The following changes since commit 0fc0142828b5bc965790a1c5c6e241897d3387cb:

Merge remote-tracking branch 'remotes/kraxel/tags/input-20200921-pull-request' into staging (2020-09-22 21:11:10 +0100)

for you to fetch changes up to d73415a315471ac0b127ed3fad45c8ec5d711de1:

qemu/atomic.h: rename atomic_ to qatomic_ (2020-09-23 16:07:44 +0100)

Halil Pasic (1):

virtio: add vhost-user-fs-ccw device

Marc Hartmayer (1):

libvhost-user: handle endianness as mandated by the spec

Stefan Hajnoczi (11):

MAINTAINERS: add Stefan Hajnoczi as block/nvme.c maintainer

util/iov: add iov_discard_undo()

virtio-blk: undo destructive iov_discard_*() operations

virtio-crypto: don't modify elem->in/out_sg

docs/system: clarify deprecation schedule

gitmodules: switch to qemu.org qboot mirror

gitmodules: switch to qemu.org meson mirror

gitmodules: add qemu.org vbootrom submodule

fdmon-poll: reset npfd when upgrading to fdmon-epoll

tests: add test-fdmon-epoll

qemu/atomic.h: rename atomic_ to qatomic_

MAINTAINERS | 5 +-

include/qemu/atomic.h | 248 +++++++++---------

docs/devel/lockcnt.txt | 8 +-

docs/devel/rcu.txt | 34 +--

accel/tcg/atomic_template.h | 20 +-

include/block/aio-wait.h | 4 +-

include/block/aio.h | 8 +-

include/exec/cpu_ldst.h | 2 +-

include/exec/exec-all.h | 6 +-

include/exec/log.h | 6 +-

include/exec/memory.h | 2 +-

include/exec/ram_addr.h | 26 +-

include/exec/ramlist.h | 2 +-

include/exec/tb-lookup.h | 4 +-

include/hw/core/cpu.h | 2 +-

include/hw/virtio/virtio-blk.h | 2 +

include/qemu/atomic128.h | 6 +-

include/qemu/bitops.h | 2 +-

include/qemu/coroutine.h | 2 +-

include/qemu/iov.h | 23 ++

include/qemu/log.h | 6 +-

include/qemu/queue.h | 7 +-

include/qemu/rcu.h | 10 +-

include/qemu/rcu_queue.h | 100 +++----

include/qemu/seqlock.h | 8 +-

include/qemu/stats64.h | 28 +-

include/qemu/thread.h | 24 +-

.../infiniband/hw/vmw_pvrdma/pvrdma_ring.h | 14 +-

linux-user/qemu.h | 2 +-

tcg/i386/tcg-target.h | 2 +-

tcg/s390/tcg-target.h | 2 +-

tcg/tci/tcg-target.h | 2 +-

accel/kvm/kvm-all.c | 12 +-

accel/tcg/cpu-exec.c | 15 +-

accel/tcg/cputlb.c | 24 +-

accel/tcg/tcg-all.c | 2 +-

accel/tcg/translate-all.c | 55 ++--

audio/jackaudio.c | 18 +-

block.c | 4 +-

block/block-backend.c | 15 +-

block/io.c | 48 ++--

block/nfs.c | 2 +-

block/sheepdog.c | 2 +-

block/throttle-groups.c | 12 +-

block/throttle.c | 4 +-

blockdev.c | 2 +-

blockjob.c | 2 +-

contrib/libvhost-user/libvhost-user.c | 79 +++---

cpus-common.c | 26 +-

dump/dump.c | 8 +-

exec.c | 49 ++--

hw/block/virtio-blk.c | 11 +-

hw/core/cpu.c | 6 +-

hw/display/qxl.c | 4 +-

hw/hyperv/hyperv.c | 10 +-

hw/hyperv/vmbus.c | 2 +-

hw/i386/xen/xen-hvm.c | 2 +-

hw/intc/rx_icu.c | 12 +-

hw/intc/sifive_plic.c | 4 +-

hw/misc/edu.c | 16 +-

hw/net/virtio-net.c | 10 +-

hw/rdma/rdma_backend.c | 18 +-

hw/rdma/rdma_rm.c | 2 +-

hw/rdma/vmw/pvrdma_dev_ring.c | 4 +-

hw/s390x/s390-pci-bus.c | 2 +-

hw/s390x/vhost-user-fs-ccw.c | 75 ++++++

hw/s390x/virtio-ccw.c | 2 +-

hw/virtio/vhost.c | 2 +-

hw/virtio/virtio-crypto.c | 17 +-

hw/virtio/virtio-mmio.c | 6 +-

hw/virtio/virtio-pci.c | 6 +-

hw/virtio/virtio.c | 16 +-

hw/xtensa/pic_cpu.c | 4 +-

iothread.c | 6 +-

linux-user/hppa/cpu_loop.c | 11 +-

linux-user/signal.c | 8 +-

migration/colo-failover.c | 4 +-

migration/migration.c | 8 +-

migration/multifd.c | 18 +-

migration/postcopy-ram.c | 34 +--

migration/rdma.c | 34 +--

monitor/hmp.c | 6 +-

monitor/misc.c | 2 +-

monitor/monitor.c | 6 +-

qemu-nbd.c | 2 +-

qga/commands.c | 12 +-

qom/object.c | 20 +-

scsi/qemu-pr-helper.c | 4 +-

softmmu/cpu-throttle.c | 10 +-

softmmu/cpus.c | 42 +--

