The following changes since commit 67b6526cf042f22521feff5ea521a05d3dd2bf8f:

Merge remote-tracking branch 'remotes/bonzini-gitlab/tags/for-upstream' into staging (2022-01-13 13:59:56 +0000)

for you to fetch changes up to e5e748739562268ef4063ee77bf53ad7040b25c7:

iotests/testrunner.py: refactor test_field_width (2022-01-14 12:03:16 +0100)

Block layer patches

- qemu-storage-daemon: Add vhost-user-blk help

- block-backend: Fix use-after-free for BDS pointers after aio_poll()

- qemu-img: Fix sparseness of output image with unaligned ranges

- vvfat: Fix crashes in read-write mode

- Fix device deletion events with -device JSON syntax

- Code cleanups

Daniel P. Berrangé (1):

softmmu: fix device deletion events with -device JSON syntax

Emanuele Giuseppe Esposito (3):

block_int: make bdrv_backing_overridden static

include/sysemu/blockdev.h: remove drive_mark_claimed_by_board and inline drive_def

include/sysemu/blockdev.h: remove drive_get_max_devs

Hanna Reitz (2):

iotests/stream-error-on-reset: New test

iotests/308: Fix for CAP_DAC_OVERRIDE

Kevin Wolf (3):

vvfat: Fix size of temporary qcow file

vvfat: Fix vvfat_write() for writes before the root directory

iotests: Test qemu-img convert of zeroed data cluster

Philippe Mathieu-Daudé (3):

docs: Correct 'vhost-user-blk' spelling

qemu-storage-daemon: Add vhost-user-blk help

qapi/block: Restrict vhost-user-blk to CONFIG_VHOST_USER_BLK_SERVER

Stefan Hajnoczi (1):

block-backend: prevent dangling BDS pointers across aio_poll()

Vladimir Sementsov-Ogievskiy (3):

qemu-img: make is_allocated_sectors() more efficient

block: drop BLK_PERM_GRAPH_MOD

iotests/testrunner.py: refactor test_field_width

qapi/block-core.json | 7 +-

qapi/block-export.json | 6 +-

qapi/qdev.json | 5 +-

docs/tools/qemu-storage-daemon.rst | 2 +-

include/block/block.h | 9 +-

include/block/block_int.h | 3 -

include/sysemu/blockdev.h | 3 -

block.c | 11 +-

block/block-backend.c | 19 ++-

block/commit.c | 1 -

block/mirror.c | 15 +--

block/monitor/block-hmp-cmds.c | 2 +-

block/vvfat.c | 37 ++++--

blockdev.c | 24 +---

hw/block/block.c | 3 +-

qemu-img.c | 23 +++-

softmmu/vl.c | 8 +-

storage-daemon/qemu-storage-daemon.c | 13 ++

tests/qtest/device-plug-test.c | 19 +++

scripts/render_block_graph.py | 1 -

tests/qemu-iotests/testrunner.py | 21 ++--

tests/qemu-iotests/122 | 1 +

tests/qemu-iotests/122.out | 2 +

tests/qemu-iotests/273.out | 4 -

tests/qemu-iotests/308 | 25 +++-

tests/qemu-iotests/308.out | 2 +-

tests/qemu-iotests/tests/stream-error-on-reset | 140 +++++++++++++++++++++

tests/qemu-iotests/tests/stream-error-on-reset.out | 5 +

28 files changed, 307 insertions(+), 104 deletions(-)

create mode 100755 tests/qemu-iotests/tests/stream-error-on-reset

create mode 100644 tests/qemu-iotests/tests/stream-error-on-reset.out

From: Emanuele Giuseppe Esposito <eesposit@redhat.com>

bdrv_backing_overridden is only used in block.c, so there is

no need to leave it in block_int.h

Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>

Message-Id: <20211215121140.456939-2-eesposit@redhat.com>

include/block/block_int.h | 3 ---

block.c | 4 +++-

2 files changed, 3 insertions(+), 4 deletions(-)

@@ -XXX,XX +XXX,XX @@ BlockDriver *bdrv_probe_all(const uint8_t *buf, int buf_size,

void bdrv_parse_filename_strip_prefix(const char *filename, const char *prefix,

QDict *options);

-bool bdrv_backing_overridden(BlockDriverState *bs);

-

-

/**

* bdrv_add_aio_context_notifier:

*

diff --git a/block.c b/block.c

--- a/block.c

+++ b/block.c

@@ -XXX,XX +XXX,XX @@ static int bdrv_reopen_prepare(BDRVReopenState *reopen_state,

static void bdrv_reopen_commit(BDRVReopenState *reopen_state);

static void bdrv_reopen_abort(BDRVReopenState *reopen_state);

+static bool bdrv_backing_overridden(BlockDriverState *bs);

