The following changes since commit f17783e706ab9c7b3a2b69cf48e4f0ba40664f54: Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20191220' into staging (2020-01-03 18:50:33 +0000) are available in the Git repository at: https://github.com/XanClic/qemu.git tags/pull-block-2020-01-06 for you to fetch changes up to 503ca1262bab2c11c533a4816d1ff4297d4f58a6: backup-top: Begin drain earlier (2020-01-06 14:26:23 +0100) ---------------------------------------------------------------- Block patches: - Minor fixes and tests from the freeze period (too minor to be included in 4.2) - Allow many bash iotests to test qcow2's external data file feature - Add compress filter driver - Fix Python iotests after 6f6e1698a6 - Fix for the backup job ---------------------------------------------------------------- Andrey Shinkevich (3): block: introduce compress filter driver qcow2: Allow writing compressed data of multiple clusters tests/qemu-iotests: add case to write compressed data of multiple clusters Max Reitz (28): block: Add bdrv_qapi_perm_to_blk_perm() block: Use bdrv_qapi_perm_to_blk_perm() blkdebug: Allow taking/unsharing permissions iotests: Add @error to wait_until_completed iotests: Add test for failing mirror complete iotests: s/qocw2/qcow2/ iotests/qcow2.py: Add dump-header-exts iotests/qcow2.py: Split feature fields into bits iotests: Add _filter_json_filename iotests: Filter refcount_order in 036 iotests: Replace IMGOPTS by _unsupported_imgopts iotests: Drop compat=1.1 in 050 iotests: Let _make_test_img parse its parameters iotests: Add -o and --no-opts to _make_test_img iotests: Inject space into -ocompat=0.10 in 051 iotests: Replace IMGOPTS= by -o iotests: Replace IMGOPTS='' by --no-opts iotests: Drop IMGOPTS use in 267 iotests: Avoid qemu-img create iotests: Use _rm_test_img for deleting test images iotests: Avoid cp/mv of test images iotests: Make 091 work with data_file iotests: Make 110 work with data_file iotests: Make 137 work with data_file iotests: Make 198 work with data_file iotests: Disable data_file where it cannot be used iotests: Allow check -o data_file backup-top: Begin drain earlier PanNengyuan (1): throttle-groups: fix memory leak in throttle_group_set_limit: Philippe Mathieu-Daudé (1): tests/qemu-iotests: Update tests to recent desugarized -accel option Vladimir Sementsov-Ogievskiy (1): qcow2-bitmaps: fix qcow2_can_store_new_dirty_bitmap block.c | 47 +++++---- block/Makefile.objs | 1 + block/backup-top.c | 4 +- block/blkdebug.c | 93 ++++++++++++++++- block/filter-compress.c | 168 +++++++++++++++++++++++++++++++ block/qcow2-bitmap.c | 41 ++++---- block/qcow2.c | 102 ++++++++++++++----- block/throttle-groups.c | 4 +- include/block/block.h | 1 + qapi/block-core.json | 24 ++++- tests/qemu-iotests/007 | 5 +- tests/qemu-iotests/014 | 2 + tests/qemu-iotests/015 | 5 +- tests/qemu-iotests/019 | 6 +- tests/qemu-iotests/020 | 6 +- tests/qemu-iotests/024 | 10 +- tests/qemu-iotests/026 | 5 +- tests/qemu-iotests/028 | 2 +- tests/qemu-iotests/029 | 7 +- tests/qemu-iotests/031 | 9 +- tests/qemu-iotests/031.out | 36 +++---- tests/qemu-iotests/036 | 15 +-- tests/qemu-iotests/036.out | 66 ++---------- tests/qemu-iotests/039 | 27 ++--- tests/qemu-iotests/039.out | 22 ++-- tests/qemu-iotests/041 | 44 ++++++++ tests/qemu-iotests/041.out | 4 +- tests/qemu-iotests/043 | 4 +- tests/qemu-iotests/046 | 2 + tests/qemu-iotests/048 | 4 +- tests/qemu-iotests/050 | 8 +- tests/qemu-iotests/051 | 7 +- tests/qemu-iotests/053 | 4 +- tests/qemu-iotests/058 | 7 +- tests/qemu-iotests/059 | 20 ++-- tests/qemu-iotests/060 | 14 +-- tests/qemu-iotests/060.out | 20 ++-- tests/qemu-iotests/061 | 63 ++++++------ tests/qemu-iotests/061.out | 72 ++++++------- tests/qemu-iotests/062 | 5 +- tests/qemu-iotests/063 | 18 ++-- tests/qemu-iotests/063.out | 3 +- tests/qemu-iotests/066 | 7 +- tests/qemu-iotests/067 | 6 +- tests/qemu-iotests/068 | 6 +- tests/qemu-iotests/069 | 2 +- tests/qemu-iotests/071 | 7 +- tests/qemu-iotests/073 | 4 + tests/qemu-iotests/074 | 4 +- tests/qemu-iotests/079 | 3 +- tests/qemu-iotests/080 | 7 +- tests/qemu-iotests/081 | 6 +- tests/qemu-iotests/085 | 18 ++-- tests/qemu-iotests/085.out | 8 +- tests/qemu-iotests/088 | 2 +- tests/qemu-iotests/090 | 2 + tests/qemu-iotests/091 | 2 +- tests/qemu-iotests/091.out | 2 - tests/qemu-iotests/092 | 2 +- tests/qemu-iotests/094 | 4 +- tests/qemu-iotests/095 | 5 +- tests/qemu-iotests/098 | 6 +- tests/qemu-iotests/099 | 10 +- tests/qemu-iotests/103 | 5 +- tests/qemu-iotests/106 | 2 +- tests/qemu-iotests/108 | 10 +- tests/qemu-iotests/109 | 4 +- tests/qemu-iotests/110 | 11 +- tests/qemu-iotests/110.out | 4 +- tests/qemu-iotests/111 | 3 +- tests/qemu-iotests/112 | 37 +++---- tests/qemu-iotests/114 | 2 + tests/qemu-iotests/115 | 3 +- tests/qemu-iotests/121 | 9 +- tests/qemu-iotests/122 | 6 +- tests/qemu-iotests/123 | 4 +- tests/qemu-iotests/125 | 2 +- tests/qemu-iotests/137 | 17 +++- tests/qemu-iotests/137.out | 6 +- tests/qemu-iotests/138 | 8 +- tests/qemu-iotests/141 | 4 +- tests/qemu-iotests/142 | 2 +- tests/qemu-iotests/144 | 4 +- tests/qemu-iotests/153 | 12 +-- tests/qemu-iotests/156 | 10 +- tests/qemu-iotests/159 | 2 +- tests/qemu-iotests/160 | 3 +- tests/qemu-iotests/161 | 4 +- tests/qemu-iotests/170 | 2 +- tests/qemu-iotests/172 | 6 +- tests/qemu-iotests/173 | 3 +- tests/qemu-iotests/174 | 2 +- tests/qemu-iotests/175 | 2 +- tests/qemu-iotests/176 | 7 +- tests/qemu-iotests/178 | 6 +- tests/qemu-iotests/182 | 2 +- tests/qemu-iotests/183 | 2 +- tests/qemu-iotests/185 | 4 +- tests/qemu-iotests/187 | 6 +- tests/qemu-iotests/190 | 4 +- tests/qemu-iotests/191 | 11 +- tests/qemu-iotests/195 | 2 +- tests/qemu-iotests/197 | 6 +- tests/qemu-iotests/198 | 6 +- tests/qemu-iotests/198.out | 4 +- tests/qemu-iotests/200 | 7 +- tests/qemu-iotests/201 | 6 +- tests/qemu-iotests/214 | 46 ++++++++- tests/qemu-iotests/214.out | 14 +++ tests/qemu-iotests/215 | 6 +- tests/qemu-iotests/217 | 3 +- tests/qemu-iotests/220 | 5 +- tests/qemu-iotests/225 | 2 +- tests/qemu-iotests/229 | 3 +- tests/qemu-iotests/232 | 4 +- tests/qemu-iotests/235 | 2 +- tests/qemu-iotests/243 | 10 +- tests/qemu-iotests/244 | 15 +-- tests/qemu-iotests/247 | 4 +- tests/qemu-iotests/249 | 4 +- tests/qemu-iotests/250 | 5 +- tests/qemu-iotests/252 | 2 +- tests/qemu-iotests/261 | 5 +- tests/qemu-iotests/265 | 2 +- tests/qemu-iotests/267 | 17 ++-- tests/qemu-iotests/273 | 3 + tests/qemu-iotests/check | 6 +- tests/qemu-iotests/common.filter | 47 ++++++++- tests/qemu-iotests/common.rc | 63 ++++++++++-- tests/qemu-iotests/iotests.py | 18 ++-- tests/qemu-iotests/qcow2.py | 23 ++++- 131 files changed, 1139 insertions(+), 552 deletions(-) create mode 100644 block/filter-compress.c -- 2.24.1 We need some way to correlate QAPI BlockPermission values with BLK_PERM_* flags. We could: (1) have the same order in the QAPI definition as the the BLK_PERM_* flags are in LSb-first order. However, then there is no guarantee that they actually match (e.g. when someone modifies the QAPI schema without thinking of the BLK_PERM_* definitions). We could add static assertions, but these would break what’s good about this solution, namely its simplicity. (2) define the BLK_PERM_* flags based on the BlockPermission values. But this way whenever someone were to modify the QAPI order (perfectly sensible in theory), the BLK_PERM_* values would change. Because these values are used for file locking, this might break file locking between different qemu versions. Therefore, go the slightly more cumbersome way: Add a function to translate from the QAPI constants to the BLK_PERM_* flags. Signed-off-by: Max Reitz <mreitz@redhat.com> Message-id: 20191108123455.39445-2-mreitz@redhat.com Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Signed-off-by: Max Reitz <mreitz@redhat.com> --- block.c | 18 ++++++++++++++++++ include/block/block.h | 1 + 2 files changed, 19 insertions(+) diff --git a/block.c b/block.c index XXXXXXX..XXXXXXX 100644 --- a/block.c +++ b/block.c @@ -XXX,XX +XXX,XX @@ void bdrv_format_default_perms(BlockDriverState *bs, BdrvChild *c, *nshared = shared; } +uint64_t bdrv_qapi_perm_to_blk_perm(BlockPermission qapi_perm) +{ + static const uint64_t permissions[] = { + [BLOCK_PERMISSION_CONSISTENT_READ] = BLK_PERM_CONSISTENT_READ, + [BLOCK_PERMISSION_WRITE] = BLK_PERM_WRITE, + [BLOCK_PERMISSION_WRITE_UNCHANGED] = BLK_PERM_WRITE_UNCHANGED, + [BLOCK_PERMISSION_RESIZE] = BLK_PERM_RESIZE, + [BLOCK_PERMISSION_GRAPH_MOD] = BLK_PERM_GRAPH_MOD, + }; + + QEMU_BUILD_BUG_ON(ARRAY_SIZE(permissions) != BLOCK_PERMISSION__MAX); + QEMU_BUILD_BUG_ON(1UL << ARRAY_SIZE(permissions) != BLK_PERM_ALL + 1); + + assert(qapi_perm < BLOCK_PERMISSION__MAX); + + return permissions[qapi_perm]; +} + static void bdrv_replace_child_noperm(BdrvChild *child, BlockDriverState *new_bs) { diff --git a/include/block/block.h b/include/block/block.h index XXXXXXX..XXXXXXX 100644 --- a/include/block/block.h +++ b/include/block/block.h @@ -XXX,XX +XXX,XX @@ enum { }; char *bdrv_perm_names(uint64_t perm); +uint64_t bdrv_qapi_perm_to_blk_perm(BlockPermission qapi_perm); /* disk I/O throttling */ void bdrv_init(void); -- 2.24.1 We can save some LoC in xdbg_graph_add_edge() by using bdrv_qapi_perm_to_blk_perm(). Signed-off-by: Max Reitz <mreitz@redhat.com> Message-id: 20191108123455.39445-3-mreitz@redhat.com Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Signed-off-by: Max Reitz <mreitz@redhat.com> --- block.c | 29 ++++++++--------------------- 1 file changed, 8 insertions(+), 21 deletions(-) diff --git a/block.c b/block.c index XXXXXXX..XXXXXXX 100644 --- a/block.c +++ b/block.c @@ -XXX,XX +XXX,XX @@ static void xdbg_graph_add_node(XDbgBlockGraphConstructor *gr, void *node, static void xdbg_graph_add_edge(XDbgBlockGraphConstructor *gr, void *parent, const BdrvChild *child) { - typedef struct { - unsigned int flag; - BlockPermission num; - } PermissionMap; - - static const PermissionMap permissions[] = { - { BLK_PERM_CONSISTENT_READ, BLOCK_PERMISSION_CONSISTENT_READ }, - { BLK_PERM_WRITE, BLOCK_PERMISSION_WRITE }, - { BLK_PERM_WRITE_UNCHANGED, BLOCK_PERMISSION_WRITE_UNCHANGED }, - { BLK_PERM_RESIZE, BLOCK_PERMISSION_RESIZE }, - { BLK_PERM_GRAPH_MOD, BLOCK_PERMISSION_GRAPH_MOD }, - { 0, 0 } - }; - const PermissionMap *p; + BlockPermission qapi_perm; XDbgBlockGraphEdge *edge; - QEMU_BUILD_BUG_ON(1UL << (ARRAY_SIZE(permissions) - 1) != BLK_PERM_ALL + 1); - edge = g_new0(XDbgBlockGraphEdge, 1); edge->parent = xdbg_graph_node_num(gr, parent); edge->child = xdbg_graph_node_num(gr, child->bs); edge->name = g_strdup(child->name); - for (p = permissions; p->flag; p++) { - if (p->flag & child->perm) { - QAPI_LIST_ADD(edge->perm, p->num); + for (qapi_perm = 0; qapi_perm < BLOCK_PERMISSION__MAX; qapi_perm++) { + uint64_t flag = bdrv_qapi_perm_to_blk_perm(qapi_perm); + + if (flag & child->perm) { + QAPI_LIST_ADD(edge->perm, qapi_perm); } - if (p->flag & child->shared_perm) { - QAPI_LIST_ADD(edge->shared_perm, p->num); + if (flag & child->shared_perm) { + QAPI_LIST_ADD(edge->shared_perm, qapi_perm); } } -- 2.24.1 Sometimes it is useful to be able to add a node to the block graph that takes or unshare a certain set of permissions for debugging purposes. This patch adds this capability to blkdebug. (Note that you cannot make blkdebug release or share permissions that it needs to take or cannot share, because this might result in assertion failures in the block layer. But if the blkdebug node has no parents, it will not take any permissions and share everything by default, so you can then freely choose what permissions to take and share.) Signed-off-by: Max Reitz <mreitz@redhat.com> Message-id: 20191108123455.39445-4-mreitz@redhat.com Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Signed-off-by: Max Reitz <mreitz@redhat.com> --- block/blkdebug.c | 93 +++++++++++++++++++++++++++++++++++++++++++- qapi/block-core.json | 14 ++++++- 2 files changed, 105 insertions(+), 2 deletions(-) diff --git a/block/blkdebug.c b/block/blkdebug.c index XXXXXXX..XXXXXXX 100644 --- a/block/blkdebug.c +++ b/block/blkdebug.c @@ -XXX,XX +XXX,XX @@ #include "qemu/cutils.h" #include "qemu/config-file.h" #include "block/block_int.h" +#include "block/qdict.h" #include "qemu/module.h" #include "qemu/option.h" +#include "qapi/qapi-visit-block-core.h" #include "qapi/qmp/qdict.h" +#include "qapi/qmp/qlist.h" #include "qapi/qmp/qstring.h" +#include "qapi/qobject-input-visitor.h" #include "sysemu/qtest.h" typedef struct BDRVBlkdebugState { @@ -XXX,XX +XXX,XX @@ typedef struct BDRVBlkdebugState { uint64_t opt_discard; uint64_t max_discard; + uint64_t take_child_perms; + uint64_t unshare_child_perms; + /* For blkdebug_refresh_filename() */ char *config_file; @@ -XXX,XX +XXX,XX @@ static void blkdebug_parse_filename(const char *filename, QDict *options, qdict_put_str(options, "x-image", filename); } +static int blkdebug_parse_perm_list(uint64_t *dest, QDict *options, + const char *prefix, Error **errp) +{ + int ret = 0; + QDict *subqdict = NULL; + QObject *crumpled_subqdict = NULL; + Visitor *v = NULL; + BlockPermissionList *perm_list = NULL, *element; + Error *local_err = NULL; + + *dest = 0; + + qdict_extract_subqdict(options, &subqdict, prefix); + if (!qdict_size(subqdict)) { + goto out; + } + + crumpled_subqdict = qdict_crumple(subqdict, errp); + if (!crumpled_subqdict) { + ret = -EINVAL; + goto out; + } + + v = qobject_input_visitor_new(crumpled_subqdict); + visit_type_BlockPermissionList(v, NULL, &perm_list, &local_err); + if (local_err) { + error_propagate(errp, local_err); + ret = -EINVAL; + goto out; + } + + for (element = perm_list; element; element = element->next) { + *dest |= bdrv_qapi_perm_to_blk_perm(element->value); + } + +out: + qapi_free_BlockPermissionList(perm_list); + visit_free(v); + qobject_unref(subqdict); + qobject_unref(crumpled_subqdict); + return ret; +} + +static int blkdebug_parse_perms(BDRVBlkdebugState *s, QDict *options, + Error **errp) +{ + int ret; + + ret = blkdebug_parse_perm_list(&s->take_child_perms, options, + "take-child-perms.", errp); + if (ret < 0) { + return ret; + } + + ret = blkdebug_parse_perm_list(&s->unshare_child_perms, options, + "unshare-child-perms.", errp); + if (ret < 0) { + return ret; + } + + return 0; +} + static QemuOptsList runtime_opts = { .name = "blkdebug", .head = QTAILQ_HEAD_INITIALIZER(runtime_opts.head), @@ -XXX,XX +XXX,XX @@ static int blkdebug_open(BlockDriverState *bs, QDict *options, int flags, /* Set initial state */ s->state = 1; + /* Parse permissions modifiers before opening the image file */ + ret = blkdebug_parse_perms(s, options, errp); + if (ret < 0) { + goto out; + } + /* Open the image file */ bs->file = bdrv_open_child(qemu_opt_get(opts, "x-image"), options, "image", bs, &child_file, false, &local_err); @@ -XXX,XX +XXX,XX @@ static int blkdebug_reopen_prepare(BDRVReopenState *reopen_state, return 0; } +static void blkdebug_child_perm(BlockDriverState *bs, BdrvChild *c, + const BdrvChildRole *role, + BlockReopenQueue *reopen_queue, + uint64_t perm, uint64_t shared, + uint64_t *nperm, uint64_t *nshared) +{ + BDRVBlkdebugState *s = bs->opaque; + + bdrv_filter_default_perms(bs, c, role, reopen_queue, perm, shared, + nperm, nshared); + + *nperm |= s->take_child_perms; + *nshared &= ~s->unshare_child_perms; +} + static const char *const blkdebug_strong_runtime_opts[] = { "config", "inject-error.", @@ -XXX,XX +XXX,XX @@ static BlockDriver bdrv_blkdebug = { .bdrv_file_open = blkdebug_open, .bdrv_close = blkdebug_close, .bdrv_reopen_prepare = blkdebug_reopen_prepare, - .bdrv_child_perm = bdrv_filter_default_perms, + .bdrv_child_perm = blkdebug_child_perm, .bdrv_getlength = blkdebug_getlength, .bdrv_refresh_filename = blkdebug_refresh_filename, diff --git a/qapi/block-core.json b/qapi/block-core.json index XXXXXXX..XXXXXXX 100644 --- a/qapi/block-core.json +++ b/qapi/block-core.json @@ -XXX,XX +XXX,XX @@ # # @set-state: array of state-change descriptions # +# @take-child-perms: Permissions to take on @image in addition to what +# is necessary anyway (which depends on how the +# blkdebug node is used). Defaults to none. +# (since 5.0) +# +# @unshare-child-perms: Permissions not to share on @image in addition +# to what cannot be shared anyway (which depends +# on how the blkdebug node is used). Defaults +# to none. (since 5.0) +# # Since: 2.9 ## { 'struct': 'BlockdevOptionsBlkdebug', @@ -XXX,XX +XXX,XX @@ '*opt-write-zero': 'int32', '*max-write-zero': 'int32', '*opt-discard': 'int32', '*max-discard': 'int32', '*inject-error': ['BlkdebugInjectErrorOptions'], - '*set-state': ['BlkdebugSetStateOptions'] } } + '*set-state': ['BlkdebugSetStateOptions'], + '*take-child-perms': ['BlockPermission'], + '*unshare-child-perms': ['BlockPermission'] } } ## # @BlockdevOptionsBlklogwrites: -- 2.24.1 Callers can use this new parameter to expect failure during the completion process. Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Message-id: 20191108123455.39445-5-mreitz@redhat.com Signed-off-by: Max Reitz <mreitz@redhat.com> --- tests/qemu-iotests/iotests.py | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/tests/qemu-iotests/iotests.py b/tests/qemu-iotests/iotests.py index XXXXXXX..XXXXXXX 100644 --- a/tests/qemu-iotests/iotests.py +++ b/tests/qemu-iotests/iotests.py @@ -XXX,XX +XXX,XX @@ class QMPTestCase(unittest.TestCase): self.assert_no_active_block_jobs() return result - def wait_until_completed(self, drive='drive0', check_offset=True, wait=60.0): + def wait_until_completed(self, drive='drive0', check_offset=True, wait=60.0, + error=None): '''Wait for a block job to finish, returning the event''' while True: for event in self.vm.get_qmp_events(wait=wait): if event['event'] == 'BLOCK_JOB_COMPLETED': self.assert_qmp(event, 'data/device', drive) - self.assert_qmp_absent(event, 'data/error') - if check_offset: - self.assert_qmp(event, 'data/offset', event['data']['len']) + if error is None: + self.assert_qmp_absent(event, 'data/error') + if check_offset: + self.assert_qmp(event, 'data/offset', + event['data']['len']) + else: + self.assert_qmp(event, 'data/error', error) self.assert_no_active_block_jobs() return event elif event['event'] == 'JOB_STATUS_CHANGE': @@ -XXX,XX +XXX,XX @@ class QMPTestCase(unittest.TestCase): self.assert_qmp(event, 'data/type', 'mirror') self.assert_qmp(event, 'data/offset', event['data']['len']) - def complete_and_wait(self, drive='drive0', wait_ready=True): + def complete_and_wait(self, drive='drive0', wait_ready=True, + completion_error=None): '''Complete a block job and wait for it to finish''' if wait_ready: self.wait_ready(drive=drive) @@ -XXX,XX +XXX,XX @@ class QMPTestCase(unittest.TestCase): result = self.vm.qmp('block-job-complete', device=drive) self.assert_qmp(result, 'return', {}) - event = self.wait_until_completed(drive=drive) + event = self.wait_until_completed(drive=drive, error=completion_error) self.assert_qmp(event, 'data/type', 'mirror') def pause_wait(self, job_id='job0'): -- 2.24.1 Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Tested-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 20191108123455.39445-6-mreitz@redhat.com Signed-off-by: Max Reitz <mreitz@redhat.com> --- tests/qemu-iotests/041 | 44 ++++++++++++++++++++++++++++++++++++++ tests/qemu-iotests/041.out | 4 ++-- 2 files changed, 46 insertions(+), 2 deletions(-) diff --git a/tests/qemu-iotests/041 b/tests/qemu-iotests/041 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/041 +++ b/tests/qemu-iotests/041 @@ -XXX,XX +XXX,XX @@ class TestOrphanedSource(iotests.QMPTestCase): target='dest-ro') self.assert_qmp(result, 'error/class', 'GenericError') + def test_failing_permission_in_complete(self): + self.assert_no_active_block_jobs() + + # Unshare consistent-read on the target + # (The mirror job does not care) + result = self.vm.qmp('blockdev-add', + driver='blkdebug', + node_name='dest-perm', + image='dest', + unshare_child_perms=['consistent-read']) + self.assert_qmp(result, 'return', {}) + + result = self.vm.qmp('blockdev-mirror', job_id='job', device='src', + sync='full', target='dest', + filter_node_name='mirror-filter') + self.assert_qmp(result, 'return', {}) + + # Require consistent-read on the source + # (We can only add this node once the job has started, or it + # will complain that it does not want to run on non-root nodes) + result = self.vm.qmp('blockdev-add', + driver='blkdebug', + node_name='src-perm', + image='src', + take_child_perms=['consistent-read']) + self.assert_qmp(result, 'return', {}) + + # While completing, mirror will attempt to replace src by + # dest, which must fail because src-perm requires + # consistent-read but dest-perm does not share it; thus + # aborting the job when it is supposed to complete + self.complete_and_wait('job', + completion_error='Operation not permitted') + + # Assert that all of our nodes are still there (except for the + # mirror filter, which should be gone despite the failure) + nodes = self.vm.qmp('query-named-block-nodes')['return'] + nodes = [node['node-name'] for node in nodes] + + for expect in ('src', 'src-perm', 'dest', 'dest-perm'): + self.assertTrue(expect in nodes, '%s disappeared' % expect) + self.assertFalse('mirror-filter' in nodes, + 'Mirror filter node did not disappear') + if __name__ == '__main__': iotests.main(supported_fmts=['qcow2', 'qed'], supported_protocols=['file']) diff --git a/tests/qemu-iotests/041.out b/tests/qemu-iotests/041.out index XXXXXXX..XXXXXXX 100644 --- a/tests/qemu-iotests/041.out +++ b/tests/qemu-iotests/041.out @@ -XXX,XX +XXX,XX @@ -.......................................................................................... +........................................................................................... ---------------------------------------------------------------------- -Ran 90 tests +Ran 91 tests OK -- 2.24.1 From: PanNengyuan <pannengyuan@huawei.com> This avoid a memory leak when qom-set is called to set throttle_group limits, here is an easy way to reproduce: 1. run qemu-iotests as follow and check the result with asan: ./check -qcow2 184 Following is the asan output backtrack: Direct leak of 912 byte(s) in 3 object(s) allocated from: #0 0xffff8d7ab3c3 in __interceptor_calloc (/lib64/libasan.so.4+0xd33c3) #1 0xffff8d4c31cb in g_malloc0 (/lib64/libglib-2.0.so.0+0x571cb) #2 0x190c857 in qobject_input_start_struct /mnt/sdc/qemu-master/qemu-4.2.0-rc0/qapi/qobject-input-visitor.c:295 #3 0x19070df in visit_start_struct /mnt/sdc/qemu-master/qemu-4.2.0-rc0/qapi/qapi-visit-core.c:49 #4 0x1948b87 in visit_type_ThrottleLimits qapi/qapi-visit-block-core.c:3759 #5 0x17e4aa3 in throttle_group_set_limits /mnt/sdc/qemu-master/qemu-4.2.0-rc0/block/throttle-groups.c:900 #6 0x1650eff in object_property_set /mnt/sdc/qemu-master/qemu-4.2.0-rc0/qom/object.c:1272 #7 0x1658517 in object_property_set_qobject /mnt/sdc/qemu-master/qemu-4.2.0-rc0/qom/qom-qobject.c:26 #8 0x15880bb in qmp_qom_set /mnt/sdc/qemu-master/qemu-4.2.0-rc0/qom/qom-qmp-cmds.c:74 #9 0x157e3e3 in qmp_marshal_qom_set qapi/qapi-commands-qom.c:154 Reported-by: Euler Robot <euler.robot@huawei.com> Signed-off-by: PanNengyuan <pannengyuan@huawei.com> Message-id: 1574835614-42028-1-git-send-email-pannengyuan@huawei.com Signed-off-by: Max Reitz <mreitz@redhat.com> --- block/throttle-groups.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/block/throttle-groups.c b/block/throttle-groups.c index XXXXXXX..XXXXXXX 100644 --- a/block/throttle-groups.c +++ b/block/throttle-groups.c @@ -XXX,XX +XXX,XX @@ static void throttle_group_set_limits(Object *obj, Visitor *v, { ThrottleGroup *tg = THROTTLE_GROUP(obj); ThrottleConfig cfg; - ThrottleLimits arg = { 0 }; - ThrottleLimits *argp = &arg; + ThrottleLimits *argp; Error *local_err = NULL; visit_type_ThrottleLimits(v, name, &argp, &local_err); @@ -XXX,XX +XXX,XX @@ static void throttle_group_set_limits(Object *obj, Visitor *v, unlock: qemu_mutex_unlock(&tg->lock); ret: + qapi_free_ThrottleLimits(argp); error_propagate(errp, local_err); return; } -- 2.24.1 From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> qcow2_can_store_new_dirty_bitmap works wrong, as it considers only bitmaps already stored in the qcow2 image and ignores persistent BdrvDirtyBitmap objects. So, let's instead count persistent BdrvDirtyBitmaps. We load all qcow2 bitmaps on open, so there should not be any bitmap in the image for which we don't have BdrvDirtyBitmaps version. If it is - it's a kind of corruption, and no reason to check for corruptions here (open() and close() are better places for it). Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Message-id: 20191014115126.15360-2-vsementsov@virtuozzo.com Reviewed-by: Max Reitz <mreitz@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Max Reitz <mreitz@redhat.com> --- block/qcow2-bitmap.c | 41 ++++++++++++++++++----------------------- 1 file changed, 18 insertions(+), 23 deletions(-) diff --git a/block/qcow2-bitmap.c b/block/qcow2-bitmap.c index XXXXXXX..XXXXXXX 100644 --- a/block/qcow2-bitmap.c +++ b/block/qcow2-bitmap.c @@ -XXX,XX +XXX,XX @@ bool coroutine_fn qcow2_co_can_store_new_dirty_bitmap(BlockDriverState *bs, Error **errp) { BDRVQcow2State *s = bs->opaque; - bool found; - Qcow2BitmapList *bm_list; + BdrvDirtyBitmap *bitmap; + uint64_t bitmap_directory_size = 0; + uint32_t nb_bitmaps = 0; + + if (bdrv_find_dirty_bitmap(bs, name)) { + error_setg(errp, "Bitmap already exists: %s", name); + return false; + } if (s->qcow_version < 3) { /* Without autoclear_features, we would always have to assume @@ -XXX,XX +XXX,XX @@ bool coroutine_fn qcow2_co_can_store_new_dirty_bitmap(BlockDriverState *bs, goto fail; } - if (s->nb_bitmaps == 0) { - return true; + FOR_EACH_DIRTY_BITMAP(bs, bitmap) { + if (bdrv_dirty_bitmap_get_persistence(bitmap)) { + nb_bitmaps++; + bitmap_directory_size += + calc_dir_entry_size(strlen(bdrv_dirty_bitmap_name(bitmap)), 0); + } } + nb_bitmaps++; + bitmap_directory_size += calc_dir_entry_size(strlen(name), 0); - if (s->nb_bitmaps >= QCOW2_MAX_BITMAPS) { + if (nb_bitmaps > QCOW2_MAX_BITMAPS) { error_setg(errp, "Maximum number of persistent bitmaps is already reached"); goto fail; } - if (s->bitmap_directory_size + calc_dir_entry_size(strlen(name), 0) > - QCOW2_MAX_BITMAP_DIRECTORY_SIZE) - { + if (bitmap_directory_size > QCOW2_MAX_BITMAP_DIRECTORY_SIZE) { error_setg(errp, "Not enough space in the bitmap directory"); goto fail; } - qemu_co_mutex_lock(&s->lock); - bm_list = bitmap_list_load(bs, s->bitmap_directory_offset, - s->bitmap_directory_size, errp); - qemu_co_mutex_unlock(&s->lock); - if (bm_list == NULL) { - goto fail; - } - - found = find_bitmap_by_name(bm_list, name); - bitmap_list_free(bm_list); - if (found) { - error_setg(errp, "Bitmap with the same name is already stored"); - goto fail; - } - return true; fail: -- 2.24.1 Probably due to blind copy-pasting, we have several instances of "qocw2" in our iotests. Fix them. Reported-by: Maxim Levitsky <mlevitsk@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com> Message-id: 20191107163708.833192-2-mreitz@redhat.com Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com> --- tests/qemu-iotests/060 | 2 +- tests/qemu-iotests/061 | 2 +- tests/qemu-iotests/062 | 2 +- tests/qemu-iotests/066 | 2 +- tests/qemu-iotests/068 | 2 +- tests/qemu-iotests/108 | 2 +- tests/qemu-iotests/138 | 2 +- tests/qemu-iotests/261 | 2 +- 8 files changed, 8 insertions(+), 8 deletions(-) diff --git a/tests/qemu-iotests/060 b/tests/qemu-iotests/060 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/060 +++ b/tests/qemu-iotests/060 @@ -XXX,XX +XXX,XX @@ _filter_io_error() . ./common.rc . ./common.filter -# This tests qocw2-specific low-level functionality +# This tests qcow2-specific low-level functionality _supported_fmt qcow2 _supported_proto file _supported_os Linux diff --git a/tests/qemu-iotests/061 b/tests/qemu-iotests/061 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/061 +++ b/tests/qemu-iotests/061 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 . ./common.rc . ./common.filter -# This tests qocw2-specific low-level functionality +# This tests qcow2-specific low-level functionality _supported_fmt qcow2 _supported_proto file _supported_os Linux diff --git a/tests/qemu-iotests/062 b/tests/qemu-iotests/062 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/062 +++ b/tests/qemu-iotests/062 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 . ./common.rc . ./common.filter -# This tests qocw2-specific low-level functionality +# This tests qcow2-specific low-level functionality _supported_fmt qcow2 _supported_proto generic diff --git a/tests/qemu-iotests/066 b/tests/qemu-iotests/066 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/066 +++ b/tests/qemu-iotests/066 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 . ./common.rc . ./common.filter -# This tests qocw2-specific low-level functionality +# This tests qcow2-specific low-level functionality _supported_fmt qcow2 _supported_proto generic diff --git a/tests/qemu-iotests/068 b/tests/qemu-iotests/068 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/068 +++ b/tests/qemu-iotests/068 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 . ./common.rc . ./common.filter -# This tests qocw2-specific low-level functionality +# This tests qcow2-specific low-level functionality _supported_fmt qcow2 _supported_proto generic diff --git a/tests/qemu-iotests/108 b/tests/qemu-iotests/108 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/108 +++ b/tests/qemu-iotests/108 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 . ./common.rc . ./common.filter -# This tests qocw2-specific low-level functionality +# This tests qcow2-specific low-level functionality _supported_fmt qcow2 _supported_proto file _supported_os Linux diff --git a/tests/qemu-iotests/138 b/tests/qemu-iotests/138 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/138 +++ b/tests/qemu-iotests/138 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 . ./common.rc . ./common.filter -# This tests qocw2-specific low-level functionality +# This tests qcow2-specific low-level functionality _supported_fmt qcow2 _supported_proto file _supported_os Linux diff --git a/tests/qemu-iotests/261 b/tests/qemu-iotests/261 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/261 +++ b/tests/qemu-iotests/261 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 . ./common.rc . ./common.filter -# This tests qocw2-specific low-level functionality +# This tests qcow2-specific low-level functionality _supported_fmt qcow2 _supported_proto file _supported_os Linux -- 2.24.1 This is useful for tests that want to whitelist fields from dump-header (with grep) but still print all header extensions. Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com> Message-id: 20191107163708.833192-3-mreitz@redhat.com Signed-off-by: Max Reitz <mreitz@redhat.com> --- tests/qemu-iotests/qcow2.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/tests/qemu-iotests/qcow2.py b/tests/qemu-iotests/qcow2.py index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/qcow2.py +++ b/tests/qemu-iotests/qcow2.py @@ -XXX,XX +XXX,XX @@ def cmd_dump_header(fd): h.dump() h.dump_extensions() +def cmd_dump_header_exts(fd): + h = QcowHeader(fd) + h.dump_extensions() + def cmd_set_header(fd, name, value): try: value = int(value, 0) @@ -XXX,XX +XXX,XX @@ def cmd_set_feature_bit(fd, group, bit): cmds = [ [ 'dump-header', cmd_dump_header, 0, 'Dump image header and header extensions' ], + [ 'dump-header-exts', cmd_dump_header_exts, 0, 'Dump image header extensions' ], [ 'set-header', cmd_set_header, 2, 'Set a field in the header'], [ 'add-header-ext', cmd_add_header_ext, 2, 'Add a header extension' ], [ 'add-header-ext-stdio', cmd_add_header_ext_stdio, 1, 'Add a header extension, data from stdin' ], -- 2.24.1 Print the feature fields as a set of bits so that filtering is easier. Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com> Message-id: 20191107163708.833192-4-mreitz@redhat.com Signed-off-by: Max Reitz <mreitz@redhat.com> --- tests/qemu-iotests/031.out | 36 +++++++++---------- tests/qemu-iotests/036.out | 18 +++++----- tests/qemu-iotests/039.out | 22 ++++++------ tests/qemu-iotests/060.out | 20 +++++------ tests/qemu-iotests/061.out | 72 ++++++++++++++++++------------------- tests/qemu-iotests/137.out | 2 +- tests/qemu-iotests/qcow2.py | 18 +++++++--- 7 files changed, 99 insertions(+), 89 deletions(-) diff --git a/tests/qemu-iotests/031.out b/tests/qemu-iotests/031.out index XXXXXXX..XXXXXXX 100644 --- a/tests/qemu-iotests/031.out +++ b/tests/qemu-iotests/031.out @@ -XXX,XX +XXX,XX @@ refcount_table_offset 0x10000 refcount_table_clusters 1 nb_snapshots 0 snapshot_offset 0x0 -incompatible_features 0x0 -compatible_features 0x0 -autoclear_features 0x0 +incompatible_features [] +compatible_features [] +autoclear_features [] refcount_order 4 header_length 72 @@ -XXX,XX +XXX,XX @@ refcount_table_offset 0x10000 refcount_table_clusters 1 nb_snapshots 0 snapshot_offset 0x0 -incompatible_features 0x0 -compatible_features 0x0 -autoclear_features 0x0 +incompatible_features [] +compatible_features [] +autoclear_features [] refcount_order 4 header_length 72 @@ -XXX,XX +XXX,XX @@ refcount_table_offset 0x10000 refcount_table_clusters 1 nb_snapshots 0 snapshot_offset 0x0 -incompatible_features 0x0 -compatible_features 0x0 -autoclear_features 0x0 +incompatible_features [] +compatible_features [] +autoclear_features [] refcount_order 4 header_length 72 @@ -XXX,XX +XXX,XX @@ refcount_table_offset 0x10000 refcount_table_clusters 1 nb_snapshots 0 snapshot_offset 0x0 -incompatible_features 0x0 -compatible_features 0x0 -autoclear_features 0x0 +incompatible_features [] +compatible_features [] +autoclear_features [] refcount_order 4 header_length 104 @@ -XXX,XX +XXX,XX @@ refcount_table_offset 0x10000 refcount_table_clusters 1 nb_snapshots 0 snapshot_offset 0x0 -incompatible_features 0x0 -compatible_features 0x0 -autoclear_features 0x0 +incompatible_features [] +compatible_features [] +autoclear_features [] refcount_order 4 header_length 104 @@ -XXX,XX +XXX,XX @@ refcount_table_offset 0x10000 refcount_table_clusters 1 nb_snapshots 0 snapshot_offset 0x0 -incompatible_features 0x0 -compatible_features 0x0 -autoclear_features 0x0 +incompatible_features [] +compatible_features [] +autoclear_features [] refcount_order 4 header_length 104 diff --git a/tests/qemu-iotests/036.out b/tests/qemu-iotests/036.out index XXXXXXX..XXXXXXX 100644 --- a/tests/qemu-iotests/036.out +++ b/tests/qemu-iotests/036.out @@ -XXX,XX +XXX,XX @@ refcount_table_offset 0x10000 refcount_table_clusters 1 nb_snapshots 0 snapshot_offset 0x0 -incompatible_features 0x8000000000000000 -compatible_features 0x0 -autoclear_features 0x0 +incompatible_features [63] +compatible_features [] +autoclear_features [] refcount_order 4 header_length 104 @@ -XXX,XX +XXX,XX @@ refcount_table_offset 0x10000 refcount_table_clusters 1 nb_snapshots 0 snapshot_offset 0x0 -incompatible_features 0x0 -compatible_features 0x0 -autoclear_features 0x8000000000000000 +incompatible_features [] +compatible_features [] +autoclear_features [63] refcount_order 4 header_length 104 @@ -XXX,XX +XXX,XX @@ refcount_table_offset 0x10000 refcount_table_clusters 1 nb_snapshots 0 snapshot_offset 0x0 -incompatible_features 0x0 -compatible_features 0x0 -autoclear_features 0x0 +incompatible_features [] +compatible_features [] +autoclear_features [] refcount_order 4 header_length 104 diff --git a/tests/qemu-iotests/039.out b/tests/qemu-iotests/039.out index XXXXXXX..XXXXXXX 100644 --- a/tests/qemu-iotests/039.out +++ b/tests/qemu-iotests/039.out @@ -XXX,XX +XXX,XX @@ QA output created by 039 Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 wrote 512/512 bytes at offset 0 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) -incompatible_features 0x0 +incompatible_features [] No errors were found on the image. == Creating a dirty image file == @@ -XXX,XX +XXX,XX @@ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 wrote 512/512 bytes at offset 0 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) ./common.rc: Killed ( VALGRIND_QEMU="${VALGRIND_QEMU_IO}" _qemu_proc_exec "${VALGRIND_LOGFILE}" "$QEMU_IO_PROG" $QEMU_IO_ARGS "$@" ) -incompatible_features 0x1 +incompatible_features [0] ERROR cluster 5 refcount=0 reference=1 ERROR OFLAG_COPIED data cluster: l2_entry=8000000000050000 refcount=0 @@ -XXX,XX +XXX,XX @@ Data may be corrupted, or further writes to the image may corrupt it. == Read-only access must still work == read 512/512 bytes at offset 0 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) -incompatible_features 0x1 +incompatible_features [0] == Repairing the image file must succeed == ERROR cluster 5 refcount=0 reference=1 @@ -XXX,XX +XXX,XX @@ The following inconsistencies were found and repaired: Double checking the fixed image now... No errors were found on the image. -incompatible_features 0x0 +incompatible_features [] == Data should still be accessible after repair == read 512/512 bytes at offset 0 @@ -XXX,XX +XXX,XX @@ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 wrote 512/512 bytes at offset 0 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) ./common.rc: Killed ( VALGRIND_QEMU="${VALGRIND_QEMU_IO}" _qemu_proc_exec "${VALGRIND_LOGFILE}" "$QEMU_IO_PROG" $QEMU_IO_ARGS "$@" ) -incompatible_features 0x1 +incompatible_features [0] ERROR cluster 5 refcount=0 reference=1 Rebuilding refcount structure Repairing cluster 1 refcount=1 reference=0 Repairing cluster 2 refcount=1 reference=0 wrote 512/512 bytes at offset 0 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) -incompatible_features 0x0 +incompatible_features [] == Creating an image file with lazy_refcounts=off == Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 wrote 512/512 bytes at offset 0 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) ./common.rc: Killed ( VALGRIND_QEMU="${VALGRIND_QEMU_IO}" _qemu_proc_exec "${VALGRIND_LOGFILE}" "$QEMU_IO_PROG" $QEMU_IO_ARGS "$@" ) -incompatible_features 0x0 +incompatible_features [] No errors were found on the image. == Committing to a backing file with lazy_refcounts=on == @@ -XXX,XX +XXX,XX @@ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/ wrote 512/512 bytes at offset 0 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) Image committed. -incompatible_features 0x0 -incompatible_features 0x0 +incompatible_features [] +incompatible_features [] No errors were found on the image. No errors were found on the image. @@ -XXX,XX +XXX,XX @@ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 wrote 512/512 bytes at offset 0 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) ./common.rc: Killed ( VALGRIND_QEMU="${VALGRIND_QEMU_IO}" _qemu_proc_exec "${VALGRIND_LOGFILE}" "$QEMU_IO_PROG" $QEMU_IO_ARGS "$@" ) -incompatible_features 0x1 +incompatible_features [0] ERROR cluster 5 refcount=0 reference=1 ERROR OFLAG_COPIED data cluster: l2_entry=8000000000050000 refcount=0 @@ -XXX,XX +XXX,XX @@ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 wrote 512/512 bytes at offset 0 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) ./common.rc: Killed ( VALGRIND_QEMU="${VALGRIND_QEMU_IO}" _qemu_proc_exec "${VALGRIND_LOGFILE}" "$QEMU_IO_PROG" $QEMU_IO_ARGS "$@" ) -incompatible_features 0x0 +incompatible_features [] No errors were found on the image. *** done diff --git a/tests/qemu-iotests/060.out b/tests/qemu-iotests/060.out index XXXXXXX..XXXXXXX 100644 --- a/tests/qemu-iotests/060.out +++ b/tests/qemu-iotests/060.out @@ -XXX,XX +XXX,XX @@ ERROR cluster 3 refcount=1 reference=3 1 errors were found on the image. Data may be corrupted, or further writes to the image may corrupt it. -incompatible_features 0x0 +incompatible_features [] qcow2: Marking image as corrupt: Preventing invalid write on metadata (overlaps with active L1 table); further corruption events will be suppressed write failed: Input/output error -incompatible_features 0x2 +incompatible_features [1] image: TEST_DIR/t.IMGFMT file format: IMGFMT virtual size: 64 MiB (67108864 bytes) @@ -XXX,XX +XXX,XX @@ ERROR cluster 2 refcount=1 reference=2 2 errors were found on the image. Data may be corrupted, or further writes to the image may corrupt it. -incompatible_features 0x0 +incompatible_features [] qcow2: Marking image as corrupt: Preventing invalid write on metadata (overlaps with refcount block); further corruption events will be suppressed write failed: Input/output error -incompatible_features 0x2 +incompatible_features [1] ERROR refcount block 0 refcount=2 ERROR cluster 2 refcount=1 reference=2 Rebuilding refcount structure @@ -XXX,XX +XXX,XX @@ The following inconsistencies were found and repaired: Double checking the fixed image now... No errors were found on the image. -incompatible_features 0x0 +incompatible_features [] wrote 512/512 bytes at offset 0 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) -incompatible_features 0x0 +incompatible_features [] === Testing cluster data reference into inactive L2 table === @@ -XXX,XX +XXX,XX @@ Data may be corrupted, or further writes to the image may corrupt it. 1 leaked clusters were found on the image. This means waste of disk space, but no harm to data. -incompatible_features 0x0 +incompatible_features [] qcow2: Marking image as corrupt: Preventing invalid write on metadata (overlaps with inactive L2 table); further corruption events will be suppressed write failed: Input/output error -incompatible_features 0x2 +incompatible_features [1] ERROR cluster 4 refcount=1 reference=2 Leaked cluster 9 refcount=1 reference=0 Repairing cluster 4 refcount=1 reference=2 @@ -XXX,XX +XXX,XX @@ The following inconsistencies were found and repaired: Double checking the fixed image now... No errors were found on the image. -incompatible_features 0x0 +incompatible_features [] wrote 512/512 bytes at offset 0 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) -incompatible_features 0x0 +incompatible_features [] read 512/512 bytes at offset 0 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) No errors were found on the image. diff --git a/tests/qemu-iotests/061.out b/tests/qemu-iotests/061.out index XXXXXXX..XXXXXXX 100644 --- a/tests/qemu-iotests/061.out +++ b/tests/qemu-iotests/061.out @@ -XXX,XX +XXX,XX @@ refcount_table_offset 0x10000 refcount_table_clusters 1 nb_snapshots 0 snapshot_offset 0x0 -incompatible_features 0x0 -compatible_features 0x1 -autoclear_features 0x0 +incompatible_features [] +compatible_features [0] +autoclear_features [] refcount_order 4 header_length 104 @@ -XXX,XX +XXX,XX @@ refcount_table_offset 0x10000 refcount_table_clusters 1 nb_snapshots 0 snapshot_offset 0x0 -incompatible_features 0x0 -compatible_features 0x0 -autoclear_features 0x0 +incompatible_features [] +compatible_features [] +autoclear_features [] refcount_order 4 header_length 72 @@ -XXX,XX +XXX,XX @@ refcount_table_offset 0x10000 refcount_table_clusters 1 nb_snapshots 0 snapshot_offset 0x0 -incompatible_features 0x0 -compatible_features 0x1 -autoclear_features 0x0 +incompatible_features [] +compatible_features [0] +autoclear_features [] refcount_order 4 header_length 104 @@ -XXX,XX +XXX,XX @@ refcount_table_offset 0x10000 refcount_table_clusters 1 nb_snapshots 0 snapshot_offset 0x0 -incompatible_features 0x0 -compatible_features 0x0 -autoclear_features 0x0 +incompatible_features [] +compatible_features [] +autoclear_features [] refcount_order 4 header_length 72 @@ -XXX,XX +XXX,XX @@ refcount_table_offset 0x10000 refcount_table_clusters 1 nb_snapshots 0 snapshot_offset 0x0 -incompatible_features 0x1 -compatible_features 0x1 -autoclear_features 0x0 +incompatible_features [0] +compatible_features [0] +autoclear_features [] refcount_order 4 header_length 104 @@ -XXX,XX +XXX,XX @@ refcount_table_offset 0x80000 refcount_table_clusters 1 nb_snapshots 0 snapshot_offset 0x0 -incompatible_features 0x0 -compatible_features 0x0 -autoclear_features 0x0 +incompatible_features [] +compatible_features [] +autoclear_features [] refcount_order 4 header_length 72 @@ -XXX,XX +XXX,XX @@ refcount_table_offset 0x10000 refcount_table_clusters 1 nb_snapshots 0 snapshot_offset 0x0 -incompatible_features 0x0 -compatible_features 0x40000000000 -autoclear_features 0x40000000000 +incompatible_features [] +compatible_features [42] +autoclear_features [42] refcount_order 4 header_length 104 @@ -XXX,XX +XXX,XX @@ refcount_table_offset 0x10000 refcount_table_clusters 1 nb_snapshots 0 snapshot_offset 0x0 -incompatible_features 0x0 -compatible_features 0x0 -autoclear_features 0x0 +incompatible_features [] +compatible_features [] +autoclear_features [] refcount_order 4 header_length 72 @@ -XXX,XX +XXX,XX @@ refcount_table_offset 0x10000 refcount_table_clusters 1 nb_snapshots 0 snapshot_offset 0x0 -incompatible_features 0x0 -compatible_features 0x0 -autoclear_features 0x0 +incompatible_features [] +compatible_features [] +autoclear_features [] refcount_order 4 header_length 72 @@ -XXX,XX +XXX,XX @@ refcount_table_offset 0x10000 refcount_table_clusters 1 nb_snapshots 0 snapshot_offset 0x0 -incompatible_features 0x0 -compatible_features 0x1 -autoclear_features 0x0 +incompatible_features [] +compatible_features [0] +autoclear_features [] refcount_order 4 header_length 104 @@ -XXX,XX +XXX,XX @@ refcount_table_offset 0x10000 refcount_table_clusters 1 nb_snapshots 0 snapshot_offset 0x0 -incompatible_features 0x1 -compatible_features 0x1 -autoclear_features 0x0 +incompatible_features [0] +compatible_features [0] +autoclear_features [] refcount_order 4 header_length 104 @@ -XXX,XX +XXX,XX @@ refcount_table_offset 0x80000 refcount_table_clusters 1 nb_snapshots 0 snapshot_offset 0x0 -incompatible_features 0x0 -compatible_features 0x0 -autoclear_features 0x0 +incompatible_features [] +compatible_features [] +autoclear_features [] refcount_order 4 header_length 104 diff --git a/tests/qemu-iotests/137.out b/tests/qemu-iotests/137.out index XXXXXXX..XXXXXXX 100644 --- a/tests/qemu-iotests/137.out +++ b/tests/qemu-iotests/137.out @@ -XXX,XX +XXX,XX @@ qemu-io: Unsupported value 'blubb' for qcow2 option 'overlap-check'. Allowed are wrote 512/512 bytes at offset 0 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) ./common.rc: Killed ( VALGRIND_QEMU="${VALGRIND_QEMU_IO}" _qemu_proc_exec "${VALGRIND_LOGFILE}" "$QEMU_IO_PROG" $QEMU_IO_ARGS "$@" ) -incompatible_features 0x0 +incompatible_features [] Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 wrote 65536/65536 bytes at offset 0 64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) diff --git a/tests/qemu-iotests/qcow2.py b/tests/qemu-iotests/qcow2.py index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/qcow2.py +++ b/tests/qemu-iotests/qcow2.py @@ -XXX,XX +XXX,XX @@ class QcowHeader: [ uint64_t, '%#x', 'snapshot_offset' ], # Version 3 header fields - [ uint64_t, '%#x', 'incompatible_features' ], - [ uint64_t, '%#x', 'compatible_features' ], - [ uint64_t, '%#x', 'autoclear_features' ], + [ uint64_t, 'mask', 'incompatible_features' ], + [ uint64_t, 'mask', 'compatible_features' ], + [ uint64_t, 'mask', 'autoclear_features' ], [ uint32_t, '%d', 'refcount_order' ], [ uint32_t, '%d', 'header_length' ], ]; @@ -XXX,XX +XXX,XX @@ class QcowHeader: def dump(self): for f in QcowHeader.fields: - print("%-25s" % f[2], f[1] % self.