softmmu/memory.c | 6 +-

softmmu/vl.c | 2 +-

target/arm/mte_helper.c | 6 +-

target/hppa/op_helper.c | 2 +-

target/i386/mem_helper.c | 2 +-

target/i386/whpx-all.c | 6 +-

target/riscv/cpu_helper.c | 2 +-

target/s390x/mem_helper.c | 4 +-

target/xtensa/exc_helper.c | 4 +-

target/xtensa/op_helper.c | 2 +-

tcg/tcg.c | 58 ++--

tcg/tci.c | 2 +-

tests/atomic64-bench.c | 14 +-

tests/atomic_add-bench.c | 14 +-

tests/iothread.c | 2 +-

tests/qht-bench.c | 12 +-

tests/rcutorture.c | 24 +-

tests/test-aio-multithread.c | 52 ++--

tests/test-fdmon-epoll.c | 73 ++++++

tests/test-iov.c | 165 ++++++++++++

tests/test-logging.c | 4 +-

tests/test-rcu-list.c | 38 +--

tests/test-thread-pool.c | 10 +-

util/aio-posix.c | 14 +-

util/aio-wait.c | 2 +-

util/aio-win32.c | 5 +-

util/async.c | 28 +-

util/atomic64.c | 10 +-

util/bitmap.c | 14 +-

util/cacheinfo.c | 2 +-

util/fdmon-epoll.c | 4 +-

util/fdmon-io_uring.c | 12 +-

util/fdmon-poll.c | 1 +

util/iov.c | 50 +++-

util/lockcnt.c | 52 ++--

util/log.c | 10 +-

util/qemu-coroutine-lock.c | 18 +-

util/qemu-coroutine-sleep.c | 4 +-

util/qemu-coroutine.c | 6 +-

util/qemu-sockets.c | 4 +-

util/qemu-thread-posix.c | 12 +-

util/qemu-thread-win32.c | 12 +-

util/qemu-timer.c | 12 +-

util/qht.c | 57 ++--

util/qsp.c | 50 ++--

util/rcu.c | 36 +--

util/stats64.c | 34 +--

.gitmodules | 6 +-

docs/devel/atomics.rst | 134 +++++-----

docs/system/deprecated.rst | 9 +-

hw/s390x/meson.build | 1 +

scripts/kernel-doc | 2 +-

tcg/aarch64/tcg-target.c.inc | 2 +-

tcg/mips/tcg-target.c.inc | 2 +-

tcg/ppc/tcg-target.c.inc | 6 +-

tcg/sparc/tcg-target.c.inc | 5 +-

tests/meson.build | 3 +

147 files changed, 1508 insertions(+), 1069 deletions(-)

create mode 100644 hw/s390x/vhost-user-fs-ccw.c

create mode 100644 tests/test-fdmon-epoll.c

2.26.2

Development of the userspace NVMe block driver picked up again recently.

After talking with Fam I am stepping up as block/nvme.c maintainer.

Patches will be merged through my 'block' tree.

Cc: Kevin Wolf <kwolf@redhat.com>

Cc: Klaus Jensen <k.jensen@samsung.com>

Cc: Fam Zheng <fam@euphon.net>

Acked-by: Kevin Wolf <kwolf@redhat.com>

Acked-by: Klaus Jensen <k.jensen@samsung.com>

Acked-by: Fam Zheng <fam@euphon.net>

Message-id: 20200907111632.90499-1-stefanha@redhat.com

MAINTAINERS | 4 +++-

diff --git a/MAINTAINERS b/MAINTAINERS

--- a/MAINTAINERS

+++ b/MAINTAINERS

@@ -XXX,XX +XXX,XX @@ S: Supported

F: block/null.c

NVMe Block Driver

-M: Fam Zheng <fam@euphon.net>

+M: Stefan Hajnoczi <stefanha@redhat.com>

+R: Fam Zheng <fam@euphon.net>

L: qemu-block@nongnu.org

S: Supported

F: block/nvme*

+T: git https://github.com/stefanha/qemu.git block

Bootdevice

M: Gonglei <arei.gonglei@huawei.com>

2.26.2

From: Marc Hartmayer <mhartmay@linux.ibm.com>

Since virtio existed even before it got standardized, the virtio

standard defines the following types of virtio devices:

+ legacy device (pre-virtio 1.0)

+ non-legacy or VIRTIO 1.0 device

+ transitional device (which can act both as legacy and non-legacy)

Virtio 1.0 defines the fields of the virtqueues as little endian,

while legacy uses guest's native endian [1]. Currently libvhost-user

does not handle virtio endianness at all, i.e. it works only if the

native endianness matches with whatever is actually needed. That means

things break spectacularly on big-endian targets. Let us handle virtio

endianness for non-legacy as required by the virtio specification [1]

and fence legacy virtio, as there is no safe way to figure out the

needed endianness conversions for all cases. The fencing of legacy

virtio devices is done in `vu_set_features_exec`.