+

/* If non-zero, use only whitelisted block drivers */

static int use_bdrv_whitelist;

@@ -XXX,XX +XXX,XX @@ static bool append_strong_runtime_options(QDict *d, BlockDriverState *bs)

/* Note: This function may return false positives; it may return true

* even if opening the backing file specified by bs's image header

* would result in exactly bs->backing. */

-bool bdrv_backing_overridden(BlockDriverState *bs)

+static bool bdrv_backing_overridden(BlockDriverState *bs)

if (bs->backing) {

return strcmp(bs->auto_backing_file,

2.31.1

From: Emanuele Giuseppe Esposito <eesposit@redhat.com>

drive_def is only a particular use case of

qemu_opts_parse_noisily, so it can be inlined.

include/sysemu/blockdev.h | 2 --

block/monitor/block-hmp-cmds.c | 2 +-

blockdev.c | 7 +------

softmmu/vl.c | 4 +++-

4 files changed, 5 insertions(+), 10 deletions(-)

diff --git a/include/sysemu/blockdev.h b/include/sysemu/blockdev.h

--- a/include/sysemu/blockdev.h

+++ b/include/sysemu/blockdev.h

@@ -XXX,XX +XXX,XX @@ BlockBackend *blk_by_legacy_dinfo(DriveInfo *dinfo);

void override_max_devs(BlockInterfaceType type, int max_devs);

DriveInfo *drive_get(BlockInterfaceType type, int bus, int unit);

-void drive_mark_claimed_by_board(void);

void drive_check_orphaned(void);

DriveInfo *drive_get_by_index(BlockInterfaceType type, int index);

int drive_get_max_bus(BlockInterfaceType type);

int drive_get_max_devs(BlockInterfaceType type);

-QemuOpts *drive_def(const char *optstr);

QemuOpts *drive_add(BlockInterfaceType type, int index, const char *file,

const char *optstr);

DriveInfo *drive_new(QemuOpts *arg, BlockInterfaceType block_default_type,

diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c

--- a/block/monitor/block-hmp-cmds.c

+++ b/block/monitor/block-hmp-cmds.c

@@ -XXX,XX +XXX,XX @@ void hmp_drive_add(Monitor *mon, const QDict *qdict)

return;

}

- opts = drive_def(optstr);

+ opts = qemu_opts_parse_noisily(qemu_find_opts("drive"), optstr, false);

if (!opts)

return;

diff --git a/blockdev.c b/blockdev.c

index XXXXXXX..XXXXXXX 100644

--- a/blockdev.c

+++ b/blockdev.c

@@ -XXX,XX +XXX,XX @@ static int drive_index_to_unit_id(BlockInterfaceType type, int index)

return max_devs ? index % max_devs : index;

-QemuOpts *drive_def(const char *optstr)

-{

- return qemu_opts_parse_noisily(qemu_find_opts("drive"), optstr, false);

-}

-

QemuOpts *drive_add(BlockInterfaceType type, int index, const char *file,

const char *optstr)

QemuOpts *opts;

- opts = drive_def(optstr);

+ opts = qemu_opts_parse_noisily(qemu_find_opts("drive"), optstr, false);

if (!opts) {

return NULL;

}

diff --git a/softmmu/vl.c b/softmmu/vl.c

--- a/softmmu/vl.c

+++ b/softmmu/vl.c

@@ -XXX,XX +XXX,XX @@ void qemu_init(int argc, char **argv, char **envp)

break;

}

case QEMU_OPTION_drive:

- if (drive_def(optarg) == NULL) {

+ opts = qemu_opts_parse_noisily(qemu_find_opts("drive"),

+ optarg, false);

+ if (opts == NULL) {

exit(1);

}

break;

2.31.1

From: Emanuele Giuseppe Esposito <eesposit@redhat.com>

Remove drive_get_max_devs, as it is not used by anyone.

Last use was removed in commit 8f2d75e81d5

("hw: Drop superfluous special checks for orphaned -drive").

Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>

Message-Id: <20211215121140.456939-4-eesposit@redhat.com>

include/sysemu/blockdev.h | 1 -

blockdev.c | 17 -----------------

2 files changed, 18 deletions(-)

diff --git a/include/sysemu/blockdev.h b/include/sysemu/blockdev.h

--- a/include/sysemu/blockdev.h

+++ b/include/sysemu/blockdev.h

@@ -XXX,XX +XXX,XX @@ DriveInfo *drive_get(BlockInterfaceType type, int bus, int unit);

void drive_check_orphaned(void);

DriveInfo *drive_get_by_index(BlockInterfaceType type, int index);

int drive_get_max_bus(BlockInterfaceType type);

-int drive_get_max_devs(BlockInterfaceType type);

QemuOpts *drive_add(BlockInterfaceType type, int index, const char *file,

const char *optstr);

diff --git a/blockdev.c b/blockdev.c

--- a/blockdev.c

+++ b/blockdev.c

@@ -XXX,XX +XXX,XX @@ void blockdev_auto_del(BlockBackend *blk)

}

-/**

- * Returns the current mapping of how many units per bus

- * a particular interface can support.