__dict__[f[2]]) + value = self.__dict__[f[2]] + if f[1] == 'mask': + bits = [] + for bit in range(64): + if value & (1 << bit): + bits.append(bit) + value_str = str(bits) + else: + value_str = f[1] % value + + print("%-25s" % f[2], value_str) print("") def dump_extensions(self): -- 2.24.1 Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com> Message-id: 20191107163708.833192-5-mreitz@redhat.com Signed-off-by: Max Reitz <mreitz@redhat.com> --- tests/qemu-iotests/common.filter | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/tests/qemu-iotests/common.filter b/tests/qemu-iotests/common.filter index XXXXXXX..XXXXXXX 100644 --- a/tests/qemu-iotests/common.filter +++ b/tests/qemu-iotests/common.filter @@ -XXX,XX +XXX,XX @@ _filter_qmp_empty_return() grep -v '{"return": {}}' } +_filter_json_filename() +{ + $PYTHON -c 'import sys +result, *fnames = sys.stdin.read().split("json:{") +depth = 0 +for fname in fnames: + depth += 1 # For the opening brace in the split separator + for chr_i, chr in enumerate(fname): + if chr == "{": + depth += 1 + elif chr == "}": + depth -= 1 + if depth == 0: + break + + # json:{} filenames may be nested; filter out everything from + # inside the outermost one + if depth == 0: + chr_i += 1 # First character past the filename + result += "json:{ /* filtered */ }" + fname[chr_i:] + +sys.stdout.write(result)' +} + # make sure this script returns success true -- 2.24.1 This test can run just fine with other values for refcount_bits, so we should filter the value from qcow2.py's dump-header. In fact, we can filter everything but the feature bits and header extensions, because that is what the test is about. (036 currently ignores user-specified image options, but that will be fixed in the next patch.) Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com> Message-id: 20191107163708.833192-6-mreitz@redhat.com Signed-off-by: Max Reitz <mreitz@redhat.com> --- tests/qemu-iotests/036 | 9 ++++--- tests/qemu-iotests/036.out | 48 -------------------------------------- 2 files changed, 6 insertions(+), 51 deletions(-) diff --git a/tests/qemu-iotests/036 b/tests/qemu-iotests/036 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/036 +++ b/tests/qemu-iotests/036 @@ -XXX,XX +XXX,XX @@ $PYTHON qcow2.py "$TEST_IMG" set-feature-bit incompatible 63 # Without feature table $PYTHON qcow2.py "$TEST_IMG" del-header-ext 0x6803f857 -$PYTHON qcow2.py "$TEST_IMG" dump-header +$PYTHON qcow2.py "$TEST_IMG" dump-header | grep features +$PYTHON qcow2.py "$TEST_IMG" dump-header-exts _img_info # With feature table containing bit 63 @@ -XXX,XX +XXX,XX @@ echo === Create image with unknown autoclear feature bit === echo _make_test_img 64M $PYTHON qcow2.py "$TEST_IMG" set-feature-bit autoclear 63 -$PYTHON qcow2.py "$TEST_IMG" dump-header +$PYTHON qcow2.py "$TEST_IMG" dump-header | grep features +$PYTHON qcow2.py "$TEST_IMG" dump-header-exts echo echo === Repair image === echo _check_test_img -r all -$PYTHON qcow2.py "$TEST_IMG" dump-header +$PYTHON qcow2.py "$TEST_IMG" dump-header | grep features +$PYTHON qcow2.py "$TEST_IMG" dump-header-exts # success, all done echo "*** done" diff --git a/tests/qemu-iotests/036.out b/tests/qemu-iotests/036.out index XXXXXXX..XXXXXXX 100644 --- a/tests/qemu-iotests/036.out +++ b/tests/qemu-iotests/036.out @@ -XXX,XX +XXX,XX @@ QA output created by 036 === Image with unknown incompatible feature bit === Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 -magic 0x514649fb -version 3 -backing_file_offset 0x0 -backing_file_size 0x0 -cluster_bits 16 -size 67108864 -crypt_method 0 -l1_size 1 -l1_table_offset 0x30000 -refcount_table_offset 0x10000 -refcount_table_clusters 1 -nb_snapshots 0 -snapshot_offset 0x0 incompatible_features [63] compatible_features [] autoclear_features [] -refcount_order 4 -header_length 104 - qemu-img: Could not open 'TEST_DIR/t.IMGFMT': Unsupported IMGFMT feature(s): Unknown incompatible feature: 8000000000000000 qemu-img: Could not open 'TEST_DIR/t.IMGFMT': Unsupported IMGFMT feature(s): Test feature @@ -XXX,XX +XXX,XX @@ qemu-img: Could not open 'TEST_DIR/t.IMGFMT': Unsupported IMGFMT feature(s): tes === Create image with unknown autoclear feature bit === Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 -magic 0x514649fb -version 3 -backing_file_offset 0x0 -backing_file_size 0x0 -cluster_bits 16 -size 67108864 -crypt_method 0 -l1_size 1 -l1_table_offset 0x30000 -refcount_table_offset 0x10000 -refcount_table_clusters 1 -nb_snapshots 0 -snapshot_offset 0x0 incompatible_features [] compatible_features [] autoclear_features [63] -refcount_order 4 -header_length 104 - Header extension: magic 0x6803f857 length 192 @@ -XXX,XX +XXX,XX @@ data <binary> === Repair image === No errors were found on the image. -magic 0x514649fb -version 3 -backing_file_offset 0x0 -backing_file_size 0x0 -cluster_bits 16 -size 67108864 -crypt_method 0 -l1_size 1 -l1_table_offset 0x30000 -refcount_table_offset 0x10000 -refcount_table_clusters 1 -nb_snapshots 0 -snapshot_offset 0x0 incompatible_features [] compatible_features [] autoclear_features [] -refcount_order 4 -header_length 104 - Header extension: magic 0x6803f857 length 192 -- 2.24.1 Some tests require compat=1.1 and thus set IMGOPTS='compat=1.1' globally. That is not how it should be done; instead, they should simply set _unsupported_imgopts to compat=0.10 (compat=1.1 is the default anyway). This makes the tests heed user-specified $IMGOPTS. Some do not work with all image options, though, so we need to disable them accordingly. Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Maxim Levitsky <mlevitsky@redhat.com> Message-id: 20191107163708.833192-7-mreitz@redhat.com Signed-off-by: Max Reitz <mreitz@redhat.com> --- tests/qemu-iotests/036 | 3 +-- tests/qemu-iotests/060 | 4 ++-- tests/qemu-iotests/062 | 3 ++- tests/qemu-iotests/066 | 3 ++- tests/qemu-iotests/068 | 3 ++- tests/qemu-iotests/098 | 4 ++-- 6 files changed, 11 insertions(+), 9 deletions(-) diff --git a/tests/qemu-iotests/036 b/tests/qemu-iotests/036 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/036 +++ b/tests/qemu-iotests/036 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 # This tests qcow2-specific low-level functionality _supported_fmt qcow2 _supported_proto file - # Only qcow2v3 and later supports feature bits -IMGOPTS="compat=1.1" +_unsupported_imgopts 'compat=0.10' echo echo === Image with unknown incompatible feature bit === diff --git a/tests/qemu-iotests/060 b/tests/qemu-iotests/060 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/060 +++ b/tests/qemu-iotests/060 @@ -XXX,XX +XXX,XX @@ _filter_io_error() _supported_fmt qcow2 _supported_proto file _supported_os Linux +# These tests only work for compat=1.1 images with refcount_bits=16 +_unsupported_imgopts 'compat=0.10' 'refcount_bits=\([^1]\|.\([^6]\|$\)\)' # The repair process will create a large file - so check for availability first _require_large_file 64G @@ -XXX,XX +XXX,XX @@ l1_offset=196608 # 0x30000 (XXX: just an assumption) l2_offset=262144 # 0x40000 (XXX: just an assumption) l2_offset_after_snapshot=524288 # 0x80000 (XXX: just an assumption) -IMGOPTS="compat=1.1" - OPEN_RW="open -o overlap-check=all $TEST_IMG" # Overlap checks are done before write operations only, therefore opening an # image read-only makes the overlap-check option irrelevant diff --git a/tests/qemu-iotests/062 b/tests/qemu-iotests/062 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/062 +++ b/tests/qemu-iotests/062 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 # This tests qcow2-specific low-level functionality _supported_fmt qcow2 _supported_proto generic +# We need zero clusters and snapshots +_unsupported_imgopts 'compat=0.10' 'refcount_bits=1[^0-9]' -IMGOPTS="compat=1.1" IMG_SIZE=64M echo diff --git a/tests/qemu-iotests/066 b/tests/qemu-iotests/066 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/066 +++ b/tests/qemu-iotests/066 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 # This tests qcow2-specific low-level functionality _supported_fmt qcow2 _supported_proto generic +# We need zero clusters and snapshots +_unsupported_imgopts 'compat=0.10' 'refcount_bits=1[^0-9]' # Intentionally create an unaligned image -IMGOPTS="compat=1.1" IMG_SIZE=$((64 * 1024 * 1024 + 512)) echo diff --git a/tests/qemu-iotests/068 b/tests/qemu-iotests/068 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/068 +++ b/tests/qemu-iotests/068 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 # This tests qcow2-specific low-level functionality _supported_fmt qcow2 _supported_proto generic +# Internal snapshots are (currently) impossible with refcount_bits=1 +_unsupported_imgopts 'compat=0.10' 'refcount_bits=1[^0-9]' -IMGOPTS="compat=1.1" IMG_SIZE=128K case "$QEMU_DEFAULT_MACHINE" in diff --git a/tests/qemu-iotests/098 b/tests/qemu-iotests/098 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/098 +++ b/tests/qemu-iotests/098 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 _supported_fmt qcow2 _supported_proto file - -IMGOPTS="compat=1.1" +# The code path we want to test here only works for compat=1.1 images +_unsupported_imgopts 'compat=0.10' for event in l1_update empty_image_prepare reftable_update refblock_alloc; do -- 2.24.1 IMGOPTS can never be empty for qcow2, because the check scripts adds compat=1.1 unless the user specified any compat option themselves. Thus, this block does not do anything and can be dropped. Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com> Message-id: 20191107163708.833192-8-mreitz@redhat.com Signed-off-by: Max Reitz <mreitz@redhat.com> --- tests/qemu-iotests/050 | 4 ---- 1 file changed, 4 deletions(-) diff --git a/tests/qemu-iotests/050 b/tests/qemu-iotests/050 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/050 +++ b/tests/qemu-iotests/050 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 _supported_fmt qcow2 qed _supported_proto file -if test "$IMGFMT" = qcow2 && test $IMGOPTS = ""; then - IMGOPTS=compat=1.1 -fi - echo echo "== Creating images ==" -- 2.24.1 This will allow us to add more options than just -b. Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com> Message-id: 20191107163708.833192-9-mreitz@redhat.com Signed-off-by: Max Reitz <mreitz@redhat.com> --- tests/qemu-iotests/common.rc | 28 ++++++++++++++++++++-------- 1 file changed, 20 insertions(+), 8 deletions(-) diff --git a/tests/qemu-iotests/common.rc b/tests/qemu-iotests/common.rc index XXXXXXX..XXXXXXX 100644 --- a/tests/qemu-iotests/common.rc +++ b/tests/qemu-iotests/common.rc @@ -XXX,XX +XXX,XX @@ _make_test_img() # extra qemu-img options can be added by tests # at least one argument (the image size) needs to be added local extra_img_options="" - local image_size=$* local optstr="" local img_name="" local use_backing=0 local backing_file="" local object_options="" + local misc_params=() if [ -n "$TEST_IMG_FILE" ]; then img_name=$TEST_IMG_FILE @@ -XXX,XX +XXX,XX @@ _make_test_img() optstr=$(_optstr_add "$optstr" "key-secret=keysec0") fi - if [ "$1" = "-b" ]; then - use_backing=1 - backing_file=$2 - image_size=$3 - fi + for param; do + if [ "$use_backing" = "1" -a -z "$backing_file" ]; then + backing_file=$param + continue + fi + + case "$param" in + -b) + use_backing=1 + ;; + + *) + misc_params=("${misc_params[@]}" "$param") + ;; + esac + done + if [ \( "$IMGFMT" = "qcow2" -o "$IMGFMT" = "qed" \) -a -n "$CLUSTER_SIZE" ]; then optstr=$(_optstr_add "$optstr" "cluster_size=$CLUSTER_SIZE") fi @@ -XXX,XX +XXX,XX @@ _make_test_img() # XXX(hch): have global image options? ( if [ $use_backing = 1 ]; then - $QEMU_IMG create $object_options -f $IMGFMT $extra_img_options -b "$backing_file" "$img_name" $image_size 2>&1 + $QEMU_IMG create $object_options -f $IMGFMT $extra_img_options -b "$backing_file" "$img_name" "${misc_params[@]}" 2>&1 else - $QEMU_IMG create $object_options -f $IMGFMT $extra_img_options "$img_name" $image_size 2>&1 + $QEMU_IMG create $object_options -f $IMGFMT $extra_img_options "$img_name" "${misc_params[@]}" 2>&1 fi ) | _filter_img_create -- 2.24.1 Blindly overriding IMGOPTS is suboptimal as this discards user-specified options. Whatever options the test needs should simply be appended. Some tests do this (with IMGOPTS=$(_optstr_add "$IMGOPTS" "...")), but that is cumbersome. It’s simpler to just give _make_test_img an -o parameter with which tests can add options. Some tests actually must override the user-specified options, though, for example when creating an image in a different format than the test $IMGFMT. For such cases, --no-opts allows clearing the current option list. Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com> Message-id: 20191107163708.833192-10-mreitz@redhat.com Signed-off-by: Max Reitz <mreitz@redhat.com> --- tests/qemu-iotests/common.rc | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/tests/qemu-iotests/common.rc b/tests/qemu-iotests/common.rc index XXXXXXX..XXXXXXX 100644 --- a/tests/qemu-iotests/common.rc +++ b/tests/qemu-iotests/common.rc @@ -XXX,XX +XXX,XX @@ _make_test_img() local use_backing=0 local backing_file="" local object_options="" + local opts_param=false local misc_params=() if [ -n "$TEST_IMG_FILE" ]; then @@ -XXX,XX +XXX,XX @@ _make_test_img() if [ "$use_backing" = "1" -a -z "$backing_file" ]; then backing_file=$param continue + elif $opts_param; then + optstr=$(_optstr_add "$optstr" "$param") + opts_param=false + continue fi case "$param" in @@ -XXX,XX +XXX,XX @@ _make_test_img() use_backing=1 ;; + -o) + opts_param=true + ;; + + --no-opts) + optstr="" + ;; + *) misc_params=("${misc_params[@]}" "$param") ;; -- 2.24.1 It did not matter before, but now that _make_test_img understands -o, we should use it properly here. Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com> Message-id: 20191107163708.833192-11-mreitz@redhat.com Signed-off-by: Max Reitz <mreitz@redhat.com> --- tests/qemu-iotests/051 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/qemu-iotests/051 b/tests/qemu-iotests/051 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/051 +++ b/tests/qemu-iotests/051 @@ -XXX,XX +XXX,XX @@ echo echo === With version 2 images enabling lazy refcounts must fail === echo -_make_test_img -ocompat=0.10 $size +_make_test_img -o compat=0.10 $size run_qemu -drive file="$TEST_IMG",format=qcow2,lazy-refcounts=on run_qemu -drive file="$TEST_IMG",format=qcow2,lazy-refcounts=off -- 2.24.1 Tests should not overwrite all user-supplied image options, but only add to it (which will effectively overwrite conflicting values). Accomplish this by passing options to _make_test_img via -o instead of $IMGOPTS. For some tests, there is no functional change because they already only appended options to IMGOPTS. For these, this patch is just a simplification. For others, this is a change, so they now heed user-specified $IMGOPTS. Some of those tests do not work with all image options, though, so we need to disable them accordingly. Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com> Message-id: 20191107163708.833192-12-mreitz@redhat.com Signed-off-by: Max Reitz <mreitz@redhat.com> --- tests/qemu-iotests/031 | 9 ++++--- tests/qemu-iotests/039 | 24 ++++++------------ tests/qemu-iotests/059 | 18 ++++++------- tests/qemu-iotests/060 | 6 ++--- tests/qemu-iotests/061 | 57 ++++++++++++++++++++++-------------------- tests/qemu-iotests/079 | 3 +-- tests/qemu-iotests/106 | 2 +- tests/qemu-iotests/108 | 2 +- tests/qemu-iotests/112 | 32 ++++++++++++------------ tests/qemu-iotests/115 | 3 +-- tests/qemu-iotests/121 | 6 ++--- tests/qemu-iotests/125 | 2 +- tests/qemu-iotests/137 | 2 +- tests/qemu-iotests/138 | 3 +-- tests/qemu-iotests/175 | 2 +- tests/qemu-iotests/190 | 2 +- tests/qemu-iotests/191 | 3 +-- tests/qemu-iotests/220 | 4 ++- tests/qemu-iotests/243 | 6 +++-- tests/qemu-iotests/244 | 10 +++++--- tests/qemu-iotests/250 | 3 +-- tests/qemu-iotests/265 | 2 +- 22 files changed, 100 insertions(+), 101 deletions(-) diff --git a/tests/qemu-iotests/031 b/tests/qemu-iotests/031 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/031 +++ b/tests/qemu-iotests/031 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 # This tests qcow2-specific low-level functionality _supported_fmt qcow2 _supported_proto file +# We want to test compat=0.10, which does not support refcount widths +# other than 16 +_unsupported_imgopts 'refcount_bits=\([^1]\|.\([^6]\|$\)\)' CLUSTER_SIZE=65536 # qcow2.py output depends on the exact options used, so override the command # line here as an exception -for IMGOPTS in "compat=0.10" "compat=1.1"; do +for compat in "compat=0.10" "compat=1.1"; do echo - echo ===== Testing with -o $IMGOPTS ===== + echo ===== Testing with -o $compat ===== echo echo === Create image with unknown header extension === echo - _make_test_img 64M + _make_test_img -o $compat 64M $PYTHON qcow2.py "$TEST_IMG" add-header-ext 0x12345678 "This is a test header extension" $PYTHON qcow2.py "$TEST_IMG" dump-header _check_test_img diff --git a/tests/qemu-iotests/039 b/tests/qemu-iotests/039 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/039 +++ b/tests/qemu-iotests/039 @@ -XXX,XX +XXX,XX @@ size=128M echo echo "== Checking that image is clean on shutdown ==" -IMGOPTS="compat=1.1,lazy_refcounts=on" -_make_test_img $size +_make_test_img -o "compat=1.1,lazy_refcounts=on" $size $QEMU_IO -c "write -P 0x5a 0 512" "$TEST_IMG" | _filter_qemu_io @@ -XXX,XX +XXX,XX @@ _check_test_img echo echo "== Creating a dirty image file ==" -IMGOPTS="compat=1.1,lazy_refcounts=on" -_make_test_img $size +_make_test_img -o "compat=1.1,lazy_refcounts=on" $size _NO_VALGRIND \ $QEMU_IO -c "write -P 0x5a 0 512" \ @@ -XXX,XX +XXX,XX @@ $QEMU_IO -c "read -P 0x5a 0 512" "$TEST_IMG" | _filter_qemu_io echo echo "== Opening a dirty image read/write should repair it ==" -IMGOPTS="compat=1.1,lazy_refcounts=on" -_make_test_img $size +_make_test_img -o "compat=1.1,lazy_refcounts=on" $size _NO_VALGRIND \ $QEMU_IO -c "write -P 0x5a 0 512" \ @@ -XXX,XX +XXX,XX @@ $PYTHON qcow2.py "$TEST_IMG" dump-header | grep incompatible_features echo echo "== Creating an image file with lazy_refcounts=off ==" -IMGOPTS="compat=1.1,lazy_refcounts=off" -_make_test_img $size +_make_test_img -o "compat=1.1,lazy_refcounts=off" $size _NO_VALGRIND \ $QEMU_IO -c "write -P 0x5a 0 512" \ @@ -XXX,XX +XXX,XX @@ _check_test_img echo echo "== Committing to a backing file with lazy_refcounts=on ==" -IMGOPTS="compat=1.1,lazy_refcounts=on" -TEST_IMG="$TEST_IMG".base _make_test_img $size +TEST_IMG="$TEST_IMG".base _make_test_img -o "compat=1.1,lazy_refcounts=on" $size -IMGOPTS="compat=1.1,lazy_refcounts=on,backing_file=$TEST_IMG.base" -_make_test_img $size +_make_test_img -o "compat=1.1,lazy_refcounts=on,backing_file=$TEST_IMG.base" $size $QEMU_IO -c "write 0 512" "$TEST_IMG" | _filter_qemu_io $QEMU_IMG commit "$TEST_IMG" @@ -XXX,XX +XXX,XX @@ TEST_IMG="$TEST_IMG".base _check_test_img echo echo "== Changing lazy_refcounts setting at runtime ==" -IMGOPTS="compat=1.1,lazy_refcounts=off" -_make_test_img $size +_make_test_img -o "compat=1.1,lazy_refcounts=off" $size _NO_VALGRIND \ $QEMU_IO -c "reopen -o lazy-refcounts=on" \ @@ -XXX,XX +XXX,XX @@ $QEMU_IO -c "reopen -o lazy-refcounts=on" \ $PYTHON qcow2.py "$TEST_IMG" dump-header | grep incompatible_features _check_test_img -IMGOPTS="compat=1.1,lazy_refcounts=on" -_make_test_img $size +_make_test_img -o "compat=1.1,lazy_refcounts=on" $size _NO_VALGRIND \ $QEMU_IO -c "reopen -o lazy-refcounts=off" \ diff --git a/tests/qemu-iotests/059 b/tests/qemu-iotests/059 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/059 +++ b/tests/qemu-iotests/059 @@ -XXX,XX +XXX,XX @@ poke_file "$TEST_IMG" "$grain_table_size_offset" "\x01\x00\x00\x00" echo echo "=== Testing monolithicFlat creation and opening ===" -IMGOPTS="subformat=monolithicFlat" _make_test_img 2G +_make_test_img -o "subformat=monolithicFlat" 2G _img_info _cleanup_test_img echo echo "=== Testing monolithicFlat with zeroed_grain ===" -IMGOPTS="subformat=monolithicFlat,zeroed_grain=on" _make_test_img 2G +_make_test_img -o "subformat=monolithicFlat,zeroed_grain=on" 2G _cleanup_test_img echo echo "=== Testing big twoGbMaxExtentFlat ===" -IMGOPTS="subformat=twoGbMaxExtentFlat" _make_test_img 1000G +_make_test_img -o "subformat=twoGbMaxExtentFlat" 1000G $QEMU_IMG info $TEST_IMG | _filter_testdir | sed -e 's/cid: [0-9]*/cid: XXXXXXXX/' _cleanup_test_img @@ -XXX,XX +XXX,XX @@ _img_info echo echo "=== Testing truncated sparse ===" -IMGOPTS="subformat=monolithicSparse" _make_test_img 100G +_make_test_img -o "subformat=monolithicSparse" 100G truncate -s 10M $TEST_IMG _img_info echo echo "=== Converting to streamOptimized from image with small cluster size===" -TEST_IMG="$TEST_IMG.qcow2" IMGFMT=qcow2 IMGOPTS="cluster_size=4096" _make_test_img 1G +TEST_IMG="$TEST_IMG.qcow2" IMGFMT=qcow2 _make_test_img -o "cluster_size=4096" 1G $QEMU_IO -f qcow2 -c "write -P 0xa 0 512" "$TEST_IMG.qcow2" | _filter_qemu_io $QEMU_IO -f qcow2 -c "write -P 0xb 10240 512" "$TEST_IMG.qcow2" | _filter_qemu_io $QEMU_IMG convert -f qcow2 -O vmdk -o subformat=streamOptimized "$TEST_IMG.qcow2" "$TEST_IMG" 2>&1 @@ -XXX,XX +XXX,XX @@ echo "=== Testing monolithicFlat with internally generated JSON file name ===" echo '--- blkdebug ---' # Should work, because bdrv_dirname() works fine with blkdebug -IMGOPTS="subformat=monolithicFlat" _make_test_img 64M +_make_test_img -o "subformat=monolithicFlat" 64M $QEMU_IO -c "open -o driver=$IMGFMT,file.driver=blkdebug,file.image.filename=$TEST_IMG,file.inject-error.0.event=read_aio" \ -c info \ 2>&1 \ @@ -XXX,XX +XXX,XX @@ _cleanup_test_img echo '--- quorum ---' # Should not work, because bdrv_dirname() does not work with quorum -IMGOPTS="subformat=monolithicFlat" _make_test_img 64M +_make_test_img -o "subformat=monolithicFlat" 64M cp "$TEST_IMG" "$TEST_IMG.orig" filename="json:{ @@ -XXX,XX +XXX,XX @@ _cleanup_test_img echo echo "=== Testing 4TB monolithicFlat creation and IO ===" -IMGOPTS="subformat=monolithicFlat" _make_test_img 4T +_make_test_img -o "subformat=monolithicFlat" 4T _img_info $QEMU_IO -c "write -P 0xa 900G 512" "$TEST_IMG" | _filter_qemu_io $QEMU_IO -c "read -v 900G 1024" "$TEST_IMG" | _filter_qemu_io @@ -XXX,XX +XXX,XX @@ _cleanup_test_img echo echo "=== Testing qemu-img map on extents ===" for fmt in monolithicSparse twoGbMaxExtentSparse; do - IMGOPTS="subformat=$fmt" _make_test_img 31G + _make_test_img -o "subformat=$fmt" 31G $QEMU_IO -c "write 65024 1k" "$TEST_IMG" | _filter_qemu_io $QEMU_IO -c "write 2147483136 1k" "$TEST_IMG" | _filter_qemu_io $QEMU_IO -c "write 5G 1k" "$TEST_IMG" | _filter_qemu_io diff --git a/tests/qemu-iotests/060 b/tests/qemu-iotests/060 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/060 +++ b/tests/qemu-iotests/060 @@ -XXX,XX +XXX,XX @@ $QEMU_IO -c 'write 0k 64k' "$BACKING_IMG" | _filter_qemu_io # compat=0.10 is required in order to make the following discard actually # unallocate the sector rather than make it a zero sector - we want COW, after # all. -IMGOPTS='compat=0.10' _make_test_img -b "$BACKING_IMG" 1G +_make_test_img -o 'compat=0.10' -b "$BACKING_IMG" 1G # Write two clusters, the second one enforces creation of an L2 table after # the first data cluster. $QEMU_IO -c 'write 0k 64k' -c 'write 512M 64k' "$TEST_IMG" | _filter_qemu_io @@ -XXX,XX +XXX,XX @@ echo echo "=== Discarding a non-covered in-bounds refblock ===" echo -IMGOPTS='refcount_bits=1' _make_test_img 64M +_make_test_img -o 'refcount_bits=1' 64M # Pretend there's a refblock somewhere where there is no refblock to # cover it (but the covering refblock has a valid index in the @@ -XXX,XX +XXX,XX @@ echo echo "=== Discarding a refblock covered by an unaligned refblock ===" echo -IMGOPTS='refcount_bits=1' _make_test_img 64M +_make_test_img -o 'refcount_bits=1' 64M # Same as above poke_file "$TEST_IMG" "$(($rt_offset+8))" "\x00\x00\x00\x10\x00\x00\x00\x00" diff --git a/tests/qemu-iotests/061 b/tests/qemu-iotests/061 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/061 +++ b/tests/qemu-iotests/061 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 _supported_fmt qcow2 _supported_proto file _supported_os Linux +# Conversion between different compat versions can only really work +# with refcount_bits=16 +_unsupported_imgopts 'refcount_bits=\([^1]\|.\([^6]\|$\)\)' echo echo "=== Testing version downgrade with zero expansion ===" echo -IMGOPTS="compat=1.1,lazy_refcounts=on" _make_test_img 64M +_make_test_img -o "compat=1.1,lazy_refcounts=on" 64M $QEMU_IO -c "write -z 0 128k" "$TEST_IMG" | _filter_qemu_io $PYTHON qcow2.py "$TEST_IMG" dump-header $QEMU_IMG amend -o "compat=0.10" "$TEST_IMG" @@ -XXX,XX +XXX,XX @@ _check_test_img echo echo "=== Testing version downgrade with zero expansion and 4K cache entries ===" echo -IMGOPTS="compat=1.1,lazy_refcounts=on" _make_test_img 64M +_make_test_img -o "compat=1.1,lazy_refcounts=on" 64M $QEMU_IO -c "write -z 0 128k" "$TEST_IMG" | _filter_qemu_io $QEMU_IO -c "write -z 32M 128k" "$TEST_IMG" | _filter_qemu_io $QEMU_IO -c map "$TEST_IMG" | _filter_qemu_io @@ -XXX,XX +XXX,XX @@ _check_test_img echo echo "=== Testing dirty version downgrade ===" echo -IMGOPTS="compat=1.1,lazy_refcounts=on" _make_test_img 64M +_make_test_img -o "compat=1.1,lazy_refcounts=on" 64M _NO_VALGRIND \ $QEMU_IO -c "write -P 0x2a 0 128k" -c flush \ -c "sigraise $(kill -l KILL)" "$TEST_IMG" 2>&1 | _filter_qemu_io @@ -XXX,XX +XXX,XX @@ _check_test_img echo echo "=== Testing version downgrade with unknown compat/autoclear flags ===" echo -IMGOPTS="compat=1.1" _make_test_img 64M +_make_test_img -o "compat=1.1" 64M $PYTHON qcow2.py "$TEST_IMG" set-feature-bit compatible 42 $PYTHON qcow2.py "$TEST_IMG" set-feature-bit autoclear 42 $PYTHON qcow2.py "$TEST_IMG" dump-header @@ -XXX,XX +XXX,XX @@ _check_test_img echo echo "=== Testing version upgrade and resize ===" echo -IMGOPTS="compat=0.10" _make_test_img 64M +_make_test_img -o "compat=0.10" 64M $QEMU_IO -c "write -P 0x2a 42M 64k" "$TEST_IMG" | _filter_qemu_io $PYTHON qcow2.py "$TEST_IMG" dump-header $QEMU_IMG amend -o "compat=1.1,lazy_refcounts=on,size=128M" "$TEST_IMG" @@ -XXX,XX +XXX,XX @@ _check_test_img echo echo "=== Testing dirty lazy_refcounts=off ===" echo -IMGOPTS="compat=1.1,lazy_refcounts=on" _make_test_img 64M +_make_test_img -o "compat=1.1,lazy_refcounts=on" 64M _NO_VALGRIND \ $QEMU_IO -c "write -P 0x2a 0 128k" -c flush \ -c "sigraise $(kill -l KILL)" "$TEST_IMG" 2>&1 | _filter_qemu_io @@ -XXX,XX +XXX,XX @@ _check_test_img echo echo "=== Testing backing file ===" echo -IMGOPTS="compat=1.1" _make_test_img 64M -IMGOPTS="compat=1.1" TEST_IMG="$TEST_IMG.base" _make_test_img 64M +_make_test_img -o "compat=1.1" 64M +TEST_IMG="$TEST_IMG.base" _make_test_img -o "compat=1.1" 64M $QEMU_IO -c "write -P 0x2a 0 128k" "$TEST_IMG.base" | _filter_qemu_io $QEMU_IO -c "read -P 0 0 128k" "$TEST_IMG" | _filter_qemu_io $QEMU_IMG amend -o "backing_file=$TEST_IMG.base,backing_fmt=qcow2" "$TEST_IMG" @@ -XXX,XX +XXX,XX @@ _check_test_img echo echo "=== Testing invalid configurations ===" echo -IMGOPTS="compat=0.10" _make_test_img 64M +_make_test_img -o "compat=0.10" 64M $QEMU_IMG amend -o "lazy_refcounts=on" "$TEST_IMG" $QEMU_IMG amend -o "compat=1.1" "$TEST_IMG" # actually valid $QEMU_IMG amend -o "compat=0.10,lazy_refcounts=on" "$TEST_IMG" @@ -XXX,XX +XXX,XX @@ $QEMU_IMG amend -o "preallocation=on" "$TEST_IMG" echo echo "=== Testing correct handling of unset value ===" echo -IMGOPTS="compat=1.1,cluster_size=1k" _make_test_img 64M +_make_test_img -o "compat=1.1,cluster_size=1k" 64M echo "Should work:" $QEMU_IMG amend -o "lazy_refcounts=on" "$TEST_IMG" echo "Should not work:" # Just to know which of these tests actually fails @@ -XXX,XX +XXX,XX @@ $QEMU_IMG amend -o "cluster_size=64k" "$TEST_IMG" echo echo "=== Testing zero expansion on inactive clusters ===" echo -IMGOPTS="compat=1.1" _make_test_img 64M +_make_test_img -o "compat=1.1" 64M $QEMU_IO -c "write -z 0 128k" "$TEST_IMG" | _filter_qemu_io $QEMU_IMG snapshot -c foo "$TEST_IMG" $QEMU_IO -c "write -P 0x2a 0 128k" "$TEST_IMG" | _filter_qemu_io @@ -XXX,XX +XXX,XX @@ $QEMU_IO -c "read -P 0 0 128k" "$TEST_IMG" | _filter_qemu_io echo echo "=== Testing zero expansion on shared L2 table ===" echo -IMGOPTS="compat=1.1" _make_test_img 64M +_make_test_img -o "compat=1.1" 64M $QEMU_IO -c "write -z 0 128k" "$TEST_IMG" | _filter_qemu_io $QEMU_IMG snapshot -c foo "$TEST_IMG" $QEMU_IMG amend -o "compat=0.10" "$TEST_IMG" @@ -XXX,XX +XXX,XX @@ $QEMU_IO -c "read -P 0 0 128k" "$TEST_IMG" | _filter_qemu_io echo echo "=== Testing zero expansion on backed image ===" echo -IMGOPTS="compat=1.1" TEST_IMG="$TEST_IMG.base" _make_test_img 64M +TEST_IMG="$TEST_IMG.base" _make_test_img -o "compat=1.1" 64M $QEMU_IO -c "write -P 0x2a 0 128k" "$TEST_IMG.base" | _filter_qemu_io -IMGOPTS="compat=1.1" _make_test_img -b "$TEST_IMG.base" 64M +_make_test_img -o "compat=1.1" -b "$TEST_IMG.base" 64M $QEMU_IO -c "read -P 0x2a 0 128k" -c "write -z 0 64k" "$TEST_IMG" | _filter_qemu_io $QEMU_IMG amend -o "compat=0.10" "$TEST_IMG" _check_test_img @@ -XXX,XX +XXX,XX @@ $QEMU_IO -c "read -P 0 0 64k" -c "read -P 0x2a 64k 64k" "$TEST_IMG" | _filter_qe echo echo "=== Testing zero expansion on backed inactive clusters ===" echo -IMGOPTS="compat=1.1" TEST_IMG="$TEST_IMG.base" _make_test_img 64M +TEST_IMG="$TEST_IMG.base" _make_test_img -o "compat=1.1" 64M $QEMU_IO -c "write -P 0x2a 0 128k" "$TEST_IMG.base" | _filter_qemu_io -IMGOPTS="compat=1.1" _make_test_img -b "$TEST_IMG.base" 64M +_make_test_img -o "compat=1.1" -b "$TEST_IMG.base" 64M $QEMU_IO -c "write -z 0 64k" "$TEST_IMG" | _filter_qemu_io $QEMU_IMG snapshot -c foo "$TEST_IMG" $QEMU_IO -c "write -P 0x42 0 128k" "$TEST_IMG" | _filter_qemu_io @@ -XXX,XX +XXX,XX @@ $QEMU_IO -c "read -P 0 0 64k" -c "read -P 0x2a 64k 64k" "$TEST_IMG" | _filter_qe echo echo "=== Testing zero expansion on backed image with shared L2 table ===" echo -IMGOPTS="compat=1.1" TEST_IMG="$TEST_IMG.base" _make_test_img 64M +TEST_IMG="$TEST_IMG.base" _make_test_img -o "compat=1.1" 64M $QEMU_IO -c "write -P 0x2a 0 128k" "$TEST_IMG.base" | _filter_qemu_io -IMGOPTS="compat=1.1" _make_test_img -b "$TEST_IMG.base" 64M +_make_test_img -o "compat=1.1" -b "$TEST_IMG.base" 64M $QEMU_IO -c "write -z 0 128k" "$TEST_IMG" | _filter_qemu_io $QEMU_IMG snapshot -c foo "$TEST_IMG" $QEMU_IMG amend -o "compat=0.10" "$TEST_IMG" @@ -XXX,XX +XXX,XX @@ $QEMU_IO -c "read -P 0 0 128k" "$TEST_IMG" | _filter_qemu_io echo echo "=== Testing preallocated zero expansion on full image ===" echo -IMGOPTS="compat=1.1" TEST_IMG="$TEST_IMG" _make_test_img 64M +TEST_IMG="$TEST_IMG" _make_test_img -o "compat=1.1" 64M $QEMU_IO -c "write -P 0x2a 0 64M" "$TEST_IMG" -c "write -z 0 64M" | _filter_qemu_io $QEMU_IMG amend -o "compat=0.10" "$TEST_IMG" _check_test_img @@ -XXX,XX +XXX,XX @@ $QEMU_IO -c "read -P 0 0 64M" "$TEST_IMG" | _filter_qemu_io echo echo "=== Testing progress report without snapshot ===" echo -IMGOPTS="compat=1.1" TEST_IMG="$TEST_IMG.base" _make_test_img 4G -IMGOPTS="compat=1.1" _make_test_img -b "$TEST_IMG.base" 4G +TEST_IMG="$TEST_IMG.base" _make_test_img -o "compat=1.1" 4G +_make_test_img -o "compat=1.1" -b "$TEST_IMG.base" 4G $QEMU_IO -c "write -z 0 64k" \ -c "write -z 1G 64k" \ -c "write -z 2G 64k" \ @@ -XXX,XX +XXX,XX @@ _check_test_img echo echo "=== Testing progress report with snapshot ===" echo -IMGOPTS="compat=1.1" TEST_IMG="$TEST_IMG.base" _make_test_img 4G -IMGOPTS="compat=1.1" _make_test_img -b "$TEST_IMG.base" 4G +TEST_IMG="$TEST_IMG.base" _make_test_img -o "compat=1.1" 4G +_make_test_img -o "compat=1.1" -b "$TEST_IMG.base" 4G $QEMU_IO -c "write -z 0 64k" \ -c "write -z 1G 64k" \ -c "write -z 2G 64k" \ @@ -XXX,XX +XXX,XX @@ _check_test_img echo echo "=== Testing version downgrade with external data file ===" echo -IMGOPTS="compat=1.1,data_file=$TEST_IMG.data" _make_test_img 64M +_make_test_img -o "compat=1.1,data_file=$TEST_IMG.data" 64M $QEMU_IMG amend -o "compat=0.10" "$TEST_IMG" _img_info --format-specific _check_test_img @@ -XXX,XX +XXX,XX @@ _check_test_img echo echo "=== Try changing the external data file ===" echo -IMGOPTS="compat=1.1" _make_test_img 64M +_make_test_img -o "compat=1.1" 64M $QEMU_IMG amend -o "data_file=foo" "$TEST_IMG" echo -IMGOPTS="compat=1.1,data_file=$TEST_IMG.data" _make_test_img 64M +_make_test_img -o "compat=1.1,data_file=$TEST_IMG.data" 64M $QEMU_IMG amend -o "data_file=foo" "$TEST_IMG" _img_info --format-specific TEST_IMG="data-file.filename=$TEST_IMG.data,file.filename=$TEST_IMG" _img_info --format-specific --image-opts @@ -XXX,XX +XXX,XX @@ TEST_IMG="data-file.filename=$TEST_IMG.data,file.filename=$TEST_IMG" _img_info - echo echo "=== Clearing and setting data-file-raw ===" echo -IMGOPTS="compat=1.1,data_file=$TEST_IMG.data,data_file_raw=on" _make_test_img 64M +_make_test_img -o "compat=1.1,data_file=$TEST_IMG.data,data_file_raw=on" 64M $QEMU_IMG amend -o "data_file_raw=on" "$TEST_IMG" _img_info --format-specific _check_test_img diff --git a/tests/qemu-iotests/079 b/tests/qemu-iotests/079 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/079 +++ b/tests/qemu-iotests/079 @@ -XXX,XX +XXX,XX @@ echo cluster_sizes="16384 32768 65536 131072 262144 524288 1048576 2097152 4194304" for s in $cluster_sizes; do - IMGOPTS=$(_optstr_add "$IMGOPTS" "preallocation=metadata,cluster_size=$s") \ - _make_test_img 4G + _make_test_img -o "preallocation=metadata,cluster_size=$s" 4G done # success, all done diff --git a/tests/qemu-iotests/106 b/tests/qemu-iotests/106 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/106 +++ b/tests/qemu-iotests/106 @@ -XXX,XX +XXX,XX @@ for create_mode in off falloc full; do echo echo "--- create_mode=$create_mode growth_mode=$growth_mode ---" - IMGOPTS="preallocation=$create_mode" _make_test_img ${CREATION_SIZE}K + _make_test_img -o "preallocation=$create_mode" ${CREATION_SIZE}K $QEMU_IMG resize -f "$IMGFMT" --preallocation=$growth_mode "$TEST_IMG" +${GROWTH_SIZE}K expected_size=0 diff --git a/tests/qemu-iotests/108 b/tests/qemu-iotests/108 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/108 +++ b/tests/qemu-iotests/108 @@ -XXX,XX +XXX,XX @@ echo echo '=== Repairing unreferenced data cluster in new refblock area ===' echo -IMGOPTS='cluster_size=512' _make_test_img 64M +_make_test_img -o 'cluster_size=512' 64M # Allocate the first 128 kB in the image (first refblock) $QEMU_IO -c 'write 0 0x1b200' "$TEST_IMG" | _filter_qemu_io # should be 131072 == 0x20000 diff --git a/tests/qemu-iotests/112 b/tests/qemu-iotests/112 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/112 +++ b/tests/qemu-iotests/112 @@ -XXX,XX +XXX,XX @@ echo '=== refcount_bits limits ===' echo # Must be positive (non-zero) -IMGOPTS="$IMGOPTS,refcount_bits=0" _make_test_img 64M +_make_test_img -o "refcount_bits=0" 64M # Must be positive (non-negative) -IMGOPTS="$IMGOPTS,refcount_bits=-1" _make_test_img 64M +_make_test_img -o "refcount_bits=-1" 64M # May not exceed 64 -IMGOPTS="$IMGOPTS,refcount_bits=128" _make_test_img 64M +_make_test_img -o "refcount_bits=128" 