it does.

Suggested-by: Stefan Hajnoczi <stefanha@redhat.com>

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Acked-by: Paolo Bonzini <pbonzini@redhat.com>

Message-id: 20200508062456.23344-5-philmd@redhat.com

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

---

include/exec/ram_addr.h | 4 ++--

exec.c | 2 +-

memory.c | 2 +-

3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/include/exec/ram_addr.h b/include/exec/ram_addr.h

index XXXXXXX..XXXXXXX 100644

--- a/include/exec/ram_addr.h

+++ b/include/exec/ram_addr.h

@@ -XXX,XX +XXX,XX @@ void qemu_ram_free(RAMBlock *block);

int qemu_ram_resize(RAMBlock *block, ram_addr_t newsize, Error **errp);

-void qemu_ram_writeback(RAMBlock *block, ram_addr_t start, ram_addr_t length);

+void qemu_ram_msync(RAMBlock *block, ram_addr_t start, ram_addr_t length);

/* Clear whole block of mem */

static inline void qemu_ram_block_writeback(RAMBlock *block)

{

- qemu_ram_writeback(block, 0, block->used_length);

+ qemu_ram_msync(block, 0, block->used_length);

}

#define DIRTY_CLIENTS_ALL ((1 << DIRTY_MEMORY_NUM) - 1)

diff --git a/exec.c b/exec.c

index XXXXXXX..XXXXXXX 100644

--- a/exec.c

+++ b/exec.c

@@ -XXX,XX +XXX,XX @@ int qemu_ram_resize(RAMBlock *block, ram_addr_t newsize, Error **errp)

* Otherwise no-op.

* @Note: this is supposed to be a synchronous op.

*/

-void qemu_ram_writeback(RAMBlock *block, ram_addr_t start, ram_addr_t length)

+void qemu_ram_msync(RAMBlock *block, ram_addr_t start, ram_addr_t length)

{

/* The requested range should fit in within the block range */

g_assert((start + length) <= block->used_length);

diff --git a/memory.c b/memory.c

index XXXXXXX..XXXXXXX 100644

--- a/memory.c

+++ b/memory.c

@@ -XXX,XX +XXX,XX @@ void memory_region_ram_resize(MemoryRegion *mr, ram_addr_t newsize, Error **errp

void memory_region_msync(MemoryRegion *mr, hwaddr addr, hwaddr size)

{

if (mr->ram_block) {

- qemu_ram_writeback(mr->ram_block, addr, size);

+ qemu_ram_msync(mr->ram_block, addr, size);

}

}

--

2.25.4