- *

- * A positive integer indicates n units per bus.

- * 0 implies the mapping has not been established.

- * -1 indicates an invalid BlockInterfaceType was given.

- */

-int drive_get_max_devs(BlockInterfaceType type)

-{

- if (type >= IF_IDE && type < IF_COUNT) {

- return if_max_devs[type];

- }

-

- return -1;

-}

-

static int drive_index_to_bus_id(BlockInterfaceType type, int index)

int max_devs = if_max_devs[type];

2.31.1

From: Daniel P. Berrangé <berrange@redhat.com>

The -device JSON syntax impl leaks a reference on the created

DeviceState instance. As a result when you hot-unplug the

device, the device_finalize method won't be called and thus

it will fail to emit the required DEVICE_DELETED event.

A 'json-cli' feature was previously added against the

'device_add' QMP command QAPI schema to indicated to mgmt

apps that -device supported JSON syntax. Given the hotplug

bug that feature flag is not usable for its purpose, so

we add a new 'json-cli-hotplug' feature to indicate the

-device supports JSON without breaking hotplug.

Fixes: 5dacda5167560b3af8eadbce5814f60ba44b467e

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/802

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>

Message-Id: <20220105123847.4047954-2-berrange@redhat.com>

Reviewed-by: Laurent Vivier <lvivier@redhat.com>

Tested-by: Ján Tomko <jtomko@redhat.com>

Reviewed-by: Thomas Huth <thuth@redhat.com>

qapi/qdev.json | 5 ++++-

softmmu/vl.c | 4 +++-

tests/qtest/device-plug-test.c | 19 +++++++++++++++++++

3 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/qapi/qdev.json b/qapi/qdev.json

--- a/qapi/qdev.json

+++ b/qapi/qdev.json

@@ -XXX,XX +XXX,XX @@

# @json-cli: If present, the "-device" command line option supports JSON

# syntax with a structure identical to the arguments of this

# command.

+# @json-cli-hotplug: If present, the "-device" command line option supports JSON

+# syntax without the reference counting leak that broke

+# hot-unplug

#

# Notes:

#

@@ -XXX,XX +XXX,XX @@

{ 'command': 'device_add',

'data': {'driver': 'str', '*bus': 'str', '*id': 'str'},

'gen': false, # so we can get the additional arguments

- 'features': ['json-cli'] }

+ 'features': ['json-cli', 'json-cli-hotplug'] }

##

# @device_del:

diff --git a/softmmu/vl.c b/softmmu/vl.c

index XXXXXXX..XXXXXXX 100644

--- a/softmmu/vl.c

+++ b/softmmu/vl.c

@@ -XXX,XX +XXX,XX @@ static void qemu_create_cli_devices(void)

qemu_opts_foreach(qemu_find_opts("device"),

device_init_func, NULL, &error_fatal);

QTAILQ_FOREACH(opt, &device_opts, next) {

+ DeviceState *dev;

loc_push_restore(&opt->loc);

/*

* TODO Eventually we should call qmp_device_add() here to make sure it

@@ -XXX,XX +XXX,XX @@ static void qemu_create_cli_devices(void)

* from the start, so call qdev_device_add_from_qdict() directly for

* now.

*/

- qdev_device_add_from_qdict(opt->opts, true, &error_fatal);

+ dev = qdev_device_add_from_qdict(opt->opts, true, &error_fatal);

+ object_unref(OBJECT(dev));

loc_pop(&opt->loc);

}

rom_reset_order_override();

diff --git a/tests/qtest/device-plug-test.c b/tests/qtest/device-plug-test.c

index XXXXXXX..XXXXXXX 100644

--- a/tests/qtest/device-plug-test.c

+++ b/tests/qtest/device-plug-test.c

@@ -XXX,XX +XXX,XX @@ static void test_pci_unplug_request(void)

qtest_quit(qtest);

+static void test_pci_unplug_json_request(void)

+{

+ QTestState *qtest = qtest_initf(

+ "-device '{\"driver\": \"virtio-mouse-pci\", \"id\": \"dev0\"}'");

+

+ /*

+ * Request device removal. As the guest is not running, the request won't

+ * be processed. However during system reset, the removal will be

+ * handled, removing the device.