64M # Must be a power of two -IMGOPTS="$IMGOPTS,refcount_bits=42" _make_test_img 64M +_make_test_img -o "refcount_bits=42" 64M # 1 is the minimum -IMGOPTS="$IMGOPTS,refcount_bits=1" _make_test_img 64M +_make_test_img -o "refcount_bits=1" 64M print_refcount_bits # 64 is the maximum -IMGOPTS="$IMGOPTS,refcount_bits=64" _make_test_img 64M +_make_test_img -o "refcount_bits=64" 64M print_refcount_bits # 16 is the default @@ -XXX,XX +XXX,XX @@ echo '=== refcount_bits and compat=0.10 ===' echo # Should work -IMGOPTS="$IMGOPTS,compat=0.10,refcount_bits=16" _make_test_img 64M +_make_test_img -o "compat=0.10,refcount_bits=16" 64M print_refcount_bits # Should not work -IMGOPTS="$IMGOPTS,compat=0.10,refcount_bits=1" _make_test_img 64M -IMGOPTS="$IMGOPTS,compat=0.10,refcount_bits=64" _make_test_img 64M +_make_test_img -o "compat=0.10,refcount_bits=1" 64M +_make_test_img -o "compat=0.10,refcount_bits=64" 64M echo echo '=== Snapshot limit on refcount_bits=1 ===' echo -IMGOPTS="$IMGOPTS,refcount_bits=1" _make_test_img 64M +_make_test_img -o "refcount_bits=1" 64M print_refcount_bits $QEMU_IO -c 'write 0 512' "$TEST_IMG" | _filter_qemu_io @@ -XXX,XX +XXX,XX @@ echo echo '=== Snapshot limit on refcount_bits=2 ===' echo -IMGOPTS="$IMGOPTS,refcount_bits=2" _make_test_img 64M +_make_test_img -o "refcount_bits=2" 64M print_refcount_bits $QEMU_IO -c 'write 0 512' "$TEST_IMG" | _filter_qemu_io @@ -XXX,XX +XXX,XX @@ echo echo '=== Compressed clusters with refcount_bits=1 ===' echo -IMGOPTS="$IMGOPTS,refcount_bits=1" _make_test_img 64M +_make_test_img -o "refcount_bits=1" 64M print_refcount_bits # Both should fit into a single host cluster; instead of failing to increase the @@ -XXX,XX +XXX,XX @@ echo echo '=== MSb set in 64 bit refcount ===' echo -IMGOPTS="$IMGOPTS,refcount_bits=64" _make_test_img 64M +_make_test_img -o "refcount_bits=64" 64M print_refcount_bits $QEMU_IO -c 'write 0 512' "$TEST_IMG" | _filter_qemu_io @@ -XXX,XX +XXX,XX @@ echo echo '=== Snapshot on maximum 64 bit refcount value ===' echo -IMGOPTS="$IMGOPTS,refcount_bits=64" _make_test_img 64M +_make_test_img -o "refcount_bits=64" 64M print_refcount_bits $QEMU_IO -c 'write 0 512' "$TEST_IMG" | _filter_qemu_io @@ -XXX,XX +XXX,XX @@ echo echo '=== Testing too many references for check ===' echo -IMGOPTS="$IMGOPTS,refcount_bits=1" _make_test_img 64M +_make_test_img -o "refcount_bits=1" 64M print_refcount_bits # This cluster should be created at 0x50000 @@ -XXX,XX +XXX,XX @@ echo echo '=== Multiple walks necessary during amend ===' echo -IMGOPTS="$IMGOPTS,refcount_bits=1,cluster_size=512" _make_test_img 64k +_make_test_img -o "refcount_bits=1,cluster_size=512" 64k # Cluster 0 is the image header, clusters 1 to 4 are used by the L1 table, a # single L2 table, the reftable and a single refblock. This creates 58 data diff --git a/tests/qemu-iotests/115 b/tests/qemu-iotests/115 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/115 +++ b/tests/qemu-iotests/115 @@ -XXX,XX +XXX,XX @@ echo # least 256 MB. We can achieve that by using preallocation=metadata for an image # which has a guest disk size of 256 MB. -IMGOPTS="$IMGOPTS,refcount_bits=64,cluster_size=512,preallocation=metadata" \ - _make_test_img 256M +_make_test_img -o "refcount_bits=64,cluster_size=512,preallocation=metadata" 256M # We know for sure that the L1 and refcount tables do not overlap with any other # structure because the metadata overlap checks would have caught that case. diff --git a/tests/qemu-iotests/121 b/tests/qemu-iotests/121 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/121 +++ b/tests/qemu-iotests/121 @@ -XXX,XX +XXX,XX @@ echo # Preallocation speeds up the write operation, but preallocating everything will # destroy the purpose of the write; so preallocate one KB less than what would # cause a reftable growth... -IMGOPTS='preallocation=metadata,cluster_size=1k' _make_test_img 64512K +_make_test_img -o 'preallocation=metadata,cluster_size=1k' 64512K # ...and make the image the desired size afterwards. $QEMU_IMG resize "$TEST_IMG" 65M @@ -XXX,XX +XXX,XX @@ echo echo '--- Test 2 ---' echo -IMGOPTS='preallocation=metadata,cluster_size=1k' _make_test_img 64513K +_make_test_img -o 'preallocation=metadata,cluster_size=1k' 64513K # This results in an L1 table growth which in turn results in some clusters at # the start of the image becoming free $QEMU_IMG resize "$TEST_IMG" 65M @@ -XXX,XX +XXX,XX @@ echo echo '=== Allocating a new refcount block must not leave holes in the image ===' echo -IMGOPTS='cluster_size=512,refcount_bits=16' _make_test_img 1M +_make_test_img -o 'cluster_size=512,refcount_bits=16' 1M # This results in an image with 256 used clusters: the qcow2 header, # the refcount table, one refcount block, the L1 table, four L2 tables diff --git a/tests/qemu-iotests/125 b/tests/qemu-iotests/125 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/125 +++ b/tests/qemu-iotests/125 @@ -XXX,XX +XXX,XX @@ for GROWTH_SIZE in 16 48 80; do for growth_mode in off metadata falloc full; do echo "--- cluster_size=$cluster_size growth_size=$GROWTH_SIZE create_mode=$create_mode growth_mode=$growth_mode ---" - IMGOPTS="preallocation=$create_mode,cluster_size=$cluster_size" _make_test_img ${CREATION_SIZE} + _make_test_img -o "preallocation=$create_mode,cluster_size=$cluster_size" ${CREATION_SIZE} $QEMU_IMG resize -f "$IMGFMT" --preallocation=$growth_mode "$TEST_IMG" +${GROWTH_SIZE}K host_size_0=$(get_image_size_on_host) diff --git a/tests/qemu-iotests/137 b/tests/qemu-iotests/137 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/137 +++ b/tests/qemu-iotests/137 @@ -XXX,XX +XXX,XX @@ $QEMU_IO \ -c "reopen -o cache-clean-interval=-1" \ "$TEST_IMG" | _filter_qemu_io -IMGOPTS="cluster_size=256k" _make_test_img 32P +_make_test_img -o "cluster_size=256k" 32P $QEMU_IO \ -c "reopen -o l2-cache-entry-size=512,l2-cache-size=1T" \ "$TEST_IMG" | _filter_qemu_io diff --git a/tests/qemu-iotests/138 b/tests/qemu-iotests/138 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/138 +++ b/tests/qemu-iotests/138 @@ -XXX,XX +XXX,XX @@ echo echo '=== Check on an image with a multiple of 2^32 clusters ===' echo -IMGOPTS=$(_optstr_add "$IMGOPTS" "cluster_size=512") \ - _make_test_img 512 +_make_test_img -o "cluster_size=512" 512 # Allocate L2 table $QEMU_IO -c 'write 0 512' "$TEST_IMG" | _filter_qemu_io diff --git a/tests/qemu-iotests/175 b/tests/qemu-iotests/175 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/175 +++ b/tests/qemu-iotests/175 @@ -XXX,XX +XXX,XX @@ stat -c "size=%s, blocks=%b" $TEST_IMG | _filter_blocks $extra_blocks $min_block for mode in off full falloc; do echo echo "== creating image with preallocation $mode ==" - IMGOPTS=preallocation=$mode _make_test_img $size | _filter_imgfmt + _make_test_img -o preallocation=$mode $size | _filter_imgfmt stat -c "size=%s, blocks=%b" $TEST_IMG | _filter_blocks $extra_blocks $min_blocks $size done diff --git a/tests/qemu-iotests/190 b/tests/qemu-iotests/190 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/190 +++ b/tests/qemu-iotests/190 @@ -XXX,XX +XXX,XX @@ _supported_proto file echo "== Huge file ==" echo -IMGOPTS='cluster_size=2M' _make_test_img 2T +_make_test_img -o 'cluster_size=2M' 2T $QEMU_IMG measure -O raw -f qcow2 "$TEST_IMG" $QEMU_IMG measure -O qcow2 -o cluster_size=64k -f qcow2 "$TEST_IMG" diff --git a/tests/qemu-iotests/191 b/tests/qemu-iotests/191 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/191 +++ b/tests/qemu-iotests/191 @@ -XXX,XX +XXX,XX @@ echo === Preparing and starting VM === echo TEST_IMG="${TEST_IMG}.base" _make_test_img $size -IMGOPTS=$(_optstr_add "$IMGOPTS" "backing_fmt=$IMGFMT") \ - TEST_IMG="${TEST_IMG}.mid" _make_test_img -b "${TEST_IMG}.base" +TEST_IMG="${TEST_IMG}.mid" _make_test_img -o "backing_fmt=$IMGFMT" -b "${TEST_IMG}.base" _make_test_img -b "${TEST_IMG}.mid" TEST_IMG="${TEST_IMG}.ovl2" _make_test_img -b "${TEST_IMG}.mid" diff --git a/tests/qemu-iotests/220 b/tests/qemu-iotests/220 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/220 +++ b/tests/qemu-iotests/220 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 _supported_fmt qcow2 _supported_proto file _supported_os Linux +# To use a different refcount width but 16 bits we need compat=1.1 +_unsupported_imgopts 'compat=0.10' echo "== Creating huge file ==" @@ -XXX,XX +XXX,XX @@ echo "== Creating huge file ==" # of a HUGE (but very sparse) file. tmpfs works, ext4 does not. _require_large_file 513T -IMGOPTS='cluster_size=2M,refcount_bits=1' _make_test_img 513T +_make_test_img -o 'cluster_size=2M,refcount_bits=1' 513T echo "== Populating refcounts ==" # We want an image with 256M refcounts * 2M clusters = 512T referenced. diff --git a/tests/qemu-iotests/243 b/tests/qemu-iotests/243 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/243 +++ b/tests/qemu-iotests/243 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 _supported_fmt qcow2 _supported_proto file _supported_os Linux +# External data files do not work with compat=0.10 +_unsupported_imgopts 'compat=0.10' for mode in off metadata falloc full; do @@ -XXX,XX +XXX,XX @@ for mode in off metadata falloc full; do echo "=== preallocation=$mode ===" echo - IMGOPTS="preallocation=$mode" _make_test_img 64M + _make_test_img -o "preallocation=$mode" 64M printf "File size: " du -b $TEST_IMG | cut -f1 @@ -XXX,XX +XXX,XX @@ for mode in off metadata falloc full; do echo "=== External data file: preallocation=$mode ===" echo - IMGOPTS="data_file=$TEST_IMG.data,preallocation=$mode" _make_test_img 64M + _make_test_img -o "data_file=$TEST_IMG.data,preallocation=$mode" 64M echo -n "qcow2 file size: " du -b $TEST_IMG | cut -f1 diff --git a/tests/qemu-iotests/244 b/tests/qemu-iotests/244 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/244 +++ b/tests/qemu-iotests/244 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 _supported_fmt qcow2 _supported_proto file _supported_os Linux +# External data files do not work with compat=0.10 +_unsupported_imgopts 'compat=0.10' echo echo "=== Create and open image with external data file ===" echo echo "With data file name in the image:" -IMGOPTS="data_file=$TEST_IMG.data" _make_test_img 64M +_make_test_img -o "data_file=$TEST_IMG.data" 64M _check_test_img $QEMU_IO -c "open $TEST_IMG" -c "read -P 0 0 64k" 2>&1 | _filter_qemu_io | _filter_testdir @@ -XXX,XX +XXX,XX @@ echo echo "=== Standalone image with external data file (efficient) ===" echo -IMGOPTS="data_file=$TEST_IMG.data" _make_test_img 64M +_make_test_img -o "data_file=$TEST_IMG.data" 64M echo -n "qcow2 file size before I/O: " du -b $TEST_IMG | cut -f1 @@ -XXX,XX +XXX,XX @@ echo echo "=== Standalone image with external data file (valid raw) ===" echo -IMGOPTS="data_file=$TEST_IMG.data,data_file_raw=on" _make_test_img 64M +_make_test_img -o "data_file=$TEST_IMG.data,data_file_raw=on" 64M echo -n "qcow2 file size before I/O: " du -b $TEST_IMG | cut -f1 @@ -XXX,XX +XXX,XX @@ echo echo "=== bdrv_co_block_status test for file and offset=0 ===" echo -IMGOPTS="data_file=$TEST_IMG.data" _make_test_img 64M +_make_test_img -o "data_file=$TEST_IMG.data" 64M $QEMU_IO -c 'write -P 0x11 0 1M' -f $IMGFMT "$TEST_IMG" | _filter_qemu_io $QEMU_IO -c 'read -P 0x11 0 1M' -f $IMGFMT "$TEST_IMG" | _filter_qemu_io diff --git a/tests/qemu-iotests/250 b/tests/qemu-iotests/250 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/250 +++ b/tests/qemu-iotests/250 @@ -XXX,XX +XXX,XX @@ disk_usage() } size=2100M -IMGOPTS="cluster_size=1M,preallocation=metadata" -_make_test_img $size +_make_test_img -o "cluster_size=1M,preallocation=metadata" $size $QEMU_IO -c 'discard 0 10M' -c 'discard 2090M 10M' \ -c 'write 2090M 10M' -c 'write 0 10M' "$TEST_IMG" | _filter_qemu_io diff --git a/tests/qemu-iotests/265 b/tests/qemu-iotests/265 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/265 +++ b/tests/qemu-iotests/265 @@ -XXX,XX +XXX,XX @@ _supported_os Linux echo '--- Writing to the image ---' # Reduce cluster size so we get more and quicker I/O -IMGOPTS='cluster_size=4096' _make_test_img 1M +_make_test_img -o 'cluster_size=4096' 1M (for ((kb = 1024 - 4; kb >= 0; kb -= 4)); do \ echo "aio_write -P 42 $((kb + 1))k 2k"; \ done) \ -- 2.24.1 Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com> Message-id: 20191107163708.833192-13-mreitz@redhat.com Signed-off-by: Max Reitz <mreitz@redhat.com> --- tests/qemu-iotests/071 | 4 ++-- tests/qemu-iotests/174 | 2 +- tests/qemu-iotests/178 | 4 ++-- tests/qemu-iotests/197 | 4 ++-- tests/qemu-iotests/215 | 4 ++-- 5 files changed, 9 insertions(+), 9 deletions(-) diff --git a/tests/qemu-iotests/071 b/tests/qemu-iotests/071 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/071 +++ b/tests/qemu-iotests/071 @@ -XXX,XX +XXX,XX @@ echo echo "=== Testing blkverify through filename ===" echo -TEST_IMG="$TEST_IMG.base" IMGOPTS="" IMGFMT="raw" _make_test_img $IMG_SIZE |\ +TEST_IMG="$TEST_IMG.base" IMGFMT="raw" _make_test_img --no-opts $IMG_SIZE |\ _filter_imgfmt _make_test_img $IMG_SIZE $QEMU_IO -c "open -o driver=raw,file.driver=blkverify,file.raw.filename=$TEST_IMG.base $TEST_IMG" \ @@ -XXX,XX +XXX,XX @@ echo echo "=== Testing blkverify through file blockref ===" echo -TEST_IMG="$TEST_IMG.base" IMGOPTS="" IMGFMT="raw" _make_test_img $IMG_SIZE |\ +TEST_IMG="$TEST_IMG.base" IMGFMT="raw" _make_test_img --no-opts $IMG_SIZE |\ _filter_imgfmt _make_test_img $IMG_SIZE $QEMU_IO -c "open -o driver=raw,file.driver=blkverify,file.raw.filename=$TEST_IMG.base,file.test.driver=$IMGFMT,file.test.file.filename=$TEST_IMG" \ diff --git a/tests/qemu-iotests/174 b/tests/qemu-iotests/174 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/174 +++ b/tests/qemu-iotests/174 @@ -XXX,XX +XXX,XX @@ _unsupported_fmt raw size=256K -IMGFMT=raw IMGKEYSECRET= IMGOPTS= _make_test_img $size | _filter_imgfmt +IMGFMT=raw IMGKEYSECRET= _make_test_img --no-opts $size | _filter_imgfmt echo echo "== reading wrong format should fail ==" diff --git a/tests/qemu-iotests/178 b/tests/qemu-iotests/178 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/178 +++ b/tests/qemu-iotests/178 @@ -XXX,XX +XXX,XX @@ $QEMU_IMG measure -O foo "$TEST_IMG" # unknown image file format make_test_img_with_fmt() { # Shadow global variables within this function - local IMGFMT="$1" IMGOPTS="" - _make_test_img "$2" + local IMGFMT="$1" + _make_test_img --no-opts "$2" } qemu_io_with_fmt() { diff --git a/tests/qemu-iotests/197 b/tests/qemu-iotests/197 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/197 +++ b/tests/qemu-iotests/197 @@ -XXX,XX +XXX,XX @@ if [ "$IMGFMT" = "vpc" ]; then fi _make_test_img 4G $QEMU_IO -c "write -P 55 3G 1k" "$TEST_IMG" | _filter_qemu_io -IMGPROTO=file IMGFMT=qcow2 IMGOPTS= TEST_IMG_FILE="$TEST_WRAP" \ - _make_test_img -F "$IMGFMT" -b "$TEST_IMG" | _filter_img_create +IMGPROTO=file IMGFMT=qcow2 TEST_IMG_FILE="$TEST_WRAP" \ + _make_test_img --no-opts -F "$IMGFMT" -b "$TEST_IMG" | _filter_img_create $QEMU_IO -f qcow2 -c "write -z -u 1M 64k" "$TEST_WRAP" | _filter_qemu_io # Ensure that a read of two clusters, but where one is already allocated, diff --git a/tests/qemu-iotests/215 b/tests/qemu-iotests/215 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/215 +++ b/tests/qemu-iotests/215 @@ -XXX,XX +XXX,XX @@ if [ "$IMGFMT" = "vpc" ]; then fi _make_test_img 4G $QEMU_IO -c "write -P 55 3G 1k" "$TEST_IMG" | _filter_qemu_io -IMGPROTO=file IMGFMT=qcow2 IMGOPTS= TEST_IMG_FILE="$TEST_WRAP" \ - _make_test_img -F "$IMGFMT" -b "$TEST_IMG" | _filter_img_create +IMGPROTO=file IMGFMT=qcow2 TEST_IMG_FILE="$TEST_WRAP" \ + _make_test_img --no-opts -F "$IMGFMT" -b "$TEST_IMG" | _filter_img_create $QEMU_IO -f qcow2 -c "write -z -u 1M 64k" "$TEST_WRAP" | _filter_qemu_io # Ensure that a read of two clusters, but where one is already allocated, -- 2.24.1 Overwriting IMGOPTS means ignoring all user-supplied options, which is not what we want. Replace the current IMGOPTS use by a new BACKING_FILE variable. Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com> Message-id: 20191107163708.833192-14-mreitz@redhat.com Signed-off-by: Max Reitz <mreitz@redhat.com> --- tests/qemu-iotests/267 | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/tests/qemu-iotests/267 b/tests/qemu-iotests/267 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/267 +++ b/tests/qemu-iotests/267 @@ -XXX,XX +XXX,XX @@ size=128M run_test() { - _make_test_img $size + if [ -n "$BACKING_FILE" ]; then + _make_test_img -b "$BACKING_FILE" $size + else + _make_test_img $size + fi printf "savevm snap0\ninfo snapshots\nloadvm snap0\n" | run_qemu "$@" | _filter_date } @@ -XXX,XX +XXX,XX @@ echo TEST_IMG="$TEST_IMG.base" _make_test_img $size -IMGOPTS="backing_file=$TEST_IMG.base" \ +BACKING_FILE="$TEST_IMG.base" \ run_test -blockdev driver=file,filename="$TEST_IMG.base",node-name=backing-file \ -blockdev driver=file,filename="$TEST_IMG",node-name=file \ -blockdev driver=$IMGFMT,file=file,backing=backing-file,node-name=fmt -IMGOPTS="backing_file=$TEST_IMG.base" \ +BACKING_FILE="$TEST_IMG.base" \ run_test -blockdev driver=file,filename="$TEST_IMG.base",node-name=backing-file \ -blockdev driver=$IMGFMT,file=backing-file,node-name=backing-fmt \ -blockdev driver=file,filename="$TEST_IMG",node-name=file \ @@ -XXX,XX +XXX,XX @@ echo echo "=== -blockdev with NBD server on the backing file ===" echo -IMGOPTS="backing_file=$TEST_IMG.base" _make_test_img $size +_make_test_img -b "$TEST_IMG.base" $size cat <<EOF | nbd_server_start unix:$SOCK_DIR/nbd nbd_server_add -w backing-fmt -- 2.24.1 Use _make_test_img whenever possible. This way, we will not ignore user-specified image options. Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com> Message-id: 20191107163708.833192-15-mreitz@redhat.com Signed-off-by: Max Reitz <mreitz@redhat.com> --- tests/qemu-iotests/094 | 2 +- tests/qemu-iotests/111 | 3 +-- tests/qemu-iotests/123 | 2 +- tests/qemu-iotests/153 | 2 +- tests/qemu-iotests/200 | 4 ++-- 5 files changed, 6 insertions(+), 7 deletions(-) diff --git a/tests/qemu-iotests/094 b/tests/qemu-iotests/094 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/094 +++ b/tests/qemu-iotests/094 @@ -XXX,XX +XXX,XX @@ _supported_proto nbd _unsupported_imgopts "subformat=monolithicFlat" "subformat=twoGbMaxExtentFlat" _make_test_img 64M -$QEMU_IMG create -f $IMGFMT "$TEST_DIR/source.$IMGFMT" 64M | _filter_img_create +TEST_IMG_FILE="$TEST_DIR/source.$IMGFMT" IMGPROTO=file _make_test_img 64M _launch_qemu -drive if=none,id=src,file="$TEST_DIR/source.$IMGFMT",format=raw \ -nodefaults diff --git a/tests/qemu-iotests/111 b/tests/qemu-iotests/111 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/111 +++ b/tests/qemu-iotests/111 @@ -XXX,XX +XXX,XX @@ _supported_fmt qed qcow qcow2 vmdk _supported_proto file _unsupported_imgopts "subformat=monolithicFlat" "subformat=twoGbMaxExtentFlat" -$QEMU_IMG create -f $IMGFMT -b "$TEST_IMG.inexistent" "$TEST_IMG" 2>&1 \ - | _filter_testdir | _filter_imgfmt +_make_test_img -b "$TEST_IMG.inexistent" # success, all done echo '*** done' diff --git a/tests/qemu-iotests/123 b/tests/qemu-iotests/123 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/123 +++ b/tests/qemu-iotests/123 @@ -XXX,XX +XXX,XX @@ _supported_os Linux SRC_IMG="$TEST_DIR/source.$IMGFMT" _make_test_img 1M -$QEMU_IMG create -f $IMGFMT "$SRC_IMG" 1M | _filter_img_create +TEST_IMG_FILE=$SRC_IMG IMGPROTO=file _make_test_img 1M $QEMU_IO -c 'write -P 42 0 1M' "$SRC_IMG" | _filter_qemu_io diff --git a/tests/qemu-iotests/153 b/tests/qemu-iotests/153 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/153 +++ b/tests/qemu-iotests/153 @@ -XXX,XX +XXX,XX @@ for opts1 in "" "read-only=on" "read-only=on,force-share=on"; do echo echo "== Creating test image ==" - $QEMU_IMG create -f $IMGFMT "${TEST_IMG}" -b ${TEST_IMG}.base | _filter_img_create + _make_test_img -b "${TEST_IMG}.base" echo echo "== Launching QEMU, opts: '$opts1' ==" diff --git a/tests/qemu-iotests/200 b/tests/qemu-iotests/200 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/200 +++ b/tests/qemu-iotests/200 @@ -XXX,XX +XXX,XX @@ _supported_proto file BACKING_IMG="${TEST_DIR}/backing.img" TEST_IMG="${TEST_DIR}/test.img" -${QEMU_IMG} create -f $IMGFMT "${BACKING_IMG}" 512M | _filter_img_create -${QEMU_IMG} create -f $IMGFMT -F $IMGFMT "${TEST_IMG}" -b "${BACKING_IMG}" 512M | _filter_img_create +TEST_IMG="$BACKING_IMG" _make_test_img 512M +_make_test_img -F $IMGFMT -b "$BACKING_IMG" 512M ${QEMU_IO} -c "write -P 0xa5 512 300M" "${BACKING_IMG}" | _filter_qemu_io -- 2.24.1 Just rm will not delete external data files. Use _rm_test_img every time we delete a test image. (In the process, clean up the indentation of every _cleanup() this patch touches.) ((Also, use quotes consistently. I am happy to see unquoted instances like "rm -rf $TEST_DIR/..." go.)) Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com> Message-id: 20191107163708.833192-16-mreitz@redhat.com Signed-off-by: Max Reitz <mreitz@redhat.com> --- tests/qemu-iotests/019 | 6 +++--- tests/qemu-iotests/020 | 6 +++--- tests/qemu-iotests/024 | 10 +++++----- tests/qemu-iotests/028 | 2 +- tests/qemu-iotests/029 | 2 +- tests/qemu-iotests/043 | 4 +++- tests/qemu-iotests/048 | 2 +- tests/qemu-iotests/050 | 4 ++-- tests/qemu-iotests/053 | 4 ++-- tests/qemu-iotests/058 | 2 +- tests/qemu-iotests/059 | 2 +- tests/qemu-iotests/061 | 2 +- tests/qemu-iotests/063 | 6 ++++-- tests/qemu-iotests/069 | 2 +- tests/qemu-iotests/074 | 2 +- tests/qemu-iotests/080 | 2 +- tests/qemu-iotests/081 | 6 +++--- tests/qemu-iotests/085 | 9 ++++++--- tests/qemu-iotests/088 | 2 +- tests/qemu-iotests/092 | 2 +- tests/qemu-iotests/094 | 2 +- tests/qemu-iotests/095 | 5 +++-- tests/qemu-iotests/099 | 7 ++++--- tests/qemu-iotests/109 | 4 ++-- tests/qemu-iotests/110 | 4 ++-- tests/qemu-iotests/122 | 6 ++++-- tests/qemu-iotests/123 | 2 +- tests/qemu-iotests/141 | 4 +++- tests/qemu-iotests/142 | 2 +- tests/qemu-iotests/144 | 4 +++- tests/qemu-iotests/153 | 10 +++------- tests/qemu-iotests/156 | 8 ++++++-- tests/qemu-iotests/159 | 2 +- tests/qemu-iotests/160 | 3 ++- tests/qemu-iotests/161 | 4 ++-- tests/qemu-iotests/170 | 2 +- tests/qemu-iotests/172 | 6 +++--- tests/qemu-iotests/173 | 3 ++- tests/qemu-iotests/178 | 2 +- tests/qemu-iotests/182 | 2 +- tests/qemu-iotests/183 | 2 +- tests/qemu-iotests/185 | 4 ++-- tests/qemu-iotests/187 | 6 +++--- tests/qemu-iotests/190 | 2 +- tests/qemu-iotests/191 | 6 +++--- tests/qemu-iotests/195 | 2 +- tests/qemu-iotests/197 | 2 +- tests/qemu-iotests/200 | 3 ++- tests/qemu-iotests/215 | 2 +- tests/qemu-iotests/225 | 2 +- tests/qemu-iotests/229 | 3 ++- tests/qemu-iotests/232 | 4 +++- tests/qemu-iotests/243 | 2 +- tests/qemu-iotests/244 | 4 ++-- tests/qemu-iotests/247 | 4 +++- tests/qemu-iotests/249 | 4 ++-- tests/qemu-iotests/252 | 2 +- 57 files changed, 118 insertions(+), 95 deletions(-) diff --git a/tests/qemu-iotests/019 b/tests/qemu-iotests/019 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/019 +++ b/tests/qemu-iotests/019 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { - _cleanup_test_img - rm -f "$TEST_IMG.base" - rm -f "$TEST_IMG.orig" + _cleanup_test_img + _rm_test_img "$TEST_IMG.base" + _rm_test_img "$TEST_IMG.orig" } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/020 b/tests/qemu-iotests/020 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/020 +++ b/tests/qemu-iotests/020 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { - _cleanup_test_img - rm -f "$TEST_IMG.base" - rm -f "$TEST_IMG.orig" + _cleanup_test_img + _rm_test_img "$TEST_IMG.base" + _rm_test_img "$TEST_IMG.orig" } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/024 b/tests/qemu-iotests/024 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/024 +++ b/tests/qemu-iotests/024 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { _cleanup_test_img - rm -f "$TEST_DIR/t.$IMGFMT.base_old" - rm -f "$TEST_DIR/t.$IMGFMT.base_new" + _rm_test_img "$TEST_DIR/t.$IMGFMT.base_old" + _rm_test_img "$TEST_DIR/t.$IMGFMT.base_new" - rm -f "$TEST_DIR/subdir/t.$IMGFMT" - rm -f "$TEST_DIR/subdir/t.$IMGFMT.base_old" - rm -f "$TEST_DIR/subdir/t.$IMGFMT.base_new" + _rm_test_img "$TEST_DIR/subdir/t.$IMGFMT" + _rm_test_img "$TEST_DIR/subdir/t.$IMGFMT.base_old" + _rm_test_img "$TEST_DIR/subdir/t.$IMGFMT.base_new" rmdir "$TEST_DIR/subdir" 2> /dev/null } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/028 b/tests/qemu-iotests/028 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/028 +++ b/tests/qemu-iotests/028 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { _cleanup_qemu - rm -f "${TEST_IMG}.copy" + _rm_test_img "${TEST_IMG}.copy" _cleanup_test_img } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/029 b/tests/qemu-iotests/029 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/029 +++ b/tests/qemu-iotests/029 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { - rm -f $TEST_IMG.snap + _rm_test_img "$TEST_IMG.snap" _cleanup_test_img } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/043 b/tests/qemu-iotests/043 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/043 +++ b/tests/qemu-iotests/043 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { _cleanup_test_img - rm -f "$TEST_IMG".[123].base + for img in "$TEST_IMG".[123].base; do + _rm_test_img "$img" + done } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/048 b/tests/qemu-iotests/048 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/048 +++ b/tests/qemu-iotests/048 @@ -XXX,XX +XXX,XX @@ _cleanup() { echo "Cleanup" _cleanup_test_img - rm "${TEST_IMG_FILE2}" + _rm_test_img "${TEST_IMG_FILE2}" } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/050 b/tests/qemu-iotests/050 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/050 +++ b/tests/qemu-iotests/050 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { _cleanup_test_img - rm -f "$TEST_IMG.old" - rm -f "$TEST_IMG.new" + _rm_test_img "$TEST_IMG.old" + _rm_test_img "$TEST_IMG.new" } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/053 b/tests/qemu-iotests/053 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/053 +++ b/tests/qemu-iotests/053 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { - rm -f "$TEST_IMG.orig" - _cleanup_test_img + _rm_test_img "$TEST_IMG.orig" + _cleanup_test_img } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/058 b/tests/qemu-iotests/058 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/058 +++ b/tests/qemu-iotests/058 @@ -XXX,XX +XXX,XX @@ _cleanup() { nbd_server_stop _cleanup_test_img - rm -f "$converted_image" + _rm_test_img "$converted_image" } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/059 b/tests/qemu-iotests/059 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/059 +++ b/tests/qemu-iotests/059 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { _cleanup_test_img - rm -f "$TEST_IMG.qcow2" + IMGFMT=qcow2 _rm_test_img "$TEST_IMG.qcow2" } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/061 b/tests/qemu-iotests/061 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/061 +++ b/tests/qemu-iotests/061 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { _cleanup_test_img - rm -f $TEST_IMG.data + _rm_test_img "$TEST_IMG.data" } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/063 b/tests/qemu-iotests/063 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/063 +++ b/tests/qemu-iotests/063 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { - _cleanup_test_img - rm -f "$TEST_IMG.orig" "$TEST_IMG.raw1" "$TEST_IMG.raw2" + _cleanup_test_img + for img in "$TEST_IMG".{orig,raw1,raw2,target}; do + _rm_test_img "$img" + done } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/069 b/tests/qemu-iotests/069 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/069 +++ b/tests/qemu-iotests/069 @@ -XXX,XX +XXX,XX @@ echo "=== Creating an image with a backing file and deleting that file ===" echo TEST_IMG="$TEST_IMG.base" _make_test_img $IMG_SIZE _make_test_img -b "$TEST_IMG.base" $IMG_SIZE -rm -f "$TEST_IMG.base" +_rm_test_img "$TEST_IMG.base" # Just open the image and close it right again (this should print an error message) $QEMU_IO -c quit "$TEST_IMG" 2>&1 | _filter_testdir | _filter_imgfmt diff --git a/tests/qemu-iotests/074 b/tests/qemu-iotests/074 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/074 +++ b/tests/qemu-iotests/074 @@ -XXX,XX +XXX,XX @@ _cleanup() { echo "Cleanup" _cleanup_test_img - rm "${TEST_IMG2}" + _rm_test_img "${TEST_IMG2}" rm -f "$TEST_DIR/blkdebug.conf" } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/080 b/tests/qemu-iotests/080 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/080 +++ b/tests/qemu-iotests/080 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { - rm -f $TEST_IMG.snap + _rm_test_img "$TEST_IMG.snap" _cleanup_test_img } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/081 b/tests/qemu-iotests/081 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/081 +++ b/tests/qemu-iotests/081 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { - rm -rf $TEST_DIR/1.raw - rm -rf $TEST_DIR/2.raw - rm -rf $TEST_DIR/3.raw + _rm_test_img "$TEST_DIR/1.raw" + _rm_test_img "$TEST_DIR/2.raw" + _rm_test_img "$TEST_DIR/3.raw" } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/085 b/tests/qemu-iotests/085 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/085 +++ b/tests/qemu-iotests/085 @@ -XXX,XX +XXX,XX @@ _cleanup() _cleanup_qemu for i in $(seq 1 ${SNAPSHOTS}) do - rm -f "${TEST_DIR}/${i}-${snapshot_virt0}" - rm -f "${TEST_DIR}/${i}-${snapshot_virt1}" + _rm_test_img "${TEST_DIR}/${i}-${snapshot_virt0}" + _rm_test_img "${TEST_DIR}/${i}-${snapshot_virt1}" + done + for img in "${TEST_IMG}".{1,2,base} + do + _rm_test_img "$img" done - rm -f "${TEST_IMG}" "${TEST_IMG}.1" "${TEST_IMG}.2" "${TEST_IMG}.base" } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/088 b/tests/qemu-iotests/088 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/088 +++ b/tests/qemu-iotests/088 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { - rm -f $TEST_IMG.snap + _rm_test_img "$TEST_IMG.snap" _cleanup_test_img } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/092 b/tests/qemu-iotests/092 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/092 +++ b/tests/qemu-iotests/092 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { - rm -f $TEST_IMG.snap + _rm_test_img "$TEST_IMG.snap" _cleanup_test_img } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/094 b/tests/qemu-iotests/094 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/094 +++ b/tests/qemu-iotests/094 @@ -XXX,XX +XXX,XX @@ _cleanup() { _cleanup_qemu _cleanup_test_img - rm -f "$TEST_DIR/source.$IMGFMT" + _rm_test_img "$TEST_DIR/source.$IMGFMT" } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/095 b/tests/qemu-iotests/095 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/095 +++ b/tests/qemu-iotests/095 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { _cleanup_qemu - rm -f "${TEST_IMG}.base" "${TEST_IMG}.snp1" - _cleanup_test_img + _rm_test_img "${TEST_IMG}.base" + _rm_test_img "${TEST_IMG}.snp1" + _cleanup_test_img } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/099 b/tests/qemu-iotests/099 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/099 +++ b/tests/qemu-iotests/099 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { - _cleanup_test_img + _cleanup_test_img + _rm_test_img "$TEST_IMG.compare" + rm -f "$TEST_DIR/blkdebug.conf" + } trap "_cleanup; exit \$status" 0 1 2 3 15 @@ -XXX,XX +XXX,XX @@ echo test_qemu "file.driver=blkdebug,file.image.filename=$TEST_IMG" -rm -f "$TEST_IMG.compare" "$TEST_DIR/blkdebug.conf" - # success, all done echo "*** done" rm -f $seq.full diff --git a/tests/qemu-iotests/109 b/tests/qemu-iotests/109 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/109 +++ b/tests/qemu-iotests/109 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { _cleanup_qemu - rm -f $TEST_IMG.src - _cleanup_test_img + _rm_test_img "$TEST_IMG.src" + _cleanup_test_img } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/110 b/tests/qemu-iotests/110 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/110 +++ b/tests/qemu-iotests/110 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { - _cleanup_test_img - rm -f "$TEST_IMG.copy" + _cleanup_test_img + _rm_test_img "$TEST_IMG.copy" } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/122 b/tests/qemu-iotests/122 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/122 +++ b/tests/qemu-iotests/122 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { - rm -f "$TEST_IMG".[123] - _cleanup_test_img + for img in "$TEST_IMG".[123]; do + _rm_test_img "$img" + done + _cleanup_test_img } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/123 b/tests/qemu-iotests/123 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/123 +++ b/tests/qemu-iotests/123 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { _cleanup_test_img - rm -f "$SRC_IMG" + _rm_test_img "$SRC_IMG" } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/141 b/tests/qemu-iotests/141 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/141 +++ b/tests/qemu-iotests/141 @@ -XXX,XX +XXX,XX @@ _cleanup() { _cleanup_qemu _cleanup_test_img - rm -f "$TEST_DIR"/{b,m,o}.$IMGFMT + for img in "$TEST_DIR"/{b,m,o}.$IMGFMT; do + _rm_test_img "$img" + done } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/142 b/tests/qemu-iotests/142 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/142 +++ b/tests/qemu-iotests/142 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { _cleanup_test_img - rm -f $TEST_IMG.snap + _rm_test_img "$TEST_IMG.snap" } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/144 b/tests/qemu-iotests/144 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/144 +++ b/tests/qemu-iotests/144 @@ -XXX,XX +XXX,XX @@ TMP_SNAP2=${TEST_DIR}/tmp2.qcow2 _cleanup() { _cleanup_qemu - rm -f "${TEST_IMG}" "${TMP_SNAP1}" "${TMP_SNAP2}" + for img in "${TEST_IMG}" "${TMP_SNAP1}" "${TMP_SNAP2}"; do + _rm_test_img "$img" + done } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/153 b/tests/qemu-iotests/153 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/153 +++ b/tests/qemu-iotests/153 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { _cleanup_test_img - rm -f "${TEST_IMG}.base" - rm -f "${TEST_IMG}.overlay" - rm -f "${TEST_IMG}.convert" - rm -f "${TEST_IMG}.a" - rm -f "${TEST_IMG}.b" - rm -f "${TEST_IMG}.c" - rm -f "${TEST_IMG}.lnk" + for img in "${TEST_IMG}".{base,overlay,convert,a,b,c,lnk}; do + _rm_test_img "$img" + done } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/156 b/tests/qemu-iotests/156 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/156 +++ b/tests/qemu-iotests/156 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { _cleanup_qemu - rm -f "$TEST_IMG"{,.target}{,.backing,.overlay} + for img in "$TEST_IMG"{,.target}{,.backing,.overlay}; do + _rm_test_img "$img" + done } trap "_cleanup; exit \$status" 0 1 2 3 15 @@ -XXX,XX +XXX,XX @@ _send_qemu_cmd $QEMU_HANDLE \ '"status": "null"' # Remove the source images -rm -f "$TEST_IMG{,.backing,.overlay}" +for img in "$TEST_IMG{,.backing,.overlay}"; do + _rm_test_img "$img" +done echo diff --git a/tests/qemu-iotests/159 b/tests/qemu-iotests/159 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/159 +++ b/tests/qemu-iotests/159 @@ -XXX,XX +XXX,XX @@ status=1 _cleanup() { _cleanup_test_img - rm -f "$TEST_IMG.out" + _rm_test_img "$TEST_IMG.out" } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/160 b/tests/qemu-iotests/160 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/160 +++ b/tests/qemu-iotests/160 @@ -XXX,XX +XXX,XX @@ status=1 _cleanup() { _cleanup_test_img - rm -f "$TEST_IMG.out" "$TEST_IMG.out.dd" + _rm_test_img "$TEST_IMG.out" + _rm_test_img "$TEST_IMG.out.dd" } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/161 b/tests/qemu-iotests/161 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/161 +++ b/tests/qemu-iotests/161 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { _cleanup_test_img - rm -f "$TEST_IMG.base" - rm -f "$TEST_IMG.int" + _rm_test_img "$TEST_IMG.base" + _rm_test_img "$TEST_IMG.int" } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/170 b/tests/qemu-iotests/170 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/170 +++ b/tests/qemu-iotests/170 @@ -XXX,XX +XXX,XX @@ status=1 _cleanup() { _cleanup_test_img - rm -f "$TEST_IMG.out" + _rm_test_img "$TEST_IMG.out" } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/172 b/tests/qemu-iotests/172 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/172 +++ b/tests/qemu-iotests/172 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { - _cleanup_test_img - rm -f "$TEST_IMG.2" - rm -f "$TEST_IMG.3" + _cleanup_test_img + _rm_test_img "$TEST_IMG.2" + _rm_test_img "$TEST_IMG.3" } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/173 b/tests/qemu-iotests/173 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/173 +++ b/tests/qemu-iotests/173 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { _cleanup_qemu - rm -f "${QEMU_TEST_DIR}/image.base" "${QEMU_TEST_DIR}/image.snp1" + _rm_test_img "${TEST_DIR}/image.base" + _rm_test_img "${TEST_DIR}/image.snp1" _cleanup_test_img } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/178 b/tests/qemu-iotests/178 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/178 +++ b/tests/qemu-iotests/178 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { _cleanup_test_img - rm -f "$TEST_IMG.converted" + _rm_test_img "$TEST_IMG.converted" } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/182 b/tests/qemu-iotests/182 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/182 +++ b/tests/qemu-iotests/182 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { _cleanup_test_img - rm -f "$TEST_IMG.overlay" + _rm_test_img "$TEST_IMG.overlay" rm -f "$SOCK_DIR/nbd.socket" } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/183 b/tests/qemu-iotests/183 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/183 +++ b/tests/qemu-iotests/183 @@ -XXX,XX +XXX,XX @@ MIG_SOCKET="${SOCK_DIR}/migrate" _cleanup() { rm -f "${MIG_SOCKET}" - rm -f "${TEST_IMG}.dest" + _rm_test_img "${TEST_IMG}.dest" _cleanup_test_img _cleanup_qemu } diff --git a/tests/qemu-iotests/185 b/tests/qemu-iotests/185 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/185 +++ b/tests/qemu-iotests/185 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { - rm -f "${TEST_IMG}.mid" - rm -f "${TEST_IMG}.copy" + _rm_test_img "${TEST_IMG}.mid" + _rm_test_img "${TEST_IMG}.copy" _cleanup_test_img _cleanup_qemu } diff --git a/tests/qemu-iotests/187 b/tests/qemu-iotests/187 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/187 +++ b/tests/qemu-iotests/187 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { - _cleanup_test_img - rm -f "$TEST_IMG.2" - rm -f "$TEST_IMG.3" + _cleanup_test_img + _rm_test_img "$TEST_IMG.2" + _rm_test_img "$TEST_IMG.3" } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/190 b/tests/qemu-iotests/190 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/190 +++ b/tests/qemu-iotests/190 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { _cleanup_test_img - rm -f "$TEST_IMG.converted" + _rm_test_img "$TEST_IMG.converted" } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/191 b/tests/qemu-iotests/191 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/191 +++ b/tests/qemu-iotests/191 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { - rm -f "${TEST_IMG}.mid" - rm -f "${TEST_IMG}.ovl2" - rm -f "${TEST_IMG}.ovl3" + _rm_test_img "${TEST_IMG}.mid" + _rm_test_img "${TEST_IMG}.ovl2" + _rm_test_img "${TEST_IMG}.ovl3" _cleanup_test_img _cleanup_qemu } diff --git a/tests/qemu-iotests/195 b/tests/qemu-iotests/195 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/195 +++ b/tests/qemu-iotests/195 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { _cleanup_test_img - rm -f "$TEST_IMG.mid" + _rm_test_img "$TEST_IMG.mid" } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/197 b/tests/qemu-iotests/197 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/197 +++ b/tests/qemu-iotests/197 @@ -XXX,XX +XXX,XX @@ esac _cleanup() { _cleanup_test_img - rm -f "$TEST_WRAP" + _rm_test_img "$TEST_WRAP" rm -f "$BLKDBG_CONF" } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/200 b/tests/qemu-iotests/200 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/200 +++ b/tests/qemu-iotests/200 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { _cleanup_qemu - rm -f "${TEST_IMG}" "${BACKING_IMG}" + _rm_test_img "${TEST_IMG}" + _rm_test_img "${BACKING_IMG}" } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/215 b/tests/qemu-iotests/215 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/215 +++ b/tests/qemu-iotests/215 @@ -XXX,XX +XXX,XX @@ esac _cleanup() { _cleanup_test_img - rm -f "$TEST_WRAP" + _rm_test_img "$TEST_WRAP" rm -f "$BLKDBG_CONF" } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/225 b/tests/qemu-iotests/225 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/225 +++ b/tests/qemu-iotests/225 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { _cleanup_test_img - rm -f "$TEST_IMG.not_base" + _rm_test_img "$TEST_IMG.not_base" } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/229 b/tests/qemu-iotests/229 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/229 +++ b/tests/qemu-iotests/229 @@ -XXX,XX +XXX,XX @@ _cleanup() { _cleanup_qemu _cleanup_test_img - rm -f "$TEST_IMG" "$DEST_IMG" + _rm_test_img "$TEST_IMG" + _rm_test_img "$DEST_IMG" } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/232 b/tests/qemu-iotests/232 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/232 +++ b/tests/qemu-iotests/232 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { _cleanup_test_img - rm -f $TEST_IMG.