[1] https://docs.oasis-open.org/virtio/virtio/v1.1/cs01/virtio-v1.1-cs01.html#x1-210003

Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>

Message-id: 20200901150019.29229-3-mhartmay@linux.ibm.com

contrib/libvhost-user/libvhost-user.c | 77 +++++++++++++++------------

1 file changed, 43 insertions(+), 34 deletions(-)

diff --git a/contrib/libvhost-user/libvhost-user.c b/contrib/libvhost-user/libvhost-user.c

--- a/contrib/libvhost-user/libvhost-user.c

+++ b/contrib/libvhost-user/libvhost-user.c

#include "qemu/atomic.h"

#include "qemu/osdep.h"

+#include "qemu/bswap.h"

#include "qemu/memfd.h"

#include "libvhost-user.h"

@@ -XXX,XX +XXX,XX @@ vu_set_features_exec(VuDev *dev, VhostUserMsg *vmsg)

DPRINT("u64: 0x%016"PRIx64"\n", vmsg->payload.u64);

dev->features = vmsg->payload.u64;

+ if (!vu_has_feature(dev, VIRTIO_F_VERSION_1)) {

+ /*

+ * We only support devices conforming to VIRTIO 1.0 or

+ * later

+ */

+ vu_panic(dev, "virtio legacy devices aren't supported by libvhost-user");

if (!(dev->features & VHOST_USER_F_PROTOCOL_FEATURES)) {

vu_set_enable_all_rings(dev, true);

@@ -XXX,XX +XXX,XX @@ vu_set_vring_addr_exec(VuDev *dev, VhostUserMsg *vmsg)

- vq->used_idx = vq->vring.used->idx;

+ vq->used_idx = lduw_le_p(&vq->vring.used->idx);

if (vq->last_avail_idx != vq->used_idx) {

bool resume = dev->iface->queue_is_processed_in_order &&

@@ -XXX,XX +XXX,XX @@ vu_check_queue_inflights(VuDev *dev, VuVirtq *vq)

return 0;

}

- vq->used_idx = vq->vring.used->idx;

+ vq->used_idx = lduw_le_p(&vq->vring.used->idx);

vq->resubmit_num = 0;

vq->resubmit_list = NULL;

vq->counter = 0;

@@ -XXX,XX +XXX,XX @@ vu_queue_started(const VuDev *dev, const VuVirtq *vq)

static inline uint16_t

vring_avail_flags(VuVirtq *vq)

{

- return vq->vring.avail->flags;

+ return lduw_le_p(&vq->vring.avail->flags);

}

static inline uint16_t

vring_avail_idx(VuVirtq *vq)

{

- vq->shadow_avail_idx = vq->vring.avail->idx;

+ vq->shadow_avail_idx = lduw_le_p(&vq->vring.avail->idx);

return vq->shadow_avail_idx;

}

@@ -XXX,XX +XXX,XX @@ vring_avail_idx(VuVirtq *vq)

static inline uint16_t

vring_avail_ring(VuVirtq *vq, int i)

{

- return vq->vring.avail->ring[i];

+ return lduw_le_p(&vq->vring.avail->ring[i]);

}

static inline uint16_t

@@ -XXX,XX +XXX,XX @@ virtqueue_read_next_desc(VuDev *dev, struct vring_desc *desc,

int i, unsigned int max, unsigned int *next)

{

/* If this descriptor says it doesn't chain, we're done. */

- if (!(desc[i].flags & VRING_DESC_F_NEXT)) {

+ if (!(lduw_le_p(&desc[i].flags) & VRING_DESC_F_NEXT)) {

return VIRTQUEUE_READ_DESC_DONE;

}

/* Check they're not leading us off end of descriptors. */

- *next = desc[i].next;

+ *next = lduw_le_p(&desc[i].next);

/* Make sure compiler knows to grab that: we don't want it changing! */

smp_wmb();

@@ -XXX,XX +XXX,XX @@ vu_queue_get_avail_bytes(VuDev *dev, VuVirtq *vq, unsigned int *in_bytes,

}

desc = vq->vring.desc;

- if (desc[i].flags & VRING_DESC_F_INDIRECT) {

- if (desc[i].len % sizeof(struct vring_desc)) {

+ if (lduw_le_p(&desc[i].flags) & VRING_DESC_F_INDIRECT) {

+ if (ldl_le_p(&desc[i].len) % sizeof(struct vring_desc)) {

vu_panic(dev, "Invalid size for indirect buffer table");

goto err;

}

@@ -XXX,XX +XXX,XX @@ vu_queue_get_avail_bytes(VuDev *dev, VuVirtq *vq, unsigned int *in_bytes,

/* loop over the indirect descriptor table */

indirect = 1;

- desc_addr = desc[i].addr;

- desc_len = desc[i].len;

+ desc_addr = ldq_le_p(&desc[i].addr);

+ desc_len = ldl_le_p(&desc[i].len);

max = desc_len / sizeof(struct vring_desc);

read_len = desc_len;

desc = vu_gpa_to_va(dev, &read_len, desc_addr);

@@ -XXX,XX +XXX,XX @@ vu_queue_get_avail_bytes(VuDev *dev, VuVirtq *vq, unsigned int *in_bytes,

goto err;

}

- if (desc[i].flags & VRING_DESC_F_WRITE) {

- in_total += desc[i].len;

+ if (lduw_le_p(&desc[i].flags) & VRING_DESC_F_WRITE) {

+ in_total += ldl_le_p(&desc[i].len);

} else {

- out_total += desc[i].len;

+ out_total += ldl_le_p(&desc[i].len);

}

if (in_total >= max_in_bytes && out_total >= max_out_bytes) {

goto done;

@@ -XXX,XX +XXX,XX @@ vring_used_flags_set_bit(VuVirtq *vq, int mask)

flags = (uint16_t *)((char*)vq->vring.used +

offsetof(struct vring_used, flags));

- *flags |= mask;

