The following changes since commit 9ac5df20f51fabcba0d902025df4bd7ea987c158: Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20200221-1' into staging (2020-02-21 16:18:38 +0000) are available in the Git repository at: https://github.com/stefanha/qemu.git tags/block-pull-request for you to fetch changes up to e5c59355ae9f724777c61c859292ec9db2c8c2ab: fuzz: add documentation to docs/devel/ (2020-02-22 08:26:48 +0000) ---------------------------------------------------------------- Pull request This pull request contains a virtio-blk/scsi performance optimization, event loop scalability improvements, and a qtest-based device fuzzing framework. I am including the fuzzing patches because I have reviewed them and Thomas Huth is currently away on leave. ---------------------------------------------------------------- Alexander Bulekov (22): softmmu: move vl.c to softmmu/ softmmu: split off vl.c:main() into main.c module: check module wasn't already initialized fuzz: add FUZZ_TARGET module type qtest: add qtest_server_send abstraction libqtest: add a layer of abstraction to send/recv libqtest: make bufwrite rely on the TransportOps qtest: add in-process incoming command handler libqos: rename i2c_send and i2c_recv libqos: split qos-test and libqos makefile vars libqos: move useful qos-test funcs to qos_external fuzz: add fuzzer skeleton exec: keep ram block across fork when using qtest main: keep rcu_atfork callback enabled for qtest fuzz: support for fork-based fuzzing. fuzz: add support for qos-assisted fuzz targets fuzz: add target/fuzz makefile rules fuzz: add configure flag --enable-fuzzing fuzz: add i440fx fuzz targets fuzz: add virtio-net fuzz target fuzz: add virtio-scsi fuzz target fuzz: add documentation to docs/devel/ Denis Plotnikov (1): virtio: increase virtqueue size for virtio-scsi and virtio-blk Paolo Bonzini (1): rcu_queue: add QSLIST functions Stefan Hajnoczi (7): aio-posix: avoid reacquiring rcu_read_lock() when polling util/async: make bh_aio_poll() O(1) aio-posix: fix use after leaving scope in aio_poll() aio-posix: don't pass ns timeout to epoll_wait() qemu/queue.h: add QLIST_SAFE_REMOVE() aio-posix: make AioHandler deletion O(1) aio-posix: make AioHandler dispatch O(1) with epoll MAINTAINERS | 11 +- Makefile | 15 +- Makefile.objs | 2 - Makefile.target | 19 ++- block.c | 5 +- chardev/spice.c | 4 +- configure | 39 +++++ docs/devel/fuzzing.txt | 116 ++++++++++++++ exec.c | 12 +- hw/block/virtio-blk.c | 2 +- hw/core/machine.c | 2 + hw/scsi/virtio-scsi.c | 2 +- include/block/aio.h | 26 ++- include/qemu/module.h | 4 +- include/qemu/queue.h | 32 +++- include/qemu/rcu_queue.h | 47 ++++++ include/sysemu/qtest.h | 4 + include/sysemu/sysemu.h | 4 + qtest.c | 31 +++- scripts/checkpatch.pl | 2 +- scripts/get_maintainer.pl | 3 +- softmmu/Makefile.objs | 3 + softmmu/main.c | 53 +++++++ vl.c => softmmu/vl.c | 48 +++--- tests/Makefile.include | 2 + tests/qtest/Makefile.include | 72 +++++---- tests/qtest/fuzz/Makefile.include | 18 +++ tests/qtest/fuzz/fork_fuzz.c | 55 +++++++ tests/qtest/fuzz/fork_fuzz.h | 23 +++ tests/qtest/fuzz/fork_fuzz.ld | 37 +++++ tests/qtest/fuzz/fuzz.c | 179 +++++++++++++++++++++ tests/qtest/fuzz/fuzz.h | 95 +++++++++++ tests/qtest/fuzz/i440fx_fuzz.c | 193 ++++++++++++++++++++++ tests/qtest/fuzz/qos_fuzz.c | 234 +++++++++++++++++++++++++++ tests/qtest/fuzz/qos_fuzz.h | 33 ++++ tests/qtest/fuzz/virtio_net_fuzz.c | 198 +++++++++++++++++++++++ tests/qtest/fuzz/virtio_scsi_fuzz.c | 213 +++++++++++++++++++++++++ tests/qtest/libqos/i2c.c | 10 +- tests/qtest/libqos/i2c.h | 4 +- tests/qtest/libqos/qos_external.c | 168 ++++++++++++++++++++ tests/qtest/libqos/qos_external.h | 28 ++++ tests/qtest/libqtest.c | 119 ++++++++++++-- tests/qtest/libqtest.h | 4 + tests/qtest/pca9552-test.c | 10 +- tests/qtest/qos-test.c | 132 +--------------- tests/test-aio.c | 3 +- tests/test-rcu-list.c | 16 ++ tests/test-rcu-slist.c | 2 + util/aio-posix.c | 187 +++++++++++++++------- util/async.c | 237 ++++++++++++++++------------ util/module.c | 7 + 51 files changed, 2365 insertions(+), 400 deletions(-) create mode 100644 docs/devel/fuzzing.txt create mode 100644 softmmu/Makefile.objs create mode 100644 softmmu/main.c rename vl.c => softmmu/vl.c (99%) create mode 100644 tests/qtest/fuzz/Makefile.include create mode 100644 tests/qtest/fuzz/fork_fuzz.c create mode 100644 tests/qtest/fuzz/fork_fuzz.h create mode 100644 tests/qtest/fuzz/fork_fuzz.ld create mode 100644 tests/qtest/fuzz/fuzz.c create mode 100644 tests/qtest/fuzz/fuzz.h create mode 100644 tests/qtest/fuzz/i440fx_fuzz.c create mode 100644 tests/qtest/fuzz/qos_fuzz.c create mode 100644 tests/qtest/fuzz/qos_fuzz.h create mode 100644 tests/qtest/fuzz/virtio_net_fuzz.c create mode 100644 tests/qtest/fuzz/virtio_scsi_fuzz.c create mode 100644 tests/qtest/libqos/qos_external.c create mode 100644 tests/qtest/libqos/qos_external.h create mode 100644 tests/test-rcu-slist.c -- 2.24.1 From: Denis Plotnikov <dplotnikov@virtuozzo.com> The goal is to reduce the amount of requests issued by a guest on 1M reads/writes. This rises the performance up to 4% on that kind of disk access pattern. The maximum chunk size to be used for the guest disk accessing is limited with seg_max parameter, which represents the max amount of pices in the scatter-geather list in one guest disk request. Since seg_max is virqueue_size dependent, increasing the virtqueue size increases seg_max, which, in turn, increases the maximum size of data to be read/write from a guest disk. More details in the original problem statment: https://lists.gnu.org/archive/html/qemu-devel/2017-12/msg03721.html Suggested-by: Denis V. Lunev <den@openvz.org> Signed-off-by: Denis Plotnikov <dplotnikov@virtuozzo.com> Message-id: 20200214074648.958-1-dplotnikov@virtuozzo.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- hw/block/virtio-blk.c | 2 +- hw/core/machine.c | 2 ++ hw/scsi/virtio-scsi.c | 2 +- 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c index XXXXXXX..XXXXXXX 100644 --- a/hw/block/virtio-blk.c +++ b/hw/block/virtio-blk.c @@ -XXX,XX +XXX,XX @@ static Property virtio_blk_properties[] = { DEFINE_PROP_BIT("request-merging", VirtIOBlock, conf.request_merging, 0, true), DEFINE_PROP_UINT16("num-queues", VirtIOBlock, conf.num_queues, 1), - DEFINE_PROP_UINT16("queue-size", VirtIOBlock, conf.queue_size, 128), + DEFINE_PROP_UINT16("queue-size", VirtIOBlock, conf.queue_size, 256), DEFINE_PROP_BOOL("seg-max-adjust", VirtIOBlock, conf.seg_max_adjust, true), DEFINE_PROP_LINK("iothread", VirtIOBlock, conf.iothread, TYPE_IOTHREAD, IOThread *), diff --git a/hw/core/machine.c b/hw/core/machine.c index XXXXXXX..XXXXXXX 100644 --- a/hw/core/machine.c +++ b/hw/core/machine.c @@ -XXX,XX +XXX,XX @@ #include "hw/mem/nvdimm.h" GlobalProperty hw_compat_4_2[] = { + { "virtio-blk-device", "queue-size", "128"}, + { "virtio-scsi-device", "virtqueue_size", "128"}, { "virtio-blk-device", "x-enable-wce-if-config-wce", "off" }, { "virtio-blk-device", "seg-max-adjust", "off"}, { "virtio-scsi-device", "seg_max_adjust", "off"}, diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c index XXXXXXX..XXXXXXX 100644 --- a/hw/scsi/virtio-scsi.c +++ b/hw/scsi/virtio-scsi.c @@ -XXX,XX +XXX,XX @@ static void virtio_scsi_device_unrealize(DeviceState *dev, Error **errp) static Property virtio_scsi_properties[] = { DEFINE_PROP_UINT32("num_queues", VirtIOSCSI, parent_obj.conf.num_queues, 1), DEFINE_PROP_UINT32("virtqueue_size", VirtIOSCSI, - parent_obj.conf.virtqueue_size, 128), + parent_obj.conf.virtqueue_size, 256), DEFINE_PROP_BOOL("seg_max_adjust", VirtIOSCSI, parent_obj.conf.seg_max_adjust, true), DEFINE_PROP_UINT32("max_sectors", VirtIOSCSI, parent_obj.conf.max_sectors, -- 2.24.1 The first rcu_read_lock/unlock() is expensive. Nested calls are cheap. This optimization increases IOPS from 73k to 162k with a Linux guest that has 2 virtio-blk,num-queues=1 and 99 virtio-blk,num-queues=32 devices. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 20200218182708.914552-1-stefanha@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- util/aio-posix.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/util/aio-posix.c b/util/aio-posix.c index XXXXXXX..XXXXXXX 100644 --- a/util/aio-posix.c +++ b/util/aio-posix.c @@ -XXX,XX +XXX,XX @@ #include "qemu/osdep.h" #include "block/block.h" +#include "qemu/rcu.h" #include "qemu/rcu_queue.h" #include "qemu/sockets.h" #include "qemu/cutils.h" @@ -XXX,XX +XXX,XX @@ static bool run_poll_handlers_once(AioContext *ctx, int64_t *timeout) bool progress = false; AioHandler *node; + /* + * Optimization: ->io_poll() handlers often contain RCU read critical + * sections and we therefore see many rcu_read_lock() -> rcu_read_unlock() + * -> rcu_read_lock() -> ... sequences with expensive memory + * synchronization primitives. Make the entire polling loop an RCU + * critical section because nested rcu_read_lock()/rcu_read_unlock() calls + * are cheap. + */ + RCU_READ_LOCK_GUARD(); + QLIST_FOREACH_RCU(node, &ctx->aio_handlers, node) { if (!node->deleted && node->io_poll && aio_node_check(ctx, node->is_external) && -- 2.24.1 From: Paolo Bonzini <pbonzini@redhat.com> QSLIST is the only family of lists for which we do not have RCU-friendly accessors, add them. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20200220103828.24525-1-pbonzini@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- include/qemu/queue.h | 15 +++++++++++-- include/qemu/rcu_queue.h | 47 ++++++++++++++++++++++++++++++++++++++++ tests/Makefile.include | 2 ++ tests/test-rcu-list.c | 16 ++++++++++++++ tests/test-rcu-slist.c | 2 ++ 5 files changed, 80 insertions(+), 2 deletions(-) create mode 100644 tests/test-rcu-slist.c diff --git a/include/qemu/queue.h b/include/qemu/queue.h index XXXXXXX..XXXXXXX 100644 --- a/include/qemu/queue.h +++ b/include/qemu/queue.h @@ -XXX,XX +XXX,XX @@ struct { \ (head)->slh_first = (head)->slh_first->field.sle_next; \ } while (/*CONSTCOND*/0) -#define QSLIST_REMOVE_AFTER(slistelm, field) do { \ +#define QSLIST_REMOVE_AFTER(slistelm, field) do { \ (slistelm)->field.sle_next = \ - QSLIST_NEXT(QSLIST_NEXT((slistelm), field), field); \ + QSLIST_NEXT(QSLIST_NEXT((slistelm), field), field); \ +} while (/*CONSTCOND*/0) + +#define QSLIST_REMOVE(head, elm, type, field) do { \ + if ((head)->slh_first == (elm)) { \ + QSLIST_REMOVE_HEAD((head), field); \ + } else { \ + struct type *curelm = (head)->slh_first; \ + while (curelm->field.sle_next != (elm)) \ + curelm = curelm->field.sle_next; \ + curelm->field.sle_next = curelm->field.sle_next->field.sle_next; \ + } \ } while (/*CONSTCOND*/0) #define QSLIST_FOREACH(var, head, field) \ diff --git a/include/qemu/rcu_queue.h b/include/qemu/rcu_queue.h index XXXXXXX..XXXXXXX 100644 --- a/include/qemu/rcu_queue.h +++ b/include/qemu/rcu_queue.h @@ -XXX,XX +XXX,XX @@ extern "C" { (var) && ((next) = atomic_rcu_read(&(var)->field.tqe_next), 1); \ (var) = (next)) +/* + * RCU singly-linked list + */ + +/* Singly-linked list access methods */ +#define QSLIST_EMPTY_RCU(head) (atomic_read(&(head)->slh_first) == NULL) +#define QSLIST_FIRST_RCU(head) atomic_rcu_read(&(head)->slh_first) +#define QSLIST_NEXT_RCU(elm, field) atomic_rcu_read(&(elm)->field.sle_next) + +/* Singly-linked list functions */ +#define QSLIST_INSERT_HEAD_RCU(head, elm, field) do { \ + (elm)->field.sle_next = (head)->slh_first; \ + atomic_rcu_set(&(head)->slh_first, (elm)); \ +} while (/*CONSTCOND*/0) + +#define QSLIST_INSERT_AFTER_RCU(head, listelm, elm, field) do { \ + (elm)->field.sle_next = (listelm)->field.sle_next; \ + atomic_rcu_set(&(listelm)->field.sle_next, (elm)); \ +} while (/*CONSTCOND*/0) + +#define QSLIST_REMOVE_HEAD_RCU(head, field) do { \ + atomic_set(&(head)->slh_first, (head)->slh_first->field.sle_next); \ +} while (/*CONSTCOND*/0) + +#define QSLIST_REMOVE_RCU(head, elm, type, field) do { \ + if ((head)->slh_first == (elm)) { \ + QSLIST_REMOVE_HEAD_RCU((head), field); \ + } else { \ + struct type *curr = (head)->slh_first; \ + while (curr->field.sle_next != (elm)) { \ + curr = curr->field.sle_next; \ + } \ + atomic_set(&curr->field.sle_next, \ + curr->field.sle_next->field.sle_next); \ + } \ +} while (/*CONSTCOND*/0) + +#define QSLIST_FOREACH_RCU(var, head, field) \ + for ((var) = atomic_rcu_read(&(head)->slh_first); \ + (var); \ + (var) = atomic_rcu_read(&(var)->field.sle_next)) + +#define QSLIST_FOREACH_SAFE_RCU(var, head, field, next) \ + for ((var) = atomic_rcu_read(&(head)->slh_first); \ + (var) && ((next) = atomic_rcu_read(&(var)->field.sle_next), 1); \ + (var) = (next)) + #ifdef __cplusplus } #endif diff --git a/tests/Makefile.include b/tests/Makefile.include index XXXXXXX..XXXXXXX 100644 --- a/tests/Makefile.include +++ b/tests/Makefile.include @@ -XXX,XX +XXX,XX @@ check-unit-y += tests/rcutorture$(EXESUF) check-unit-y += tests/test-rcu-list$(EXESUF) check-unit-y += tests/test-rcu-simpleq$(EXESUF) check-unit-y += tests/test-rcu-tailq$(EXESUF) +check-unit-y += tests/test-rcu-slist$(EXESUF) check-unit-y += tests/test-qdist$(EXESUF) check-unit-y += tests/test-qht$(EXESUF) check-unit-y += tests/test-qht-par$(EXESUF) @@ -XXX,XX +XXX,XX @@ tests/rcutorture$(EXESUF): tests/rcutorture.o $(test-util-obj-y) tests/test-rcu-list$(EXESUF): tests/test-rcu-list.o $(test-util-obj-y) tests/test-rcu-simpleq$(EXESUF): tests/test-rcu-simpleq.o $(test-util-obj-y) tests/test-rcu-tailq$(EXESUF): tests/test-rcu-tailq.o $(test-util-obj-y) +tests/test-rcu-slist$(EXESUF): tests/test-rcu-slist.o $(test-util-obj-y) tests/test-qdist$(EXESUF): tests/test-qdist.o $(test-util-obj-y) tests/test-qht$(EXESUF): tests/test-qht.o $(test-util-obj-y) tests/test-qht-par$(EXESUF): tests/test-qht-par.o tests/qht-bench$(EXESUF) $(test-util-obj-y) diff --git a/tests/test-rcu-list.c b/tests/test-rcu-list.c index XXXXXXX..XXXXXXX 100644 --- a/tests/test-rcu-list.c +++ b/tests/test-rcu-list.c @@ -XXX,XX +XXX,XX @@ struct list_element { QSIMPLEQ_ENTRY(list_element) entry; #elif TEST_LIST_TYPE == 3 QTAILQ_ENTRY(list_element) entry; +#elif TEST_LIST_TYPE == 4 + QSLIST_ENTRY(list_element) entry; #else #error Invalid TEST_LIST_TYPE #endif @@ -XXX,XX +XXX,XX @@ static QTAILQ_HEAD(, list_element) Q_list_head; #define TEST_LIST_INSERT_HEAD_RCU QTAILQ_INSERT_HEAD_RCU #define TEST_LIST_FOREACH_RCU QTAILQ_FOREACH_RCU #define TEST_LIST_FOREACH_SAFE_RCU QTAILQ_FOREACH_SAFE_RCU + +#elif TEST_LIST_TYPE == 4 +static QSLIST_HEAD(, list_element) Q_list_head; + +#define TEST_NAME "qslist" +#define TEST_LIST_REMOVE_RCU(el, f) \ + QSLIST_REMOVE_RCU(&Q_list_head, el, list_element, f) + +#define TEST_LIST_INSERT_AFTER_RCU(list_el, el, f) \ + QSLIST_INSERT_AFTER_RCU(&Q_list_head, list_el, el, f) + +#define TEST_LIST_INSERT_HEAD_RCU QSLIST_INSERT_HEAD_RCU +#define TEST_LIST_FOREACH_RCU QSLIST_FOREACH_RCU +#define TEST_LIST_FOREACH_SAFE_RCU QSLIST_FOREACH_SAFE_RCU #else #error Invalid TEST_LIST_TYPE #endif diff --git a/tests/test-rcu-slist.c b/tests/test-rcu-slist.c new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/tests/test-rcu-slist.c @@ -XXX,XX +XXX,XX @@ +#define TEST_LIST_TYPE 4 +#include "test-rcu-list.c" -- 2.24.1 The ctx->first_bh list contains all created BHs, including those that are not scheduled. The list is iterated by the event loop and therefore has O(n) time complexity with respected to the number of created BHs. Rewrite BHs so that only scheduled or deleted BHs are enqueued. Only BHs that actually require action will be iterated. One semantic change is required: qemu_bh_delete() enqueues the BH and therefore invokes aio_notify(). The tests/test-aio.c:test_source_bh_delete_from_cb() test case assumed that g_main_context_iteration(NULL, false) returns false after qemu_bh_delete() but it now returns true for one iteration. Fix up the test case. This patch makes aio_compute_timeout() and aio_bh_poll() drop from a CPU profile reported by perf-top(1). Previously they combined to 9% CPU utilization when AioContext polling is commented out and the guest has 2 virtio-blk,num-queues=1 and 99 virtio-blk,num-queues=32 devices. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 20200221093951.1414693-1-stefanha@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- include/block/aio.h | 20 +++- tests/test-aio.c | 3 +- util/async.c | 237 ++++++++++++++++++++++++++------------------ 3 files changed, 158 insertions(+), 102 deletions(-) diff --git a/include/block/aio.h b/include/block/aio.h index XXXXXXX..XXXXXXX 100644 --- a/include/block/aio.h +++ b/include/block/aio.h @@ -XXX,XX +XXX,XX @@ struct ThreadPool; struct LinuxAioState; struct LuringState; +/* + * Each aio_bh_poll() call carves off a slice of the BH list, so that newly + * scheduled BHs are not processed until the next aio_bh_poll() call. All + * active aio_bh_poll() calls chain their slices together in a list, so that + * nested aio_bh_poll() calls process all scheduled bottom halves. + */ +typedef QSLIST_HEAD(, QEMUBH) BHList; +typedef struct BHListSlice BHListSlice; +struct BHListSlice { + BHList bh_list; + QSIMPLEQ_ENTRY(BHListSlice) next; +}; + struct AioContext { GSource source; @@ -XXX,XX +XXX,XX @@ struct AioContext { */ QemuLockCnt list_lock; - /* Anchor of the list of Bottom Halves belonging to the context */ - struct QEMUBH *first_bh; + /* Bottom Halves pending aio_bh_poll() processing */ + BHList bh_list; + + /* Chained BH list slices for each nested aio_bh_poll() call */ + QSIMPLEQ_HEAD(, BHListSlice) bh_slice_list; /* Used by aio_notify. * diff --git a/tests/test-aio.c b/tests/test-aio.c index XXXXXXX..XXXXXXX 100644 --- a/tests/test-aio.c +++ b/tests/test-aio.c @@ -XXX,XX +XXX,XX @@ static void test_source_bh_delete_from_cb(void) g_assert_cmpint(data1.n, ==, data1.max); g_assert(data1.bh == NULL); - g_assert(!g_main_context_iteration(NULL, false)); + assert(g_main_context_iteration(NULL, false)); + assert(!g_main_context_iteration(NULL, false)); } static void test_source_bh_delete_from_cb_many(void) diff --git a/util/async.c b/util/async.c index XXXXXXX..XXXXXXX 100644 --- a/util/async.c +++ b/util/async.c @@ -XXX,XX +XXX,XX @@ #include "block/thread-pool.h" #include "qemu/main-loop.h" #include "qemu/atomic.h" +#include "qemu/rcu_queue.h" #include "block/raw-aio.h" #include "qemu/coroutine_int.h" #include "trace.h" @@ -XXX,XX +XXX,XX @@ /***********************************************************/ /* bottom halves (can be seen as timers which expire ASAP) */ +/* QEMUBH::flags values */ +enum { + /* Already enqueued and waiting for aio_bh_poll() */ + BH_PENDING = (1 << 0), + + /* Invoke the callback */ + BH_SCHEDULED = (1 << 1), + + /* Delete without invoking callback */ + BH_DELETED = (1 << 2), + + /* Delete after invoking callback */ + BH_ONESHOT = (1 << 3), + + /* Schedule periodically when the event loop is idle */ + BH_IDLE = (1 << 4), +}; + struct QEMUBH { AioContext *ctx; QEMUBHFunc *cb; void *opaque; - QEMUBH *next; - bool scheduled; - bool idle; - bool deleted; + QSLIST_ENTRY(QEMUBH) next; + unsigned flags; }; +/* Called concurrently from any thread */ +static void aio_bh_enqueue(QEMUBH *bh, unsigned new_flags) +{ + AioContext *ctx = bh->ctx; + unsigned old_flags; + + /* + * The memory barrier implicit in atomic_fetch_or makes sure that: + * 1. idle & any writes needed by the callback are done before the + * locations are read in the aio_bh_poll. + * 2. ctx is loaded before the callback has a chance to execute and bh + * could be freed. + */ + old_flags = atomic_fetch_or(&bh->flags, BH_PENDING | new_flags); + if (!(old_flags & BH_PENDING)) { + QSLIST_INSERT_HEAD_ATOMIC(&ctx->bh_list, bh, next); + } + + aio_notify(ctx); +} + +/* Only called from aio_bh_poll() and aio_ctx_finalize() */ +static QEMUBH *aio_bh_dequeue(BHList *head, unsigned *flags) +{ + QEMUBH *bh = QSLIST_FIRST_RCU(head); + + if (!bh) { + return NULL; + } + + QSLIST_REMOVE_HEAD(head, next); + + /* + * The atomic_and is paired with aio_bh_enqueue(). The implicit memory + * barrier ensures that the callback sees all writes done by the scheduling + * thread. It also ensures that the scheduling thread sees the cleared + * flag before bh->cb has run, and thus will call aio_notify again if + * necessary. + */ + *flags = atomic_fetch_and(&bh->flags, + ~(BH_PENDING | BH_SCHEDULED | BH_IDLE)); + return bh; +} + void aio_bh_schedule_oneshot(AioContext *ctx, QEMUBHFunc *cb, void *opaque) { QEMUBH *bh; @@ -XXX,XX +XXX,XX @@ void aio_bh_schedule_oneshot(AioContext *ctx, QEMUBHFunc *cb, void *opaque) .cb = cb, .opaque = opaque, }; - qemu_lockcnt_lock(&ctx->list_lock); - bh->next = ctx->first_bh; - bh->scheduled = 1; - bh->deleted = 1; - /* Make sure that the members are ready before putting bh into list */ - smp_wmb(); - ctx->first_bh = bh; - qemu_lockcnt_unlock(&ctx->list_lock); - aio_notify(ctx); + aio_bh_enqueue(bh, BH_SCHEDULED | BH_ONESHOT); } QEMUBH *aio_bh_new(AioContext *ctx, QEMUBHFunc *cb, void *opaque) @@ -XXX,XX +XXX,XX @@ QEMUBH *aio_bh_new(AioContext *ctx, QEMUBHFunc *cb, void *opaque) .cb = cb, .opaque = opaque, }; - qemu_lockcnt_lock(&ctx->list_lock); - bh->next = ctx->first_bh; - /* Make sure that the members are ready before putting bh into list */ - smp_wmb(); - ctx->first_bh = bh; - qemu_lockcnt_unlock(&ctx->list_lock); return bh; } @@ -XXX,XX +XXX,XX @@ void aio_bh_call(QEMUBH *bh) bh->cb(bh->opaque); } -/* Multiple occurrences of aio_bh_poll cannot be called concurrently. - * The count in ctx->list_lock is incremented before the call, and is - * not affected by the call. - */ +/* Multiple occurrences of aio_bh_poll cannot be called concurrently. */ int aio_bh_poll(AioContext *ctx) { - QEMUBH *bh, **bhp, *next; - int ret; - bool deleted = false; - - ret = 0; - for (bh = atomic_rcu_read(&ctx->first_bh); bh; bh = next) { - next = atomic_rcu_read(&bh->next); - /* The atomic_xchg is paired with the one in qemu_bh_schedule. The - * implicit memory barrier ensures that the callback sees all writes - * done by the scheduling thread. It also ensures that the scheduling - * thread sees the zero before bh->cb has run, and thus will call - * aio_notify again if necessary. - */ - if (atomic_xchg(&bh->scheduled, 0)) { + BHListSlice slice; + BHListSlice *s; + int ret = 0; + + QSLIST_MOVE_ATOMIC(&slice.bh_list, &ctx->bh_list); + QSIMPLEQ_INSERT_TAIL(&ctx->bh_slice_list, &slice, next); + + while ((s = QSIMPLEQ_FIRST(&ctx->bh_slice_list))) { + QEMUBH *bh; + unsigned flags; + + bh = aio_bh_dequeue(&s->bh_list, &flags); + if (!bh) { + QSIMPLEQ_REMOVE_HEAD(&ctx->bh_slice_list, next); + continue; + } + + if ((flags & (BH_SCHEDULED | BH_DELETED)) == BH_SCHEDULED) { /* Idle BHs don't count as progress */ - if (!bh->idle) { + if (!(flags & BH_IDLE)) { ret = 1; } - bh->idle = 0; aio_bh_call(bh); } - if (bh->deleted) { - deleted = true; + if (flags & (BH_DELETED | BH_ONESHOT)) { + g_free(bh); } } - /* remove deleted bhs */ - if (!deleted) { - return ret; - } - - if (qemu_lockcnt_dec_if_lock(&ctx->list_lock)) { - bhp = &ctx->first_bh; - while (*bhp) { - bh = *bhp; - if (bh->deleted && !bh->scheduled) { - *bhp = bh->next; - g_free(bh); - } else { - bhp = &bh->next; - } - } - qemu_lockcnt_inc_and_unlock(&ctx->list_lock); - } return ret; } void qemu_bh_schedule_idle(QEMUBH *bh) { - bh->idle = 1; - /* Make sure that idle & any writes needed by the callback are done - * before the locations are read in the aio_bh_poll. - */ - atomic_mb_set(&bh->scheduled, 1); + aio_bh_enqueue(bh, BH_SCHEDULED | BH_IDLE); } void qemu_bh_schedule(QEMUBH *bh) { - AioContext *ctx; - - ctx = bh->ctx; - bh->idle = 0; - /* The memory barrier implicit in atomic_xchg makes sure that: - * 1. idle & any writes needed by the callback are done before the - * locations are read in the aio_bh_poll. - * 2. ctx is loaded before scheduled is set and the callback has a chance - * to execute. - */ - if (atomic_xchg(&bh->scheduled, 1) == 0) { - aio_notify(ctx); - } + aio_bh_enqueue(bh, BH_SCHEDULED); } - /* This func is async. */ void qemu_bh_cancel(QEMUBH *bh) { - atomic_mb_set(&bh->scheduled, 0); + atomic_and(&bh->flags, ~BH_SCHEDULED); } /* This func is async.The bottom half will do the delete action at the finial @@ -XXX,XX +XXX,XX @@ void qemu_bh_cancel(QEMUBH *bh) */ void qemu_bh_delete(QEMUBH *bh) { - bh->scheduled = 0; - bh->deleted = 1; + aio_bh_enqueue(bh, BH_DELETED); } -int64_t -aio_compute_timeout(AioContext *ctx) +static int64_t aio_compute_bh_timeout(BHList *head, int timeout) { - int64_t deadline; - int timeout = -1; QEMUBH *bh; - for (bh = atomic_rcu_read(&ctx->first_bh); bh; - bh = atomic_rcu_read(&bh->next)) { - if (bh->scheduled) { - if (bh->idle) { + QSLIST_FOREACH_RCU(bh, head, next) { + if ((bh->flags & (BH_SCHEDULED | BH_DELETED)) == BH_SCHEDULED) { + if (bh->flags & BH_IDLE) { /* idle bottom halves will be polled at least * every 10ms */ timeout = 10000000; @@ -XXX,XX +XXX,XX @@ aio_compute_timeout(AioContext *ctx) } } + return timeout; +} + +int64_t +aio_compute_timeout(AioContext *ctx) +{ + BHListSlice *s; + int64_t deadline; + int timeout = -1; + + timeout = aio_compute_bh_timeout(&ctx->bh_list, timeout); + if (timeout == 0) { + return 0; + } + + QSIMPLEQ_FOREACH(s, &ctx->bh_slice_list, next) { + timeout = aio_compute_bh_timeout(&s->bh_list, timeout); + if (timeout == 0) { + return 0; + } + } + deadline = timerlistgroup_deadline_ns(&ctx->tlg); if (deadline == 0) { return 0; @@ -XXX,XX +XXX,XX @@ aio_ctx_check(GSource *source) { AioContext *ctx = (AioContext *) source; QEMUBH *bh; + BHListSlice *s; atomic_and(&ctx->notify_me, ~1); aio_notify_accept(ctx); - for (bh = ctx->first_bh; bh; bh = bh->next) { - if (bh->scheduled) { + QSLIST_FOREACH_RCU(bh, &ctx->bh_list, next) { + if ((bh->flags & (BH_SCHEDULED | BH_DELETED)) == BH_SCHEDULED) { return true; } } + + QSIMPLEQ_FOREACH(s, &ctx->bh_slice_list, next) { + QSLIST_FOREACH_RCU(bh, &s->bh_list, next) { + if ((bh->flags & (BH_SCHEDULED | BH_DELETED)) == BH_SCHEDULED) { + return true; + } + } + } return aio_pending(ctx) || (timerlistgroup_deadline_ns(&ctx->tlg) == 0); } @@ -XXX,XX +XXX,XX @@ static void aio_ctx_finalize(GSource *source) { AioContext *ctx = (AioContext *) source; + QEMUBH *bh; + unsigned flags; thread_pool_free(ctx->thread_pool); @@ -XXX,XX +XXX,XX @@ aio_ctx_finalize(GSource *source) assert(QSLIST_EMPTY(&ctx->scheduled_coroutines)); qemu_bh_delete(ctx->co_schedule_bh); - qemu_lockcnt_lock(&ctx->list_lock); - assert(!qemu_lockcnt_count(&ctx->list_lock)); - while (ctx->first_bh) { - QEMUBH *next = ctx->first_bh->next; + /* There must be no aio_bh_poll() calls going on */ + assert(QSIMPLEQ_EMPTY(&ctx->bh_slice_list)); + while ((bh = aio_bh_dequeue(&ctx->bh_list, &flags))) { /* qemu_bh_delete() must have been called on BHs in this AioContext */ - assert(ctx->first_bh->deleted); + assert(flags & BH_DELETED); - g_free(ctx->first_bh); - ctx->first_bh = next; + g_free(bh); } - qemu_lockcnt_unlock(&ctx->list_lock); aio_set_event_notifier(ctx, &ctx->notifier, false, NULL, NULL); event_notifier_cleanup(&ctx->notifier); @@ -XXX,XX +XXX,XX @@ AioContext *aio_context_new(Error **errp) AioContext *ctx; ctx = (AioContext *) g_source_new(&aio_source_funcs, sizeof(AioContext)); + QSLIST_INIT(&ctx->bh_list); + QSIMPLEQ_INIT(&ctx->bh_slice_list); aio_context_setup(ctx); ret = event_notifier_init(&ctx->notifier, false); -- 2.24.1 epoll_handler is a stack variable and must not be accessed after it goes out of scope: if (aio_epoll_check_poll(ctx, pollfds, npfd, timeout)) { AioHandler epoll_handler; ... add_pollfd(&epoll_handler); ret = aio_epoll(ctx, pollfds, npfd, timeout); } ... ... /* if we have any readable fds, dispatch event */ if (ret > 0) { for (i = 0; i < npfd; i++) { nodes[i]->pfd.revents = pollfds[i].revents; } } nodes[0] is &epoll_handler, which has already gone out of scope. There is no need to use pollfds[] for epoll. We don't need an AioHandler for the epoll fd. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Sergio Lopez <slp@redhat.com> Message-id: 20200214171712.541358-2-stefanha@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- util/aio-posix.c | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-) diff --git a/util/aio-posix.c b/util/aio-posix.c index XXXXXXX..XXXXXXX 100644 --- a/util/aio-posix.c +++ b/util/aio-posix.c @@ -XXX,XX +XXX,XX @@ static void aio_epoll_update(AioContext *ctx, AioHandler *node, bool is_new) } } -static int aio_epoll(AioContext *ctx, GPollFD *pfds, - unsigned npfd, int64_t timeout) +static int aio_epoll(AioContext *ctx, int64_t timeout) { + GPollFD pfd = { + .fd = ctx->epollfd, + .events = G_IO_IN | G_IO_OUT | G_IO_HUP | G_IO_ERR, + }; AioHandler *node; int i, ret = 0; struct epoll_event events[128]; - assert(npfd == 1); - assert(pfds[0].fd == ctx->epollfd); if (timeout > 0) { - ret = qemu_poll_ns(pfds, npfd, timeout); + ret = qemu_poll_ns(&pfd, 1, timeout); } if (timeout <= 0 || ret > 0) { ret = epoll_wait(ctx->epollfd, events, @@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking) /* wait until next event */ if (aio_epoll_check_poll(ctx, pollfds, npfd, timeout)) { - AioHandler epoll_handler; - - epoll_handler.pfd.fd = ctx->epollfd; - epoll_handler.pfd.events = G_IO_IN | G_IO_OUT | G_IO_HUP | G_IO_ERR; - npfd = 0; - add_pollfd(&epoll_handler); - ret = aio_epoll(ctx, pollfds, npfd, timeout); + npfd = 0; /* pollfds[] is not being used */ + ret = aio_epoll(ctx, timeout); } else { ret = qemu_poll_ns(pollfds, npfd, timeout); } -- 2.24.1 Don't pass the nanosecond timeout into epoll_wait(), which expects milliseconds. The epoll_wait() timeout value does not matter if qemu_poll_ns() determined that the poll fd is ready, but passing a value in the wrong units is still ugly. Pass a 0 timeout to epoll_wait() instead. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Sergio Lopez <slp@redhat.com> Message-id: 20200214171712.541358-3-stefanha@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- util/aio-posix.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/util/aio-posix.c b/util/aio-posix.c index XXXXXXX..XXXXXXX 100644 --- a/util/aio-posix.c +++ b/util/aio-posix.c @@ -XXX,XX +XXX,XX @@ static int aio_epoll(AioContext *ctx, int64_t timeout) if (timeout > 0) { ret = qemu_poll_ns(&pfd, 1, timeout); + if (ret > 0) { + timeout = 0; + } } if (timeout <= 0 || ret > 0) { ret = epoll_wait(ctx->epollfd, events, -- 2.24.1 QLIST_REMOVE() assumes the element is in a list. It also leaves the element's linked list pointers dangling. Introduce a safe version of QLIST_REMOVE() and convert open-coded instances of this pattern. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Sergio Lopez <slp@redhat.com> Message-id: 20200214171712.541358-4-stefanha@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- block.c | 5 +---- chardev/spice.c | 4 +--- include/qemu/queue.h | 14 ++++++++++++++ 3 files changed, 16 insertions(+), 7 deletions(-) diff --git a/block.c b/block.c index XXXXXXX..XXXXXXX 100644 --- a/block.c +++ b/block.c @@ -XXX,XX +XXX,XX @@ BdrvChild *bdrv_attach_child(BlockDriverState *parent_bs, static void bdrv_detach_child(BdrvChild *child) { - if (child->next.le_prev) { - QLIST_REMOVE(child, next); - child->next.le_prev = NULL; - } + QLIST_SAFE_REMOVE(child, next); bdrv_replace_child(child, NULL); diff --git a/chardev/spice.c b/chardev/spice.c index XXXXXXX..XXXXXXX 100644 --- a/chardev/spice.c +++ b/chardev/spice.c @@ -XXX,XX +XXX,XX @@ static void char_spice_finalize(Object *obj) vmc_unregister_interface(s); - if (s->next.le_prev) { - QLIST_REMOVE(s, next); - } + QLIST_SAFE_REMOVE(s, next); g_free((char *)s->sin.subtype); g_free((char *)s->sin.portname); diff --git a/include/qemu/queue.h b/include/qemu/queue.h index XXXXXXX..XXXXXXX 100644 --- a/include/qemu/queue.h +++ b/include/qemu/queue.h @@ -XXX,XX +XXX,XX @@ struct { \ *(elm)->field.le_prev = (elm)->field.le_next; \ } while (/*CONSTCOND*/0) +/* + * Like QLIST_REMOVE() but safe to call when elm is not in a list + */ +#define QLIST_SAFE_REMOVE(elm, field) do { \ + if ((elm)->field.le_prev != NULL) { \ + if ((elm)->field.le_next != NULL) \ + (elm)->field.le_next->field.le_prev = \ + (elm)->field.le_prev; \ + *(elm)->field.le_prev = (elm)->field.le_next; \ + (elm)->field.le_next = NULL; \ + (elm)->field.le_prev = NULL; \ + } \ +} while (/*CONSTCOND*/0) + #define QLIST_FOREACH(var, head, field) \ for ((var) = ((head)->lh_first); \ (var); \ -- 2.24.1 It is not necessary to scan all AioHandlers for deletion. Keep a list of deleted handlers instead of scanning the full list of all handlers. The AioHandler->deleted field can be dropped. Let's check if the handler has been inserted into the deleted list instead. Add a new QLIST_IS_INSERTED() API for this check. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Sergio Lopez <slp@redhat.com> Message-id: 20200214171712.541358-5-stefanha@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- include/block/aio.h | 6 ++++- include/qemu/queue.h | 3 +++ util/aio-posix.c | 53 +++++++++++++++++++++++++++++--------------- 3 files changed, 43 insertions(+), 19 deletions(-) diff --git a/include/block/aio.h b/include/block/aio.h index XXXXXXX..XXXXXXX 100644 --- a/include/block/aio.h +++ b/include/block/aio.h @@ -XXX,XX +XXX,XX @@ void qemu_aio_unref(void *p); void qemu_aio_ref(void *p); typedef struct AioHandler AioHandler; +typedef QLIST_HEAD(, AioHandler) AioHandlerList; typedef void QEMUBHFunc(void *opaque); typedef bool AioPollFn(void *opaque); typedef void IOHandler(void *opaque); @@ -XXX,XX +XXX,XX @@ struct AioContext { QemuRecMutex lock; /* The list of registered AIO handlers. Protected by ctx->list_lock. */ - QLIST_HEAD(, AioHandler) aio_handlers; + AioHandlerList aio_handlers; + + /* The list of AIO handlers to be deleted. Protected by ctx->list_lock. */ + AioHandlerList deleted_aio_handlers; /* Used to avoid unnecessary event_notifier_set calls in aio_notify; * accessed with atomic primitives. If this field is 0, everything diff --git a/include/qemu/queue.h b/include/qemu/queue.h index XXXXXXX..XXXXXXX 100644 --- a/include/qemu/queue.h +++ b/include/qemu/queue.h @@ -XXX,XX +XXX,XX @@ struct { \ } \ } while (/*CONSTCOND*/0) +/* Is elm in a list? */ +#define QLIST_IS_INSERTED(elm, field) ((elm)->field.le_prev != NULL) + #define QLIST_FOREACH(var, head, field) \ for ((var) = ((head)->lh_first); \ (var); \ diff --git a/util/aio-posix.c b/util/aio-posix.c index XXXXXXX..XXXXXXX 100644 --- a/util/aio-posix.c +++ b/util/aio-posix.c @@ -XXX,XX +XXX,XX @@ struct AioHandler AioPollFn *io_poll; IOHandler *io_poll_begin; IOHandler *io_poll_end; - int deleted; void *opaque; bool is_external; QLIST_ENTRY(AioHandler) node; + QLIST_ENTRY(AioHandler) node_deleted; }; #ifdef CONFIG_EPOLL_CREATE1 @@ -XXX,XX +XXX,XX @@ static bool aio_epoll_try_enable(AioContext *ctx) QLIST_FOREACH_RCU(node, &ctx->aio_handlers, node) { int r; - if (node->deleted || !node->pfd.events) { + if (QLIST_IS_INSERTED(node, node_deleted) || !node->pfd.events) { continue; } event.events = epoll_events_from_pfd(node->pfd.events); @@ -XXX,XX +XXX,XX @@ static AioHandler *find_aio_handler(AioContext *ctx, int fd) AioHandler *node; QLIST_FOREACH(node, &ctx->aio_handlers, node) { - if (node->pfd.fd == fd) - if (!node->deleted) + if (node->pfd.fd == fd) { + if (!QLIST_IS_INSERTED(node, node_deleted)) { return node; + } + } } return NULL; @@ -XXX,XX +XXX,XX @@ static bool aio_remove_fd_handler(AioContext *ctx, AioHandler *node) /* If a read is in progress, just mark the node as deleted */ if (qemu_lockcnt_count(&ctx->list_lock)) { - node->deleted = 1; + QLIST_INSERT_HEAD_RCU(&ctx->deleted_aio_handlers, node, node_deleted); node->pfd.revents = 0; return false; } @@ -XXX,XX +XXX,XX @@ static void poll_set_started(AioContext *ctx, bool started) QLIST_FOREACH_RCU(node, &ctx->aio_handlers, node) { IOHandler *fn; - if (node->deleted) { + if (QLIST_IS_INSERTED(node, node_deleted)) { continue; } @@ -XXX,XX +XXX,XX @@ bool aio_pending(AioContext *ctx) return result; } +static void aio_free_deleted_handlers(AioContext *ctx) +{ + AioHandler *node; + + if (QLIST_EMPTY_RCU(&ctx->deleted_aio_handlers)) { + return; + } + if (!qemu_lockcnt_dec_if_lock(&ctx->list_lock)) { + return; /* we are nested, let the parent do the freeing */ + } + + while ((node = QLIST_FIRST_RCU(&ctx->deleted_aio_handlers))) { + QLIST_REMOVE(node, node); + QLIST_REMOVE(node, node_deleted); + g_free(node); + } + + qemu_lockcnt_inc_and_unlock(&ctx->list_lock); +} + static bool aio_dispatch_handlers(AioContext *ctx) { AioHandler *node, *tmp; @@ -XXX,XX +XXX,XX @@ static bool aio_dispatch_handlers(AioContext *ctx) revents = node->pfd.revents & node->pfd.events; node->pfd.revents = 0; - if (!node->deleted && + if (!QLIST_IS_INSERTED(node, node_deleted) && (revents & (G_IO_IN | G_IO_HUP | G_IO_ERR)) && aio_node_check(ctx, node->is_external) && node->io_read) { @@ -XXX,XX +XXX,XX @@ static bool aio_dispatch_handlers(AioContext *ctx) progress = true; } } - if (!node->deleted && + if (!QLIST_IS_INSERTED(node, node_deleted) && (revents & (G_IO_OUT | G_IO_ERR)) && aio_node_check(ctx, node->is_external) && node->io_write) { node->io_write(node->opaque); progress = true; } - - if (node->deleted) { - if (qemu_lockcnt_dec_if_lock(&ctx->list_lock)) { - QLIST_REMOVE(node, node); - g_free(node); - qemu_lockcnt_inc_and_unlock(&ctx->list_lock); - } - } } return progress; @@ -XXX,XX +XXX,XX @@ void aio_dispatch(AioContext *ctx) qemu_lockcnt_inc(&ctx->list_lock); aio_bh_poll(ctx); aio_dispatch_handlers(ctx); + aio_free_deleted_handlers(ctx); qemu_lockcnt_dec(&ctx->list_lock); timerlistgroup_run_timers(&ctx->tlg); @@ -XXX,XX +XXX,XX @@ static bool run_poll_handlers_once(AioContext *ctx, int64_t *timeout) RCU_READ_LOCK_GUARD(); QLIST_FOREACH_RCU(node, &ctx->aio_handlers, node) { - if (!node->deleted && node->io_poll && + if (!QLIST_IS_INSERTED(node, node_deleted) && node->io_poll && aio_node_check(ctx, node->is_external) && node->io_poll(node->opaque)) { /* @@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking) if (!aio_epoll_enabled(ctx)) { QLIST_FOREACH_RCU(node, &ctx->aio_handlers, node) { - if (!node->deleted && node->pfd.events + if (!QLIST_IS_INSERTED(node, node_deleted) && node->pfd.events && aio_node_check(ctx, node->is_external)) { add_pollfd(node); } @@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking) progress |= aio_dispatch_handlers(ctx); } + aio_free_deleted_handlers(ctx); + qemu_lockcnt_dec(&ctx->list_lock); progress |= timerlistgroup_run_timers(&ctx->tlg); -- 2.24.1 File descriptor monitoring is O(1) with epoll(7), but aio_dispatch_handlers() still scans all AioHandlers instead of dispatching just those that are ready. This makes aio_poll() O(n) with respect to the total number of registered handlers. Add a local ready_list to aio_poll() so that each nested aio_poll() builds a list of handlers ready to be dispatched. Since file descriptor polling is level-triggered, nested aio_poll() calls also see fds that were ready in the parent but not yet dispatched. This guarantees that nested aio_poll() invocations will dispatch all fds, even those that became ready before the nested invocation. Since only handlers ready to be dispatched are placed onto the ready_list, the new aio_dispatch_ready_handlers() function provides O(1) dispatch. Note that AioContext polling is still O(n) and currently cannot be fully disabled. This still needs to be fixed before aio_poll() is fully O(1). Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Sergio Lopez <slp@redhat.com> Message-id: 20200214171712.541358-6-stefanha@redhat.com [Fix compilation error on macOS where there is no epoll(87). The aio_epoll() prototype was out of date and aio_add_ready_list() needed to be moved outside the ifdef. --Stefan] Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- util/aio-posix.c | 110 +++++++++++++++++++++++++++++++++-------------- 1 file changed, 78 insertions(+), 32 deletions(-) diff --git a/util/aio-posix.c b/util/aio-posix.c index XXXXXXX..XXXXXXX 100644 --- a/util/aio-posix.c +++ b/util/aio-posix.c @@ -XXX,XX +XXX,XX @@ struct AioHandler void *opaque; bool is_external; QLIST_ENTRY(AioHandler) node; + QLIST_ENTRY(AioHandler) node_ready; /* only used during aio_poll() */ QLIST_ENTRY(AioHandler) node_deleted; }; +/* Add a handler to a ready list */ +static void add_ready_handler(AioHandlerList *ready_list, + AioHandler *node, + int revents) +{ + QLIST_SAFE_REMOVE(node, node_ready); /* remove from nested parent's list */ + node->pfd.revents = revents; + QLIST_INSERT_HEAD(ready_list, node, node_ready); +} + #ifdef CONFIG_EPOLL_CREATE1 /* The fd number threshold to switch to epoll */ @@ -XXX,XX +XXX,XX @@ static void aio_epoll_update(AioContext *ctx, AioHandler *node, bool is_new) } } -static int aio_epoll(AioContext *ctx, int64_t timeout) +static int aio_epoll(AioContext *ctx, AioHandlerList *ready_list, + int64_t timeout) { GPollFD pfd = { .fd = ctx->epollfd, @@ -XXX,XX +XXX,XX @@ static int aio_epoll(AioContext *ctx, int64_t timeout) } for (i = 0; i < ret; i++) { int ev = events[i].events; + int revents = (ev & EPOLLIN ? G_IO_IN : 0) | + (ev & EPOLLOUT ? G_IO_OUT : 0) | + (ev & EPOLLHUP ? G_IO_HUP : 0) | + (ev & EPOLLERR ? G_IO_ERR : 0); + node = events[i].data.ptr; - node->pfd.revents = (ev & EPOLLIN ? G_IO_IN : 0) | - (ev & EPOLLOUT ? G_IO_OUT : 0) | - (ev & EPOLLHUP ? G_IO_HUP : 0) | - (ev & EPOLLERR ? G_IO_ERR : 0); + add_ready_handler(ready_list, node, revents); } } out: @@ -XXX,XX +XXX,XX @@ static void aio_epoll_update(AioContext *ctx, AioHandler *node, bool is_new) { } -static int aio_epoll(AioContext *ctx, GPollFD *pfds, - unsigned npfd, int64_t timeout) +static int aio_epoll(AioContext *ctx, AioHandlerList *ready_list, + int64_t timeout) { assert(false); } @@ -XXX,XX +XXX,XX @@ static void aio_free_deleted_handlers(AioContext *ctx) qemu_lockcnt_inc_and_unlock(&ctx->list_lock); } -static bool aio_dispatch_handlers(AioContext *ctx) +static bool aio_dispatch_handler(AioContext *ctx, AioHandler *node) { - AioHandler *node, *tmp; bool progress = false; + int revents; - QLIST_FOREACH_SAFE_RCU(node, &ctx->aio_handlers, node, tmp) { - int revents; + revents = node->pfd.revents & node->pfd.events; + node->pfd.revents = 0; - revents = node->pfd.revents & node->pfd.events; - node->pfd.revents = 0; + if (!QLIST_IS_INSERTED(node, node_deleted) && + (revents & (G_IO_IN | G_IO_HUP | G_IO_ERR)) && + aio_node_check(ctx, node->is_external) && + node->io_read) { + node->io_read(node->opaque); - if (!QLIST_IS_INSERTED(node, node_deleted) && - (revents & (G_IO_IN | G_IO_HUP | G_IO_ERR)) && - aio_node_check(ctx, node->is_external) && - node->io_read) { - node->io_read(node->opaque); - - /* aio_notify() does not count as progress */ - if (node->opaque != &ctx->notifier) { - progress = true; - } - } - if (!QLIST_IS_INSERTED(node, node_deleted) && - (revents & (G_IO_OUT | G_IO_ERR)) && - aio_node_check(ctx, node->is_external) && - node->io_write) { - node->io_write(node->opaque); + /* aio_notify() does not count as progress */ + if (node->opaque != &ctx->notifier) { progress = true; } } + if (!QLIST_IS_INSERTED(node, node_deleted) && + (revents & (G_IO_OUT | G_IO_ERR)) && + aio_node_check(ctx, node->is_external) && + node->io_write) { + node->io_write(node->opaque); + progress = true; + } + + return progress; +} + +/* + * If we have a list of ready handlers then this is more efficient than + * scanning all handlers with aio_dispatch_handlers(). + */ +static bool aio_dispatch_ready_handlers(AioContext *ctx, + AioHandlerList *ready_list) +{ + bool progress = false; + AioHandler *node; + + while ((node = QLIST_FIRST(ready_list))) { + QLIST_SAFE_REMOVE(node, node_ready); + progress = aio_dispatch_handler(ctx, node) || progress; + } + + return progress; +} + +/* Slower than aio_dispatch_ready_handlers() but only used via glib */ +static bool aio_dispatch_handlers(AioContext *ctx) +{ + AioHandler *node, *tmp; + bool progress = false; + + QLIST_FOREACH_SAFE_RCU(node, &ctx->aio_handlers, node, tmp) { + progress = aio_dispatch_handler(ctx, node) || progress; + } return progress; } @@ -XXX,XX +XXX,XX @@ static bool try_poll_mode(AioContext *ctx, int64_t *timeout) bool aio_poll(AioContext *ctx, bool blocking) { + AioHandlerList ready_list = QLIST_HEAD_INITIALIZER(ready_list); AioHandler *node; int i; int ret = 0; @@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking) /* wait until next event */ if (aio_epoll_check_poll(ctx, pollfds, npfd, timeout)) { npfd = 0; /* pollfds[] is not being used */ - ret = aio_epoll(ctx, timeout); + ret = aio_epoll(ctx, &ready_list, timeout); } else { ret = qemu_poll_ns(pollfds, npfd, timeout); } @@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking) /* if we have any readable fds, dispatch event */ if (ret > 0) { for (i = 0; i < npfd; i++) { - nodes[i]->pfd.revents = pollfds[i].revents; + int revents = pollfds[i].revents; + + if (revents) { + add_ready_handler(&ready_list, nodes[i], revents); + } } } @@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking) progress |= aio_bh_poll(ctx); if (ret > 0) { - progress |= aio_dispatch_handlers(ctx); + progress |= aio_dispatch_ready_handlers(ctx, &ready_list); } aio_free_deleted_handlers(ctx); -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> Move vl.c to a separate directory, similar to linux-user/ Update the chechpatch and get_maintainer scripts, since they relied on /vl.c for top_of_tree checks. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-2-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- MAINTAINERS | 2 +- Makefile.objs | 2 -- Makefile.target | 1 + scripts/checkpatch.pl | 2 +- scripts/get_maintainer.pl | 3 ++- softmmu/Makefile.objs | 2 ++ vl.c => softmmu/vl.c | 0 7 files changed, 7 insertions(+), 5 deletions(-) create mode 100644 softmmu/Makefile.objs rename vl.c => softmmu/vl.c (100%) diff --git a/MAINTAINERS b/MAINTAINERS index XXXXXXX..XXXXXXX 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -XXX,XX +XXX,XX @@ F: include/qemu/main-loop.h F: include/sysemu/runstate.h F: util/main-loop.c F: util/qemu-timer.c -F: vl.c +F: softmmu/vl.c F: qapi/run-state.json Human Monitor (HMP) diff --git a/Makefile.objs b/Makefile.objs index XXXXXXX..XXXXXXX 100644 --- a/Makefile.objs +++ b/Makefile.objs @@ -XXX,XX +XXX,XX @@ common-obj-y += ui/ common-obj-m += ui/ common-obj-y += dma-helpers.o -common-obj-y += vl.o -vl.o-cflags := $(GPROF_CFLAGS) $(SDL_CFLAGS) common-obj-$(CONFIG_TPM) += tpm.o common-obj-y += backends/ diff --git a/Makefile.target b/Makefile.target index XXXXXXX..XXXXXXX 100644 --- a/Makefile.target +++ b/Makefile.target @@ -XXX,XX +XXX,XX @@ obj-y += qapi/ obj-y += memory.o obj-y += memory_mapping.o obj-y += migration/ram.o +obj-y += softmmu/ LIBS := $(libs_softmmu) $(LIBS) # Hardware support diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl index XXXXXXX..XXXXXXX 100755 --- a/scripts/checkpatch.pl +++ b/scripts/checkpatch.pl @@ -XXX,XX +XXX,XX @@ sub top_of_kernel_tree { my @tree_check = ( "COPYING", "MAINTAINERS", "Makefile", "README.rst", "docs", "VERSION", - "vl.c" + "linux-user", "softmmu" ); foreach my $check (@tree_check) { diff --git a/scripts/get_maintainer.pl b/scripts/get_maintainer.pl index XXXXXXX..XXXXXXX 100755 --- a/scripts/get_maintainer.pl +++ b/scripts/get_maintainer.pl @@ -XXX,XX +XXX,XX @@ sub top_of_tree { && (-f "${lk_path}Makefile") && (-d "${lk_path}docs") && (-f "${lk_path}VERSION") - && (-f "${lk_path}vl.c")) { + && (-d "${lk_path}linux-user/") + && (-d "${lk_path}softmmu/")) { return 1; } return 0; diff --git a/softmmu/Makefile.objs b/softmmu/Makefile.objs new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/softmmu/Makefile.objs @@ -XXX,XX +XXX,XX @@ +obj-y += vl.o +vl.o-cflags := $(GPROF_CFLAGS) $(SDL_CFLAGS) diff --git a/vl.c b/softmmu/vl.c similarity index 100% rename from vl.c rename to softmmu/vl.c -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> A program might rely on functions implemented in vl.c, but implement its own main(). By placing main into a separate source file, there are no complaints about duplicate main()s when linking against vl.o. For example, the virtual-device fuzzer uses a main() provided by libfuzzer, and needs to perform some initialization before running the softmmu initialization. Now, main simply calls three vl.c functions which handle the guest initialization, main loop and cleanup. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-3-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- MAINTAINERS | 1 + Makefile.target | 2 +- include/sysemu/sysemu.h | 4 ++++ softmmu/Makefile.objs | 1 + softmmu/main.c | 53 +++++++++++++++++++++++++++++++++++++++++ softmmu/vl.c | 36 +++++++--------------------- 6 files changed, 69 insertions(+), 28 deletions(-) create mode 100644 softmmu/main.c diff --git a/MAINTAINERS b/MAINTAINERS index XXXXXXX..XXXXXXX 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -XXX,XX +XXX,XX @@ F: include/sysemu/runstate.h F: util/main-loop.c F: util/qemu-timer.c F: softmmu/vl.c +F: softmmu/main.c F: qapi/run-state.json Human Monitor (HMP) diff --git a/Makefile.target b/Makefile.target index XXXXXXX..XXXXXXX 100644 --- a/Makefile.target +++ b/Makefile.target @@ -XXX,XX +XXX,XX @@ endif COMMON_LDADDS = ../libqemuutil.a # build either PROG or PROGW -$(QEMU_PROG_BUILD): $(all-obj-y) $(COMMON_LDADDS) +$(QEMU_PROG_BUILD): $(all-obj-y) $(COMMON_LDADDS) $(softmmu-main-y) $(call LINK, $(filter-out %.mak, $^)) ifdef CONFIG_DARWIN $(call quiet-command,Rez -append $(SRC_PATH)/pc-bios/qemu.rsrc -o $@,"REZ","$(TARGET_DIR)$@") diff --git a/include/sysemu/sysemu.h b/include/sysemu/sysemu.h index XXXXXXX..XXXXXXX 100644 --- a/include/sysemu/sysemu.h +++ b/include/sysemu/sysemu.h @@ -XXX,XX +XXX,XX @@ QemuOpts *qemu_get_machine_opts(void); bool defaults_enabled(void); +void qemu_init(int argc, char **argv, char **envp); +void qemu_main_loop(void); +void qemu_cleanup(void); + extern QemuOptsList qemu_legacy_drive_opts; extern QemuOptsList qemu_common_drive_opts; extern QemuOptsList qemu_drive_opts; diff --git a/softmmu/Makefile.objs b/softmmu/Makefile.objs index XXXXXXX..XXXXXXX 100644 --- a/softmmu/Makefile.objs +++ b/softmmu/Makefile.objs @@ -XXX,XX +XXX,XX @@ +softmmu-main-y = softmmu/main.o obj-y += vl.o vl.o-cflags := $(GPROF_CFLAGS) $(SDL_CFLAGS) diff --git a/softmmu/main.c b/softmmu/main.c new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/softmmu/main.c @@ -XXX,XX +XXX,XX @@ +/* + * QEMU System Emulator + * + * Copyright (c) 2003-2020 Fabrice Bellard + * + * Permission is hereby granted, free of charge, to any person obtaining a copy + * of this software and associated documentation files (the "Software"), to deal + * in the Software without restriction, including without limitation the rights + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell + * copies of the Software, and to permit persons to whom the Software is + * furnished to do so, subject to the following conditions: + * + * The above copyright notice and this permission notice shall be included in + * all copies or substantial portions of the Software. + * + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL + * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN + * THE SOFTWARE. + */ + +#include "qemu/osdep.h" +#include "qemu-common.h" +#include "sysemu/sysemu.h" + +#ifdef CONFIG_SDL +#if defined(__APPLE__) || defined(main) +#include <SDL.h> +int main(int argc, char **argv) +{ + return qemu_main(argc, argv, NULL); +} +#undef main +#define main qemu_main +#endif +#endif /* CONFIG_SDL */ + +#ifdef CONFIG_COCOA +#undef main +#define main qemu_main +#endif /* CONFIG_COCOA */ + +int main(int argc, char **argv, char **envp) +{ + qemu_init(argc, argv, envp); + qemu_main_loop(); + qemu_cleanup(); + + return 0; +} diff --git a/softmmu/vl.c b/softmmu/vl.c index XXXXXXX..XXXXXXX 100644 --- a/softmmu/vl.c +++ b/softmmu/vl.c @@ -XXX,XX +XXX,XX @@ #include "sysemu/seccomp.h" #include "sysemu/tcg.h" -#ifdef CONFIG_SDL -#if defined(__APPLE__) || defined(main) -#include <SDL.h> -int qemu_main(int argc, char **argv, char **envp); -int main(int argc, char **argv) -{ - return qemu_main(argc, argv, NULL); -} -#undef main -#define main qemu_main -#endif -#endif /* CONFIG_SDL */ - -#ifdef CONFIG_COCOA -#undef main -#define main qemu_main -#endif /* CONFIG_COCOA */ - - #include "qemu/error-report.h" #include "qemu/sockets.h" #include "sysemu/accel.h" @@ -XXX,XX +XXX,XX @@ static bool main_loop_should_exit(void) return false; } -static void main_loop(void) +void qemu_main_loop(void) { #ifdef CONFIG_PROFILER int64_t ti; @@ -XXX,XX +XXX,XX @@ static void configure_accelerators(const char *progname) } } -int main(int argc, char **argv, char **envp) +void qemu_init(int argc, char **argv, char **envp) { int i; int snapshot, linux_boot; @@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv, char **envp) case QEMU_OPTION_watchdog: if (watchdog) { error_report("only one watchdog option may be given"); - return 1; + exit(1); } watchdog = optarg; break; @@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv, char **envp) parse_numa_opts(current_machine); /* do monitor/qmp handling at preconfig state if requested */ - main_loop(); + qemu_main_loop(); audio_init_audiodevs(); @@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv, char **envp) if (vmstate_dump_file) { /* dump and exit */ dump_vmstate_json_to_file(vmstate_dump_file); - return 0; + exit(0); } if (incoming) { @@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv, char **envp) accel_setup_post(current_machine); os_setup_post(); - main_loop(); + return; +} +void qemu_cleanup(void) +{ gdbserver_cleanup(); /* @@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv, char **envp) qemu_chr_cleanup(); user_creatable_cleanup(); /* TODO: unref root container, check all devices are ok */ - - return 0; } -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> The virtual-device fuzzer must initialize QOM, prior to running vl:qemu_init, so that it can use the qos_graph to identify the arguments required to initialize a guest for libqos-assisted fuzzing. This change prevents errors when vl:qemu_init tries to (re)initialize the previously initialized QOM module. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20200220041118.23264-4-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- util/module.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/util/module.c b/util/module.c index XXXXXXX..XXXXXXX 100644 --- a/util/module.c +++ b/util/module.c @@ -XXX,XX +XXX,XX @@ typedef struct ModuleEntry typedef QTAILQ_HEAD(, ModuleEntry) ModuleTypeList; static ModuleTypeList init_type_list[MODULE_INIT_MAX]; +static bool modules_init_done[MODULE_INIT_MAX]; static ModuleTypeList dso_init_list; @@ -XXX,XX +XXX,XX @@ void module_call_init(module_init_type type) ModuleTypeList *l; ModuleEntry *e; + if (modules_init_done[type]) { + return; + } + l = find_type(type); QTAILQ_FOREACH(e, l, node) { e->init(); } + + modules_init_done[type] = true; } #ifdef CONFIG_MODULES -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-5-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- include/qemu/module.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/include/qemu/module.h b/include/qemu/module.h index XXXXXXX..XXXXXXX 100644 --- a/include/qemu/module.h +++ b/include/qemu/module.h @@ -XXX,XX +XXX,XX @@ typedef enum { MODULE_INIT_TRACE, MODULE_INIT_XEN_BACKEND, MODULE_INIT_LIBQOS, + MODULE_INIT_FUZZ_TARGET, MODULE_INIT_MAX } module_init_type; @@ -XXX,XX +XXX,XX @@ typedef enum { #define xen_backend_init(function) module_init(function, \ MODULE_INIT_XEN_BACKEND) #define libqos_init(function) module_init(function, MODULE_INIT_LIBQOS) - +#define fuzz_target_init(function) module_init(function, \ + MODULE_INIT_FUZZ_TARGET) #define block_module_load_one(lib) module_load_one("block-", lib) #define ui_module_load_one(lib) module_load_one("ui-", lib) #define audio_module_load_one(lib) module_load_one("audio-", lib) -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> qtest_server_send is a function pointer specifying the handler used to transmit data to the qtest client. In the standard configuration, this calls the CharBackend handler, but now it is possible for other types of handlers, e.g direct-function calls if the qtest client and server exist within the same process (inproc) Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Acked-by: Thomas Huth <thuth@redhat.com> Message-id: 20200220041118.23264-6-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- include/sysemu/qtest.h | 3 +++ qtest.c | 18 ++++++++++++++++-- 2 files changed, 19 insertions(+), 2 deletions(-) diff --git a/include/sysemu/qtest.h b/include/sysemu/qtest.h index XXXXXXX..XXXXXXX 100644 --- a/include/sysemu/qtest.h +++ b/include/sysemu/qtest.h @@ -XXX,XX +XXX,XX @@ bool qtest_driver(void); void qtest_server_init(const char *qtest_chrdev, const char *qtest_log, Error **errp); +void qtest_server_set_send_handler(void (*send)(void *, const char *), + void *opaque); + #endif diff --git a/qtest.c b/qtest.c index XXXXXXX..XXXXXXX 100644 --- a/qtest.c +++ b/qtest.c @@ -XXX,XX +XXX,XX @@ static GString *inbuf; static int irq_levels[MAX_IRQ]; static qemu_timeval start_time; static bool qtest_opened; +static void (*qtest_server_send)(void*, const char*); +static void *qtest_server_send_opaque; #define FMT_timeval "%ld.%06ld" @@ -XXX,XX +XXX,XX @@ static void GCC_FMT_ATTR(1, 2) qtest_log_send(const char *fmt, ...) va_end(ap); } -static void do_qtest_send(CharBackend *chr, const char *str, size_t len) +static void qtest_server_char_be_send(void *opaque, const char *str) { + size_t len = strlen(str); + CharBackend* chr = (CharBackend *)opaque; qemu_chr_fe_write_all(chr, (uint8_t *)str, len); if (qtest_log_fp && qtest_opened) { fprintf(qtest_log_fp, "%s", str); @@ -XXX,XX +XXX,XX @@ static void do_qtest_send(CharBackend *chr, const char *str, size_t len) static void qtest_send(CharBackend *chr, const char *str) { - do_qtest_send(chr, str, strlen(str)); + qtest_server_send(qtest_server_send_opaque, str); } static void GCC_FMT_ATTR(2, 3) qtest_sendf(CharBackend *chr, @@ -XXX,XX +XXX,XX @@ void qtest_server_init(const char *qtest_chrdev, const char *qtest_log, Error ** qemu_chr_fe_set_echo(&qtest_chr, true); inbuf = g_string_new(""); + + if (!qtest_server_send) { + qtest_server_set_send_handler(qtest_server_char_be_send, &qtest_chr); + } +} + +void qtest_server_set_send_handler(void (*send)(void*, const char*), void *opaque) +{ + qtest_server_send = send; + qtest_server_send_opaque = opaque; } bool qtest_driver(void) -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> This makes it simple to swap the transport functions for qtest commands to and from the qtest client. For example, now it is possible to directly pass qtest commands to a server handler that exists within the same process, without the standard way of writing to a file descriptor. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-7-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- tests/qtest/libqtest.c | 48 ++++++++++++++++++++++++++++++++++-------- 1 file changed, 39 insertions(+), 9 deletions(-) diff --git a/tests/qtest/libqtest.c b/tests/qtest/libqtest.c index XXXXXXX..XXXXXXX 100644 --- a/tests/qtest/libqtest.c +++ b/tests/qtest/libqtest.c @@ -XXX,XX +XXX,XX @@ #define SOCKET_TIMEOUT 50 #define SOCKET_MAX_FDS 16 + +typedef void (*QTestSendFn)(QTestState *s, const char *buf); +typedef GString* (*QTestRecvFn)(QTestState *); + +typedef struct QTestClientTransportOps { + QTestSendFn send; /* for sending qtest commands */ + QTestRecvFn recv_line; /* for receiving qtest command responses */ +} QTestTransportOps; + struct QTestState { int fd; @@ -XXX,XX +XXX,XX @@ struct QTestState bool big_endian; bool irq_level[MAX_IRQ]; GString *rx; + QTestTransportOps ops; }; static GHookList abrt_hooks; @@ -XXX,XX +XXX,XX @@ static struct sigaction sigact_old; static int qtest_query_target_endianness(QTestState *s); +static void qtest_client_socket_send(QTestState*, const char *buf); +static void socket_send(int fd, const char *buf, size_t size); + +static GString *qtest_client_socket_recv_line(QTestState *); + +static void qtest_client_set_tx_handler(QTestState *s, QTestSendFn send); +static void qtest_client_set_rx_handler(QTestState *s, QTestRecvFn recv); + static int init_socket(const char *socket_path) { struct sockaddr_un addr; @@ -XXX,XX +XXX,XX @@ QTestState *qtest_init_without_qmp_handshake(const char *extra_args) sock = init_socket(socket_path); qmpsock = init_socket(qmp_socket_path); + qtest_client_set_rx_handler(s, qtest_client_socket_recv_line); + qtest_client_set_tx_handler(s, qtest_client_socket_send); + qtest_add_abrt_handler(kill_qemu_hook_func, s); command = g_strdup_printf("exec %s " @@ -XXX,XX +XXX,XX @@ static void socket_send(int fd, const char *buf, size_t size) } } -static void socket_sendf(int fd, const char *fmt, va_list ap) +static void qtest_client_socket_send(QTestState *s, const char *buf) { - gchar *str = g_strdup_vprintf(fmt, ap); - size_t size = strlen(str); - - socket_send(fd, str, size); - g_free(str); + socket_send(s->fd, buf, strlen(buf)); } static void GCC_FMT_ATTR(2, 3) qtest_sendf(QTestState *s, const char *fmt, ...) @@ -XXX,XX +XXX,XX @@ static void GCC_FMT_ATTR(2, 3) qtest_sendf(QTestState *s, const char *fmt, ...) va_list ap; va_start(ap, fmt); - socket_sendf(s->fd, fmt, ap); + gchar *str = g_strdup_vprintf(fmt, ap); va_end(ap); + + s->ops.send(s, str); + g_free(str); } /* Sends a message and file descriptors to the socket. @@ -XXX,XX +XXX,XX @@ static void socket_send_fds(int socket_fd, int *fds, size_t fds_num, g_assert_cmpint(ret, >, 0); } -static GString *qtest_recv_line(QTestState *s) +static GString *qtest_client_socket_recv_line(QTestState *s) { GString *line; size_t offset; @@ -XXX,XX +XXX,XX @@ static gchar **qtest_rsp(QTestState *s, int expected_args) int i; redo: - line = qtest_recv_line(s); + line = s->ops.recv_line(s); words = g_strsplit(line->str, " ", 0); g_string_free(line, TRUE); @@ -XXX,XX +XXX,XX @@ void qmp_assert_error_class(QDict *rsp, const char *class) qobject_unref(rsp); } + +static void qtest_client_set_tx_handler(QTestState *s, + QTestSendFn send) +{ + s->ops.send = send; +} +static void qtest_client_set_rx_handler(QTestState *s, QTestRecvFn recv) +{ + s->ops.recv_line = recv; +} -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> When using qtest "in-process" communication, qtest_sendf directly calls a function in the server (qtest.c). Previously, bufwrite used socket_send, which bypasses the TransportOps enabling the call into qtest.c. This change replaces the socket_send calls with ops->send, maintaining the benefits of the direct socket_send call, while adding support for in-process qtest calls. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-8-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- tests/qtest/libqtest.c | 71 ++++++++++++++++++++++++++++++++++++++++-- tests/qtest/libqtest.h | 4 +++ 2 files changed, 73 insertions(+), 2 deletions(-) diff --git a/tests/qtest/libqtest.c b/tests/qtest/libqtest.c index XXXXXXX..XXXXXXX 100644 --- a/tests/qtest/libqtest.c +++ b/tests/qtest/libqtest.c @@ -XXX,XX +XXX,XX @@ typedef void (*QTestSendFn)(QTestState *s, const char *buf); +typedef void (*ExternalSendFn)(void *s, const char *buf); typedef GString* (*QTestRecvFn)(QTestState *); typedef struct QTestClientTransportOps { QTestSendFn send; /* for sending qtest commands */ + + /* + * use external_send to send qtest command strings through functions which + * do not accept a QTestState as the first parameter. + */ + ExternalSendFn external_send; + QTestRecvFn recv_line; /* for receiving qtest command responses */ } QTestTransportOps; @@ -XXX,XX +XXX,XX @@ void qtest_bufwrite(QTestState *s, uint64_t addr, const void *data, size_t size) bdata = g_base64_encode(data, size); qtest_sendf(s, "b64write 0x%" PRIx64 " 0x%zx ", addr, size); - socket_send(s->fd, bdata, strlen(bdata)); - socket_send(s->fd, "\n", 1); + s->ops.send(s, bdata); + s->ops.send(s, "\n"); qtest_rsp(s, 0); g_free(bdata); } @@ -XXX,XX +XXX,XX @@ static void qtest_client_set_rx_handler(QTestState *s, QTestRecvFn recv) { s->ops.recv_line = recv; } +/* A type-safe wrapper for s->send() */ +static void send_wrapper(QTestState *s, const char *buf) +{ + s->ops.external_send(s, buf); +} + +static GString *qtest_client_inproc_recv_line(QTestState *s) +{ + GString *line; + size_t offset; + char *eol; + + eol = strchr(s->rx->str, '\n'); + offset = eol - s->rx->str; + line = g_string_new_len(s->rx->str, offset); + g_string_erase(s->rx, 0, offset + 1); + return line; +} + +QTestState *qtest_inproc_init(QTestState **s, bool log, const char* arch, + void (*send)(void*, const char*)) +{ + QTestState *qts; + qts = g_new0(QTestState, 1); + *s = qts; /* Expose qts early on, since the query endianness relies on it */ + qts->wstatus = 0; + for (int i = 0; i < MAX_IRQ; i++) { + qts->irq_level[i] = false; + } + + qtest_client_set_rx_handler(qts, qtest_client_inproc_recv_line); + + /* send() may not have a matching protoype, so use a type-safe wrapper */ + qts->ops.external_send = send; + qtest_client_set_tx_handler(qts, send_wrapper); + + qts->big_endian = qtest_query_target_endianness(qts); + + /* + * Set a dummy path for QTEST_QEMU_BINARY. Doesn't need to exist, but this + * way, qtest_get_arch works for inproc qtest. + */ + gchar *bin_path = g_strconcat("/qemu-system-", arch, NULL); + setenv("QTEST_QEMU_BINARY", bin_path, 0); + g_free(bin_path); + + return qts; +} + +void qtest_client_inproc_recv(void *opaque, const char *str) +{ + QTestState *qts = *(QTestState **)opaque; + + if (!qts->rx) { + qts->rx = g_string_new(NULL); + } + g_string_append(qts->rx, str); + return; +} diff --git a/tests/qtest/libqtest.h b/tests/qtest/libqtest.h index XXXXXXX..XXXXXXX 100644 --- a/tests/qtest/libqtest.h +++ b/tests/qtest/libqtest.h @@ -XXX,XX +XXX,XX @@ bool qtest_probe_child(QTestState *s); */ void qtest_set_expected_status(QTestState *s, int status); +QTestState *qtest_inproc_init(QTestState **s, bool log, const char* arch, + void (*send)(void*, const char*)); + +void qtest_client_inproc_recv(void *opaque, const char *str); #endif -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> The handler allows a qtest client to send commands to the server by directly calling a function, rather than using a file/CharBackend Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-9-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- include/sysemu/qtest.h | 1 + qtest.c | 13 +++++++++++++ 2 files changed, 14 insertions(+) diff --git a/include/sysemu/qtest.h b/include/sysemu/qtest.h index XXXXXXX..XXXXXXX 100644 --- a/include/sysemu/qtest.h +++ b/include/sysemu/qtest.h @@ -XXX,XX +XXX,XX @@ void qtest_server_init(const char *qtest_chrdev, const char *qtest_log, Error ** void qtest_server_set_send_handler(void (*send)(void *, const char *), void *opaque); +void qtest_server_inproc_recv(void *opaque, const char *buf); #endif diff --git a/qtest.c b/qtest.c index XXXXXXX..XXXXXXX 100644 --- a/qtest.c +++ b/qtest.c @@ -XXX,XX +XXX,XX @@ bool qtest_driver(void) { return qtest_chr.chr != NULL; } + +void qtest_server_inproc_recv(void *dummy, const char *buf) +{ + static GString *gstr; + if (!gstr) { + gstr = g_string_new(NULL); + } + g_string_append(gstr, buf); + if (gstr->str[gstr->len - 1] == '\n') { + qtest_process_inbuf(NULL, gstr); + g_string_truncate(gstr, 0); + } +} -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> The names i2c_send and i2c_recv collide with functions defined in hw/i2c/core.c. This causes an error when linking against libqos and softmmu simultaneously (for example when using qtest inproc). Rename the libqos functions to avoid this. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Acked-by: Thomas Huth <thuth@redhat.com> Message-id: 20200220041118.23264-10-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- tests/qtest/libqos/i2c.c | 10 +++++----- tests/qtest/libqos/i2c.h | 4 ++-- tests/qtest/pca9552-test.c | 10 +++++----- 3 files changed, 12 insertions(+), 12 deletions(-) diff --git a/tests/qtest/libqos/i2c.c b/tests/qtest/libqos/i2c.c index XXXXXXX..XXXXXXX 100644 --- a/tests/qtest/libqos/i2c.c +++ b/tests/qtest/libqos/i2c.c @@ -XXX,XX +XXX,XX @@ #include "libqos/i2c.h" #include "libqtest.h" -void i2c_send(QI2CDevice *i2cdev, const uint8_t *buf, uint16_t len) +void qi2c_send(QI2CDevice *i2cdev, const uint8_t *buf, uint16_t len) { i2cdev->bus->send(i2cdev->bus, i2cdev->addr, buf, len); } -void i2c_recv(QI2CDevice *i2cdev, uint8_t *buf, uint16_t len) +void qi2c_recv(QI2CDevice *i2cdev, uint8_t *buf, uint16_t len) { i2cdev->bus->recv(i2cdev->bus, i2cdev->addr, buf, len); } @@ -XXX,XX +XXX,XX @@ void i2c_recv(QI2CDevice *i2cdev, uint8_t *buf, uint16_t len) void i2c_read_block(QI2CDevice *i2cdev, uint8_t reg, uint8_t *buf, uint16_t len) { - i2c_send(i2cdev, &reg, 1); - i2c_recv(i2cdev, buf, len); + qi2c_send(i2cdev, &reg, 1); + qi2c_recv(i2cdev, buf, len); } void i2c_write_block(QI2CDevice *i2cdev, uint8_t reg, @@ -XXX,XX +XXX,XX @@ void i2c_write_block(QI2CDevice *i2cdev, uint8_t reg, uint8_t *cmd = g_malloc(len + 1); cmd[0] = reg; memcpy(&cmd[1], buf, len); - i2c_send(i2cdev, cmd, len + 1); + qi2c_send(i2cdev, cmd, len + 1); g_free(cmd); } diff --git a/tests/qtest/libqos/i2c.h b/tests/qtest/libqos/i2c.h index XXXXXXX..XXXXXXX 100644 --- a/tests/qtest/libqos/i2c.h +++ b/tests/qtest/libqos/i2c.h @@ -XXX,XX +XXX,XX @@ struct QI2CDevice { void *i2c_device_create(void *i2c_bus, QGuestAllocator *alloc, void *addr); void add_qi2c_address(QOSGraphEdgeOptions *opts, QI2CAddress *addr); -void i2c_send(QI2CDevice *dev, const uint8_t *buf, uint16_t len); -void i2c_recv(QI2CDevice *dev, uint8_t *buf, uint16_t len); +void qi2c_send(QI2CDevice *dev, const uint8_t *buf, uint16_t len); +void qi2c_recv(QI2CDevice *dev, uint8_t *buf, uint16_t len); void i2c_read_block(QI2CDevice *dev, uint8_t reg, uint8_t *buf, uint16_t len); diff --git a/tests/qtest/pca9552-test.c b/tests/qtest/pca9552-test.c index XXXXXXX..XXXXXXX 100644 --- a/tests/qtest/pca9552-test.c +++ b/tests/qtest/pca9552-test.c @@ -XXX,XX +XXX,XX @@ static void receive_autoinc(void *obj, void *data, QGuestAllocator *alloc) pca9552_init(i2cdev); - i2c_send(i2cdev, &reg, 1); + qi2c_send(i2cdev, &reg, 1); /* PCA9552_LS0 */ - i2c_recv(i2cdev, &resp, 1); + qi2c_recv(i2cdev, &resp, 1); g_assert_cmphex(resp, ==, 0x54); /* PCA9552_LS1 */ - i2c_recv(i2cdev, &resp, 1); + qi2c_recv(i2cdev, &resp, 1); g_assert_cmphex(resp, ==, 0x55); /* PCA9552_LS2 */ - i2c_recv(i2cdev, &resp, 1); + qi2c_recv(i2cdev, &resp, 1); g_assert_cmphex(resp, ==, 0x55); /* PCA9552_LS3 */ - i2c_recv(i2cdev, &resp, 1); + qi2c_recv(i2cdev, &resp, 1); g_assert_cmphex(resp, ==, 0x54); } -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> Most qos-related objects were specified in the qos-test-obj-y variable. qos-test-obj-y also included qos-test.o which defines a main(). This made it difficult to repurpose qos-test-obj-y to link anything beside tests/qos-test against libqos. This change separates objects that are libqos-specific and ones that are qos-test specific into different variables. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20200220041118.23264-11-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- tests/qtest/Makefile.include | 71 ++++++++++++++++++------------------ 1 file changed, 36 insertions(+), 35 deletions(-) diff --git a/tests/qtest/Makefile.include b/tests/qtest/Makefile.include index XXXXXXX..XXXXXXX 100644 --- a/tests/qtest/Makefile.include +++ b/tests/qtest/Makefile.include @@ -XXX,XX +XXX,XX @@ check-qtest-s390x-y += migration-test # libqos / qgraph : libqgraph-obj-y = tests/qtest/libqos/qgraph.o -libqos-obj-y = $(libqgraph-obj-y) tests/qtest/libqos/pci.o tests/qtest/libqos/fw_cfg.o -libqos-obj-y += tests/qtest/libqos/malloc.o -libqos-obj-y += tests/qtest/libqos/libqos.o -libqos-spapr-obj-y = $(libqos-obj-y) tests/qtest/libqos/malloc-spapr.o +libqos-core-obj-y = $(libqgraph-obj-y) tests/qtest/libqos/pci.o tests/qtest/libqos/fw_cfg.o +libqos-core-obj-y += tests/qtest/libqos/malloc.o +libqos-core-obj-y += tests/qtest/libqos/libqos.o +libqos-spapr-obj-y = $(libqos-core-obj-y) tests/qtest/libqos/malloc-spapr.o libqos-spapr-obj-y += tests/qtest/libqos/libqos-spapr.o libqos-spapr-obj-y += tests/qtest/libqos/rtas.o libqos-spapr-obj-y += tests/qtest/libqos/pci-spapr.o -libqos-pc-obj-y = $(libqos-obj-y) tests/qtest/libqos/pci-pc.o +libqos-pc-obj-y = $(libqos-core-obj-y) tests/qtest/libqos/pci-pc.o libqos-pc-obj-y += tests/qtest/libqos/malloc-pc.o tests/qtest/libqos/libqos-pc.o libqos-pc-obj-y += tests/qtest/libqos/ahci.o libqos-usb-obj-y = $(libqos-spapr-obj-y) $(libqos-pc-obj-y) tests/qtest/libqos/usb.o # qos devices: -qos-test-obj-y = tests/qtest/qos-test.o $(libqgraph-obj-y) -qos-test-obj-y += $(libqos-pc-obj-y) $(libqos-spapr-obj-y) -qos-test-obj-y += tests/qtest/libqos/e1000e.o -qos-test-obj-y += tests/qtest/libqos/i2c.o -qos-test-obj-y += tests/qtest/libqos/i2c-imx.o -qos-test-obj-y += tests/qtest/libqos/i2c-omap.o -qos-test-obj-y += tests/qtest/libqos/sdhci.o -qos-test-obj-y += tests/qtest/libqos/tpci200.o -qos-test-obj-y += tests/qtest/libqos/virtio.o -qos-test-obj-$(CONFIG_VIRTFS) += tests/qtest/libqos/virtio-9p.o -qos-test-obj-y += tests/qtest/libqos/virtio-balloon.o -qos-test-obj-y += tests/qtest/libqos/virtio-blk.o -qos-test-obj-y += tests/qtest/libqos/virtio-mmio.o -qos-test-obj-y += tests/qtest/libqos/virtio-net.o -qos-test-obj-y += tests/qtest/libqos/virtio-pci.o -qos-test-obj-y += tests/qtest/libqos/virtio-pci-modern.o -qos-test-obj-y += tests/qtest/libqos/virtio-rng.o -qos-test-obj-y += tests/qtest/libqos/virtio-scsi.o -qos-test-obj-y += tests/qtest/libqos/virtio-serial.o +libqos-obj-y = $(libqgraph-obj-y) +libqos-obj-y += $(libqos-pc-obj-y) $(libqos-spapr-obj-y) +libqos-obj-y += tests/qtest/libqos/e1000e.o +libqos-obj-y += tests/qtest/libqos/i2c.o +libqos-obj-y += tests/qtest/libqos/i2c-imx.o +libqos-obj-y += tests/qtest/libqos/i2c-omap.o +libqos-obj-y += tests/qtest/libqos/sdhci.o +libqos-obj-y += tests/qtest/libqos/tpci200.o +libqos-obj-y += tests/qtest/libqos/virtio.o +libqos-obj-$(CONFIG_VIRTFS) += tests/qtest/libqos/virtio-9p.o +libqos-obj-y += tests/qtest/libqos/virtio-balloon.o +libqos-obj-y += tests/qtest/libqos/virtio-blk.o +libqos-obj-y += tests/qtest/libqos/virtio-mmio.o +libqos-obj-y += tests/qtest/libqos/virtio-net.o +libqos-obj-y += tests/qtest/libqos/virtio-pci.o +libqos-obj-y += tests/qtest/libqos/virtio-pci-modern.o +libqos-obj-y += tests/qtest/libqos/virtio-rng.o +libqos-obj-y += tests/qtest/libqos/virtio-scsi.o +libqos-obj-y += tests/qtest/libqos/virtio-serial.o # qos machines: -qos-test-obj-y += tests/qtest/libqos/aarch64-xlnx-zcu102-machine.o -qos-test-obj-y += tests/qtest/libqos/arm-imx25-pdk-machine.o -qos-test-obj-y += tests/qtest/libqos/arm-n800-machine.o -qos-test-obj-y += tests/qtest/libqos/arm-raspi2-machine.o -qos-test-obj-y += tests/qtest/libqos/arm-sabrelite-machine.o -qos-test-obj-y += tests/qtest/libqos/arm-smdkc210-machine.o -qos-test-obj-y += tests/qtest/libqos/arm-virt-machine.o -qos-test-obj-y += tests/qtest/libqos/arm-xilinx-zynq-a9-machine.o -qos-test-obj-y += tests/qtest/libqos/ppc64_pseries-machine.o -qos-test-obj-y += tests/qtest/libqos/x86_64_pc-machine.o +libqos-obj-y += tests/qtest/libqos/aarch64-xlnx-zcu102-machine.o +libqos-obj-y += tests/qtest/libqos/arm-imx25-pdk-machine.o +libqos-obj-y += tests/qtest/libqos/arm-n800-machine.o +libqos-obj-y += tests/qtest/libqos/arm-raspi2-machine.o +libqos-obj-y += tests/qtest/libqos/arm-sabrelite-machine.o +libqos-obj-y += tests/qtest/libqos/arm-smdkc210-machine.o +libqos-obj-y += tests/qtest/libqos/arm-virt-machine.o +libqos-obj-y += tests/qtest/libqos/arm-xilinx-zynq-a9-machine.o +libqos-obj-y += tests/qtest/libqos/ppc64_pseries-machine.o +libqos-obj-y += tests/qtest/libqos/x86_64_pc-machine.o # qos tests: +qos-test-obj-y += tests/qtest/qos-test.o qos-test-obj-y += tests/qtest/ac97-test.o qos-test-obj-y += tests/qtest/ds1338-test.o qos-test-obj-y += tests/qtest/e1000-test.o @@ -XXX,XX +XXX,XX @@ check-unit-y += tests/test-qgraph$(EXESUF) tests/test-qgraph$(EXESUF): tests/test-qgraph.o $(libqgraph-obj-y) check-qtest-generic-y += qos-test -tests/qtest/qos-test$(EXESUF): $(qos-test-obj-y) +tests/qtest/qos-test$(EXESUF): $(qos-test-obj-y) $(libqos-obj-y) # QTest dependencies: tests/qtest/qmp-test$(EXESUF): tests/qtest/qmp-test.o -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> The moved functions are not specific to qos-test and might be useful elsewhere. For example the virtual-device fuzzer makes use of them for qos-assisted fuzz-targets. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-12-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- tests/qtest/Makefile.include | 1 + tests/qtest/libqos/qos_external.c | 168 ++++++++++++++++++++++++++++++ tests/qtest/libqos/qos_external.h | 28 +++++ tests/qtest/qos-test.c | 132 +---------------------- 4 files changed, 198 insertions(+), 131 deletions(-) create mode 100644 tests/qtest/libqos/qos_external.c create mode 100644 tests/qtest/libqos/qos_external.h diff --git a/tests/qtest/Makefile.include b/tests/qtest/Makefile.include index XXXXXXX..XXXXXXX 100644 --- a/tests/qtest/Makefile.include +++ b/tests/qtest/Makefile.include @@ -XXX,XX +XXX,XX @@ libqos-usb-obj-y = $(libqos-spapr-obj-y) $(libqos-pc-obj-y) tests/qtest/libqos/u # qos devices: libqos-obj-y = $(libqgraph-obj-y) libqos-obj-y += $(libqos-pc-obj-y) $(libqos-spapr-obj-y) +libqos-obj-y += tests/qtest/libqos/qos_external.o libqos-obj-y += tests/qtest/libqos/e1000e.o libqos-obj-y += tests/qtest/libqos/i2c.o libqos-obj-y += tests/qtest/libqos/i2c-imx.o diff --git a/tests/qtest/libqos/qos_external.c b/tests/qtest/libqos/qos_external.c new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/tests/qtest/libqos/qos_external.c @@ -XXX,XX +XXX,XX @@ +/* + * libqos driver framework + * + * Copyright (c) 2018 Emanuele Giuseppe Esposito <e.emanuelegiuseppe@gmail.com> + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License version 2 as published by the Free Software Foundation. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, see <http://www.gnu.org/licenses/> + */ + +#include "qemu/osdep.h" +#include <getopt.h> +#include "libqtest.h" +#include "qapi/qmp/qdict.h" +#include "qapi/qmp/qbool.h" +#include "qapi/qmp/qstring.h" +#include "qemu/module.h" +#include "qapi/qmp/qlist.h" +#include "libqos/malloc.h" +#include "libqos/qgraph.h" +#include "libqos/qgraph_internal.h" +#include "libqos/qos_external.h" + + + +void apply_to_node(const char *name, bool is_machine, bool is_abstract) +{ + char *machine_name = NULL; + if (is_machine) { + const char *arch = qtest_get_arch(); + machine_name = g_strconcat(arch, "/", name, NULL); + name = machine_name; + } + qos_graph_node_set_availability(name, true); + if (is_abstract) { + qos_delete_cmd_line(name); + } + g_free(machine_name); +} + +/** + * apply_to_qlist(): using QMP queries QEMU for a list of + * machines and devices available, and sets the respective node + * as true. If a node is found, also all its produced and contained + * child are marked available. + * + * See qos_graph_node_set_availability() for more info + */ +void apply_to_qlist(QList *list, bool is_machine) +{ + const QListEntry *p; + const char *name; + bool abstract; + QDict *minfo; + QObject *qobj; + QString *qstr; + QBool *qbool; + + for (p = qlist_first(list); p; p = qlist_next(p)) { + minfo = qobject_to(QDict, qlist_entry_obj(p)); + qobj = qdict_get(minfo, "name"); + qstr = qobject_to(QString, qobj); + name = qstring_get_str(qstr); + + qobj = qdict_get(minfo, "abstract"); + if (qobj) { + qbool = qobject_to(QBool, qobj); + abstract = qbool_get_bool(qbool); + } else { + abstract = false; + } + + apply_to_node(name, is_machine, abstract); + qobj = qdict_get(minfo, "alias"); + if (qobj) { + qstr = qobject_to(QString, qobj); + name = qstring_get_str(qstr); + apply_to_node(name, is_machine, abstract); + } + } +} + +QGuestAllocator *get_machine_allocator(QOSGraphObject *obj) +{ + return obj->get_driver(obj, "memory"); +} + +/** + * allocate_objects(): given an array of nodes @arg, + * walks the path invoking all constructors and + * passing the corresponding parameter in order to + * continue the objects allocation. + * Once the test is reached, return the object it consumes. + * + * Since the machine and QEDGE_CONSUMED_BY nodes allocate + * memory in the constructor, g_test_queue_destroy is used so + * that after execution they can be safely free'd. (The test's + * ->before callback is also welcome to use g_test_queue_destroy). + * + * Note: as specified in walk_path() too, @arg is an array of + * char *, where arg[0] is a pointer to the command line + * string that will be used to properly start QEMU when executing + * the test, and the remaining elements represent the actual objects + * that will be allocated. + */ +void *allocate_objects(QTestState *qts, char **path, QGuestAllocator **p_alloc) +{ + int current = 0; + QGuestAllocator *alloc; + QOSGraphObject *parent = NULL; + QOSGraphEdge *edge; + QOSGraphNode *node; + void *edge_arg; + void *obj; + + node = qos_graph_get_node(path[current]); + g_assert(node->type == QNODE_MACHINE); + + obj = qos_machine_new(node, qts); + qos_object_queue_destroy(obj); + + alloc = get_machine_allocator(obj); + if (p_alloc) { + *p_alloc = alloc; + } + + for (;;) { + if (node->type != QNODE_INTERFACE) { + qos_object_start_hw(obj); + parent = obj; + } + + /* follow edge and get object for next node constructor */ + current++; + edge = qos_graph_get_edge(path[current - 1], path[current]); + node = qos_graph_get_node(path[current]); + + if (node->type == QNODE_TEST) { + g_assert(qos_graph_edge_get_type(edge) == QEDGE_CONSUMED_BY); + return obj; + } + + switch (qos_graph_edge_get_type(edge)) { + case QEDGE_PRODUCES: + obj = parent->get_driver(parent, path[current]); + break; + + case QEDGE_CONSUMED_BY: + edge_arg = qos_graph_edge_get_arg(edge); + obj = qos_driver_new(node, obj, alloc, edge_arg); + qos_object_queue_destroy(obj); + break; + + case QEDGE_CONTAINS: + obj = parent->get_device(parent, path[current]); + break; + } + } +} + diff --git a/tests/qtest/libqos/qos_external.h b/tests/qtest/libqos/qos_external.h new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/tests/qtest/libqos/qos_external.h @@ -XXX,XX +XXX,XX @@ +/* + * libqos driver framework + * + * Copyright (c) 2018 Emanuele Giuseppe Esposito <e.emanuelegiuseppe@gmail.com> + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License version 2 as published by the Free Software Foundation. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, see <http://www.gnu.org/licenses/> + */ + +#ifndef QOS_EXTERNAL_H +#define QOS_EXTERNAL_H +#include "libqos/qgraph.h" + +void apply_to_node(const char *name, bool is_machine, bool is_abstract); +void apply_to_qlist(QList *list, bool is_machine); +QGuestAllocator *get_machine_allocator(QOSGraphObject *obj); +void *allocate_objects(QTestState *qts, char **path, QGuestAllocator **p_alloc); + +#endif diff --git a/tests/qtest/qos-test.c b/tests/qtest/qos-test.c index XXXXXXX..XXXXXXX 100644 --- a/tests/qtest/qos-test.c +++ b/tests/qtest/qos-test.c @@ -XXX,XX +XXX,XX @@ #include "libqos/malloc.h" #include "libqos/qgraph.h" #include "libqos/qgraph_internal.h" +#include "libqos/qos_external.h" static char *old_path; -static void apply_to_node(const char *name, bool is_machine, bool is_abstract) -{ - char *machine_name = NULL; - if (is_machine) { - const char *arch = qtest_get_arch(); - machine_name = g_strconcat(arch, "/", name, NULL); - name = machine_name; - } - qos_graph_node_set_availability(name, true); - if (is_abstract) { - qos_delete_cmd_line(name); - } - g_free(machine_name); -} -/** - * apply_to_qlist(): using QMP queries QEMU for a list of - * machines and devices available, and sets the respective node - * as true. If a node is found, also all its produced and contained - * child are marked available. - * - * See qos_graph_node_set_availability() for more info - */ -static void apply_to_qlist(QList *list, bool is_machine) -{ - const QListEntry *p; - const char *name; - bool abstract; - QDict *minfo; - QObject *qobj; - QString *qstr; - QBool *qbool; - - for (p = qlist_first(list); p; p = qlist_next(p)) { - minfo = qobject_to(QDict, qlist_entry_obj(p)); - qobj = qdict_get(minfo, "name"); - qstr = qobject_to(QString, qobj); - name = qstring_get_str(qstr); - - qobj = qdict_get(minfo, "abstract"); - if (qobj) { - qbool = qobject_to(QBool, qobj); - abstract = qbool_get_bool(qbool); - } else { - abstract = false; - } - - apply_to_node(name, is_machine, abstract); - qobj = qdict_get(minfo, "alias"); - if (qobj) { - qstr = qobject_to(QString, qobj); - name = qstring_get_str(qstr); - apply_to_node(name, is_machine, abstract); - } - } -} /** * qos_set_machines_devices_available(): sets availability of qgraph @@ -XXX,XX +XXX,XX @@ static void qos_set_machines_devices_available(void) qobject_unref(response); } -static QGuestAllocator *get_machine_allocator(QOSGraphObject *obj) -{ - return obj->get_driver(obj, "memory"); -} static void restart_qemu_or_continue(char *path) { @@ -XXX,XX +XXX,XX @@ void qos_invalidate_command_line(void) old_path = NULL; } -/** - * allocate_objects(): given an array of nodes @arg, - * walks the path invoking all constructors and - * passing the corresponding parameter in order to - * continue the objects allocation. - * Once the test is reached, return the object it consumes. - * - * Since the machine and QEDGE_CONSUMED_BY nodes allocate - * memory in the constructor, g_test_queue_destroy is used so - * that after execution they can be safely free'd. (The test's - * ->before callback is also welcome to use g_test_queue_destroy). - * - * Note: as specified in walk_path() too, @arg is an array of - * char *, where arg[0] is a pointer to the command line - * string that will be used to properly start QEMU when executing - * the test, and the remaining elements represent the actual objects - * that will be allocated. - */ -static void *allocate_objects(QTestState *qts, char **path, QGuestAllocator **p_alloc) -{ - int current = 0; - QGuestAllocator *alloc; - QOSGraphObject *parent = NULL; - QOSGraphEdge *edge; - QOSGraphNode *node; - void *edge_arg; - void *obj; - - node = qos_graph_get_node(path[current]); - g_assert(node->type == QNODE_MACHINE); - - obj = qos_machine_new(node, qts); - qos_object_queue_destroy(obj); - - alloc = get_machine_allocator(obj); - if (p_alloc) { - *p_alloc = alloc; - } - - for (;;) { - if (node->type != QNODE_INTERFACE) { - qos_object_start_hw(obj); - parent = obj; - } - - /* follow edge and get object for next node constructor */ - current++; - edge = qos_graph_get_edge(path[current - 1], path[current]); - node = qos_graph_get_node(path[current]); - - if (node->type == QNODE_TEST) { - g_assert(qos_graph_edge_get_type(edge) == QEDGE_CONSUMED_BY); - return obj; - } - - switch (qos_graph_edge_get_type(edge)) { - case QEDGE_PRODUCES: - obj = parent->get_driver(parent, path[current]); - break; - - case QEDGE_CONSUMED_BY: - edge_arg = qos_graph_edge_get_arg(edge); - obj = qos_driver_new(node, obj, alloc, edge_arg); - qos_object_queue_destroy(obj); - break; - - case QEDGE_CONTAINS: - obj = parent->get_device(parent, path[current]); - break; - } - } -} /* The argument to run_one_test, which is the test function that is registered * with GTest, is a vector of strings. The first item is the initial command -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> tests/fuzz/fuzz.c serves as the entry point for the virtual-device fuzzer. Namely, libfuzzer invokes the LLVMFuzzerInitialize and LLVMFuzzerTestOneInput functions, both of which are defined in this file. This change adds a "FuzzTarget" struct, along with the fuzz_add_target function, which should be used to define new fuzz targets. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-13-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- MAINTAINERS | 8 ++ tests/qtest/fuzz/Makefile.include | 6 + tests/qtest/fuzz/fuzz.c | 179 ++++++++++++++++++++++++++++++ tests/qtest/fuzz/fuzz.h | 95 ++++++++++++++++ 4 files changed, 288 insertions(+) create mode 100644 tests/qtest/fuzz/Makefile.include create mode 100644 tests/qtest/fuzz/fuzz.c create mode 100644 tests/qtest/fuzz/fuzz.h diff --git a/MAINTAINERS b/MAINTAINERS index XXXXXXX..XXXXXXX 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -XXX,XX +XXX,XX @@ F: qtest.c F: accel/qtest.c F: tests/qtest/ +Device Fuzzing +M: Alexander Bulekov <alxndr@bu.edu> +R: Paolo Bonzini <pbonzini@redhat.com> +R: Bandan Das <bsd@redhat.com> +R: Stefan Hajnoczi <stefanha@redhat.com> +S: Maintained +F: tests/qtest/fuzz/ + Register API M: Alistair Francis <alistair@alistair23.me> S: Maintained diff --git a/tests/qtest/fuzz/Makefile.include b/tests/qtest/fuzz/Makefile.include new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/tests/qtest/fuzz/Makefile.include @@ -XXX,XX +XXX,XX @@ +QEMU_PROG_FUZZ=qemu-fuzz-$(TARGET_NAME)$(EXESUF) + +fuzz-obj-y += tests/qtest/libqtest.o +fuzz-obj-y += tests/qtest/fuzz/fuzz.o # Fuzzer skeleton + +FUZZ_CFLAGS += -I$(SRC_PATH)/tests -I$(SRC_PATH)/tests/qtest diff --git a/tests/qtest/fuzz/fuzz.c b/tests/qtest/fuzz/fuzz.c new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/tests/qtest/fuzz/fuzz.c @@ -XXX,XX +XXX,XX @@ +/* + * fuzzing driver + * + * Copyright Red Hat Inc., 2019 + * + * Authors: + * Alexander Bulekov <alxndr@bu.edu> + * + * This work is licensed under the terms of the GNU GPL, version 2 or later. + * See the COPYING file in the top-level directory. + * + */ + +#include "qemu/osdep.h" + +#include <wordexp.h> + +#include "sysemu/qtest.h" +#include "sysemu/runstate.h" +#include "sysemu/sysemu.h" +#include "qemu/main-loop.h" +#include "tests/qtest/libqtest.h" +#include "tests/qtest/libqos/qgraph.h" +#include "fuzz.h" + +#define MAX_EVENT_LOOPS 10 + +typedef struct FuzzTargetState { + FuzzTarget *target; + QSLIST_ENTRY(FuzzTargetState) target_list; +} FuzzTargetState; + +typedef QSLIST_HEAD(, FuzzTargetState) FuzzTargetList; + +static const char *fuzz_arch = TARGET_NAME; + +static FuzzTargetList *fuzz_target_list; +static FuzzTarget *fuzz_target; +static QTestState *fuzz_qts; + + + +void flush_events(QTestState *s) +{ + int i = MAX_EVENT_LOOPS; + while (g_main_context_pending(NULL) && i-- > 0) { + main_loop_wait(false); + } +} + +static QTestState *qtest_setup(void) +{ + qtest_server_set_send_handler(&qtest_client_inproc_recv, &fuzz_qts); + return qtest_inproc_init(&fuzz_qts, false, fuzz_arch, + &qtest_server_inproc_recv); +} + +void fuzz_add_target(const FuzzTarget *target) +{ + FuzzTargetState *tmp; + FuzzTargetState *target_state; + if (!fuzz_target_list) { + fuzz_target_list = g_new0(FuzzTargetList, 1); + } + + QSLIST_FOREACH(tmp, fuzz_target_list, target_list) { + if (g_strcmp0(tmp->target->name, target->name) == 0) { + fprintf(stderr, "Error: Fuzz target name %s already in use\n", + target->name); + abort(); + } + } + target_state = g_new0(FuzzTargetState, 1); + target_state->target = g_new0(FuzzTarget, 1); + *(target_state->target) = *target; + QSLIST_INSERT_HEAD(fuzz_target_list, target_state, target_list); +} + + + +static void usage(char *path) +{ + printf("Usage: %s --fuzz-target=FUZZ_TARGET [LIBFUZZER ARGUMENTS]\n", path); + printf("where FUZZ_TARGET is one of:\n"); + FuzzTargetState *tmp; + if (!fuzz_target_list) { + fprintf(stderr, "Fuzz target list not initialized\n"); + abort(); + } + QSLIST_FOREACH(tmp, fuzz_target_list, target_list) { + printf(" * %s : %s\n", tmp->target->name, + tmp->target->description); + } + exit(0); +} + +static FuzzTarget *fuzz_get_target(char* name) +{ + FuzzTargetState *tmp; + if (!fuzz_target_list) { + fprintf(stderr, "Fuzz target list not initialized\n"); + abort(); + } + + QSLIST_FOREACH(tmp, fuzz_target_list, target_list) { + if (strcmp(tmp->target->name, name) == 0) { + return tmp->target; + } + } + return NULL; +} + + +/* Executed for each fuzzing-input */ +int LLVMFuzzerTestOneInput(const unsigned char *Data, size_t Size) +{ + /* + * Do the pre-fuzz-initialization before the first fuzzing iteration, + * instead of before the actual fuzz loop. This is needed since libfuzzer + * may fork off additional workers, prior to the fuzzing loop, and if + * pre_fuzz() sets up e.g. shared memory, this should be done for the + * individual worker processes + */ + static int pre_fuzz_done; + if (!pre_fuzz_done && fuzz_target->pre_fuzz) { + fuzz_target->pre_fuzz(fuzz_qts); + pre_fuzz_done = true; + } + + fuzz_target->fuzz(fuzz_qts, Data, Size); + return 0; +} + +/* Executed once, prior to fuzzing */ +int LLVMFuzzerInitialize(int *argc, char ***argv, char ***envp) +{ + + char *target_name; + + /* Initialize qgraph and modules */ + qos_graph_init(); + module_call_init(MODULE_INIT_FUZZ_TARGET); + module_call_init(MODULE_INIT_QOM); + module_call_init(MODULE_INIT_LIBQOS); + + if (*argc <= 1) { + usage(**argv); + } + + /* Identify the fuzz target */ + target_name = (*argv)[1]; + if (!strstr(target_name, "--fuzz-target=")) { + usage(**argv); + } + + target_name += strlen("--fuzz-target="); + + fuzz_target = fuzz_get_target(target_name); + if (!fuzz_target) { + usage(**argv); + } + + fuzz_qts = qtest_setup(); + + if (fuzz_target->pre_vm_init) { + fuzz_target->pre_vm_init(); + } + + /* Run QEMU's softmmu main with the fuzz-target dependent arguments */ + const char *init_cmdline = fuzz_target->get_init_cmdline(fuzz_target); + + /* Split the runcmd into an argv and argc */ + wordexp_t result; + wordexp(init_cmdline, &result, 0); + + qemu_init(result.we_wordc, result.we_wordv, NULL); + + return 0; +} diff --git a/tests/qtest/fuzz/fuzz.h b/tests/qtest/fuzz/fuzz.h new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/tests/qtest/fuzz/fuzz.h @@ -XXX,XX +XXX,XX @@ +/* + * fuzzing driver + * + * Copyright Red Hat Inc., 2019 + * + * Authors: + * Alexander Bulekov <alxndr@bu.edu> + * + * This work is licensed under the terms of the GNU GPL, version 2 or later. + * See the COPYING file in the top-level directory. + * + */ + +#ifndef FUZZER_H_ +#define FUZZER_H_ + +#include "qemu/osdep.h" +#include "qemu/units.h" +#include "qapi/error.h" + +#include "tests/qtest/libqtest.h" + +/** + * A libfuzzer fuzzing target + * + * The QEMU fuzzing binary is built with all available targets, each + * with a unique @name that can be specified on the command-line to + * select which target should run. + * + * A target must implement ->fuzz() to process a random input. If QEMU + * crashes in ->fuzz() then libfuzzer will record a failure. + * + * Fuzzing targets are registered with fuzz_add_target(): + * + * static const FuzzTarget fuzz_target = { + * .name = "my-device-fifo", + * .description = "Fuzz the FIFO buffer registers of my-device", + * ... + * }; + * + * static void register_fuzz_target(void) + * { + * fuzz_add_target(&fuzz_target); + * } + * fuzz_target_init(register_fuzz_target); + */ +typedef struct FuzzTarget { + const char *name; /* target identifier (passed to --fuzz-target=)*/ + const char *description; /* help text */ + + + /* + * returns the arg-list that is passed to qemu/softmmu init() + * Cannot be NULL + */ + const char* (*get_init_cmdline)(struct FuzzTarget *); + + /* + * will run once, prior to running qemu/softmmu init. + * eg: set up shared-memory for communication with the child-process + * Can be NULL + */ + void(*pre_vm_init)(void); + + /* + * will run once, after QEMU has been initialized, prior to the fuzz-loop. + * eg: detect the memory map + * Can be NULL + */ + void(*pre_fuzz)(QTestState *); + + /* + * accepts and executes an input from libfuzzer. this is repeatedly + * executed during the fuzzing loop. Its should handle setup, input + * execution and cleanup. + * Cannot be NULL + */ + void(*fuzz)(QTestState *, const unsigned char *, size_t); + +} FuzzTarget; + +void flush_events(QTestState *); +void reboot(QTestState *); + +/* + * makes a copy of *target and adds it to the target-list. + * i.e. fine to set up target on the caller's stack + */ +void fuzz_add_target(const FuzzTarget *target); + +int LLVMFuzzerTestOneInput(const unsigned char *Data, size_t Size); +int LLVMFuzzerInitialize(int *argc, char ***argv, char ***envp); + +#endif + -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> Ram blocks were marked MADV_DONTFORK breaking fuzzing-tests which execute each test-input in a forked process. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-14-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- exec.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/exec.c b/exec.c index XXXXXXX..XXXXXXX 100644 --- a/exec.c +++ b/exec.c @@ -XXX,XX +XXX,XX @@ #include "sysemu/kvm.h" #include "sysemu/sysemu.h" #include "sysemu/tcg.h" +#include "sysemu/qtest.h" #include "qemu/timer.h" #include "qemu/config-file.h" #include "qemu/error-report.h" @@ -XXX,XX +XXX,XX @@ static void ram_block_add(RAMBlock *new_block, Error **errp, bool shared) if (new_block->host) { qemu_ram_setup_dump(new_block->host, new_block->max_length); qemu_madvise(new_block->host, new_block->max_length, QEMU_MADV_HUGEPAGE); - /* MADV_DONTFORK is also needed by KVM in absence of synchronous MMU */ - qemu_madvise(new_block->host, new_block->max_length, QEMU_MADV_DONTFORK); + /* + * MADV_DONTFORK is also needed by KVM in absence of synchronous MMU + * Configure it unless the machine is a qtest server, in which case + * KVM is not used and it may be forked (eg for fuzzing purposes). + */ + if (!qtest_enabled()) { + qemu_madvise(new_block->host, new_block->max_length, + QEMU_MADV_DONTFORK); + } ram_block_notify_add(new_block->host, new_block->max_length); } } -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> The qtest-based fuzzer makes use of forking to reset-state between tests. Keep the callback enabled, so the call_rcu thread gets created within the child process. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Acked-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20200220041118.23264-15-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- softmmu/vl.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/softmmu/vl.c b/softmmu/vl.c index XXXXXXX..XXXXXXX 100644 --- a/softmmu/vl.c +++ b/softmmu/vl.c @@ -XXX,XX +XXX,XX @@ void qemu_init(int argc, char **argv, char **envp) set_memory_options(&ram_slots, &maxram_size, machine_class); os_daemonize(); - rcu_disable_atfork(); + + /* + * If QTest is enabled, keep the rcu_atfork enabled, since system processes + * may be forked testing purposes (e.g. fork-server based fuzzing) The fork + * should happen before a signle cpu instruction is executed, to prevent + * deadlocks. See commit 73c6e40, rcu: "completely disable pthread_atfork + * callbacks as soon as possible" + */ + if (!qtest_enabled()) { + rcu_disable_atfork(); + } if (pid_file && !qemu_write_pidfile(pid_file, &err)) { error_reportf_err(err, "cannot create PID file: "); -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> fork() is a simple way to ensure that state does not leak in between fuzzing runs. Unfortunately, the fuzzer mutation engine relies on bitmaps which contain coverage information for each fuzzing run, and these bitmaps should be copied from the child to the parent(where the mutation occurs). These bitmaps are created through compile-time instrumentation and they are not shared with fork()-ed processes, by default. To address this, we create a shared memory region, adjust its size and map it _over_ the counter region. Furthermore, libfuzzer doesn't generally expose the globals that specify the location of the counters/coverage bitmap. As a workaround, we rely on a custom linker script which forces all of the bitmaps we care about to be placed in a contiguous region, which is easy to locate and mmap over. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-16-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- tests/qtest/fuzz/Makefile.include | 5 +++ tests/qtest/fuzz/fork_fuzz.c | 55 +++++++++++++++++++++++++++++++ tests/qtest/fuzz/fork_fuzz.h | 23 +++++++++++++ tests/qtest/fuzz/fork_fuzz.ld | 37 +++++++++++++++++++++ 4 files changed, 120 insertions(+) create mode 100644 tests/qtest/fuzz/fork_fuzz.c create mode 100644 tests/qtest/fuzz/fork_fuzz.h create mode 100644 tests/qtest/fuzz/fork_fuzz.ld diff --git a/tests/qtest/fuzz/Makefile.include b/tests/qtest/fuzz/Makefile.include index XXXXXXX..XXXXXXX 100644 --- a/tests/qtest/fuzz/Makefile.include +++ b/tests/qtest/fuzz/Makefile.include @@ -XXX,XX +XXX,XX @@ QEMU_PROG_FUZZ=qemu-fuzz-$(TARGET_NAME)$(EXESUF) fuzz-obj-y += tests/qtest/libqtest.o fuzz-obj-y += tests/qtest/fuzz/fuzz.o # Fuzzer skeleton +fuzz-obj-y += tests/qtest/fuzz/fork_fuzz.o FUZZ_CFLAGS += -I$(SRC_PATH)/tests -I$(SRC_PATH)/tests/qtest + +# Linker Script to force coverage-counters into known regions which we can mark +# shared +FUZZ_LDFLAGS += -Xlinker -T$(SRC_PATH)/tests/qtest/fuzz/fork_fuzz.ld diff --git a/tests/qtest/fuzz/fork_fuzz.c b/tests/qtest/fuzz/fork_fuzz.c new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/tests/qtest/fuzz/fork_fuzz.c @@ -XXX,XX +XXX,XX @@ +/* + * Fork-based fuzzing helpers + * + * Copyright Red Hat Inc., 2019 + * + * Authors: + * Alexander Bulekov <alxndr@bu.edu> + * + * This work is licensed under the terms of the GNU GPL, version 2 or later. + * See the COPYING file in the top-level directory. + * + */ + +#include "qemu/osdep.h" +#include "fork_fuzz.h" + + +void counter_shm_init(void) +{ + char *shm_path = g_strdup_printf("/qemu-fuzz-cntrs.%d", getpid()); + int fd = shm_open(shm_path, O_CREAT | O_RDWR, S_IRUSR | S_IWUSR); + g_free(shm_path); + + if (fd == -1) { + perror("Error: "); + exit(1); + } + if (ftruncate(fd, &__FUZZ_COUNTERS_END - &__FUZZ_COUNTERS_START) == -1) { + perror("Error: "); + exit(1); + } + /* Copy what's in the counter region to the shm.. */ + void *rptr = mmap(NULL , + &__FUZZ_COUNTERS_END - &__FUZZ_COUNTERS_START, + PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0); + memcpy(rptr, + &__FUZZ_COUNTERS_START, + &__FUZZ_COUNTERS_END - &__FUZZ_COUNTERS_START); + + munmap(rptr, &__FUZZ_COUNTERS_END - &__FUZZ_COUNTERS_START); + + /* And map the shm over the counter region */ + rptr = mmap(&__FUZZ_COUNTERS_START, + &__FUZZ_COUNTERS_END - &__FUZZ_COUNTERS_START, + PROT_READ | PROT_WRITE, MAP_SHARED | MAP_FIXED, fd, 0); + + close(fd); + + if (!rptr) { + perror("Error: "); + exit(1); + } +} + + diff --git a/tests/qtest/fuzz/fork_fuzz.h b/tests/qtest/fuzz/fork_fuzz.h new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/tests/qtest/fuzz/fork_fuzz.h @@ -XXX,XX +XXX,XX @@ +/* + * Fork-based fuzzing helpers + * + * Copyright Red Hat Inc., 2019 + * + * Authors: + * Alexander Bulekov <alxndr@bu.edu> + * + * This work is licensed under the terms of the GNU GPL, version 2 or later. + * See the COPYING file in the top-level directory. + * + */ + +#ifndef FORK_FUZZ_H +#define FORK_FUZZ_H + +extern uint8_t __FUZZ_COUNTERS_START; +extern uint8_t __FUZZ_COUNTERS_END; + +void counter_shm_init(void); + +#endif + diff --git a/tests/qtest/fuzz/fork_fuzz.ld b/tests/qtest/fuzz/fork_fuzz.ld new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/tests/qtest/fuzz/fork_fuzz.ld @@ -XXX,XX +XXX,XX @@ +/* We adjust linker script modification to place all of the stuff that needs to + * persist across fuzzing runs into a contiguous seciton of memory. Then, it is + * easy to re-map the counter-related memory as shared. +*/ + +SECTIONS +{ + .data.fuzz_start : ALIGN(4K) + { + __FUZZ_COUNTERS_START = .; + __start___sancov_cntrs = .; + *(_*sancov_cntrs); + __stop___sancov_cntrs = .; + + /* Lowest stack counter */ + *(__sancov_lowest_stack); + } + .data.fuzz_ordered : + { + /* Coverage counters. They're not necessary for fuzzing, but are useful + * for analyzing the fuzzing performance + */ + __start___llvm_prf_cnts = .; + *(*llvm_prf_cnts); + __stop___llvm_prf_cnts = .; + + /* Internal Libfuzzer TracePC object which contains the ValueProfileMap */ + FuzzerTracePC*(.bss*); + } + .data.fuzz_end : ALIGN(4K) + { + __FUZZ_COUNTERS_END = .; + } +} +/* Dont overwrite the SECTIONS in the default linker script. Instead insert the + * above into the default script */ +INSERT AFTER .data; -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-17-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- tests/qtest/fuzz/Makefile.include | 2 + tests/qtest/fuzz/qos_fuzz.c | 234 ++++++++++++++++++++++++++++++ tests/qtest/fuzz/qos_fuzz.h | 33 +++++ 3 files changed, 269 insertions(+) create mode 100644 tests/qtest/fuzz/qos_fuzz.c create mode 100644 tests/qtest/fuzz/qos_fuzz.h diff --git a/tests/qtest/fuzz/Makefile.include b/tests/qtest/fuzz/Makefile.include index XXXXXXX..XXXXXXX 100644 --- a/tests/qtest/fuzz/Makefile.include +++ b/tests/qtest/fuzz/Makefile.include @@ -XXX,XX +XXX,XX @@ QEMU_PROG_FUZZ=qemu-fuzz-$(TARGET_NAME)$(EXESUF) fuzz-obj-y += tests/qtest/libqtest.o +fuzz-obj-y += $(libqos-obj-y) fuzz-obj-y += tests/qtest/fuzz/fuzz.o # Fuzzer skeleton fuzz-obj-y += tests/qtest/fuzz/fork_fuzz.o +fuzz-obj-y += tests/qtest/fuzz/qos_fuzz.o FUZZ_CFLAGS += -I$(SRC_PATH)/tests -I$(SRC_PATH)/tests/qtest diff --git a/tests/qtest/fuzz/qos_fuzz.c b/tests/qtest/fuzz/qos_fuzz.c new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/tests/qtest/fuzz/qos_fuzz.c @@ -XXX,XX +XXX,XX @@ +/* + * QOS-assisted fuzzing helpers + * + * Copyright (c) 2018 Emanuele Giuseppe Esposito <e.emanuelegiuseppe@gmail.com> + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License version 2 as published by the Free Software Foundation. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, see <http://www.gnu.org/licenses/> + */ + +#include "qemu/osdep.h" +#include "qemu/units.h" +#include "qapi/error.h" +#include "qemu-common.h" +#include "exec/memory.h" +#include "exec/address-spaces.h" +#include "sysemu/sysemu.h" +#include "qemu/main-loop.h" + +#include "tests/qtest/libqtest.h" +#include "tests/qtest/libqos/malloc.h" +#include "tests/qtest/libqos/qgraph.h" +#include "tests/qtest/libqos/qgraph_internal.h" +#include "tests/qtest/libqos/qos_external.h" + +#include "fuzz.h" +#include "qos_fuzz.h" + +#include "qapi/qapi-commands-machine.h" +#include "qapi/qapi-commands-qom.h" +#include "qapi/qmp/qlist.h" + + +void *fuzz_qos_obj; +QGuestAllocator *fuzz_qos_alloc; + +static const char *fuzz_target_name; +static char **fuzz_path_vec; + +/* + * Replaced the qmp commands with direct qmp_marshal calls. + * Probably there is a better way to do this + */ +static void qos_set_machines_devices_available(void) +{ + QDict *req = qdict_new(); + QObject *response; + QDict *args = qdict_new(); + QList *lst; + Error *err = NULL; + + qmp_marshal_query_machines(NULL, &response, &err); + assert(!err); + lst = qobject_to(QList, response); + apply_to_qlist(lst, true); + + qobject_unref(response); + + + qdict_put_str(req, "execute", "qom-list-types"); + qdict_put_str(args, "implements", "device"); + qdict_put_bool(args, "abstract", true); + qdict_put_obj(req, "arguments", (QObject *) args); + + qmp_marshal_qom_list_types(args, &response, &err); + assert(!err); + lst = qobject_to(QList, response); + apply_to_qlist(lst, false); + qobject_unref(response); + qobject_unref(req); +} + +static char **current_path; + +void *qos_allocate_objects(QTestState *qts, QGuestAllocator **p_alloc) +{ + return allocate_objects(qts, current_path + 1, p_alloc); +} + +static const char *qos_build_main_args(void) +{ + char **path = fuzz_path_vec; + QOSGraphNode *test_node; + GString *cmd_line = g_string_new(path[0]); + void *test_arg; + + if (!path) { + fprintf(stderr, "QOS Path not found\n"); + abort(); + } + + /* Before test */ + current_path = path; + test_node = qos_graph_get_node(path[(g_strv_length(path) - 1)]); + test_arg = test_node->u.test.arg; + if (test_node->u.test.before) { + test_arg = test_node->u.test.before(cmd_line, test_arg); + } + /* Prepend the arguments that we need */ + g_string_prepend(cmd_line, + TARGET_NAME " -display none -machine accel=qtest -m 64 "); + return cmd_line->str; +} + +/* + * This function is largely a copy of qos-test.c:walk_path. Since walk_path + * is itself a callback, its a little annoying to add another argument/layer of + * indirection + */ +static void walk_path(QOSGraphNode *orig_path, int len) +{ + QOSGraphNode *path; + QOSGraphEdge *edge; + + /* etype set to QEDGE_CONSUMED_BY so that machine can add to the command line */ + QOSEdgeType etype = QEDGE_CONSUMED_BY; + + /* twice QOS_PATH_MAX_ELEMENT_SIZE since each edge can have its arg */ + char **path_vec = g_new0(char *, (QOS_PATH_MAX_ELEMENT_SIZE * 2)); + int path_vec_size = 0; + + char *after_cmd, *before_cmd, *after_device; + GString *after_device_str = g_string_new(""); + char *node_name = orig_path->name, *path_str; + + GString *cmd_line = g_string_new(""); + GString *cmd_line2 = g_string_new(""); + + path = qos_graph_get_node(node_name); /* root */ + node_name = qos_graph_edge_get_dest(path->path_edge); /* machine name */ + + path_vec[path_vec_size++] = node_name; + path_vec[path_vec_size++] = qos_get_machine_type(node_name); + + for (;;) { + path = qos_graph_get_node(node_name); + if (!path->path_edge) { + break; + } + + node_name = qos_graph_edge_get_dest(path->path_edge); + + /* append node command line + previous edge command line */ + if (path->command_line && etype == QEDGE_CONSUMED_BY) { + g_string_append(cmd_line, path->command_line); + g_string_append(cmd_line, after_device_str->str); + g_string_truncate(after_device_str, 0); + } + + path_vec[path_vec_size++] = qos_graph_edge_get_name(path->path_edge); + /* detect if edge has command line args */ + after_cmd = qos_graph_edge_get_after_cmd_line(path->path_edge); + after_device = qos_graph_edge_get_extra_device_opts(path->path_edge); + before_cmd = qos_graph_edge_get_before_cmd_line(path->path_edge); + edge = qos_graph_get_edge(path->name, node_name); + etype = qos_graph_edge_get_type(edge); + + if (before_cmd) { + g_string_append(cmd_line, before_cmd); + } + if (after_cmd) { + g_string_append(cmd_line2, after_cmd); + } + if (after_device) { + g_string_append(after_device_str, after_device); + } + } + + path_vec[path_vec_size++] = NULL; + g_string_append(cmd_line, after_device_str->str); + g_string_free(after_device_str, true); + + g_string_append(cmd_line, cmd_line2->str); + g_string_free(cmd_line2, true); + + /* + * here position 0 has <arch>/<machine>, position 1 has <machine>. + * The path must not have the <arch>, qtest_add_data_func adds it. + */ + path_str = g_strjoinv("/", path_vec + 1); + + /* Check that this is the test we care about: */ + char *test_name = strrchr(path_str, '/') + 1; + if (strcmp(test_name, fuzz_target_name) == 0) { + /* + * put arch/machine in position 1 so run_one_test can do its work + * and add the command line at position 0. + */ + path_vec[1] = path_vec[0]; + path_vec[0] = g_string_free(cmd_line, false); + + fuzz_path_vec = path_vec; + } else { + g_free(path_vec); + } + + g_free(path_str); +} + +static const char *qos_get_cmdline(FuzzTarget *t) +{ + /* + * Set a global variable that we use to identify the qos_path for our + * fuzz_target + */ + fuzz_target_name = t->name; + qos_set_machines_devices_available(); + qos_graph_foreach_test_path(walk_path); + return qos_build_main_args(); +} + +void fuzz_add_qos_target( + FuzzTarget *fuzz_opts, + const char *interface, + QOSGraphTestOptions *opts + ) +{ + qos_add_test(fuzz_opts->name, interface, NULL, opts); + fuzz_opts->get_init_cmdline = qos_get_cmdline; + fuzz_add_target(fuzz_opts); +} + +void qos_init_path(QTestState *s) +{ + fuzz_qos_obj = qos_allocate_objects(s , &fuzz_qos_alloc); +} diff --git a/tests/qtest/fuzz/qos_fuzz.h b/tests/qtest/fuzz/qos_fuzz.h new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/tests/qtest/fuzz/qos_fuzz.h @@ -XXX,XX +XXX,XX @@ +/* + * QOS-assisted fuzzing helpers + * + * Copyright Red Hat Inc., 2019 + * + * Authors: + * Alexander Bulekov <alxndr@bu.edu> + * + * This work is licensed under the terms of the GNU GPL, version 2 or later. + * See the COPYING file in the top-level directory. + */ + +#ifndef _QOS_FUZZ_H_ +#define _QOS_FUZZ_H_ + +#include "tests/qtest/fuzz/fuzz.h" +#include "tests/qtest/libqos/qgraph.h" + +int qos_fuzz(const unsigned char *Data, size_t Size); +void qos_setup(void); + +extern void *fuzz_qos_obj; +extern QGuestAllocator *fuzz_qos_alloc; + +void fuzz_add_qos_target( + FuzzTarget *fuzz_opts, + const char *interface, + QOSGraphTestOptions *opts + ); + +void qos_init_path(QTestState *); + +#endif -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20200220041118.23264-18-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- Makefile | 15 ++++++++++++++- Makefile.target | 16 ++++++++++++++++ 2 files changed, 30 insertions(+), 1 deletion(-) diff --git a/Makefile b/Makefile index XXXXXXX..XXXXXXX 100644 --- a/Makefile +++ b/Makefile @@ -XXX,XX +XXX,XX @@ config-host.h-timestamp: config-host.mak qemu-options.def: $(SRC_PATH)/qemu-options.hx $(SRC_PATH)/scripts/hxtool $(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -h < $< > $@,"GEN","$@") -TARGET_DIRS_RULES := $(foreach t, all clean install, $(addsuffix /$(t), $(TARGET_DIRS))) +TARGET_DIRS_RULES := $(foreach t, all fuzz clean install, $(addsuffix /$(t), $(TARGET_DIRS))) SOFTMMU_ALL_RULES=$(filter %-softmmu/all, $(TARGET_DIRS_RULES)) $(SOFTMMU_ALL_RULES): $(authz-obj-y) @@ -XXX,XX +XXX,XX @@ ifdef DECOMPRESS_EDK2_BLOBS $(SOFTMMU_ALL_RULES): $(edk2-decompressed) endif +SOFTMMU_FUZZ_RULES=$(filter %-softmmu/fuzz, $(TARGET_DIRS_RULES)) +$(SOFTMMU_FUZZ_RULES): $(authz-obj-y) +$(SOFTMMU_FUZZ_RULES): $(block-obj-y) +$(SOFTMMU_FUZZ_RULES): $(chardev-obj-y) +$(SOFTMMU_FUZZ_RULES): $(crypto-obj-y) +$(SOFTMMU_FUZZ_RULES): $(io-obj-y) +$(SOFTMMU_FUZZ_RULES): config-all-devices.mak +$(SOFTMMU_FUZZ_RULES): $(edk2-decompressed) + .PHONY: $(TARGET_DIRS_RULES) # The $(TARGET_DIRS_RULES) are of the form SUBDIR/GOAL, so that # $(dir $@) yields the sub-directory, and $(notdir $@) yields the sub-goal @@ -XXX,XX +XXX,XX @@ subdir-slirp: slirp/all $(filter %/all, $(TARGET_DIRS_RULES)): libqemuutil.a $(common-obj-y) \ $(qom-obj-y) +$(filter %/fuzz, $(TARGET_DIRS_RULES)): libqemuutil.a $(common-obj-y) \ + $(qom-obj-y) $(crypto-user-obj-$(CONFIG_USER_ONLY)) + ROM_DIRS = $(addprefix pc-bios/, $(ROMS)) ROM_DIRS_RULES=$(foreach t, all clean, $(addsuffix /$(t), $(ROM_DIRS))) # Only keep -O and -g cflags @@ -XXX,XX +XXX,XX @@ $(ROM_DIRS_RULES): .PHONY: recurse-all recurse-clean recurse-install recurse-all: $(addsuffix /all, $(TARGET_DIRS) $(ROM_DIRS)) +recurse-fuzz: $(addsuffix /fuzz, $(TARGET_DIRS) $(ROM_DIRS)) recurse-clean: $(addsuffix /clean, $(TARGET_DIRS) $(ROM_DIRS)) recurse-install: $(addsuffix /install, $(TARGET_DIRS)) $(addsuffix /install, $(TARGET_DIRS)): all diff --git a/Makefile.target b/Makefile.target index XXXXXXX..XXXXXXX 100644 --- a/Makefile.target +++ b/Makefile.target @@ -XXX,XX +XXX,XX @@ ifdef CONFIG_TRACE_SYSTEMTAP rm -f *.stp endif +ifdef CONFIG_FUZZ +include $(SRC_PATH)/tests/qtest/fuzz/Makefile.include +include $(SRC_PATH)/tests/qtest/Makefile.include + +fuzz: fuzz-vars +fuzz-vars: QEMU_CFLAGS := $(FUZZ_CFLAGS) $(QEMU_CFLAGS) +fuzz-vars: QEMU_LDFLAGS := $(FUZZ_LDFLAGS) $(QEMU_LDFLAGS) +fuzz-vars: $(QEMU_PROG_FUZZ) +dummy := $(call unnest-vars,, fuzz-obj-y) + + +$(QEMU_PROG_FUZZ): config-devices.mak $(all-obj-y) $(COMMON_LDADDS) $(fuzz-obj-y) + $(call LINK, $(filter-out %.mak, $^)) + +endif + install: all ifneq ($(PROGS),) $(call install-prog,$(PROGS),$(DESTDIR)$(bindir)) -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-19-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- configure | 39 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) diff --git a/configure b/configure index XXXXXXX..XXXXXXX 100755 --- a/configure +++ b/configure @@ -XXX,XX +XXX,XX @@ debug_mutex="no" libpmem="" default_devices="yes" plugins="no" +fuzzing="no" supported_cpu="no" supported_os="no" @@ -XXX,XX +XXX,XX @@ int main(void) { return 0; } EOF } +write_c_fuzzer_skeleton() { + cat > $TMPC <<EOF +#include <stdint.h> +#include <sys/types.h> +int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size); +int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { return 0; } +EOF +} + if check_define __linux__ ; then targetos="Linux" elif check_define _WIN32 ; then @@ -XXX,XX +XXX,XX @@ for opt do ;; --disable-containers) use_containers="no" ;; + --enable-fuzzing) fuzzing=yes + ;; + --disable-fuzzing) fuzzing=no + ;; *) echo "ERROR: unknown option $opt" echo "Try '$0 --help' for more information" @@ -XXX,XX +XXX,XX @@ EOF fi fi +########################################## +# checks for fuzzer +if test "$fuzzing" = "yes" ; then + write_c_fuzzer_skeleton + if compile_prog "$CPU_CFLAGS -Werror -fsanitize=address,fuzzer" ""; then + have_fuzzer=yes + fi +fi + ########################################## # check for libpmem @@ -XXX,XX +XXX,XX @@ echo "libpmem support $libpmem" echo "libudev $libudev" echo "default devices $default_devices" echo "plugin support $plugins" +echo "fuzzing support $fuzzing" if test "$supported_cpu" = "no"; then echo @@ -XXX,XX +XXX,XX @@ fi if test "$sheepdog" = "yes" ; then echo "CONFIG_SHEEPDOG=y" >> $config_host_mak fi +if test "$fuzzing" = "yes" ; then + if test "$have_fuzzer" = "yes"; then + FUZZ_LDFLAGS=" -fsanitize=address,fuzzer" + FUZZ_CFLAGS=" -fsanitize=address,fuzzer" + CFLAGS=" -fsanitize=address,fuzzer-no-link" + else + error_exit "Your compiler doesn't support -fsanitize=address,fuzzer" + exit 1 + fi +fi if test "$plugins" = "yes" ; then echo "CONFIG_PLUGIN=y" >> $config_host_mak @@ -XXX,XX +XXX,XX @@ if test "$libudev" != "no"; then echo "CONFIG_LIBUDEV=y" >> $config_host_mak echo "LIBUDEV_LIBS=$libudev_libs" >> $config_host_mak fi +if test "$fuzzing" != "no"; then + echo "CONFIG_FUZZ=y" >> $config_host_mak + echo "FUZZ_CFLAGS=$FUZZ_CFLAGS" >> $config_host_mak + echo "FUZZ_LDFLAGS=$FUZZ_LDFLAGS" >> $config_host_mak +fi if test "$edk2_blobs" = "yes" ; then echo "DECOMPRESS_EDK2_BLOBS=y" >> $config_host_mak -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> These three targets should simply fuzz reads/writes to a couple ioports, but they mostly serve as examples of different ways to write targets. They demonstrate using qtest and qos for fuzzing, as well as using rebooting and forking to reset state, or not resetting it at all. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-20-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- tests/qtest/fuzz/Makefile.include | 3 + tests/qtest/fuzz/i440fx_fuzz.c | 193 ++++++++++++++++++++++++++++++ 2 files changed, 196 insertions(+) create mode 100644 tests/qtest/fuzz/i440fx_fuzz.c diff --git a/tests/qtest/fuzz/Makefile.include b/tests/qtest/fuzz/Makefile.include index XXXXXXX..XXXXXXX 100644 --- a/tests/qtest/fuzz/Makefile.include +++ b/tests/qtest/fuzz/Makefile.include @@ -XXX,XX +XXX,XX @@ fuzz-obj-y += tests/qtest/fuzz/fuzz.o # Fuzzer skeleton fuzz-obj-y += tests/qtest/fuzz/fork_fuzz.o fuzz-obj-y += tests/qtest/fuzz/qos_fuzz.o +# Targets +fuzz-obj-y += tests/qtest/fuzz/i440fx_fuzz.o + FUZZ_CFLAGS += -I$(SRC_PATH)/tests -I$(SRC_PATH)/tests/qtest # Linker Script to force coverage-counters into known regions which we can mark diff --git a/tests/qtest/fuzz/i440fx_fuzz.c b/tests/qtest/fuzz/i440fx_fuzz.c new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/tests/qtest/fuzz/i440fx_fuzz.c @@ -XXX,XX +XXX,XX @@ +/* + * I440FX Fuzzing Target + * + * Copyright Red Hat Inc., 2019 + * + * Authors: + * Alexander Bulekov <alxndr@bu.edu> + * + * This work is licensed under the terms of the GNU GPL, version 2 or later. + * See the COPYING file in the top-level directory. + */ + +#include "qemu/osdep.h" + +#include "qemu/main-loop.h" +#include "tests/qtest/libqtest.h" +#include "tests/qtest/libqos/pci.h" +#include "tests/qtest/libqos/pci-pc.h" +#include "fuzz.h" +#include "fuzz/qos_fuzz.h" +#include "fuzz/fork_fuzz.h" + + +#define I440FX_PCI_HOST_BRIDGE_CFG 0xcf8 +#define I440FX_PCI_HOST_BRIDGE_DATA 0xcfc + +/* + * the input to the fuzzing functions below is a buffer of random bytes. we + * want to convert these bytes into a sequence of qtest or qos calls. to do + * this we define some opcodes: + */ +enum action_id { + WRITEB, + WRITEW, + WRITEL, + READB, + READW, + READL, + ACTION_MAX +}; + +static void i440fx_fuzz_qtest(QTestState *s, + const unsigned char *Data, size_t Size) { + /* + * loop over the Data, breaking it up into actions. each action has an + * opcode, address offset and value + */ + typedef struct QTestFuzzAction { + uint8_t opcode; + uint8_t addr; + uint32_t value; + } QTestFuzzAction; + QTestFuzzAction a; + + while (Size >= sizeof(a)) { + /* make a copy of the action so we can normalize the values in-place */ + memcpy(&a, Data, sizeof(a)); + /* select between two i440fx Port IO addresses */ + uint16_t addr = a.addr % 2 ? I440FX_PCI_HOST_BRIDGE_CFG : + I440FX_PCI_HOST_BRIDGE_DATA; + switch (a.opcode % ACTION_MAX) { + case WRITEB: + qtest_outb(s, addr, (uint8_t)a.value); + break; + case WRITEW: + qtest_outw(s, addr, (uint16_t)a.value); + break; + case WRITEL: + qtest_outl(s, addr, (uint32_t)a.value); + break; + case READB: + qtest_inb(s, addr); + break; + case READW: + qtest_inw(s, addr); + break; + case READL: + qtest_inl(s, addr); + break; + } + /* Move to the next operation */ + Size -= sizeof(a); + Data += sizeof(a); + } + flush_events(s); +} + +static void i440fx_fuzz_qos(QTestState *s, + const unsigned char *Data, size_t Size) { + /* + * Same as i440fx_fuzz_qtest, but using QOS. devfn is incorporated into the + * value written over Port IO + */ + typedef struct QOSFuzzAction { + uint8_t opcode; + uint8_t offset; + int devfn; + uint32_t value; + } QOSFuzzAction; + + static QPCIBus *bus; + if (!bus) { + bus = qpci_new_pc(s, fuzz_qos_alloc); + } + + QOSFuzzAction a; + while (Size >= sizeof(a)) { + memcpy(&a, Data, sizeof(a)); + switch (a.opcode % ACTION_MAX) { + case WRITEB: + bus->config_writeb(bus, a.devfn, a.offset, (uint8_t)a.value); + break; + case WRITEW: + bus->config_writew(bus, a.devfn, a.offset, (uint16_t)a.value); + break; + case WRITEL: + bus->config_writel(bus, a.devfn, a.offset, (uint32_t)a.value); + break; + case READB: + bus->config_readb(bus, a.devfn, a.offset); + break; + case READW: + bus->config_readw(bus, a.devfn, a.offset); + break; + case READL: + bus->config_readl(bus, a.devfn, a.offset); + break; + } + Size -= sizeof(a); + Data += sizeof(a); + } + flush_events(s); +} + +static void i440fx_fuzz_qos_fork(QTestState *s, + const unsigned char *Data, size_t Size) { + if (fork() == 0) { + i440fx_fuzz_qos(s, Data, Size); + _Exit(0); + } else { + wait(NULL); + } +} + +static const char *i440fx_qtest_argv = TARGET_NAME " -machine accel=qtest" + "-m 0 -display none"; +static const char *i440fx_argv(FuzzTarget *t) +{ + return i440fx_qtest_argv; +} + +static void fork_init(void) +{ + counter_shm_init(); +} + +static void register_pci_fuzz_targets(void) +{ + /* Uses simple qtest commands and reboots to reset state */ + fuzz_add_target(&(FuzzTarget){ + .name = "i440fx-qtest-reboot-fuzz", + .description = "Fuzz the i440fx using raw qtest commands and" + "rebooting after each run", + .get_init_cmdline = i440fx_argv, + .fuzz = i440fx_fuzz_qtest}); + + /* Uses libqos and forks to prevent state leakage */ + fuzz_add_qos_target(&(FuzzTarget){ + .name = "i440fx-qos-fork-fuzz", + .description = "Fuzz the i440fx using raw qtest commands and" + "rebooting after each run", + .pre_vm_init = &fork_init, + .fuzz = i440fx_fuzz_qos_fork,}, + "i440FX-pcihost", + &(QOSGraphTestOptions){} + ); + + /* + * Uses libqos. Doesn't do anything to reset state. Note that if we were to + * reboot after each run, we would also have to redo the qos-related + * initialization (qos_init_path) + */ + fuzz_add_qos_target(&(FuzzTarget){ + .name = "i440fx-qos-noreset-fuzz", + .description = "Fuzz the i440fx using raw qtest commands and" + "rebooting after each run", + .fuzz = i440fx_fuzz_qos,}, + "i440FX-pcihost", + &(QOSGraphTestOptions){} + ); +} + +fuzz_target_init(register_pci_fuzz_targets); -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> The virtio-net fuzz target feeds inputs to all three virtio-net virtqueues, and uses forking to avoid leaking state between fuzz runs. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-21-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- tests/qtest/fuzz/Makefile.include | 1 + tests/qtest/fuzz/virtio_net_fuzz.c | 198 +++++++++++++++++++++++++++++ 2 files changed, 199 insertions(+) create mode 100644 tests/qtest/fuzz/virtio_net_fuzz.c diff --git a/tests/qtest/fuzz/Makefile.include b/tests/qtest/fuzz/Makefile.include index XXXXXXX..XXXXXXX 100644 --- a/tests/qtest/fuzz/Makefile.include +++ b/tests/qtest/fuzz/Makefile.include @@ -XXX,XX +XXX,XX @@ fuzz-obj-y += tests/qtest/fuzz/qos_fuzz.o # Targets fuzz-obj-y += tests/qtest/fuzz/i440fx_fuzz.o +fuzz-obj-y += tests/qtest/fuzz/virtio_net_fuzz.o FUZZ_CFLAGS += -I$(SRC_PATH)/tests -I$(SRC_PATH)/tests/qtest diff --git a/tests/qtest/fuzz/virtio_net_fuzz.c b/tests/qtest/fuzz/virtio_net_fuzz.c new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/tests/qtest/fuzz/virtio_net_fuzz.c @@ -XXX,XX +XXX,XX @@ +/* + * virtio-net Fuzzing Target + * + * Copyright Red Hat Inc., 2019 + * + * Authors: + * Alexander Bulekov <alxndr@bu.edu> + * + * This work is licensed under the terms of the GNU GPL, version 2 or later. + * See the COPYING file in the top-level directory. + */ + +#include "qemu/osdep.h" + +#include "standard-headers/linux/virtio_config.h" +#include "tests/qtest/libqtest.h" +#include "tests/qtest/libqos/virtio-net.h" +#include "fuzz.h" +#include "fork_fuzz.h" +#include "qos_fuzz.h" + + +#define QVIRTIO_NET_TIMEOUT_US (30 * 1000 * 1000) +#define QVIRTIO_RX_VQ 0 +#define QVIRTIO_TX_VQ 1 +#define QVIRTIO_CTRL_VQ 2 + +static int sockfds[2]; +static bool sockfds_initialized; + +static void virtio_net_fuzz_multi(QTestState *s, + const unsigned char *Data, size_t Size, bool check_used) +{ + typedef struct vq_action { + uint8_t queue; + uint8_t length; + uint8_t write; + uint8_t next; + uint8_t rx; + } vq_action; + + uint32_t free_head = 0; + + QGuestAllocator *t_alloc = fuzz_qos_alloc; + + QVirtioNet *net_if = fuzz_qos_obj; + QVirtioDevice *dev = net_if->vdev; + QVirtQueue *q; + vq_action vqa; + while (Size >= sizeof(vqa)) { + memcpy(&vqa, Data, sizeof(vqa)); + Data += sizeof(vqa); + Size -= sizeof(vqa); + + q = net_if->queues[vqa.queue % 3]; + + vqa.length = vqa.length >= Size ? Size : vqa.length; + + /* + * Only attempt to write incoming packets, when using the socket + * backend. Otherwise, always place the input on a virtqueue. + */ + if (vqa.rx && sockfds_initialized) { + write(sockfds[0], Data, vqa.length); + } else { + vqa.rx = 0; + uint64_t req_addr = guest_alloc(t_alloc, vqa.length); + /* + * If checking used ring, ensure that the fuzzer doesn't trigger + * trivial asserion failure on zero-zied buffer + */ + qtest_memwrite(s, req_addr, Data, vqa.length); + + + free_head = qvirtqueue_add(s, q, req_addr, vqa.length, + vqa.write, vqa.next); + qvirtqueue_add(s, q, req_addr, vqa.length, vqa.write , vqa.next); + qvirtqueue_kick(s, dev, q, free_head); + } + + /* Run the main loop */ + qtest_clock_step(s, 100); + flush_events(s); + + /* Wait on used descriptors */ + if (check_used && !vqa.rx) { + gint64 start_time = g_get_monotonic_time(); + /* + * normally, we could just use qvirtio_wait_used_elem, but since we + * must manually run the main-loop for all the bhs to run, we use + * this hack with flush_events(), to run the main_loop + */ + while (!vqa.rx && q != net_if->queues[QVIRTIO_RX_VQ]) { + uint32_t got_desc_idx; + /* Input led to a virtio_error */ + if (dev->bus->get_status(dev) & VIRTIO_CONFIG_S_NEEDS_RESET) { + break; + } + if (dev->bus->get_queue_isr_status(dev, q) && + qvirtqueue_get_buf(s, q, &got_desc_idx, NULL)) { + g_assert_cmpint(got_desc_idx, ==, free_head); + break; + } + g_assert(g_get_monotonic_time() - start_time + <= QVIRTIO_NET_TIMEOUT_US); + + /* Run the main loop */ + qtest_clock_step(s, 100); + flush_events(s); + } + } + Data += vqa.length; + Size -= vqa.length; + } +} + +static void virtio_net_fork_fuzz(QTestState *s, + const unsigned char *Data, size_t Size) +{ + if (fork() == 0) { + virtio_net_fuzz_multi(s, Data, Size, false); + flush_events(s); + _Exit(0); + } else { + wait(NULL); + } +} + +static void virtio_net_fork_fuzz_check_used(QTestState *s, + const unsigned char *Data, size_t Size) +{ + if (fork() == 0) { + virtio_net_fuzz_multi(s, Data, Size, true); + flush_events(s); + _Exit(0); + } else { + wait(NULL); + } +} + +static void virtio_net_pre_fuzz(QTestState *s) +{ + qos_init_path(s); + counter_shm_init(); +} + +static void *virtio_net_test_setup_socket(GString *cmd_line, void *arg) +{ + int ret = socketpair(PF_UNIX, SOCK_STREAM, 0, sockfds); + g_assert_cmpint(ret, !=, -1); + fcntl(sockfds[0], F_SETFL, O_NONBLOCK); + sockfds_initialized = true; + g_string_append_printf(cmd_line, " -netdev socket,fd=%d,id=hs0 ", + sockfds[1]); + return arg; +} + +static void *virtio_net_test_setup_user(GString *cmd_line, void *arg) +{ + g_string_append_printf(cmd_line, " -netdev user,id=hs0 "); + return arg; +} + +static void register_virtio_net_fuzz_targets(void) +{ + fuzz_add_qos_target(&(FuzzTarget){ + .name = "virtio-net-socket", + .description = "Fuzz the virtio-net virtual queues. Fuzz incoming " + "traffic using the socket backend", + .pre_fuzz = &virtio_net_pre_fuzz, + .fuzz = virtio_net_fork_fuzz,}, + "virtio-net", + &(QOSGraphTestOptions){.before = virtio_net_test_setup_socket} + ); + + fuzz_add_qos_target(&(FuzzTarget){ + .name = "virtio-net-socket-check-used", + .description = "Fuzz the virtio-net virtual queues. Wait for the " + "descriptors to be used. Timeout may indicate improperly handled " + "input", + .pre_fuzz = &virtio_net_pre_fuzz, + .fuzz = virtio_net_fork_fuzz_check_used,}, + "virtio-net", + &(QOSGraphTestOptions){.before = virtio_net_test_setup_socket} + ); + fuzz_add_qos_target(&(FuzzTarget){ + .name = "virtio-net-slirp", + .description = "Fuzz the virtio-net virtual queues with the slirp " + " backend. Warning: May result in network traffic emitted from the " + " process. Run in an isolated network environment.", + .pre_fuzz = &virtio_net_pre_fuzz, + .fuzz = virtio_net_fork_fuzz,}, + "virtio-net", + &(QOSGraphTestOptions){.before = virtio_net_test_setup_user} + ); +} + +fuzz_target_init(register_virtio_net_fuzz_targets); -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> The virtio-scsi fuzz target sets up and fuzzes the available virtio-scsi queues. After an element is placed on a queue, the fuzzer can select whether to perform a kick, or continue adding elements. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-22-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- tests/qtest/fuzz/Makefile.include | 1 + tests/qtest/fuzz/virtio_scsi_fuzz.c | 213 ++++++++++++++++++++++++++++ 2 files changed, 214 insertions(+) create mode 100644 tests/qtest/fuzz/virtio_scsi_fuzz.c diff --git a/tests/qtest/fuzz/Makefile.include b/tests/qtest/fuzz/Makefile.include index XXXXXXX..XXXXXXX 100644 --- a/tests/qtest/fuzz/Makefile.include +++ b/tests/qtest/fuzz/Makefile.include @@ -XXX,XX +XXX,XX @@ fuzz-obj-y += tests/qtest/fuzz/qos_fuzz.o # Targets fuzz-obj-y += tests/qtest/fuzz/i440fx_fuzz.o fuzz-obj-y += tests/qtest/fuzz/virtio_net_fuzz.o +fuzz-obj-y += tests/qtest/fuzz/virtio_scsi_fuzz.o FUZZ_CFLAGS += -I$(SRC_PATH)/tests -I$(SRC_PATH)/tests/qtest diff --git a/tests/qtest/fuzz/virtio_scsi_fuzz.c b/tests/qtest/fuzz/virtio_scsi_fuzz.c new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/tests/qtest/fuzz/virtio_scsi_fuzz.c @@ -XXX,XX +XXX,XX @@ +/* + * virtio-serial Fuzzing Target + * + * Copyright Red Hat Inc., 2019 + * + * Authors: + * Alexander Bulekov <alxndr@bu.edu> + * + * This work is licensed under the terms of the GNU GPL, version 2 or later. + * See the COPYING file in the top-level directory. + */ + +#include "qemu/osdep.h" + +#include "tests/qtest/libqtest.h" +#include "libqos/virtio-scsi.h" +#include "libqos/virtio.h" +#include "libqos/virtio-pci.h" +#include "standard-headers/linux/virtio_ids.h" +#include "standard-headers/linux/virtio_pci.h" +#include "standard-headers/linux/virtio_scsi.h" +#include "fuzz.h" +#include "fork_fuzz.h" +#include "qos_fuzz.h" + +#define PCI_SLOT 0x02 +#define PCI_FN 0x00 +#define QVIRTIO_SCSI_TIMEOUT_US (1 * 1000 * 1000) + +#define MAX_NUM_QUEUES 64 + +/* Based on tests/virtio-scsi-test.c */ +typedef struct { + int num_queues; + QVirtQueue *vq[MAX_NUM_QUEUES + 2]; +} QVirtioSCSIQueues; + +static QVirtioSCSIQueues *qvirtio_scsi_init(QVirtioDevice *dev, uint64_t mask) +{ + QVirtioSCSIQueues *vs; + uint64_t feat; + int i; + + vs = g_new0(QVirtioSCSIQueues, 1); + + feat = qvirtio_get_features(dev); + if (mask) { + feat &= ~QVIRTIO_F_BAD_FEATURE | mask; + } else { + feat &= ~(QVIRTIO_F_BAD_FEATURE | (1ull << VIRTIO_RING_F_EVENT_IDX)); + } + qvirtio_set_features(dev, feat); + + vs->num_queues = qvirtio_config_readl(dev, 0); + + for (i = 0; i < vs->num_queues + 2; i++) { + vs->vq[i] = qvirtqueue_setup(dev, fuzz_qos_alloc, i); + } + + qvirtio_set_driver_ok(dev); + + return vs; +} + +static void virtio_scsi_fuzz(QTestState *s, QVirtioSCSIQueues* queues, + const unsigned char *Data, size_t Size) +{ + /* + * Data is a sequence of random bytes. We split them up into "actions", + * followed by data: + * [vqa][dddddddd][vqa][dddd][vqa][dddddddddddd] ... + * The length of the data is specified by the preceding vqa.length + */ + typedef struct vq_action { + uint8_t queue; + uint8_t length; + uint8_t write; + uint8_t next; + uint8_t kick; + } vq_action; + + /* Keep track of the free head for each queue we interact with */ + bool vq_touched[MAX_NUM_QUEUES + 2] = {0}; + uint32_t free_head[MAX_NUM_QUEUES + 2]; + + QGuestAllocator *t_alloc = fuzz_qos_alloc; + + QVirtioSCSI *scsi = fuzz_qos_obj; + QVirtioDevice *dev = scsi->vdev; + QVirtQueue *q; + vq_action vqa; + while (Size >= sizeof(vqa)) { + /* Copy the action, so we can normalize length, queue and flags */ + memcpy(&vqa, Data, sizeof(vqa)); + + Data += sizeof(vqa); + Size -= sizeof(vqa); + + vqa.queue = vqa.queue % queues->num_queues; + /* Cap length at the number of remaining bytes in data */ + vqa.length = vqa.length >= Size ? Size : vqa.length; + vqa.write = vqa.write & 1; + vqa.next = vqa.next & 1; + vqa.kick = vqa.kick & 1; + + + q = queues->vq[vqa.queue]; + + /* Copy the data into ram, and place it on the virtqueue */ + uint64_t req_addr = guest_alloc(t_alloc, vqa.length); + qtest_memwrite(s, req_addr, Data, vqa.length); + if (vq_touched[vqa.queue] == 0) { + vq_touched[vqa.queue] = 1; + free_head[vqa.queue] = qvirtqueue_add(s, q, req_addr, vqa.length, + vqa.write, vqa.next); + } else { + qvirtqueue_add(s, q, req_addr, vqa.length, vqa.write , vqa.next); + } + + if (vqa.kick) { + qvirtqueue_kick(s, dev, q, free_head[vqa.queue]); + free_head[vqa.queue] = 0; + } + Data += vqa.length; + Size -= vqa.length; + } + /* In the end, kick each queue we interacted with */ + for (int i = 0; i < MAX_NUM_QUEUES + 2; i++) { + if (vq_touched[i]) { + qvirtqueue_kick(s, dev, queues->vq[i], free_head[i]); + } + } +} + +static void virtio_scsi_fork_fuzz(QTestState *s, + const unsigned char *Data, size_t Size) +{ + QVirtioSCSI *scsi = fuzz_qos_obj; + static QVirtioSCSIQueues *queues; + if (!queues) { + queues = qvirtio_scsi_init(scsi->vdev, 0); + } + if (fork() == 0) { + virtio_scsi_fuzz(s, queues, Data, Size); + flush_events(s); + _Exit(0); + } else { + wait(NULL); + } +} + +static void virtio_scsi_with_flag_fuzz(QTestState *s, + const unsigned char *Data, size_t Size) +{ + QVirtioSCSI *scsi = fuzz_qos_obj; + static QVirtioSCSIQueues *queues; + + if (fork() == 0) { + if (Size >= sizeof(uint64_t)) { + queues = qvirtio_scsi_init(scsi->vdev, *(uint64_t *)Data); + virtio_scsi_fuzz(s, queues, + Data + sizeof(uint64_t), Size - sizeof(uint64_t)); + flush_events(s); + } + _Exit(0); + } else { + wait(NULL); + } +} + +static void virtio_scsi_pre_fuzz(QTestState *s) +{ + qos_init_path(s); + counter_shm_init(); +} + +static void *virtio_scsi_test_setup(GString *cmd_line, void *arg) +{ + g_string_append(cmd_line, + " -drive file=blkdebug::null-co://," + "file.image.read-zeroes=on," + "if=none,id=dr1,format=raw,file.align=4k " + "-device scsi-hd,drive=dr1,lun=0,scsi-id=1"); + return arg; +} + + +static void register_virtio_scsi_fuzz_targets(void) +{ + fuzz_add_qos_target(&(FuzzTarget){ + .name = "virtio-scsi-fuzz", + .description = "Fuzz the virtio-scsi virtual queues, forking" + "for each fuzz run", + .pre_vm_init = &counter_shm_init, + .pre_fuzz = &virtio_scsi_pre_fuzz, + .fuzz = virtio_scsi_fork_fuzz,}, + "virtio-scsi", + &(QOSGraphTestOptions){.before = virtio_scsi_test_setup} + ); + + fuzz_add_qos_target(&(FuzzTarget){ + .name = "virtio-scsi-flags-fuzz", + .description = "Fuzz the virtio-scsi virtual queues, forking" + "for each fuzz run (also fuzzes the virtio flags)", + .pre_vm_init = &counter_shm_init, + .pre_fuzz = &virtio_scsi_pre_fuzz, + .fuzz = virtio_scsi_with_flag_fuzz,}, + "virtio-scsi", + &(QOSGraphTestOptions){.before = virtio_scsi_test_setup} + ); +} + +fuzz_target_init(register_virtio_scsi_fuzz_targets); -- 2.24.1 From: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-23-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- docs/devel/fuzzing.txt | 116 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 116 insertions(+) create mode 100644 docs/devel/fuzzing.txt diff --git a/docs/devel/fuzzing.txt b/docs/devel/fuzzing.txt new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/docs/devel/fuzzing.txt @@ -XXX,XX +XXX,XX @@ += Fuzzing = + +== Introduction == + +This document describes the virtual-device fuzzing infrastructure in QEMU and +how to use it to implement additional fuzzers. + +== Basics == + +Fuzzing operates by passing inputs to an entry point/target function. The +fuzzer tracks the code coverage triggered by the input. Based on these +findings, the fuzzer mutates the input and repeats the fuzzing. + +To fuzz QEMU, we rely on libfuzzer. Unlike other fuzzers such as AFL, libfuzzer +is an _in-process_ fuzzer. For the developer, this means that it is their +responsibility to ensure that state is reset between fuzzing-runs. + +== Building the fuzzers == + +NOTE: If possible, build a 32-bit binary. When forking, the 32-bit fuzzer is +much faster, since the page-map has a smaller size. This is due to the fact that +AddressSanitizer mmaps ~20TB of memory, as part of its detection. This results +in a large page-map, and a much slower fork(). + +To build the fuzzers, install a recent version of clang: +Configure with (substitute the clang binaries with the version you installed): + + CC=clang-8 CXX=clang++-8 /path/to/configure --enable-fuzzing + +Fuzz targets are built similarly to system/softmmu: + + make i386-softmmu/fuzz + +This builds ./i386-softmmu/qemu-fuzz-i386 + +The first option to this command is: --fuzz_taget=FUZZ_NAME +To list all of the available fuzzers run qemu-fuzz-i386 with no arguments. + +eg: + ./i386-softmmu/qemu-fuzz-i386 --fuzz-target=virtio-net-fork-fuzz + +Internally, libfuzzer parses all arguments that do not begin with "--". +Information about these is available by passing -help=1 + +Now the only thing left to do is wait for the fuzzer to trigger potential +crashes. + +== Adding a new fuzzer == +Coverage over virtual devices can be improved by adding additional fuzzers. +Fuzzers are kept in tests/qtest/fuzz/ and should be added to +tests/qtest/fuzz/Makefile.include + +Fuzzers can rely on both qtest and libqos to communicate with virtual devices. + +1. Create a new source file. For example ``tests/qtest/fuzz/foo-device-fuzz.c``. + +2. Write the fuzzing code using the libqtest/libqos API. See existing fuzzers +for reference. + +3. Register the fuzzer in ``tests/fuzz/Makefile.include`` by appending the +corresponding object to fuzz-obj-y + +Fuzzers can be more-or-less thought of as special qtest programs which can +modify the qtest commands and/or qtest command arguments based on inputs +provided by libfuzzer. Libfuzzer passes a byte array and length. Commonly the +fuzzer loops over the byte-array interpreting it as a list of qtest commands, +addresses, or values. + += Implementation Details = + +== The Fuzzer's Lifecycle == + +The fuzzer has two entrypoints that libfuzzer calls. libfuzzer provides it's +own main(), which performs some setup, and calls the entrypoints: + +LLVMFuzzerInitialize: called prior to fuzzing. Used to initialize all of the +necessary state + +LLVMFuzzerTestOneInput: called for each fuzzing run. Processes the input and +resets the state at the end of each run. + +In more detail: + +LLVMFuzzerInitialize parses the arguments to the fuzzer (must start with two +dashes, so they are ignored by libfuzzer main()). Currently, the arguments +select the fuzz target. Then, the qtest client is initialized. If the target +requires qos, qgraph is set up and the QOM/LIBQOS modules are initialized. +Then the QGraph is walked and the QEMU cmd_line is determined and saved. + +After this, the vl.c:qemu__main is called to set up the guest. There are +target-specific hooks that can be called before and after qemu_main, for +additional setup(e.g. PCI setup, or VM snapshotting). + +LLVMFuzzerTestOneInput: Uses qtest/qos functions to act based on the fuzz +input. It is also responsible for manually calling the main loop/main_loop_wait +to ensure that bottom halves are executed and any cleanup required before the +next input. + +Since the same process is reused for many fuzzing runs, QEMU state needs to +be reset at the end of each run. There are currently two implemented +options for resetting state: +1. Reboot the guest between runs. + Pros: Straightforward and fast for simple fuzz targets. + Cons: Depending on the device, does not reset all device state. If the + device requires some initialization prior to being ready for fuzzing + (common for QOS-based targets), this initialization needs to be done after + each reboot. + Example target: i440fx-qtest-reboot-fuzz +2. Run each test case in a separate forked process and copy the coverage + information back to the parent. This is fairly similar to AFL's "deferred" + fork-server mode [3] + Pros: Relatively fast. Devices only need to be initialized once. No need + to do slow reboots or vmloads. + Cons: Not officially supported by libfuzzer. Does not work well for devices + that rely on dedicated threads. + Example target: virtio-net-fork-fuzz -- 2.24.1 The following changes since commit ac793156f650ae2d77834932d72224175ee69086: Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20201020-1' into staging (2020-10-20 21:11:35 +0100) are available in the Git repository at: https://gitlab.com/stefanha/qemu.git tags/block-pull-request for you to fetch changes up to 32a3fd65e7e3551337fd26bfc0e2f899d70c028c: iotests: add commit top->base cases to 274 (2020-10-22 09:55:39 +0100) ---------------------------------------------------------------- Pull request v2: * Fix format string issues on 32-bit hosts [Peter] * Fix qemu-nbd.c CONFIG_POSIX ifdef issue [Eric] * Fix missing eventfd.h header on macOS [Peter] * Drop unreliable vhost-user-blk test (will send a new patch when ready) [Peter] This pull request contains the vhost-user-blk server by Coiby Xu along with my additions, block/nvme.c alignment and hardware error statistics by Philippe Mathieu-Daudé, and bdrv_co_block_status_above() fixes by Vladimir Sementsov-Ogievskiy. ---------------------------------------------------------------- Coiby Xu (6): libvhost-user: Allow vu_message_read to be replaced libvhost-user: remove watch for kick_fd when de-initialize vu-dev util/vhost-user-server: generic vhost user server block: move logical block size check function to a common utility function block/export: vhost-user block device backend server MAINTAINERS: Add vhost-user block device backend server maintainer Philippe Mathieu-Daudé (1): block/nvme: Add driver statistics for access alignment and hw errors Stefan Hajnoczi (16): util/vhost-user-server: s/fileds/fields/ typo fix util/vhost-user-server: drop unnecessary QOM cast util/vhost-user-server: drop unnecessary watch deletion block/export: consolidate request structs into VuBlockReq util/vhost-user-server: drop unused DevicePanicNotifier util/vhost-user-server: fix memory leak in vu_message_read() util/vhost-user-server: check EOF when reading payload util/vhost-user-server: rework vu_client_trip() coroutine lifecycle block/export: report flush errors block/export: convert vhost-user-blk server to block export API util/vhost-user-server: move header to include/ util/vhost-user-server: use static library in meson.build qemu-storage-daemon: avoid compiling blockdev_ss twice block: move block exports to libblockdev block/export: add iothread and fixed-iothread options block/export: add vhost-user-blk multi-queue support Vladimir Sementsov-Ogievskiy (5): block/io: fix bdrv_co_block_status_above block/io: bdrv_common_block_status_above: support include_base block/io: bdrv_common_block_status_above: support bs == base block/io: fix bdrv_is_allocated_above iotests: add commit top->base cases to 274 MAINTAINERS | 9 + qapi/block-core.json | 24 +- qapi/block-export.json | 36 +- block/coroutines.h | 2 + block/export/vhost-user-blk-server.h | 19 + contrib/libvhost-user/libvhost-user.h | 21 + include/qemu/vhost-user-server.h | 65 +++ util/block-helpers.h | 19 + block/export/export.c | 37 +- block/export/vhost-user-blk-server.c | 431 ++++++++++++++++++++ block/io.c | 132 +++--- block/nvme.c | 27 ++ block/qcow2.c | 16 +- contrib/libvhost-user/libvhost-user-glib.c | 2 +- contrib/libvhost-user/libvhost-user.c | 15 +- hw/core/qdev-properties-system.c | 31 +- nbd/server.c | 2 - qemu-nbd.c | 21 +- softmmu/vl.c | 4 + stubs/blk-exp-close-all.c | 7 + tests/vhost-user-bridge.c | 2 + tools/virtiofsd/fuse_virtio.c | 4 +- util/block-helpers.c | 46 +++ util/vhost-user-server.c | 446 +++++++++++++++++++++ block/export/meson.build | 3 +- contrib/libvhost-user/meson.build | 1 + meson.build | 22 +- nbd/meson.build | 2 + storage-daemon/meson.build | 3 +- stubs/meson.build | 1 + tests/qemu-iotests/274 | 20 + tests/qemu-iotests/274.out | 68 ++++ util/meson.build | 4 + 33 files changed, 1420 insertions(+), 122 deletions(-) create mode 100644 block/export/vhost-user-blk-server.h create mode 100644 include/qemu/vhost-user-server.h create mode 100644 util/block-helpers.h create mode 100644 block/export/vhost-user-blk-server.c create mode 100644 stubs/blk-exp-close-all.c create mode 100644 util/block-helpers.c create mode 100644 util/vhost-user-server.c -- 2.26.2 From: Philippe Mathieu-Daudé <philmd@redhat.com> Keep statistics of some hardware errors, and number of aligned/unaligned I/O accesses. QMP example booting a full RHEL 8.3 aarch64 guest: { "execute": "query-blockstats" } { "return": [ { "device": "", "node-name": "drive0", "stats": { "flush_total_time_ns": 6026948, "wr_highest_offset": 3383991230464, "wr_total_time_ns": 807450995, "failed_wr_operations": 0, "failed_rd_operations": 0, "wr_merged": 3, "wr_bytes": 50133504, "failed_unmap_operations": 0, "failed_flush_operations": 0, "account_invalid": false, "rd_total_time_ns": 1846979900, "flush_operations": 130, "wr_operations": 659, "rd_merged": 1192, "rd_bytes": 218244096, "account_failed": false, "idle_time_ns": 2678641497, "rd_operations": 7406, }, "driver-specific": { "driver": "nvme", "completion-errors": 0, "unaligned-accesses": 2959, "aligned-accesses": 4477 }, "qdev": "/machine/peripheral-anon/device[0]/virtio-backend" } ] } Suggested-by: Stefan Hajnoczi <stefanha@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Acked-by: Markus Armbruster <armbru@redhat.com> Message-id: 20201001162939.1567915-1-philmd@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- qapi/block-core.json | 24 +++++++++++++++++++++++- block/nvme.c | 27 +++++++++++++++++++++++++++ 2 files changed, 50 insertions(+), 1 deletion(-) diff --git a/qapi/block-core.json b/qapi/block-core.json index XXXXXXX..XXXXXXX 100644 --- a/qapi/block-core.json +++ b/qapi/block-core.json @@ -XXX,XX +XXX,XX @@ 'discard-nb-failed': 'uint64', 'discard-bytes-ok': 'uint64' } } +## +# @BlockStatsSpecificNvme: +# +# NVMe driver statistics +# +# @completion-errors: The number of completion errors. +# +# @aligned-accesses: The number of aligned accesses performed by +# the driver. +# +# @unaligned-accesses: The number of unaligned accesses performed by +# the driver. +# +# Since: 5.2 +## +{ 'struct': 'BlockStatsSpecificNvme', + 'data': { + 'completion-errors': 'uint64', + 'aligned-accesses': 'uint64', + 'unaligned-accesses': 'uint64' } } + ## # @BlockStatsSpecific: # @@ -XXX,XX +XXX,XX @@ 'discriminator': 'driver', 'data': { 'file': 'BlockStatsSpecificFile', - 'host_device': 'BlockStatsSpecificFile' } } + 'host_device': 'BlockStatsSpecificFile', + 'nvme': 'BlockStatsSpecificNvme' } } ## # @BlockStats: diff --git a/block/nvme.c b/block/nvme.c index XXXXXXX..XXXXXXX 100644 --- a/block/nvme.c +++ b/block/nvme.c @@ -XXX,XX +XXX,XX @@ struct BDRVNVMeState { /* PCI address (required for nvme_refresh_filename()) */ char *device; + + struct { + uint64_t completion_errors; + uint64_t aligned_accesses; + uint64_t unaligned_accesses; + } stats; }; #define NVME_BLOCK_OPT_DEVICE "device" @@ -XXX,XX +XXX,XX @@ static bool nvme_process_completion(NVMeQueuePair *q) break; } ret = nvme_translate_error(c); + if (ret) { + s->stats.completion_errors++; + } q->cq.head = (q->cq.head + 1) % NVME_QUEUE_SIZE; if (!q->cq.head) { q->cq_phase = !q->cq_phase; @@ -XXX,XX +XXX,XX @@ static int nvme_co_prw(BlockDriverState *bs, uint64_t offset, uint64_t bytes, assert(QEMU_IS_ALIGNED(bytes, s->page_size)); assert(bytes <= s->max_transfer); if (nvme_qiov_aligned(bs, qiov)) { + s->stats.aligned_accesses++; return nvme_co_prw_aligned(bs, offset, bytes, qiov, is_write, flags); } + s->stats.unaligned_accesses++; trace_nvme_prw_buffered(s, offset, bytes, qiov->niov, is_write); buf = qemu_try_memalign(s->page_size, bytes); @@ -XXX,XX +XXX,XX @@ static void nvme_unregister_buf(BlockDriverState *bs, void *host) qemu_vfio_dma_unmap(s->vfio, host); } +static BlockStatsSpecific *nvme_get_specific_stats(BlockDriverState *bs) +{ + BlockStatsSpecific *stats = g_new(BlockStatsSpecific, 1); + BDRVNVMeState *s = bs->opaque; + + stats->driver = BLOCKDEV_DRIVER_NVME; + stats->u.nvme = (BlockStatsSpecificNvme) { + .completion_errors = s->stats.completion_errors, + .aligned_accesses = s->stats.aligned_accesses, + .unaligned_accesses = s->stats.unaligned_accesses, + }; + + return stats; +} + static const char *const nvme_strong_runtime_opts[] = { NVME_BLOCK_OPT_DEVICE, NVME_BLOCK_OPT_NAMESPACE, @@ -XXX,XX +XXX,XX @@ static BlockDriver bdrv_nvme = { .bdrv_refresh_filename = nvme_refresh_filename, .bdrv_refresh_limits = nvme_refresh_limits, .strong_runtime_opts = nvme_strong_runtime_opts, + .bdrv_get_specific_stats = nvme_get_specific_stats, .bdrv_detach_aio_context = nvme_detach_aio_context, .bdrv_attach_aio_context = nvme_attach_aio_context, -- 2.26.2 From: Coiby Xu <coiby.xu@gmail.com> Allow vu_message_read to be replaced by one which will make use of the QIOChannel functions. Thus reading vhost-user message won't stall the guest. For slave channel, we still use the default vu_message_read. Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Coiby Xu <coiby.xu@gmail.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20200918080912.321299-2-coiby.xu@gmail.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- contrib/libvhost-user/libvhost-user.h | 21 +++++++++++++++++++++ contrib/libvhost-user/libvhost-user-glib.c | 2 +- contrib/libvhost-user/libvhost-user.c | 14 +++++++------- tests/vhost-user-bridge.c | 2 ++ tools/virtiofsd/fuse_virtio.c | 4 ++-- 5 files changed, 33 insertions(+), 10 deletions(-) diff --git a/contrib/libvhost-user/libvhost-user.h b/contrib/libvhost-user/libvhost-user.h index XXXXXXX..XXXXXXX 100644 --- a/contrib/libvhost-user/libvhost-user.h +++ b/contrib/libvhost-user/libvhost-user.h @@ -XXX,XX +XXX,XX @@ */ #define VHOST_USER_MAX_RAM_SLOTS 32 +#define VHOST_USER_HDR_SIZE offsetof(VhostUserMsg, payload.u64) + typedef enum VhostSetConfigType { VHOST_SET_CONFIG_TYPE_MASTER = 0, VHOST_SET_CONFIG_TYPE_MIGRATION = 1, @@ -XXX,XX +XXX,XX @@ typedef uint64_t (*vu_get_features_cb) (VuDev *dev); typedef void (*vu_set_features_cb) (VuDev *dev, uint64_t features); typedef int (*vu_process_msg_cb) (VuDev *dev, VhostUserMsg *vmsg, int *do_reply); +typedef bool (*vu_read_msg_cb) (VuDev *dev, int sock, VhostUserMsg *vmsg); typedef void (*vu_queue_set_started_cb) (VuDev *dev, int qidx, bool started); typedef bool (*vu_queue_is_processed_in_order_cb) (VuDev *dev, int qidx); typedef int (*vu_get_config_cb) (VuDev *dev, uint8_t *config, uint32_t len); @@ -XXX,XX +XXX,XX @@ struct VuDev { bool broken; uint16_t max_queues; + /* @read_msg: custom method to read vhost-user message + * + * Read data from vhost_user socket fd and fill up + * the passed VhostUserMsg *vmsg struct. + * + * If reading fails, it should close the received set of file + * descriptors as socket message's auxiliary data. + * + * For the details, please refer to vu_message_read in libvhost-user.c + * which will be used by default if not custom method is provided when + * calling vu_init + * + * Returns: true if vhost-user message successfully received, + * otherwise return false. + * + */ + vu_read_msg_cb read_msg; /* @set_watch: add or update the given fd to the watch set, * call cb when condition is met */ vu_set_watch_cb set_watch; @@ -XXX,XX +XXX,XX @@ bool vu_init(VuDev *dev, uint16_t max_queues, int socket, vu_panic_cb panic, + vu_read_msg_cb read_msg, vu_set_watch_cb set_watch, vu_remove_watch_cb remove_watch, const VuDevIface *iface); diff --git a/contrib/libvhost-user/libvhost-user-glib.c b/contrib/libvhost-user/libvhost-user-glib.c index XXXXXXX..XXXXXXX 100644 --- a/contrib/libvhost-user/libvhost-user-glib.c +++ b/contrib/libvhost-user/libvhost-user-glib.c @@ -XXX,XX +XXX,XX @@ vug_init(VugDev *dev, uint16_t max_queues, int socket, g_assert(dev); g_assert(iface); - if (!vu_init(&dev->parent, max_queues, socket, panic, set_watch, + if (!vu_init(&dev->parent, max_queues, socket, panic, NULL, set_watch, remove_watch, iface)) { return false; } diff --git a/contrib/libvhost-user/libvhost-user.c b/contrib/libvhost-user/libvhost-user.c index XXXXXXX..XXXXXXX 100644 --- a/contrib/libvhost-user/libvhost-user.c +++ b/contrib/libvhost-user/libvhost-user.c @@ -XXX,XX +XXX,XX @@ /* The version of inflight buffer */ #define INFLIGHT_VERSION 1 -#define VHOST_USER_HDR_SIZE offsetof(VhostUserMsg, payload.u64) - /* The version of the protocol we support */ #define VHOST_USER_VERSION 1 #define LIBVHOST_USER_DEBUG 0 @@ -XXX,XX +XXX,XX @@ have_userfault(void) } static bool -vu_message_read(VuDev *dev, int conn_fd, VhostUserMsg *vmsg) +vu_message_read_default(VuDev *dev, int conn_fd, VhostUserMsg *vmsg) { char control[CMSG_SPACE(VHOST_MEMORY_BASELINE_NREGIONS * sizeof(int))] = {}; struct iovec iov = { @@ -XXX,XX +XXX,XX @@ vu_process_message_reply(VuDev *dev, const VhostUserMsg *vmsg) goto out; } - if (!vu_message_read(dev, dev->slave_fd, &msg_reply)) { + if (!vu_message_read_default(dev, dev->slave_fd, &msg_reply)) { goto out; } @@ -XXX,XX +XXX,XX @@ vu_set_mem_table_exec_postcopy(VuDev *dev, VhostUserMsg *vmsg) /* Wait for QEMU to confirm that it's registered the handler for the * faults. */ - if (!vu_message_read(dev, dev->sock, vmsg) || + if (!dev->read_msg(dev, dev->sock, vmsg) || vmsg->size != sizeof(vmsg->payload.u64) || vmsg->payload.u64 != 0) { vu_panic(dev, "failed to receive valid ack for postcopy set-mem-table"); @@ -XXX,XX +XXX,XX @@ vu_dispatch(VuDev *dev) int reply_requested; bool need_reply, success = false; - if (!vu_message_read(dev, dev->sock, &vmsg)) { + if (!dev->read_msg(dev, dev->sock, &vmsg)) { goto end; } @@ -XXX,XX +XXX,XX @@ vu_init(VuDev *dev, uint16_t max_queues, int socket, vu_panic_cb panic, + vu_read_msg_cb read_msg, vu_set_watch_cb set_watch, vu_remove_watch_cb remove_watch, const VuDevIface *iface) @@ -XXX,XX +XXX,XX @@ vu_init(VuDev *dev, dev->sock = socket; dev->panic = panic; + dev->read_msg = read_msg ? read_msg : vu_message_read_default; dev->set_watch = set_watch; dev->remove_watch = remove_watch; dev->iface = iface; @@ -XXX,XX +XXX,XX @@ static void _vu_queue_notify(VuDev *dev, VuVirtq *vq, bool sync) vu_message_write(dev, dev->slave_fd, &vmsg); if (ack) { - vu_message_read(dev, dev->slave_fd, &vmsg); + vu_message_read_default(dev, dev->slave_fd, &vmsg); } return; } diff --git a/tests/vhost-user-bridge.c b/tests/vhost-user-bridge.c index XXXXXXX..XXXXXXX 100644 --- a/tests/vhost-user-bridge.c +++ b/tests/vhost-user-bridge.c @@ -XXX,XX +XXX,XX @@ vubr_accept_cb(int sock, void *ctx) VHOST_USER_BRIDGE_MAX_QUEUES, conn_fd, vubr_panic, + NULL, vubr_set_watch, vubr_remove_watch, &vuiface)) { @@ -XXX,XX +XXX,XX @@ vubr_new(const char *path, bool client) VHOST_USER_BRIDGE_MAX_QUEUES, dev->sock, vubr_panic, + NULL, vubr_set_watch, vubr_remove_watch, &vuiface)) { diff --git a/tools/virtiofsd/fuse_virtio.c b/tools/virtiofsd/fuse_virtio.c index XXXXXXX..XXXXXXX 100644 --- a/tools/virtiofsd/fuse_virtio.c +++ b/tools/virtiofsd/fuse_virtio.c @@ -XXX,XX +XXX,XX @@ int virtio_session_mount(struct fuse_session *se) se->vu_socketfd = data_sock; se->virtio_dev->se = se; pthread_rwlock_init(&se->virtio_dev->vu_dispatch_rwlock, NULL); - vu_init(&se->virtio_dev->dev, 2, se->vu_socketfd, fv_panic, fv_set_watch, - fv_remove_watch, &fv_iface); + vu_init(&se->virtio_dev->dev, 2, se->vu_socketfd, fv_panic, NULL, + fv_set_watch, fv_remove_watch, &fv_iface); return 0; } -- 2.26.2 From: Coiby Xu <coiby.xu@gmail.com> When the client is running in gdb and quit command is run in gdb, QEMU will still dispatch the event which will cause segment fault in the callback function. Signed-off-by: Coiby Xu <coiby.xu@gmail.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20200918080912.321299-3-coiby.xu@gmail.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- contrib/libvhost-user/libvhost-user.c | 1 + 1 file changed, 1 insertion(+) diff --git a/contrib/libvhost-user/libvhost-user.c b/contrib/libvhost-user/libvhost-user.c index XXXXXXX..XXXXXXX 100644 --- a/contrib/libvhost-user/libvhost-user.c +++ b/contrib/libvhost-user/libvhost-user.c @@ -XXX,XX +XXX,XX @@ vu_deinit(VuDev *dev) } if (vq->kick_fd != -1) { + dev->remove_watch(dev, vq->kick_fd); close(vq->kick_fd); vq->kick_fd = -1; } -- 2.26.2 From: Coiby Xu <coiby.xu@gmail.com> Sharing QEMU devices via vhost-user protocol. Only one vhost-user client can connect to the server one time. Suggested-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Coiby Xu <coiby.xu@gmail.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20200918080912.321299-4-coiby.xu@gmail.com [Fixed size_t %lu -> %zu format string compiler error. --Stefan] Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- util/vhost-user-server.h | 65 ++++++ util/vhost-user-server.c | 428 +++++++++++++++++++++++++++++++++++++++ util/meson.build | 1 + 3 files changed, 494 insertions(+) create mode 100644 util/vhost-user-server.h create mode 100644 util/vhost-user-server.c diff --git a/util/vhost-user-server.h b/util/vhost-user-server.h new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/util/vhost-user-server.h @@ -XXX,XX +XXX,XX @@ +/* + * Sharing QEMU devices via vhost-user protocol + * + * Copyright (c) Coiby Xu <coiby.xu@gmail.com>. + * Copyright (c) 2020 Red Hat, Inc. + * + * This work is licensed under the terms of the GNU GPL, version 2 or + * later. See the COPYING file in the top-level directory. + */ + +#ifndef VHOST_USER_SERVER_H +#define VHOST_USER_SERVER_H + +#include "contrib/libvhost-user/libvhost-user.h" +#include "io/channel-socket.h" +#include "io/channel-file.h" +#include "io/net-listener.h" +#include "qemu/error-report.h" +#include "qapi/error.h" +#include "standard-headers/linux/virtio_blk.h" + +typedef struct VuFdWatch { + VuDev *vu_dev; + int fd; /*kick fd*/ + void *pvt; + vu_watch_cb cb; + bool processing; + QTAILQ_ENTRY(VuFdWatch) next; +} VuFdWatch; + +typedef struct VuServer VuServer; +typedef void DevicePanicNotifierFn(VuServer *server); + +struct VuServer { + QIONetListener *listener; + AioContext *ctx; + DevicePanicNotifierFn *device_panic_notifier; + int max_queues; + const VuDevIface *vu_iface; + VuDev vu_dev; + QIOChannel *ioc; /* The I/O channel with the client */ + QIOChannelSocket *sioc; /* The underlying data channel with the client */ + /* IOChannel for fd provided via VHOST_USER_SET_SLAVE_REQ_FD */ + QIOChannel *ioc_slave; + QIOChannelSocket *sioc_slave; + Coroutine *co_trip; /* coroutine for processing VhostUserMsg */ + QTAILQ_HEAD(, VuFdWatch) vu_fd_watches; + /* restart coroutine co_trip if AIOContext is changed */ + bool aio_context_changed; + bool processing_msg; +}; + +bool vhost_user_server_start(VuServer *server, + SocketAddress *unix_socket, + AioContext *ctx, + uint16_t max_queues, + DevicePanicNotifierFn *device_panic_notifier, + const VuDevIface *vu_iface, + Error **errp); + +void vhost_user_server_stop(VuServer *server); + +void vhost_user_server_set_aio_context(VuServer *server, AioContext *ctx); + +#endif /* VHOST_USER_SERVER_H */ diff --git a/util/vhost-user-server.c b/util/vhost-user-server.c new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/util/vhost-user-server.c @@ -XXX,XX +XXX,XX @@ +/* + * Sharing QEMU devices via vhost-user protocol + * + * Copyright (c) Coiby Xu <coiby.xu@gmail.com>. + * Copyright (c) 2020 Red Hat, Inc. + * + * This work is licensed under the terms of the GNU GPL, version 2 or + * later. See the COPYING file in the top-level directory. + */ +#include "qemu/osdep.h" +#include "qemu/main-loop.h" +#include "vhost-user-server.h" + +static void vmsg_close_fds(VhostUserMsg *vmsg) +{ + int i; + for (i = 0; i < vmsg->fd_num; i++) { + close(vmsg->fds[i]); + } +} + +static void vmsg_unblock_fds(VhostUserMsg *vmsg) +{ + int i; + for (i = 0; i < vmsg->fd_num; i++) { + qemu_set_nonblock(vmsg->fds[i]); + } +} + +static void vu_accept(QIONetListener *listener, QIOChannelSocket *sioc, + gpointer opaque); + +static void close_client(VuServer *server) +{ + /* + * Before closing the client + * + * 1. Let vu_client_trip stop processing new vhost-user msg + * + * 2. remove kick_handler + * + * 3. wait for the kick handler to be finished + * + * 4. wait for the current vhost-user msg to be finished processing + */ + + QIOChannelSocket *sioc = server->sioc; + /* When this is set vu_client_trip will stop new processing vhost-user message */ + server->sioc = NULL; + + VuFdWatch *vu_fd_watch, *next; + QTAILQ_FOREACH_SAFE(vu_fd_watch, &server->vu_fd_watches, next, next) { + aio_set_fd_handler(server->ioc->ctx, vu_fd_watch->fd, true, NULL, + NULL, NULL, NULL); + } + + while (!QTAILQ_EMPTY(&server->vu_fd_watches)) { + QTAILQ_FOREACH_SAFE(vu_fd_watch, &server->vu_fd_watches, next, next) { + if (!vu_fd_watch->processing) { + QTAILQ_REMOVE(&server->vu_fd_watches, vu_fd_watch, next); + g_free(vu_fd_watch); + } + } + } + + while (server->processing_msg) { + if (server->ioc->read_coroutine) { + server->ioc->read_coroutine = NULL; + qio_channel_set_aio_fd_handler(server->ioc, server->ioc->ctx, NULL, + NULL, server->ioc); + server->processing_msg = false; + } + } + + vu_deinit(&server->vu_dev); + object_unref(OBJECT(sioc)); + object_unref(OBJECT(server->ioc)); +} + +static void panic_cb(VuDev *vu_dev, const char *buf) +{ + VuServer *server = container_of(vu_dev, VuServer, vu_dev); + + /* avoid while loop in close_client */ + server->processing_msg = false; + + if (buf) { + error_report("vu_panic: %s", buf); + } + + if (server->sioc) { + close_client(server); + } + + if (server->device_panic_notifier) { + server->device_panic_notifier(server); + } + + /* + * Set the callback function for network listener so another + * vhost-user client can connect to this server + */ + qio_net_listener_set_client_func(server->listener, + vu_accept, + server, + NULL); +} + +static bool coroutine_fn +vu_message_read(VuDev *vu_dev, int conn_fd, VhostUserMsg *vmsg) +{ + struct iovec iov = { + .iov_base = (char *)vmsg, + .iov_len = VHOST_USER_HDR_SIZE, + }; + int rc, read_bytes = 0; + Error *local_err = NULL; + /* + * Store fds/nfds returned from qio_channel_readv_full into + * temporary variables. + * + * VhostUserMsg is a packed structure, gcc will complain about passing + * pointer to a packed structure member if we pass &VhostUserMsg.fd_num + * and &VhostUserMsg.fds directly when calling qio_channel_readv_full, + * thus two temporary variables nfds and fds are used here. + */ + size_t nfds = 0, nfds_t = 0; + const size_t max_fds = G_N_ELEMENTS(vmsg->fds); + int *fds_t = NULL; + VuServer *server = container_of(vu_dev, VuServer, vu_dev); + QIOChannel *ioc = server->ioc; + + if (!ioc) { + error_report_err(local_err); + goto fail; + } + + assert(qemu_in_coroutine()); + do { + /* + * qio_channel_readv_full may have short reads, keeping calling it + * until getting VHOST_USER_HDR_SIZE or 0 bytes in total + */ + rc = qio_channel_readv_full(ioc, &iov, 1, &fds_t, &nfds_t, &local_err); + if (rc < 0) { + if (rc == QIO_CHANNEL_ERR_BLOCK) { + qio_channel_yield(ioc, G_IO_IN); + continue; + } else { + error_report_err(local_err); + return false; + } + } + read_bytes += rc; + if (nfds_t > 0) { + if (nfds + nfds_t > max_fds) { + error_report("A maximum of %zu fds are allowed, " + "however got %zu fds now", + max_fds, nfds + nfds_t); + goto fail; + } + memcpy(vmsg->fds + nfds, fds_t, + nfds_t *sizeof(vmsg->fds[0])); + nfds += nfds_t; + g_free(fds_t); + } + if (read_bytes == VHOST_USER_HDR_SIZE || rc == 0) { + break; + } + iov.iov_base = (char *)vmsg + read_bytes; + iov.iov_len = VHOST_USER_HDR_SIZE - read_bytes; + } while (true); + + vmsg->fd_num = nfds; + /* qio_channel_readv_full will make socket fds blocking, unblock them */ + vmsg_unblock_fds(vmsg); + if (vmsg->size > sizeof(vmsg->payload)) { + error_report("Error: too big message request: %d, " + "size: vmsg->size: %u, " + "while sizeof(vmsg->payload) = %zu", + vmsg->request, vmsg->size, sizeof(vmsg->payload)); + goto fail; + } + + struct iovec iov_payload = { + .iov_base = (char *)&vmsg->payload, + .iov_len = vmsg->size, + }; + if (vmsg->size) { + rc = qio_channel_readv_all_eof(ioc, &iov_payload, 1, &local_err); + if (rc == -1) { + error_report_err(local_err); + goto fail; + } + } + + return true; + +fail: + vmsg_close_fds(vmsg); + + return false; +} + + +static void vu_client_start(VuServer *server); +static coroutine_fn void vu_client_trip(void *opaque) +{ + VuServer *server = opaque; + + while (!server->aio_context_changed && server->sioc) { + server->processing_msg = true; + vu_dispatch(&server->vu_dev); + server->processing_msg = false; + } + + if (server->aio_context_changed && server->sioc) { + server->aio_context_changed = false; + vu_client_start(server); + } +} + +static void vu_client_start(VuServer *server) +{ + server->co_trip = qemu_coroutine_create(vu_client_trip, server); + aio_co_enter(server->ctx, server->co_trip); +} + +/* + * a wrapper for vu_kick_cb + * + * since aio_dispatch can only pass one user data pointer to the + * callback function, pack VuDev and pvt into a struct. Then unpack it + * and pass them to vu_kick_cb + */ +static void kick_handler(void *opaque) +{ + VuFdWatch *vu_fd_watch = opaque; + vu_fd_watch->processing = true; + vu_fd_watch->cb(vu_fd_watch->vu_dev, 0, vu_fd_watch->pvt); + vu_fd_watch->processing = false; +} + + +static VuFdWatch *find_vu_fd_watch(VuServer *server, int fd) +{ + + VuFdWatch *vu_fd_watch, *next; + QTAILQ_FOREACH_SAFE(vu_fd_watch, &server->vu_fd_watches, next, next) { + if (vu_fd_watch->fd == fd) { + return vu_fd_watch; + } + } + return NULL; +} + +static void +set_watch(VuDev *vu_dev, int fd, int vu_evt, + vu_watch_cb cb, void *pvt) +{ + + VuServer *server = container_of(vu_dev, VuServer, vu_dev); + g_assert(vu_dev); + g_assert(fd >= 0); + g_assert(cb); + + VuFdWatch *vu_fd_watch = find_vu_fd_watch(server, fd); + + if (!vu_fd_watch) { + VuFdWatch *vu_fd_watch = g_new0(VuFdWatch, 1); + + QTAILQ_INSERT_TAIL(&server->vu_fd_watches, vu_fd_watch, next); + + vu_fd_watch->fd = fd; + vu_fd_watch->cb = cb; + qemu_set_nonblock(fd); + aio_set_fd_handler(server->ioc->ctx, fd, true, kick_handler, + NULL, NULL, vu_fd_watch); + vu_fd_watch->vu_dev = vu_dev; + vu_fd_watch->pvt = pvt; + } +} + + +static void remove_watch(VuDev *vu_dev, int fd) +{ + VuServer *server; + g_assert(vu_dev); + g_assert(fd >= 0); + + server = container_of(vu_dev, VuServer, vu_dev); + + VuFdWatch *vu_fd_watch = find_vu_fd_watch(server, fd); + + if (!vu_fd_watch) { + return; + } + aio_set_fd_handler(server->ioc->ctx, fd, true, NULL, NULL, NULL, NULL); + + QTAILQ_REMOVE(&server->vu_fd_watches, vu_fd_watch, next); + g_free(vu_fd_watch); +} + + +static void vu_accept(QIONetListener *listener, QIOChannelSocket *sioc, + gpointer opaque) +{ + VuServer *server = opaque; + + if (server->sioc) { + warn_report("Only one vhost-user client is allowed to " + "connect the server one time"); + return; + } + + if (!vu_init(&server->vu_dev, server->max_queues, sioc->fd, panic_cb, + vu_message_read, set_watch, remove_watch, server->vu_iface)) { + error_report("Failed to initialize libvhost-user"); + return; + } + + /* + * Unset the callback function for network listener to make another + * vhost-user client keeping waiting until this client disconnects + */ + qio_net_listener_set_client_func(server->listener, + NULL, + NULL, + NULL); + server->sioc = sioc; + /* + * Increase the object reference, so sioc will not freed by + * qio_net_listener_channel_func which will call object_unref(OBJECT(sioc)) + */ + object_ref(OBJECT(server->sioc)); + qio_channel_set_name(QIO_CHANNEL(sioc), "vhost-user client"); + server->ioc = QIO_CHANNEL(sioc); + object_ref(OBJECT(server->ioc)); + qio_channel_attach_aio_context(server->ioc, server->ctx); + qio_channel_set_blocking(QIO_CHANNEL(server->sioc), false, NULL); + vu_client_start(server); +} + + +void vhost_user_server_stop(VuServer *server) +{ + if (server->sioc) { + close_client(server); + } + + if (server->listener) { + qio_net_listener_disconnect(server->listener); + object_unref(OBJECT(server->listener)); + } + +} + +void vhost_user_server_set_aio_context(VuServer *server, AioContext *ctx) +{ + VuFdWatch *vu_fd_watch, *next; + void *opaque = NULL; + IOHandler *io_read = NULL; + bool attach; + + server->ctx = ctx ? ctx : qemu_get_aio_context(); + + if (!server->sioc) { + /* not yet serving any client*/ + return; + } + + if (ctx) { + qio_channel_attach_aio_context(server->ioc, ctx); + server->aio_context_changed = true; + io_read = kick_handler; + attach = true; + } else { + qio_channel_detach_aio_context(server->ioc); + /* server->ioc->ctx keeps the old AioConext */ + ctx = server->ioc->ctx; + attach = false; + } + + QTAILQ_FOREACH_SAFE(vu_fd_watch, &server->vu_fd_watches, next, next) { + if (vu_fd_watch->cb) { + opaque = attach ? vu_fd_watch : NULL; + aio_set_fd_handler(ctx, vu_fd_watch->fd, true, + io_read, NULL, NULL, + opaque); + } + } +} + + +bool vhost_user_server_start(VuServer *server, + SocketAddress *socket_addr, + AioContext *ctx, + uint16_t max_queues, + DevicePanicNotifierFn *device_panic_notifier, + const VuDevIface *vu_iface, + Error **errp) +{ + QIONetListener *listener = qio_net_listener_new(); + if (qio_net_listener_open_sync(listener, socket_addr, 1, + errp) < 0) { + object_unref(OBJECT(listener)); + return false; + } + + /* zero out unspecified fileds */ + *server = (VuServer) { + .listener = listener, + .vu_iface = vu_iface, + .max_queues = max_queues, + .ctx = ctx, + .device_panic_notifier = device_panic_notifier, + }; + + qio_net_listener_set_name(server->listener, "vhost-user-backend-listener"); + + qio_net_listener_set_client_func(server->listener, + vu_accept, + server, + NULL); + + QTAILQ_INIT(&server->vu_fd_watches); + return true; +} diff --git a/util/meson.build b/util/meson.build index XXXXXXX..XXXXXXX 100644 --- a/util/meson.build +++ b/util/meson.build @@ -XXX,XX +XXX,XX @@ if have_block util_ss.add(files('main-loop.c')) util_ss.add(files('nvdimm-utils.c')) util_ss.add(files('qemu-coroutine.c', 'qemu-coroutine-lock.c', 'qemu-coroutine-io.c')) + util_ss.add(when: 'CONFIG_LINUX', if_true: files('vhost-user-server.c')) util_ss.add(files('qemu-coroutine-sleep.c')) util_ss.add(files('qemu-co-shared-resource.c')) util_ss.add(files('thread-pool.c', 'qemu-timer.c')) -- 2.26.2 From: Coiby Xu <coiby.xu@gmail.com> Move the constants from hw/core/qdev-properties.c to util/block-helpers.h so that knowledge of the min/max values is Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Coiby Xu <coiby.xu@gmail.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Acked-by: Eduardo Habkost <ehabkost@redhat.com> Message-id: 20200918080912.321299-5-coiby.xu@gmail.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- util/block-helpers.h | 19 +++++++++++++ hw/core/qdev-properties-system.c | 31 ++++----------------- util/block-helpers.c | 46 ++++++++++++++++++++++++++++++++ util/meson.build | 1 + 4 files changed, 71 insertions(+), 26 deletions(-) create mode 100644 util/block-helpers.h create mode 100644 util/block-helpers.c diff --git a/util/block-helpers.h b/util/block-helpers.h new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/util/block-helpers.h @@ -XXX,XX +XXX,XX @@ +#ifndef BLOCK_HELPERS_H +#define BLOCK_HELPERS_H + +#include "qemu/units.h" + +/* lower limit is sector size */ +#define MIN_BLOCK_SIZE INT64_C(512) +#define MIN_BLOCK_SIZE_STR "512 B" +/* + * upper limit is arbitrary, 2 MiB looks sufficient for all sensible uses, and + * matches qcow2 cluster size limit + */ +#define MAX_BLOCK_SIZE (2 * MiB) +#define MAX_BLOCK_SIZE_STR "2 MiB" + +void check_block_size(const char *id, const char *name, int64_t value, + Error **errp); + +#endif /* BLOCK_HELPERS_H */ diff --git a/hw/core/qdev-properties-system.c b/hw/core/qdev-properties-system.c index XXXXXXX..XXXXXXX 100644 --- a/hw/core/qdev-properties-system.c +++ b/hw/core/qdev-properties-system.c @@ -XXX,XX +XXX,XX @@ #include "sysemu/blockdev.h" #include "net/net.h" #include "hw/pci/pci.h" +#include "util/block-helpers.h" static bool check_prop_still_unset(DeviceState *dev, const char *name, const void *old_val, const char *new_val, @@ -XXX,XX +XXX,XX @@ const PropertyInfo qdev_prop_losttickpolicy = { /* --- blocksize --- */ -/* lower limit is sector size */ -#define MIN_BLOCK_SIZE 512 -#define MIN_BLOCK_SIZE_STR "512 B" -/* - * upper limit is arbitrary, 2 MiB looks sufficient for all sensible uses, and - * matches qcow2 cluster size limit - */ -#define MAX_BLOCK_SIZE (2 * MiB) -#define MAX_BLOCK_SIZE_STR "2 MiB" - static void set_blocksize(Object *obj, Visitor *v, const char *name, void *opaque, Error **errp) { @@ -XXX,XX +XXX,XX @@ static void set_blocksize(Object *obj, Visitor *v, const char *name, Property *prop = opaque; uint32_t *ptr = qdev_get_prop_ptr(dev, prop); uint64_t value; + Error *local_err = NULL; if (dev->realized) { qdev_prop_set_after_realize(dev, name, errp); @@ -XXX,XX +XXX,XX @@ static void set_blocksize(Object *obj, Visitor *v, const char *name, if (!visit_type_size(v, name, &value, errp)) { return; } - /* value of 0 means "unset" */ - if (value && (value < MIN_BLOCK_SIZE || value > MAX_BLOCK_SIZE)) { - error_setg(errp, - "Property %s.%s doesn't take value %" PRIu64 - " (minimum: " MIN_BLOCK_SIZE_STR - ", maximum: " MAX_BLOCK_SIZE_STR ")", - dev->id ? : "", name, value); + check_block_size(dev->id ? : "", name, value, &local_err); + if (local_err) { + error_propagate(errp, local_err); return; } - - /* We rely on power-of-2 blocksizes for bitmasks */ - if ((value & (value - 1)) != 0) { - error_setg(errp, - "Property %s.%s doesn't take value '%" PRId64 "', " - "it's not a power of 2", dev->id ?: "", name, (int64_t)value); - return; - } - *ptr = value; } diff --git a/util/block-helpers.c b/util/block-helpers.c new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/util/block-helpers.c @@ -XXX,XX +XXX,XX @@ +/* + * Block utility functions + * + * Copyright IBM, Corp. 2011 + * Copyright (c) 2020 Coiby Xu <coiby.xu@gmail.com> + * + * This work is licensed under the terms of the GNU GPL, version 2 or later. + * See the COPYING file in the top-level directory. + */ + +#include "qemu/osdep.h" +#include "qapi/error.h" +#include "qapi/qmp/qerror.h" +#include "block-helpers.h" + +/** + * check_block_size: + * @id: The unique ID of the object + * @name: The name of the property being validated + * @value: The block size in bytes + * @errp: A pointer to an area to store an error + * + * This function checks that the block size meets the following conditions: + * 1. At least MIN_BLOCK_SIZE + * 2. No larger than MAX_BLOCK_SIZE + * 3. A power of 2 + */ +void check_block_size(const char *id, const char *name, int64_t value, + Error **errp) +{ + /* value of 0 means "unset" */ + if (value && (value < MIN_BLOCK_SIZE || value > MAX_BLOCK_SIZE)) { + error_setg(errp, QERR_PROPERTY_VALUE_OUT_OF_RANGE, + id, name, value, MIN_BLOCK_SIZE, MAX_BLOCK_SIZE); + return; + } + + /* We rely on power-of-2 blocksizes for bitmasks */ + if ((value & (value - 1)) != 0) { + error_setg(errp, + "Property %s.%s doesn't take value '%" PRId64 + "', it's not a power of 2", + id, name, value); + return; + } +} diff --git a/util/meson.build b/util/meson.build index XXXXXXX..XXXXXXX 100644 --- a/util/meson.build +++ b/util/meson.build @@ -XXX,XX +XXX,XX @@ if have_block util_ss.add(files('nvdimm-utils.c')) util_ss.add(files('qemu-coroutine.c', 'qemu-coroutine-lock.c', 'qemu-coroutine-io.c')) util_ss.add(when: 'CONFIG_LINUX', if_true: files('vhost-user-server.c')) + util_ss.add(files('block-helpers.c')) util_ss.add(files('qemu-coroutine-sleep.c')) util_ss.add(files('qemu-co-shared-resource.c')) util_ss.add(files('thread-pool.c', 'qemu-timer.c')) -- 2.26.2 From: Coiby Xu <coiby.xu@gmail.com> By making use of libvhost-user, block device drive can be shared to the connected vhost-user client. Only one client can connect to the server one time. Since vhost-user-server needs a block drive to be created first, delay the creation of this object. Suggested-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Coiby Xu <coiby.xu@gmail.