[01234] + for img in "$TEST_IMG".[01234]; do + _rm_test_img "$img" + done } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/243 b/tests/qemu-iotests/243 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/243 +++ b/tests/qemu-iotests/243 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { _cleanup_test_img - rm -f $TEST_IMG.data + _rm_test_img "$TEST_IMG.data" } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/244 b/tests/qemu-iotests/244 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/244 +++ b/tests/qemu-iotests/244 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { _cleanup_test_img - rm -f $TEST_IMG.data - rm -f $TEST_IMG.src + _rm_test_img "$TEST_IMG.data" + _rm_test_img "$TEST_IMG.src" } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/247 b/tests/qemu-iotests/247 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/247 +++ b/tests/qemu-iotests/247 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { _cleanup_test_img - rm -f $TEST_IMG.[01234] + for img in "$TEST_IMG".[01234]; do + _rm_test_img "$img" + done } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/249 b/tests/qemu-iotests/249 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/249 +++ b/tests/qemu-iotests/249 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { _cleanup_test_img - rm -f "$TEST_IMG.base" - rm -f "$TEST_IMG.int" + _rm_test_img "$TEST_IMG.base" + _rm_test_img "$TEST_IMG.int" } trap "_cleanup; exit \$status" 0 1 2 3 15 diff --git a/tests/qemu-iotests/252 b/tests/qemu-iotests/252 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/252 +++ b/tests/qemu-iotests/252 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _cleanup() { _cleanup_test_img - rm -f "$TEST_IMG.base_new" + _rm_test_img "$TEST_IMG.base_new" } trap "_cleanup; exit \$status" 0 1 2 3 15 -- 2.24.1 This will not work with external data files, so try to get tests working without it as far as possible. Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com> Message-id: 20191107163708.833192-17-mreitz@redhat.com Signed-off-by: Max Reitz <mreitz@redhat.com> --- tests/qemu-iotests/063 | 12 ++++-------- tests/qemu-iotests/063.out | 3 ++- tests/qemu-iotests/085 | 9 +++------ tests/qemu-iotests/085.out | 8 ++++---- 4 files changed, 13 insertions(+), 19 deletions(-) diff --git a/tests/qemu-iotests/063 b/tests/qemu-iotests/063 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/063 +++ b/tests/qemu-iotests/063 @@ -XXX,XX +XXX,XX @@ _unsupported_imgopts "subformat=monolithicFlat" \ _make_test_img 4M echo "== Testing conversion with -n fails with no target file ==" -# check .orig file does not exist -rm -f "$TEST_IMG.orig" if $QEMU_IMG convert -f $IMGFMT -O $IMGFMT -n "$TEST_IMG" "$TEST_IMG.orig" >/dev/null 2>&1; then exit 1 fi echo "== Testing conversion with -n succeeds with a target file ==" -rm -f "$TEST_IMG.orig" -cp "$TEST_IMG" "$TEST_IMG.orig" +_rm_test_img "$TEST_IMG.orig" +TEST_IMG="$TEST_IMG.orig" _make_test_img 4M if ! $QEMU_IMG convert -f $IMGFMT -O $IMGFMT -n "$TEST_IMG" "$TEST_IMG.orig" ; then exit 1 fi @@ -XXX,XX +XXX,XX @@ fi _check_test_img echo "== Testing conversion to a smaller file fails ==" -rm -f "$TEST_IMG.orig" -mv "$TEST_IMG" "$TEST_IMG.orig" -_make_test_img 2M -if $QEMU_IMG convert -f $IMGFMT -O $IMGFMT -n "$TEST_IMG.orig" "$TEST_IMG" >/dev/null 2>&1; then +TEST_IMG="$TEST_IMG.target" _make_test_img 2M +if $QEMU_IMG convert -f $IMGFMT -O $IMGFMT -n "$TEST_IMG" "$TEST_IMG.target" >/dev/null 2>&1; then exit 1 fi diff --git a/tests/qemu-iotests/063.out b/tests/qemu-iotests/063.out index XXXXXXX..XXXXXXX 100644 --- a/tests/qemu-iotests/063.out +++ b/tests/qemu-iotests/063.out @@ -XXX,XX +XXX,XX @@ QA output created by 063 Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=4194304 == Testing conversion with -n fails with no target file == == Testing conversion with -n succeeds with a target file == +Formatting 'TEST_DIR/t.IMGFMT.orig', fmt=IMGFMT size=4194304 == Testing conversion to raw is the same after conversion with -n == == Testing conversion back to original format == No errors were found on the image. == Testing conversion to a smaller file fails == -Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=2097152 +Formatting 'TEST_DIR/t.IMGFMT.target', fmt=IMGFMT size=2097152 == Regression testing for copy offloading bug == Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1048576 Formatting 'TEST_DIR/t.IMGFMT.target', fmt=IMGFMT size=1048576 diff --git a/tests/qemu-iotests/085 b/tests/qemu-iotests/085 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/085 +++ b/tests/qemu-iotests/085 @@ -XXX,XX +XXX,XX @@ add_snapshot_image() { base_image="${TEST_DIR}/$((${1}-1))-${snapshot_virt0}" snapshot_file="${TEST_DIR}/${1}-${snapshot_virt0}" - _make_test_img -u -b "${base_image}" "$size" - mv "${TEST_IMG}" "${snapshot_file}" + TEST_IMG=$snapshot_file _make_test_img -u -b "${base_image}" "$size" do_blockdev_add "$1" "'backing': null, " "${snapshot_file}" } @@ -XXX,XX +XXX,XX @@ blockdev_snapshot() size=128M -_make_test_img $size -mv "${TEST_IMG}" "${TEST_IMG}.1" -_make_test_img $size -mv "${TEST_IMG}" "${TEST_IMG}.2" +TEST_IMG="$TEST_IMG.1" _make_test_img $size +TEST_IMG="$TEST_IMG.2" _make_test_img $size echo echo === Running QEMU === diff --git a/tests/qemu-iotests/085.out b/tests/qemu-iotests/085.out index XXXXXXX..XXXXXXX 100644 --- a/tests/qemu-iotests/085.out +++ b/tests/qemu-iotests/085.out @@ -XXX,XX +XXX,XX @@ QA output created by 085 -Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 -Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 +Formatting 'TEST_DIR/t.IMGFMT.1', fmt=IMGFMT size=134217728 +Formatting 'TEST_DIR/t.IMGFMT.2', fmt=IMGFMT size=134217728 === Running QEMU === @@ -XXX,XX +XXX,XX @@ Formatting 'TEST_DIR/10-snapshot-v1.qcow2', fmt=qcow2 size=134217728 backing_fil === Create a couple of snapshots using blockdev-snapshot === -Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/10-snapshot-v0.IMGFMT +Formatting 'TEST_DIR/11-snapshot-v0.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/10-snapshot-v0.IMGFMT { 'execute': 'blockdev-add', 'arguments': { 'driver': 'IMGFMT', 'node-name': 'snap_11', 'backing': null, 'file': { 'driver': 'file', 'filename': 'TEST_DIR/11-snapshot-v0.IMGFMT', 'node-name': 'file_11' } } } {"return": {}} { 'execute': 'blockdev-snapshot', 'arguments': { 'node': 'virtio0', 'overlay':'snap_11' } } {"return": {}} -Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/11-snapshot-v0.IMGFMT +Formatting 'TEST_DIR/12-snapshot-v0.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/11-snapshot-v0.IMGFMT { 'execute': 'blockdev-add', 'arguments': { 'driver': 'IMGFMT', 'node-name': 'snap_12', 'backing': null, 'file': { 'driver': 'file', 'filename': 'TEST_DIR/12-snapshot-v0.IMGFMT', 'node-name': 'file_12' } } } {"return": {}} { 'execute': 'blockdev-snapshot', 'arguments': { 'node': 'virtio0', 'overlay':'snap_12' } } -- 2.24.1 The image end offset as reported by qemu-img check is different when using an external data file; we do not care about its value here, so we can just filter it. Incidentally, common.rc already has _check_test_img for us which does exactly that. Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com> Message-id: 20191107163708.833192-18-mreitz@redhat.com Signed-off-by: Max Reitz <mreitz@redhat.com> --- tests/qemu-iotests/091 | 2 +- tests/qemu-iotests/091.out | 2 -- 2 files changed, 1 insertion(+), 3 deletions(-) diff --git a/tests/qemu-iotests/091 b/tests/qemu-iotests/091 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/091 +++ b/tests/qemu-iotests/091 @@ -XXX,XX +XXX,XX @@ echo "Check image pattern" ${QEMU_IO} -c "read -P 0x22 0 4M" "${TEST_IMG}" | _filter_testdir | _filter_qemu_io echo "Running 'qemu-img check -r all \$TEST_IMG'" -"${QEMU_IMG}" check -r all "${TEST_IMG}" 2>&1 | _filter_testdir | _filter_qemu +_check_test_img -r all echo "*** done" rm -f $seq.full diff --git a/tests/qemu-iotests/091.out b/tests/qemu-iotests/091.out index XXXXXXX..XXXXXXX 100644 --- a/tests/qemu-iotests/091.out +++ b/tests/qemu-iotests/091.out @@ -XXX,XX +XXX,XX @@ read 4194304/4194304 bytes at offset 0 4 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) Running 'qemu-img check -r all $TEST_IMG' No errors were found on the image. -80/16384 = 0.49% allocated, 0.00% fragmented, 0.00% compressed clusters -Image end offset: 5570560 *** done -- 2.24.1 The only difference is that the json:{} filename of the image looks different. We actually do not care about that filename in this test, we are only interested in (1) that there is a json:{} filename, and (2) whether the backing filename can be constructed. So just filter out the json:{} data, thus making this test pass both with and without data_file. Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com> Message-id: 20191107163708.833192-19-mreitz@redhat.com Signed-off-by: Max Reitz <mreitz@redhat.com> --- tests/qemu-iotests/110 | 7 +++++-- tests/qemu-iotests/110.out | 4 ++-- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/tests/qemu-iotests/110 b/tests/qemu-iotests/110 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/110 +++ b/tests/qemu-iotests/110 @@ -XXX,XX +XXX,XX @@ echo # Across blkdebug without a config file, you cannot reconstruct filenames, so # qemu is incapable of knowing the directory of the top image from the filename # alone. However, using bdrv_dirname(), it should still work. +# (Filter out the json:{} filename so this test works with external data files) TEST_IMG="json:{ 'driver': '$IMGFMT', 'file': { @@ -XXX,XX +XXX,XX @@ TEST_IMG="json:{ } ] } -}" _img_info | _filter_img_info | grep -v 'backing file format' +}" _img_info | _filter_img_info | grep -v 'backing file format' \ + | _filter_json_filename echo echo '=== Backing name is always relative to the backed image ===' @@ -XXX,XX +XXX,XX @@ TEST_IMG="json:{ } ] } -}" _img_info | _filter_img_info | grep -v 'backing file format' +}" _img_info | _filter_img_info | grep -v 'backing file format' \ + | _filter_json_filename # success, all done diff --git a/tests/qemu-iotests/110.out b/tests/qemu-iotests/110.out index XXXXXXX..XXXXXXX 100644 --- a/tests/qemu-iotests/110.out +++ b/tests/qemu-iotests/110.out @@ -XXX,XX +XXX,XX @@ backing file: t.IMGFMT.base (actual path: TEST_DIR/t.IMGFMT.base) === Non-reconstructable filename === -image: json:{"driver": "IMGFMT", "file": {"set-state.0.event": "read_aio", "image": {"driver": "file", "filename": "TEST_DIR/t.IMGFMT"}, "driver": "blkdebug", "set-state.0.new_state": 42}} +image: json:{ /* filtered */ } file format: IMGFMT virtual size: 64 MiB (67108864 bytes) backing file: t.IMGFMT.base (actual path: TEST_DIR/t.IMGFMT.base) @@ -XXX,XX +XXX,XX @@ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=t.IMGFMT.b === Nodes without a common directory === -image: json:{"driver": "IMGFMT", "file": {"children": [{"driver": "file", "filename": "TEST_DIR/t.IMGFMT"}, {"driver": "file", "filename": "TEST_DIR/t.IMGFMT.copy"}], "driver": "quorum", "vote-threshold": 1}} +image: json:{ /* filtered */ } file format: IMGFMT virtual size: 64 MiB (67108864 bytes) backing file: t.IMGFMT.base (cannot determine actual path) -- 2.24.1 When using an external data file, there are no refcounts for data clusters. We thus have to adjust the corruption test in this patch to not be based around a data cluster allocation, but the L2 table allocation (L2 tables are still refcounted with external data files). Furthermore, we should not print qcow2.py's list of incompatible features because it differs depending on whether there is an external data file or not. With those two changes, the test will work both with and without external data files (once that options works with the iotests at all). Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com> Message-id: 20191107163708.833192-20-mreitz@redhat.com Signed-off-by: Max Reitz <mreitz@redhat.com> --- tests/qemu-iotests/137 | 15 +++++++++++---- tests/qemu-iotests/137.out | 6 ++---- 2 files changed, 13 insertions(+), 8 deletions(-) diff --git a/tests/qemu-iotests/137 b/tests/qemu-iotests/137 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/137 +++ b/tests/qemu-iotests/137 @@ -XXX,XX +XXX,XX @@ $QEMU_IO \ "$TEST_IMG" 2>&1 | _filter_qemu_io # The dirty bit must not be set -$PYTHON qcow2.py "$TEST_IMG" dump-header | grep incompatible_features +# (Filter the external data file bit) +if $PYTHON qcow2.py "$TEST_IMG" dump-header | grep incompatible_features \ + | grep -q '\<0\>' +then + echo 'ERROR: Dirty bit set' +else + echo 'OK: Dirty bit not set' +fi # Similarly we can test whether corruption detection has been enabled: -# Create L1/L2, overwrite first entry in refcount block, allocate something. +# Create L1, overwrite refcounts, force allocation of L2 by writing +# data. # Disabling the checks should fail, so the corruption must be detected. _make_test_img 64M -$QEMU_IO -c "write 0 64k" "$TEST_IMG" | _filter_qemu_io -poke_file "$TEST_IMG" "$((0x20000))" "\x00\x00" +poke_file "$TEST_IMG" "$((0x20000))" "\x00\x00\x00\x00\x00\x00\x00\x00" $QEMU_IO \ -c "reopen -o overlap-check=none,lazy-refcounts=42" \ -c "write 64k 64k" \ diff --git a/tests/qemu-iotests/137.out b/tests/qemu-iotests/137.out index XXXXXXX..XXXXXXX 100644 --- a/tests/qemu-iotests/137.out +++ b/tests/qemu-iotests/137.out @@ -XXX,XX +XXX,XX @@ qemu-io: Unsupported value 'blubb' for qcow2 option 'overlap-check'. Allowed are wrote 512/512 bytes at offset 0 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) ./common.rc: Killed ( VALGRIND_QEMU="${VALGRIND_QEMU_IO}" _qemu_proc_exec "${VALGRIND_LOGFILE}" "$QEMU_IO_PROG" $QEMU_IO_ARGS "$@" ) -incompatible_features [] +OK: Dirty bit not set Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 -wrote 65536/65536 bytes at offset 0 -64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) qemu-io: Parameter 'lazy-refcounts' expects 'on' or 'off' -qcow2: Marking image as corrupt: Preventing invalid write on metadata (overlaps with qcow2_header); further corruption events will be suppressed +qcow2: Marking image as corrupt: Preventing invalid allocation of L2 table at offset 0; further corruption events will be suppressed write failed: Input/output error *** done -- 2.24.1 We do not care about the json:{} filenames here, so we can just filter them out and thus make the test work both with and without external data files. Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com> Message-id: 20191107163708.833192-21-mreitz@redhat.com Signed-off-by: Max Reitz <mreitz@redhat.com> --- tests/qemu-iotests/198 | 6 ++++-- tests/qemu-iotests/198.out | 4 ++-- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/tests/qemu-iotests/198 b/tests/qemu-iotests/198 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/198 +++ b/tests/qemu-iotests/198 @@ -XXX,XX +XXX,XX @@ echo echo "== checking image base ==" $QEMU_IMG info --image-opts $IMGSPECBASE | _filter_img_info --format-specific \ | sed -e "/^disk size:/ D" -e '/refcount bits:/ D' -e '/compat:/ D' \ - -e '/lazy refcounts:/ D' -e '/corrupt:/ D' + -e '/lazy refcounts:/ D' -e '/corrupt:/ D' -e '/^\s*data file/ D' \ + | _filter_json_filename echo echo "== checking image layer ==" $QEMU_IMG info --image-opts $IMGSPECLAYER | _filter_img_info --format-specific \ | sed -e "/^disk size:/ D" -e '/refcount bits:/ D' -e '/compat:/ D' \ - -e '/lazy refcounts:/ D' -e '/corrupt:/ D' + -e '/lazy refcounts:/ D' -e '/corrupt:/ D' -e '/^\s*data file/ D' \ + | _filter_json_filename # success, all done diff --git a/tests/qemu-iotests/198.out b/tests/qemu-iotests/198.out index XXXXXXX..XXXXXXX 100644 --- a/tests/qemu-iotests/198.out +++ b/tests/qemu-iotests/198.out @@ -XXX,XX +XXX,XX @@ read 16777216/16777216 bytes at offset 0 16 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) == checking image base == -image: json:{"encrypt.key-secret": "sec0", "driver": "IMGFMT", "file": {"driver": "file", "filename": "TEST_DIR/t.IMGFMT.base"}} +image: json:{ /* filtered */ } file format: IMGFMT virtual size: 16 MiB (16777216 bytes) Format specific information: @@ -XXX,XX +XXX,XX @@ Format specific information: master key iters: 1024 == checking image layer == -image: json:{"encrypt.key-secret": "sec1", "driver": "IMGFMT", "file": {"driver": "file", "filename": "TEST_DIR/t.IMGFMT"}} +image: json:{ /* filtered */ } file format: IMGFMT virtual size: 16 MiB (16777216 bytes) backing file: TEST_DIR/t.IMGFMT.base -- 2.24.1 Signed-off-by: Max Reitz <mreitz@redhat.com> Message-id: 20191107163708.833192-22-mreitz@redhat.com [mreitz: Also disable 273] Signed-off-by: Max Reitz <mreitz@redhat.com> --- tests/qemu-iotests/007 | 5 +++-- tests/qemu-iotests/014 | 2 ++ tests/qemu-iotests/015 | 5 +++-- tests/qemu-iotests/026 | 5 ++++- tests/qemu-iotests/029 | 5 +++-- tests/qemu-iotests/031 | 6 +++--- tests/qemu-iotests/036 | 5 +++-- tests/qemu-iotests/039 | 3 +++ tests/qemu-iotests/046 | 2 ++ tests/qemu-iotests/048 | 2 ++ tests/qemu-iotests/051 | 5 +++-- tests/qemu-iotests/058 | 5 +++-- tests/qemu-iotests/060 | 6 ++++-- tests/qemu-iotests/061 | 6 ++++-- tests/qemu-iotests/062 | 2 +- tests/qemu-iotests/066 | 4 +++- tests/qemu-iotests/067 | 6 ++++-- tests/qemu-iotests/068 | 5 +++-- tests/qemu-iotests/071 | 3 +++ tests/qemu-iotests/073 | 4 ++++ tests/qemu-iotests/074 | 2 ++ tests/qemu-iotests/080 | 5 +++-- tests/qemu-iotests/090 | 2 ++ tests/qemu-iotests/098 | 6 ++++-- tests/qemu-iotests/099 | 3 ++- tests/qemu-iotests/103 | 5 +++-- tests/qemu-iotests/108 | 6 ++++-- tests/qemu-iotests/112 | 5 +++-- tests/qemu-iotests/114 | 2 ++ tests/qemu-iotests/121 | 3 +++ tests/qemu-iotests/138 | 3 +++ tests/qemu-iotests/156 | 2 ++ tests/qemu-iotests/176 | 7 +++++-- tests/qemu-iotests/191 | 2 ++ tests/qemu-iotests/201 | 6 +++--- tests/qemu-iotests/214 | 3 ++- tests/qemu-iotests/217 | 3 ++- tests/qemu-iotests/220 | 5 +++-- tests/qemu-iotests/243 | 6 ++++-- tests/qemu-iotests/244 | 5 +++-- tests/qemu-iotests/250 | 2 ++ tests/qemu-iotests/261 | 3 ++- tests/qemu-iotests/267 | 5 +++-- tests/qemu-iotests/273 | 3 +++ 44 files changed, 127 insertions(+), 53 deletions(-) diff --git a/tests/qemu-iotests/007 b/tests/qemu-iotests/007 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/007 +++ b/tests/qemu-iotests/007 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 _supported_fmt qcow2 _supported_proto generic # refcount_bits must be at least 4 so we can create ten internal snapshots -# (1 bit supports none, 2 bits support two, 4 bits support 14) -_unsupported_imgopts 'refcount_bits=\(1\|2\)[^0-9]' +# (1 bit supports none, 2 bits support two, 4 bits support 14); +# snapshot are generally impossible with external data files +_unsupported_imgopts 'refcount_bits=\(1\|2\)[^0-9]' data_file echo echo "creating image" diff --git a/tests/qemu-iotests/014 b/tests/qemu-iotests/014 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/014 +++ b/tests/qemu-iotests/014 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 _supported_fmt qcow2 _supported_proto file _supported_os Linux +# Compression and snapshots do not work with external data files +_unsupported_imgopts data_file TEST_OFFSETS="0 4294967296" TEST_OPS="writev read write readv" diff --git a/tests/qemu-iotests/015 b/tests/qemu-iotests/015 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/015 +++ b/tests/qemu-iotests/015 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 # actually any format that supports snapshots _supported_fmt qcow2 _supported_proto generic -# Internal snapshots are (currently) impossible with refcount_bits=1 -_unsupported_imgopts 'refcount_bits=1[^0-9]' +# Internal snapshots are (currently) impossible with refcount_bits=1, +# and generally impossible with external data files +_unsupported_imgopts 'refcount_bits=1[^0-9]' data_file echo echo "creating image" diff --git a/tests/qemu-iotests/026 b/tests/qemu-iotests/026 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/026 +++ b/tests/qemu-iotests/026 @@ -XXX,XX +XXX,XX @@ _supported_cache_modes writethrough none # 32 and 64 bits do not work either, however, due to different leaked cluster # count on error. # Thus, the only remaining option is refcount_bits=16. -_unsupported_imgopts 'refcount_bits=\([^1]\|.\([^6]\|$\)\)' +# +# As for data_file, none of the refcount tests can work for it. +_unsupported_imgopts 'refcount_bits=\([^1]\|.\([^6]\|$\)\)' \ + data_file echo "Errors while writing 128 kB" echo diff --git a/tests/qemu-iotests/029 b/tests/qemu-iotests/029 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/029 +++ b/tests/qemu-iotests/029 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 _supported_fmt qcow2 _supported_proto generic _unsupported_proto vxhs -# Internal snapshots are (currently) impossible with refcount_bits=1 -_unsupported_imgopts 'refcount_bits=1[^0-9]' +# Internal snapshots are (currently) impossible with refcount_bits=1, +# and generally impossible with external data files +_unsupported_imgopts 'refcount_bits=1[^0-9]' data_file offset_size=24 offset_l1_size=36 diff --git a/tests/qemu-iotests/031 b/tests/qemu-iotests/031 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/031 +++ b/tests/qemu-iotests/031 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 # This tests qcow2-specific low-level functionality _supported_fmt qcow2 _supported_proto file -# We want to test compat=0.10, which does not support refcount widths -# other than 16 -_unsupported_imgopts 'refcount_bits=\([^1]\|.\([^6]\|$\)\)' +# We want to test compat=0.10, which does not support external data +# files or refcount widths other than 16 +_unsupported_imgopts data_file 'refcount_bits=\([^1]\|.\([^6]\|$\)\)' CLUSTER_SIZE=65536 diff --git a/tests/qemu-iotests/036 b/tests/qemu-iotests/036 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/036 +++ b/tests/qemu-iotests/036 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 # This tests qcow2-specific low-level functionality _supported_fmt qcow2 _supported_proto file -# Only qcow2v3 and later supports feature bits -_unsupported_imgopts 'compat=0.10' +# Only qcow2v3 and later supports feature bits; +# qcow2.py does not support external data files +_unsupported_imgopts 'compat=0.10' data_file echo echo === Image with unknown incompatible feature bit === diff --git a/tests/qemu-iotests/039 b/tests/qemu-iotests/039 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/039 +++ b/tests/qemu-iotests/039 @@ -XXX,XX +XXX,XX @@ _supported_proto file _supported_os Linux _default_cache_mode writethrough _supported_cache_modes writethrough +# Some of these test cases expect no external data file so that all +# clusters are part of the qcow2 image and refcounted +_unsupported_imgopts data_file size=128M diff --git a/tests/qemu-iotests/046 b/tests/qemu-iotests/046 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/046 +++ b/tests/qemu-iotests/046 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 _supported_fmt qcow2 _supported_proto file +# data_file does not support compressed clusters +_unsupported_imgopts data_file CLUSTER_SIZE=64k size=128M diff --git a/tests/qemu-iotests/048 b/tests/qemu-iotests/048 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/048 +++ b/tests/qemu-iotests/048 @@ -XXX,XX +XXX,XX @@ _compare() _supported_fmt raw qcow2 qed luks _supported_proto file _supported_os Linux +# Using 'cp' is incompatible with external data files +_unsupported_imgopts data_file # Remove once all tests are fixed to use TEST_IMG_FILE # correctly and common.rc sets it unconditionally diff --git a/tests/qemu-iotests/051 b/tests/qemu-iotests/051 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/051 +++ b/tests/qemu-iotests/051 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 _supported_fmt qcow2 _supported_proto file # A compat=0.10 image is created in this test which does not support anything -# other than refcount_bits=16 -_unsupported_imgopts 'refcount_bits=\([^1]\|.\([^6]\|$\)\)' +# other than refcount_bits=16; +# it also will not support an external data file +_unsupported_imgopts 'refcount_bits=\([^1]\|.\([^6]\|$\)\)' data_file _require_drivers nbd do_run_qemu() diff --git a/tests/qemu-iotests/058 b/tests/qemu-iotests/058 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/058 +++ b/tests/qemu-iotests/058 @@ -XXX,XX +XXX,XX @@ _supported_fmt qcow2 _supported_proto file _supported_os Linux _require_command QEMU_NBD -# Internal snapshots are (currently) impossible with refcount_bits=1 -_unsupported_imgopts 'refcount_bits=1[^0-9]' +# Internal snapshots are (currently) impossible with refcount_bits=1, +# and generally impossible with external data files +_unsupported_imgopts 'refcount_bits=1[^0-9]' data_file nbd_snapshot_img="nbd:unix:$nbd_unix_socket" diff --git a/tests/qemu-iotests/060 b/tests/qemu-iotests/060 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/060 +++ b/tests/qemu-iotests/060 @@ -XXX,XX +XXX,XX @@ _filter_io_error() _supported_fmt qcow2 _supported_proto file _supported_os Linux -# These tests only work for compat=1.1 images with refcount_bits=16 -_unsupported_imgopts 'compat=0.10' 'refcount_bits=\([^1]\|.\([^6]\|$\)\)' +# These tests only work for compat=1.1 images without an external +# data file with refcount_bits=16 +_unsupported_imgopts 'compat=0.10' data_file \ + 'refcount_bits=\([^1]\|.\([^6]\|$\)\)' # The repair process will create a large file - so check for availability first _require_large_file 64G diff --git a/tests/qemu-iotests/061 b/tests/qemu-iotests/061 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/061 +++ b/tests/qemu-iotests/061 @@ -XXX,XX +XXX,XX @@ _supported_fmt qcow2 _supported_proto file _supported_os Linux # Conversion between different compat versions can only really work -# with refcount_bits=16 -_unsupported_imgopts 'refcount_bits=\([^1]\|.\([^6]\|$\)\)' +# with refcount_bits=16; +# we have explicit tests for data_file here, but the whole test does +# not work with it +_unsupported_imgopts 'refcount_bits=\([^1]\|.\([^6]\|$\)\)' data_file echo echo "=== Testing version downgrade with zero expansion ===" diff --git a/tests/qemu-iotests/062 b/tests/qemu-iotests/062 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/062 +++ b/tests/qemu-iotests/062 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 _supported_fmt qcow2 _supported_proto generic # We need zero clusters and snapshots -_unsupported_imgopts 'compat=0.10' 'refcount_bits=1[^0-9]' +_unsupported_imgopts 'compat=0.10' 'refcount_bits=1[^0-9]' data_file IMG_SIZE=64M diff --git a/tests/qemu-iotests/066 b/tests/qemu-iotests/066 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/066 +++ b/tests/qemu-iotests/066 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 _supported_fmt qcow2 _supported_proto generic # We need zero clusters and snapshots -_unsupported_imgopts 'compat=0.10' 'refcount_bits=1[^0-9]' +# (TODO: Consider splitting the snapshot part into a separate test +# file, so this one runs with refcount_bits=1 and data_file) +_unsupported_imgopts 'compat=0.10' 'refcount_bits=1[^0-9]' data_file # Intentionally create an unaligned image IMG_SIZE=$((64 * 1024 * 1024 + 512)) diff --git a/tests/qemu-iotests/067 b/tests/qemu-iotests/067 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/067 +++ b/tests/qemu-iotests/067 @@ -XXX,XX +XXX,XX @@ status=1 # failure is the default! _supported_fmt qcow2 _supported_proto file -# Because anything other than 16 would change the output of query-block -_unsupported_imgopts 'refcount_bits=\([^1]\|.\([^6]\|$\)\)' +# Because anything other than 16 would change the output of query-block, +# and external data files would change the output of +# query-named-block-nodes +_unsupported_imgopts 'refcount_bits=\([^1]\|.\([^6]\|$\)\)' data_file do_run_qemu() { diff --git a/tests/qemu-iotests/068 b/tests/qemu-iotests/068 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/068 +++ b/tests/qemu-iotests/068 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 # This tests qcow2-specific low-level functionality _supported_fmt qcow2 _supported_proto generic -# Internal snapshots are (currently) impossible with refcount_bits=1 -_unsupported_imgopts 'compat=0.10' 'refcount_bits=1[^0-9]' +# Internal snapshots are (currently) impossible with refcount_bits=1, +# and generally impossible with external data files +_unsupported_imgopts 'compat=0.10' 'refcount_bits=1[^0-9]' data_file IMG_SIZE=128K diff --git a/tests/qemu-iotests/071 b/tests/qemu-iotests/071 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/071 +++ b/tests/qemu-iotests/071 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 _supported_fmt qcow2 _supported_proto file _require_drivers blkdebug blkverify +# blkdebug can only inject errors on bs->file, not on the data_file, +# so thie test does not work with external data files +_unsupported_imgopts data_file do_run_qemu() { diff --git a/tests/qemu-iotests/073 b/tests/qemu-iotests/073 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/073 +++ b/tests/qemu-iotests/073 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 _supported_fmt qcow2 _supported_proto generic _unsupported_proto vxhs +# External data files do not support compressed clusters +# (TODO: Consider writing a version for external data files that does +# not test compressed clusters) +_unsupported_imgopts data_file CLUSTER_SIZE=64k size=128M diff --git a/tests/qemu-iotests/074 b/tests/qemu-iotests/074 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/074 +++ b/tests/qemu-iotests/074 @@ -XXX,XX +XXX,XX @@ _compare() _supported_fmt qcow2 _supported_proto file _supported_os Linux +# blkdebug can only inject errors on bs->file +_unsupported_imgopts data_file # Setup test basic parameters TEST_IMG2=$TEST_IMG.2 diff --git a/tests/qemu-iotests/080 b/tests/qemu-iotests/080 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/080 +++ b/tests/qemu-iotests/080 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 _supported_fmt qcow2 _supported_proto file _supported_os Linux -# - Internal snapshots are (currently) impossible with refcount_bits=1 +# - Internal snapshots are (currently) impossible with refcount_bits=1, +# and generally impossible with external data files # - This is generally a test for compat=1.1 images -_unsupported_imgopts 'refcount_bits=1[^0-9]' 'compat=0.10' +_unsupported_imgopts 'refcount_bits=1[^0-9]' data_file 'compat=0.10' header_size=104 diff --git a/tests/qemu-iotests/090 b/tests/qemu-iotests/090 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/090 +++ b/tests/qemu-iotests/090 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 _supported_fmt qcow2 _supported_proto file nfs +# External data files do not support compressed clusters +_unsupported_imgopts data_file IMG_SIZE=128K diff --git a/tests/qemu-iotests/098 b/tests/qemu-iotests/098 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/098 +++ b/tests/qemu-iotests/098 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 _supported_fmt qcow2 _supported_proto file -# The code path we want to test here only works for compat=1.1 images -_unsupported_imgopts 'compat=0.10' +# The code path we want to test here only works for compat=1.1 images; +# blkdebug can only inject errors on bs->file, so external data files +# do not work with this test +_unsupported_imgopts 'compat=0.10' data_file for event in l1_update empty_image_prepare reftable_update refblock_alloc; do diff --git a/tests/qemu-iotests/099 b/tests/qemu-iotests/099 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/099 +++ b/tests/qemu-iotests/099 @@ -XXX,XX +XXX,XX @@ _supported_fmt qcow qcow2 qed vdi vhdx vmdk vpc _supported_proto file _supported_os Linux _require_drivers blkdebug blkverify +# data_file would change the json:{} filenames _unsupported_imgopts "subformat=monolithicFlat" "subformat=twoGbMaxExtentFlat" \ - "subformat=twoGbMaxExtentSparse" + "subformat=twoGbMaxExtentSparse" data_file do_run_qemu() { diff --git a/tests/qemu-iotests/103 b/tests/qemu-iotests/103 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/103 +++ b/tests/qemu-iotests/103 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 _supported_fmt qcow2 _supported_proto file nfs -# Internal snapshots are (currently) impossible with refcount_bits=1 -_unsupported_imgopts 'refcount_bits=1[^0-9]' +# Internal snapshots are (currently) impossible with refcount_bits=1, +# and generally impossible with external data files +_unsupported_imgopts 'refcount_bits=1[^0-9]' data_file IMG_SIZE=64K diff --git a/tests/qemu-iotests/108 b/tests/qemu-iotests/108 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/108 +++ b/tests/qemu-iotests/108 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 _supported_fmt qcow2 _supported_proto file _supported_os Linux -# This test directly modifies a refblock so it relies on refcount_bits being 16 -_unsupported_imgopts 'refcount_bits=\([^1]\|.\([^6]\|$\)\)' +# This test directly modifies a refblock so it relies on refcount_bits being 16; +# and the low-level modification it performs are not tuned for external data +# files +_unsupported_imgopts 'refcount_bits=\([^1]\|.\([^6]\|$\)\)' data_file echo echo '=== Repairing an image without any refcount table ===' diff --git a/tests/qemu-iotests/112 b/tests/qemu-iotests/112 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/112 +++ b/tests/qemu-iotests/112 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 _supported_fmt qcow2 _supported_proto file # This test will set refcount_bits on its own which would conflict with the -# manual setting; compat will be overridden as well -_unsupported_imgopts refcount_bits 'compat=0.10' +# manual setting; compat will be overridden as well; +# and external data files do not work well with our refcount testing +_unsupported_imgopts refcount_bits 'compat=0.10' data_file print_refcount_bits() { diff --git a/tests/qemu-iotests/114 b/tests/qemu-iotests/114 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/114 +++ b/tests/qemu-iotests/114 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 _supported_fmt qcow2 _supported_proto generic _unsupported_proto vxhs +# qcow2.py does not work too well with external data files +_unsupported_imgopts data_file TEST_IMG="$TEST_IMG.base" _make_test_img 64M diff --git a/tests/qemu-iotests/121 b/tests/qemu-iotests/121 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/121 +++ b/tests/qemu-iotests/121 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 _supported_fmt qcow2 _supported_proto file _supported_os Linux +# Refcount structures are used much differently with external data +# files +_unsupported_imgopts data_file echo echo '=== New refcount structures may not conflict with existing structures ===' diff --git a/tests/qemu-iotests/138 b/tests/qemu-iotests/138 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/138 +++ b/tests/qemu-iotests/138 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 _supported_fmt qcow2 _supported_proto file _supported_os Linux +# With an external data file, data clusters are not refcounted +# (and so qemu-img check does not check their refcount) +_unsupported_imgopts data_file echo echo '=== Check on an image with a multiple of 2^32 clusters ===' diff --git a/tests/qemu-iotests/156 b/tests/qemu-iotests/156 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/156 +++ b/tests/qemu-iotests/156 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 _supported_fmt qcow2 qed _supported_proto generic _unsupported_proto vxhs +# Copying files around with cp does not work with external data files +_unsupported_imgopts data_file # Create source disk TEST_IMG="$TEST_IMG.backing" _make_test_img 1M diff --git a/tests/qemu-iotests/176 b/tests/qemu-iotests/176 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/176 +++ b/tests/qemu-iotests/176 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 _supported_fmt qcow2 _supported_proto file _supported_os Linux -# Persistent dirty bitmaps require compat=1.1 -_unsupported_imgopts 'compat=0.10' +# Persistent dirty bitmaps require compat=1.1; +# Internal snapshots forbid using an external data file +# (they work with refcount_bits=1 here, though, because there actually +# is no data when creating the snapshot) +_unsupported_imgopts 'compat=0.10' data_file run_qemu() { diff --git a/tests/qemu-iotests/191 b/tests/qemu-iotests/191 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/191 +++ b/tests/qemu-iotests/191 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 _supported_fmt qcow2 _supported_proto file +# An external data file would change the query-named-block-nodes output +_unsupported_imgopts data_file size=64M diff --git a/tests/qemu-iotests/201 b/tests/qemu-iotests/201 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/201 +++ b/tests/qemu-iotests/201 @@ -XXX,XX +XXX,XX @@ _supported_fmt qcow2 _supported_proto generic _supported_os Linux -# Internal snapshots are (currently) impossible with refcount_bits=1 -# This was taken from test 080 -_unsupported_imgopts 'refcount_bits=1[^0-9]' +# Internal snapshots are (currently) impossible with refcount_bits=1, +# and generally impossible with external data files +_unsupported_imgopts 'refcount_bits=1[^0-9]' data_file size=64M _make_test_img $size diff --git a/tests/qemu-iotests/214 b/tests/qemu-iotests/214 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/214 +++ b/tests/qemu-iotests/214 @@ -XXX,XX +XXX,XX @@ _supported_proto file # Repairing the corrupted image requires qemu-img check to store a # refcount up to 3, which requires at least two refcount bits. -_unsupported_imgopts 'refcount_bits=1[^0-9]' +# External data files do not support compressed clusters. +_unsupported_imgopts 'refcount_bits=1[^0-9]' data_file echo diff --git a/tests/qemu-iotests/217 b/tests/qemu-iotests/217 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/217 +++ b/tests/qemu-iotests/217 @@ -XXX,XX +XXX,XX @@ _supported_proto file # This test needs clusters with at least a refcount of 2 so that # OFLAG_COPIED is not set. refcount_bits=1 is therefore unsupported. -_unsupported_imgopts 'refcount_bits=1[^0-9]' +# (As are external data files.) +_unsupported_imgopts 'refcount_bits=1[^0-9]' data_file echo echo '=== Simulating an I/O error during snapshot deletion ===' diff --git a/tests/qemu-iotests/220 b/tests/qemu-iotests/220 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/220 +++ b/tests/qemu-iotests/220 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 _supported_fmt qcow2 _supported_proto file _supported_os Linux -# To use a different refcount width but 16 bits we need compat=1.1 -_unsupported_imgopts 'compat=0.10' +# To use a different refcount width but 16 bits we need compat=1.1, +# and external data files do not support compressed clusters. +_unsupported_imgopts 'compat=0.10' data_file echo "== Creating huge file ==" diff --git a/tests/qemu-iotests/243 b/tests/qemu-iotests/243 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/243 +++ b/tests/qemu-iotests/243 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 _supported_fmt qcow2 _supported_proto file _supported_os Linux -# External data files do not work with compat=0.10 -_unsupported_imgopts 'compat=0.10' +# External data files do not work with compat=0.10, and because there +# is an explicit case for external data files here, we cannot allow +# the user to specify whether to use one +_unsupported_imgopts 'compat=0.10' data_file for mode in off metadata falloc full; do diff --git a/tests/qemu-iotests/244 b/tests/qemu-iotests/244 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/244 +++ b/tests/qemu-iotests/244 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 _supported_fmt qcow2 _supported_proto file _supported_os Linux -# External data files do not work with compat=0.10 -_unsupported_imgopts 'compat=0.10' +# External data files do not work with compat=0.10, and because we use +# our own external data file, we cannot let the user specify one +_unsupported_imgopts 'compat=0.10' data_file echo echo "=== Create and open image with external data file ===" diff --git a/tests/qemu-iotests/250 b/tests/qemu-iotests/250 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/250 +++ b/tests/qemu-iotests/250 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 _supported_fmt qcow2 _supported_proto file _supported_os Linux +# This test does not make much sense with external data files +_unsupported_imgopts data_file # This test checks that qcow2_process_discards does not truncate a discard # request > 2G. diff --git a/tests/qemu-iotests/261 b/tests/qemu-iotests/261 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/261 +++ b/tests/qemu-iotests/261 @@ -XXX,XX +XXX,XX @@ _supported_os Linux # (1) We create a v2 image that supports nothing but refcount_bits=16 # (2) We do some refcount management on our own which expects # refcount_bits=16 -_unsupported_imgopts 'refcount_bits=\([^1]\|.