+ stw_le_p(flags, lduw_le_p(flags) | mask);

}

static inline void

@@ -XXX,XX +XXX,XX @@ vring_used_flags_unset_bit(VuVirtq *vq, int mask)

flags = (uint16_t *)((char*)vq->vring.used +

offsetof(struct vring_used, flags));

- *flags &= ~mask;

+ stw_le_p(flags, lduw_le_p(flags) & ~mask);

}

static inline void

@@ -XXX,XX +XXX,XX @@ vring_set_avail_event(VuVirtq *vq, uint16_t val)

return;

}

- *((uint16_t *) &vq->vring.used->ring[vq->vring.num]) = val;

+ stw_le_p(&vq->vring.used->ring[vq->vring.num], val);

}

void

@@ -XXX,XX +XXX,XX @@ vu_queue_map_desc(VuDev *dev, VuVirtq *vq, unsigned int idx, size_t sz)

struct vring_desc desc_buf[VIRTQUEUE_MAX_SIZE];

int rc;

- if (desc[i].flags & VRING_DESC_F_INDIRECT) {

- if (desc[i].len % sizeof(struct vring_desc)) {

+ if (lduw_le_p(&desc[i].flags) & VRING_DESC_F_INDIRECT) {

+ if (ldl_le_p(&desc[i].len) % sizeof(struct vring_desc)) {

vu_panic(dev, "Invalid size for indirect buffer table");

}

/* loop over the indirect descriptor table */

- desc_addr = desc[i].addr;

- desc_len = desc[i].len;

+ desc_addr = ldq_le_p(&desc[i].addr);

+ desc_len = ldl_le_p(&desc[i].len);

max = desc_len / sizeof(struct vring_desc);

read_len = desc_len;

desc = vu_gpa_to_va(dev, &read_len, desc_addr);

@@ -XXX,XX +XXX,XX @@ vu_queue_map_desc(VuDev *dev, VuVirtq *vq, unsigned int idx, size_t sz)

/* Collect all the descriptors */

do {

- if (desc[i].flags & VRING_DESC_F_WRITE) {

+ if (lduw_le_p(&desc[i].flags) & VRING_DESC_F_WRITE) {

virtqueue_map_desc(dev, &in_num, iov + out_num,

VIRTQUEUE_MAX_SIZE - out_num, true,

- desc[i].addr, desc[i].len);

+ ldq_le_p(&desc[i].addr), ldl_le_p(&desc[i].len));

} else {

if (in_num) {

vu_panic(dev, "Incorrect order for descriptors");

@@ -XXX,XX +XXX,XX @@ vu_queue_map_desc(VuDev *dev, VuVirtq *vq, unsigned int idx, size_t sz)

}

virtqueue_map_desc(dev, &out_num, iov,

VIRTQUEUE_MAX_SIZE, false,

- desc[i].addr, desc[i].len);

+ ldq_le_p(&desc[i].addr), ldl_le_p(&desc[i].len));

}

/* If we've got too many, that implies a descriptor loop. */

@@ -XXX,XX +XXX,XX @@ vu_log_queue_fill(VuDev *dev, VuVirtq *vq,

max = vq->vring.num;

i = elem->index;

- if (desc[i].flags & VRING_DESC_F_INDIRECT) {

- if (desc[i].len % sizeof(struct vring_desc)) {

+ if (lduw_le_p(&desc[i].flags) & VRING_DESC_F_INDIRECT) {

+ if (ldl_le_p(&desc[i].len) % sizeof(struct vring_desc)) {

vu_panic(dev, "Invalid size for indirect buffer table");

}

/* loop over the indirect descriptor table */

- desc_addr = desc[i].addr;

- desc_len = desc[i].len;

+ desc_addr = ldq_le_p(&desc[i].addr);

+ desc_len = ldl_le_p(&desc[i].len);

max = desc_len / sizeof(struct vring_desc);

read_len = desc_len;

desc = vu_gpa_to_va(dev, &read_len, desc_addr);

@@ -XXX,XX +XXX,XX @@ vu_log_queue_fill(VuDev *dev, VuVirtq *vq,

return;

}

- if (desc[i].flags & VRING_DESC_F_WRITE) {

- min = MIN(desc[i].len, len);

- vu_log_write(dev, desc[i].addr, min);

+ if (lduw_le_p(&desc[i].flags) & VRING_DESC_F_WRITE) {

+ min = MIN(ldl_le_p(&desc[i].len), len);

+ vu_log_write(dev, ldq_le_p(&desc[i].addr), min);

len -= min;

}

@@ -XXX,XX +XXX,XX @@ vu_queue_fill(VuDev *dev, VuVirtq *vq,

idx = (idx + vq->used_idx) % vq->vring.num;

- uelem.id = elem->index;

- uelem.len = len;

+ stl_le_p(&uelem.id, elem->index);

+ stl_le_p(&uelem.len, len);

vring_used_write(dev, vq, &uelem, idx);

}

static inline

void vring_used_idx_set(VuDev *dev, VuVirtq *vq, uint16_t val)

{

- vq->vring.used->idx = val;

+ stw_le_p(&vq->vring.used->idx, val);

vu_log_write(dev,

vq->vring.log_guest_addr + offsetof(struct vring_used, idx),

sizeof(vq->vring.used->idx));

2.26.2

From: Halil Pasic <pasic@linux.ibm.com>

Wire up the CCW device for vhost-user-fs.