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20200918080912.321299-6-coiby.xu@gmail.com [Shorten "vhost_user_blk_server" string to "vhost_user_blk" to avoid the following compiler warning: ../block/export/vhost-user-blk-server.c:178:50: error: ‘%s’ directive output truncated writing 21 bytes into a region of size 20 [-Werror=format-truncation=] and fix "Invalid size %ld ..." ssize_t format string arguments for 32-bit hosts. --Stefan] Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- block/export/vhost-user-blk-server.h | 36 ++ block/export/vhost-user-blk-server.c | 661 +++++++++++++++++++++++++++ softmmu/vl.c | 4 + block/meson.build | 1 + 4 files changed, 702 insertions(+) create mode 100644 block/export/vhost-user-blk-server.h create mode 100644 block/export/vhost-user-blk-server.c diff --git a/block/export/vhost-user-blk-server.h b/block/export/vhost-user-blk-server.h new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/block/export/vhost-user-blk-server.h @@ -XXX,XX +XXX,XX @@ +/* + * Sharing QEMU block devices via vhost-user protocal + * + * Copyright (c) Coiby Xu <coiby.xu@gmail.com>. + * Copyright (c) 2020 Red Hat, Inc. + * + * This work is licensed under the terms of the GNU GPL, version 2 or + * later. See the COPYING file in the top-level directory. + */ + +#ifndef VHOST_USER_BLK_SERVER_H +#define VHOST_USER_BLK_SERVER_H +#include "util/vhost-user-server.h" + +typedef struct VuBlockDev VuBlockDev; +#define TYPE_VHOST_USER_BLK_SERVER "vhost-user-blk-server" +#define VHOST_USER_BLK_SERVER(obj) \ + OBJECT_CHECK(VuBlockDev, obj, TYPE_VHOST_USER_BLK_SERVER) + +/* vhost user block device */ +struct VuBlockDev { + Object parent_obj; + char *node_name; + SocketAddress *addr; + AioContext *ctx; + VuServer vu_server; + bool running; + uint32_t blk_size; + BlockBackend *backend; + QIOChannelSocket *sioc; + QTAILQ_ENTRY(VuBlockDev) next; + struct virtio_blk_config blkcfg; + bool writable; +}; + +#endif /* VHOST_USER_BLK_SERVER_H */ diff --git a/block/export/vhost-user-blk-server.c b/block/export/vhost-user-blk-server.c new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/block/export/vhost-user-blk-server.c @@ -XXX,XX +XXX,XX @@ +/* + * Sharing QEMU block devices via vhost-user protocal + * + * Parts of the code based on nbd/server.c. + * + * Copyright (c) Coiby Xu <coiby.xu@gmail.com>. + * Copyright (c) 2020 Red Hat, Inc. + * + * This work is licensed under the terms of the GNU GPL, version 2 or + * later. See the COPYING file in the top-level directory. + */ +#include "qemu/osdep.h" +#include "block/block.h" +#include "vhost-user-blk-server.h" +#include "qapi/error.h" +#include "qom/object_interfaces.h" +#include "sysemu/block-backend.h" +#include "util/block-helpers.h" + +enum { + VHOST_USER_BLK_MAX_QUEUES = 1, +}; +struct virtio_blk_inhdr { + unsigned char status; +}; + +typedef struct VuBlockReq { + VuVirtqElement *elem; + int64_t sector_num; + size_t size; + struct virtio_blk_inhdr *in; + struct virtio_blk_outhdr out; + VuServer *server; + struct VuVirtq *vq; +} VuBlockReq; + +static void vu_block_req_complete(VuBlockReq *req) +{ + VuDev *vu_dev = &req->server->vu_dev; + + /* IO size with 1 extra status byte */ + vu_queue_push(vu_dev, req->vq, req->elem, req->size + 1); + vu_queue_notify(vu_dev, req->vq); + + if (req->elem) { + free(req->elem); + } + + g_free(req); +} + +static VuBlockDev *get_vu_block_device_by_server(VuServer *server) +{ + return container_of(server, VuBlockDev, vu_server); +} + +static int coroutine_fn +vu_block_discard_write_zeroes(VuBlockReq *req, struct iovec *iov, + uint32_t iovcnt, uint32_t type) +{ + struct virtio_blk_discard_write_zeroes desc; + ssize_t size = iov_to_buf(iov, iovcnt, 0, &desc, sizeof(desc)); + if (unlikely(size != sizeof(desc))) { + error_report("Invalid size %zd, expect %zu", size, sizeof(desc)); + return -EINVAL; + } + + VuBlockDev *vdev_blk = get_vu_block_device_by_server(req->server); + uint64_t range[2] = { le64_to_cpu(desc.sector) << 9, + le32_to_cpu(desc.num_sectors) << 9 }; + if (type == VIRTIO_BLK_T_DISCARD) { + if (blk_co_pdiscard(vdev_blk->backend, range[0], range[1]) == 0) { + return 0; + } + } else if (type == VIRTIO_BLK_T_WRITE_ZEROES) { + if (blk_co_pwrite_zeroes(vdev_blk->backend, + range[0], range[1], 0) == 0) { + return 0; + } + } + + return -EINVAL; +} + +static void coroutine_fn vu_block_flush(VuBlockReq *req) +{ + VuBlockDev *vdev_blk = get_vu_block_device_by_server(req->server); + BlockBackend *backend = vdev_blk->backend; + blk_co_flush(backend); +} + +struct req_data { + VuServer *server; + VuVirtq *vq; + VuVirtqElement *elem; +}; + +static void coroutine_fn vu_block_virtio_process_req(void *opaque) +{ + struct req_data *data = opaque; + VuServer *server = data->server; + VuVirtq *vq = data->vq; + VuVirtqElement *elem = data->elem; + uint32_t type; + VuBlockReq *req; + + VuBlockDev *vdev_blk = get_vu_block_device_by_server(server); + BlockBackend *backend = vdev_blk->backend; + + struct iovec *in_iov = elem->in_sg; + struct iovec *out_iov = elem->out_sg; + unsigned in_num = elem->in_num; + unsigned out_num = elem->out_num; + /* refer to hw/block/virtio_blk.c */ + if (elem->out_num < 1 || elem->in_num < 1) { + error_report("virtio-blk request missing headers"); + free(elem); + return; + } + + req = g_new0(VuBlockReq, 1); + req->server = server; + req->vq = vq; + req->elem = elem; + + if (unlikely(iov_to_buf(out_iov, out_num, 0, &req->out, + sizeof(req->out)) != sizeof(req->out))) { + error_report("virtio-blk request outhdr too short"); + goto err; + } + + iov_discard_front(&out_iov, &out_num, sizeof(req->out)); + + if (in_iov[in_num - 1].iov_len < sizeof(struct virtio_blk_inhdr)) { + error_report("virtio-blk request inhdr too short"); + goto err; + } + + /* We always touch the last byte, so just see how big in_iov is. */ + req->in = (void *)in_iov[in_num - 1].iov_base + + in_iov[in_num - 1].iov_len + - sizeof(struct virtio_blk_inhdr); + iov_discard_back(in_iov, &in_num, sizeof(struct virtio_blk_inhdr)); + + type = le32_to_cpu(req->out.type); + switch (type & ~VIRTIO_BLK_T_BARRIER) { + case VIRTIO_BLK_T_IN: + case VIRTIO_BLK_T_OUT: { + ssize_t ret = 0; + bool is_write = type & VIRTIO_BLK_T_OUT; + req->sector_num = le64_to_cpu(req->out.sector); + + int64_t offset = req->sector_num * vdev_blk->blk_size; + QEMUIOVector qiov; + if (is_write) { + qemu_iovec_init_external(&qiov, out_iov, out_num); + ret = blk_co_pwritev(backend, offset, qiov.size, + &qiov, 0); + } else { + qemu_iovec_init_external(&qiov, in_iov, in_num); + ret = blk_co_preadv(backend, offset, qiov.size, + &qiov, 0); + } + if (ret >= 0) { + req->in->status = VIRTIO_BLK_S_OK; + } else { + req->in->status = VIRTIO_BLK_S_IOERR; + } + break; + } + case VIRTIO_BLK_T_FLUSH: + vu_block_flush(req); + req->in->status = VIRTIO_BLK_S_OK; + break; + case VIRTIO_BLK_T_GET_ID: { + size_t size = MIN(iov_size(&elem->in_sg[0], in_num), + VIRTIO_BLK_ID_BYTES); + snprintf(elem->in_sg[0].iov_base, size, "%s", "vhost_user_blk"); + req->in->status = VIRTIO_BLK_S_OK; + req->size = elem->in_sg[0].iov_len; + break; + } + case VIRTIO_BLK_T_DISCARD: + case VIRTIO_BLK_T_WRITE_ZEROES: { + int rc; + rc = vu_block_discard_write_zeroes(req, &elem->out_sg[1], + out_num, type); + if (rc == 0) { + req->in->status = VIRTIO_BLK_S_OK; + } else { + req->in->status = VIRTIO_BLK_S_IOERR; + } + break; + } + default: + req->in->status = VIRTIO_BLK_S_UNSUPP; + break; + } + + vu_block_req_complete(req); + return; + +err: + free(elem); + g_free(req); + return; +} + +static void vu_block_process_vq(VuDev *vu_dev, int idx) +{ + VuServer *server; + VuVirtq *vq; + struct req_data *req_data; + + server = container_of(vu_dev, VuServer, vu_dev); + assert(server); + + vq = vu_get_queue(vu_dev, idx); + assert(vq); + VuVirtqElement *elem; + while (1) { + elem = vu_queue_pop(vu_dev, vq, sizeof(VuVirtqElement) + + sizeof(VuBlockReq)); + if (elem) { + req_data = g_new0(struct req_data, 1); + req_data->server = server; + req_data->vq = vq; + req_data->elem = elem; + Coroutine *co = qemu_coroutine_create(vu_block_virtio_process_req, + req_data); + aio_co_enter(server->ioc->ctx, co); + } else { + break; + } + } +} + +static void vu_block_queue_set_started(VuDev *vu_dev, int idx, bool started) +{ + VuVirtq *vq; + + assert(vu_dev); + + vq = vu_get_queue(vu_dev, idx); + vu_set_queue_handler(vu_dev, vq, started ? vu_block_process_vq : NULL); +} + +static uint64_t vu_block_get_features(VuDev *dev) +{ + uint64_t features; + VuServer *server = container_of(dev, VuServer, vu_dev); + VuBlockDev *vdev_blk = get_vu_block_device_by_server(server); + features = 1ull << VIRTIO_BLK_F_SIZE_MAX | + 1ull << VIRTIO_BLK_F_SEG_MAX | + 1ull << VIRTIO_BLK_F_TOPOLOGY | + 1ull << VIRTIO_BLK_F_BLK_SIZE | + 1ull << VIRTIO_BLK_F_FLUSH | + 1ull << VIRTIO_BLK_F_DISCARD | + 1ull << VIRTIO_BLK_F_WRITE_ZEROES | + 1ull << VIRTIO_BLK_F_CONFIG_WCE | + 1ull << VIRTIO_F_VERSION_1 | + 1ull << VIRTIO_RING_F_INDIRECT_DESC | + 1ull << VIRTIO_RING_F_EVENT_IDX | + 1ull << VHOST_USER_F_PROTOCOL_FEATURES; + + if (!vdev_blk->writable) { + features |= 1ull << VIRTIO_BLK_F_RO; + } + + return features; +} + +static uint64_t vu_block_get_protocol_features(VuDev *dev) +{ + return 1ull << VHOST_USER_PROTOCOL_F_CONFIG | + 1ull << VHOST_USER_PROTOCOL_F_INFLIGHT_SHMFD; +} + +static int +vu_block_get_config(VuDev *vu_dev, uint8_t *config, uint32_t len) +{ + VuServer *server = container_of(vu_dev, VuServer, vu_dev); + VuBlockDev *vdev_blk = get_vu_block_device_by_server(server); + memcpy(config, &vdev_blk->blkcfg, len); + + return 0; +} + +static int +vu_block_set_config(VuDev *vu_dev, const uint8_t *data, + uint32_t offset, uint32_t size, uint32_t flags) +{ + VuServer *server = container_of(vu_dev, VuServer, vu_dev); + VuBlockDev *vdev_blk = get_vu_block_device_by_server(server); + uint8_t wce; + + /* don't support live migration */ + if (flags != VHOST_SET_CONFIG_TYPE_MASTER) { + return -EINVAL; + } + + if (offset != offsetof(struct virtio_blk_config, wce) || + size != 1) { + return -EINVAL; + } + + wce = *data; + vdev_blk->blkcfg.wce = wce; + blk_set_enable_write_cache(vdev_blk->backend, wce); + return 0; +} + +/* + * When the client disconnects, it sends a VHOST_USER_NONE request + * and vu_process_message will simple call exit which cause the VM + * to exit abruptly. + * To avoid this issue, process VHOST_USER_NONE request ahead + * of vu_process_message. + * + */ +static int vu_block_process_msg(VuDev *dev, VhostUserMsg *vmsg, int *do_reply) +{ + if (vmsg->request == VHOST_USER_NONE) { + dev->panic(dev, "disconnect"); + return true; + } + return false; +} + +static const VuDevIface vu_block_iface = { + .get_features = vu_block_get_features, + .queue_set_started = vu_block_queue_set_started, + .get_protocol_features = vu_block_get_protocol_features, + .get_config = vu_block_get_config, + .set_config = vu_block_set_config, + .process_msg = vu_block_process_msg, +}; + +static void blk_aio_attached(AioContext *ctx, void *opaque) +{ + VuBlockDev *vub_dev = opaque; + aio_context_acquire(ctx); + vhost_user_server_set_aio_context(&vub_dev->vu_server, ctx); + aio_context_release(ctx); +} + +static void blk_aio_detach(void *opaque) +{ + VuBlockDev *vub_dev = opaque; + AioContext *ctx = vub_dev->vu_server.ctx; + aio_context_acquire(ctx); + vhost_user_server_set_aio_context(&vub_dev->vu_server, NULL); + aio_context_release(ctx); +} + +static void +vu_block_initialize_config(BlockDriverState *bs, + struct virtio_blk_config *config, uint32_t blk_size) +{ + config->capacity = bdrv_getlength(bs) >> BDRV_SECTOR_BITS; + config->blk_size = blk_size; + config->size_max = 0; + config->seg_max = 128 - 2; + config->min_io_size = 1; + config->opt_io_size = 1; + config->num_queues = VHOST_USER_BLK_MAX_QUEUES; + config->max_discard_sectors = 32768; + config->max_discard_seg = 1; + config->discard_sector_alignment = config->blk_size >> 9; + config->max_write_zeroes_sectors = 32768; + config->max_write_zeroes_seg = 1; +} + +static VuBlockDev *vu_block_init(VuBlockDev *vu_block_device, Error **errp) +{ + + BlockBackend *blk; + Error *local_error = NULL; + const char *node_name = vu_block_device->node_name; + bool writable = vu_block_device->writable; + uint64_t perm = BLK_PERM_CONSISTENT_READ; + int ret; + + AioContext *ctx; + + BlockDriverState *bs = bdrv_lookup_bs(node_name, node_name, &local_error); + + if (!bs) { + error_propagate(errp, local_error); + return NULL; + } + + if (bdrv_is_read_only(bs)) { + writable = false; + } + + if (writable) { + perm |= BLK_PERM_WRITE; + } + + ctx = bdrv_get_aio_context(bs); + aio_context_acquire(ctx); + bdrv_invalidate_cache(bs, NULL); + aio_context_release(ctx); + + /* + * Don't allow resize while the vhost user server is running, + * otherwise we don't care what happens with the node. + */ + blk = blk_new(bdrv_get_aio_context(bs), perm, + BLK_PERM_CONSISTENT_READ | BLK_PERM_WRITE_UNCHANGED | + BLK_PERM_WRITE | BLK_PERM_GRAPH_MOD); + ret = blk_insert_bs(blk, bs, errp); + + if (ret < 0) { + goto fail; + } + + blk_set_enable_write_cache(blk, false); + + blk_set_allow_aio_context_change(blk, true); + + vu_block_device->blkcfg.wce = 0; + vu_block_device->backend = blk; + if (!vu_block_device->blk_size) { + vu_block_device->blk_size = BDRV_SECTOR_SIZE; + } + vu_block_device->blkcfg.blk_size = vu_block_device->blk_size; + blk_set_guest_block_size(blk, vu_block_device->blk_size); + vu_block_initialize_config(bs, &vu_block_device->blkcfg, + vu_block_device->blk_size); + return vu_block_device; + +fail: + blk_unref(blk); + return NULL; +} + +static void vu_block_deinit(VuBlockDev *vu_block_device) +{ + if (vu_block_device->backend) { + blk_remove_aio_context_notifier(vu_block_device->backend, blk_aio_attached, + blk_aio_detach, vu_block_device); + } + + blk_unref(vu_block_device->backend); +} + +static void vhost_user_blk_server_stop(VuBlockDev *vu_block_device) +{ + vhost_user_server_stop(&vu_block_device->vu_server); + vu_block_deinit(vu_block_device); +} + +static void vhost_user_blk_server_start(VuBlockDev *vu_block_device, + Error **errp) +{ + AioContext *ctx; + SocketAddress *addr = vu_block_device->addr; + + if (!vu_block_init(vu_block_device, errp)) { + return; + } + + ctx = bdrv_get_aio_context(blk_bs(vu_block_device->backend)); + + if (!vhost_user_server_start(&vu_block_device->vu_server, addr, ctx, + VHOST_USER_BLK_MAX_QUEUES, + NULL, &vu_block_iface, + errp)) { + goto error; + } + + blk_add_aio_context_notifier(vu_block_device->backend, blk_aio_attached, + blk_aio_detach, vu_block_device); + vu_block_device->running = true; + return; + + error: + vu_block_deinit(vu_block_device); +} + +static bool vu_prop_modifiable(VuBlockDev *vus, Error **errp) +{ + if (vus->running) { + error_setg(errp, "The property can't be modified " + "while the server is running"); + return false; + } + return true; +} + +static void vu_set_node_name(Object *obj, const char *value, Error **errp) +{ + VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj); + + if (!vu_prop_modifiable(vus, errp)) { + return; + } + + if (vus->node_name) { + g_free(vus->node_name); + } + + vus->node_name = g_strdup(value); +} + +static char *vu_get_node_name(Object *obj, Error **errp) +{ + VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj); + return g_strdup(vus->node_name); +} + +static void free_socket_addr(SocketAddress *addr) +{ + g_free(addr->u.q_unix.path); + g_free(addr); +} + +static void vu_set_unix_socket(Object *obj, const char *value, + Error **errp) +{ + VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj); + + if (!vu_prop_modifiable(vus, errp)) { + return; + } + + if (vus->addr) { + free_socket_addr(vus->addr); + } + + SocketAddress *addr = g_new0(SocketAddress, 1); + addr->type = SOCKET_ADDRESS_TYPE_UNIX; + addr->u.q_unix.path = g_strdup(value); + vus->addr = addr; +} + +static char *vu_get_unix_socket(Object *obj, Error **errp) +{ + VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj); + return g_strdup(vus->addr->u.q_unix.path); +} + +static bool vu_get_block_writable(Object *obj, Error **errp) +{ + VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj); + return vus->writable; +} + +static void vu_set_block_writable(Object *obj, bool value, Error **errp) +{ + VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj); + + if (!vu_prop_modifiable(vus, errp)) { + return; + } + + vus->writable = value; +} + +static void vu_get_blk_size(Object *obj, Visitor *v, const char *name, + void *opaque, Error **errp) +{ + VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj); + uint32_t value = vus->blk_size; + + visit_type_uint32(v, name, &value, errp); +} + +static void vu_set_blk_size(Object *obj, Visitor *v, const char *name, + void *opaque, Error **errp) +{ + VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj); + + Error *local_err = NULL; + uint32_t value; + + if (!vu_prop_modifiable(vus, errp)) { + return; + } + + visit_type_uint32(v, name, &value, &local_err); + if (local_err) { + goto out; + } + + check_block_size(object_get_typename(obj), name, value, &local_err); + if (local_err) { + goto out; + } + + vus->blk_size = value; + +out: + error_propagate(errp, local_err); +} + +static void vhost_user_blk_server_instance_finalize(Object *obj) +{ + VuBlockDev *vub = VHOST_USER_BLK_SERVER(obj); + + vhost_user_blk_server_stop(vub); + + /* + * Unlike object_property_add_str, object_class_property_add_str + * doesn't have a release method. Thus manual memory freeing is + * needed. + */ + free_socket_addr(vub->addr); + g_free(vub->node_name); +} + +static void vhost_user_blk_server_complete(UserCreatable *obj, Error **errp) +{ + VuBlockDev *vub = VHOST_USER_BLK_SERVER(obj); + + vhost_user_blk_server_start(vub, errp); +} + +static void vhost_user_blk_server_class_init(ObjectClass *klass, + void *class_data) +{ + UserCreatableClass *ucc = USER_CREATABLE_CLASS(klass); + ucc->complete = vhost_user_blk_server_complete; + + object_class_property_add_bool(klass, "writable", + vu_get_block_writable, + vu_set_block_writable); + + object_class_property_add_str(klass, "node-name", + vu_get_node_name, + vu_set_node_name); + + object_class_property_add_str(klass, "unix-socket", + vu_get_unix_socket, + vu_set_unix_socket); + + object_class_property_add(klass, "logical-block-size", "uint32", + vu_get_blk_size, vu_set_blk_size, + NULL, NULL); +} + +static const TypeInfo vhost_user_blk_server_info = { + .name = TYPE_VHOST_USER_BLK_SERVER, + .parent = TYPE_OBJECT, + .instance_size = sizeof(VuBlockDev), + .instance_finalize = vhost_user_blk_server_instance_finalize, + .class_init = vhost_user_blk_server_class_init, + .interfaces = (InterfaceInfo[]) { + {TYPE_USER_CREATABLE}, + {} + }, +}; + +static void vhost_user_blk_server_register_types(void) +{ + type_register_static(&vhost_user_blk_server_info); +} + +type_init(vhost_user_blk_server_register_types) diff --git a/softmmu/vl.c b/softmmu/vl.c index XXXXXXX..XXXXXXX 100644 --- a/softmmu/vl.c +++ b/softmmu/vl.c @@ -XXX,XX +XXX,XX @@ static bool object_create_initial(const char *type, QemuOpts *opts) } #endif + /* Reason: vhost-user-blk-server property "node-name" */ + if (g_str_equal(type, "vhost-user-blk-server")) { + return false; + } /* * Reason: filter-* property "netdev" etc. */ diff --git a/block/meson.build b/block/meson.build index XXXXXXX..XXXXXXX 100644 --- a/block/meson.build +++ b/block/meson.build @@ -XXX,XX +XXX,XX @@ block_ss.add(when: 'CONFIG_WIN32', if_true: files('file-win32.c', 'win32-aio.c') block_ss.add(when: 'CONFIG_POSIX', if_true: [files('file-posix.c'), coref, iokit]) block_ss.add(when: 'CONFIG_LIBISCSI', if_true: files('iscsi-opts.c')) block_ss.add(when: 'CONFIG_LINUX', if_true: files('nvme.c')) +block_ss.add(when: 'CONFIG_LINUX', if_true: files('export/vhost-user-blk-server.c', '../contrib/libvhost-user/libvhost-user.c')) block_ss.add(when: 'CONFIG_REPLICATION', if_true: files('replication.c')) block_ss.add(when: 'CONFIG_SHEEPDOG', if_true: files('sheepdog.c')) block_ss.add(when: ['CONFIG_LINUX_AIO', libaio], if_true: files('linux-aio.c')) -- 2.26.2 From: Coiby Xu <coiby.xu@gmail.com> Suggested-by: Stefano Garzarella <sgarzare@redhat.com> Signed-off-by: Coiby Xu <coiby.xu@gmail.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20200918080912.321299-8-coiby.xu@gmail.com [Removed reference to vhost-user-blk-test.c, it will be sent in a separate pull request. --Stefan] Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- MAINTAINERS | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/MAINTAINERS b/MAINTAINERS index XXXXXXX..XXXXXXX 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -XXX,XX +XXX,XX @@ L: qemu-block@nongnu.org S: Supported F: tests/image-fuzzer/ +Vhost-user block device backend server +M: Coiby Xu <Coiby.Xu@gmail.com> +S: Maintained +F: block/export/vhost-user-blk-server.c +F: util/vhost-user-server.c +F: tests/qtest/libqos/vhost-user-blk.c + Replication M: Wen Congyang <wencongyang2@huawei.com> M: Xie Changlong <xiechanglong.d@gmail.com> -- 2.26.2 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20200924151549.913737-3-stefanha@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- util/vhost-user-server.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/util/vhost-user-server.c b/util/vhost-user-server.c index XXXXXXX..XXXXXXX 100644 --- a/util/vhost-user-server.c +++ b/util/vhost-user-server.c @@ -XXX,XX +XXX,XX @@ bool vhost_user_server_start(VuServer *server, return false; } - /* zero out unspecified fileds */ + /* zero out unspecified fields */ *server = (VuServer) { .listener = listener, .vu_iface = vu_iface, -- 2.26.2 We already have access to the value with the correct type (ioc and sioc are the same QIOChannel). Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20200924151549.913737-4-stefanha@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- util/vhost-user-server.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/util/vhost-user-server.c b/util/vhost-user-server.c index XXXXXXX..XXXXXXX 100644 --- a/util/vhost-user-server.c +++ b/util/vhost-user-server.c @@ -XXX,XX +XXX,XX @@ static void vu_accept(QIONetListener *listener, QIOChannelSocket *sioc, server->ioc = QIO_CHANNEL(sioc); object_ref(OBJECT(server->ioc)); qio_channel_attach_aio_context(server->ioc, server->ctx); - qio_channel_set_blocking(QIO_CHANNEL(server->sioc), false, NULL); + qio_channel_set_blocking(server->ioc, false, NULL); vu_client_start(server); } -- 2.26.2 Explicitly deleting watches is not necessary since libvhost-user calls remove_watch() during vu_deinit(). Add an assertion to check this though. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20200924151549.913737-5-stefanha@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- util/vhost-user-server.c | 19 ++++--------------- 1 file changed, 4 insertions(+), 15 deletions(-) diff --git a/util/vhost-user-server.c b/util/vhost-user-server.c index XXXXXXX..XXXXXXX 100644 --- a/util/vhost-user-server.c +++ b/util/vhost-user-server.c @@ -XXX,XX +XXX,XX @@ static void close_client(VuServer *server) /* When this is set vu_client_trip will stop new processing vhost-user message */ server->sioc = NULL; - VuFdWatch *vu_fd_watch, *next; - QTAILQ_FOREACH_SAFE(vu_fd_watch, &server->vu_fd_watches, next, next) { - aio_set_fd_handler(server->ioc->ctx, vu_fd_watch->fd, true, NULL, - NULL, NULL, NULL); - } - - while (!QTAILQ_EMPTY(&server->vu_fd_watches)) { - QTAILQ_FOREACH_SAFE(vu_fd_watch, &server->vu_fd_watches, next, next) { - if (!vu_fd_watch->processing) { - QTAILQ_REMOVE(&server->vu_fd_watches, vu_fd_watch, next); - g_free(vu_fd_watch); - } - } - } - while (server->processing_msg) { if (server->ioc->read_coroutine) { server->ioc->read_coroutine = NULL; @@ -XXX,XX +XXX,XX @@ static void close_client(VuServer *server) } vu_deinit(&server->vu_dev); + + /* vu_deinit() should have called remove_watch() */ + assert(QTAILQ_EMPTY(&server->vu_fd_watches)); + object_unref(OBJECT(sioc)); object_unref(OBJECT(server->ioc)); } -- 2.26.2 Only one struct is needed per request. Drop req_data and the separate VuBlockReq instance. Instead let vu_queue_pop() allocate everything at once. This fixes the req_data memory leak in vu_block_virtio_process_req(). Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20200924151549.913737-6-stefanha@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- block/export/vhost-user-blk-server.c | 68 +++++++++------------------- 1 file changed, 21 insertions(+), 47 deletions(-) diff --git a/block/export/vhost-user-blk-server.c b/block/export/vhost-user-blk-server.c index XXXXXXX..XXXXXXX 100644 --- a/block/export/vhost-user-blk-server.c +++ b/block/export/vhost-user-blk-server.c @@ -XXX,XX +XXX,XX @@ struct virtio_blk_inhdr { }; typedef struct VuBlockReq { - VuVirtqElement *elem; + VuVirtqElement elem; int64_t sector_num; size_t size; struct virtio_blk_inhdr *in; @@ -XXX,XX +XXX,XX @@ static void vu_block_req_complete(VuBlockReq *req) VuDev *vu_dev = &req->server->vu_dev; /* IO size with 1 extra status byte */ - vu_queue_push(vu_dev, req->vq, req->elem, req->size + 1); + vu_queue_push(vu_dev, req->vq, &req->elem, req->size + 1); vu_queue_notify(vu_dev, req->vq); - if (req->elem) { - free(req->elem); - } - - g_free(req); + free(req); } static VuBlockDev *get_vu_block_device_by_server(VuServer *server) @@ -XXX,XX +XXX,XX @@ static void coroutine_fn vu_block_flush(VuBlockReq *req) blk_co_flush(backend); } -struct req_data { - VuServer *server; - VuVirtq *vq; - VuVirtqElement *elem; -}; - static void coroutine_fn vu_block_virtio_process_req(void *opaque) { - struct req_data *data = opaque; - VuServer *server = data->server; - VuVirtq *vq = data->vq; - VuVirtqElement *elem = data->elem; + VuBlockReq *req = opaque; + VuServer *server = req->server; + VuVirtqElement *elem = &req->elem; uint32_t type; - VuBlockReq *req; VuBlockDev *vdev_blk = get_vu_block_device_by_server(server); BlockBackend *backend = vdev_blk->backend; @@ -XXX,XX +XXX,XX @@ static void coroutine_fn vu_block_virtio_process_req(void *opaque) struct iovec *out_iov = elem->out_sg; unsigned in_num = elem->in_num; unsigned out_num = elem->out_num; + /* refer to hw/block/virtio_blk.c */ if (elem->out_num < 1 || elem->in_num < 1) { error_report("virtio-blk request missing headers"); - free(elem); - return; + goto err; } - req = g_new0(VuBlockReq, 1); - req->server = server; - req->vq = vq; - req->elem = elem; - if (unlikely(iov_to_buf(out_iov, out_num, 0, &req->out, sizeof(req->out)) != sizeof(req->out))) { error_report("virtio-blk request outhdr too short"); @@ -XXX,XX +XXX,XX @@ static void coroutine_fn vu_block_virtio_process_req(void *opaque) err: free(elem); - g_free(req); - return; } static void vu_block_process_vq(VuDev *vu_dev, int idx) { - VuServer *server; - VuVirtq *vq; - struct req_data *req_data; + VuServer *server = container_of(vu_dev, VuServer, vu_dev); + VuVirtq *vq = vu_get_queue(vu_dev, idx); - server = container_of(vu_dev, VuServer, vu_dev); - assert(server); - - vq = vu_get_queue(vu_dev, idx); - assert(vq); - VuVirtqElement *elem; while (1) { - elem = vu_queue_pop(vu_dev, vq, sizeof(VuVirtqElement) + - sizeof(VuBlockReq)); - if (elem) { - req_data = g_new0(struct req_data, 1); - req_data->server = server; - req_data->vq = vq; - req_data->elem = elem; - Coroutine *co = qemu_coroutine_create(vu_block_virtio_process_req, - req_data); - aio_co_enter(server->ioc->ctx, co); - } else { + VuBlockReq *req; + + req = vu_queue_pop(vu_dev, vq, sizeof(VuBlockReq)); + if (!req) { break; } + + req->server = server; + req->vq = vq; + + Coroutine *co = + qemu_coroutine_create(vu_block_virtio_process_req, req); + qemu_coroutine_enter(co); } } -- 2.26.2 The device panic notifier callback is not used. Drop it. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20200924151549.913737-7-stefanha@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- util/vhost-user-server.h | 3 --- block/export/vhost-user-blk-server.c | 3 +-- util/vhost-user-server.c | 6 ------ 3 files changed, 1 insertion(+), 11 deletions(-) diff --git a/util/vhost-user-server.h b/util/vhost-user-server.h index XXXXXXX..XXXXXXX 100644 --- a/util/vhost-user-server.h +++ b/util/vhost-user-server.h @@ -XXX,XX +XXX,XX @@ typedef struct VuFdWatch { } VuFdWatch; typedef struct VuServer VuServer; -typedef void DevicePanicNotifierFn(VuServer *server); struct VuServer { QIONetListener *listener; AioContext *ctx; - DevicePanicNotifierFn *device_panic_notifier; int max_queues; const VuDevIface *vu_iface; VuDev vu_dev; @@ -XXX,XX +XXX,XX @@ bool vhost_user_server_start(VuServer *server, SocketAddress *unix_socket, AioContext *ctx, uint16_t max_queues, - DevicePanicNotifierFn *device_panic_notifier, const VuDevIface *vu_iface, Error **errp); diff --git a/block/export/vhost-user-blk-server.c b/block/export/vhost-user-blk-server.c index XXXXXXX..XXXXXXX 100644 --- a/block/export/vhost-user-blk-server.c +++ b/block/export/vhost-user-blk-server.c @@ -XXX,XX +XXX,XX @@ static void vhost_user_blk_server_start(VuBlockDev *vu_block_device, ctx = bdrv_get_aio_context(blk_bs(vu_block_device->backend)); if (!vhost_user_server_start(&vu_block_device->vu_server, addr, ctx, - VHOST_USER_BLK_MAX_QUEUES, - NULL, &vu_block_iface, + VHOST_USER_BLK_MAX_QUEUES, &vu_block_iface, errp)) { goto error; } diff --git a/util/vhost-user-server.c b/util/vhost-user-server.c index XXXXXXX..XXXXXXX 100644 --- a/util/vhost-user-server.c +++ b/util/vhost-user-server.c @@ -XXX,XX +XXX,XX @@ static void panic_cb(VuDev *vu_dev, const char *buf) close_client(server); } - if (server->device_panic_notifier) { - server->device_panic_notifier(server); - } - /* * Set the callback function for network listener so another * vhost-user client can connect to this server @@ -XXX,XX +XXX,XX @@ bool vhost_user_server_start(VuServer *server, SocketAddress *socket_addr, AioContext *ctx, uint16_t max_queues, - DevicePanicNotifierFn *device_panic_notifier, const VuDevIface *vu_iface, Error **errp) { @@ -XXX,XX +XXX,XX @@ bool vhost_user_server_start(VuServer *server, .vu_iface = vu_iface, .max_queues = max_queues, .ctx = ctx, - .device_panic_notifier = device_panic_notifier, }; qio_net_listener_set_name(server->listener, "vhost-user-backend-listener"); -- 2.26.2 fds[] is leaked when qio_channel_readv_full() fails. Use vmsg->fds[] instead of keeping a local fds[] array. Then we can reuse goto fail to clean up fds. vmsg->fd_num must be zeroed before the loop to make this safe. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20200924151549.913737-8-stefanha@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- util/vhost-user-server.c | 50 ++++++++++++++++++---------------------- 1 file changed, 23 insertions(+), 27 deletions(-) diff --git a/util/vhost-user-server.c b/util/vhost-user-server.c index XXXXXXX..XXXXXXX 100644 --- a/util/vhost-user-server.c +++ b/util/vhost-user-server.c @@ -XXX,XX +XXX,XX @@ vu_message_read(VuDev *vu_dev, int conn_fd, VhostUserMsg *vmsg) }; int rc, read_bytes = 0; Error *local_err = NULL; - /* - * Store fds/nfds returned from qio_channel_readv_full into - * temporary variables. - * - * VhostUserMsg is a packed structure, gcc will complain about passing - * pointer to a packed structure member if we pass &VhostUserMsg.fd_num - * and &VhostUserMsg.fds directly when calling qio_channel_readv_full, - * thus two temporary variables nfds and fds are used here. - */ - size_t nfds = 0, nfds_t = 0; const size_t max_fds = G_N_ELEMENTS(vmsg->fds); - int *fds_t = NULL; VuServer *server = container_of(vu_dev, VuServer, vu_dev); QIOChannel *ioc = server->ioc; + vmsg->fd_num = 0; if (!ioc) { error_report_err(local_err); goto fail; @@ -XXX,XX +XXX,XX @@ vu_message_read(VuDev *vu_dev, int conn_fd, VhostUserMsg *vmsg) assert(qemu_in_coroutine()); do { + size_t nfds = 0; + int *fds = NULL; + /* * qio_channel_readv_full may have short reads, keeping calling it * until getting VHOST_USER_HDR_SIZE or 0 bytes in total */ - rc = qio_channel_readv_full(ioc, &iov, 1, &fds_t, &nfds_t, &local_err); + rc = qio_channel_readv_full(ioc, &iov, 1, &fds, &nfds, &local_err); if (rc < 0) { if (rc == QIO_CHANNEL_ERR_BLOCK) { + assert(local_err == NULL); qio_channel_yield(ioc, G_IO_IN); continue; } else { error_report_err(local_err); - return false; + goto fail; } } - read_bytes += rc; - if (nfds_t > 0) { - if (nfds + nfds_t > max_fds) { + + if (nfds > 0) { + if (vmsg->fd_num + nfds > max_fds) { error_report("A maximum of %zu fds are allowed, " "however got %zu fds now", - max_fds, nfds + nfds_t); + max_fds, vmsg->fd_num + nfds); + g_free(fds); goto fail; } - memcpy(vmsg->fds + nfds, fds_t, - nfds_t *sizeof(vmsg->fds[0])); - nfds += nfds_t; - g_free(fds_t); + memcpy(vmsg->fds + vmsg->fd_num, fds, nfds * sizeof(vmsg->fds[0])); + vmsg->fd_num += nfds; + g_free(fds); } - if (read_bytes == VHOST_USER_HDR_SIZE || rc == 0) { - break; + + if (rc == 0) { /* socket closed */ + goto fail; } - iov.iov_base = (char *)vmsg + read_bytes; - iov.iov_len = VHOST_USER_HDR_SIZE - read_bytes; - } while (true); - vmsg->fd_num = nfds; + iov.iov_base += rc; + iov.iov_len -= rc; + read_bytes += rc; + } while (read_bytes != VHOST_USER_HDR_SIZE); + /* qio_channel_readv_full will make socket fds blocking, unblock them */ vmsg_unblock_fds(vmsg); if (vmsg->size > sizeof(vmsg->payload)) { -- 2.26.2 Unexpected EOF is an error that must be reported. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20200924151549.913737-9-stefanha@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- util/vhost-user-server.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/util/vhost-user-server.c b/util/vhost-user-server.c index XXXXXXX..XXXXXXX 100644 --- a/util/vhost-user-server.c +++ b/util/vhost-user-server.c @@ -XXX,XX +XXX,XX @@ vu_message_read(VuDev *vu_dev, int conn_fd, VhostUserMsg *vmsg) }; if (vmsg->size) { rc = qio_channel_readv_all_eof(ioc, &iov_payload, 1, &local_err); - if (rc == -1) { - error_report_err(local_err); + if (rc != 1) { + if (local_err) { + error_report_err(local_err); + } goto fail; } } -- 2.26.2 The vu_client_trip() coroutine is leaked during AioContext switching. It is also unsafe to destroy the vu_dev in panic_cb() since its callers still access it in some cases. Rework the lifecycle to solve these safety issues. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20200924151549.913737-10-stefanha@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- util/vhost-user-server.h | 29 ++-- block/export/vhost-user-blk-server.c | 9 +- util/vhost-user-server.c | 245 +++++++++++++++------------ 3 files changed, 155 insertions(+), 128 deletions(-) diff --git a/util/vhost-user-server.h b/util/vhost-user-server.h index XXXXXXX..XXXXXXX 100644 --- a/util/vhost-user-server.h +++ b/util/vhost-user-server.h @@ -XXX,XX +XXX,XX @@ #include "qapi/error.h" #include "standard-headers/linux/virtio_blk.h" +/* A kick fd that we monitor on behalf of libvhost-user */ typedef struct VuFdWatch { VuDev *vu_dev; int fd; /*kick fd*/ void *pvt; vu_watch_cb cb; - bool processing; QTAILQ_ENTRY(VuFdWatch) next; } VuFdWatch; -typedef struct VuServer VuServer; - -struct VuServer { +/** + * VuServer: + * A vhost-user server instance with user-defined VuDevIface callbacks. + * Vhost-user device backends can be implemented using VuServer. VuDevIface + * callbacks and virtqueue kicks run in the given AioContext. + */ +typedef struct { QIONetListener *listener; + QEMUBH *restart_listener_bh; AioContext *ctx; int max_queues; const VuDevIface *vu_iface; + + /* Protected by ctx lock */ VuDev vu_dev; QIOChannel *ioc; /* The I/O channel with the client */ QIOChannelSocket *sioc; /* The underlying data channel with the client */ - /* IOChannel for fd provided via VHOST_USER_SET_SLAVE_REQ_FD */ - QIOChannel *ioc_slave; - QIOChannelSocket *sioc_slave; - Coroutine *co_trip; /* coroutine for processing VhostUserMsg */ QTAILQ_HEAD(, VuFdWatch) vu_fd_watches; - /* restart coroutine co_trip if AIOContext is changed */ - bool aio_context_changed; - bool processing_msg; -}; + + Coroutine *co_trip; /* coroutine for processing VhostUserMsg */ +} VuServer; bool vhost_user_server_start(VuServer *server, SocketAddress *unix_socket, @@ -XXX,XX +XXX,XX @@ bool vhost_user_server_start(VuServer *server, void vhost_user_server_stop(VuServer *server); -void vhost_user_server_set_aio_context(VuServer *server, AioContext *ctx); +void vhost_user_server_attach_aio_context(VuServer *server, AioContext *ctx); +void vhost_user_server_detach_aio_context(VuServer *server); #endif /* VHOST_USER_SERVER_H */ diff --git a/block/export/vhost-user-blk-server.c b/block/export/vhost-user-blk-server.c index XXXXXXX..XXXXXXX 100644 --- a/block/export/vhost-user-blk-server.c +++ b/block/export/vhost-user-blk-server.c @@ -XXX,XX +XXX,XX @@ static const VuDevIface vu_block_iface = { static void blk_aio_attached(AioContext *ctx, void *opaque) { VuBlockDev *vub_dev = opaque; - aio_context_acquire(ctx); - vhost_user_server_set_aio_context(&vub_dev->vu_server, ctx); - aio_context_release(ctx); + vhost_user_server_attach_aio_context(&vub_dev->vu_server, ctx); } static void blk_aio_detach(void *opaque) { VuBlockDev *vub_dev = opaque; - AioContext *ctx = vub_dev->vu_server.ctx; - aio_context_acquire(ctx); - vhost_user_server_set_aio_context(&vub_dev->vu_server, NULL); - aio_context_release(ctx); + vhost_user_server_detach_aio_context(&vub_dev->vu_server); } static void diff --git a/util/vhost-user-server.c b/util/vhost-user-server.c index XXXXXXX..XXXXXXX 100644 --- a/util/vhost-user-server.c +++ b/util/vhost-user-server.c @@ -XXX,XX +XXX,XX @@ */ #include "qemu/osdep.h" #include "qemu/main-loop.h" +#include "block/aio-wait.h" #include "vhost-user-server.h" +/* + * Theory of operation: + * + * VuServer is started and stopped by vhost_user_server_start() and + * vhost_user_server_stop() from the main loop thread. Starting the server + * opens a vhost-user UNIX domain socket and listens for incoming connections. + * Only one connection is allowed at a time. + * + * The connection is handled by the vu_client_trip() coroutine in the + * VuServer->ctx AioContext. The coroutine consists of a vu_dispatch() loop + * where libvhost-user calls vu_message_read() to receive the next vhost-user + * protocol messages over the UNIX domain socket. + * + * When virtqueues are set up libvhost-user calls set_watch() to monitor kick + * fds. These fds are also handled in the VuServer->ctx AioContext. + * + * Both vu_client_trip() and kick fd monitoring can be stopped by shutting down + * the socket connection. Shutting down the socket connection causes + * vu_message_read() to fail since no more data can be received from the socket. + * After vu_dispatch() fails, vu_client_trip() calls vu_deinit() to stop + * libvhost-user before terminating the coroutine. vu_deinit() calls + * remove_watch() to stop monitoring kick fds and this stops virtqueue + * processing. + * + * When vu_client_trip() has finished cleaning up it schedules a BH in the main + * loop thread to accept the next client connection. + * + * When libvhost-user detects an error it calls panic_cb() and sets the + * dev->broken flag. Both vu_client_trip() and kick fd processing stop when + * the dev->broken flag is set. + * + * It is possible to switch AioContexts using + * vhost_user_server_detach_aio_context() and + * vhost_user_server_attach_aio_context(). They stop monitoring fds in the old + * AioContext and resume monitoring in the new AioContext. The vu_client_trip() + * coroutine remains in a yielded state during the switch. This is made + * possible by QIOChannel's support for spurious coroutine re-entry in + * qio_channel_yield(). The coroutine will restart I/O when re-entered from the + * new AioContext. + */ + static void vmsg_close_fds(VhostUserMsg *vmsg) { int i; @@ -XXX,XX +XXX,XX @@ static void vmsg_unblock_fds(VhostUserMsg *vmsg) } } -static void vu_accept(QIONetListener *listener, QIOChannelSocket *sioc, - gpointer opaque); - -static void close_client(VuServer *server) -{ - /* - * Before closing the client - * - * 1. Let vu_client_trip stop processing new vhost-user msg - * - * 2. remove kick_handler - * - * 3. wait for the kick handler to be finished - * - * 4. wait for the current vhost-user msg to be finished processing - */ - - QIOChannelSocket *sioc = server->sioc; - /* When this is set vu_client_trip will stop new processing vhost-user message */ - server->sioc = NULL; - - while (server->processing_msg) { - if (server->ioc->read_coroutine) { - server->ioc->read_coroutine = NULL; - qio_channel_set_aio_fd_handler(server->ioc, server->ioc->ctx, NULL, - NULL, server->ioc); - server->processing_msg = false; - } - } - - vu_deinit(&server->vu_dev); - - /* vu_deinit() should have called remove_watch() */ - assert(QTAILQ_EMPTY(&server->vu_fd_watches)); - - object_unref(OBJECT(sioc)); - object_unref(OBJECT(server->ioc)); -} - static void panic_cb(VuDev *vu_dev, const char *buf) { - VuServer *server = container_of(vu_dev, VuServer, vu_dev); - - /* avoid while loop in close_client */ - server->processing_msg = false; - - if (buf) { - error_report("vu_panic: %s", buf); - } - - if (server->sioc) { - close_client(server); - } - - /* - * Set the callback function for network listener so another - * vhost-user client can connect to this server - */ - qio_net_listener_set_client_func(server->listener, - vu_accept, - server, - NULL); + error_report("vu_panic: %s", buf); } static bool coroutine_fn @@ -XXX,XX +XXX,XX @@ fail: return false; } - -static void vu_client_start(VuServer *server); static coroutine_fn void vu_client_trip(void *opaque) { VuServer *server = opaque; + VuDev *vu_dev = &server->vu_dev; - while (!server->aio_context_changed && server->sioc) { - server->processing_msg = true; - vu_dispatch(&server->vu_dev); - server->processing_msg = false; + while (!vu_dev->broken && vu_dispatch(vu_dev)) { + /* Keep running */ } - if (server->aio_context_changed && server->sioc) { - server->aio_context_changed = false; - vu_client_start(server); - } -} + vu_deinit(vu_dev); + + /* vu_deinit() should have called remove_watch() */ + assert(QTAILQ_EMPTY(&server->vu_fd_watches)); + + object_unref(OBJECT(server->sioc)); + server->sioc = NULL; -static void vu_client_start(VuServer *server) -{ - server->co_trip = qemu_coroutine_create(vu_client_trip, server); - aio_co_enter(server->ctx, server->co_trip); + object_unref(OBJECT(server->ioc)); + server->ioc = NULL; + + server->co_trip = NULL; + if (server->restart_listener_bh) { + qemu_bh_schedule(server->restart_listener_bh); + } + aio_wait_kick(); } /* @@ -XXX,XX +XXX,XX @@ static void vu_client_start(VuServer *server) static void kick_handler(void *opaque) { VuFdWatch *vu_fd_watch = opaque; - vu_fd_watch->processing = true; - vu_fd_watch->cb(vu_fd_watch->vu_dev, 0, vu_fd_watch->pvt); - vu_fd_watch->processing = false; + VuDev *vu_dev = vu_fd_watch->vu_dev; + + vu_fd_watch->cb(vu_dev, 0, vu_fd_watch->pvt); + + /* Stop vu_client_trip() if an error occurred in vu_fd_watch->cb() */ + if (vu_dev->broken) { + VuServer *server = container_of(vu_dev, VuServer, vu_dev); + + qio_channel_shutdown(server->ioc, QIO_CHANNEL_SHUTDOWN_BOTH, NULL); + } } - static VuFdWatch *find_vu_fd_watch(VuServer *server, int fd) { @@ -XXX,XX +XXX,XX @@ static void vu_accept(QIONetListener *listener, QIOChannelSocket *sioc, qio_channel_set_name(QIO_CHANNEL(sioc), "vhost-user client"); server->ioc = QIO_CHANNEL(sioc); object_ref(OBJECT(server->ioc)); - qio_channel_attach_aio_context(server->ioc, server->ctx); + + /* TODO vu_message_write() spins if non-blocking! */ qio_channel_set_blocking(server->ioc, false, NULL); - vu_client_start(server); + + server->co_trip = qemu_coroutine_create(vu_client_trip, server); + + aio_context_acquire(server->ctx); + vhost_user_server_attach_aio_context(server, server->ctx); + aio_context_release(server->ctx); } - void vhost_user_server_stop(VuServer *server) { + aio_context_acquire(server->ctx); + + qemu_bh_delete(server->restart_listener_bh); + server->restart_listener_bh = NULL; + if (server->sioc) { - close_client(server); + VuFdWatch *vu_fd_watch; + + QTAILQ_FOREACH(vu_fd_watch, &server->vu_fd_watches, next) { + aio_set_fd_handler(server->ctx, vu_fd_watch->fd, true, + NULL, NULL, NULL, vu_fd_watch); + } + + qio_channel_shutdown(server->ioc, QIO_CHANNEL_SHUTDOWN_BOTH, NULL); + + AIO_WAIT_WHILE(server->ctx, server->co_trip); } + aio_context_release(server->ctx); + if (server->listener) { qio_net_listener_disconnect(server->listener); object_unref(OBJECT(server->listener)); } +} + +/* + * Allow the next client to connect to the server. Called from a BH in the main + * loop. + */ +static void restart_listener_bh(void *opaque) +{ + VuServer *server = opaque; + qio_net_listener_set_client_func(server->listener, vu_accept, server, + NULL); } -void vhost_user_server_set_aio_context(VuServer *server, AioContext *ctx) +/* Called with ctx acquired */ +void vhost_user_server_attach_aio_context(VuServer *server, AioContext *ctx) { - VuFdWatch *vu_fd_watch, *next; - void *opaque = NULL; - IOHandler *io_read = NULL; - bool attach; + VuFdWatch *vu_fd_watch; - server->ctx = ctx ? ctx : qemu_get_aio_context(); + server->ctx = ctx; if (!server->sioc) { - /* not yet serving any client*/ return; } - if (ctx) { - qio_channel_attach_aio_context(server->ioc, ctx); - server->aio_context_changed = true; - io_read = kick_handler; - attach = true; - } else { + qio_channel_attach_aio_context(server->ioc, ctx); + + QTAILQ_FOREACH(vu_fd_watch, &server->vu_fd_watches, next) { + aio_set_fd_handler(ctx, vu_fd_watch->fd, true, kick_handler, NULL, + NULL, vu_fd_watch); + } + + aio_co_schedule(ctx, server->co_trip); +} + +/* Called with server->ctx acquired */ +void vhost_user_server_detach_aio_context(VuServer *server) +{ + if (server->sioc) { + VuFdWatch *vu_fd_watch; + + QTAILQ_FOREACH(vu_fd_watch, &server->vu_fd_watches, next) { + aio_set_fd_handler(server->ctx, vu_fd_watch->fd, true, + NULL, NULL, NULL, vu_fd_watch); + } + qio_channel_detach_aio_context(server->ioc); - /* server->ioc->ctx keeps the old AioConext */ - ctx = server->ioc->ctx; - attach = false; } - QTAILQ_FOREACH_SAFE(vu_fd_watch, &server->vu_fd_watches, next, next) { - if (vu_fd_watch->cb) { - opaque = attach ? vu_fd_watch : NULL; - aio_set_fd_handler(ctx, vu_fd_watch->fd, true, - io_read, NULL, NULL, - opaque); - } - } + server->ctx = NULL; } - bool vhost_user_server_start(VuServer *server, SocketAddress *socket_addr, AioContext *ctx, @@ -XXX,XX +XXX,XX @@ bool vhost_user_server_start(VuServer *server, const VuDevIface *vu_iface, Error **errp) { + QEMUBH *bh; QIONetListener *listener = qio_net_listener_new(); if (qio_net_listener_open_sync(listener, socket_addr, 1, errp) < 0) { @@ -XXX,XX +XXX,XX @@ bool vhost_user_server_start(VuServer *server, return false; } + bh = qemu_bh_new(restart_listener_bh, server); + /* zero out unspecified fields */ *server = (VuServer) { .listener = listener, + .restart_listener_bh = bh, .vu_iface = vu_iface, .max_queues = max_queues, .ctx = ctx, -- 2.26.2 Propagate the flush return value since errors are possible. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20200924151549.913737-11-stefanha@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- block/export/vhost-user-blk-server.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/block/export/vhost-user-blk-server.c b/block/export/vhost-user-blk-server.c index XXXXXXX..XXXXXXX 100644 --- a/block/export/vhost-user-blk-server.c +++ b/block/export/vhost-user-blk-server.c @@ -XXX,XX +XXX,XX @@ vu_block_discard_write_zeroes(VuBlockReq *req, struct iovec *iov, return -EINVAL; } -static void coroutine_fn vu_block_flush(VuBlockReq *req) +static int coroutine_fn vu_block_flush(VuBlockReq *req) { VuBlockDev *vdev_blk = get_vu_block_device_by_server(req->server); BlockBackend *backend = vdev_blk->backend; - blk_co_flush(backend); + return blk_co_flush(backend); } static void coroutine_fn vu_block_virtio_process_req(void *opaque) @@ -XXX,XX +XXX,XX @@ static void coroutine_fn vu_block_virtio_process_req(void *opaque) break; } case VIRTIO_BLK_T_FLUSH: - vu_block_flush(req); - req->in->status = VIRTIO_BLK_S_OK; + if (vu_block_flush(req) == 0) { + req->in->status = VIRTIO_BLK_S_OK; + } else { + req->in->status = VIRTIO_BLK_S_IOERR; + } break; case VIRTIO_BLK_T_GET_ID: { size_t size = MIN(iov_size(&elem->in_sg[0], in_num), -- 2.26.2 Use the new QAPI block exports API instead of defining our own QOM objects. This is a large change because the lifecycle of VuBlockDev needs to follow BlockExportDriver. QOM properties are replaced by QAPI options objects. VuBlockDev is renamed VuBlkExport and contains a BlockExport field. Several fields can be dropped since BlockExport already has equivalents. The file names and meson build integration will be adjusted in a future patch. libvhost-user should probably be built as a static library that is linked into QEMU instead of as a .c file that results in duplicate compilation. The new command-line syntax is: $ qemu-storage-daemon \ --blockdev file,node-name=drive0,filename=test.img \ --export vhost-user-blk,node-name=drive0,id=export0,unix-socket=/tmp/vhost-user-blk.sock Note that unix-socket is optional because we may wish to accept chardevs too in the future. Markus noted that supported address families are not explicit in the QAPI schema. It is unlikely that support for more address families will be added since file descriptor passing is required and few address families support it. If a new address family needs to be added, then the QAPI 'features' syntax can be used to advertize them. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Acked-by: Markus Armbruster <armbru@redhat.com> Message-id: 20200924151549.913737-12-stefanha@redhat.com [Skip test on big-endian host architectures because this device doesn't support them yet (as already mentioned in a code comment). --Stefan] Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- qapi/block-export.json | 21 +- block/export/vhost-user-blk-server.h | 23 +- block/export/export.c | 6 + block/export/vhost-user-blk-server.c | 452 +++++++-------------------- util/vhost-user-server.c | 10 +- block/export/meson.build | 1 + block/meson.build | 1 - 7 files changed, 156 insertions(+), 358 deletions(-) diff --git a/qapi/block-export.json b/qapi/block-export.json index XXXXXXX..XXXXXXX 100644 --- a/qapi/block-export.json +++ b/qapi/block-export.json @@ -XXX,XX +XXX,XX @@ 'data': { '*name': 'str', '*description': 'str', '*bitmap': 'str' } } +## +# @BlockExportOptionsVhostUserBlk: +# +# A vhost-user-blk block export. +# +# @addr: The vhost-user socket on which to listen. Both 'unix' and 'fd' +# SocketAddress types are supported. Passed fds must be UNIX domain +# sockets. +# @logical-block-size: Logical block size in bytes. Defaults to 512 bytes. +# +# Since: 5.2 +## +{ 'struct': 'BlockExportOptionsVhostUserBlk', + 'data': { 'addr': 'SocketAddress', '*logical-block-size': 'size' } } + ## # @NbdServerAddOptions: # @@ -XXX,XX +XXX,XX @@ # An enumeration of block export types # # @nbd: NBD export +# @vhost-user-blk: vhost-user-blk export (since 5.2) # # Since: 4.2 ## { 'enum': 'BlockExportType', - 'data': [ 'nbd' ] } + 'data': [ 'nbd', 'vhost-user-blk' ] } ## # @BlockExportOptions: @@ -XXX,XX +XXX,XX @@ '*writethrough': 'bool' }, 'discriminator': 'type', 'data': { - 'nbd': 'BlockExportOptionsNbd' + 'nbd': 'BlockExportOptionsNbd', + 'vhost-user-blk': 'BlockExportOptionsVhostUserBlk' } } ## diff --git a/block/export/vhost-user-blk-server.h b/block/export/vhost-user-blk-server.h index XXXXXXX..XXXXXXX 100644 --- a/block/export/vhost-user-blk-server.h +++ b/block/export/vhost-user-blk-server.h @@ -XXX,XX +XXX,XX @@ #ifndef VHOST_USER_BLK_SERVER_H #define VHOST_USER_BLK_SERVER_H -#include "util/vhost-user-server.h" -typedef struct VuBlockDev VuBlockDev; -#define TYPE_VHOST_USER_BLK_SERVER "vhost-user-blk-server" -#define VHOST_USER_BLK_SERVER(obj) \ - OBJECT_CHECK(VuBlockDev, obj, TYPE_VHOST_USER_BLK_SERVER) +#include "block/export.h" -/* vhost user block device */ -struct VuBlockDev { - Object parent_obj; - char *node_name; - SocketAddress *addr; - AioContext *ctx; - VuServer vu_server; - bool running; - uint32_t blk_size; - BlockBackend *backend; - QIOChannelSocket *sioc; - QTAILQ_ENTRY(VuBlockDev) next; - struct virtio_blk_config blkcfg; - bool writable; -}; +/* For block/export/export.c */ +extern const BlockExportDriver blk_exp_vhost_user_blk; #endif /* VHOST_USER_BLK_SERVER_H */ diff --git a/block/export/export.c b/block/export/export.c index XXXXXXX..XXXXXXX 100644 --- a/block/export/export.c +++ b/block/export/export.c @@ -XXX,XX +XXX,XX @@ #include "sysemu/block-backend.h" #include "block/export.h" #include "block/nbd.h" +#if CONFIG_LINUX +#include "block/export/vhost-user-blk-server.h" +#endif #include "qapi/error.h" #include "qapi/qapi-commands-block-export.h" #include "qapi/qapi-events-block-export.h" @@ -XXX,XX +XXX,XX @@ static const BlockExportDriver *blk_exp_drivers[] = { &blk_exp_nbd, +#if CONFIG_LINUX + &blk_exp_vhost_user_blk, +#endif }; /* Only accessed from the main thread */ diff --git a/block/export/vhost-user-blk-server.c b/block/export/vhost-user-blk-server.c index XXXXXXX..XXXXXXX 100644 --- a/block/export/vhost-user-blk-server.c +++ b/block/export/vhost-user-blk-server.c @@ -XXX,XX +XXX,XX @@ */ #include "qemu/osdep.h" #include "block/block.h" +#include "contrib/libvhost-user/libvhost-user.h" +#include "standard-headers/linux/virtio_blk.h" +#include "util/vhost-user-server.h" #include "vhost-user-blk-server.h" #include "qapi/error.h" #include "qom/object_interfaces.h" @@ -XXX,XX +XXX,XX @@ struct virtio_blk_inhdr { unsigned char status; }; -typedef struct VuBlockReq { +typedef struct VuBlkReq { VuVirtqElement elem; int64_t sector_num; size_t size; @@ -XXX,XX +XXX,XX @@ typedef struct VuBlockReq { struct virtio_blk_outhdr out; VuServer *server; struct VuVirtq *vq; -} VuBlockReq; +} VuBlkReq; -static void vu_block_req_complete(VuBlockReq *req) +/* vhost user block device */ +typedef struct { + BlockExport export; + VuServer vu_server; + uint32_t blk_size; + QIOChannelSocket *sioc; + struct virtio_blk_config blkcfg; + bool writable; +} VuBlkExport; + +static void vu_blk_req_complete(VuBlkReq *req) { VuDev *vu_dev = &req->server->vu_dev; @@ -XXX,XX +XXX,XX @@ static void vu_block_req_complete(VuBlockReq *req) free(req); } -static VuBlockDev *get_vu_block_device_by_server(VuServer *server) -{ - return container_of(server, VuBlockDev, vu_server); -} - static int coroutine_fn -vu_block_discard_write_zeroes(VuBlockReq *req, struct iovec *iov, - uint32_t iovcnt, uint32_t type) +vu_blk_discard_write_zeroes(BlockBackend *blk, struct iovec *iov, + uint32_t iovcnt, uint32_t type) { struct virtio_blk_discard_write_zeroes desc; ssize_t size = iov_to_buf(iov, iovcnt, 0, &desc, sizeof(desc)); @@ -XXX,XX +XXX,XX @@ vu_block_discard_write_zeroes(VuBlockReq *req, struct iovec *iov, return -EINVAL; } - VuBlockDev *vdev_blk = get_vu_block_device_by_server(req->server); uint64_t range[2] = { le64_to_cpu(desc.sector) << 9, le32_to_cpu(desc.num_sectors) << 9 }; if (type == VIRTIO_BLK_T_DISCARD) { - if (blk_co_pdiscard(vdev_blk->backend, range[0], range[1]) == 0) { + if (blk_co_pdiscard(blk, range[0], range[1]) == 0) { return 0; } } else if (type == VIRTIO_BLK_T_WRITE_ZEROES) { - if (blk_co_pwrite_zeroes(vdev_blk->backend, - range[0], range[1], 0) == 0) { + if (blk_co_pwrite_zeroes(blk, range[0], range[1], 0) == 0) { return 0; } } @@ -XXX,XX +XXX,XX @@ vu_block_discard_write_zeroes(VuBlockReq *req, struct iovec *iov, return -EINVAL; } -static int coroutine_fn vu_block_flush(VuBlockReq *req) +static void coroutine_fn vu_blk_virtio_process_req(void *opaque) { - VuBlockDev *vdev_blk = get_vu_block_device_by_server(req->server); - BlockBackend *backend = vdev_blk->backend; - return blk_co_flush(backend); -} - -static void coroutine_fn vu_block_virtio_process_req(void *opaque) -{ - VuBlockReq *req = opaque; + VuBlkReq *req = opaque; VuServer *server = req->server; VuVirtqElement *elem = &req->elem; uint32_t type; - VuBlockDev *vdev_blk = get_vu_block_device_by_server(server); - BlockBackend *backend = vdev_blk->backend; + VuBlkExport *vexp = container_of(server, VuBlkExport, vu_server); + BlockBackend *blk = vexp->export.blk; struct iovec *in_iov = elem->in_sg; struct iovec *out_iov = elem->out_sg; @@ -XXX,XX +XXX,XX @@ static void coroutine_fn vu_block_virtio_process_req(void *opaque) bool is_write = type & VIRTIO_BLK_T_OUT; req->sector_num = le64_to_cpu(req->out.sector); - int64_t offset = req->sector_num * vdev_blk->blk_size; + if (is_write && !vexp->writable) { + req->in->status = VIRTIO_BLK_S_IOERR; + break; + } + + int64_t offset = req->sector_num * vexp->blk_size; QEMUIOVector qiov; if (is_write) { qemu_iovec_init_external(&qiov, out_iov, out_num); - ret = blk_co_pwritev(backend, offset, qiov.size, - &qiov, 0); + ret = blk_co_pwritev(blk, offset, qiov.size, &qiov, 0); } else { qemu_iovec_init_external(&qiov, in_iov, in_num); - ret = blk_co_preadv(backend, offset, qiov.size, - &qiov, 0); + ret = blk_co_preadv(blk, offset, qiov.size, &qiov, 0); } if (ret >= 0) { req->in->status = VIRTIO_BLK_S_OK; @@ -XXX,XX +XXX,XX @@ static void coroutine_fn vu_block_virtio_process_req(void *opaque) break; } case VIRTIO_BLK_T_FLUSH: - if (vu_block_flush(req) == 0) { + if (blk_co_flush(blk) == 0) { req->in->status = VIRTIO_BLK_S_OK; } else { req->in->status = VIRTIO_BLK_S_IOERR; @@ -XXX,XX +XXX,XX @@ static void coroutine_fn vu_block_virtio_process_req(void *opaque) case VIRTIO_BLK_T_DISCARD: case VIRTIO_BLK_T_WRITE_ZEROES: { int rc; - rc = vu_block_discard_write_zeroes(req, &elem->out_sg[1], - out_num, type); + + if (!vexp->writable) { + req->in->status = VIRTIO_BLK_S_IOERR; + break; + } + + rc = vu_blk_discard_write_zeroes(blk, &elem->out_sg[1], out_num, type); if (rc == 0) { req->in->status = VIRTIO_BLK_S_OK; } else { @@ -XXX,XX +XXX,XX @@ static void coroutine_fn vu_block_virtio_process_req(void *opaque) break; } - vu_block_req_complete(req); + vu_blk_req_complete(req); return; err: - free(elem); + free(req); } -static void vu_block_process_vq(VuDev *vu_dev, int idx) +static void vu_blk_process_vq(VuDev *vu_dev, int idx) { VuServer *server = container_of(vu_dev, VuServer, vu_dev); VuVirtq *vq = vu_get_queue(vu_dev, idx); while (1) { - VuBlockReq *req; + VuBlkReq *req; - req = vu_queue_pop(vu_dev, vq, sizeof(VuBlockReq)); + req = vu_queue_pop(vu_dev, vq, sizeof(VuBlkReq)); if (!req) { break; } @@ -XXX,XX +XXX,XX @@ static void vu_block_process_vq(VuDev *vu_dev, int idx) req->vq = vq; Coroutine *co = - qemu_coroutine_create(vu_block_virtio_process_req, req); + qemu_coroutine_create(vu_blk_virtio_process_req, req); qemu_coroutine_enter(co); } } -static void vu_block_queue_set_started(VuDev *vu_dev, int idx, bool started) +static void vu_blk_queue_set_started(VuDev *vu_dev, int idx, bool started) { VuVirtq *vq; assert(vu_dev); vq = vu_get_queue(vu_dev, idx); - vu_set_queue_handler(vu_dev, vq, started ? vu_block_process_vq : NULL); + vu_set_queue_handler(vu_dev, vq, started ? vu_blk_process_vq : NULL); } -static uint64_t vu_block_get_features(VuDev *dev) +static uint64_t vu_blk_get_features(VuDev *dev) { uint64_t features; VuServer *server = container_of(dev, VuServer, vu_dev); - VuBlockDev *vdev_blk = get_vu_block_device_by_server(server); + VuBlkExport *vexp = container_of(server, VuBlkExport, vu_server); features = 1ull << VIRTIO_BLK_F_SIZE_MAX | 1ull << VIRTIO_BLK_F_SEG_MAX | 1ull << VIRTIO_BLK_F_TOPOLOGY | @@ -XXX,XX +XXX,XX @@ static uint64_t vu_block_get_features(VuDev *dev) 1ull << VIRTIO_RING_F_EVENT_IDX | 1ull << VHOST_USER_F_PROTOCOL_FEATURES; - if (!vdev_blk->writable) { + if (!vexp->writable) { features |= 1ull << VIRTIO_BLK_F_RO; } return features; } -static uint64_t vu_block_get_protocol_features(VuDev *dev) +static uint64_t vu_blk_get_protocol_features(VuDev *dev) { return 1ull << VHOST_USER_PROTOCOL_F_CONFIG | 1ull << VHOST_USER_PROTOCOL_F_INFLIGHT_SHMFD; } static int -vu_block_get_config(VuDev *vu_dev, uint8_t *config, uint32_t len) +vu_blk_get_config(VuDev *vu_dev, uint8_t *config, uint32_t len) { + /* TODO blkcfg must be little-endian for VIRTIO 1.0 */ VuServer *server = container_of(vu_dev, VuServer, vu_dev); - VuBlockDev *vdev_blk = get_vu_block_device_by_server(server); - memcpy(config, &vdev_blk->blkcfg, len); - + VuBlkExport *vexp = container_of(server, VuBlkExport, vu_server); + memcpy(config, &vexp->blkcfg, len); return 0; } static int -vu_block_set_config(VuDev *vu_dev, const uint8_t *data, +vu_blk_set_config(VuDev *vu_dev, const uint8_t *data, uint32_t offset, uint32_t size, uint32_t flags) { VuServer *server = container_of(vu_dev, VuServer, vu_dev); - VuBlockDev *vdev_blk = get_vu_block_device_by_server(server); + VuBlkExport *vexp = container_of(server, VuBlkExport, vu_server); uint8_t wce; /* don't support live migration */ @@ -XXX,XX +XXX,XX @@ vu_block_set_config(VuDev *vu_dev, const uint8_t *data, } wce = *data; - vdev_blk->blkcfg.wce = wce; - blk_set_enable_write_cache(vdev_blk->backend, wce); + vexp->blkcfg.wce = wce; + blk_set_enable_write_cache(vexp->export.blk, wce); return 0; } @@ -XXX,XX +XXX,XX @@ vu_block_set_config(VuDev *vu_dev, const uint8_t *data, * of vu_process_message. * */ -static int vu_block_process_msg(VuDev *dev, VhostUserMsg *vmsg, int *do_reply) +static int vu_blk_process_msg(VuDev *dev, VhostUserMsg *vmsg, int *do_reply) { if (vmsg->request == VHOST_USER_NONE) { dev->panic(dev, "disconnect"); @@ -XXX,XX +XXX,XX @@ static int vu_block_process_msg(VuDev *dev, VhostUserMsg *vmsg, int *do_reply) return false; } -static const VuDevIface vu_block_iface = { - .get_features = vu_block_get_features, - .queue_set_started = vu_block_queue_set_started, - .get_protocol_features = vu_block_get_protocol_features, - .get_config = vu_block_get_config, - .set_config = vu_block_set_config, - .process_msg = vu_block_process_msg, +static const VuDevIface vu_blk_iface = { + .get_features = vu_blk_get_features, + .queue_set_started = vu_blk_queue_set_started, + .get_protocol_features = vu_blk_get_protocol_features, + .get_config = vu_blk_get_config, + .set_config = vu_blk_set_config, + .process_msg = vu_blk_process_msg, }; static void blk_aio_attached(AioContext *ctx, void *opaque) { - VuBlockDev *vub_dev = opaque; - vhost_user_server_attach_aio_context(&vub_dev->vu_server, ctx); + VuBlkExport *vexp = opaque; + vhost_user_server_attach_aio_context(&vexp->vu_server, ctx); } static void blk_aio_detach(void *opaque) { - VuBlockDev *vub_dev = opaque; - vhost_user_server_detach_aio_context(&vub_dev->vu_server); + VuBlkExport *vexp = opaque; + vhost_user_server_detach_aio_context(&vexp->vu_server); } static void -vu_block_initialize_config(BlockDriverState *bs, +vu_blk_initialize_config(BlockDriverState *bs, struct virtio_blk_config *config, uint32_t blk_size) { config->capacity = bdrv_getlength(bs) >> BDRV_SECTOR_BITS; @@ -XXX,XX +XXX,XX @@ vu_block_initialize_config(BlockDriverState *bs, config->max_write_zeroes_seg = 1; } -static VuBlockDev *vu_block_init(VuBlockDev *vu_block_device, Error **errp) +static void vu_blk_exp_request_shutdown(BlockExport *exp) { + VuBlkExport *vexp = container_of(exp, VuBlkExport, export); - BlockBackend *blk; - Error *local_error = NULL; - const char *node_name = vu_block_device->node_name; - bool writable = vu_block_device->writable; - uint64_t perm = BLK_PERM_CONSISTENT_READ; - int ret; - - AioContext *ctx; - - BlockDriverState *bs = bdrv_lookup_bs(node_name, node_name, &local_error); - - if (!bs) { - error_propagate(errp, local_error); - return NULL; - } - - if (bdrv_is_read_only(bs)) { - writable = false; - } - - if (writable) { - perm |= BLK_PERM_WRITE; - } - - ctx = bdrv_get_aio_context(bs); - aio_context_acquire(ctx); - bdrv_invalidate_cache(bs, NULL); - aio_context_release(ctx); - - /* - * Don't allow resize while the vhost user server is running, - * otherwise we don't care what happens with the node. - */ - blk = blk_new(bdrv_get_aio_context(bs), perm, - BLK_PERM_CONSISTENT_READ | BLK_PERM_WRITE_UNCHANGED | - BLK_PERM_WRITE | BLK_PERM_GRAPH_MOD); - ret = blk_insert_bs(blk, bs, errp); - - if (ret < 0) { - goto fail; - } - - blk_set_enable_write_cache(blk, false); - - blk_set_allow_aio_context_change(blk, true); - - vu_block_device->blkcfg.wce = 0; - vu_block_device->backend = blk; - if (!vu_block_device->blk_size) { - vu_block_device->blk_size = BDRV_SECTOR_SIZE; - } - vu_block_device->blkcfg.blk_size = vu_block_device->blk_size; - blk_set_guest_block_size(blk, vu_block_device->blk_size); - vu_block_initialize_config(bs, &vu_block_device->blkcfg, - vu_block_device->blk_size); - return vu_block_device; - -fail: - blk_unref(blk); - return NULL; -} - -static void vu_block_deinit(VuBlockDev *vu_block_device) -{ - if (vu_block_device->backend) { - blk_remove_aio_context_notifier(vu_block_device->backend, blk_aio_attached, - blk_aio_detach, vu_block_device); - } - - blk_unref(vu_block_device->backend); -} - -static void vhost_user_blk_server_stop(VuBlockDev *vu_block_device) -{ - vhost_user_server_stop(&vu_block_device->vu_server); - vu_block_deinit(vu_block_device); -} - -static void vhost_user_blk_server_start(VuBlockDev *vu_block_device, - Error **errp) -{ - AioContext *ctx; - SocketAddress *addr = vu_block_device->addr; - - if (!vu_block_init(vu_block_device, errp)) { - return; - } - - ctx = bdrv_get_aio_context(blk_bs(vu_block_device->backend)); - - if (!vhost_user_server_start(&vu_block_device->vu_server, addr, ctx, - VHOST_USER_BLK_MAX_QUEUES, &vu_block_iface, - errp)) { - goto error; - } - - blk_add_aio_context_notifier(vu_block_device->backend, blk_aio_attached, - blk_aio_detach, vu_block_device); - vu_block_device->running = true; - return; - - error: - vu_block_deinit(vu_block_device); -} - -static bool vu_prop_modifiable(VuBlockDev *vus, Error **errp) -{ - if (vus->running) { - error_setg(errp, "The property can't be modified " - "while the server is running"); - return false; - } - return true; -} - -static void vu_set_node_name(Object *obj, const char *value, Error **errp) -{ - VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj); - - if (!vu_prop_modifiable(vus, errp)) { - return; - } - - if (vus->node_name) { - g_free(vus->node_name); - } - - vus->node_name = g_strdup(value); -} - -static char *vu_get_node_name(Object *obj, Error **errp) -{ - VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj); - return g_strdup(vus->node_name); -} - -static void free_socket_addr(SocketAddress *addr) -{ - g_free(addr->u.q_unix.path); - g_free(addr); -} - -static void vu_set_unix_socket(Object *obj, const char *value, - Error **errp) -{ - VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj); - - if (!vu_prop_modifiable(vus, errp)) { - return; - } - - if (vus->addr) { - free_socket_addr(vus->addr); - } - - SocketAddress *addr = g_new0(SocketAddress, 1); - addr->type = SOCKET_ADDRESS_TYPE_UNIX; - addr->u.q_unix.path = g_strdup(value); - vus->addr = addr; + vhost_user_server_stop(&vexp->vu_server); } -static char *vu_get_unix_socket(Object *obj, Error **errp) +static int vu_blk_exp_create(BlockExport *exp, BlockExportOptions *opts, + Error **errp) { - VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj); - return g_strdup(vus->addr->u.q_unix.path); -} - -static bool vu_get_block_writable(Object *obj, Error **errp) -{ - VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj); - return vus->writable; -} - -static void vu_set_block_writable(Object *obj, bool value, Error **errp) -{ - VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj); - - if (!vu_prop_modifiable(vus, errp)) { - return; - } - - vus->writable = value; -} - -static void vu_get_blk_size(Object *obj, Visitor *v, const char *name, - void *opaque, Error **errp) -{ - VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj); - uint32_t value = vus->blk_size; - - visit_type_uint32(v, name, &value, errp); -} - -static void vu_set_blk_size(Object *obj, Visitor *v, const char *name, - void *opaque, Error **errp) -{ - VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj); - + VuBlkExport *vexp = container_of(exp, VuBlkExport, export); + BlockExportOptionsVhostUserBlk *vu_opts = &opts->u.vhost_user_blk; Error *local_err = NULL; - uint32_t value; + uint64_t logical_block_size; - if (!vu_prop_modifiable(vus, errp)) { - return; - } + vexp->writable = opts->writable; + vexp->blkcfg.wce = 0; - visit_type_uint32(v, name, &value, &local_err); - if (local_err) { - goto out; + if (vu_opts->has_logical_block_size) { + logical_block_size = vu_opts->logical_block_size; + } else { + logical_block_size = BDRV_SECTOR_SIZE; } - - check_block_size(object_get_typename(obj), name, value, &local_err); + check_block_size(exp->id, "logical-block-size", logical_block_size, + &local_err); if (local_err) { - goto out; + error_propagate(errp, local_err); + return -EINVAL; + } + vexp->blk_size = logical_block_size; + blk_set_guest_block_size(exp->blk, logical_block_size); + vu_blk_initialize_config(blk_bs(exp->blk), &vexp->blkcfg, + logical_block_size); + + blk_set_allow_aio_context_change(exp->blk, true); + blk_add_aio_context_notifier(exp->blk, blk_aio_attached, blk_aio_detach, + vexp); + + if (!vhost_user_server_start(&vexp->vu_server, vu_opts->addr, exp->ctx, + VHOST_USER_BLK_MAX_QUEUES, &vu_blk_iface, + errp)) { + blk_remove_aio_context_notifier(exp->blk, blk_aio_attached, + blk_aio_detach, vexp); + return -EADDRNOTAVAIL; } - vus->blk_size = value; - -out: - error_propagate(errp, local_err); -} - -static void vhost_user_blk_server_instance_finalize(Object *obj) -{ - VuBlockDev *vub = VHOST_USER_BLK_SERVER(obj); - - vhost_user_blk_server_stop(vub); - - /* - * Unlike object_property_add_str, object_class_property_add_str - * doesn't have a release method. Thus manual memory freeing is - * needed. - */ - free_socket_addr(vub->addr); - g_free(vub->node_name); -} - -static void vhost_user_blk_server_complete(UserCreatable *obj, Error **errp) -{ - VuBlockDev *vub = VHOST_USER_BLK_SERVER(obj); - - vhost_user_blk_server_start(vub, errp); + return 0; } -static void vhost_user_blk_server_class_init(ObjectClass *klass, - void *class_data) +static void vu_blk_exp_delete(BlockExport *exp) { - UserCreatableClass *ucc = USER_CREATABLE_CLASS(klass); - ucc->complete = vhost_user_blk_server_complete; - - object_class_property_add_bool(klass, "writable", - vu_get_block_writable, - vu_set_block_writable); - - object_class_property_add_str(klass, "node-name", - vu_get_node_name, - vu_set_node_name); - - object_class_property_add_str(klass, "unix-socket", - vu_get_unix_socket, - vu_set_unix_socket); + VuBlkExport *vexp = container_of(exp, VuBlkExport, export); - object_class_property_add(klass, "logical-block-size", "uint32", - vu_get_blk_size, vu_set_blk_size, - NULL, NULL); + blk_remove_aio_context_notifier(exp->blk, blk_aio_attached, blk_aio_detach, + vexp); } -static const TypeInfo vhost_user_blk_server_info = { - .name = TYPE_VHOST_USER_BLK_SERVER, - .parent = TYPE_OBJECT, - .instance_size = sizeof(VuBlockDev), - .instance_finalize = vhost_user_blk_server_instance_finalize, - .class_init = vhost_user_blk_server_class_init, - .interfaces = (InterfaceInfo[]) { - {TYPE_USER_CREATABLE}, - {} - }, +const BlockExportDriver blk_exp_vhost_user_blk = { + .type = BLOCK_EXPORT_TYPE_VHOST_USER_BLK, + .instance_size = sizeof(VuBlkExport), + .create = vu_blk_exp_create, + .delete = vu_blk_exp_delete, + .request_shutdown = vu_blk_exp_request_shutdown, }; - -static void vhost_user_blk_server_register_types(void) -{ - type_register_static(&vhost_user_blk_server_info); -} - -type_init(vhost_user_blk_server_register_types) diff --git a/util/vhost-user-server.c b/util/vhost-user-server.c index XXXXXXX..XXXXXXX 100644 --- a/util/vhost-user-server.c +++ b/util/vhost-user-server.c @@ -XXX,XX +XXX,XX @@ bool vhost_user_server_start(VuServer *server, Error **errp) { QEMUBH *bh; - QIONetListener *listener = qio_net_listener_new(); + QIONetListener *listener; + + if (socket_addr->type != SOCKET_ADDRESS_TYPE_UNIX && + socket_addr->type != SOCKET_ADDRESS_TYPE_FD) { + error_setg(errp, "Only socket address types 'unix' and 'fd' are supported"); + return false; + } + + listener = qio_net_listener_new(); if (qio_net_listener_open_sync(listener, socket_addr, 1, errp) < 0) { object_unref(OBJECT(listener)); diff --git a/block/export/meson.build b/block/export/meson.build index XXXXXXX..XXXXXXX 100644 --- a/block/export/meson.build +++ b/block/export/meson.build @@ -1 +1,2 @@ block_ss.add(files('export.c')) +block_ss.add(when: 'CONFIG_LINUX', if_true: files('vhost-user-blk-server.c', '../../contrib/libvhost-user/libvhost-user.c')) diff --git a/block/meson.build b/block/meson.build index XXXXXXX..XXXXXXX 100644 --- a/block/meson.build +++ b/block/meson.build @@ -XXX,XX +XXX,XX @@ block_ss.add(when: 'CONFIG_WIN32', if_true: files('file-win32.c', 'win32-aio.c') block_ss.add(when: 'CONFIG_POSIX', if_true: [files('file-posix.c'), coref, iokit]) block_ss.add(when: 'CONFIG_LIBISCSI', if_true: files('iscsi-opts.c')) block_ss.add(when: 'CONFIG_LINUX', if_true: files('nvme.c')) -block_ss.add(when: 'CONFIG_LINUX', if_true: files('export/vhost-user-blk-server.c', '../contrib/libvhost-user/libvhost-user.c')) block_ss.add(when: 'CONFIG_REPLICATION', if_true: files('replication.c')) block_ss.add(when: 'CONFIG_SHEEPDOG', if_true: files('sheepdog.c')) block_ss.add(when: ['CONFIG_LINUX_AIO', libaio], if_true: files('linux-aio.c')) -- 2.26.2 Headers used by other subsystems are located in include/. Also add the vhost-user-server and vhost-user-blk-server headers to MAINTAINERS. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20200924151549.913737-13-stefanha@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- MAINTAINERS | 4 +++- {util => include/qemu}/vhost-user-server.h | 0 block/export/vhost-user-blk-server.c | 2 +- util/vhost-user-server.c | 2 +- 4 files changed, 5 insertions(+), 3 deletions(-) rename {util => include/qemu}/vhost-user-server.h (100%) diff --git a/MAINTAINERS b/MAINTAINERS index XXXXXXX..XXXXXXX 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -XXX,XX +XXX,XX @@ Vhost-user block device backend server M: Coiby Xu <Coiby.Xu@gmail.com> S: Maintained F: block/export/vhost-user-blk-server.c -F: util/vhost-user-server.c +F: block/export/vhost-user-blk-server.h +F: include/qemu/vhost-user-server.h F: tests/qtest/libqos/vhost-user-blk.c +F: util/vhost-user-server.c Replication M: Wen Congyang <wencongyang2@huawei.com> diff --git a/util/vhost-user-server.h b/include/qemu/vhost-user-server.h similarity index 100% rename from util/vhost-user-server.h rename to include/qemu/vhost-user-server.h diff --git a/block/export/vhost-user-blk-server.c b/block/export/vhost-user-blk-server.c index XXXXXXX..XXXXXXX 100644 --- a/block/export/vhost-user-blk-server.c +++ b/block/export/vhost-user-blk-server.c @@ -XXX,XX +XXX,XX @@ #include "block/block.h" #include "contrib/libvhost-user/libvhost-user.h" #include "standard-headers/linux/virtio_blk.h" -#include "util/vhost-user-server.h" +#include "qemu/vhost-user-server.h" #include "vhost-user-blk-server.h" #include "qapi/error.h" #include "qom/object_interfaces.h" diff --git a/util/vhost-user-server.c b/util/vhost-user-server.c index XXXXXXX..XXXXXXX 100644 --- a/util/vhost-user-server.c +++ b/util/vhost-user-server.c @@ -XXX,XX +XXX,XX @@ */ #include "qemu/osdep.h" #include "qemu/main-loop.h" +#include "qemu/vhost-user-server.h" #include "block/aio-wait.h" -#include "vhost-user-server.h" /* * Theory of operation: -- 2.26.2 Don't compile contrib/libvhost-user/libvhost-user.c again. Instead build the static library once and then reuse it throughout QEMU. Also switch from CONFIG_LINUX to CONFIG_VHOST_USER, which is what the vhost-user tools (vhost-user-gpu, etc) do. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20200924151549.913737-14-stefanha@redhat.com [Added CONFIG_LINUX again because libvhost-user doesn't build on macOS. --Stefan] Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- block/export/export.c | 8 ++++---- block/export/meson.build | 2 +- contrib/libvhost-user/meson.build | 1 + meson.build | 6 +++++- util/meson.build | 4 +++- 5 files changed, 14 insertions(+), 7 deletions(-) diff --git a/block/export/export.c b/block/export/export.c index XXXXXXX..XXXXXXX 100644 --- a/block/export/export.c +++ b/block/export/export.c @@ -XXX,XX +XXX,XX @@ #include "sysemu/block-backend.h" #include "block/export.h" #include "block/nbd.h" -#if CONFIG_LINUX -#include "block/export/vhost-user-blk-server.h" -#endif #include "qapi/error.h" #include "qapi/qapi-commands-block-export.h" #include "qapi/qapi-events-block-export.h" #include "qemu/id.h" +#ifdef CONFIG_VHOST_USER +#include "vhost-user-blk-server.h" +#endif static const BlockExportDriver *blk_exp_drivers[] = { &blk_exp_nbd, -#if CONFIG_LINUX +#ifdef CONFIG_VHOST_USER &blk_exp_vhost_user_blk, #endif }; diff --git a/block/export/meson.build b/block/export/meson.build index XXXXXXX..XXXXXXX 100644 --- a/block/export/meson.build +++ b/block/export/meson.build @@ -XXX,XX +XXX,XX @@ block_ss.add(files('export.c')) -block_ss.add(when: 'CONFIG_LINUX', if_true: files('vhost-user-blk-server.c', '../../contrib/libvhost-user/libvhost-user.c')) +block_ss.add(when: ['CONFIG_LINUX', 'CONFIG_VHOST_USER'], if_true: files('vhost-user-blk-server.c')) diff --git a/contrib/libvhost-user/meson.build b/contrib/libvhost-user/meson.build index XXXXXXX..XXXXXXX 100644 --- a/contrib/libvhost-user/meson.build +++ b/contrib/libvhost-user/meson.build @@ -XXX,XX +XXX,XX @@ libvhost_user = static_library('vhost-user', files('libvhost-user.c', 'libvhost-user-glib.c'), build_by_default: false) +vhost_user = declare_dependency(link_with: libvhost_user) diff --git a/meson.build b/meson.build index XXXXXXX..XXXXXXX 100644 --- a/meson.build +++ b/meson.build @@ -XXX,XX +XXX,XX @@ trace_events_subdirs += [ 'util', ] +vhost_user = not_found +if 'CONFIG_VHOST_USER' in config_host + subdir('contrib/libvhost-user') +endif + subdir('qapi') subdir('qobject') subdir('stubs') @@ -XXX,XX +XXX,XX @@ if have_tools install: true) if 'CONFIG_VHOST_USER' in config_host - subdir('contrib/libvhost-user') subdir('contrib/vhost-user-blk') subdir('contrib/vhost-user-gpu') subdir('contrib/vhost-user-input') diff --git a/util/meson.build b/util/meson.build index XXXXXXX..XXXXXXX 100644 --- a/util/meson.build +++ b/util/meson.build @@ -XXX,XX +XXX,XX @@ if have_block util_ss.add(files('main-loop.c')) util_ss.add(files('nvdimm-utils.c')) util_ss.add(files('qemu-coroutine.c', 'qemu-coroutine-lock.c', 'qemu-coroutine-io.c')) - util_ss.add(when: 'CONFIG_LINUX', if_true: files('vhost-user-server.c')) + util_ss.add(when: ['CONFIG_LINUX', 'CONFIG_VHOST_USER'], if_true: [ + files('vhost-user-server.c'), vhost_user + ]) util_ss.add(files('block-helpers.c')) util_ss.add(files('qemu-coroutine-sleep.c')) util_ss.add(files('qemu-co-shared-resource.c')) -- 2.26.2 Introduce libblkdev.fa to avoid recompiling blockdev_ss twice. Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20200929125516.186715-3-stefanha@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- meson.build | 12 ++++++++++-- storage-daemon/meson.build | 3 +-- 2 files changed, 11 insertions(+), 4 deletions(-) diff --git a/meson.build b/meson.build index XXXXXXX..XXXXXXX 100644 --- a/meson.build +++ b/meson.build @@ -XXX,XX +XXX,XX @@ blockdev_ss.add(files( # os-win32.c does not blockdev_ss.add(when: 'CONFIG_POSIX', if_true: files('os-posix.c')) softmmu_ss.add(when: 'CONFIG_WIN32', if_true: [files('os-win32.c')]) -softmmu_ss.add_all(blockdev_ss) common_ss.add(files('cpus-common.c')) @@ -XXX,XX +XXX,XX @@ block = declare_dependency(link_whole: [libblock], link_args: '@block.syms', dependencies: [crypto, io]) +blockdev_ss = blockdev_ss.apply(config_host, strict: false) +libblockdev = static_library('blockdev', blockdev_ss.sources() + genh, + dependencies: blockdev_ss.dependencies(), + name_suffix: 'fa', + build_by_default: false) + +blockdev = declare_dependency(link_whole: [libblockdev], + dependencies: [block]) + qmp_ss = qmp_ss.apply(config_host, strict: false) libqmp = static_library('qmp', qmp_ss.sources() + genh, dependencies: qmp_ss.dependencies(), @@ -XXX,XX +XXX,XX @@ foreach m : block_mods + softmmu_mods install_dir: config_host['qemu_moddir']) endforeach -softmmu_ss.add(authz, block, chardev, crypto, io, qmp) +softmmu_ss.add(authz, blockdev, chardev, crypto, io, qmp) common_ss.add(qom, qemuutil) common_ss.add_all(when: 'CONFIG_SOFTMMU', if_true: [softmmu_ss]) diff --git a/storage-daemon/meson.build b/storage-daemon/meson.build index XXXXXXX..XXXXXXX 100644 --- a/storage-daemon/meson.build +++ b/storage-daemon/meson.build @@ -XXX,XX +XXX,XX @@ qsd_ss = ss.source_set() qsd_ss.add(files('qemu-storage-daemon.c')) -qsd_ss.add(block, chardev, qmp, qom, qemuutil) -qsd_ss.add_all(blockdev_ss) +qsd_ss.add(blockdev, chardev, qmp, qom, qemuutil) subdir('qapi') -- 2.26.2 Block exports are used by softmmu, qemu-storage-daemon, and qemu-nbd. They are not used by other programs and are not otherwise needed in libblock. Undo the recent move of blockdev-nbd.c from blockdev_ss into block_ss. Since bdrv_close_all() (libblock) calls blk_exp_close_all() (libblockdev) a stub function is required.. Make qemu-nbd.c use signal handling utility functions instead of duplicating the code. This helps because os-posix.c is in libblockdev and it depends on a qemu_system_killed() symbol that qemu-nbd.c lacks. Once we use the signal handling utility functions we also end up providing the necessary symbol. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-id: 20200929125516.186715-4-stefanha@redhat.com [Fixed s/ndb/nbd/ typo in commit description as suggested by Eric Blake --Stefan] Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- qemu-nbd.c | 21 ++++++++------------- stubs/blk-exp-close-all.c | 7 +++++++ block/export/meson.build | 4 ++-- meson.build | 4 ++-- nbd/meson.build | 2 ++ stubs/meson.build | 1 + 6 files changed, 22 insertions(+), 17 deletions(-) create mode 100644 stubs/blk-exp-close-all.c diff --git a/qemu-nbd.c b/qemu-nbd.c index XXXXXXX..XXXXXXX 100644 --- a/qemu-nbd.c +++ b/qemu-nbd.c @@ -XXX,XX +XXX,XX @@ #include "qapi/error.h" #include "qemu/cutils.h" #include "sysemu/block-backend.h" +#include "sysemu/runstate.h" /* for qemu_system_killed() prototype */ #include "block/block_int.h" #include "block/nbd.h" #include "qemu/main-loop.h" @@ -XXX,XX +XXX,XX @@ QEMU_COPYRIGHT "\n" } #ifdef CONFIG_POSIX -static void termsig_handler(int signum) +/* + * The client thread uses SIGTERM to interrupt the server. A signal + * handler ensures that "qemu-nbd -v -c" exits with a nice status code. + */ +void qemu_system_killed(int signum, pid_t pid) { qatomic_cmpxchg(&state, RUNNING, TERMINATE); qemu_notify_event(); @@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv) BlockExportOptions *export_opts; #ifdef CONFIG_POSIX - /* - * Exit gracefully on various signals, which includes SIGTERM used - * by 'qemu-nbd -v -c'. - */ - struct sigaction sa_sigterm; - memset(&sa_sigterm, 0, sizeof(sa_sigterm)); - sa_sigterm.sa_handler = termsig_handler; - sigaction(SIGTERM, &sa_sigterm, NULL); - sigaction(SIGINT, &sa_sigterm, NULL); - sigaction(SIGHUP, &sa_sigterm, NULL); - - signal(SIGPIPE, SIG_IGN); + os_setup_early_signal_handling(); + os_setup_signal_handling(); #endif socket_init(); diff --git a/stubs/blk-exp-close-all.c b/stubs/blk-exp-close-all.c new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/stubs/blk-exp-close-all.c @@ -XXX,XX +XXX,XX @@ +#include "qemu/osdep.h" +#include "block/export.h" + +/* Only used in programs that support block exports (libblockdev.fa) */ +void blk_exp_close_all(void) +{ +} diff --git a/block/export/meson.build b/block/export/meson.build index XXXXXXX..XXXXXXX 100644 --- a/block/export/meson.build +++ b/block/export/meson.build @@ -XXX,XX +XXX,XX @@ -block_ss.add(files('export.c')) -block_ss.add(when: ['CONFIG_LINUX', 'CONFIG_VHOST_USER'], if_true: files('vhost-user-blk-server.c')) +blockdev_ss.add(files('export.c')) +blockdev_ss.add(when: ['CONFIG_LINUX', 'CONFIG_VHOST_USER'], if_true: files('vhost-user-blk-server.c')) diff --git a/meson.build b/meson.build index XXXXXXX..XXXXXXX 100644 --- a/meson.build +++ b/meson.build @@ -XXX,XX +XXX,XX @@ subdir('dump') block_ss.add(files( 'block.c', - 'blockdev-nbd.c', 'blockjob.c', 'job.c', 'qemu-io-cmds.c', @@ -XXX,XX +XXX,XX @@ subdir('block') blockdev_ss.add(files( 'blockdev.c', + 'blockdev-nbd.c', 'iothread.c', 'job-qmp.c', )) @@ -XXX,XX +XXX,XX @@ if have_tools qemu_io = executable('qemu-io', files('qemu-io.c'), dependencies: [block, qemuutil], install: true) qemu_nbd = executable('qemu-nbd', files('qemu-nbd.c'), - dependencies: [block, qemuutil], install: true) + dependencies: [blockdev, qemuutil], install: true) subdir('storage-daemon') subdir('contrib/rdmacm-mux') diff --git a/nbd/meson.build b/nbd/meson.build index XXXXXXX..XXXXXXX 100644 --- a/nbd/meson.build +++ b/nbd/meson.build @@ -XXX,XX +XXX,XX @@ block_ss.add(files( 'client.c', 'common.c', +)) +blockdev_ss.add(files( 'server.c', )) diff --git a/stubs/meson.build b/stubs/meson.build index XXXXXXX..XXXXXXX 100644 --- a/stubs/meson.build +++ b/stubs/meson.build @@ -XXX,XX +XXX,XX @@ stub_ss.add(files('arch_type.c')) stub_ss.add(files('bdrv-next-monitor-owned.c')) stub_ss.add(files('blk-commit-all.c')) +stub_ss.add(files('blk-exp-close-all.c')) stub_ss.add(files('blockdev-close-all-bdrv-states.c')) stub_ss.add(files('change-state-handler.c')) stub_ss.add(files('cmos.c')) -- 2.26.2 Make it possible to specify the iothread where the export will run. By default the block node can be moved to other AioContexts later and the export will follow. The fixed-iothread option forces strict behavior that prevents changing AioContext while the export is active. See the QAPI docs for details. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20200929125516.186715-5-stefanha@redhat.com [Fix stray '#' character in block-export.json and add missing "(since: 5.2)" as suggested by Eric Blake. --Stefan] Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- qapi/block-export.json | 11 ++++++++++ block/export/export.c | 31 +++++++++++++++++++++++++++- block/export/vhost-user-blk-server.c | 5 ++++- nbd/server.c | 2 -- 4 files changed, 45 insertions(+), 4 deletions(-) diff --git a/qapi/block-export.json b/qapi/block-export.json index XXXXXXX..XXXXXXX 100644 --- a/qapi/block-export.json +++ b/qapi/block-export.json @@ -XXX,XX +XXX,XX @@ # export before completion is signalled. (since: 5.2; # default: false) # +# @iothread: The name of the iothread object where the export will run. The +# default is to use the thread currently associated with the +# block node. (since: 5.2) +# +# @fixed-iothread: True prevents the block node from being moved to another +# thread while the export is active. If true and @iothread is +# given, export creation fails if the block node cannot be +# moved to the iothread. The default is false. (since: 5.2) +# # Since: 4.2 ## { 'union': 'BlockExportOptions', 'base': { 'type': 'BlockExportType', 'id': 'str', + '*fixed-iothread': 'bool', + '*iothread': 'str', 'node-name': 'str', '*writable': 'bool', '*writethrough': 'bool' }, diff --git a/block/export/export.c b/block/export/export.c index XXXXXXX..XXXXXXX 100644 --- a/block/export/export.c +++ b/block/export/export.c @@ -XXX,XX +XXX,XX @@ #include "block/block.h" #include "sysemu/block-backend.h" +#include "sysemu/iothread.h" #include "block/export.h" #include "block/nbd.h" #include "qapi/error.h" @@ -XXX,XX +XXX,XX @@ static const BlockExportDriver *blk_exp_find_driver(BlockExportType type) BlockExport *blk_exp_add(BlockExportOptions *export, Error **errp) { + bool fixed_iothread = export->has_fixed_iothread && export->fixed_iothread; const BlockExportDriver *drv; BlockExport *exp = NULL; BlockDriverState *bs; - BlockBackend *blk; + BlockBackend *blk = NULL; AioContext *ctx; uint64_t perm; int ret; @@ -XXX,XX +XXX,XX @@ BlockExport *blk_exp_add(BlockExportOptions *export, Error **errp) ctx = bdrv_get_aio_context(bs); aio_context_acquire(ctx); + if (export->has_iothread) { + IOThread *iothread; + AioContext *new_ctx; + + iothread = iothread_by_id(export->iothread); + if (!iothread) { + error_setg(errp, "iothread \"%s\" not found", export->iothread); + goto fail; + } + + new_ctx = iothread_get_aio_context(iothread); + + ret = bdrv_try_set_aio_context(bs, new_ctx, errp); + if (ret == 0) { + aio_context_release(ctx); + aio_context_acquire(new_ctx); + ctx = new_ctx; + } else if (fixed_iothread) { + goto fail; + } + } + /* * Block exports are used for non-shared storage migration. Make sure * that BDRV_O_INACTIVE is cleared and the image is ready for write @@ -XXX,XX +XXX,XX @@ BlockExport *blk_exp_add(BlockExportOptions *export, Error **errp) } blk = blk_new(ctx, perm, BLK_PERM_ALL); + + if (!fixed_iothread) { + blk_set_allow_aio_context_change(blk, true); + } + ret = blk_insert_bs(blk, bs, errp); if (ret < 0) { goto fail; diff --git a/block/export/vhost-user-blk-server.c b/block/export/vhost-user-blk-server.c index XXXXXXX..XXXXXXX 100644 --- a/block/export/vhost-user-blk-server.c +++ b/block/export/vhost-user-blk-server.c @@ -XXX,XX +XXX,XX @@ static const VuDevIface vu_blk_iface = { static void blk_aio_attached(AioContext *ctx, void *opaque) { VuBlkExport *vexp = opaque; + + vexp->export.ctx = ctx; vhost_user_server_attach_aio_context(&vexp->vu_server, ctx); } static void blk_aio_detach(void *opaque) { VuBlkExport *vexp = opaque; + vhost_user_server_detach_aio_context(&vexp->vu_server); + vexp->export.ctx = NULL; } static void @@ -XXX,XX +XXX,XX @@ static int vu_blk_exp_create(BlockExport *exp, BlockExportOptions *opts, vu_blk_initialize_config(blk_bs(exp->blk), &vexp->blkcfg, logical_block_size); - blk_set_allow_aio_context_change(exp->blk, true); blk_add_aio_context_notifier(exp->blk, blk_aio_attached, blk_aio_detach, vexp); diff --git a/nbd/server.c b/nbd/server.c index XXXXXXX..XXXXXXX 100644 --- a/nbd/server.c +++ b/nbd/server.c @@ -XXX,XX +XXX,XX @@ static int nbd_export_create(BlockExport *blk_exp, BlockExportOptions *exp_args, return ret; } - blk_set_allow_aio_context_change(blk, true); - QTAILQ_INIT(&exp->clients); exp->name = g_strdup(arg->name); exp->description = g_strdup(arg->description); -- 2.26.2 Allow the number of queues to be configured using --export vhost-user-blk,num-queues=N. This setting should match the QEMU --device vhost-user-blk-pci,num-queues=N setting but QEMU vhost-user-blk.c lowers its own value if the vhost-user-blk backend offers fewer queues than QEMU. The vhost-user-blk-server.c code is already capable of multi-queue. All virtqueue processing runs in the same AioContext. No new locking is needed. Add the num-queues=N option and set the VIRTIO_BLK_F_MQ feature bit. Note that the feature bit only announces the presence of the num_queues configuration space field. It does not promise that there is more than 1 virtqueue, so we can set it unconditionally. I tested multi-queue by running a random read fio test with numjobs=4 on an -smp 4 guest. After the benchmark finished the guest /proc/interrupts file showed activity on all 4 virtio-blk MSI-X. The /sys/block/vda/mq/ directory shows that Linux blk-mq has 4 queues configured. An automated test is included in the next commit. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Acked-by: Markus Armbruster <armbru@redhat.com> Message-id: 20201001144604.559733-2-stefanha@redhat.com [Fixed accidental tab characters as suggested by Markus Armbruster --Stefan] Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- qapi/block-export.json | 10 +++++++--- block/export/vhost-user-blk-server.c | 24 ++++++++++++++++++------ 2 files changed, 25 insertions(+), 9 deletions(-) diff --git a/qapi/block-export.json b/qapi/block-export.json index XXXXXXX..XXXXXXX 100644 --- a/qapi/block-export.json +++ b/qapi/block-export.json @@ -XXX,XX +XXX,XX @@ # SocketAddress types are supported. Passed fds must be UNIX domain # sockets. # @logical-block-size: Logical block size in bytes. Defaults to 512 bytes. +# @num-queues: Number of request virtqueues. Must be greater than 0. Defaults +# to 1. # # Since: 5.2 ## { 'struct': 'BlockExportOptionsVhostUserBlk', - 'data': { 'addr': 'SocketAddress', '*logical-block-size': 'size' } } + 'data': { 'addr': 'SocketAddress', + '*logical-block-size': 'size', + '*num-queues': 'uint16'} } ## # @NbdServerAddOptions: @@ -XXX,XX +XXX,XX @@ { 'union': 'BlockExportOptions', 'base': { 'type': 'BlockExportType', 'id': 'str', - '*fixed-iothread': 'bool', - '*iothread': 'str', + '*fixed-iothread': 'bool', + '*iothread': 'str', 'node-name': 'str', '*writable': 'bool', '*writethrough': 'bool' }, diff --git a/block/export/vhost-user-blk-server.c b/block/export/vhost-user-blk-server.c index XXXXXXX..XXXXXXX 100644 --- a/block/export/vhost-user-blk-server.c +++ b/block/export/vhost-user-blk-server.c @@ -XXX,XX +XXX,XX @@ #include "util/block-helpers.h" enum { - VHOST_USER_BLK_MAX_QUEUES = 1, + VHOST_USER_BLK_NUM_QUEUES_DEFAULT = 1, }; struct virtio_blk_inhdr { unsigned char status; @@ -XXX,XX +XXX,XX @@ static uint64_t vu_blk_get_features(VuDev *dev) 1ull << VIRTIO_BLK_F_DISCARD | 1ull << VIRTIO_BLK_F_WRITE_ZEROES | 1ull << VIRTIO_BLK_F_CONFIG_WCE | + 1ull << VIRTIO_BLK_F_MQ | 1ull << VIRTIO_F_VERSION_1 | 1ull << VIRTIO_RING_F_INDIRECT_DESC | 1ull << VIRTIO_RING_F_EVENT_IDX | @@ -XXX,XX +XXX,XX @@ static void blk_aio_detach(void *opaque) static void vu_blk_initialize_config(BlockDriverState *bs, - struct virtio_blk_config *config, uint32_t blk_size) + struct virtio_blk_config *config, + uint32_t blk_size, + uint16_t num_queues) { config->capacity = bdrv_getlength(bs) >> BDRV_SECTOR_BITS; config->blk_size = blk_size; @@ -XXX,XX +XXX,XX @@ vu_blk_initialize_config(BlockDriverState *bs, config->seg_max = 128 - 2; config->min_io_size = 1; config->opt_io_size = 1; - config->num_queues = VHOST_USER_BLK_MAX_QUEUES; + config->num_queues = num_queues; config->max_discard_sectors = 32768; config->max_discard_seg = 1; config->discard_sector_alignment = config->blk_size >> 9; @@ -XXX,XX +XXX,XX @@ static int vu_blk_exp_create(BlockExport *exp, BlockExportOptions *opts, BlockExportOptionsVhostUserBlk *vu_opts = &opts->u.vhost_user_blk; Error *local_err = NULL; uint64_t logical_block_size; + uint16_t num_queues = VHOST_USER_BLK_NUM_QUEUES_DEFAULT; vexp->writable = opts->writable; vexp->blkcfg.wce = 0; @@ -XXX,XX +XXX,XX @@ static int vu_blk_exp_create(BlockExport *exp, BlockExportOptions *opts, } vexp->blk_size = logical_block_size; blk_set_guest_block_size(exp->blk, logical_block_size); + + if (vu_opts->has_num_queues) { + num_queues = vu_opts->num_queues; + } + if (num_queues == 0) { + error_setg(errp, "num-queues must be greater than 0"); + return -EINVAL; + } + vu_blk_initialize_config(blk_bs(exp->blk), &vexp->blkcfg, - logical_block_size); + logical_block_size, num_queues); blk_add_aio_context_notifier(exp->blk, blk_aio_attached, blk_aio_detach, vexp); if (!vhost_user_server_start(&vexp->vu_server, vu_opts->addr, exp->ctx, - VHOST_USER_BLK_MAX_QUEUES, &vu_blk_iface, - errp)) { + num_queues, &vu_blk_iface, errp)) { blk_remove_aio_context_notifier(exp->blk, blk_aio_attached, blk_aio_detach, vexp); return -EADDRNOTAVAIL; -- 2.26.2 From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> bdrv_co_block_status_above has several design problems with handling short backing files: 1. With want_zeros=true, it may return ret with BDRV_BLOCK_ZERO but without BDRV_BLOCK_ALLOCATED flag, when actually short backing file which produces these after-EOF zeros is inside requested backing sequence. 2. With want_zero=false, it may return pnum=0 prior to actual EOF, because of EOF of short backing file. Fix these things, making logic about short backing files clearer. With fixed bdrv_block_status_above we also have to improve is_zero in qcow2 code, otherwise iotest 154 will fail, because with this patch we stop to merge zeros of different types (produced by fully unallocated in the whole backing chain regions vs produced by short backing files). Note also, that this patch leaves for another day the general problem around block-status: misuse of BDRV_BLOCK_ALLOCATED as is-fs-allocated vs go-to-backing. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Reviewed-by: Alberto Garcia <berto@igalia.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-id: 20200924194003.22080-2-vsementsov@virtuozzo.com [Fix s/comes/come/ as suggested by Eric Blake --Stefan] Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- block/io.c | 68 ++++++++++++++++++++++++++++++++++++++++----------- block/qcow2.c | 16 ++++++++++-- 2 files changed, 68 insertions(+), 16 deletions(-) diff --git a/block/io.c b/block/io.c index XXXXXXX..XXXXXXX 100644 --- a/block/io.c +++ b/block/io.c @@ -XXX,XX +XXX,XX @@ bdrv_co_common_block_status_above(BlockDriverState *bs, int64_t *map, BlockDriverState **file) { + int ret; BlockDriverState *p; - int ret = 0; - bool first = true; + int64_t eof = 0; assert(bs != base); - for (p = bs; p != base; p = bdrv_filter_or_cow_bs(p)) { + + ret = bdrv_co_block_status(bs, want_zero, offset, bytes, pnum, map, file); + if (ret < 0 || *pnum == 0 || ret & BDRV_BLOCK_ALLOCATED) { + return ret; + } + + if (ret & BDRV_BLOCK_EOF) { + eof = offset + *pnum; + } + + assert(*pnum <= bytes); + bytes = *pnum; + + for (p = bdrv_filter_or_cow_bs(bs); p != base; + p = bdrv_filter_or_cow_bs(p)) + { ret = bdrv_co_block_status(p, want_zero, offset, bytes, pnum, map, file); if (ret < 0) { - break; + return ret; } - if (ret & BDRV_BLOCK_ZERO && ret & BDRV_BLOCK_EOF && !first) { + if (*pnum == 0) { /* - * Reading beyond the end of the file continues to read - * zeroes, but we can only widen the result to the - * unallocated length we learned from an earlier - * iteration. + * The top layer deferred to this layer, and because this layer is + * short, any zeroes that we synthesize beyond EOF behave as if they + * were allocated at this layer. + * + * We don't include BDRV_BLOCK_EOF into ret, as upper layer may be + * larger. We'll add BDRV_BLOCK_EOF if needed at function end, see + * below. */ + assert(ret & BDRV_BLOCK_EOF); *pnum = bytes; + if (file) { + *file = p; + } + ret = BDRV_BLOCK_ZERO | BDRV_BLOCK_ALLOCATED; + break; } - if (ret & (BDRV_BLOCK_ZERO | BDRV_BLOCK_DATA)) { + if (ret & BDRV_BLOCK_ALLOCATED) { + /* + * We've found the node and the status, we must break. + * + * Drop BDRV_BLOCK_EOF, as it's not for upper layer, which may be + * larger. We'll add BDRV_BLOCK_EOF if needed at function end, see + * below. + */ + ret &= ~BDRV_BLOCK_EOF; break; } - /* [offset, pnum] unallocated on this layer, which could be only - * the first part of [offset, bytes]. */ - bytes = MIN(bytes, *pnum); - first = false; + + /* + * OK, [offset, offset + *pnum) region is unallocated on this layer, + * let's continue the diving. + */ + assert(*pnum <= bytes); + bytes = *pnum; + } + + if (offset + *pnum == eof) { + ret |= BDRV_BLOCK_EOF; } + return ret; } diff --git a/block/qcow2.c b/block/qcow2.c index XXXXXXX..XXXXXXX 100644 --- a/block/qcow2.c +++ b/block/qcow2.c @@ -XXX,XX +XXX,XX @@ static bool is_zero(BlockDriverState *bs, int64_t offset, int64_t bytes) if (!bytes) { return true; } - res = bdrv_block_status_above(bs, NULL, offset, bytes, &nr, NULL, NULL); - return res >= 0 && (res & BDRV_BLOCK_ZERO) && nr == bytes; + + /* + * bdrv_block_status_above doesn't merge different types of zeros, for + * example, zeros which come from the region which is unallocated in + * the whole backing chain, and zeros which come because of a short + * backing file. So, we need a loop. + */ + do { + res = bdrv_block_status_above(bs, NULL, offset, bytes, &nr, NULL, NULL); + offset += nr; + bytes -= nr; + } while (res >= 0 && (res & BDRV_BLOCK_ZERO) && nr && bytes); + + return res >= 0 && (res & BDRV_BLOCK_ZERO) && bytes == 0; } static coroutine_fn int qcow2_co_pwrite_zeroes(BlockDriverState *bs, -- 2.26.2 From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> In order to reuse bdrv_common_block_status_above in bdrv_is_allocated_above, let's support include_base parameter. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Reviewed-by: Alberto Garcia <berto@igalia.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-id: 20200924194003.22080-3-vsementsov@virtuozzo.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- block/coroutines.h | 2 ++ block/io.c | 21 ++++++++++++++------- 2 files changed, 16 insertions(+), 7 deletions(-) diff --git a/block/coroutines.h b/block/coroutines.h index XXXXXXX..XXXXXXX 100644 --- a/block/coroutines.h +++ b/block/coroutines.h @@ -XXX,XX +XXX,XX @@ bdrv_pwritev(BdrvChild *child, int64_t offset, unsigned int bytes, int coroutine_fn bdrv_co_common_block_status_above(BlockDriverState *bs, BlockDriverState *base, + bool include_base, bool want_zero, int64_t offset, int64_t bytes, @@ -XXX,XX +XXX,XX @@ bdrv_co_common_block_status_above(BlockDriverState *bs, int generated_co_wrapper bdrv_common_block_status_above(BlockDriverState *bs, BlockDriverState *base, + bool include_base, bool want_zero, int64_t offset, int64_t bytes, diff --git a/block/io.c b/block/io.c index XXXXXXX..XXXXXXX 100644 --- a/block/io.c +++ b/block/io.c @@ -XXX,XX +XXX,XX @@ early_out: int coroutine_fn bdrv_co_common_block_status_above(BlockDriverState *bs, BlockDriverState *base, + bool include_base, bool want_zero, int64_t offset, int64_t bytes, @@ -XXX,XX +XXX,XX @@ bdrv_co_common_block_status_above(BlockDriverState *bs, BlockDriverState *p; int64_t eof = 0; - assert(bs != base); + assert(include_base || bs != base); + assert(!include_base || base); /* Can't include NULL base */ ret = bdrv_co_block_status(bs, want_zero, offset, bytes, pnum, map, file); - if (ret < 0 || *pnum == 0 || ret & BDRV_BLOCK_ALLOCATED) { + if (ret < 0 || *pnum == 0 || ret & BDRV_BLOCK_ALLOCATED || bs == base) { return ret; } @@ -XXX,XX +XXX,XX @@ bdrv_co_common_block_status_above(BlockDriverState *bs, assert(*pnum <= bytes); bytes = *pnum; - for (p = bdrv_filter_or_cow_bs(bs); p != base; + for (p = bdrv_filter_or_cow_bs(bs); include_base || p != base; p = bdrv_filter_or_cow_bs(p)) { ret = bdrv_co_block_status(p, want_zero, offset, bytes, pnum, map, @@ -XXX,XX +XXX,XX @@ bdrv_co_common_block_status_above(BlockDriverState *bs, break; } + if (p == base) { + assert(include_base); + break; + } + /* * OK, [offset, offset + *pnum) region is unallocated on this layer, * let's continue the diving. @@ -XXX,XX +XXX,XX @@ int bdrv_block_status_above(BlockDriverState *bs, BlockDriverState *base, int64_t offset, int64_t bytes, int64_t *pnum, int64_t *map, BlockDriverState **file) { - return bdrv_common_block_status_above(bs, base, true, offset, bytes, + return bdrv_common_block_status_above(bs, base, false, true, offset, bytes, pnum, map, file); } @@ -XXX,XX +XXX,XX @@ int coroutine_fn bdrv_is_allocated(BlockDriverState *bs, int64_t offset, int ret; int64_t dummy; - ret = bdrv_common_block_status_above(bs, bdrv_filter_or_cow_bs(bs), false, - offset, bytes, pnum ? pnum : &dummy, - NULL, NULL); + ret = bdrv_common_block_status_above(bs, bs, true, false, offset, + bytes, pnum ? pnum : &dummy, NULL, + NULL); if (ret < 0) { return ret; } -- 2.26.2 From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> We are going to reuse bdrv_common_block_status_above in bdrv_is_allocated_above. bdrv_is_allocated_above may be called with include_base == false and still bs == base (for ex. from img_rebase()). So, support this corner case. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Alberto Garcia <berto@igalia.com> Message-id: 20200924194003.22080-4-vsementsov@virtuozzo.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- block/io.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/block/io.c b/block/io.c index XXXXXXX..XXXXXXX 100644 --- a/block/io.c +++ b/block/io.c @@ -XXX,XX +XXX,XX @@ bdrv_co_common_block_status_above(BlockDriverState *bs, BlockDriverState *p; int64_t eof = 0; - assert(include_base || bs != base); assert(!include_base || base); /* Can't include NULL base */ + if (!include_base && bs == base) { + *pnum = bytes; + return 0; + } + ret = bdrv_co_block_status(bs, want_zero, offset, bytes, pnum, map, file); if (ret < 0 || *pnum == 0 || ret & BDRV_BLOCK_ALLOCATED || bs == base) { return ret; -- 2.26.2 From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> bdrv_is_allocated_above wrongly handles short backing files: it reports after-EOF space as UNALLOCATED which is wrong, as on read the data is generated on the level of short backing file (if all overlays have unallocated areas at that place). Reusing bdrv_common_block_status_above fixes the issue and unifies code path. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Alberto Garcia <berto@igalia.com> Message-id: 20200924194003.22080-5-vsementsov@virtuozzo.com [Fix s/has/have/ as suggested by Eric Blake. Fix s/area/areas/. --Stefan] Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- block/io.c | 43 +++++-------------------------------------- 1 file changed, 5 insertions(+), 38 deletions(-) diff --git a/block/io.c b/block/io.c index XXXXXXX..XXXXXXX 100644 --- a/block/io.c +++ b/block/io.c @@ -XXX,XX +XXX,XX @@ int coroutine_fn bdrv_is_allocated(BlockDriverState *bs, int64_t offset, * at 'offset + *pnum' may return the same allocation status (in other * words, the result is not necessarily the maximum possible range); * but 'pnum' will only be 0 when end of file is reached. - * */ int bdrv_is_allocated_above(BlockDriverState *top, BlockDriverState *base, bool include_base, int64_t offset, int64_t bytes, int64_t *pnum) { - BlockDriverState *intermediate; - int ret; - int64_t n = bytes; - - assert(base || !include_base); - - intermediate = top; - while (include_base || intermediate != base) { - int64_t pnum_inter; - int64_t size_inter; - - assert(intermediate); - ret = bdrv_is_allocated(intermediate, offset, bytes, &pnum_inter); - if (ret < 0) { - return ret; - } - if (ret) { - *pnum = pnum_inter; - return 1; - } - - size_inter = bdrv_getlength(intermediate); - if (size_inter < 0) { - return size_inter; - } - if (n > pnum_inter && - (intermediate == top || offset + pnum_inter < size_inter)) { - n = pnum_inter; - } - - if (intermediate == base) { - break; - } - - intermediate = bdrv_filter_or_cow_bs(intermediate); + int ret = bdrv_common_block_status_above(top, base, include_base, false, + offset, bytes, pnum, NULL, NULL); + if (ret < 0) { + return ret; } - *pnum = n; - return 0; + return !!(ret & BDRV_BLOCK_ALLOCATED); } int coroutine_fn -- 2.26.2 From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> These cases are fixed by previous patches around block_status and is_allocated. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Alberto Garcia <berto@igalia.com> Message-id: 20200924194003.22080-6-vsementsov@virtuozzo.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- tests/qemu-iotests/274 | 20 +++++++++++ tests/qemu-iotests/274.out | 68 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 88 insertions(+) diff --git a/tests/qemu-iotests/274 b/tests/qemu-iotests/274 index XXXXXXX..XXXXXXX 100755 --- a/tests/qemu-iotests/274 +++ b/tests/qemu-iotests/274 @@ -XXX,XX +XXX,XX @@ with iotests.FilePath('base') as base, \ iotests.qemu_io_log('-c', 'read -P 1 0 %d' % size_short, mid) iotests.qemu_io_log('-c', 'read -P 0 %d %d' % (size_short, size_diff), mid) + iotests.log('=== Testing qemu-img commit (top -> base) ===') + + create_chain() + iotests.qemu_img_log('commit', '-b', base, top) + iotests.img_info_log(base) + iotests.qemu_io_log('-c', 'read -P 1 0 %d' % size_short, base) + iotests.qemu_io_log('-c', 'read -P 0 %d %d' % (size_short, size_diff), base) + + iotests.log('=== Testing QMP active commit (top -> base) ===') + + create_chain() + with create_vm() as vm: + vm.launch() + vm.qmp_log('block-commit', device='top', base_node='base', + job_id='job0', auto_dismiss=False) + vm.run_job('job0', wait=5) + + iotests.img_info_log(mid) + iotests.qemu_io_log('-c', 'read -P 1 0 %d' % size_short, base) + iotests.qemu_io_log('-c', 'read -P 0 %d %d' % (size_short, size_diff), base) iotests.log('== Resize tests ==') diff --git a/tests/qemu-iotests/274.out b/tests/qemu-iotests/274.out index XXXXXXX..XXXXXXX 100644 --- a/tests/qemu-iotests/274.out +++ b/tests/qemu-iotests/274.out @@ -XXX,XX +XXX,XX @@ read 1048576/1048576 bytes at offset 0 read 1048576/1048576 bytes at offset 1048576 1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) +=== Testing qemu-img commit (top -> base) === +Formatting 'TEST_DIR/PID-base', fmt=qcow2 cluster_size=65536 extended_l2=off compression_type=zlib size=2097152 lazy_refcounts=off refcount_bits=16 + +Formatting 'TEST_DIR/PID-mid', fmt=qcow2 cluster_size=65536 extended_l2=off compression_type=zlib size=1048576 backing_file=TEST_DIR/PID-base backing_fmt=qcow2 lazy_refcounts=off refcount_bits=16 + +Formatting 'TEST_DIR/PID-top', fmt=qcow2 cluster_size=65536 extended_l2=off compression_type=zlib size=2097152 backing_file=TEST_DIR/PID-mid backing_fmt=qcow2 lazy_refcounts=off refcount_bits=16 + +wrote 2097152/2097152 bytes at offset 0 +2 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) + +Image committed. + +image: TEST_IMG +file format: IMGFMT +virtual size: 2 MiB (2097152 bytes) +cluster_size: 65536 +Format specific information: + compat: 1.1 + compression type: zlib + lazy refcounts: false + refcount bits: 16 + corrupt: false + extended l2: false + +read 1048576/1048576 bytes at offset 0 +1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) + +read 1048576/1048576 bytes at offset 1048576 +1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) + +=== Testing QMP active commit (top -> base) === +Formatting 'TEST_DIR/PID-base', fmt=qcow2 cluster_size=65536 extended_l2=off compression_type=zlib size=2097152 lazy_refcounts=off refcount_bits=16 + +Formatting 'TEST_DIR/PID-mid', fmt=qcow2 cluster_size=65536 extended_l2=off compression_type=zlib size=1048576 backing_file=TEST_DIR/PID-base backing_fmt=qcow2 lazy_refcounts=off refcount_bits=16 + +Formatting 'TEST_DIR/PID-top', fmt=qcow2 cluster_size=65536 extended_l2=off compression_type=zlib size=2097152 backing_file=TEST_DIR/PID-mid backing_fmt=qcow2 lazy_refcounts=off refcount_bits=16 + +wrote 2097152/2097152 bytes at offset 0 +2 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) + +{"execute": "block-commit", "arguments": {"auto-dismiss": false, "base-node": "base", "device": "top", "job-id": "job0"}} +{"return": {}} +{"execute": "job-complete", "arguments": {"id": "job0"}} +{"return": {}} +{"data": {"device": "job0", "len": 1048576, "offset": 1048576, "speed": 0, "type": "commit"}, "event": "BLOCK_JOB_READY", "timestamp": {"microseconds": "USECS", "seconds": "SECS"}} +{"data": {"device": "job0", "len": 1048576, "offset": 1048576, "speed": 0, "type": "commit"}, "event": "BLOCK_JOB_COMPLETED", "timestamp": {"microseconds": "USECS", "seconds": "SECS"}} +{"execute": "job-dismiss", "arguments": {"id": "job0"}} +{"return": {}} +image: TEST_IMG +file format: IMGFMT +virtual size: 1 MiB (1048576 bytes) +cluster_size: 65536 +backing file: TEST_DIR/PID-base +backing file format: IMGFMT +Format specific information: + compat: 1.1 + compression type: zlib + lazy refcounts: false + refcount bits: 16 + corrupt: false + extended l2: false + +read 1048576/1048576 bytes at offset 0 +1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) + +read 1048576/1048576 bytes at offset 1048576 +1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) + == Resize tests == === preallocation=off === Formatting 'TEST_DIR/PID-base', fmt=qcow2 cluster_size=65536 extended_l2=off compression_type=zlib size=6442450944 lazy_refcounts=off refcount_bits=16 -- 2.26.2