\([^6]\|$\)\)' +# As for data files, they do not support snapshots at all. +_unsupported_imgopts 'refcount_bits=\([^1]\|.\([^6]\|$\)\)' data_file # Parameters: # $1: image filename diff --git a/tests/qemu-iotests/267 b/tests/qemu-iotests/267 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/267 +++ b/tests/qemu-iotests/267 @@ -XXX,XX +XXX,XX @@ _supported_proto file _supported_os Linux _require_drivers copy-on-read -# Internal snapshots are (currently) impossible with refcount_bits=1 -_unsupported_imgopts 'refcount_bits=1[^0-9]' +# Internal snapshots are (currently) impossible with refcount_bits=1, +# and generally impossible with external data files +_unsupported_imgopts 'refcount_bits=1[^0-9]' data_file do_run_qemu() { diff --git a/tests/qemu-iotests/273 b/tests/qemu-iotests/273 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/273 +++ b/tests/qemu-iotests/273 @@ -XXX,XX +XXX,XX @@ trap "_cleanup; exit \$status" 0 1 2 3 15 _supported_fmt qcow2 _supported_proto file _supported_os Linux +# External data files would add nodes to the block graph, so it would +# not match the reference output +_unsupported_imgopts data_file do_run_qemu() { -- 2.24.1 The problem with allowing the data_file option is that you want to use a different data file per image used in the test. Therefore, we need to allow patterns like -o data_file='$TEST_IMG.data_file'. Then, we need to filter it out from qemu-img map, qemu-img create, and remove the data file in _rm_test_img. Signed-off-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com> Message-id: 20191107163708.833192-23-mreitz@redhat.com Signed-off-by: Max Reitz <mreitz@redhat.com> --- tests/qemu-iotests/common.filter | 23 +++++++++++++++++++++-- tests/qemu-iotests/common.rc | 22 +++++++++++++++++++++- 2 files changed, 42 insertions(+), 3 deletions(-) diff --git a/tests/qemu-iotests/common.filter b/tests/qemu-iotests/common.filter index XXXXXXX..XXXXXXX 100644 --- a/tests/qemu-iotests/common.filter +++ b/tests/qemu-iotests/common.filter @@ -XXX,XX +XXX,XX @@ _filter_actual_image_size() # replace driver-specific options in the "Formatting..." line _filter_img_create() { - $SED -e "s#$REMOTE_TEST_DIR#TEST_DIR#g" \ + data_file_filter=() + if data_file=$(_get_data_file "$TEST_IMG"); then + data_file_filter=(-e "s# data_file=$data_file##") + fi + + $SED "${data_file_filter[@]}" \ + -e "s#$REMOTE_TEST_DIR#TEST_DIR#g" \ -e "s#$IMGPROTO:$TEST_DIR#TEST_DIR#g" \ -e "s#$TEST_DIR#TEST_DIR#g" \ -e "s#$SOCK_DIR#SOCK_DIR#g" \ @@ -XXX,XX +XXX,XX @@ _filter_img_info() # human and json output _filter_qemu_img_map() { + # Assuming the data_file value in $IMGOPTS contains a '$TEST_IMG', + # create a filter that replaces the data file name by $TEST_IMG. + # Example: + # In $IMGOPTS: 'data_file=$TEST_IMG.data_file' + # Then data_file_pattern == '\(.*\).data_file' + # And data_file_filter == -e 's#\(.*\).data_file#\1# + data_file_filter=() + if data_file_pattern=$(_get_data_file '\\(.*\\)'); then + data_file_filter=(-e "s#$data_file_pattern#\\1#") + fi + $SED -e 's/\([0-9a-fx]* *[0-9a-fx]* *\)[0-9a-fx]* */\1/g' \ -e 's/"offset": [0-9]\+/"offset": OFFSET/g' \ - -e 's/Mapped to *//' | _filter_testdir | _filter_imgfmt + -e 's/Mapped to *//' \ + "${data_file_filter[@]}" \ + | _filter_testdir | _filter_imgfmt } _filter_nbd() diff --git a/tests/qemu-iotests/common.rc b/tests/qemu-iotests/common.rc index XXXXXXX..XXXXXXX 100644 --- a/tests/qemu-iotests/common.rc +++ b/tests/qemu-iotests/common.rc @@ -XXX,XX +XXX,XX @@ _stop_nbd_server() fi } +# Gets the data_file value from IMGOPTS and replaces the '$TEST_IMG' +# pattern by '$1' +# Caution: The replacement is done with sed, so $1 must be escaped +# properly. (The delimiter is '#'.) +_get_data_file() +{ + if ! echo "$IMGOPTS" | grep -q 'data_file='; then + return 1 + fi + + echo "$IMGOPTS" | sed -e 's/.*data_file=\([^,]*\).*/\1/' \ + | sed -e "s#\\\$TEST_IMG#$1#" +} + _make_test_img() { # extra qemu-img options can be added by tests @@ -XXX,XX +XXX,XX @@ _make_test_img() fi if [ -n "$IMGOPTS" ]; then - optstr=$(_optstr_add "$optstr" "$IMGOPTS") + imgopts_expanded=$(echo "$IMGOPTS" | sed -e "s#\\\$TEST_IMG#$img_name#") + optstr=$(_optstr_add "$optstr" "$imgopts_expanded") fi if [ -n "$IMGKEYSECRET" ]; then object_options="--object secret,id=keysec0,data=$IMGKEYSECRET" @@ -XXX,XX +XXX,XX @@ _rm_test_img() # Remove all the extents for vmdk "$QEMU_IMG" info "$img" 2>/dev/null | grep 'filename:' | cut -f 2 -d: \ | xargs -I {} rm -f "{}" + elif [ "$IMGFMT" = "qcow2" ]; then + # Remove external data file + if data_file=$(_get_data_file "$img"); then + rm -f "$data_file" + fi fi rm -f "$img" } -- 2.24.1 From: Andrey Shinkevich <andrey.shinkevich@virtuozzo.com> Allow writing all the data compressed through the filter driver. The written data will be aligned by the cluster size. Based on the QEMU current implementation, that data can be written to unallocated clusters only. May be used for a backup job. Suggested-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Andrey Shinkevich <andrey.shinkevich@virtuozzo.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Message-id: 1575288906-551879-2-git-send-email-andrey.shinkevich@virtuozzo.com [mreitz: Replace NULL bdrv_get_format_name() by "(no format)"] Signed-off-by: Max Reitz <mreitz@redhat.com> --- block/Makefile.objs | 1 + block/filter-compress.c | 168 ++++++++++++++++++++++++++++++++++++++++ qapi/block-core.json | 10 ++- 3 files changed, 175 insertions(+), 4 deletions(-) create mode 100644 block/filter-compress.c diff --git a/block/Makefile.objs b/block/Makefile.objs index XXXXXXX..XXXXXXX 100644 --- a/block/Makefile.objs +++ b/block/Makefile.objs @@ -XXX,XX +XXX,XX @@ block-obj-y += crypto.o block-obj-y += aio_task.o block-obj-y += backup-top.o +block-obj-y += filter-compress.o common-obj-y += stream.o diff --git a/block/filter-compress.c b/block/filter-compress.c new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/block/filter-compress.c @@ -XXX,XX +XXX,XX @@ +/* + * Compress filter block driver + * + * Copyright (c) 2019 Virtuozzo International GmbH + * + * Author: + * Andrey Shinkevich <andrey.shinkevich@virtuozzo.com> + * (based on block/copy-on-read.c by Max Reitz) + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License as + * published by the Free Software Foundation; either version 2 or + * (at your option) any later version of the License. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, see <http://www.gnu.org/licenses/>. + */ + +#include "qemu/osdep.h" +#include "block/block_int.h" +#include "qemu/module.h" +#include "qapi/error.h" + + +static int compress_open(BlockDriverState *bs, QDict *options, int flags, + Error **errp) +{ + bs->file = bdrv_open_child(NULL, options, "file", bs, &child_file, false, + errp); + if (!bs->file) { + return -EINVAL; + } + + if (!bs->file->bs->drv || !block_driver_can_compress(bs->file->bs->drv)) { + error_setg(errp, + "Compression is not supported for underlying format: %s", + bdrv_get_format_name(bs->file->bs) ?: "(no format)"); + + return -ENOTSUP; + } + + bs->supported_write_flags = BDRV_REQ_WRITE_UNCHANGED | + (BDRV_REQ_FUA & bs->file->bs->supported_write_flags); + + bs->supported_zero_flags = BDRV_REQ_WRITE_UNCHANGED | + ((BDRV_REQ_FUA | BDRV_REQ_MAY_UNMAP | BDRV_REQ_NO_FALLBACK) & + bs->file->bs->supported_zero_flags); + + return 0; +} + + +static int64_t compress_getlength(BlockDriverState *bs) +{ + return bdrv_getlength(bs->file->bs); +} + + +static int coroutine_fn compress_co_preadv_part(BlockDriverState *bs, + uint64_t offset, uint64_t bytes, + QEMUIOVector *qiov, + size_t qiov_offset, + int flags) +{ + return bdrv_co_preadv_part(bs->file, offset, bytes, qiov, qiov_offset, + flags); +} + + +static int coroutine_fn compress_co_pwritev_part(BlockDriverState *bs, + uint64_t offset, + uint64_t bytes, + QEMUIOVector *qiov, + size_t qiov_offset, int flags) +{ + return bdrv_co_pwritev_part(bs->file, offset, bytes, qiov, qiov_offset, + flags | BDRV_REQ_WRITE_COMPRESSED); +} + + +static int coroutine_fn compress_co_pwrite_zeroes(BlockDriverState *bs, + int64_t offset, int bytes, + BdrvRequestFlags flags) +{ + return bdrv_co_pwrite_zeroes(bs->file, offset, bytes, flags); +} + + +static int coroutine_fn compress_co_pdiscard(BlockDriverState *bs, + int64_t offset, int bytes) +{ + return bdrv_co_pdiscard(bs->file, offset, bytes); +} + + +static void compress_refresh_limits(BlockDriverState *bs, Error **errp) +{ + BlockDriverInfo bdi; + int ret; + + if (!bs->file) { + return; + } + + ret = bdrv_get_info(bs->file->bs, &bdi); + if (ret < 0 || bdi.cluster_size == 0) { + return; + } + + bs->bl.request_alignment = bdi.cluster_size; +} + + +static void compress_eject(BlockDriverState *bs, bool eject_flag) +{ + bdrv_eject(bs->file->bs, eject_flag); +} + + +static void compress_lock_medium(BlockDriverState *bs, bool locked) +{ + bdrv_lock_medium(bs->file->bs, locked); +} + + +static bool compress_recurse_is_first_non_filter(BlockDriverState *bs, + BlockDriverState *candidate) +{ + return bdrv_recurse_is_first_non_filter(bs->file->bs, candidate); +} + + +static BlockDriver bdrv_compress = { + .format_name = "compress", + + .bdrv_open = compress_open, + .bdrv_child_perm = bdrv_filter_default_perms, + + .bdrv_getlength = compress_getlength, + + .bdrv_co_preadv_part = compress_co_preadv_part, + .bdrv_co_pwritev_part = compress_co_pwritev_part, + .bdrv_co_pwrite_zeroes = compress_co_pwrite_zeroes, + .bdrv_co_pdiscard = compress_co_pdiscard, + .bdrv_refresh_limits = compress_refresh_limits, + + .bdrv_eject = compress_eject, + .bdrv_lock_medium = compress_lock_medium, + + .bdrv_co_block_status = bdrv_co_block_status_from_file, + + .bdrv_recurse_is_first_non_filter = compress_recurse_is_first_non_filter, + + .has_variable_length = true, + .is_filter = true, +}; + +static void bdrv_compress_init(void) +{ + bdrv_register(&bdrv_compress); +} + +block_init(bdrv_compress_init); diff --git a/qapi/block-core.json b/qapi/block-core.json index XXXXXXX..XXXXXXX 100644 --- a/qapi/block-core.json +++ b/qapi/block-core.json @@ -XXX,XX +XXX,XX @@ # @copy-on-read: Since 3.0 # @blklogwrites: Since 3.0 # @blkreplay: Since 4.2 +# @compress: Since 5.0 # # Since: 2.9 ## { 'enum': 'BlockdevDriver', 'data': [ 'blkdebug', 'blklogwrites', 'blkreplay', 'blkverify', 'bochs', - 'cloop', 'copy-on-read', 'dmg', 'file', 'ftp', 'ftps', 'gluster', - 'host_cdrom', 'host_device', 'http', 'https', 'iscsi', 'luks', - 'nbd', 'nfs', 'null-aio', 'null-co', 'nvme', 'parallels', 'qcow', - 'qcow2', 'qed', 'quorum', 'raw', 'rbd', + 'cloop', 'compress', 'copy-on-read', 'dmg', 'file', 'ftp', 'ftps', + 'gluster', 'host_cdrom', 'host_device', 'http', 'https', 'iscsi', + 'luks', 'nbd', 'nfs', 'null-aio', 'null-co', 'nvme', 'parallels', + 'qcow', 'qcow2', 'qed', 'quorum', 'raw', 'rbd', { 'name': 'replication', 'if': 'defined(CONFIG_REPLICATION)' }, 'sheepdog', 'ssh', 'throttle', 'vdi', 'vhdx', 'vmdk', 'vpc', 'vvfat', 'vxhs' ] } @@ -XXX,XX +XXX,XX @@ 'blkreplay': 'BlockdevOptionsBlkreplay', 'bochs': 'BlockdevOptionsGenericFormat', 'cloop': 'BlockdevOptionsGenericFormat', + 'compress': 'BlockdevOptionsGenericFormat', 'copy-on-read':'BlockdevOptionsGenericFormat', 'dmg': 'BlockdevOptionsGenericFormat', 'file': 'BlockdevOptionsFile', -- 2.24.1 From: Andrey Shinkevich <andrey.shinkevich@virtuozzo.com> QEMU currently supports writing compressed data of the size equal to one cluster. This patch allows writing QCOW2 compressed data that exceed one cluster. Now, we split buffered data into separate clusters and write them compressed using the block/aio_task API. Suggested-by: Pavel Butsykin <pbutsykin@virtuozzo.com> Suggested-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Signed-off-by: Andrey Shinkevich <andrey.shinkevich@virtuozzo.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Message-id: 1575288906-551879-3-git-send-email-andrey.shinkevich@virtuozzo.com Signed-off-by: Max Reitz <mreitz@redhat.com> --- block/qcow2.c | 102 +++++++++++++++++++++++++++++++++++++------------- 1 file changed, 75 insertions(+), 27 deletions(-) diff --git a/block/qcow2.c b/block/qcow2.c index XXXXXXX..XXXXXXX 100644 --- a/block/qcow2.c +++ b/block/qcow2.c @@ -XXX,XX +XXX,XX @@ fail: return ret; } -/* XXX: put compressed sectors first, then all the cluster aligned - tables to avoid losing bytes in alignment */ static coroutine_fn int -qcow2_co_pwritev_compressed_part(BlockDriverState *bs, +qcow2_co_pwritev_compressed_task(BlockDriverState *bs, uint64_t offset, uint64_t bytes, QEMUIOVector *qiov, size_t qiov_offset) { @@ -XXX,XX +XXX,XX @@ qcow2_co_pwritev_compressed_part(BlockDriverState *bs, uint8_t *buf, *out_buf; uint64_t cluster_offset; - if (has_data_file(bs)) { - return -ENOTSUP; - } - - if (bytes == 0) { - /* align end of file to a sector boundary to ease reading with - sector based I/Os */ - int64_t len = bdrv_getlength(bs->file->bs); - if (len < 0) { - return len; - } - return bdrv_co_truncate(bs->file, len, false, PREALLOC_MODE_OFF, NULL); - } - - if (offset_into_cluster(s, offset)) { - return -EINVAL; - } + assert(bytes == s->cluster_size || (bytes < s->cluster_size && + (offset + bytes == bs->total_sectors << BDRV_SECTOR_BITS))); buf = qemu_blockalign(bs, s->cluster_size); - if (bytes != s->cluster_size) { - if (bytes > s->cluster_size || - offset + bytes != bs->total_sectors << BDRV_SECTOR_BITS) - { - qemu_vfree(buf); - return -EINVAL; - } + if (bytes < s->cluster_size) { /* Zero-pad last write if image size is not cluster aligned */ memset(buf + bytes, 0, s->cluster_size - bytes); } @@ -XXX,XX +XXX,XX @@ fail: return ret; } +static coroutine_fn int qcow2_co_pwritev_compressed_task_entry(AioTask *task) +{ + Qcow2AioTask *t = container_of(task, Qcow2AioTask, task); + + assert(!t->cluster_type && !t->l2meta); + + return qcow2_co_pwritev_compressed_task(t->bs, t->offset, t->bytes, t->qiov, + t->qiov_offset); +} + +/* + * XXX: put compressed sectors first, then all the cluster aligned + * tables to avoid losing bytes in alignment + */ +static coroutine_fn int +qcow2_co_pwritev_compressed_part(BlockDriverState *bs, + uint64_t offset, uint64_t bytes, + QEMUIOVector *qiov, size_t qiov_offset) +{ + BDRVQcow2State *s = bs->opaque; + AioTaskPool *aio = NULL; + int ret = 0; + + if (has_data_file(bs)) { + return -ENOTSUP; + } + + if (bytes == 0) { + /* + * align end of file to a sector boundary to ease reading with + * sector based I/Os + */ + int64_t len = bdrv_getlength(bs->file->bs); + if (len < 0) { + return len; + } + return bdrv_co_truncate(bs->file, len, false, PREALLOC_MODE_OFF, NULL); + } + + if (offset_into_cluster(s, offset)) { + return -EINVAL; + } + + while (bytes && aio_task_pool_status(aio) == 0) { + uint64_t chunk_size = MIN(bytes, s->cluster_size); + + if (!aio && chunk_size != bytes) { + aio = aio_task_pool_new(QCOW2_MAX_WORKERS); + } + + ret = qcow2_add_task(bs, aio, qcow2_co_pwritev_compressed_task_entry, + 0, 0, offset, chunk_size, qiov, qiov_offset, NULL); + if (ret < 0) { + break; + } + qiov_offset += chunk_size; + offset += chunk_size; + bytes -= chunk_size; + } + + if (aio) { + aio_task_pool_wait_all(aio); + if (ret == 0) { + ret = aio_task_pool_status(aio); + } + g_free(aio); + } + + return ret; +} + static int coroutine_fn qcow2_co_preadv_compressed(BlockDriverState *bs, uint64_t file_cluster_offset, -- 2.24.1 From: Andrey Shinkevich <andrey.shinkevich@virtuozzo.com> Add the case to the iotest #214 that checks possibility of writing compressed data of more than one cluster size. The test case involves the compress filter driver showing a sample usage of that. Signed-off-by: Andrey Shinkevich <andrey.shinkevich@virtuozzo.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Message-id: 1575288906-551879-4-git-send-email-andrey.shinkevich@virtuozzo.com Signed-off-by: Max Reitz <mreitz@redhat.com> --- tests/qemu-iotests/214 | 43 ++++++++++++++++++++++++++++++++++++++ tests/qemu-iotests/214.out | 14 +++++++++++++ 2 files changed, 57 insertions(+) diff --git a/tests/qemu-iotests/214 b/tests/qemu-iotests/214 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/214 +++ b/tests/qemu-iotests/214 @@ -XXX,XX +XXX,XX @@ _check_test_img -r all $QEMU_IO -c "read -P 0x11 0 4M" "$TEST_IMG" 2>&1 | _filter_qemu_io | _filter_testdir $QEMU_IO -c "read -P 0x22 4M 4M" "$TEST_IMG" 2>&1 | _filter_qemu_io | _filter_testdir +echo +echo "=== Write compressed data of multiple clusters ===" +echo +cluster_size=0x10000 +_make_test_img 2M -o cluster_size=$cluster_size + +echo "Write uncompressed data:" +let data_size="8 * $cluster_size" +$QEMU_IO -c "write -P 0xaa 0 $data_size" "$TEST_IMG" \ + 2>&1 | _filter_qemu_io | _filter_testdir +sizeA=$($QEMU_IMG info --output=json "$TEST_IMG" | + sed -n '/"actual-size":/ s/[^0-9]//gp') + +_make_test_img 2M -o cluster_size=$cluster_size +echo "Write compressed data:" +let data_size="3 * $cluster_size + $cluster_size / 2" +# Set compress on. That will align the written data +# by the cluster size and will write them compressed. +QEMU_IO_OPTIONS=$QEMU_IO_OPTIONS_NO_FMT \ +$QEMU_IO -c "write -P 0xbb 0 $data_size" --image-opts \ + "driver=compress,file.driver=$IMGFMT,file.file.driver=file,file.file.filename=$TEST_IMG" \ + 2>&1 | _filter_qemu_io | _filter_testdir + +let offset="4 * $cluster_size + $cluster_size / 4" +QEMU_IO_OPTIONS=$QEMU_IO_OPTIONS_NO_FMT \ +$QEMU_IO -c "write -P 0xcc $offset $data_size" "json:{\ + 'driver': 'compress', + 'file': {'driver': '$IMGFMT', + 'file': {'driver': 'file', + 'filename': '$TEST_IMG'}}}" | \ + _filter_qemu_io | _filter_testdir + +sizeB=$($QEMU_IMG info --output=json "$TEST_IMG" | + sed -n '/"actual-size":/ s/[^0-9]//gp') + +if [ $sizeA -le $sizeB ] +then + echo "Compression ERROR" +fi + +$QEMU_IMG check --output=json "$TEST_IMG" | + sed -n 's/,$//; /"compressed-clusters":/ s/^ *//p' + # success, all done echo '*** done' rm -f $seq.full diff --git a/tests/qemu-iotests/214.out b/tests/qemu-iotests/214.out index XXXXXXX..XXXXXXX 100644 --- a/tests/qemu-iotests/214.out +++ b/tests/qemu-iotests/214.out @@ -XXX,XX +XXX,XX @@ read 4194304/4194304 bytes at offset 0 4 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) read 4194304/4194304 bytes at offset 4194304 4 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) + +=== Write compressed data of multiple clusters === + +Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=2097152 +Write uncompressed data: +wrote 524288/524288 bytes at offset 0 +512 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) +Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=2097152 +Write compressed data: +wrote 229376/229376 bytes at offset 0 +224 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) +wrote 229376/229376 bytes at offset 278528 +224 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) +"compressed-clusters": 8 *** done -- 2.24.1 From: Philippe Mathieu-Daudé <philmd@redhat.com> Commit 6f6e1698a6 desugarized "-machine accel=" to a list of "-accel" options. Since now "-machine accel" and "-accel" became incompatible, update the iotests to the new format. Error reported here: https://gitlab.com/qemu-project/qemu/-/jobs/385801004#L3400 Reported-by: GitLab CI Fixes: 6f6e1698a6 (vl: configure accelerators from -accel options) Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20200106130951.29873-1-philmd@redhat.com Signed-off-by: Max Reitz <mreitz@redhat.com> --- tests/qemu-iotests/235 | 2 +- tests/qemu-iotests/check | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/tests/qemu-iotests/235 b/tests/qemu-iotests/235 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/235 +++ b/tests/qemu-iotests/235 @@ -XXX,XX +XXX,XX @@ qemu_img_create('-f', iotests.imgfmt, '-o', 'preallocation=metadata', disk, str(size)) vm = QEMUMachine(iotests.qemu_prog) -vm.add_args('-machine', 'accel=kvm:tcg') +vm.add_args('-accel', 'kvm', '-accel', 'tcg') if iotests.qemu_default_machine == 's390-ccw-virtio': vm.add_args('-no-shutdown') vm.add_args('-drive', 'id=src,file=' + disk) diff --git a/tests/qemu-iotests/check b/tests/qemu-iotests/check index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/check +++ b/tests/qemu-iotests/check @@ -XXX,XX +XXX,XX @@ export QEMU_PROG="$(type -p "$QEMU_PROG")" case "$QEMU_PROG" in *qemu-system-arm|*qemu-system-aarch64) - export QEMU_OPTIONS="-nodefaults -display none -machine virt,accel=qtest" + export QEMU_OPTIONS="-nodefaults -display none -machine virt -accel qtest" ;; *qemu-system-tricore) - export QEMU_OPTIONS="-nodefaults -display none -machine tricore_testboard,accel=qtest" + export QEMU_OPTIONS="-nodefaults -display none -machine tricore_testboard -accel qtest" ;; *) - export QEMU_OPTIONS="-nodefaults -display none -machine accel=qtest" + export QEMU_OPTIONS="-nodefaults -display none -accel qtest" ;; esac -- 2.24.1 When dropping backup-top, we need to drain the node before freeing the BlockCopyState. Otherwise, requests may still be in flight and then the assertion in shres_destroy() will fail. (This becomes visible in intermittent failure of 056.) Cc: qemu-stable@nongnu.org Signed-off-by: Max Reitz <mreitz@redhat.com> Message-id: 20191219182638.104621-1-mreitz@redhat.com Signed-off-by: Max Reitz <mreitz@redhat.com> --- block/backup-top.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/block/backup-top.c b/block/backup-top.c index XXXXXXX..XXXXXXX 100644 --- a/block/backup-top.c +++ b/block/backup-top.c @@ -XXX,XX +XXX,XX @@ void bdrv_backup_top_drop(BlockDriverState *bs) BDRVBackupTopState *s = bs->opaque; AioContext *aio_context = bdrv_get_aio_context(bs); - block_copy_state_free(s->bcs); - aio_context_acquire(aio_context); bdrv_drained_begin(bs); + block_copy_state_free(s->bcs); + s->active = false; bdrv_child_refresh_perms(bs, bs->backing, &error_abort); bdrv_replace_node(bs, backing_bs(bs), &error_abort); -- 2.24.1 The following changes since commit 9ac5df20f51fabcba0d902025df4bd7ea987c158: Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20200221-1' into staging (2020-02-21 16:18:38 +0000) are available in the Git repository at: https://github.com/stefanha/qemu.git tags/block-pull-request for you to fetch changes up to e5c59355ae9f724777c61c859292ec9db2c8c2ab: fuzz: add documentation to docs/devel/ (2020-02-22 08:26:48 +0000) ---------------------------------------------------------------- Pull request This pull request contains a virtio-blk/scsi performance optimization, event loop scalability improvements, and a qtest-based device fuzzing framework. I am including the fuzzing patches because I have reviewed them and Thomas Huth is currently away on leave. ---------------------------------------------------------------- Alexander Bulekov (22): softmmu: move vl.c to softmmu/ softmmu: split off vl.c:main() into main.c module: check module wasn't already initialized fuzz: add FUZZ_TARGET module type qtest: add qtest_server_send abstraction libqtest: add a layer of abstraction to send/recv libqtest: make bufwrite rely on the TransportOps qtest: add in-process incoming command handler libqos: rename i2c_send and i2c_recv libqos: split qos-test and libqos makefile vars libqos: move useful qos-test funcs to qos_external fuzz: add fuzzer skeleton exec: keep ram block across fork when using qtest main: keep rcu_atfork callback enabled for qtest fuzz: support for fork-based fuzzing. fuzz: add support for qos-assisted fuzz targets fuzz: add target/fuzz makefile rules fuzz: add configure flag --enable-fuzzing fuzz: add i440fx fuzz targets fuzz: add virtio-net fuzz target fuzz: add virtio-scsi fuzz target fuzz: add documentation to docs/devel/ Denis Plotnikov (1): virtio: increase virtqueue size for virtio-scsi and virtio-blk Paolo Bonzini (1): rcu_queue: add QSLIST functions Stefan Hajnoczi (7): aio-posix: avoid reacquiring rcu_read_lock() when polling util/async: make bh_aio_poll() O(1) aio-posix: fix use after leaving scope in aio_poll() aio-posix: don't pass ns timeout to epoll_wait() qemu/queue.h: add QLIST_SAFE_REMOVE() aio-posix: make AioHandler deletion O(1) aio-posix: make AioHandler dispatch O(1) with epoll MAINTAINERS | 11 +- Makefile | 15 +- Makefile.objs | 2 - Makefile.target | 19 ++- block.c | 5 +- chardev/spice.c | 4 +- configure | 39 +++++ docs/devel/fuzzing.txt | 116 ++++++++++++++ exec.c | 12 +- hw/block/virtio-blk.c | 2 +- hw/core/machine.c | 2 + hw/scsi/virtio-scsi.c | 2 +- include/block/aio.h | 26 ++- include/qemu/module.h | 4 +- include/qemu/queue.h | 32 +++- include/qemu/rcu_queue.h | 47 ++++++ include/sysemu/qtest.h | 4 + include/sysemu/sysemu.h | 4 + qtest.c | 31 +++- scripts/checkpatch.pl | 2 +- scripts/get_maintainer.pl | 3 +- softmmu/Makefile.objs | 3 + softmmu/main.c | 53 +++++++ vl.c => softmmu/vl.c | 48 +++--- tests/Makefile.include | 2 + tests/qtest/Makefile.include | 72 +++++---- tests/qtest/fuzz/Makefile.include | 18 +++ tests/qtest/fuzz/fork_fuzz.c | 55 +++++++ tests/qtest/fuzz/fork_fuzz.h | 23 +++ tests/qtest/fuzz/fork_fuzz.ld | 37 +++++ tests/qtest/fuzz/fuzz.c | 179 +++++++++++++++++++++ tests/qtest/fuzz/fuzz.h | 95 +++++++++++ tests/qtest/fuzz/i440fx_fuzz.c | 193 ++++++++++++++++++++++ tests/qtest/fuzz/qos_fuzz.c | 234 +++++++++++++++++++++++++++ tests/qtest/fuzz/qos_fuzz.h | 33 ++++ tests/qtest/fuzz/virtio_net_fuzz.c | 198 +++++++++++++++++++++++ tests/qtest/fuzz/virtio_scsi_fuzz.c | 213 +++++++++++++++++++++++++ tests/qtest/libqos/i2c.c | 10 +- tests/qtest/libqos/i2c.h | 4 +- tests/qtest/libqos/qos_external.c | 168 ++++++++++++++++++++ tests/qtest/libqos/qos_external.h | 28 ++++ tests/qtest/libqtest.c | 119 ++++++++++++-- tests/qtest/libqtest.h | 4 + tests/qtest/pca9552-test.c | 10 +- tests/qtest/qos-test.c | 132 +--------------- tests/test-aio.c | 3 +- tests/test-rcu-list.c | 16 ++ tests/test-rcu-slist.c | 2 + util/aio-posix.c | 187 +++++++++++++++------- util/async.c | 237 ++++++++++++++++------------ util/module.c | 7 + 51 files changed, 2365 insertions(+), 400 deletions(-) create mode 100644 docs/devel/fuzzing.txt create mode 100644 softmmu/Makefile.objs create mode 100644 softmmu/main.c rename vl.c => softmmu/vl.c (99%) create mode 100644 tests/qtest/fuzz/Makefile.include create mode 100644 tests/qtest/fuzz/fork_fuzz.c create mode 100644 tests/qtest/fuzz/fork_fuzz.h create mode 100644 tests/qtest/fuzz/fork_fuzz.ld create mode 100644 tests/qtest/fuzz/fuzz.c create mode 100644 tests/qtest/fuzz/fuzz.h create mode 100644 tests/qtest/fuzz/i440fx_fuzz.c create mode 100644 tests/qtest/fuzz/qos_fuzz.c create mode 100644 tests/qtest/fuzz/qos_fuzz.h create mode 100644 tests/qtest/fuzz/virtio_net_fuzz.c create mode 100644 tests/qtest/fuzz/virtio_scsi_fuzz.c create mode 100644 tests/qtest/libqos/qos_external.c create mode 100644 tests/qtest/libqos/qos_external.h create mode 100644 tests/test-rcu-slist.c -- 2.24.1 From: Denis Plotnikov <dplotnikov@virtuozzo.com> The goal is to reduce the amount of requests issued by a guest on 1M reads/writes. This rises the performance up to 4% on that kind of disk access pattern. The maximum chunk size to be used for the guest disk accessing is limited with seg_max parameter, which represents the max amount of pices in the scatter-geather list in one guest disk request. Since seg_max is virqueue_size dependent, increasing the virtqueue size increases seg_max, which, in turn, increases the maximum size of data to be read/write from a guest disk. More details in the original problem statment: https://lists.gnu.org/archive/html/qemu-devel/2017-12/msg03721.html Suggested-by: Denis V. Lunev <den@openvz.org> Signed-off-by: Denis Plotnikov <dplotnikov@virtuozzo.com> Message-id: 20200214074648.958-1-dplotnikov@virtuozzo.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- hw/block/virtio-blk.c | 2 +- hw/core/machine.c | 2 ++ hw/scsi/virtio-scsi.c | 2 +- 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c index XXXXXXX..XXXXXXX 100644 --- a/hw/block/virtio-blk.c +++ b/hw/block/virtio-blk.c @@ -XXX,XX +XXX,XX @@ static Property virtio_blk_properties[] = { DEFINE_PROP_BIT("request-merging", VirtIOBlock, conf.request_merging, 0, true), DEFINE_PROP_UINT16("num-queues", VirtIOBlock, conf.num_queues, 1), - DEFINE_PROP_UINT16("queue-size", VirtIOBlock, conf.queue_size, 128), + DEFINE_PROP_UINT16("queue-size", VirtIOBlock, conf.queue_size, 256), DEFINE_PROP_BOOL("seg-max-adjust", VirtIOBlock, conf.seg_max_adjust, true), DEFINE_PROP_LINK("iothread", VirtIOBlock, conf.iothread, TYPE_IOTHREAD, IOThread *), diff --git a/hw/core/machine.c b/hw/core/machine.c index XXXXXXX..XXXXXXX 100644 --- a/hw/core/machine.c +++ b/hw/core/machine.c @@ -XXX,XX +XXX,XX @@ #include "hw/mem/nvdimm.h" GlobalProperty hw_compat_4_2[] = { + { "virtio-blk-device", "queue-size", "128"}, + { "virtio-scsi-device", "virtqueue_size", "128"}, { "virtio-blk-device", "x-enable-wce-if-config-wce", "off" }, { "virtio-blk-device", "seg-max-adjust", "off"}, { "virtio-scsi-device", "seg_max_adjust", "off"}, diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c index XXXXXXX..XXXXXXX 100644 --- a/hw/scsi/virtio-scsi.c +++ b/hw/scsi/virtio-scsi.c @@ -XXX,XX +XXX,XX @@ static void virtio_scsi_device_unrealize(DeviceState *dev, Error **errp) static Property virtio_scsi_properties[] = { DEFINE_PROP_UINT32("num_queues", VirtIOSCSI, parent_obj.conf.num_queues, 1), DEFINE_PROP_UINT32("virtqueue_size", VirtIOSCSI, - parent_obj.conf.virtqueue_size, 128), + parent_obj.conf.virtqueue_size, 256), DEFINE_PROP_BOOL("seg_max_adjust", VirtIOSCSI, parent_obj.conf.seg_max_adjust, true), DEFINE_PROP_UINT32("max_sectors", VirtIOSCSI, parent_obj.conf.max_sectors, -- 2.24.1 The first rcu_read_lock/unlock() is expensive. Nested calls are cheap. This optimization increases IOPS from 73k to 162k with a Linux guest that has 2 virtio-blk,num-queues=1 and 99 virtio-blk,num-queues=32 devices. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 20200218182708.914552-1-stefanha@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- util/aio-posix.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/util/aio-posix.c b/util/aio-posix.c index XXXXXXX..XXXXXXX 100644 --- a/util/aio-posix.c +++ b/util/aio-posix.c @@ -XXX,XX +XXX,XX @@ #include "qemu/osdep.h" #include "block/block.h" +#include "qemu/rcu.h" #include "qemu/rcu_queue.h" #include "qemu/sockets.h" #include "qemu/cutils.h" @@ -XXX,XX +XXX,XX @@ static bool run_poll_handlers_once(AioContext *ctx, int64_t *timeout) bool progress = false; AioHandler *node; + /* + * Optimization: ->io_poll() handlers often contain RCU read critical + * sections and we therefore see many rcu_read_lock() -> rcu_read_unlock() + * -> rcu_read_lock() -> ... sequences with expensive memory + * synchronization primitives. Make the entire polling loop an RCU + * critical section because nested rcu_read_lock()/rcu_read_unlock() calls + * are cheap. + */ + RCU_READ_LOCK_GUARD(); + QLIST_FOREACH_RCU(node, &ctx->aio_handlers, node) { if (!node->deleted && node->io_poll && aio_node_check(ctx, node->is_external) && -- 2.24.1 From: Paolo Bonzini <pbonzini@redhat.com> QSLIST is the only family of lists for which we do not have RCU-friendly accessors, add them. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20200220103828.24525-1-pbonzini@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- include/qemu/queue.h | 15 +++++++++++-- include/qemu/rcu_queue.h | 47 ++++++++++++++++++++++++++++++++++++++++ tests/Makefile.include | 2 ++ tests/test-rcu-list.c | 16 ++++++++++++++ tests/test-rcu-slist.c | 2 ++ 5 files changed, 80 insertions(+), 2 deletions(-) create mode 100644 tests/test-rcu-slist.c diff --git a/include/qemu/queue.h b/include/qemu/queue.h index XXXXXXX..XXXXXXX 100644 --- a/include/qemu/queue.h +++ b/include/qemu/queue.h @@ -XXX,XX +XXX,XX @@ struct { \ (head)->slh_first = (head)->slh_first->field.sle_next; \ } while (/*CONSTCOND*/0) -#define QSLIST_REMOVE_AFTER(slistelm, field) do { \ +#define QSLIST_REMOVE_AFTER(slistelm, field) do { \ (slistelm)->field.sle_next = \ - QSLIST_NEXT(QSLIST_NEXT((slistelm), field), field); \ + QSLIST_NEXT(QSLIST_NEXT((slistelm), field), field); \ +} while (/*CONSTCOND*/0) + +#define QSLIST_REMOVE(head, elm, type, field) do { \ + if ((head)->slh_first == (elm)) { \ + QSLIST_REMOVE_HEAD((head), field); \ + } else { \ + struct type *curelm = (head)->slh_first; \ + while (curelm->field.sle_next != (elm)) \ + curelm = curelm->field.sle_next; \ + curelm->field.sle_next = curelm->field.sle_next->field.sle_next; \ + } \ } while (/*CONSTCOND*/0) #define QSLIST_FOREACH(var, head, field) \ diff --git a/include/qemu/rcu_queue.h b/include/qemu/rcu_queue.h index XXXXXXX..XXXXXXX 100644 --- a/include/qemu/rcu_queue.h +++ b/include/qemu/rcu_queue.h @@ -XXX,XX +XXX,XX @@ extern "C" { (var) && ((next) = atomic_rcu_read(&(var)->field.tqe_next), 1); \ (var) = (next)) +/* + * RCU singly-linked list + */ + +/* Singly-linked list access methods */ +#define QSLIST_EMPTY_RCU(head) (atomic_read(&(head)->slh_first) == NULL) +#define QSLIST_FIRST_RCU(head) atomic_rcu_read(&(head)->slh_first) +#define QSLIST_NEXT_RCU(elm, field) atomic_rcu_read(&(elm)->field.sle_next) + +/* Singly-linked list functions */ +#define QSLIST_INSERT_HEAD_RCU(head, elm, field) do { \ + (elm)->field.sle_next = (head)->slh_first; \ + atomic_rcu_set(&(head)->slh_first, (elm)); \ +} while (/*CONSTCOND*/0) + +#define QSLIST_INSERT_AFTER_RCU(head, listelm, elm, field) do { \ + (elm)->field.sle_next = (listelm)->field.sle_next; \ + atomic_rcu_set(&(listelm)->field.sle_next, (elm)); \ +} while (/*CONSTCOND*/0) + +#define QSLIST_REMOVE_HEAD_RCU(head, field) do { \ + atomic_set(&(head)->slh_first, (head)->slh_first->field.sle_next); \ +} while (/*CONSTCOND*/0) + +#define QSLIST_REMOVE_RCU(head, elm, type, field) do { \ + if ((head)->slh_first == (elm)) { \ + QSLIST_REMOVE_HEAD_RCU((head), field); \ + } else { \ + struct type *curr = (head)->slh_first; \ + while (curr->field.sle_next != (elm)) { \ + curr = curr->field.sle_next; \ + } \ + atomic_set(&curr->field.sle_next, \ + curr->field.sle_next->field.sle_next); \ + } \ +} while (/*CONSTCOND*/0) + +#define QSLIST_FOREACH_RCU(var, head, field) \ + for ((var) = atomic_rcu_read(&(head)->slh_first); \ + (var); \ + (var) = atomic_rcu_read(&(var)->field.sle_next)) + +#define QSLIST_FOREACH_SAFE_RCU(var, head, field, next) \ + for ((var) = atomic_rcu_read(&(head)->slh_first); \ + (var) && ((next) = atomic_rcu_read(&(var)->field.sle_next), 1); \ + (var) = (next)) + #ifdef __cplusplus } #endif diff --git a/tests/Makefile.include b/tests/Makefile.include index XXXXXXX..XXXXXXX 100644 --- a/tests/Makefile.include +++ b/tests/Makefile.include @@ -XXX,XX +XXX,XX @@ check-unit-y += tests/rcutorture$(EXESUF) check-unit-y += tests/test-rcu-list$(EXESUF) check-unit-y += tests/test-rcu-simpleq$(EXESUF) check-unit-y += tests/test-rcu-tailq$(EXESUF) +check-unit-y += tests/test-rcu-slist$(EXESUF) check-unit-y += tests/test-qdist$(EXESUF) check-unit-y += tests/test-qht$(EXESUF) check-unit-y += tests/test-qht-par$(EXESUF) @@ -XXX,XX +XXX,XX @@ tests/rcutorture$(EXESUF): tests/rcutorture.o $(test-util-obj-y) tests/test-rcu-list$(EXESUF): tests/test-rcu-list.o $(test-util-obj-y) tests/test-rcu-simpleq$(EXESUF): tests/test-rcu-simpleq.o $(test-util-obj-y) tests/test-rcu-tailq$(EXESUF): tests/test-rcu-tailq.o $(test-util-obj-y) +tests/test-rcu-slist$(EXESUF): tests/test-rcu-slist.o $(test-util-obj-y) tests/test-qdist$(EXESUF): tests/test-qdist.o $(test-util-obj-y) tests/test-qht$(EXESUF): tests/test-qht.o $(test-util-obj-y) tests/test-qht-par$(EXESUF): tests/test-qht-par.o tests/qht-bench$(EXESUF) $(test-util-obj-y) diff --git a/tests/test-rcu-list.c b/tests/test-rcu-list.c index XXXXXXX..XXXXXXX 100644 --- a/tests/test-rcu-list.c +++ b/tests/test-rcu-list.c @@ -XXX,XX +XXX,XX @@ struct list_element { QSIMPLEQ_ENTRY(list_element) entry; #elif TEST_LIST_TYPE == 3 QTAILQ_ENTRY(list_element) entry; +#elif TEST_LIST_TYPE == 4 + QSLIST_ENTRY(list_element) entry; #else #error Invalid TEST_LIST_TYPE #endif @@ -XXX,XX +XXX,XX @@ static QTAILQ_HEAD(, list_element) Q_list_head; #define TEST_LIST_INSERT_HEAD_RCU QTAILQ_INSERT_HEAD_RCU #define TEST_LIST_FOREACH_RCU QTAILQ_FOREACH_RCU #define TEST_LIST_FOREACH_SAFE_RCU QTAILQ_FOREACH_SAFE_RCU + +#elif TEST_LIST_TYPE == 4 +static QSLIST_HEAD(, list_element) Q_list_head; + +#define TEST_NAME "qslist" +#define TEST_LIST_REMOVE_RCU(el, f) \ + QSLIST_REMOVE_RCU(&Q_list_head, el, list_element, f) + +#define TEST_LIST_INSERT_AFTER_RCU(list_el, el, f) \ + QSLIST_INSERT_AFTER_RCU(&Q_list_head, list_el, el, f) + +#define TEST_LIST_INSERT_HEAD_RCU QSLIST_INSERT_HEAD_RCU +#define TEST_LIST_FOREACH_RCU QSLIST_FOREACH_RCU +#define TEST_LIST_FOREACH_SAFE_RCU QSLIST_FOREACH_SAFE_RCU #else #error Invalid TEST_LIST_TYPE #endif diff --git a/tests/test-rcu-slist.c b/tests/test-rcu-slist.c new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/tests/test-rcu-slist.c @@ -XXX,XX +XXX,XX @@ +#define TEST_LIST_TYPE 4 +#include "test-rcu-list.c" -- 2.24.1 The ctx->first_bh list contains all created BHs, including those that are not scheduled. The list is iterated by the event loop and therefore has O(n) time complexity with respected to the number of created BHs. Rewrite BHs so that only scheduled or deleted BHs are enqueued. Only BHs that actually require action will be iterated. One semantic change is required: qemu_bh_delete() enqueues the BH and therefore invokes aio_notify(). The tests/test-aio.c:test_source_bh_delete_from_cb() test case assumed that g_main_context_iteration(NULL, false) returns false after qemu_bh_delete() but it now returns true for one iteration. Fix up the test case. This patch makes aio_compute_timeout() and aio_bh_poll() drop from a CPU profile reported by perf-top(1). Previously they combined to 9% CPU utilization when AioContext polling is commented out and the guest has 2 virtio-blk,num-queues=1 and 99 virtio-blk,num-queues=32 devices. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 20200221093951.1414693-1-stefanha@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- include/block/aio.h | 20 +++- tests/test-aio.c | 3 +- util/async.c | 237 ++++++++++++++++++++++++++------------------ 3 files changed, 158 insertions(+), 102 deletions(-) diff --git a/include/block/aio.h b/include/block/aio.h index XXXXXXX..XXXXXXX 100644 --- a/include/block/aio.h +++ b/include/block/aio.h @@ -XXX,XX +XXX,XX @@ struct ThreadPool; struct LinuxAioState; struct LuringState; +/* + * Each aio_bh_poll() call carves off a slice of the BH list, so that newly + * scheduled BHs are not processed until the next aio_bh_poll() call. All + * active aio_bh_poll() calls chain their slices together in a list, so that + * nested aio_bh_poll() calls process all scheduled bottom halves. + */ +typedef QSLIST_HEAD(, QEMUBH) BHList; +typedef struct BHListSlice BHListSlice; +struct BHListSlice { + BHList bh_list; + QSIMPLEQ_ENTRY(BHListSlice) next; +}; + struct AioContext { GSource source; @@ -XXX,XX +XXX,XX @@ struct AioContext { */ QemuLockCnt list_lock; - /* Anchor of the list of Bottom Halves belonging to the context */ - struct QEMUBH *first_bh; + /* Bottom Halves pending aio_bh_poll() processing */ + BHList bh_list; + + /* Chained BH list slices for each nested aio_bh_poll() call */ + QSIMPLEQ_HEAD(, BHListSlice) bh_slice_list; /* Used by aio_notify. * diff --git a/tests/test-aio.c b/tests/test-aio.c index XXXXXXX..XXXXXXX 100644 --- a/tests/test-aio.c +++ b/tests/test-aio.c @@ -XXX,XX +XXX,XX @@ static void test_source_bh_delete_from_cb(void) g_assert_cmpint(data1.n, ==, data1.max); g_assert(data1.bh == NULL); - g_assert(!g_main_context_iteration(NULL, false)); + assert(g_main_context_iteration(NULL, false)); + assert(!g_main_context_iteration(NULL, false)); } static void test_source_bh_delete_from_cb_many(void) diff --git a/util/async.c b/util/async.c index XXXXXXX..XXXXXXX 100644 --- a/util/async.c +++ b/util/async.c @@ -XXX,XX +XXX,XX @@ #include "block/thread-pool.h" #include "qemu/main-loop.h" #include "qemu/atomic.h" +#include "qemu/rcu_queue.h" #include "block/raw-aio.h" #include "qemu/coroutine_int.h" #include "trace.h" @@ -XXX,XX +XXX,XX @@ /***********************************************************/ /* bottom halves (can be seen as timers which expire ASAP) */ +/* QEMUBH::flags values */ +enum { + /* Already enqueued and waiting for aio_bh_poll() */ + BH_PENDING = (1 << 0), + + /* Invoke the callback */ + BH_SCHEDULED = (1 << 1), + + /* Delete without invoking callback */ + BH_DELETED = (1 << 2), + + /* Delete after invoking callback */ + BH_ONESHOT = (1 << 3), + + /* Schedule periodically when the event loop is idle */ + BH_IDLE = (1 << 4), +}; + struct QEMUBH { AioContext *ctx; QEMUBHFunc *cb; void *opaque; - QEMUBH *next; - bool scheduled; - bool idle; - bool deleted; + QSLIST_ENTRY(QEMUBH) next; + unsigned flags; }; +/* Called concurrently from any thread */ +static void aio_bh_enqueue(QEMUBH *bh, unsigned new_flags) +{ + AioContext *ctx = bh->ctx; + unsigned old_flags; + + /* + * The memory barrier implicit in atomic_fetch_or makes sure that: + * 1. idle & any writes needed by the callback are done before the + * locations are read in the aio_bh_poll. + * 2. ctx is loaded before the callback has a chance to execute and bh + * could be freed. + */ + old_flags = atomic_fetch_or(&bh->flags, BH_PENDING | new_flags); + if (!