Reviewed-by: Cornelia Huck <cohuck@redhat.com>

Signed-off-by: Halil Pasic <pasic@linux.ibm.com>

Message-id: 20200901150019.29229-2-mhartmay@linux.ibm.com

hw/s390x/vhost-user-fs-ccw.c | 75 ++++++++++++++++++++++++++++++++++++

hw/s390x/meson.build | 1 +

2 files changed, 76 insertions(+)

create mode 100644 hw/s390x/vhost-user-fs-ccw.c

diff --git a/hw/s390x/vhost-user-fs-ccw.c b/hw/s390x/vhost-user-fs-ccw.c

+++ b/hw/s390x/vhost-user-fs-ccw.c

+ * virtio ccw vhost-user-fs implementation

+ * Copyright 2020 IBM Corp.

+ * This work is licensed under the terms of the GNU GPL, version 2 or (at

+ * your option) any later version. See the COPYING file in the top-level

+ * directory.

+#include "hw/qdev-properties.h"

+#include "qapi/error.h"

+#include "hw/virtio/vhost-user-fs.h"

+#include "virtio-ccw.h"

+typedef struct VHostUserFSCcw {

+ VirtioCcwDevice parent_obj;

+ VHostUserFS vdev;

+} VHostUserFSCcw;

+

+#define TYPE_VHOST_USER_FS_CCW "vhost-user-fs-ccw"

+#define VHOST_USER_FS_CCW(obj) \

+ OBJECT_CHECK(VHostUserFSCcw, (obj), TYPE_VHOST_USER_FS_CCW)

+

+

+static Property vhost_user_fs_ccw_properties[] = {

+ DEFINE_PROP_BIT("ioeventfd", VirtioCcwDevice, flags,

+ VIRTIO_CCW_FLAG_USE_IOEVENTFD_BIT, true),

+ DEFINE_PROP_UINT32("max_revision", VirtioCcwDevice, max_rev,

+ VIRTIO_CCW_MAX_REV),

+ DEFINE_PROP_END_OF_LIST(),

+};

+

+static void vhost_user_fs_ccw_realize(VirtioCcwDevice *ccw_dev, Error **errp)

+ VHostUserFSCcw *dev = VHOST_USER_FS_CCW(ccw_dev);

+ DeviceState *vdev = DEVICE(&dev->vdev);

+

+ qdev_realize(vdev, BUS(&ccw_dev->bus), errp);

+static void vhost_user_fs_ccw_instance_init(Object *obj)

+ VHostUserFSCcw *dev = VHOST_USER_FS_CCW(obj);

+ VirtioCcwDevice *ccw_dev = VIRTIO_CCW_DEVICE(obj);

+

+ ccw_dev->force_revision_1 = true;

+ virtio_instance_init_common(obj, &dev->vdev, sizeof(dev->vdev),

+ TYPE_VHOST_USER_FS);

+static void vhost_user_fs_ccw_class_init(ObjectClass *klass, void *data)

+ DeviceClass *dc = DEVICE_CLASS(klass);

+ VirtIOCCWDeviceClass *k = VIRTIO_CCW_DEVICE_CLASS(klass);

+

+ k->realize = vhost_user_fs_ccw_realize;

+ device_class_set_props(dc, vhost_user_fs_ccw_properties);

+ set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);

+static const TypeInfo vhost_user_fs_ccw = {

+ .name = TYPE_VHOST_USER_FS_CCW,

+ .parent = TYPE_VIRTIO_CCW_DEVICE,

+ .instance_size = sizeof(VHostUserFSCcw),

+ .instance_init = vhost_user_fs_ccw_instance_init,

+ .class_init = vhost_user_fs_ccw_class_init,

+};

+

+static void vhost_user_fs_ccw_register(void)

+ type_register_static(&vhost_user_fs_ccw);

2.26.2

The iov_discard_front/back() operations are useful for parsing iovecs

but they modify the array elements. If the original array is needed

after parsing finishes there is currently no way to restore it.

Although g_memdup() can be used before performing destructive

iov_discard_front/back() operations, this is inefficient.

Introduce iov_discard_undo() to restore the array to the state prior to

an iov_discard_front/back() operation.

Reviewed-by: Li Qiang <liq3ea@gmail.com>

Message-Id: <20200917094455.822379-2-stefanha@redhat.com>

include/qemu/iov.h | 23 +++++++

tests/test-iov.c | 165 +++++++++++++++++++++++++++++++++++++++++++++

util/iov.c | 50 ++++++++++++--

3 files changed, 234 insertions(+), 4 deletions(-)

diff --git a/include/qemu/iov.h b/include/qemu/iov.h

--- a/include/qemu/iov.h

+++ b/include/qemu/iov.h

@@ -XXX,XX +XXX,XX @@ size_t iov_discard_front(struct iovec **iov, unsigned int *iov_cnt,

size_t iov_discard_back(struct iovec *iov, unsigned int *iov_cnt,

size_t bytes);

+/* Information needed to undo an iov_discard_*() operation */

+typedef struct {

+ struct iovec *modified_iov;

+ struct iovec orig;

+} IOVDiscardUndo;

+

+/*

+ * Undo an iov_discard_front_undoable() or iov_discard_back_undoable()

+ * operation. If multiple operations are made then each one needs a separate

+ * IOVDiscardUndo and iov_discard_undo() must be called in the reverse order

+ * that the operations were made.

+ */

+void iov_discard_undo(IOVDiscardUndo *undo);

+

+/*

+ * Undoable versions of iov_discard_front() and iov_discard_back(). Use

+ * iov_discard_undo() to reset to the state before the discard operations.

+ */

+size_t iov_discard_front_undoable(struct iovec **iov, unsigned int *iov_cnt,

+ size_t bytes, IOVDiscardUndo *undo);

+size_t iov_discard_back_undoable(struct iovec *iov, unsigned int *iov_cnt,

+ size_t bytes, IOVDiscardUndo *undo);

+

typedef struct QEMUIOVector {

struct iovec *iov;

int niov;

diff --git a/tests/test-iov.c b/tests/test-iov.c

index XXXXXXX..XXXXXXX 100644

--- a/tests/test-iov.c

+++ b/tests/test-iov.c

@@ -XXX,XX +XXX,XX @@ static void iov_free(struct iovec *iov, unsigned niov)

g_free(iov);

}

+static bool iov_equals(const struct iovec *a, const struct iovec *b,

+ unsigned niov)

+{

+ return memcmp(a, b, sizeof(a[0]) * niov) == 0;

+}

+

static void test_iov_bytes(struct iovec *iov, unsigned niov,

size_t offset, size_t bytes)

{

@@ -XXX,XX +XXX,XX @@ static void test_discard_front(void)

iov_free(iov, iov_cnt);

}

+static void test_discard_front_undo(void)

+{

+ IOVDiscardUndo undo;

+ struct iovec *iov;

+ struct iovec *iov_tmp;

+ struct iovec *iov_orig;

+ unsigned int iov_cnt;

+ unsigned int iov_cnt_tmp;

+ size_t size;

+

+ /* Discard zero bytes */

+ iov_random(&iov, &iov_cnt);

+ iov_orig = g_memdup(iov, sizeof(iov[0]) * iov_cnt);

+ iov_tmp = iov;

+ iov_cnt_tmp = iov_cnt;

+ iov_discard_front_undoable(&iov_tmp, &iov_cnt_tmp, 0, &undo);

+ iov_discard_undo(&undo);

+ assert(iov_equals(iov, iov_orig, iov_cnt));

+ g_free(iov_orig);

+ iov_free(iov, iov_cnt);

+

+ /* Discard more bytes than vector size */

+ iov_random(&iov, &iov_cnt);

+ iov_orig = g_memdup(iov, sizeof(iov[0]) * iov_cnt);

+ iov_tmp = iov;

+ iov_cnt_tmp = iov_cnt;

+ size = iov_size(iov, iov_cnt);

+ iov_discard_front_undoable(&iov_tmp, &iov_cnt_tmp, size + 1, &undo);

+ iov_discard_undo(&undo);

+ assert(iov_equals(iov, iov_orig, iov_cnt));

+ g_free(iov_orig);

+ iov_free(iov, iov_cnt);

+

+ /* Discard entire vector */

+ iov_random(&iov, &iov_cnt);

+ iov_orig = g_memdup(iov, sizeof(iov[0]) * iov_cnt);

+ iov_tmp = iov;

+ iov_cnt_tmp = iov_cnt;

+ size = iov_size(iov, iov_cnt);

+ iov_discard_front_undoable(&iov_tmp, &iov_cnt_tmp, size, &undo);

+ iov_discard_undo(&undo);

+ assert(iov_equals(iov, iov_orig, iov_cnt));

+ g_free(iov_orig);

+ iov_free(iov, iov_cnt);

+

+ /* Discard within first element */

+ iov_random(&iov, &iov_cnt);

+ iov_orig = g_memdup(iov, sizeof(iov[0]) * iov_cnt);

+ iov_tmp = iov;

+ iov_cnt_tmp = iov_cnt;

+ size = g_test_rand_int_range(1, iov->iov_len);

+ iov_discard_front_undoable(&iov_tmp, &iov_cnt_tmp, size, &undo);

+ iov_discard_undo(&undo);

+ assert(iov_equals(iov, iov_orig, iov_cnt));

+ g_free(iov_orig);

+ iov_free(iov, iov_cnt);

+

+ /* Discard entire first element */

+ iov_random(&iov, &iov_cnt);

+ iov_orig = g_memdup(iov, sizeof(iov[0]) * iov_cnt);

+ iov_tmp = iov;

+ iov_cnt_tmp = iov_cnt;

+ iov_discard_front_undoable(&iov_tmp, &iov_cnt_tmp, iov->iov_len, &undo);

+ iov_discard_undo(&undo);

+ assert(iov_equals(iov, iov_orig, iov_cnt));

+ g_free(iov_orig);

+ iov_free(iov, iov_cnt);

+

+ /* Discard within second element */

+ iov_random(&iov, &iov_cnt);

+ iov_orig = g_memdup(iov, sizeof(iov[0]) * iov_cnt);

+ iov_tmp = iov;

+ iov_cnt_tmp = iov_cnt;

+ size = iov->iov_len + g_test_rand_int_range(1, iov[1].iov_len);

+ iov_discard_front_undoable(&iov_tmp, &iov_cnt_tmp, size, &undo);

+ iov_discard_undo(&undo);

+ assert(iov_equals(iov, iov_orig, iov_cnt));

+ g_free(iov_orig);

+ iov_free(iov, iov_cnt);

+}

+

static void test_discard_back(void)

{

struct iovec *iov;

@@ -XXX,XX +XXX,XX @@ static void test_discard_back(void)

iov_free(iov, iov_cnt);

}

+static void test_discard_back_undo(void)