(old_flags & BH_PENDING)) { + QSLIST_INSERT_HEAD_ATOMIC(&ctx->bh_list, bh, next); + } + + aio_notify(ctx); +} + +/* Only called from aio_bh_poll() and aio_ctx_finalize() */ +static QEMUBH *aio_bh_dequeue(BHList *head, unsigned *flags) +{ + QEMUBH *bh = QSLIST_FIRST_RCU(head); + + if (!bh) { + return NULL; + } + + QSLIST_REMOVE_HEAD(head, next); + + /* + * The atomic_and is paired with aio_bh_enqueue(). The implicit memory + * barrier ensures that the callback sees all writes done by the scheduling + * thread. It also ensures that the scheduling thread sees the cleared + * flag before bh->cb has run, and thus will call aio_notify again if + * necessary. + */ + *flags = atomic_fetch_and(&bh->flags, + ~(BH_PENDING | BH_SCHEDULED | BH_IDLE)); + return bh; +} + void aio_bh_schedule_oneshot(AioContext *ctx, QEMUBHFunc *cb, void *opaque) { QEMUBH *bh; @@ -XXX,XX +XXX,XX @@ void aio_bh_schedule_oneshot(AioContext *ctx, QEMUBHFunc *cb, void *opaque) .cb = cb, .opaque = opaque, }; - qemu_lockcnt_lock(&ctx->list_lock); - bh->next = ctx->first_bh; - bh->scheduled = 1; - bh->deleted = 1; - /* Make sure that the members are ready before putting bh into list */ - smp_wmb(); - ctx->first_bh = bh; - qemu_lockcnt_unlock(&ctx->list_lock); - aio_notify(ctx); + aio_bh_enqueue(bh, BH_SCHEDULED | BH_ONESHOT); } QEMUBH *aio_bh_new(AioContext *ctx, QEMUBHFunc *cb, void *opaque) @@ -XXX,XX +XXX,XX @@ QEMUBH *aio_bh_new(AioContext *ctx, QEMUBHFunc *cb, void *opaque) .cb = cb, .opaque = opaque, }; - qemu_lockcnt_lock(&ctx->list_lock); - bh->next = ctx->first_bh; - /* Make sure that the members are ready before putting bh into list */ - smp_wmb(); - ctx->first_bh = bh; - qemu_lockcnt_unlock(&ctx->list_lock); return bh; } @@ -XXX,XX +XXX,XX @@ void aio_bh_call(QEMUBH *bh) bh->cb(bh->opaque); } -/* Multiple occurrences of aio_bh_poll cannot be called concurrently. - * The count in ctx->list_lock is incremented before the call, and is - * not affected by the call. - */ +/* Multiple occurrences of aio_bh_poll cannot be called concurrently. */ int aio_bh_poll(AioContext *ctx) { - QEMUBH *bh, **bhp, *next; - int ret; - bool deleted = false; - - ret = 0; - for (bh = atomic_rcu_read(&ctx->first_bh); bh; bh = next) { - next = atomic_rcu_read(&bh->next); - /* The atomic_xchg is paired with the one in qemu_bh_schedule. The - * implicit memory barrier ensures that the callback sees all writes - * done by the scheduling thread. It also ensures that the scheduling - * thread sees the zero before bh->cb has run, and thus will call - * aio_notify again if necessary. - */ - if (atomic_xchg(&bh->scheduled, 0)) { + BHListSlice slice; + BHListSlice *s; + int ret = 0; + + QSLIST_MOVE_ATOMIC(&slice.bh_list, &ctx->bh_list); + QSIMPLEQ_INSERT_TAIL(&ctx->bh_slice_list, &slice, next); + + while ((s = QSIMPLEQ_FIRST(&ctx->bh_slice_list))) { + QEMUBH *bh; + unsigned flags; + + bh = aio_bh_dequeue(&s->bh_list, &flags); + if (!bh) { + QSIMPLEQ_REMOVE_HEAD(&ctx->bh_slice_list, next); + continue; + } + + if ((flags & (BH_SCHEDULED | BH_DELETED)) == BH_SCHEDULED) { /* Idle BHs don't count as progress */ - if (!bh->idle) { + if (!(flags & BH_IDLE)) { ret = 1; } - bh->idle = 0; aio_bh_call(bh); } - if (bh->deleted) { - deleted = true; + if (flags & (BH_DELETED | BH_ONESHOT)) { + g_free(bh); } } - /* remove deleted bhs */ - if (!deleted) { - return ret; - } - - if (qemu_lockcnt_dec_if_lock(&ctx->list_lock)) { - bhp = &ctx->first_bh; - while (*bhp) { - bh = *bhp; - if (bh->deleted && !bh->scheduled) { - *bhp = bh->next; - g_free(bh); - } else { - bhp = &bh->next; - } - } - qemu_lockcnt_inc_and_unlock(&ctx->list_lock); - } return ret; } void qemu_bh_schedule_idle(QEMUBH *bh) { - bh->idle = 1; - /* Make sure that idle & any writes needed by the callback are done - * before the locations are read in the aio_bh_poll. - */ - atomic_mb_set(&bh->scheduled, 1); + aio_bh_enqueue(bh, BH_SCHEDULED | BH_IDLE); } void qemu_bh_schedule(QEMUBH *bh) { - AioContext *ctx; - - ctx = bh->ctx; - bh->idle = 0; - /* The memory barrier implicit in atomic_xchg makes sure that: - * 1. idle & any writes needed by the callback are done before the - * locations are read in the aio_bh_poll. - * 2. ctx is loaded before scheduled is set and the callback has a chance - * to execute. - */ - if (atomic_xchg(&bh->scheduled, 1) == 0) { - aio_notify(ctx); - } + aio_bh_enqueue(bh, BH_SCHEDULED); } - /* This func is async. */ void qemu_bh_cancel(QEMUBH *bh) { - atomic_mb_set(&bh->scheduled, 0); + atomic_and(&bh->flags, ~BH_SCHEDULED); } /* This func is async.The bottom half will do the delete action at the finial @@ -XXX,XX +XXX,XX @@ void qemu_bh_cancel(QEMUBH *bh) */ void qemu_bh_delete(QEMUBH *bh) { - bh->scheduled = 0; - bh->deleted = 1; + aio_bh_enqueue(bh, BH_DELETED); } -int64_t -aio_compute_timeout(AioContext *ctx) +static int64_t aio_compute_bh_timeout(BHList *head, int timeout) { - int64_t deadline; - int timeout = -1; QEMUBH *bh; - for (bh = atomic_rcu_read(&ctx->first_bh); bh; - bh = atomic_rcu_read(&bh->next)) { - if (bh->scheduled) { - if (bh->idle) { + QSLIST_FOREACH_RCU(bh, head, next) { + if ((bh->flags & (BH_SCHEDULED | BH_DELETED)) == BH_SCHEDULED) { + if (bh->flags & BH_IDLE) { /* idle bottom halves will be polled at least * every 10ms */ timeout = 10000000; @@ -XXX,XX +XXX,XX @@ aio_compute_timeout(AioContext *ctx) } } + return timeout; +} + +int64_t +aio_compute_timeout(AioContext *ctx) +{ + BHListSlice *s; + int64_t deadline; + int timeout = -1; + + timeout = aio_compute_bh_timeout(&ctx->bh_list, timeout); + if (timeout == 0) { + return 0; + } + + QSIMPLEQ_FOREACH(s, &ctx->bh_slice_list, next) { + timeout = aio_compute_bh_timeout(&s->bh_list, timeout); + if (timeout == 0) { + return 0; + } + } + deadline = timerlistgroup_deadline_ns(&ctx->tlg); if (deadline == 0) { return 0; @@ -XXX,XX +XXX,XX @@ aio_ctx_check(GSource *source) { AioContext *ctx = (AioContext *) source; QEMUBH *bh; + BHListSlice *s; atomic_and(&ctx->notify_me, ~1); aio_notify_accept(ctx); - for (bh = ctx->first_bh; bh; bh = bh->next) { - if (bh->scheduled) { + QSLIST_FOREACH_RCU(bh, &ctx->bh_list, next) { + if ((bh->flags & (BH_SCHEDULED | BH_DELETED)) == BH_SCHEDULED) { return true; } } + + QSIMPLEQ_FOREACH(s, &ctx->bh_slice_list, next) { + QSLIST_FOREACH_RCU(bh, &s->bh_list, next) { + if ((bh->flags & (BH_SCHEDULED | BH_DELETED)) == BH_SCHEDULED) { + return true; + } + } + } return aio_pending(ctx) || (timerlistgroup_deadline_ns(&ctx->tlg) == 0); } @@ -XXX,XX +XXX,XX @@ static void aio_ctx_finalize(GSource *source) { AioContext *ctx = (AioContext *) source; + QEMUBH *bh; + unsigned flags; thread_pool_free(ctx->thread_pool); @@ -XXX,XX +XXX,XX @@ aio_ctx_finalize(GSource *source) assert(QSLIST_EMPTY(&ctx->scheduled_coroutines)); qemu_bh_delete(ctx->co_schedule_bh); - qemu_lockcnt_lock(&ctx->list_lock); - assert(!qemu_lockcnt_count(&ctx->list_lock)); - while (ctx->first_bh) { - QEMUBH *next = ctx->first_bh->next; + /* There must be no aio_bh_poll() calls going on */ + assert(QSIMPLEQ_EMPTY(&ctx->bh_slice_list)); + while ((bh = aio_bh_dequeue(&ctx->bh_list, &flags))) { /* qemu_bh_delete() must have been called on BHs in this AioContext */ - assert(ctx->first_bh->deleted); + assert(flags & BH_DELETED); - g_free(ctx->first_bh); - ctx->first_bh = next; + g_free(bh); } - qemu_lockcnt_unlock(&ctx->list_lock); aio_set_event_notifier(ctx, &ctx->notifier, false, NULL, NULL); event_notifier_cleanup(&ctx->notifier); @@ -XXX,XX +XXX,XX @@ AioContext *aio_context_new(Error **errp) AioContext *ctx; ctx = (AioContext *) g_source_new(&aio_source_funcs, sizeof(AioContext)); + QSLIST_INIT(&ctx->bh_list); + QSIMPLEQ_INIT(&ctx->bh_slice_list); aio_context_setup(ctx); ret = event_notifier_init(&ctx->notifier, false); -- 2.24.1 epoll_handler is a stack variable and must not be accessed after it goes out of scope: if (aio_epoll_check_poll(ctx, pollfds, npfd, timeout)) { AioHandler epoll_handler; ... add_pollfd(&epoll_handler); ret = aio_epoll(ctx, pollfds, npfd, timeout); } ... ... /* if we have any readable fds, dispatch event */ if (ret > 0) { for (i = 0; i < npfd; i++) { nodes[i]->pfd.revents = pollfds[i].revents; } } nodes[0] is &epoll_handler, which has already gone out of scope. There is no need to use pollfds[] for epoll. We don't need an AioHandler for the epoll fd. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Sergio Lopez <slp@redhat.com> Message-id: 20200214171712.541358-2-stefanha@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- util/aio-posix.c | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-) diff --git a/util/aio-posix.c b/util/aio-posix.c index XXXXXXX..XXXXXXX 100644 --- a/util/aio-posix.c +++ b/util/aio-posix.c @@ -XXX,XX +XXX,XX @@ static void aio_epoll_update(AioContext *ctx, AioHandler *node, bool is_new) } } -static int aio_epoll(AioContext *ctx, GPollFD *pfds, - unsigned npfd, int64_t timeout) +static int aio_epoll(AioContext *ctx, int64_t timeout) { + GPollFD pfd = { + .fd = ctx->epollfd, + .events = G_IO_IN | G_IO_OUT | G_IO_HUP | G_IO_ERR, + }; AioHandler *node; int i, ret = 0; struct epoll_event events[128]; - assert(npfd == 1); - assert(pfds[0].fd == ctx->epollfd); if (timeout > 0) { - ret = qemu_poll_ns(pfds, npfd, timeout); + ret = qemu_poll_ns(&pfd, 1, timeout); } if (timeout <= 0 || ret > 0) { ret = epoll_wait(ctx->epollfd, events, @@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking) /* wait until next event */ if (aio_epoll_check_poll(ctx, pollfds, npfd, timeout)) { - AioHandler epoll_handler; - - epoll_handler.pfd.fd = ctx->epollfd; - epoll_handler.pfd.events = G_IO_IN | G_IO_OUT | G_IO_HUP | G_IO_ERR; - npfd = 0; - add_pollfd(&epoll_handler); - ret = aio_epoll(ctx, pollfds, npfd, timeout); + npfd = 0; /* pollfds[] is not being used */ + ret = aio_epoll(ctx, timeout); } else { ret = qemu_poll_ns(pollfds, npfd, timeout); } -- 2.24.1 Don't pass the nanosecond timeout into epoll_wait(), which expects milliseconds. The epoll_wait() timeout value does not matter if qemu_poll_ns() determined that the poll fd is ready, but passing a value in the wrong units is still ugly. Pass a 0 timeout to epoll_wait() instead. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Sergio Lopez <slp@redhat.com> Message-id: 20200214171712.541358-3-stefanha@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- util/aio-posix.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/util/aio-posix.c b/util/aio-posix.c index XXXXXXX..XXXXXXX 100644 --- a/util/aio-posix.c +++ b/util/aio-posix.c @@ -XXX,XX +XXX,XX @@ static int aio_epoll(AioContext *ctx, int64_t timeout) if (timeout > 0) { ret = qemu_poll_ns(&pfd, 1, timeout); + if (ret > 0) { + timeout = 0; + } } if (timeout <= 0 || ret > 0) { ret = epoll_wait(ctx->epollfd, events, -- 2.24.1 QLIST_REMOVE() assumes the element is in a list. It also leaves the element's linked list pointers dangling. Introduce a safe version of QLIST_REMOVE() and convert open-coded instances of this pattern. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Sergio Lopez <slp@redhat.com> Message-id: 20200214171712.541358-4-stefanha@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- block.c | 5 +---- chardev/spice.c | 4 +--- include/qemu/queue.h | 14 ++++++++++++++ 3 files changed, 16 insertions(+), 7 deletions(-) diff --git a/block.c b/block.c index XXXXXXX..XXXXXXX 100644 --- a/block.c +++ b/block.c @@ -XXX,XX +XXX,XX @@ BdrvChild *bdrv_attach_child(BlockDriverState *parent_bs, static void bdrv_detach_child(BdrvChild *child) { - if (child->next.le_prev) { - QLIST_REMOVE(child, next); - child->next.le_prev = NULL; - } + QLIST_SAFE_REMOVE(child, next); bdrv_replace_child(child, NULL); diff --git a/chardev/spice.c b/chardev/spice.c index XXXXXXX..XXXXXXX 100644 --- a/chardev/spice.c +++ b/chardev/spice.c @@ -XXX,XX +XXX,XX @@ static void char_spice_finalize(Object *obj) vmc_unregister_interface(s); - if (s->next.le_prev) { - QLIST_REMOVE(s, next); - } + QLIST_SAFE_REMOVE(s, next); g_free((char *)s->sin.subtype); g_free((char *)s->sin.portname); diff --git a/include/qemu/queue.h b/include/qemu/queue.h index XXXXXXX..XXXXXXX 100644 --- a/include/qemu/queue.h +++ b/include/qemu/queue.h @@ -XXX,XX +XXX,XX @@ struct { \ *(elm)->field.le_prev = (elm)->field.le_next; \ } while (/*CONSTCOND*/0) +/* + * Like QLIST_REMOVE() but safe to call when elm is not in a list + */ +#define QLIST_SAFE_REMOVE(elm, field) do { \ + if ((elm)->field.le_prev != NULL) { \ + if ((elm)->field.le_next != NULL) \ + (elm)->field.le_next->field.le_prev = \ + (elm)->field.le_prev; \ + *(elm)->field.le_prev = (elm)->field.le_next; \ + (elm)->field.le_next = NULL; \ + (elm)->field.le_prev = NULL; \ + } \ +} while (/*CONSTCOND*/0) + #define QLIST_FOREACH(var, head, field) \ for ((var) = ((head)->lh_first); \ (var); \ -- 2.24.1 It is not necessary to scan all AioHandlers for deletion. Keep a list of deleted handlers instead of scanning the full list of all handlers. The AioHandler->deleted field can be dropped. Let's check if the handler has been inserted into the deleted list instead. Add a new QLIST_IS_INSERTED() API for this check. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Sergio Lopez <slp@redhat.com> Message-id: 20200214171712.541358-5-stefanha@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- include/block/aio.h | 6 ++++- include/qemu/queue.h | 3 +++ util/aio-posix.c | 53 +++++++++++++++++++++++++++++--------------- 3 files changed, 43 insertions(+), 19 deletions(-) diff --git a/include/block/aio.h b/include/block/aio.h index XXXXXXX..XXXXXXX 100644 --- a/include/block/aio.h +++ b/include/block/aio.h @@ -XXX,XX +XXX,XX @@ void qemu_aio_unref(void *p); void qemu_aio_ref(void *p); typedef struct AioHandler AioHandler; +typedef QLIST_HEAD(, AioHandler) AioHandlerList; typedef void QEMUBHFunc(void *opaque); typedef bool AioPollFn(void *opaque); typedef void IOHandler(void *opaque); @@ -XXX,XX +XXX,XX @@ struct AioContext { QemuRecMutex lock; /* The list of registered AIO handlers. Protected by ctx->list_lock. */ - QLIST_HEAD(, AioHandler) aio_handlers; + AioHandlerList aio_handlers; + + /* The list of AIO handlers to be deleted. Protected by ctx->list_lock. */ + AioHandlerList deleted_aio_handlers; /* Used to avoid unnecessary event_notifier_set calls in aio_notify; * accessed with atomic primitives. If this field is 0, everything diff --git a/include/qemu/queue.h b/include/qemu/queue.h index XXXXXXX..XXXXXXX 100644 --- a/include/qemu/queue.h +++ b/include/qemu/queue.h @@ -XXX,XX +XXX,XX @@ struct { \ } \ } while (/*CONSTCOND*/0) +/* Is elm in a list? */ +#define QLIST_IS_INSERTED(elm, field) ((elm)->field.le_prev != NULL) + #define QLIST_FOREACH(var, head, field) \ for ((var) = ((head)->lh_first); \ (var); \ diff --git a/util/aio-posix.c b/util/aio-posix.c index XXXXXXX..XXXXXXX 100644 --- a/util/aio-posix.c +++ b/util/aio-posix.c @@ -XXX,XX +XXX,XX @@ struct AioHandler AioPollFn *io_poll; IOHandler *io_poll_begin; IOHandler *io_poll_end; - int deleted; void *opaque; bool is_external; QLIST_ENTRY(AioHandler) node; + QLIST_ENTRY(AioHandler) node_deleted; }; #ifdef CONFIG_EPOLL_CREATE1 @@ -XXX,XX +XXX,XX @@ static bool aio_epoll_try_enable(AioContext *ctx) QLIST_FOREACH_RCU(node, &ctx->aio_handlers, node) { int r; - if (node->deleted || !node->pfd.events) { + if (QLIST_IS_INSERTED(node, node_deleted) || !node->pfd.events) { continue; } event.events = epoll_events_from_pfd(node->pfd.events); @@ -XXX,XX +XXX,XX @@ static AioHandler *find_aio_handler(AioContext *ctx, int fd) AioHandler *node; QLIST_FOREACH(node, &ctx->aio_handlers, node) { - if (node->pfd.fd == fd) - if (!node->deleted) + if (node->pfd.fd == fd) { + if (!QLIST_IS_INSERTED(node, node_deleted)) { return node; + } + } } return NULL; @@ -XXX,XX +XXX,XX @@ static bool aio_remove_fd_handler(AioContext *ctx, AioHandler *node) /* If a read is in progress, just mark the node as deleted */ if (qemu_lockcnt_count(&ctx->list_lock)) { - node->deleted = 1; + QLIST_INSERT_HEAD_RCU(&ctx->deleted_aio_handlers, node, node_deleted); node->pfd.revents = 0; return false; } @@ -XXX,XX +XXX,XX @@ static void poll_set_started(AioContext *ctx, bool started) QLIST_FOREACH_RCU(node, &ctx->aio_handlers, node) { IOHandler *fn; - if (node->deleted) { + if (QLIST_IS_INSERTED(node, node_deleted)) { continue; } @@ -XXX,XX +XXX,XX @@ bool aio_pending(AioContext *ctx) return result; } +static void aio_free_deleted_handlers(AioContext *ctx) +{ + AioHandler *node; + + if (QLIST_EMPTY_RCU(&ctx->deleted_aio_handlers)) { + return; + } + if (!qemu_lockcnt_dec_if_lock(&ctx->list_lock)) { + return; /* we are nested, let the parent do the freeing */ + } + + while ((node = QLIST_FIRST_RCU(&ctx->deleted_aio_handlers))) { + QLIST_REMOVE(node, node); + QLIST_REMOVE(node, node_deleted); + g_free(node); + } + + qemu_lockcnt_inc_and_unlock(&ctx->list_lock); +} + static bool aio_dispatch_handlers(AioContext *ctx) { AioHandler *node, *tmp; @@ -XXX,XX +XXX,XX @@ static bool aio_dispatch_handlers(AioContext *ctx) revents = node->pfd.revents & node->pfd.events; node->pfd.revents = 0; - if (!node->deleted && + if (!QLIST_IS_INSERTED(node, node_deleted) && (revents & (G_IO_IN | G_IO_HUP | G_IO_ERR)) && aio_node_check(ctx, node->is_external) && node->io_read) { @@ -XXX,XX +XXX,XX @@ static bool aio_dispatch_handlers(AioContext *ctx) progress = true; } } - if (!node->deleted && + if (!QLIST_IS_INSERTED(node, node_deleted) && (revents & (G_IO_OUT | G_IO_ERR)) && aio_node_check(ctx, node->is_external) && node->io_write) { node->io_write(node->opaque); progress = true; } - - if (node->deleted) { - if (qemu_lockcnt_dec_if_lock(&ctx->list_lock)) { - QLIST_REMOVE(node, node); - g_free(node); - qemu_lockcnt_inc_and_unlock(&ctx->list_lock); - } - } } return progress; @@ -XXX,XX +XXX,XX @@ void aio_dispatch(AioContext *ctx) qemu_lockcnt_inc(&ctx->list_lock); aio_bh_poll(ctx); aio_dispatch_handlers(ctx); + aio_free_deleted_handlers(ctx); qemu_lockcnt_dec(&ctx->list_lock); timerlistgroup_run_timers(&ctx->tlg); @@ -XXX,XX +XXX,XX @@ static bool run_poll_handlers_once(AioContext *ctx, int64_t *timeout) RCU_READ_LOCK_GUARD(); QLIST_FOREACH_RCU(node, &ctx->aio_handlers, node) { - if (!node->deleted && node->io_poll && + if (!QLIST_IS_INSERTED(node, node_deleted) && node->io_poll && aio_node_check(ctx, node->is_external) && node->io_poll(node->opaque)) { /* @@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking) if (!aio_epoll_enabled(ctx)) { QLIST_FOREACH_RCU(node, &ctx->aio_handlers, node) { - if (!node->deleted && node->pfd.events + if (!QLIST_IS_INSERTED(node, node_deleted) && node->pfd.events && aio_node_check(ctx, node->is_external)) { add_pollfd(node); } @@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking) progress |= aio_dispatch_handlers(ctx); } + aio_free_deleted_handlers(ctx); + qemu_lockcnt_dec(&ctx->list_lock); progress |= timerlistgroup_run_timers(&ctx->tlg); -- 2.24.1 File descriptor monitoring is O(1) with epoll(7), but aio_dispatch_handlers() still scans all AioHandlers instead of dispatching just those that are ready. This makes aio_poll() O(n) with respect to the total number of registered handlers. Add a local ready_list to aio_poll() so that each nested aio_poll() builds a list of handlers ready to be dispatched. Since file descriptor polling is level-triggered, nested aio_poll() calls also see fds that were ready in the parent but not yet dispatched. This guarantees that nested aio_poll() invocations will dispatch all fds, even those that became ready before the nested invocation. Since only handlers ready to be dispatched are placed onto the ready_list, the new aio_dispatch_ready_handlers() function provides O(1) dispatch. Note that AioContext polling is still O(n) and currently cannot be fully disabled. This still needs to be fixed before aio_poll() is fully O(1). Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Sergio Lopez <slp@redhat.com> Message-id: 20200214171712.541358-6-stefanha@redhat.com [Fix compilation error on macOS where there is no epoll(87). The aio_epoll() prototype was out of date and aio_add_ready_list() needed to be moved outside the ifdef. --Stefan] Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- util/aio-posix.c | 110 +++++++++++++++++++++++++++++++++-------------- 1 file changed, 78 insertions(+), 32 deletions(-) diff --git a/util/aio-posix.c b/util/aio-posix.c index XXXXXXX..XXXXXXX 100644 --- a/util/aio-posix.c +++ b/util/aio-posix.c @@ -XXX,XX +XXX,XX @@ struct AioHandler void *opaque; bool is_external; QLIST_ENTRY(AioHandler) node; + QLIST_ENTRY(AioHandler) node_ready; /* only used during aio_poll() */ QLIST_ENTRY(AioHandler) node_deleted; }; +/* Add a handler to a ready list */ +static void add_ready_handler(AioHandlerList *ready_list, + AioHandler *node, + int revents) +{ + QLIST_SAFE_REMOVE(node, node_ready); /* remove from nested parent's list */ + node->pfd.revents = revents; + QLIST_INSERT_HEAD(ready_list, node, node_ready); +} + #ifdef CONFIG_EPOLL_CREATE1 /* The fd number threshold to switch to epoll */ @@ -XXX,XX +XXX,XX @@ static void aio_epoll_update(AioContext *ctx, AioHandler *node, bool is_new) } } -static int aio_epoll(AioContext *ctx, int64_t timeout) +static int aio_epoll(AioContext *ctx, AioHandlerList *ready_list, + int64_t timeout) { GPollFD pfd = { .fd = ctx->epollfd, @@ -XXX,XX +XXX,XX @@ static int aio_epoll(AioContext *ctx, int64_t timeout) } for (i = 0; i < ret; i++) { int ev = events[i].events; + int revents = (ev & EPOLLIN ? G_IO_IN : 0) | + (ev & EPOLLOUT ? G_IO_OUT : 0) | + (ev & EPOLLHUP ? G_IO_HUP : 0) | + (ev & EPOLLERR ? G_IO_ERR : 0); + node = events[i].data.ptr; - node->pfd.revents = (ev & EPOLLIN ? G_IO_IN : 0) | - (ev & EPOLLOUT ? G_IO_OUT : 0) | - (ev & EPOLLHUP ? G_IO_HUP : 0) | - (ev & EPOLLERR ? G_IO_ERR : 0); + add_ready_handler(ready_list, node, revents); } } out: @@ -XXX,XX +XXX,XX @@ static void aio_epoll_update(AioContext *ctx, AioHandler *node, bool is_new) { } -static int aio_epoll(AioContext *ctx, GPollFD *pfds, - unsigned npfd, int64_t timeout) +static int aio_epoll(AioContext *ctx, AioHandlerList *ready_list, + int64_t timeout) { assert(false); } @@ -XXX,XX +XXX,XX @@ static void aio_free_deleted_handlers(AioContext *ctx) qemu_lockcnt_inc_and_unlock(&ctx->list_lock); } -static bool aio_dispatch_handlers(AioContext *ctx) +static bool aio_dispatch_handler(AioContext *ctx, AioHandler *node) { - AioHandler *node, *tmp; bool progress = false; + int revents; - QLIST_FOREACH_SAFE_RCU(node, &ctx->aio_handlers, node, tmp) { - int revents; + revents = node->pfd.revents & node->pfd.events; + node->pfd.revents = 0; - revents = node->pfd.revents & node->pfd.events; - node->pfd.revents = 0; + if (!QLIST_IS_INSERTED(node, node_deleted) && + (revents & (G_IO_IN | G_IO_HUP | G_IO_ERR)) && + aio_node_check(ctx, node->is_external) && + node->io_read) { + node->io_read(node->opaque); - if (!QLIST_IS_INSERTED(node, node_deleted) && - (revents & (G_IO_IN | G_IO_HUP | G_IO_ERR)) && - aio_node_check(ctx, node->is_external) && - node->io_read) { - node->io_read(node->opaque); - - /* aio_notify() does not count as progress */ - if (node->opaque != &ctx->notifier) { - progress = true; - } - } - if (!QLIST_IS_INSERTED(node, node_deleted) && - (revents & (G_IO_OUT | G_IO_ERR)) && - aio_node_check(ctx, node->is_external) && - node->io_write) { - node->io_write(node->opaque); + /* aio_notify() does not count as progress */ + if (node->opaque != &ctx->notifier) { progress = true; } } + if (!QLIST_IS_INSERTED(node, node_deleted) && + (revents & (G_IO_OUT | G_IO_ERR)) && + aio_node_check(ctx, node->is_external) && + node->io_write) { + node->io_write(node->opaque); + progress = true; + } + + return progress; +} + +/* + * If we have a list of ready handlers then this is more efficient than + * scanning all handlers with aio_dispatch_handlers(). + */ +static bool aio_dispatch_ready_handlers(AioContext *ctx, + AioHandlerList *ready_list) +{ + bool progress = false; + AioHandler *node; + + while ((node = QLIST_FIRST(ready_list))) { + QLIST_SAFE_REMOVE(node, node_ready); + progress = aio_dispatch_handler(ctx, node) || progress; + } + + return progress; +} + +/* Slower than aio_dispatch_ready_handlers() but only used via glib */ +static bool aio_dispatch_handlers(AioContext *ctx) +{ + AioHandler *node, *tmp; + bool progress = false; + + QLIST_FOREACH_SAFE_RCU(node, &ctx->aio_handlers, node, tmp) { + progress = aio_dispatch_handler(ctx, node) || progress; + } return progress; } @@ -XXX,XX +XXX,XX @@ static bool try_poll_mode(AioContext *ctx, int64_t *timeout) bool aio_poll(AioContext *ctx, bool blocking) { + AioHandlerList ready_list = QLIST_HEAD_INITIALIZER(ready_list); AioHandler *node; int i; int ret = 0; @@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking) /* wait until next event */ if (aio_epoll_check_poll(ctx, pollfds, npfd, timeout)) { npfd = 0; /* pollfds[] is not being used */ - ret = aio_epoll(ctx, timeout); + ret = aio_epoll(ctx, &ready_list, timeout); } else { ret = qemu_poll_ns(pollfds, npfd, timeout); } @@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking) /* if we have any readable fds, dispatch event */ if (ret > 0) { for (i = 0; i < npfd; i++) { - nodes[i]->pfd.revents = pollfds[i].revents; + int revents = pollfds[i].revents; + + if (revents) { + add_ready_handler(&ready_list, nodes[i], revents); + } } } @@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking) progress |= aio_bh_poll(ctx); if (ret > 0) { - progress |= aio_dispatch_handlers(ctx); + progress |= aio_dispatch_ready_handlers(ctx, &ready_list); } aio_free_deleted_handlers(ctx); -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> Move vl.c to a separate directory, similar to linux-user/ Update the chechpatch and get_maintainer scripts, since they relied on /vl.c for top_of_tree checks. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-2-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- MAINTAINERS | 2 +- Makefile.objs | 2 -- Makefile.target | 1 + scripts/checkpatch.pl | 2 +- scripts/get_maintainer.pl | 3 ++- softmmu/Makefile.objs | 2 ++ vl.c => softmmu/vl.c | 0 7 files changed, 7 insertions(+), 5 deletions(-) create mode 100644 softmmu/Makefile.objs rename vl.c => softmmu/vl.c (100%) diff --git a/MAINTAINERS b/MAINTAINERS index XXXXXXX..XXXXXXX 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -XXX,XX +XXX,XX @@ F: include/qemu/main-loop.h F: include/sysemu/runstate.h F: util/main-loop.c F: util/qemu-timer.c -F: vl.c +F: softmmu/vl.c F: qapi/run-state.json Human Monitor (HMP) diff --git a/Makefile.objs b/Makefile.objs index XXXXXXX..XXXXXXX 100644 --- a/Makefile.objs +++ b/Makefile.objs @@ -XXX,XX +XXX,XX @@ common-obj-y += ui/ common-obj-m += ui/ common-obj-y += dma-helpers.o -common-obj-y += vl.o -vl.o-cflags := $(GPROF_CFLAGS) $(SDL_CFLAGS) common-obj-$(CONFIG_TPM) += tpm.o common-obj-y += backends/ diff --git a/Makefile.target b/Makefile.target index XXXXXXX..XXXXXXX 100644 --- a/Makefile.target +++ b/Makefile.target @@ -XXX,XX +XXX,XX @@ obj-y += qapi/ obj-y += memory.o obj-y += memory_mapping.o obj-y += migration/ram.o +obj-y += softmmu/ LIBS := $(libs_softmmu) $(LIBS) # Hardware support diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl index XXXXXXX..XXXXXXX 100755 --- a/scripts/checkpatch.pl +++ b/scripts/checkpatch.pl @@ -XXX,XX +XXX,XX @@ sub top_of_kernel_tree { my @tree_check = ( "COPYING", "MAINTAINERS", "Makefile", "README.rst", "docs", "VERSION", - "vl.c" + "linux-user", "softmmu" ); foreach my $check (@tree_check) { diff --git a/scripts/get_maintainer.pl b/scripts/get_maintainer.pl index XXXXXXX..XXXXXXX 100755 --- a/scripts/get_maintainer.pl +++ b/scripts/get_maintainer.pl @@ -XXX,XX +XXX,XX @@ sub top_of_tree { && (-f "${lk_path}Makefile") && (-d "${lk_path}docs") && (-f "${lk_path}VERSION") - && (-f "${lk_path}vl.c")) { + && (-d "${lk_path}linux-user/") + && (-d "${lk_path}softmmu/")) { return 1; } return 0; diff --git a/softmmu/Makefile.objs b/softmmu/Makefile.objs new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/softmmu/Makefile.objs @@ -XXX,XX +XXX,XX @@ +obj-y += vl.o +vl.o-cflags := $(GPROF_CFLAGS) $(SDL_CFLAGS) diff --git a/vl.c b/softmmu/vl.c similarity index 100% rename from vl.c rename to softmmu/vl.c -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> A program might rely on functions implemented in vl.c, but implement its own main(). By placing main into a separate source file, there are no complaints about duplicate main()s when linking against vl.o. For example, the virtual-device fuzzer uses a main() provided by libfuzzer, and needs to perform some initialization before running the softmmu initialization. Now, main simply calls three vl.c functions which handle the guest initialization, main loop and cleanup. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-3-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- MAINTAINERS | 1 + Makefile.target | 2 +- include/sysemu/sysemu.h | 4 ++++ softmmu/Makefile.objs | 1 + softmmu/main.c | 53 +++++++++++++++++++++++++++++++++++++++++ softmmu/vl.c | 36 +++++++--------------------- 6 files changed, 69 insertions(+), 28 deletions(-) create mode 100644 softmmu/main.c diff --git a/MAINTAINERS b/MAINTAINERS index XXXXXXX..XXXXXXX 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -XXX,XX +XXX,XX @@ F: include/sysemu/runstate.h F: util/main-loop.c F: util/qemu-timer.c F: softmmu/vl.c +F: softmmu/main.c F: qapi/run-state.json Human Monitor (HMP) diff --git a/Makefile.target b/Makefile.target index XXXXXXX..XXXXXXX 100644 --- a/Makefile.target +++ b/Makefile.target @@ -XXX,XX +XXX,XX @@ endif COMMON_LDADDS = ../libqemuutil.a # build either PROG or PROGW -$(QEMU_PROG_BUILD): $(all-obj-y) $(COMMON_LDADDS) +$(QEMU_PROG_BUILD): $(all-obj-y) $(COMMON_LDADDS) $(softmmu-main-y) $(call LINK, $(filter-out %.mak, $^)) ifdef CONFIG_DARWIN $(call quiet-command,Rez -append $(SRC_PATH)/pc-bios/qemu.rsrc -o $@,"REZ","$(TARGET_DIR)$@") diff --git a/include/sysemu/sysemu.h b/include/sysemu/sysemu.h index XXXXXXX..XXXXXXX 100644 --- a/include/sysemu/sysemu.h +++ b/include/sysemu/sysemu.h @@ -XXX,XX +XXX,XX @@ QemuOpts *qemu_get_machine_opts(void); bool defaults_enabled(void); +void qemu_init(int argc, char **argv, char **envp); +void qemu_main_loop(void); +void qemu_cleanup(void); + extern QemuOptsList qemu_legacy_drive_opts; extern QemuOptsList qemu_common_drive_opts; extern QemuOptsList qemu_drive_opts; diff --git a/softmmu/Makefile.objs b/softmmu/Makefile.objs index XXXXXXX..XXXXXXX 100644 --- a/softmmu/Makefile.objs +++ b/softmmu/Makefile.objs @@ -XXX,XX +XXX,XX @@ +softmmu-main-y = softmmu/main.o obj-y += vl.o vl.o-cflags := $(GPROF_CFLAGS) $(SDL_CFLAGS) diff --git a/softmmu/main.c b/softmmu/main.c new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/softmmu/main.c @@ -XXX,XX +XXX,XX @@ +/* + * QEMU System Emulator + * + * Copyright (c) 2003-2020 Fabrice Bellard + * + * Permission is hereby granted, free of charge, to any person obtaining a copy + * of this software and associated documentation files (the "Software"), to deal + * in the Software without restriction, including without limitation the rights + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell + * copies of the Software, and to permit persons to whom the Software is + * furnished to do so, subject to the following conditions: + * + * The above copyright notice and this permission notice shall be included in + * all copies or substantial portions of the Software. + * + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL + * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN + * THE SOFTWARE. + */ + +#include "qemu/osdep.h" +#include "qemu-common.h" +#include "sysemu/sysemu.h" + +#ifdef CONFIG_SDL +#if defined(__APPLE__) || defined(main) +#include <SDL.h> +int main(int argc, char **argv) +{ + return qemu_main(argc, argv, NULL); +} +#undef main +#define main qemu_main +#endif +#endif /* CONFIG_SDL */ + +#ifdef CONFIG_COCOA +#undef main +#define main qemu_main +#endif /* CONFIG_COCOA */ + +int main(int argc, char **argv, char **envp) +{ + qemu_init(argc, argv, envp); + qemu_main_loop(); + qemu_cleanup(); + + return 0; +} diff --git a/softmmu/vl.c b/softmmu/vl.c index XXXXXXX..XXXXXXX 100644 --- a/softmmu/vl.c +++ b/softmmu/vl.c @@ -XXX,XX +XXX,XX @@ #include "sysemu/seccomp.h" #include "sysemu/tcg.h" -#ifdef CONFIG_SDL -#if defined(__APPLE__) || defined(main) -#include <SDL.h> -int qemu_main(int argc, char **argv, char **envp); -int main(int argc, char **argv) -{ - return qemu_main(argc, argv, NULL); -} -#undef main -#define main qemu_main -#endif -#endif /* CONFIG_SDL */ - -#ifdef CONFIG_COCOA -#undef main -#define main qemu_main -#endif /* CONFIG_COCOA */ - - #include "qemu/error-report.h" #include "qemu/sockets.h" #include "sysemu/accel.h" @@ -XXX,XX +XXX,XX @@ static bool main_loop_should_exit(void) return false; } -static void main_loop(void) +void qemu_main_loop(void) { #ifdef CONFIG_PROFILER int64_t ti; @@ -XXX,XX +XXX,XX @@ static void configure_accelerators(const char *progname) } } -int main(int argc, char **argv, char **envp) +void qemu_init(int argc, char **argv, char **envp) { int i; int snapshot, linux_boot; @@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv, char **envp) case QEMU_OPTION_watchdog: if (watchdog) { error_report("only one watchdog option may be given"); - return 1; + exit(1); } watchdog = optarg; break; @@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv, char **envp) parse_numa_opts(current_machine); /* do monitor/qmp handling at preconfig state if requested */ - main_loop(); + qemu_main_loop(); audio_init_audiodevs(); @@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv, char **envp) if (vmstate_dump_file) { /* dump and exit */ dump_vmstate_json_to_file(vmstate_dump_file); - return 0; + exit(0); } if (incoming) { @@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv, char **envp) accel_setup_post(current_machine); os_setup_post(); - main_loop(); + return; +} +void qemu_cleanup(void) +{ gdbserver_cleanup(); /* @@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv, char **envp) qemu_chr_cleanup(); user_creatable_cleanup(); /* TODO: unref root container, check all devices are ok */ - - return 0; } -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> The virtual-device fuzzer must initialize QOM, prior to running vl:qemu_init, so that it can use the qos_graph to identify the arguments required to initialize a guest for libqos-assisted fuzzing. This change prevents errors when vl:qemu_init tries to (re)initialize the previously initialized QOM module. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20200220041118.23264-4-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- util/module.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/util/module.c b/util/module.c index XXXXXXX..XXXXXXX 100644 --- a/util/module.c +++ b/util/module.c @@ -XXX,XX +XXX,XX @@ typedef struct ModuleEntry typedef QTAILQ_HEAD(, ModuleEntry) ModuleTypeList; static ModuleTypeList init_type_list[MODULE_INIT_MAX]; +static bool modules_init_done[MODULE_INIT_MAX]; static ModuleTypeList dso_init_list; @@ -XXX,XX +XXX,XX @@ void module_call_init(module_init_type type) ModuleTypeList *l; ModuleEntry *e; + if (modules_init_done[type]) { + return; + } + l = find_type(type); QTAILQ_FOREACH(e, l, node) { e->init(); } + + modules_init_done[type] = true; } #ifdef CONFIG_MODULES -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-5-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- include/qemu/module.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/include/qemu/module.h b/include/qemu/module.h index XXXXXXX..XXXXXXX 100644 --- a/include/qemu/module.h +++ b/include/qemu/module.h @@ -XXX,XX +XXX,XX @@ typedef enum { MODULE_INIT_TRACE, MODULE_INIT_XEN_BACKEND, MODULE_INIT_LIBQOS, + MODULE_INIT_FUZZ_TARGET, MODULE_INIT_MAX } module_init_type; @@ -XXX,XX +XXX,XX @@ typedef enum { #define xen_backend_init(function) module_init(function, \ MODULE_INIT_XEN_BACKEND) #define libqos_init(function) module_init(function, MODULE_INIT_LIBQOS) - +#define fuzz_target_init(function) module_init(function, \ + MODULE_INIT_FUZZ_TARGET) #define block_module_load_one(lib) module_load_one("block-", lib) #define ui_module_load_one(lib) module_load_one("ui-", lib) #define audio_module_load_one(lib) module_load_one("audio-", lib) -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> qtest_server_send is a function pointer specifying the handler used to transmit data to the qtest client. In the standard configuration, this calls the CharBackend handler, but now it is possible for other types of handlers, e.g direct-function calls if the qtest client and server exist within the same process (inproc) Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Acked-by: Thomas Huth <thuth@redhat.com> Message-id: 20200220041118.23264-6-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- include/sysemu/qtest.h | 3 +++ qtest.c | 18 ++++++++++++++++-- 2 files changed, 19 insertions(+), 2 deletions(-) diff --git a/include/sysemu/qtest.h b/include/sysemu/qtest.h index XXXXXXX..XXXXXXX 100644 --- a/include/sysemu/qtest.h +++ b/include/sysemu/qtest.h @@ -XXX,XX +XXX,XX @@ bool qtest_driver(void); void qtest_server_init(const char *qtest_chrdev, const char *qtest_log, Error **errp); +void qtest_server_set_send_handler(void (*send)(void *, const char *), + void *opaque); + #endif diff --git a/qtest.c b/qtest.c index XXXXXXX..XXXXXXX 100644 --- a/qtest.c +++ b/qtest.c @@ -XXX,XX +XXX,XX @@ static GString *inbuf; static int irq_levels[MAX_IRQ]; static qemu_timeval start_time; static bool qtest_opened; +static void (*qtest_server_send)(void*, const char*); +static void *qtest_server_send_opaque; #define FMT_timeval "%ld.%06ld" @@ -XXX,XX +XXX,XX @@ static void GCC_FMT_ATTR(1, 2) qtest_log_send(const char *fmt, ...) va_end(ap); } -static void do_qtest_send(CharBackend *chr, const char *str, size_t len) +static void qtest_server_char_be_send(void *opaque, const char *str) { + size_t len = strlen(str); + CharBackend* chr = (CharBackend *)opaque; qemu_chr_fe_write_all(chr, (uint8_t *)str, len); if (qtest_log_fp && qtest_opened) { fprintf(qtest_log_fp, "%s", str); @@ -XXX,XX +XXX,XX @@ static void do_qtest_send(CharBackend *chr, const char *str, size_t len) static void qtest_send(CharBackend *chr, const char *str) { - do_qtest_send(chr, str, strlen(str)); + qtest_server_send(qtest_server_send_opaque, str); } static void GCC_FMT_ATTR(2, 3) qtest_sendf(CharBackend *chr, @@ -XXX,XX +XXX,XX @@ void qtest_server_init(const char *qtest_chrdev, const char *qtest_log, Error ** qemu_chr_fe_set_echo(&qtest_chr, true); inbuf = g_string_new(""); + + if (!qtest_server_send) { + qtest_server_set_send_handler(qtest_server_char_be_send, &qtest_chr); + } +} + +void qtest_server_set_send_handler(void (*send)(void*, const char*), void *opaque) +{ + qtest_server_send = send; + qtest_server_send_opaque = opaque; } bool qtest_driver(void) -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> This makes it simple to swap the transport functions for qtest commands to and from the qtest client. For example, now it is possible to directly pass qtest commands to a server handler that exists within the same process, without the standard way of writing to a file descriptor. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-7-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- tests/qtest/libqtest.c | 48 ++++++++++++++++++++++++++++++++++-------- 1 file changed, 39 insertions(+), 9 deletions(-) diff --git a/tests/qtest/libqtest.c b/tests/qtest/libqtest.c index XXXXXXX..XXXXXXX 100644 --- a/tests/qtest/libqtest.c +++ b/tests/qtest/libqtest.c @@ -XXX,XX +XXX,XX @@ #define SOCKET_TIMEOUT 50 #define SOCKET_MAX_FDS 16 + +typedef void (*QTestSendFn)(QTestState *s, const char *buf); +typedef GString* (*QTestRecvFn)(QTestState *); + +typedef struct QTestClientTransportOps { + QTestSendFn send; /* for sending qtest commands */ + QTestRecvFn recv_line; /* for receiving qtest command responses */ +} QTestTransportOps; + struct QTestState { int fd; @@ -XXX,XX +XXX,XX @@ struct QTestState bool big_endian; bool irq_level[MAX_IRQ]; GString *rx; + QTestTransportOps ops; }; static GHookList abrt_hooks; @@ -XXX,XX +XXX,XX @@ static struct sigaction sigact_old; static int qtest_query_target_endianness(QTestState *s); +static void qtest_client_socket_send(QTestState*, const char *buf); +static void socket_send(int fd, const char *buf, size_t size); + +static GString *qtest_client_socket_recv_line(QTestState *); + +static void qtest_client_set_tx_handler(QTestState *s, QTestSendFn send); +static void qtest_client_set_rx_handler(QTestState *s, QTestRecvFn recv); + static int init_socket(const char *socket_path) { struct sockaddr_un addr; @@ -XXX,XX +XXX,XX @@ QTestState *qtest_init_without_qmp_handshake(const char *extra_args) sock = init_socket(socket_path); qmpsock = init_socket(qmp_socket_path); + qtest_client_set_rx_handler(s, qtest_client_socket_recv_line); + qtest_client_set_tx_handler(s, qtest_client_socket_send); + qtest_add_abrt_handler(kill_qemu_hook_func, s); command = g_strdup_printf("exec %s " @@ -XXX,XX +XXX,XX @@ static void socket_send(int fd, const char *buf, size_t size) } } -static void socket_sendf(int fd, const char *fmt, va_list ap) +static void qtest_client_socket_send(QTestState *s, const char *buf) { - gchar *str = g_strdup_vprintf(fmt, ap); - size_t size = strlen(str); - - socket_send(fd, str, size); - g_free(str); + socket_send(s->fd, buf, strlen(buf)); } static void GCC_FMT_ATTR(2, 3) qtest_sendf(QTestState *s, const char *fmt, ...) @@ -XXX,XX +XXX,XX @@ static void GCC_FMT_ATTR(2, 3) qtest_sendf(QTestState *s, const char *fmt, ...) va_list ap; va_start(ap, fmt); - socket_sendf(s->fd, fmt, ap); + gchar *str = g_strdup_vprintf(fmt, ap); va_end(ap); + + s->ops.send(s, str); + g_free(str); } /* Sends a message and file descriptors to the socket. @@ -XXX,XX +XXX,XX @@ static void socket_send_fds(int socket_fd, int *fds, size_t fds_num, g_assert_cmpint(ret, >, 0); } -static GString *qtest_recv_line(QTestState *s) +static GString *qtest_client_socket_recv_line(QTestState *s) { GString *line; size_t offset; @@ -XXX,XX +XXX,XX @@ static gchar **qtest_rsp(QTestState *s, int expected_args) int i; redo: - line = qtest_recv_line(s); + line = s->ops.recv_line(s); words = g_strsplit(line->str, " ", 0); g_string_free(line, TRUE); @@ -XXX,XX +XXX,XX @@ void qmp_assert_error_class(QDict *rsp, const char *class) qobject_unref(rsp); } + +static void qtest_client_set_tx_handler(QTestState *s, + QTestSendFn send) +{ + s->ops.send = send; +} +static void qtest_client_set_rx_handler(QTestState *s, QTestRecvFn recv) +{ + s->ops.recv_line = recv; +} -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> When using qtest "in-process" communication, qtest_sendf directly calls a function in the server (qtest.c). Previously, bufwrite used socket_send, which bypasses the TransportOps enabling the call into qtest.c. This change replaces the socket_send calls with ops->send, maintaining the benefits of the direct socket_send call, while adding support for in-process qtest calls. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-8-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- tests/qtest/libqtest.c | 71 ++++++++++++++++++++++++++++++++++++++++-- tests/qtest/libqtest.h | 4 +++ 2 files changed, 73 insertions(+), 2 deletions(-) diff --git a/tests/qtest/libqtest.c b/tests/qtest/libqtest.c index XXXXXXX..XXXXXXX 100644 --- a/tests/qtest/libqtest.c +++ b/tests/qtest/libqtest.c @@ -XXX,XX +XXX,XX @@ typedef void (*QTestSendFn)(QTestState *s, const char *buf); +typedef void (*ExternalSendFn)(void *s, const char *buf); typedef GString* (*QTestRecvFn)(QTestState *); typedef struct QTestClientTransportOps { QTestSendFn send; /* for sending qtest commands */ + + /* + * use external_send to send qtest command strings through functions which + * do not accept a QTestState as the first parameter. + */ + ExternalSendFn external_send; + QTestRecvFn recv_line; /* for receiving qtest command responses */ } QTestTransportOps; @@ -XXX,XX +XXX,XX @@ void qtest_bufwrite(QTestState *s, uint64_t addr, const void *data, size_t size) bdata = g_base64_encode(data, size); qtest_sendf(s, "b64write 0x%" PRIx64 " 0x%zx ", addr, size); - socket_send(s->fd, bdata, strlen(bdata)); - socket_send(s->fd, "\n", 1); + s->ops.send(s, bdata); + s->ops.send(s, "\n"); qtest_rsp(s, 0); g_free(bdata); } @@ -XXX,XX +XXX,XX @@ static void qtest_client_set_rx_handler(QTestState *s, QTestRecvFn recv) { s->ops.recv_line = recv; } +/* A type-safe wrapper for s->send() */ +static void send_wrapper(QTestState *s, const char *buf) +{ + s->ops.external_send(s, buf); +} + +static GString *qtest_client_inproc_recv_line(QTestState *s) +{ + GString *line; + size_t offset; + char *eol; + + eol = strchr(s->rx->str, '\n'); + offset = eol - s->rx->str; + line = g_string_new_len(s->rx->str, offset); + g_string_erase(s->rx, 0, offset + 1); + return line; +} + +QTestState *qtest_inproc_init(QTestState **s, bool log, const char* arch, + void (*send)(void*, const char*)) +{ + QTestState *qts; + qts = g_new0(QTestState, 1); + *s = qts; /* Expose qts early on, since the query endianness relies on it */ + qts->wstatus = 0; + for (int i = 0; i < MAX_IRQ; i++) { + qts->irq_level[i] = false; + } + + qtest_client_set_rx_handler(qts, qtest_client_inproc_recv_line); + + /* send() may not have a matching protoype, so use a type-safe wrapper */ + qts->ops.external_send = send; + qtest_client_set_tx_handler(qts, send_wrapper); + + qts->big_endian = qtest_query_target_endianness(qts); + + /* + * Set a dummy path for QTEST_QEMU_BINARY. Doesn't need to exist, but this + * way, qtest_get_arch works for inproc qtest. + */ + gchar *bin_path = g_strconcat("/qemu-system-", arch, NULL); + setenv("QTEST_QEMU_BINARY", bin_path, 0); + g_free(bin_path); + + return qts; +} + +void qtest_client_inproc_recv(void *opaque, const char *str) +{ + QTestState *qts = *(QTestState **)opaque; + + if (!qts->rx) { + qts->rx = g_string_new(NULL); + } + g_string_append(qts->rx, str); + return; +} diff --git a/tests/qtest/libqtest.h b/tests/qtest/libqtest.h index XXXXXXX..XXXXXXX 100644 --- a/tests/qtest/libqtest.h +++ b/tests/qtest/libqtest.h @@ -XXX,XX +XXX,XX @@ bool qtest_probe_child(QTestState *s); */ void qtest_set_expected_status(QTestState *s, int status); +QTestState *qtest_inproc_init(QTestState **s, bool log, const char* arch, + void (*send)(void*, const char*)); + +void qtest_client_inproc_recv(void *opaque, const char *str); #endif -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> The handler allows a qtest client to send commands to the server by directly calling a function, rather than using a file/CharBackend Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-9-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- include/sysemu/qtest.h | 1 + qtest.c | 13 +++++++++++++ 2 files changed, 14 insertions(+) diff --git a/include/sysemu/qtest.h b/include/sysemu/qtest.h index XXXXXXX..XXXXXXX 100644 --- a/include/sysemu/qtest.h +++ b/include/sysemu/qtest.h @@ -XXX,XX +XXX,XX @@ void qtest_server_init(const char *qtest_chrdev, const char *qtest_log, Error ** void qtest_server_set_send_handler(void (*send)(void *, const char *), void *opaque); +void qtest_server_inproc_recv(void *opaque, const char *buf); #endif diff --git a/qtest.c b/qtest.c index XXXXXXX..XXXXXXX 100644 --- a/qtest.c +++ b/qtest.c @@ -XXX,XX +XXX,XX @@ bool qtest_driver(void) { return qtest_chr.chr != NULL; } + +void qtest_server_inproc_recv(void *dummy, const char *buf) +{ + static GString *gstr; + if (!gstr) { + gstr = g_string_new(NULL); + } + g_string_append(gstr, buf); + if (gstr->str[gstr->len - 1] == '\n') { + qtest_process_inbuf(NULL, gstr); + g_string_truncate(gstr, 0); + } +} -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> The names i2c_send and i2c_recv collide with functions defined in hw/i2c/core.c. This causes an error when linking against libqos and softmmu simultaneously (for example when using qtest inproc). Rename the libqos functions to avoid this. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Acked-by: Thomas Huth <thuth@redhat.com> Message-id: 20200220041118.23264-10-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- tests/qtest/libqos/i2c.c | 10 +++++----- tests/qtest/libqos/i2c.h | 4 ++-- tests/qtest/pca9552-test.c | 10 +++++----- 3 files changed, 12 insertions(+), 12 deletions(-) diff --git a/tests/qtest/libqos/i2c.c b/tests/qtest/libqos/i2c.c index XXXXXXX..XXXXXXX 100644 --- a/tests/qtest/libqos/i2c.c +++ b/tests/qtest/libqos/i2c.c @@ -XXX,XX +XXX,XX @@ #include "libqos/i2c.h" #include "libqtest.h" -void i2c_send(QI2CDevice *i2cdev, const uint8_t *buf, uint16_t len) +void qi2c_send(QI2CDevice *i2cdev, const uint8_t *buf, uint16_t len) { i2cdev->bus->send(i2cdev->bus, i2cdev->addr, buf, len); } -void i2c_recv(QI2CDevice *i2cdev, uint8_t *buf, uint16_t len) +void qi2c_recv(QI2CDevice *i2cdev, uint8_t *buf, uint16_t len) { i2cdev->bus->recv(i2cdev->bus, i2cdev->addr, buf, len); } @@ -XXX,XX +XXX,XX @@ void i2c_recv(QI2CDevice *i2cdev, uint8_t *buf, uint16_t len) void i2c_read_block(QI2CDevice *i2cdev, uint8_t reg, uint8_t *buf, uint16_t len) { - i2c_send(i2cdev, &reg, 1); - i2c_recv(i2cdev, buf, len); + qi2c_send(i2cdev, &reg, 1); + qi2c_recv(i2cdev, buf, len); } void i2c_write_block(QI2CDevice *i2cdev, uint8_t reg, @@ -XXX,XX +XXX,XX @@ void i2c_write_block(QI2CDevice *i2cdev, uint8_t reg, uint8_t *cmd = g_malloc(len + 1); cmd[0] = reg; memcpy(&cmd[1], buf, len); - i2c_send(i2cdev, cmd, len + 1); + qi2c_send(i2cdev, cmd, len + 1); g_free(cmd); } diff --git a/tests/qtest/libqos/i2c.h b/tests/qtest/libqos/i2c.h index XXXXXXX..XXXXXXX 100644 --- a/tests/qtest/libqos/i2c.h +++ b/tests/qtest/libqos/i2c.h @@ -XXX,XX +XXX,XX @@ struct QI2CDevice { void *i2c_device_create(void *i2c_bus, QGuestAllocator *alloc, void *addr); void add_qi2c_address(QOSGraphEdgeOptions *opts, QI2CAddress *addr); -void i2c_send(QI2CDevice *dev, const uint8_t *buf, uint16_t len); -void i2c_recv(QI2CDevice *dev, uint8_t *buf, uint16_t len); +void qi2c_send(QI2CDevice *dev, const uint8_t *buf, uint16_t len); +void qi2c_recv(QI2CDevice *dev, uint8_t *buf, uint16_t len); void i2c_read_block(QI2CDevice *dev, uint8_t reg, uint8_t *buf, uint16_t len); diff --git a/tests/qtest/pca9552-test.c b/tests/qtest/pca9552-test.c index XXXXXXX..XXXXXXX 100644 --- a/tests/qtest/pca9552-test.c +++ b/tests/qtest/pca9552-test.c @@ -XXX,XX +XXX,XX @@ static void receive_autoinc(void *obj, void *data, QGuestAllocator *alloc) pca9552_init(i2cdev); - i2c_send(i2cdev, &reg, 1); + qi2c_send(i2cdev, &reg, 1); /* PCA9552_LS0 */ - i2c_recv(i2cdev, &resp, 1); + qi2c_recv(i2cdev, &resp, 1); g_assert_cmphex(resp, ==, 0x54); /* PCA9552_LS1 */ - i2c_recv(i2cdev, &resp, 1); + qi2c_recv(i2cdev, &resp, 1); g_assert_cmphex(resp, ==, 0x55); /* PCA9552_LS2 */ - i2c_recv(i2cdev, &resp, 1); + qi2c_recv(i2cdev, &resp, 1); g_assert_cmphex(resp, ==, 0x55); /* PCA9552_LS3 */ - i2c_recv(i2cdev, &resp, 1); + qi2c_recv(i2cdev, &resp, 1); g_assert_cmphex(resp, ==, 0x54); } -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> Most qos-related objects were specified in the qos-test-obj-y variable. qos-test-obj-y also included qos-test.o which defines a main(). This made it difficult to repurpose qos-test-obj-y to link anything beside tests/qos-test against libqos. This change separates objects that are libqos-specific and ones that are qos-test specific into different variables. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20200220041118.23264-11-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- tests/qtest/Makefile.include | 71 ++++++++++++++++++------------------ 1 file changed, 36 insertions(+), 35 deletions(-) diff --git a/tests/qtest/Makefile.include b/tests/qtest/Makefile.include index XXXXXXX..XXXXXXX 100644 --- a/tests/qtest/Makefile.include +++ b/tests/qtest/Makefile.include @@ -XXX,XX +XXX,XX @@ check-qtest-s390x-y += migration-test # libqos / qgraph : libqgraph-obj-y = tests/qtest/libqos/qgraph.o -libqos-obj-y = $(libqgraph-obj-y) tests/qtest/libqos/pci.o tests/qtest/libqos/fw_cfg.o -libqos-obj-y += tests/qtest/libqos/malloc.o -libqos-obj-y += tests/qtest/libqos/libqos.o -libqos-spapr-obj-y = $(libqos-obj-y) tests/qtest/libqos/malloc-spapr.o +libqos-core-obj-y = $(libqgraph-obj-y) tests/qtest/libqos/pci.o tests/qtest/libqos/fw_cfg.o +libqos-core-obj-y += tests/qtest/libqos/malloc.o +libqos-core-obj-y += tests/qtest/libqos/libqos.o +libqos-spapr-obj-y = $(libqos-core-obj-y) tests/qtest/libqos/malloc-spapr.o libqos-spapr-obj-y += tests/qtest/libqos/libqos-spapr.o libqos-spapr-obj-y += tests/qtest/libqos/rtas.o libqos-spapr-obj-y += tests/qtest/libqos/pci-spapr.o -libqos-pc-obj-y = $(libqos-obj-y) tests/qtest/libqos/pci-pc.o +libqos-pc-obj-y = $(libqos-core-obj-y) tests/qtest/libqos/pci-pc.o libqos-pc-obj-y += tests/qtest/libqos/malloc-pc.o tests/qtest/libqos/libqos-pc.o libqos-pc-obj-y += tests/qtest/libqos/ahci.o libqos-usb-obj-y = $(libqos-spapr-obj-y) $(libqos-pc-obj-y) tests/qtest/libqos/usb.o # qos devices: -qos-test-obj-y = tests/qtest/qos-test.o $(libqgraph-obj-y) -qos-test-obj-y += $(libqos-pc-obj-y) $(libqos-spapr-obj-y) -qos-test-obj-y += tests/qtest/libqos/e1000e.o -qos-test-obj-y += tests/qtest/libqos/i2c.o -qos-test-obj-y += tests/qtest/libqos/i2c-imx.o -qos-test-obj-y += tests/qtest/libqos/i2c-omap.o -qos-test-obj-y += tests/qtest/libqos/sdhci.o -qos-test-obj-y += tests/qtest/libqos/tpci200.o -qos-test-obj-y += tests/qtest/libqos/virtio.o -qos-test-obj-$(CONFIG_VIRTFS) += tests/qtest/libqos/virtio-9p.o -qos-test-obj-y += tests/qtest/libqos/virtio-balloon.o -qos-test-obj-y += tests/qtest/libqos/virtio-blk.o -qos-test-obj-y += tests/qtest/libqos/virtio-mmio.o -qos-test-obj-y += tests/qtest/libqos/virtio-net.o -qos-test-obj-y += tests/qtest/libqos/virtio-pci.o -qos-test-obj-y += tests/qtest/libqos/virtio-pci-modern.o -qos-test-obj-y += tests/qtest/libqos/virtio-rng.o -qos-test-obj-y += tests/qtest/libqos/virtio-scsi.o -qos-test-obj-y += tests/qtest/libqos/virtio-serial.o +libqos-obj-y = $(libqgraph-obj-y) +libqos-obj-y += $(libqos-pc-obj-y) $(libqos-spapr-obj-y) +libqos-obj-y += tests/qtest/libqos/e1000e.o +libqos-obj-y += tests/qtest/libqos/i2c.o +libqos-obj-y += tests/qtest/libqos/i2c-imx.o +libqos-obj-y += tests/qtest/libqos/i2c-omap.o +libqos-obj-y += tests/qtest/libqos/sdhci.o +libqos-obj-y += tests/qtest/libqos/tpci200.o +libqos-obj-y += tests/qtest/libqos/virtio.o +libqos-obj-$(CONFIG_VIRTFS) += tests/qtest/libqos/virtio-9p.o +libqos-obj-y += tests/qtest/libqos/virtio-balloon.o +libqos-obj-y += tests/qtest/libqos/virtio-blk.o +libqos-obj-y += tests/qtest/libqos/virtio-mmio.o +libqos-obj-y += tests/qtest/libqos/virtio-net.o +libqos-obj-y += tests/qtest/libqos/virtio-pci.o +libqos-obj-y += tests/qtest/libqos/virtio-pci-modern.o +libqos-obj-y += tests/qtest/libqos/virtio-rng.o +libqos-obj-y += tests/qtest/libqos/virtio-scsi.o +libqos-obj-y += tests/qtest/libqos/virtio-serial.o # qos machines: -qos-test-obj-y += tests/qtest/libqos/aarch64-xlnx-zcu102-machine.o -qos-test-obj-y += tests/qtest/libqos/arm-imx25-pdk-machine.o -qos-test-obj-y += tests/qtest/libqos/arm-n800-machine.o -qos-test-obj-y += tests/qtest/libqos/arm-raspi2-machine.o -qos-test-obj-y += tests/qtest/libqos/arm-sabrelite-machine.o -qos-test-obj-y += tests/qtest/libqos/arm-smdkc210-machine.o -qos-test-obj-y += tests/qtest/libqos/arm-virt-machine.o -qos-test-obj-y += tests/qtest/libqos/arm-xilinx-zynq-a9-machine.o -qos-test-obj-y += tests/qtest/libqos/ppc64_pseries-machine.o -qos-test-obj-y += tests/qtest/libqos/x86_64_pc-machine.o +libqos-obj-y += tests/qtest/libqos/aarch64-xlnx-zcu102-machine.o +libqos-obj-y += tests/qtest/libqos/arm-imx25-pdk-machine.o +libqos-obj-y += tests/qtest/libqos/arm-n800-machine.o +libqos-obj-y += tests/qtest/libqos/arm-raspi2-machine.o +libqos-obj-y += tests/qtest/libqos/arm-sabrelite-machine.o +libqos-obj-y += tests/qtest/libqos/arm-smdkc210-machine.o +libqos-obj-y += tests/qtest/libqos/arm-virt-machine.o +libqos-obj-y += tests/qtest/libqos/arm-xilinx-zynq-a9-machine.o +libqos-obj-y += tests/qtest/libqos/ppc64_pseries-machine.o +libqos-obj-y += tests/qtest/libqos/x86_64_pc-machine.o # qos tests: +qos-test-obj-y += tests/qtest/qos-test.o qos-test-obj-y += tests/qtest/ac97-test.o qos-test-obj-y += tests/qtest/ds1338-test.o qos-test-obj-y += tests/qtest/e1000-test.o @@ -XXX,XX +XXX,XX @@ check-unit-y += tests/test-qgraph$(EXESUF) tests/test-qgraph$(EXESUF): tests/test-qgraph.o $(libqgraph-obj-y) check-qtest-generic-y += qos-test -tests/qtest/qos-test$(EXESUF): $(qos-test-obj-y) +tests/qtest/qos-test$(EXESUF): $(qos-test-obj-y) $(libqos-obj-y) # QTest dependencies: tests/qtest/qmp-test$(EXESUF): tests/qtest/qmp-test.o -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> The moved functions are not specific to qos-test and might be useful elsewhere. For example the virtual-device fuzzer makes use of them for qos-assisted fuzz-targets. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-12-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- tests/qtest/Makefile.include | 1 + tests/qtest/libqos/qos_external.c | 168 ++++++++++++++++++++++++++++++ tests/qtest/libqos/qos_external.h | 28 +++++ tests/qtest/qos-test.c | 132 +---------------------- 4 files changed, 198 insertions(+), 131 deletions(-) create mode 100644 tests/qtest/libqos/qos_external.c create mode 100644 tests/qtest/libqos/qos_external.h diff --git a/tests/qtest/Makefile.include b/tests/qtest/Makefile.include index XXXXXXX..XXXXXXX 100644 --- a/tests/qtest/Makefile.include +++ b/tests/qtest/Makefile.include @@ -XXX,XX +XXX,XX @@ libqos-usb-obj-y = $(libqos-spapr-obj-y) $(libqos-pc-obj-y) tests/qtest/libqos/u # qos devices: libqos-obj-y = $(libqgraph-obj-y) libqos-obj-y += $(libqos-pc-obj-y) $(libqos-spapr-obj-y) +libqos-obj-y += tests/qtest/libqos/qos_external.o libqos-obj-y += tests/qtest/libqos/e1000e.o libqos-obj-y += tests/qtest/libqos/i2c.o libqos-obj-y += tests/qtest/libqos/i2c-imx.o diff --git a/tests/qtest/libqos/qos_external.c b/tests/qtest/libqos/qos_external.c new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/tests/qtest/libqos/qos_external.c @@ -XXX,XX +XXX,XX @@ +/* + * libqos driver framework + * + * Copyright (c) 2018 Emanuele Giuseppe Esposito <e.emanuelegiuseppe@gmail.com> + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License version 2 as published by the Free Software Foundation. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, see <http://www.gnu.org/licenses/> + */ + +#include "qemu/osdep.h" +#include <getopt.h> +#include "libqtest.h" +#include "qapi/qmp/qdict.h" +#include "qapi/qmp/qbool.h" +#include "qapi/qmp/qstring.h" +#include "qemu/module.h" +#include "qapi/qmp/qlist.h" +#include "libqos/malloc.h" +#include "libqos/qgraph.h" +#include "libqos/qgraph_internal.h" +#include "libqos/qos_external.h" + + + +void apply_to_node(const char *name, bool is_machine, bool is_abstract) +{ + char *machine_name = NULL; + if (is_machine) { + const char *arch = qtest_get_arch(); + machine_name = g_strconcat(arch, "/", name, NULL); + name = machine_name; + } + qos_graph_node_set_availability(name, true); + if (is_abstract) { + qos_delete_cmd_line(name); + } + g_free(machine_name); +} + +/** + * apply_to_qlist(): using QMP queries QEMU for a list of + * machines and devices available, and sets the respective node + * as true. If a node is found, also all its produced and contained + * child are marked available. + * + * See qos_graph_node_set_availability() for more info + */ +void apply_to_qlist(QList *list, bool is_machine) +{ + const QListEntry *p; + const char *name; + bool abstract; + QDict *minfo; + QObject *qobj; + QString *qstr; + QBool *qbool; + + for (p = qlist_first(list); p; p = qlist_next(p)) { + minfo = qobject_to(QDict, qlist_entry_obj(p)); + qobj = qdict_get(minfo, "name"); + qstr = qobject_to(QString, qobj); + name = qstring_get_str(qstr); + + qobj = qdict_get(minfo, "abstract"); + if (qobj) { + qbool = qobject_to(QBool, qobj); + abstract = qbool_get_bool(qbool); + } else { + abstract = false; + } + + apply_to_node(name, is_machine, abstract); + qobj = qdict_get(minfo, "alias"); + if (qobj) { + qstr = qobject_to(QString, qobj); + name = qstring_get_str(qstr); + apply_to_node(name, is_machine, abstract); + } + } +} + +QGuestAllocator *get_machine_allocator(QOSGraphObject *obj) +{ + return obj->get_driver(obj, "memory"); +} + +/** + * allocate_objects(): given an array of nodes @arg, + * walks the path invoking all constructors and + * passing the corresponding parameter in order to + * continue the objects allocation. + * Once the test is reached, return the object it consumes. + * + * Since the machine and QEDGE_CONSUMED_BY nodes allocate + * memory in the constructor, g_test_queue_destroy is used so + * that after execution they can be safely free'd. (The test's + * ->before callback is also welcome to use g_test_queue_destroy). + * + * Note: as specified in walk_path() too, @arg is an array of + * char *, where arg[0] is a pointer to the command line + * string that will be used to properly start QEMU when executing + * the test, and the remaining elements represent the actual objects + * that will be allocated. + */ +void *allocate_objects(QTestState *qts, char **path, QGuestAllocator **p_alloc) +{ + int current = 0; + QGuestAllocator *alloc; + QOSGraphObject *parent = NULL; + QOSGraphEdge *edge; + QOSGraphNode *node; + void *edge_arg; + void *obj; + + node = qos_graph_get_node(path[current]); + g_assert(node->type == QNODE_MACHINE); + + obj = qos_machine_new(node, qts); + qos_object_queue_destroy(obj); + + alloc = get_machine_allocator(obj); + if (p_alloc) { + *p_alloc = alloc; + } + + for (;;) { + if (node->type != QNODE_INTERFACE) { + qos_object_start_hw(obj); + parent = obj; + } + + /* follow edge and get object for next node constructor */ + current++; + edge = qos_graph_get_edge(path[current - 1], path[current]); + node = qos_graph_get_node(path[current]); + + if (node->type == QNODE_TEST) { + g_assert(qos_graph_edge_get_type(edge) == QEDGE_CONSUMED_BY); + return obj; + } + + switch (qos_graph_edge_get_type(edge)) { + case QEDGE_PRODUCES: + obj = parent->get_driver(parent, path[current]); + break; + + case QEDGE_CONSUMED_BY: + edge_arg = qos_graph_edge_get_arg(edge); + obj = qos_driver_new(node, obj, alloc, edge_arg); + qos_object_queue_destroy(obj); + break; + + case QEDGE_CONTAINS: + obj = parent->get_device(parent, path[current]); + break; + } + } +} + diff --git a/tests/qtest/libqos/qos_external.h b/tests/qtest/libqos/qos_external.h new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/tests/qtest/libqos/qos_external.h @@ -XXX,XX +XXX,XX @@ +/* + * libqos driver framework + * + * Copyright (c) 2018 Emanuele Giuseppe Esposito <e.emanuelegiuseppe@gmail.com> + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License version 2 as published by the Free Software Foundation. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, see <http://www.gnu.org/licenses/> + */ + +#ifndef QOS_EXTERNAL_H +#define QOS_EXTERNAL_H +#include "libqos/qgraph.h" + +void apply_to_node(const char *name, bool is_machine, bool is_abstract); +void apply_to_qlist(QList *list, bool is_machine); +QGuestAllocator *get_machine_allocator(QOSGraphObject *obj); +void *allocate_objects(QTestState *qts, char **path, QGuestAllocator **p_alloc); + +#endif diff --git a/tests/qtest/qos-test.c b/tests/qtest/qos-test.c index XXXXXXX..XXXXXXX 100644 --- a/tests/qtest/qos-test.c +++ b/tests/qtest/qos-test.c @@ -XXX,XX +XXX,XX @@ #include "libqos/malloc.h" #include "libqos/qgraph.h" #include "libqos/qgraph_internal.h" +#include "libqos/qos_external.h" static char *old_path; -static void apply_to_node(const char *name, bool is_machine, bool is_abstract) -{ - char *machine_name = NULL; - if (is_machine) { - const char *arch = qtest_get_arch(); - machine_name = g_strconcat(arch, "/", name, NULL); - name = machine_name; - } - qos_graph_node_set_availability(name, true); - if (is_abstract) { - qos_delete_cmd_line(name); - } - g_free(machine_name); -} -/** - * apply_to_qlist(): using QMP queries QEMU for a list of - * machines and devices available, and sets the respective node - * as true. If a node is found, also all its produced and contained - * child are marked available. - * - * See qos_graph_node_set_availability() for more info - */ -static void apply_to_qlist(QList *list, bool is_machine) -{ - const QListEntry *p; - const char *name; - bool abstract; - QDict *minfo; - QObject *qobj; - QString *qstr; - QBool *qbool; - - for (p = qlist_first(list); p; p = qlist_next(p)) { - minfo = qobject_to(QDict, qlist_entry_obj(p)); - qobj = qdict_get(minfo, "name"); - qstr = qobject_to(QString, qobj); - name = qstring_get_str(qstr); - - qobj = qdict_get(minfo, "abstract"); - if (qobj) { - qbool = qobject_to(QBool, qobj); - abstract = qbool_get_bool(qbool); - } else { - abstract = false; - } - - apply_to_node(name, is_machine, abstract); - qobj = qdict_get(minfo, "alias"); - if (qobj) { - qstr = qobject_to(QString, qobj); - name = qstring_get_str(qstr); - apply_to_node(name, is_machine, abstract); - } - } -} /** * qos_set_machines_devices_available(): sets availability of qgraph @@ -XXX,XX +XXX,XX @@ static void qos_set_machines_devices_available(void) qobject_unref(response); } -static QGuestAllocator *get_machine_allocator(QOSGraphObject *obj) -{ - return obj->get_driver(obj, "memory"); -} static void restart_qemu_or_continue(char *path) { @@ -XXX,XX +XXX,XX @@ void qos_invalidate_command_line(void) old_path = NULL; } -/** - * allocate_objects(): given an array of nodes @arg, - * walks the path invoking all constructors and - * passing the corresponding parameter in order to - * continue the objects allocation. - * Once the test is reached, return the object it consumes. - * - * Since the machine and QEDGE_CONSUMED_BY nodes allocate - * memory in the constructor, g_test_queue_destroy is used so - * that after execution they can be safely free'd. (The test's - * ->before callback is also welcome to use g_test_queue_destroy). - * - * Note: as specified in walk_path() too, @arg is an array of - * char *, where arg[0] is a pointer to the command line - * string that will be used to properly start QEMU when executing - * the test, and the remaining elements represent the actual objects - * that will be allocated. - */ -static void *allocate_objects(QTestState *qts, char **path, QGuestAllocator **p_alloc) -{ - int current = 0; - QGuestAllocator *alloc; - QOSGraphObject *parent = NULL; - QOSGraphEdge *edge; - QOSGraphNode *node; - void *edge_arg; - void *obj; - - node = qos_graph_get_node(path[current]); - g_assert(node->type == QNODE_MACHINE); - - obj = qos_machine_new(node, qts); - qos_object_queue_destroy(obj); - - alloc = get_machine_allocator(obj); - if (p_alloc) { - *p_alloc = alloc; - } - - for (;;) { - if (node->type != QNODE_INTERFACE) { - qos_object_start_hw(obj); - parent = obj; - } - - /* follow edge and get object for next node constructor */ - current++; - edge = qos_graph_get_edge(path[current - 1], path[current]); - node = qos_graph_get_node(path[current]); - - if (node->type == QNODE_TEST) { - g_assert(qos_graph_edge_get_type(edge) == QEDGE_CONSUMED_BY); - return obj; - } - - switch (qos_graph_edge_get_type(edge)) { - case QEDGE_PRODUCES: - obj = parent->get_driver(parent, path[current]); - break; - - case QEDGE_CONSUMED_BY: - edge_arg = qos_graph_edge_get_arg(edge); - obj = qos_driver_new(node, obj, alloc, edge_arg); - qos_object_queue_destroy(obj); - break; - - case QEDGE_CONTAINS: - obj = parent->get_device(parent, path[current]); - break; - } - } -} /* The argument to run_one_test, which is the test function that is registered * with GTest, is a vector of strings. The first item is the initial command -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> tests/fuzz/fuzz.c serves as the entry point for the virtual-device fuzzer. Namely, libfuzzer invokes the LLVMFuzzerInitialize and LLVMFuzzerTestOneInput functions, both of which are defined in this file. This change adds a "FuzzTarget" struct, along with the fuzz_add_target function, which should be used to define new fuzz targets. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-13-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- MAINTAINERS | 8 ++ tests/qtest/fuzz/Makefile.include | 6 + tests/qtest/fuzz/fuzz.c | 179 ++++++++++++++++++++++++++++++ tests/qtest/fuzz/fuzz.h | 95 ++++++++++++++++ 4 files changed, 288 insertions(+) create mode 100644 tests/qtest/fuzz/Makefile.include create mode 100644 tests/qtest/fuzz/fuzz.c create mode 100644 tests/qtest/fuzz/fuzz.h diff --git a/MAINTAINERS b/MAINTAINERS index XXXXXXX..XXXXXXX 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -XXX,XX +XXX,XX @@ F: qtest.c F: accel/qtest.c F: tests/qtest/ +Device Fuzzing +M: Alexander Bulekov <alxndr@bu.edu> +R: Paolo Bonzini <pbonzini@redhat.com> +R: Bandan Das <bsd@redhat.com> +R: Stefan Hajnoczi <stefanha@redhat.com> +S: Maintained +F: tests/qtest/fuzz/ + Register API M: Alistair Francis <alistair@alistair23.me> S: Maintained diff --git a/tests/qtest/fuzz/Makefile.include b/tests/qtest/fuzz/Makefile.include new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/tests/qtest/fuzz/Makefile.include @@ -XXX,XX +XXX,XX @@ +QEMU_PROG_FUZZ=qemu-fuzz-$(TARGET_NAME)$(EXESUF) + +fuzz-obj-y += tests/qtest/libqtest.o +fuzz-obj-y += tests/qtest/fuzz/fuzz.o # Fuzzer skeleton + +FUZZ_CFLAGS += -I$(SRC_PATH)/tests -I$(SRC_PATH)/tests/qtest diff --git a/tests/qtest/fuzz/fuzz.c b/tests/qtest/fuzz/fuzz.c new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/tests/qtest/fuzz/fuzz.c @@ -XXX,XX +XXX,XX @@ +/* + * fuzzing driver + * + * Copyright Red Hat Inc., 2019 + * + * Authors: + * Alexander Bulekov <alxndr@bu.edu> + * + * This work is licensed under the terms of the GNU GPL, version 2 or later. + * See the COPYING file in the top-level directory. + * + */ + +#include "qemu/osdep.h" + +#include <wordexp.h> + +#include "sysemu/qtest.h" +#include "sysemu/runstate.h" +#include "sysemu/sysemu.h" +#include "qemu/main-loop.h" +#include "tests/qtest/libqtest.h" +#include "tests/qtest/libqos/qgraph.h" +#include "fuzz.h" + +#define MAX_EVENT_LOOPS 10 + +typedef struct FuzzTargetState { + FuzzTarget *target; + QSLIST_ENTRY(FuzzTargetState) target_list; +} FuzzTargetState; + +typedef QSLIST_HEAD(, FuzzTargetState) FuzzTargetList; + +static const char *fuzz_arch = TARGET_NAME; + +static FuzzTargetList *fuzz_target_list; +static FuzzTarget *fuzz_target; +static QTestState *fuzz_qts; + + + +void flush_events(QTestState *s) +{ + int i = MAX_EVENT_LOOPS; + while (g_main_context_pending(NULL) && i-- > 0) { + main_loop_wait(false); + } +} + +static QTestState *qtest_setup(void) +{ + qtest_server_set_send_handler(&qtest_client_inproc_recv, &fuzz_qts); + return qtest_inproc_init(&fuzz_qts, false, fuzz_arch, + &qtest_server_inproc_recv); +} + +void fuzz_add_target(const FuzzTarget *target) +{ + FuzzTargetState *tmp; + FuzzTargetState *target_state; + if (!fuzz_target_list) { + fuzz_target_list = g_new0(FuzzTargetList, 1); + } + + QSLIST_FOREACH(tmp, fuzz_target_list, target_list) { + if (g_strcmp0(tmp->target->name, target->name) == 0) { + fprintf(stderr, "Error: Fuzz target name %s already in use\n", + target->name); + abort(); + } + } + target_state = g_new0(FuzzTargetState, 1); + target_state->target = g_new0(FuzzTarget, 1); + *(target_state->target) = *target; + QSLIST_INSERT_HEAD(fuzz_target_list, target_state, target_list); +} + + + +static void usage(char *path) +{ + printf("Usage: %s --fuzz-target=FUZZ_TARGET [LIBFUZZER ARGUMENTS]\n", path); + printf("where FUZZ_TARGET is one of:\n"); + FuzzTargetState *tmp; + if (!fuzz_target_list) { + fprintf(stderr, "Fuzz target list not initialized\n"); + abort(); + } + QSLIST_FOREACH(tmp, fuzz_target_list, target_list) { + printf(" * %s : %s\n", tmp->target->name, + tmp->target->description); + } + exit(0); +} + +static FuzzTarget *fuzz_get_target(char* name) +{ + FuzzTargetState *tmp; + if (!fuzz_target_list) { + fprintf(stderr, "Fuzz target list not initialized\n"); + abort(); + } + + QSLIST_FOREACH(tmp, fuzz_target_list, target_list) { + if (strcmp(tmp->target->name, name) == 0) { + return tmp->target; + } + } + return NULL; +} + + +/* Executed for each fuzzing-input */ +int LLVMFuzzerTestOneInput(const unsigned char *Data, size_t Size) +{ + /* + * Do the pre-fuzz-initialization before the first fuzzing iteration, + * instead of before the actual fuzz loop. This is needed since libfuzzer + * may fork off additional workers, prior to the fuzzing loop, and if + * pre_fuzz() sets up e.g. shared memory, this should be done for the + * individual worker processes + */ + static int pre_fuzz_done; + if (!pre_fuzz_done && fuzz_target->pre_fuzz) { + fuzz_target->pre_fuzz(fuzz_qts); + pre_fuzz_done = true; + } + + fuzz_target->fuzz(fuzz_qts, Data, Size); + return 0; +} + +/* Executed once, prior to fuzzing */ +int LLVMFuzzerInitialize(int *argc, char ***argv, char ***envp) +{ + + char *target_name; + + /* Initialize qgraph and modules */ + qos_graph_init(); + module_call_init(MODULE_INIT_FUZZ_TARGET); + module_call_init(MODULE_INIT_QOM); + module_call_init(MODULE_INIT_LIBQOS); + + if (*argc <= 1) { + usage(**argv); + } + + /* Identify the fuzz target */ + target_name = (*argv)[1]; + if (!strstr(target_name, "--fuzz-target=")) { + usage(**argv); + } + + target_name += strlen("--fuzz-target="); + + fuzz_target = fuzz_get_target(target_name); + if (!fuzz_target) { + usage(**argv); + } + + fuzz_qts = qtest_setup(); + + if (fuzz_target->pre_vm_init) { + fuzz_target->pre_vm_init(); + } + + /* Run QEMU's softmmu main with the fuzz-target dependent arguments */ + const char *init_cmdline = fuzz_target->get_init_cmdline(fuzz_target); + + /* Split the runcmd into an argv and argc */ + wordexp_t result; + wordexp(init_cmdline, &result, 0); + + qemu_init(result.we_wordc, result.we_wordv, NULL); + + return 0; +} diff --git a/tests/qtest/fuzz/fuzz.h b/tests/qtest/fuzz/fuzz.h new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/tests/qtest/fuzz/fuzz.h @@ -XXX,XX +XXX,XX @@ +/* + * fuzzing driver + * + * Copyright Red Hat Inc., 2019 + * + * Authors: + * Alexander Bulekov <alxndr@bu.edu> + * + * This work is licensed under the terms of the GNU GPL, version 2 or later. + * See the COPYING file in the top-level directory. + * + */ + +#ifndef FUZZER_H_ +#define FUZZER_H_ + +#include "qemu/osdep.h" +#include "qemu/units.h" +#include "qapi/error.h" + +#include "tests/qtest/libqtest.h" + +/** + * A libfuzzer fuzzing target + * + * The QEMU fuzzing binary is built with all available targets, each + * with a unique @name that can be specified on the command-line to + * select which target should run. + * + * A target must implement ->fuzz() to process a random input. If QEMU + * crashes in ->fuzz() then libfuzzer will record a failure. + * + * Fuzzing targets are registered with fuzz_add_target(): + * + * static const FuzzTarget fuzz_target = { + * .name = "my-device-fifo", + * .description = "Fuzz the FIFO buffer registers of my-device", + * ... + * }; + * + * static void register_fuzz_target(void) + * { + * fuzz_add_target(&fuzz_target); + * } + * fuzz_target_init(register_fuzz_target); + */ +typedef struct FuzzTarget { + const char *name; /* target identifier (passed to --fuzz-target=)*/ + const char *description; /* help text */ + + + /* + * returns the arg-list that is passed to qemu/softmmu init() + * Cannot be NULL + */ + const char* (*get_init_cmdline)(struct FuzzTarget *); + + /* + * will run once, prior to running qemu/softmmu init. + * eg: set up shared-memory for communication with the child-process + * Can be NULL + */ + void(*pre_vm_init)(void); + + /* + * will run once, after QEMU has been initialized, prior to the fuzz-loop. + * eg: detect the memory map + * Can be NULL + */ + void(*pre_fuzz)(QTestState *); + + /* + * accepts and executes an input from libfuzzer. this is repeatedly + * executed during the fuzzing loop. Its should handle setup, input + * execution and cleanup. + * Cannot be NULL + */ + void(*fuzz)(QTestState *, const unsigned char *, size_t); + +} FuzzTarget; + +void flush_events(QTestState *); +void reboot(QTestState *); + +/* + * makes a copy of *target and adds it to the target-list. + * i.e. fine to set up target on the caller's stack + */ +void fuzz_add_target(const FuzzTarget *target); + +int LLVMFuzzerTestOneInput(const unsigned char *Data, size_t Size); +int LLVMFuzzerInitialize(int *argc, char ***argv, char ***envp); + +#endif + -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> Ram blocks were marked MADV_DONTFORK breaking fuzzing-tests which execute each test-input in a forked process. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-14-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- exec.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/exec.c b/exec.c index XXXXXXX..XXXXXXX 100644 --- a/exec.c +++ b/exec.c @@ -XXX,XX +XXX,XX @@ #include "sysemu/kvm.h" #include "sysemu/sysemu.h" #include "sysemu/tcg.h" +#include "sysemu/qtest.h" #include "qemu/timer.h" #include "qemu/config-file.h" #include "qemu/error-report.h" @@ -XXX,XX +XXX,XX @@ static void ram_block_add(RAMBlock *new_block, Error **errp, bool shared) if (new_block->host) { qemu_ram_setup_dump(new_block->host, new_block->max_length); qemu_madvise(new_block->host, new_block->max_length, QEMU_MADV_HUGEPAGE); - /* MADV_DONTFORK is also needed by KVM in absence of synchronous MMU */ - qemu_madvise(new_block->host, new_block->max_length, QEMU_MADV_DONTFORK); + /* + * MADV_DONTFORK is also needed by KVM in absence of synchronous MMU + * Configure it unless the machine is a qtest server, in which case + * KVM is not used and it may be forked (eg for fuzzing purposes). + */ + if (!qtest_enabled()) { + qemu_madvise(new_block->host, new_block->max_length, + QEMU_MADV_DONTFORK); + } ram_block_notify_add(new_block->host, new_block->max_length); } } -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> The qtest-based fuzzer makes use of forking to reset-state between tests. Keep the callback enabled, so the call_rcu thread gets created within the child process. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Acked-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20200220041118.23264-15-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- softmmu/vl.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/softmmu/vl.c b/softmmu/vl.c index XXXXXXX..XXXXXXX 100644 --- a/softmmu/vl.c +++ b/softmmu/vl.c @@ -XXX,XX +XXX,XX @@ void qemu_init(int argc, char **argv, char **envp) set_memory_options(&ram_slots, &maxram_size, machine_class); os_daemonize(); - rcu_disable_atfork(); + + /* + * If QTest is enabled, keep the rcu_atfork enabled, since system processes + * may be forked testing purposes (e.g. fork-server based fuzzing) The fork + * should happen before a signle cpu instruction is executed, to prevent + * deadlocks. See commit 73c6e40, rcu: "completely disable pthread_atfork + * callbacks as soon as possible" + */ + if (!qtest_enabled()) { + rcu_disable_atfork(); + } if (pid_file && !qemu_write_pidfile(pid_file, &err)) { error_reportf_err(err, "cannot create PID file: "); -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> fork() is a simple way to ensure that state does not leak in between fuzzing runs. Unfortunately, the fuzzer mutation engine relies on bitmaps which contain coverage information for each fuzzing run, and these bitmaps should be copied from the child to the parent(where the mutation occurs). These bitmaps are created through compile-time instrumentation and they are not shared with fork()-ed processes, by default. To address this, we create a shared memory region, adjust its size and map it _over_ the counter region. Furthermore, libfuzzer doesn't generally expose the globals that specify the location of the counters/coverage bitmap. As a workaround, we rely on a custom linker script which forces all of the bitmaps we care about to be placed in a contiguous region, which is easy to locate and mmap over. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-16-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- tests/qtest/fuzz/Makefile.include | 5 +++ tests/qtest/fuzz/fork_fuzz.c | 55 +++++++++++++++++++++++++++++++ tests/qtest/fuzz/fork_fuzz.h | 23 +++++++++++++ tests/qtest/fuzz/fork_fuzz.ld | 37 +++++++++++++++++++++ 4 files changed, 120 insertions(+) create mode 100644 tests/qtest/fuzz/fork_fuzz.c create mode 100644 tests/qtest/fuzz/fork_fuzz.h create mode 100644 tests/qtest/fuzz/fork_fuzz.ld diff --git a/tests/qtest/fuzz/Makefile.include b/tests/qtest/fuzz/Makefile.include index XXXXXXX..XXXXXXX 100644 --- a/tests/qtest/fuzz/Makefile.include +++ b/tests/qtest/fuzz/Makefile.include @@ -XXX,XX +XXX,XX @@ QEMU_PROG_FUZZ=qemu-fuzz-$(TARGET_NAME)$(EXESUF) fuzz-obj-y += tests/qtest/libqtest.o fuzz-obj-y += tests/qtest/fuzz/fuzz.o # Fuzzer skeleton +fuzz-obj-y += tests/qtest/fuzz/fork_fuzz.o FUZZ_CFLAGS += -I$(SRC_PATH)/tests -I$(SRC_PATH)/tests/qtest + +# Linker Script to force coverage-counters into known regions which we can mark +# shared +FUZZ_LDFLAGS += -Xlinker -T$(SRC_PATH)/tests/qtest/fuzz/fork_fuzz.ld diff --git a/tests/qtest/fuzz/fork_fuzz.c b/tests/qtest/fuzz/fork_fuzz.c new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/tests/qtest/fuzz/fork_fuzz.c @@ -XXX,XX +XXX,XX @@ +/* + * Fork-based fuzzing helpers + * + * Copyright Red Hat Inc., 2019 + * + * Authors: + * Alexander Bulekov <alxndr@bu.edu> + * + * This work is licensed under the terms of the GNU GPL, version 2 or later. + * See the COPYING file in the top-level directory. + * + */ + +#include "qemu/osdep.h" +#include "fork_fuzz.h" + + +void counter_shm_init(void) +{ + char *shm_path = g_strdup_printf("/qemu-fuzz-cntrs.