+{

+ IOVDiscardUndo undo;

+ struct iovec *iov;

+ struct iovec *iov_orig;

+ unsigned int iov_cnt;

+ unsigned int iov_cnt_tmp;

+ size_t size;

+

+ /* Discard zero bytes */

+ iov_random(&iov, &iov_cnt);

+ iov_orig = g_memdup(iov, sizeof(iov[0]) * iov_cnt);

+ iov_cnt_tmp = iov_cnt;

+ iov_discard_back_undoable(iov, &iov_cnt_tmp, 0, &undo);

+ iov_discard_undo(&undo);

+ assert(iov_equals(iov, iov_orig, iov_cnt));

+ g_free(iov_orig);

+ iov_free(iov, iov_cnt);

+

+ /* Discard more bytes than vector size */

+ iov_random(&iov, &iov_cnt);

+ iov_orig = g_memdup(iov, sizeof(iov[0]) * iov_cnt);

+ iov_cnt_tmp = iov_cnt;

+ size = iov_size(iov, iov_cnt);

+ iov_discard_back_undoable(iov, &iov_cnt_tmp, size + 1, &undo);

+ iov_discard_undo(&undo);

+ assert(iov_equals(iov, iov_orig, iov_cnt));

+ g_free(iov_orig);

+ iov_free(iov, iov_cnt);

+

+ /* Discard entire vector */

+ iov_random(&iov, &iov_cnt);

+ iov_orig = g_memdup(iov, sizeof(iov[0]) * iov_cnt);

+ iov_cnt_tmp = iov_cnt;

+ size = iov_size(iov, iov_cnt);

+ iov_discard_back_undoable(iov, &iov_cnt_tmp, size, &undo);

+ iov_discard_undo(&undo);

+ assert(iov_equals(iov, iov_orig, iov_cnt));

+ g_free(iov_orig);

+ iov_free(iov, iov_cnt);

+

+ /* Discard within last element */

+ iov_random(&iov, &iov_cnt);

+ iov_orig = g_memdup(iov, sizeof(iov[0]) * iov_cnt);

+ iov_cnt_tmp = iov_cnt;

+ size = g_test_rand_int_range(1, iov[iov_cnt - 1].iov_len);

+ iov_discard_back_undoable(iov, &iov_cnt_tmp, size, &undo);

+ iov_discard_undo(&undo);

+ assert(iov_equals(iov, iov_orig, iov_cnt));

+ g_free(iov_orig);

+ iov_free(iov, iov_cnt);

+

+ /* Discard entire last element */

+ iov_random(&iov, &iov_cnt);

+ iov_orig = g_memdup(iov, sizeof(iov[0]) * iov_cnt);

+ iov_cnt_tmp = iov_cnt;

+ size = iov[iov_cnt - 1].iov_len;

+ iov_discard_back_undoable(iov, &iov_cnt_tmp, size, &undo);

+ iov_discard_undo(&undo);

+ assert(iov_equals(iov, iov_orig, iov_cnt));

+ g_free(iov_orig);

+ iov_free(iov, iov_cnt);

+

+ /* Discard within second-to-last element */

+ iov_random(&iov, &iov_cnt);

+ iov_orig = g_memdup(iov, sizeof(iov[0]) * iov_cnt);

+ iov_cnt_tmp = iov_cnt;

+ size = iov[iov_cnt - 1].iov_len +

+ g_test_rand_int_range(1, iov[iov_cnt - 2].iov_len);

+ iov_discard_back_undoable(iov, &iov_cnt_tmp, size, &undo);

+ iov_discard_undo(&undo);

+ assert(iov_equals(iov, iov_orig, iov_cnt));

+ g_free(iov_orig);

+ iov_free(iov, iov_cnt);

+}

+

int main(int argc, char **argv)

{

g_test_init(&argc, &argv, NULL);

@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)

g_test_add_func("/basic/iov/io", test_io);

g_test_add_func("/basic/iov/discard-front", test_discard_front);

g_test_add_func("/basic/iov/discard-back", test_discard_back);

+ g_test_add_func("/basic/iov/discard-front-undo", test_discard_front_undo);

+ g_test_add_func("/basic/iov/discard-back-undo", test_discard_back_undo);

return g_test_run();

}

diff --git a/util/iov.c b/util/iov.c

index XXXXXXX..XXXXXXX 100644

--- a/util/iov.c

+++ b/util/iov.c

@@ -XXX,XX +XXX,XX @@ void qemu_iovec_clone(QEMUIOVector *dest, const QEMUIOVector *src, void *buf)

}

-size_t iov_discard_front(struct iovec **iov, unsigned int *iov_cnt,

- size_t bytes)

+void iov_discard_undo(IOVDiscardUndo *undo)

+{

+ /* Restore original iovec if it was modified */

+ if (undo->modified_iov) {

+ *undo->modified_iov = undo->orig;

+}

+

+size_t iov_discard_front_undoable(struct iovec **iov,

+ unsigned int *iov_cnt,

+ size_t bytes,

+ IOVDiscardUndo *undo)

{

size_t total = 0;

struct iovec *cur;

+ if (undo) {

+ undo->modified_iov = NULL;

for (cur = *iov; *iov_cnt > 0; cur++) {

if (cur->iov_len > bytes) {

+ if (undo) {

+ undo->modified_iov = cur;

+ undo->orig = *cur;

+ }

+

cur->iov_base += bytes;

cur->iov_len -= bytes;

total += bytes;