%d", getpid()); + int fd = shm_open(shm_path, O_CREAT | O_RDWR, S_IRUSR | S_IWUSR); + g_free(shm_path); + + if (fd == -1) { + perror("Error: "); + exit(1); + } + if (ftruncate(fd, &__FUZZ_COUNTERS_END - &__FUZZ_COUNTERS_START) == -1) { + perror("Error: "); + exit(1); + } + /* Copy what's in the counter region to the shm.. */ + void *rptr = mmap(NULL , + &__FUZZ_COUNTERS_END - &__FUZZ_COUNTERS_START, + PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0); + memcpy(rptr, + &__FUZZ_COUNTERS_START, + &__FUZZ_COUNTERS_END - &__FUZZ_COUNTERS_START); + + munmap(rptr, &__FUZZ_COUNTERS_END - &__FUZZ_COUNTERS_START); + + /* And map the shm over the counter region */ + rptr = mmap(&__FUZZ_COUNTERS_START, + &__FUZZ_COUNTERS_END - &__FUZZ_COUNTERS_START, + PROT_READ | PROT_WRITE, MAP_SHARED | MAP_FIXED, fd, 0); + + close(fd); + + if (!rptr) { + perror("Error: "); + exit(1); + } +} + + diff --git a/tests/qtest/fuzz/fork_fuzz.h b/tests/qtest/fuzz/fork_fuzz.h new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/tests/qtest/fuzz/fork_fuzz.h @@ -XXX,XX +XXX,XX @@ +/* + * Fork-based fuzzing helpers + * + * Copyright Red Hat Inc., 2019 + * + * Authors: + * Alexander Bulekov <alxndr@bu.edu> + * + * This work is licensed under the terms of the GNU GPL, version 2 or later. + * See the COPYING file in the top-level directory. + * + */ + +#ifndef FORK_FUZZ_H +#define FORK_FUZZ_H + +extern uint8_t __FUZZ_COUNTERS_START; +extern uint8_t __FUZZ_COUNTERS_END; + +void counter_shm_init(void); + +#endif + diff --git a/tests/qtest/fuzz/fork_fuzz.ld b/tests/qtest/fuzz/fork_fuzz.ld new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/tests/qtest/fuzz/fork_fuzz.ld @@ -XXX,XX +XXX,XX @@ +/* We adjust linker script modification to place all of the stuff that needs to + * persist across fuzzing runs into a contiguous seciton of memory. Then, it is + * easy to re-map the counter-related memory as shared. +*/ + +SECTIONS +{ + .data.fuzz_start : ALIGN(4K) + { + __FUZZ_COUNTERS_START = .; + __start___sancov_cntrs = .; + *(_*sancov_cntrs); + __stop___sancov_cntrs = .; + + /* Lowest stack counter */ + *(__sancov_lowest_stack); + } + .data.fuzz_ordered : + { + /* Coverage counters. They're not necessary for fuzzing, but are useful + * for analyzing the fuzzing performance + */ + __start___llvm_prf_cnts = .; + *(*llvm_prf_cnts); + __stop___llvm_prf_cnts = .; + + /* Internal Libfuzzer TracePC object which contains the ValueProfileMap */ + FuzzerTracePC*(.bss*); + } + .data.fuzz_end : ALIGN(4K) + { + __FUZZ_COUNTERS_END = .; + } +} +/* Dont overwrite the SECTIONS in the default linker script. Instead insert the + * above into the default script */ +INSERT AFTER .data; -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-17-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- tests/qtest/fuzz/Makefile.include | 2 + tests/qtest/fuzz/qos_fuzz.c | 234 ++++++++++++++++++++++++++++++ tests/qtest/fuzz/qos_fuzz.h | 33 +++++ 3 files changed, 269 insertions(+) create mode 100644 tests/qtest/fuzz/qos_fuzz.c create mode 100644 tests/qtest/fuzz/qos_fuzz.h diff --git a/tests/qtest/fuzz/Makefile.include b/tests/qtest/fuzz/Makefile.include index XXXXXXX..XXXXXXX 100644 --- a/tests/qtest/fuzz/Makefile.include +++ b/tests/qtest/fuzz/Makefile.include @@ -XXX,XX +XXX,XX @@ QEMU_PROG_FUZZ=qemu-fuzz-$(TARGET_NAME)$(EXESUF) fuzz-obj-y += tests/qtest/libqtest.o +fuzz-obj-y += $(libqos-obj-y) fuzz-obj-y += tests/qtest/fuzz/fuzz.o # Fuzzer skeleton fuzz-obj-y += tests/qtest/fuzz/fork_fuzz.o +fuzz-obj-y += tests/qtest/fuzz/qos_fuzz.o FUZZ_CFLAGS += -I$(SRC_PATH)/tests -I$(SRC_PATH)/tests/qtest diff --git a/tests/qtest/fuzz/qos_fuzz.c b/tests/qtest/fuzz/qos_fuzz.c new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/tests/qtest/fuzz/qos_fuzz.c @@ -XXX,XX +XXX,XX @@ +/* + * QOS-assisted fuzzing helpers + * + * Copyright (c) 2018 Emanuele Giuseppe Esposito <e.emanuelegiuseppe@gmail.com> + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License version 2 as published by the Free Software Foundation. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, see <http://www.gnu.org/licenses/> + */ + +#include "qemu/osdep.h" +#include "qemu/units.h" +#include "qapi/error.h" +#include "qemu-common.h" +#include "exec/memory.h" +#include "exec/address-spaces.h" +#include "sysemu/sysemu.h" +#include "qemu/main-loop.h" + +#include "tests/qtest/libqtest.h" +#include "tests/qtest/libqos/malloc.h" +#include "tests/qtest/libqos/qgraph.h" +#include "tests/qtest/libqos/qgraph_internal.h" +#include "tests/qtest/libqos/qos_external.h" + +#include "fuzz.h" +#include "qos_fuzz.h" + +#include "qapi/qapi-commands-machine.h" +#include "qapi/qapi-commands-qom.h" +#include "qapi/qmp/qlist.h" + + +void *fuzz_qos_obj; +QGuestAllocator *fuzz_qos_alloc; + +static const char *fuzz_target_name; +static char **fuzz_path_vec; + +/* + * Replaced the qmp commands with direct qmp_marshal calls. + * Probably there is a better way to do this + */ +static void qos_set_machines_devices_available(void) +{ + QDict *req = qdict_new(); + QObject *response; + QDict *args = qdict_new(); + QList *lst; + Error *err = NULL; + + qmp_marshal_query_machines(NULL, &response, &err); + assert(!err); + lst = qobject_to(QList, response); + apply_to_qlist(lst, true); + + qobject_unref(response); + + + qdict_put_str(req, "execute", "qom-list-types"); + qdict_put_str(args, "implements", "device"); + qdict_put_bool(args, "abstract", true); + qdict_put_obj(req, "arguments", (QObject *) args); + + qmp_marshal_qom_list_types(args, &response, &err); + assert(!err); + lst = qobject_to(QList, response); + apply_to_qlist(lst, false); + qobject_unref(response); + qobject_unref(req); +} + +static char **current_path; + +void *qos_allocate_objects(QTestState *qts, QGuestAllocator **p_alloc) +{ + return allocate_objects(qts, current_path + 1, p_alloc); +} + +static const char *qos_build_main_args(void) +{ + char **path = fuzz_path_vec; + QOSGraphNode *test_node; + GString *cmd_line = g_string_new(path[0]); + void *test_arg; + + if (!path) { + fprintf(stderr, "QOS Path not found\n"); + abort(); + } + + /* Before test */ + current_path = path; + test_node = qos_graph_get_node(path[(g_strv_length(path) - 1)]); + test_arg = test_node->u.test.arg; + if (test_node->u.test.before) { + test_arg = test_node->u.test.before(cmd_line, test_arg); + } + /* Prepend the arguments that we need */ + g_string_prepend(cmd_line, + TARGET_NAME " -display none -machine accel=qtest -m 64 "); + return cmd_line->str; +} + +/* + * This function is largely a copy of qos-test.c:walk_path. Since walk_path + * is itself a callback, its a little annoying to add another argument/layer of + * indirection + */ +static void walk_path(QOSGraphNode *orig_path, int len) +{ + QOSGraphNode *path; + QOSGraphEdge *edge; + + /* etype set to QEDGE_CONSUMED_BY so that machine can add to the command line */ + QOSEdgeType etype = QEDGE_CONSUMED_BY; + + /* twice QOS_PATH_MAX_ELEMENT_SIZE since each edge can have its arg */ + char **path_vec = g_new0(char *, (QOS_PATH_MAX_ELEMENT_SIZE * 2)); + int path_vec_size = 0; + + char *after_cmd, *before_cmd, *after_device; + GString *after_device_str = g_string_new(""); + char *node_name = orig_path->name, *path_str; + + GString *cmd_line = g_string_new(""); + GString *cmd_line2 = g_string_new(""); + + path = qos_graph_get_node(node_name); /* root */ + node_name = qos_graph_edge_get_dest(path->path_edge); /* machine name */ + + path_vec[path_vec_size++] = node_name; + path_vec[path_vec_size++] = qos_get_machine_type(node_name); + + for (;;) { + path = qos_graph_get_node(node_name); + if (!path->path_edge) { + break; + } + + node_name = qos_graph_edge_get_dest(path->path_edge); + + /* append node command line + previous edge command line */ + if (path->command_line && etype == QEDGE_CONSUMED_BY) { + g_string_append(cmd_line, path->command_line); + g_string_append(cmd_line, after_device_str->str); + g_string_truncate(after_device_str, 0); + } + + path_vec[path_vec_size++] = qos_graph_edge_get_name(path->path_edge); + /* detect if edge has command line args */ + after_cmd = qos_graph_edge_get_after_cmd_line(path->path_edge); + after_device = qos_graph_edge_get_extra_device_opts(path->path_edge); + before_cmd = qos_graph_edge_get_before_cmd_line(path->path_edge); + edge = qos_graph_get_edge(path->name, node_name); + etype = qos_graph_edge_get_type(edge); + + if (before_cmd) { + g_string_append(cmd_line, before_cmd); + } + if (after_cmd) { + g_string_append(cmd_line2, after_cmd); + } + if (after_device) { + g_string_append(after_device_str, after_device); + } + } + + path_vec[path_vec_size++] = NULL; + g_string_append(cmd_line, after_device_str->str); + g_string_free(after_device_str, true); + + g_string_append(cmd_line, cmd_line2->str); + g_string_free(cmd_line2, true); + + /* + * here position 0 has <arch>/<machine>, position 1 has <machine>. + * The path must not have the <arch>, qtest_add_data_func adds it. + */ + path_str = g_strjoinv("/", path_vec + 1); + + /* Check that this is the test we care about: */ + char *test_name = strrchr(path_str, '/') + 1; + if (strcmp(test_name, fuzz_target_name) == 0) { + /* + * put arch/machine in position 1 so run_one_test can do its work + * and add the command line at position 0. + */ + path_vec[1] = path_vec[0]; + path_vec[0] = g_string_free(cmd_line, false); + + fuzz_path_vec = path_vec; + } else { + g_free(path_vec); + } + + g_free(path_str); +} + +static const char *qos_get_cmdline(FuzzTarget *t) +{ + /* + * Set a global variable that we use to identify the qos_path for our + * fuzz_target + */ + fuzz_target_name = t->name; + qos_set_machines_devices_available(); + qos_graph_foreach_test_path(walk_path); + return qos_build_main_args(); +} + +void fuzz_add_qos_target( + FuzzTarget *fuzz_opts, + const char *interface, + QOSGraphTestOptions *opts + ) +{ + qos_add_test(fuzz_opts->name, interface, NULL, opts); + fuzz_opts->get_init_cmdline = qos_get_cmdline; + fuzz_add_target(fuzz_opts); +} + +void qos_init_path(QTestState *s) +{ + fuzz_qos_obj = qos_allocate_objects(s , &fuzz_qos_alloc); +} diff --git a/tests/qtest/fuzz/qos_fuzz.h b/tests/qtest/fuzz/qos_fuzz.h new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/tests/qtest/fuzz/qos_fuzz.h @@ -XXX,XX +XXX,XX @@ +/* + * QOS-assisted fuzzing helpers + * + * Copyright Red Hat Inc., 2019 + * + * Authors: + * Alexander Bulekov <alxndr@bu.edu> + * + * This work is licensed under the terms of the GNU GPL, version 2 or later. + * See the COPYING file in the top-level directory. + */ + +#ifndef _QOS_FUZZ_H_ +#define _QOS_FUZZ_H_ + +#include "tests/qtest/fuzz/fuzz.h" +#include "tests/qtest/libqos/qgraph.h" + +int qos_fuzz(const unsigned char *Data, size_t Size); +void qos_setup(void); + +extern void *fuzz_qos_obj; +extern QGuestAllocator *fuzz_qos_alloc; + +void fuzz_add_qos_target( + FuzzTarget *fuzz_opts, + const char *interface, + QOSGraphTestOptions *opts + ); + +void qos_init_path(QTestState *); + +#endif -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20200220041118.23264-18-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- Makefile | 15 ++++++++++++++- Makefile.target | 16 ++++++++++++++++ 2 files changed, 30 insertions(+), 1 deletion(-) diff --git a/Makefile b/Makefile index XXXXXXX..XXXXXXX 100644 --- a/Makefile +++ b/Makefile @@ -XXX,XX +XXX,XX @@ config-host.h-timestamp: config-host.mak qemu-options.def: $(SRC_PATH)/qemu-options.hx $(SRC_PATH)/scripts/hxtool $(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -h < $< > $@,"GEN","$@") -TARGET_DIRS_RULES := $(foreach t, all clean install, $(addsuffix /$(t), $(TARGET_DIRS))) +TARGET_DIRS_RULES := $(foreach t, all fuzz clean install, $(addsuffix /$(t), $(TARGET_DIRS))) SOFTMMU_ALL_RULES=$(filter %-softmmu/all, $(TARGET_DIRS_RULES)) $(SOFTMMU_ALL_RULES): $(authz-obj-y) @@ -XXX,XX +XXX,XX @@ ifdef DECOMPRESS_EDK2_BLOBS $(SOFTMMU_ALL_RULES): $(edk2-decompressed) endif +SOFTMMU_FUZZ_RULES=$(filter %-softmmu/fuzz, $(TARGET_DIRS_RULES)) +$(SOFTMMU_FUZZ_RULES): $(authz-obj-y) +$(SOFTMMU_FUZZ_RULES): $(block-obj-y) +$(SOFTMMU_FUZZ_RULES): $(chardev-obj-y) +$(SOFTMMU_FUZZ_RULES): $(crypto-obj-y) +$(SOFTMMU_FUZZ_RULES): $(io-obj-y) +$(SOFTMMU_FUZZ_RULES): config-all-devices.mak +$(SOFTMMU_FUZZ_RULES): $(edk2-decompressed) + .PHONY: $(TARGET_DIRS_RULES) # The $(TARGET_DIRS_RULES) are of the form SUBDIR/GOAL, so that # $(dir $@) yields the sub-directory, and $(notdir $@) yields the sub-goal @@ -XXX,XX +XXX,XX @@ subdir-slirp: slirp/all $(filter %/all, $(TARGET_DIRS_RULES)): libqemuutil.a $(common-obj-y) \ $(qom-obj-y) +$(filter %/fuzz, $(TARGET_DIRS_RULES)): libqemuutil.a $(common-obj-y) \ + $(qom-obj-y) $(crypto-user-obj-$(CONFIG_USER_ONLY)) + ROM_DIRS = $(addprefix pc-bios/, $(ROMS)) ROM_DIRS_RULES=$(foreach t, all clean, $(addsuffix /$(t), $(ROM_DIRS))) # Only keep -O and -g cflags @@ -XXX,XX +XXX,XX @@ $(ROM_DIRS_RULES): .PHONY: recurse-all recurse-clean recurse-install recurse-all: $(addsuffix /all, $(TARGET_DIRS) $(ROM_DIRS)) +recurse-fuzz: $(addsuffix /fuzz, $(TARGET_DIRS) $(ROM_DIRS)) recurse-clean: $(addsuffix /clean, $(TARGET_DIRS) $(ROM_DIRS)) recurse-install: $(addsuffix /install, $(TARGET_DIRS)) $(addsuffix /install, $(TARGET_DIRS)): all diff --git a/Makefile.target b/Makefile.target index XXXXXXX..XXXXXXX 100644 --- a/Makefile.target +++ b/Makefile.target @@ -XXX,XX +XXX,XX @@ ifdef CONFIG_TRACE_SYSTEMTAP rm -f *.stp endif +ifdef CONFIG_FUZZ +include $(SRC_PATH)/tests/qtest/fuzz/Makefile.include +include $(SRC_PATH)/tests/qtest/Makefile.include + +fuzz: fuzz-vars +fuzz-vars: QEMU_CFLAGS := $(FUZZ_CFLAGS) $(QEMU_CFLAGS) +fuzz-vars: QEMU_LDFLAGS := $(FUZZ_LDFLAGS) $(QEMU_LDFLAGS) +fuzz-vars: $(QEMU_PROG_FUZZ) +dummy := $(call unnest-vars,, fuzz-obj-y) + + +$(QEMU_PROG_FUZZ): config-devices.mak $(all-obj-y) $(COMMON_LDADDS) $(fuzz-obj-y) + $(call LINK, $(filter-out %.mak, $^)) + +endif + install: all ifneq ($(PROGS),) $(call install-prog,$(PROGS),$(DESTDIR)$(bindir)) -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-19-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- configure | 39 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) diff --git a/configure b/configure index XXXXXXX..XXXXXXX 100755 --- a/configure +++ b/configure @@ -XXX,XX +XXX,XX @@ debug_mutex="no" libpmem="" default_devices="yes" plugins="no" +fuzzing="no" supported_cpu="no" supported_os="no" @@ -XXX,XX +XXX,XX @@ int main(void) { return 0; } EOF } +write_c_fuzzer_skeleton() { + cat > $TMPC <<EOF +#include <stdint.h> +#include <sys/types.h> +int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size); +int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { return 0; } +EOF +} + if check_define __linux__ ; then targetos="Linux" elif check_define _WIN32 ; then @@ -XXX,XX +XXX,XX @@ for opt do ;; --disable-containers) use_containers="no" ;; + --enable-fuzzing) fuzzing=yes + ;; + --disable-fuzzing) fuzzing=no + ;; *) echo "ERROR: unknown option $opt" echo "Try '$0 --help' for more information" @@ -XXX,XX +XXX,XX @@ EOF fi fi +########################################## +# checks for fuzzer +if test "$fuzzing" = "yes" ; then + write_c_fuzzer_skeleton + if compile_prog "$CPU_CFLAGS -Werror -fsanitize=address,fuzzer" ""; then + have_fuzzer=yes + fi +fi + ########################################## # check for libpmem @@ -XXX,XX +XXX,XX @@ echo "libpmem support $libpmem" echo "libudev $libudev" echo "default devices $default_devices" echo "plugin support $plugins" +echo "fuzzing support $fuzzing" if test "$supported_cpu" = "no"; then echo @@ -XXX,XX +XXX,XX @@ fi if test "$sheepdog" = "yes" ; then echo "CONFIG_SHEEPDOG=y" >> $config_host_mak fi +if test "$fuzzing" = "yes" ; then + if test "$have_fuzzer" = "yes"; then + FUZZ_LDFLAGS=" -fsanitize=address,fuzzer" + FUZZ_CFLAGS=" -fsanitize=address,fuzzer" + CFLAGS=" -fsanitize=address,fuzzer-no-link" + else + error_exit "Your compiler doesn't support -fsanitize=address,fuzzer" + exit 1 + fi +fi if test "$plugins" = "yes" ; then echo "CONFIG_PLUGIN=y" >> $config_host_mak @@ -XXX,XX +XXX,XX @@ if test "$libudev" != "no"; then echo "CONFIG_LIBUDEV=y" >> $config_host_mak echo "LIBUDEV_LIBS=$libudev_libs" >> $config_host_mak fi +if test "$fuzzing" != "no"; then + echo "CONFIG_FUZZ=y" >> $config_host_mak + echo "FUZZ_CFLAGS=$FUZZ_CFLAGS" >> $config_host_mak + echo "FUZZ_LDFLAGS=$FUZZ_LDFLAGS" >> $config_host_mak +fi if test "$edk2_blobs" = "yes" ; then echo "DECOMPRESS_EDK2_BLOBS=y" >> $config_host_mak -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> These three targets should simply fuzz reads/writes to a couple ioports, but they mostly serve as examples of different ways to write targets. They demonstrate using qtest and qos for fuzzing, as well as using rebooting and forking to reset state, or not resetting it at all. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-20-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- tests/qtest/fuzz/Makefile.include | 3 + tests/qtest/fuzz/i440fx_fuzz.c | 193 ++++++++++++++++++++++++++++++ 2 files changed, 196 insertions(+) create mode 100644 tests/qtest/fuzz/i440fx_fuzz.c diff --git a/tests/qtest/fuzz/Makefile.include b/tests/qtest/fuzz/Makefile.include index XXXXXXX..XXXXXXX 100644 --- a/tests/qtest/fuzz/Makefile.include +++ b/tests/qtest/fuzz/Makefile.include @@ -XXX,XX +XXX,XX @@ fuzz-obj-y += tests/qtest/fuzz/fuzz.o # Fuzzer skeleton fuzz-obj-y += tests/qtest/fuzz/fork_fuzz.o fuzz-obj-y += tests/qtest/fuzz/qos_fuzz.o +# Targets +fuzz-obj-y += tests/qtest/fuzz/i440fx_fuzz.o + FUZZ_CFLAGS += -I$(SRC_PATH)/tests -I$(SRC_PATH)/tests/qtest # Linker Script to force coverage-counters into known regions which we can mark diff --git a/tests/qtest/fuzz/i440fx_fuzz.c b/tests/qtest/fuzz/i440fx_fuzz.c new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/tests/qtest/fuzz/i440fx_fuzz.c @@ -XXX,XX +XXX,XX @@ +/* + * I440FX Fuzzing Target + * + * Copyright Red Hat Inc., 2019 + * + * Authors: + * Alexander Bulekov <alxndr@bu.edu> + * + * This work is licensed under the terms of the GNU GPL, version 2 or later. + * See the COPYING file in the top-level directory. + */ + +#include "qemu/osdep.h" + +#include "qemu/main-loop.h" +#include "tests/qtest/libqtest.h" +#include "tests/qtest/libqos/pci.h" +#include "tests/qtest/libqos/pci-pc.h" +#include "fuzz.h" +#include "fuzz/qos_fuzz.h" +#include "fuzz/fork_fuzz.h" + + +#define I440FX_PCI_HOST_BRIDGE_CFG 0xcf8 +#define I440FX_PCI_HOST_BRIDGE_DATA 0xcfc + +/* + * the input to the fuzzing functions below is a buffer of random bytes. we + * want to convert these bytes into a sequence of qtest or qos calls. to do + * this we define some opcodes: + */ +enum action_id { + WRITEB, + WRITEW, + WRITEL, + READB, + READW, + READL, + ACTION_MAX +}; + +static void i440fx_fuzz_qtest(QTestState *s, + const unsigned char *Data, size_t Size) { + /* + * loop over the Data, breaking it up into actions. each action has an + * opcode, address offset and value + */ + typedef struct QTestFuzzAction { + uint8_t opcode; + uint8_t addr; + uint32_t value; + } QTestFuzzAction; + QTestFuzzAction a; + + while (Size >= sizeof(a)) { + /* make a copy of the action so we can normalize the values in-place */ + memcpy(&a, Data, sizeof(a)); + /* select between two i440fx Port IO addresses */ + uint16_t addr = a.addr % 2 ? I440FX_PCI_HOST_BRIDGE_CFG : + I440FX_PCI_HOST_BRIDGE_DATA; + switch (a.opcode % ACTION_MAX) { + case WRITEB: + qtest_outb(s, addr, (uint8_t)a.value); + break; + case WRITEW: + qtest_outw(s, addr, (uint16_t)a.value); + break; + case WRITEL: + qtest_outl(s, addr, (uint32_t)a.value); + break; + case READB: + qtest_inb(s, addr); + break; + case READW: + qtest_inw(s, addr); + break; + case READL: + qtest_inl(s, addr); + break; + } + /* Move to the next operation */ + Size -= sizeof(a); + Data += sizeof(a); + } + flush_events(s); +} + +static void i440fx_fuzz_qos(QTestState *s, + const unsigned char *Data, size_t Size) { + /* + * Same as i440fx_fuzz_qtest, but using QOS. devfn is incorporated into the + * value written over Port IO + */ + typedef struct QOSFuzzAction { + uint8_t opcode; + uint8_t offset; + int devfn; + uint32_t value; + } QOSFuzzAction; + + static QPCIBus *bus; + if (!bus) { + bus = qpci_new_pc(s, fuzz_qos_alloc); + } + + QOSFuzzAction a; + while (Size >= sizeof(a)) { + memcpy(&a, Data, sizeof(a)); + switch (a.opcode % ACTION_MAX) { + case WRITEB: + bus->config_writeb(bus, a.devfn, a.offset, (uint8_t)a.value); + break; + case WRITEW: + bus->config_writew(bus, a.devfn, a.offset, (uint16_t)a.value); + break; + case WRITEL: + bus->config_writel(bus, a.devfn, a.offset, (uint32_t)a.value); + break; + case READB: + bus->config_readb(bus, a.devfn, a.offset); + break; + case READW: + bus->config_readw(bus, a.devfn, a.offset); + break; + case READL: + bus->config_readl(bus, a.devfn, a.offset); + break; + } + Size -= sizeof(a); + Data += sizeof(a); + } + flush_events(s); +} + +static void i440fx_fuzz_qos_fork(QTestState *s, + const unsigned char *Data, size_t Size) { + if (fork() == 0) { + i440fx_fuzz_qos(s, Data, Size); + _Exit(0); + } else { + wait(NULL); + } +} + +static const char *i440fx_qtest_argv = TARGET_NAME " -machine accel=qtest" + "-m 0 -display none"; +static const char *i440fx_argv(FuzzTarget *t) +{ + return i440fx_qtest_argv; +} + +static void fork_init(void) +{ + counter_shm_init(); +} + +static void register_pci_fuzz_targets(void) +{ + /* Uses simple qtest commands and reboots to reset state */ + fuzz_add_target(&(FuzzTarget){ + .name = "i440fx-qtest-reboot-fuzz", + .description = "Fuzz the i440fx using raw qtest commands and" + "rebooting after each run", + .get_init_cmdline = i440fx_argv, + .fuzz = i440fx_fuzz_qtest}); + + /* Uses libqos and forks to prevent state leakage */ + fuzz_add_qos_target(&(FuzzTarget){ + .name = "i440fx-qos-fork-fuzz", + .description = "Fuzz the i440fx using raw qtest commands and" + "rebooting after each run", + .pre_vm_init = &fork_init, + .fuzz = i440fx_fuzz_qos_fork,}, + "i440FX-pcihost", + &(QOSGraphTestOptions){} + ); + + /* + * Uses libqos. Doesn't do anything to reset state. Note that if we were to + * reboot after each run, we would also have to redo the qos-related + * initialization (qos_init_path) + */ + fuzz_add_qos_target(&(FuzzTarget){ + .name = "i440fx-qos-noreset-fuzz", + .description = "Fuzz the i440fx using raw qtest commands and" + "rebooting after each run", + .fuzz = i440fx_fuzz_qos,}, + "i440FX-pcihost", + &(QOSGraphTestOptions){} + ); +} + +fuzz_target_init(register_pci_fuzz_targets); -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> The virtio-net fuzz target feeds inputs to all three virtio-net virtqueues, and uses forking to avoid leaking state between fuzz runs. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-21-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- tests/qtest/fuzz/Makefile.include | 1 + tests/qtest/fuzz/virtio_net_fuzz.c | 198 +++++++++++++++++++++++++++++ 2 files changed, 199 insertions(+) create mode 100644 tests/qtest/fuzz/virtio_net_fuzz.c diff --git a/tests/qtest/fuzz/Makefile.include b/tests/qtest/fuzz/Makefile.include index XXXXXXX..XXXXXXX 100644 --- a/tests/qtest/fuzz/Makefile.include +++ b/tests/qtest/fuzz/Makefile.include @@ -XXX,XX +XXX,XX @@ fuzz-obj-y += tests/qtest/fuzz/qos_fuzz.o # Targets fuzz-obj-y += tests/qtest/fuzz/i440fx_fuzz.o +fuzz-obj-y += tests/qtest/fuzz/virtio_net_fuzz.o FUZZ_CFLAGS += -I$(SRC_PATH)/tests -I$(SRC_PATH)/tests/qtest diff --git a/tests/qtest/fuzz/virtio_net_fuzz.c b/tests/qtest/fuzz/virtio_net_fuzz.c new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/tests/qtest/fuzz/virtio_net_fuzz.c @@ -XXX,XX +XXX,XX @@ +/* + * virtio-net Fuzzing Target + * + * Copyright Red Hat Inc., 2019 + * + * Authors: + * Alexander Bulekov <alxndr@bu.edu> + * + * This work is licensed under the terms of the GNU GPL, version 2 or later. + * See the COPYING file in the top-level directory. + */ + +#include "qemu/osdep.h" + +#include "standard-headers/linux/virtio_config.h" +#include "tests/qtest/libqtest.h" +#include "tests/qtest/libqos/virtio-net.h" +#include "fuzz.h" +#include "fork_fuzz.h" +#include "qos_fuzz.h" + + +#define QVIRTIO_NET_TIMEOUT_US (30 * 1000 * 1000) +#define QVIRTIO_RX_VQ 0 +#define QVIRTIO_TX_VQ 1 +#define QVIRTIO_CTRL_VQ 2 + +static int sockfds[2]; +static bool sockfds_initialized; + +static void virtio_net_fuzz_multi(QTestState *s, + const unsigned char *Data, size_t Size, bool check_used) +{ + typedef struct vq_action { + uint8_t queue; + uint8_t length; + uint8_t write; + uint8_t next; + uint8_t rx; + } vq_action; + + uint32_t free_head = 0; + + QGuestAllocator *t_alloc = fuzz_qos_alloc; + + QVirtioNet *net_if = fuzz_qos_obj; + QVirtioDevice *dev = net_if->vdev; + QVirtQueue *q; + vq_action vqa; + while (Size >= sizeof(vqa)) { + memcpy(&vqa, Data, sizeof(vqa)); + Data += sizeof(vqa); + Size -= sizeof(vqa); + + q = net_if->queues[vqa.queue % 3]; + + vqa.length = vqa.length >= Size ? Size : vqa.length; + + /* + * Only attempt to write incoming packets, when using the socket + * backend. Otherwise, always place the input on a virtqueue. + */ + if (vqa.rx && sockfds_initialized) { + write(sockfds[0], Data, vqa.length); + } else { + vqa.rx = 0; + uint64_t req_addr = guest_alloc(t_alloc, vqa.length); + /* + * If checking used ring, ensure that the fuzzer doesn't trigger + * trivial asserion failure on zero-zied buffer + */ + qtest_memwrite(s, req_addr, Data, vqa.length); + + + free_head = qvirtqueue_add(s, q, req_addr, vqa.length, + vqa.write, vqa.next); + qvirtqueue_add(s, q, req_addr, vqa.length, vqa.write , vqa.next); + qvirtqueue_kick(s, dev, q, free_head); + } + + /* Run the main loop */ + qtest_clock_step(s, 100); + flush_events(s); + + /* Wait on used descriptors */ + if (check_used && !vqa.rx) { + gint64 start_time = g_get_monotonic_time(); + /* + * normally, we could just use qvirtio_wait_used_elem, but since we + * must manually run the main-loop for all the bhs to run, we use + * this hack with flush_events(), to run the main_loop + */ + while (!vqa.rx && q != net_if->queues[QVIRTIO_RX_VQ]) { + uint32_t got_desc_idx; + /* Input led to a virtio_error */ + if (dev->bus->get_status(dev) & VIRTIO_CONFIG_S_NEEDS_RESET) { + break; + } + if (dev->bus->get_queue_isr_status(dev, q) && + qvirtqueue_get_buf(s, q, &got_desc_idx, NULL)) { + g_assert_cmpint(got_desc_idx, ==, free_head); + break; + } + g_assert(g_get_monotonic_time() - start_time + <= QVIRTIO_NET_TIMEOUT_US); + + /* Run the main loop */ + qtest_clock_step(s, 100); + flush_events(s); + } + } + Data += vqa.length; + Size -= vqa.length; + } +} + +static void virtio_net_fork_fuzz(QTestState *s, + const unsigned char *Data, size_t Size) +{ + if (fork() == 0) { + virtio_net_fuzz_multi(s, Data, Size, false); + flush_events(s); + _Exit(0); + } else { + wait(NULL); + } +} + +static void virtio_net_fork_fuzz_check_used(QTestState *s, + const unsigned char *Data, size_t Size) +{ + if (fork() == 0) { + virtio_net_fuzz_multi(s, Data, Size, true); + flush_events(s); + _Exit(0); + } else { + wait(NULL); + } +} + +static void virtio_net_pre_fuzz(QTestState *s) +{ + qos_init_path(s); + counter_shm_init(); +} + +static void *virtio_net_test_setup_socket(GString *cmd_line, void *arg) +{ + int ret = socketpair(PF_UNIX, SOCK_STREAM, 0, sockfds); + g_assert_cmpint(ret, !=, -1); + fcntl(sockfds[0], F_SETFL, O_NONBLOCK); + sockfds_initialized = true; + g_string_append_printf(cmd_line, " -netdev socket,fd=%d,id=hs0 ", + sockfds[1]); + return arg; +} + +static void *virtio_net_test_setup_user(GString *cmd_line, void *arg) +{ + g_string_append_printf(cmd_line, " -netdev user,id=hs0 "); + return arg; +} + +static void register_virtio_net_fuzz_targets(void) +{ + fuzz_add_qos_target(&(FuzzTarget){ + .name = "virtio-net-socket", + .description = "Fuzz the virtio-net virtual queues. Fuzz incoming " + "traffic using the socket backend", + .pre_fuzz = &virtio_net_pre_fuzz, + .fuzz = virtio_net_fork_fuzz,}, + "virtio-net", + &(QOSGraphTestOptions){.before = virtio_net_test_setup_socket} + ); + + fuzz_add_qos_target(&(FuzzTarget){ + .name = "virtio-net-socket-check-used", + .description = "Fuzz the virtio-net virtual queues. Wait for the " + "descriptors to be used. Timeout may indicate improperly handled " + "input", + .pre_fuzz = &virtio_net_pre_fuzz, + .fuzz = virtio_net_fork_fuzz_check_used,}, + "virtio-net", + &(QOSGraphTestOptions){.before = virtio_net_test_setup_socket} + ); + fuzz_add_qos_target(&(FuzzTarget){ + .name = "virtio-net-slirp", + .description = "Fuzz the virtio-net virtual queues with the slirp " + " backend. Warning: May result in network traffic emitted from the " + " process. Run in an isolated network environment.", + .pre_fuzz = &virtio_net_pre_fuzz, + .fuzz = virtio_net_fork_fuzz,}, + "virtio-net", + &(QOSGraphTestOptions){.before = virtio_net_test_setup_user} + ); +} + +fuzz_target_init(register_virtio_net_fuzz_targets); -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> The virtio-scsi fuzz target sets up and fuzzes the available virtio-scsi queues. After an element is placed on a queue, the fuzzer can select whether to perform a kick, or continue adding elements. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-22-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- tests/qtest/fuzz/Makefile.include | 1 + tests/qtest/fuzz/virtio_scsi_fuzz.c | 213 ++++++++++++++++++++++++++++ 2 files changed, 214 insertions(+) create mode 100644 tests/qtest/fuzz/virtio_scsi_fuzz.c diff --git a/tests/qtest/fuzz/Makefile.include b/tests/qtest/fuzz/Makefile.include index XXXXXXX..XXXXXXX 100644 --- a/tests/qtest/fuzz/Makefile.include +++ b/tests/qtest/fuzz/Makefile.include @@ -XXX,XX +XXX,XX @@ fuzz-obj-y += tests/qtest/fuzz/qos_fuzz.o # Targets fuzz-obj-y += tests/qtest/fuzz/i440fx_fuzz.o fuzz-obj-y += tests/qtest/fuzz/virtio_net_fuzz.o +fuzz-obj-y += tests/qtest/fuzz/virtio_scsi_fuzz.o FUZZ_CFLAGS += -I$(SRC_PATH)/tests -I$(SRC_PATH)/tests/qtest diff --git a/tests/qtest/fuzz/virtio_scsi_fuzz.c b/tests/qtest/fuzz/virtio_scsi_fuzz.c new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/tests/qtest/fuzz/virtio_scsi_fuzz.c @@ -XXX,XX +XXX,XX @@ +/* + * virtio-serial Fuzzing Target + * + * Copyright Red Hat Inc., 2019 + * + * Authors: + * Alexander Bulekov <alxndr@bu.edu> + * + * This work is licensed under the terms of the GNU GPL, version 2 or later. + * See the COPYING file in the top-level directory. + */ + +#include "qemu/osdep.h" + +#include "tests/qtest/libqtest.h" +#include "libqos/virtio-scsi.h" +#include "libqos/virtio.h" +#include "libqos/virtio-pci.h" +#include "standard-headers/linux/virtio_ids.h" +#include "standard-headers/linux/virtio_pci.h" +#include "standard-headers/linux/virtio_scsi.h" +#include "fuzz.h" +#include "fork_fuzz.h" +#include "qos_fuzz.h" + +#define PCI_SLOT 0x02 +#define PCI_FN 0x00 +#define QVIRTIO_SCSI_TIMEOUT_US (1 * 1000 * 1000) + +#define MAX_NUM_QUEUES 64 + +/* Based on tests/virtio-scsi-test.c */ +typedef struct { + int num_queues; + QVirtQueue *vq[MAX_NUM_QUEUES + 2]; +} QVirtioSCSIQueues; + +static QVirtioSCSIQueues *qvirtio_scsi_init(QVirtioDevice *dev, uint64_t mask) +{ + QVirtioSCSIQueues *vs; + uint64_t feat; + int i; + + vs = g_new0(QVirtioSCSIQueues, 1); + + feat = qvirtio_get_features(dev); + if (mask) { + feat &= ~QVIRTIO_F_BAD_FEATURE | mask; + } else { + feat &= ~(QVIRTIO_F_BAD_FEATURE | (1ull << VIRTIO_RING_F_EVENT_IDX)); + } + qvirtio_set_features(dev, feat); + + vs->num_queues = qvirtio_config_readl(dev, 0); + + for (i = 0; i < vs->num_queues + 2; i++) { + vs->vq[i] = qvirtqueue_setup(dev, fuzz_qos_alloc, i); + } + + qvirtio_set_driver_ok(dev); + + return vs; +} + +static void virtio_scsi_fuzz(QTestState *s, QVirtioSCSIQueues* queues, + const unsigned char *Data, size_t Size) +{ + /* + * Data is a sequence of random bytes. We split them up into "actions", + * followed by data: + * [vqa][dddddddd][vqa][dddd][vqa][dddddddddddd] ... + * The length of the data is specified by the preceding vqa.length + */ + typedef struct vq_action { + uint8_t queue; + uint8_t length; + uint8_t write; + uint8_t next; + uint8_t kick; + } vq_action; + + /* Keep track of the free head for each queue we interact with */ + bool vq_touched[MAX_NUM_QUEUES + 2] = {0}; + uint32_t free_head[MAX_NUM_QUEUES + 2]; + + QGuestAllocator *t_alloc = fuzz_qos_alloc; + + QVirtioSCSI *scsi = fuzz_qos_obj; + QVirtioDevice *dev = scsi->vdev; + QVirtQueue *q; + vq_action vqa; + while (Size >= sizeof(vqa)) { + /* Copy the action, so we can normalize length, queue and flags */ + memcpy(&vqa, Data, sizeof(vqa)); + + Data += sizeof(vqa); + Size -= sizeof(vqa); + + vqa.queue = vqa.queue % queues->num_queues; + /* Cap length at the number of remaining bytes in data */ + vqa.length = vqa.length >= Size ? Size : vqa.length; + vqa.write = vqa.write & 1; + vqa.next = vqa.next & 1; + vqa.kick = vqa.kick & 1; + + + q = queues->vq[vqa.queue]; + + /* Copy the data into ram, and place it on the virtqueue */ + uint64_t req_addr = guest_alloc(t_alloc, vqa.length); + qtest_memwrite(s, req_addr, Data, vqa.length); + if (vq_touched[vqa.queue] == 0) { + vq_touched[vqa.queue] = 1; + free_head[vqa.queue] = qvirtqueue_add(s, q, req_addr, vqa.length, + vqa.write, vqa.next); + } else { + qvirtqueue_add(s, q, req_addr, vqa.length, vqa.write , vqa.next); + } + + if (vqa.kick) { + qvirtqueue_kick(s, dev, q, free_head[vqa.queue]); + free_head[vqa.queue] = 0; + } + Data += vqa.length; + Size -= vqa.length; + } + /* In the end, kick each queue we interacted with */ + for (int i = 0; i < MAX_NUM_QUEUES + 2; i++) { + if (vq_touched[i]) { + qvirtqueue_kick(s, dev, queues->vq[i], free_head[i]); + } + } +} + +static void virtio_scsi_fork_fuzz(QTestState *s, + const unsigned char *Data, size_t Size) +{ + QVirtioSCSI *scsi = fuzz_qos_obj; + static QVirtioSCSIQueues *queues; + if (!queues) { + queues = qvirtio_scsi_init(scsi->vdev, 0); + } + if (fork() == 0) { + virtio_scsi_fuzz(s, queues, Data, Size); + flush_events(s); + _Exit(0); + } else { + wait(NULL); + } +} + +static void virtio_scsi_with_flag_fuzz(QTestState *s, + const unsigned char *Data, size_t Size) +{ + QVirtioSCSI *scsi = fuzz_qos_obj; + static QVirtioSCSIQueues *queues; + + if (fork() == 0) { + if (Size >= sizeof(uint64_t)) { + queues = qvirtio_scsi_init(scsi->vdev, *(uint64_t *)Data); + virtio_scsi_fuzz(s, queues, + Data + sizeof(uint64_t), Size - sizeof(uint64_t)); + flush_events(s); + } + _Exit(0); + } else { + wait(NULL); + } +} + +static void virtio_scsi_pre_fuzz(QTestState *s) +{ + qos_init_path(s); + counter_shm_init(); +} + +static void *virtio_scsi_test_setup(GString *cmd_line, void *arg) +{ + g_string_append(cmd_line, + " -drive file=blkdebug::null-co://," + "file.image.read-zeroes=on," + "if=none,id=dr1,format=raw,file.align=4k " + "-device scsi-hd,drive=dr1,lun=0,scsi-id=1"); + return arg; +} + + +static void register_virtio_scsi_fuzz_targets(void) +{ + fuzz_add_qos_target(&(FuzzTarget){ + .name = "virtio-scsi-fuzz", + .description = "Fuzz the virtio-scsi virtual queues, forking" + "for each fuzz run", + .pre_vm_init = &counter_shm_init, + .pre_fuzz = &virtio_scsi_pre_fuzz, + .fuzz = virtio_scsi_fork_fuzz,}, + "virtio-scsi", + &(QOSGraphTestOptions){.before = virtio_scsi_test_setup} + ); + + fuzz_add_qos_target(&(FuzzTarget){ + .name = "virtio-scsi-flags-fuzz", + .description = "Fuzz the virtio-scsi virtual queues, forking" + "for each fuzz run (also fuzzes the virtio flags)", + .pre_vm_init = &counter_shm_init, + .pre_fuzz = &virtio_scsi_pre_fuzz, + .fuzz = virtio_scsi_with_flag_fuzz,}, + "virtio-scsi", + &(QOSGraphTestOptions){.before = virtio_scsi_test_setup} + ); +} + +fuzz_target_init(register_virtio_scsi_fuzz_targets); -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-23-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- docs/devel/fuzzing.txt | 116 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 116 insertions(+) create mode 100644 docs/devel/fuzzing.txt diff --git a/docs/devel/fuzzing.txt b/docs/devel/fuzzing.txt new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/docs/devel/fuzzing.txt @@ -XXX,XX +XXX,XX @@ += Fuzzing = + +== Introduction == + +This document describes the virtual-device fuzzing infrastructure in QEMU and +how to use it to implement additional fuzzers. + +== Basics == + +Fuzzing operates by passing inputs to an entry point/target function. The +fuzzer tracks the code coverage triggered by the input. Based on these +findings, the fuzzer mutates the input and repeats the fuzzing. + +To fuzz QEMU, we rely on libfuzzer. Unlike other fuzzers such as AFL, libfuzzer +is an _in-process_ fuzzer. For the developer, this means that it is their +responsibility to ensure that state is reset between fuzzing-runs. + +== Building the fuzzers == + +NOTE: If possible, build a 32-bit binary. When forking, the 32-bit fuzzer is +much faster, since the page-map has a smaller size. This is due to the fact that +AddressSanitizer mmaps ~20TB of memory, as part of its detection. This results +in a large page-map, and a much slower fork(). + +To build the fuzzers, install a recent version of clang: +Configure with (substitute the clang binaries with the version you installed): + + CC=clang-8 CXX=clang++-8 /path/to/configure --enable-fuzzing + +Fuzz targets are built similarly to system/softmmu: + + make i386-softmmu/fuzz + +This builds ./i386-softmmu/qemu-fuzz-i386 + +The first option to this command is: --fuzz_taget=FUZZ_NAME +To list all of the available fuzzers run qemu-fuzz-i386 with no arguments. + +eg: + ./i386-softmmu/qemu-fuzz-i386 --fuzz-target=virtio-net-fork-fuzz + +Internally, libfuzzer parses all arguments that do not begin with "--". +Information about these is available by passing -help=1 + +Now the only thing left to do is wait for the fuzzer to trigger potential +crashes. + +== Adding a new fuzzer == +Coverage over virtual devices can be improved by adding additional fuzzers. +Fuzzers are kept in tests/qtest/fuzz/ and should be added to +tests/qtest/fuzz/Makefile.include + +Fuzzers can rely on both qtest and libqos to communicate with virtual devices. + +1. Create a new source file. For example ``tests/qtest/fuzz/foo-device-fuzz.c``. + +2. Write the fuzzing code using the libqtest/libqos API. See existing fuzzers +for reference. + +3. Register the fuzzer in ``tests/fuzz/Makefile.include`` by appending the +corresponding object to fuzz-obj-y + +Fuzzers can be more-or-less thought of as special qtest programs which can +modify the qtest commands and/or qtest command arguments based on inputs +provided by libfuzzer. Libfuzzer passes a byte array and length. Commonly the +fuzzer loops over the byte-array interpreting it as a list of qtest commands, +addresses, or values. + += Implementation Details = + +== The Fuzzer's Lifecycle == + +The fuzzer has two entrypoints that libfuzzer calls. libfuzzer provides it's +own main(), which performs some setup, and calls the entrypoints: + +LLVMFuzzerInitialize: called prior to fuzzing. Used to initialize all of the +necessary state + +LLVMFuzzerTestOneInput: called for each fuzzing run. Processes the input and +resets the state at the end of each run. + +In more detail: + +LLVMFuzzerInitialize parses the arguments to the fuzzer (must start with two +dashes, so they are ignored by libfuzzer main()). Currently, the arguments +select the fuzz target. Then, the qtest client is initialized. If the target +requires qos, qgraph is set up and the QOM/LIBQOS modules are initialized. +Then the QGraph is walked and the QEMU cmd_line is determined and saved. + +After this, the vl.c:qemu__main is called to set up the guest. There are +target-specific hooks that can be called before and after qemu_main, for +additional setup(e.g. PCI setup, or VM snapshotting). + +LLVMFuzzerTestOneInput: Uses qtest/qos functions to act based on the fuzz +input. It is also responsible for manually calling the main loop/main_loop_wait +to ensure that bottom halves are executed and any cleanup required before the +next input. + +Since the same process is reused for many fuzzing runs, QEMU state needs to +be reset at the end of each run. There are currently two implemented +options for resetting state: +1. Reboot the guest between runs. + Pros: Straightforward and fast for simple fuzz targets. + Cons: Depending on the device, does not reset all device state. If the + device requires some initialization prior to being ready for fuzzing + (common for QOS-based targets), this initialization needs to be done after + each reboot. + Example target: i440fx-qtest-reboot-fuzz +2. Run each test case in a separate forked process and copy the coverage + information back to the parent. This is fairly similar to AFL's "deferred" + fork-server mode [3] + Pros: Relatively fast. Devices only need to be initialized once. No need + to do slow reboots or vmloads. + Cons: Not officially supported by libfuzzer. Does not work well for devices + that rely on dedicated threads. + Example target: virtio-net-fork-fuzz -- 2.24.1