@@ -XXX,XX +XXX,XX @@ size_t iov_discard_front(struct iovec **iov, unsigned int *iov_cnt,

return total;

}

-size_t iov_discard_back(struct iovec *iov, unsigned int *iov_cnt,

- size_t bytes)

+size_t iov_discard_front(struct iovec **iov, unsigned int *iov_cnt,

+ size_t bytes)

+{

+ return iov_discard_front_undoable(iov, iov_cnt, bytes, NULL);

+}

+

+size_t iov_discard_back_undoable(struct iovec *iov,

+ unsigned int *iov_cnt,

+ size_t bytes,

+ IOVDiscardUndo *undo)

{

size_t total = 0;

struct iovec *cur;

+ if (undo) {

+ undo->modified_iov = NULL;

if (*iov_cnt == 0) {

return 0;

}

@@ -XXX,XX +XXX,XX @@ size_t iov_discard_back(struct iovec *iov, unsigned int *iov_cnt,

while (*iov_cnt > 0) {

if (cur->iov_len > bytes) {

+ if (undo) {

+ undo->modified_iov = cur;

+ undo->orig = *cur;

+ }

+

cur->iov_len -= bytes;

total += bytes;

break;

@@ -XXX,XX +XXX,XX @@ size_t iov_discard_back(struct iovec *iov, unsigned int *iov_cnt,

return total;

}

+size_t iov_discard_back(struct iovec *iov, unsigned int *iov_cnt,

+ size_t bytes)

+{

+ return iov_discard_back_undoable(iov, iov_cnt, bytes, NULL);

+}

+

void qemu_iovec_discard_back(QEMUIOVector *qiov, size_t bytes)

{

size_t total;

2.26.2

Fuzzing discovered that virtqueue_unmap_sg() is being called on modified

req->in/out_sg iovecs. This means dma_memory_map() and

dma_memory_unmap() calls do not have matching memory addresses.

Fuzzing discovered that non-RAM addresses trigger a bug:

void address_space_unmap(AddressSpace *as, void *buffer, hwaddr len,

bool is_write, hwaddr access_len)

{

if (buffer != bounce.buffer) {

^^^^^^^^^^^^^^^^^^^^^^^

A modified iov->iov_base is no longer recognized as a bounce buffer and

the wrong branch is taken.

There are more potential bugs: dirty memory is not tracked correctly and

MemoryRegion refcounts can be leaked.

Use the new iov_discard_undo() API to restore elem->in/out_sg before

virtqueue_push() is called.

Fixes: 827805a2492c1bbf1c0712ed18ee069b4ebf3dd6 ("virtio-blk: Convert VirtIOBlockReq.out to structrue")

Reported-by: Alexander Bulekov <alxndr@bu.edu>

include/hw/virtio/virtio-blk.h | 2 ++

hw/block/virtio-blk.c | 11 +++++++++--

2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/include/hw/virtio/virtio-blk.h b/include/hw/virtio/virtio-blk.h

--- a/include/hw/virtio/virtio-blk.h

+++ b/include/hw/virtio/virtio-blk.h

@@ -XXX,XX +XXX,XX @@ typedef struct VirtIOBlockReq {

int64_t sector_num;

VirtIOBlock *dev;

VirtQueue *vq;

+ IOVDiscardUndo inhdr_undo;

+ IOVDiscardUndo outhdr_undo;

struct virtio_blk_inhdr *in;

struct virtio_blk_outhdr out;

QEMUIOVector qiov;

diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/block/virtio-blk.c

+++ b/hw/block/virtio-blk.c

@@ -XXX,XX +XXX,XX @@ static void virtio_blk_req_complete(VirtIOBlockReq *req, unsigned char status)

trace_virtio_blk_req_complete(vdev, req, status);

stb_p(&req->in->status, status);

+ iov_discard_undo(&req->inhdr_undo);

+ iov_discard_undo(&req->outhdr_undo);

virtqueue_push(req->vq, &req->elem, req->in_len);

if (s->dataplane_started && !s->dataplane_disabled) {

virtio_blk_data_plane_notify(s->dataplane, req->vq);

@@ -XXX,XX +XXX,XX @@ static int virtio_blk_handle_request(VirtIOBlockReq *req, MultiReqBuffer *mrb)

return -1;

- iov_discard_front(&out_iov, &out_num, sizeof(req->out));

+ iov_discard_front_undoable(&out_iov, &out_num, sizeof(req->out),

+ &req->outhdr_undo);

if (in_iov[in_num - 1].iov_len < sizeof(struct virtio_blk_inhdr)) {

virtio_error(vdev, "virtio-blk request inhdr too short");

+ iov_discard_undo(&req->outhdr_undo);

return -1;

@@ -XXX,XX +XXX,XX @@ static int virtio_blk_handle_request(VirtIOBlockReq *req, MultiReqBuffer *mrb)

req->in = (void *)in_iov[in_num - 1].iov_base

+ in_iov[in_num - 1].iov_len

- sizeof(struct virtio_blk_inhdr);

- iov_discard_back(in_iov, &in_num, sizeof(struct virtio_blk_inhdr));

+ iov_discard_back_undoable(in_iov, &in_num, sizeof(struct virtio_blk_inhdr),

+ &req->inhdr_undo);

type = virtio_ldl_p(vdev, &req->out.type);

@@ -XXX,XX +XXX,XX @@ static int virtio_blk_handle_request(VirtIOBlockReq *req, MultiReqBuffer *mrb)