+ */

+ device_del(qtest, "dev0");

+ system_reset(qtest);

+ wait_device_deleted_event(qtest, "dev0");

+

+ qtest_quit(qtest);

+}

+

static void test_ccw_unplug(void)

{

QTestState *qtest = qtest_initf("-device virtio-balloon-ccw,id=dev0");

@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)

*/

qtest_add_func("/device-plug/pci-unplug-request",

test_pci_unplug_request);

+ qtest_add_func("/device-plug/pci-unplug-json-request",

+ test_pci_unplug_json_request);

if (!strcmp(arch, "s390x")) {

qtest_add_func("/device-plug/ccw-unplug",

2.31.1

From: Philippe Mathieu-Daudé <philmd@redhat.com>

Add missing vhost-user-blk help:

$ qemu-storage-daemon -h

...

--export [type=]vhost-user-blk,id=<id>,node-name=<node-name>,

addr.type=unix,addr.path=<socket-path>[,writable=on|off]

[,logical-block-size=<block-size>][,num-queues=<num-queues>]

export the specified block node as a

vhosts-user-blk device over UNIX domain socket

--export [type=]vhost-user-blk,id=<id>,node-name=<node-name>,

fd,addr.str=<fd>[,writable=on|off]

[,logical-block-size=<block-size>][,num-queues=<num-queues>]

export the specified block node as a

vhosts-user-blk device over file descriptor

...

Fixes: 90fc91d50b7 ("convert vhost-user-blk server to block export API")

Reported-by: Qing Wang <qinwang@redhat.com>

Reviewed-by: Eric Blake <eblake@redhat.com>

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-Id: <20220107105420.395011-3-f4bug@amsat.org>

storage-daemon/qemu-storage-daemon.c | 13 +++++++++++++

1 file changed, 13 insertions(+)

diff --git a/storage-daemon/qemu-storage-daemon.c b/storage-daemon/qemu-storage-daemon.c

--- a/storage-daemon/qemu-storage-daemon.c

+++ b/storage-daemon/qemu-storage-daemon.c

@@ -XXX,XX +XXX,XX @@ static void help(void)

" export the specified block node over FUSE\n"

"\n"

#endif /* CONFIG_FUSE */

+#ifdef CONFIG_VHOST_USER_BLK_SERVER

+" --export [type=]vhost-user-blk,id=<id>,node-name=<node-name>,\n"

+" addr.type=unix,addr.path=<socket-path>[,writable=on|off]\n"

+" [,logical-block-size=<block-size>][,num-queues=<num-queues>]\n"

+" export the specified block node as a\n"

+" vhost-user-blk device over UNIX domain socket\n"

+" --export [type=]vhost-user-blk,id=<id>,node-name=<node-name>,\n"

+" fd,addr.str=<fd>[,writable=on|off]\n"

+" [,logical-block-size=<block-size>][,num-queues=<num-queues>]\n"

+" export the specified block node as a\n"

+" vhost-user-blk device over file descriptor\n"

+"\n"

+#endif /* CONFIG_VHOST_USER_BLK_SERVER */

" --monitor [chardev=]name[,mode=control][,pretty[=on|off]]\n"

" configure a QMP monitor\n"

"\n"

2.31.1

From: Philippe Mathieu-Daudé <philmd@redhat.com>

When building QEMU with --disable-vhost-user and using introspection,

query-qmp-schema lists vhost-user-blk even though it's not actually

available:

{ "execute": "query-qmp-schema" }

{

"return": [

...

{

"name": "312",

"members": [

{

"name": "nbd"

},

{

"name": "vhost-user-blk"

}

],

"meta-type": "enum",

"values": [

"nbd",

"vhost-user-blk"

]

},

Restrict vhost-user-blk in BlockExportType when

CONFIG_VHOST_USER_BLK_SERVER is disabled, so it

doesn't end listed by query-qmp-schema.

Fixes: 90fc91d50b7 ("convert vhost-user-blk server to block export API")

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-Id: <20220107105420.395011-4-f4bug@amsat.org>

qapi/block-export.json | 6 ++++--

1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/qapi/block-export.json b/qapi/block-export.json

--- a/qapi/block-export.json

+++ b/qapi/block-export.json

@@ -XXX,XX +XXX,XX @@

# Since: 4.2

##

{ 'enum': 'BlockExportType',

- 'data': [ 'nbd', 'vhost-user-blk',

+ 'data': [ 'nbd',

+ { 'name': 'vhost-user-blk', 'if': 'CONFIG_VHOST_USER_BLK_SERVER' },

{ 'name': 'fuse', 'if': 'CONFIG_FUSE' } ] }

##

@@ -XXX,XX +XXX,XX @@

'discriminator': 'type',

'data': {

'nbd': 'BlockExportOptionsNbd',

- 'vhost-user-blk': 'BlockExportOptionsVhostUserBlk',

+ 'vhost-user-blk': { 'type': 'BlockExportOptionsVhostUserBlk',

+ 'if': 'CONFIG_VHOST_USER_BLK_SERVER' },

'fuse': { 'type': 'BlockExportOptionsFuse',

'if': 'CONFIG_FUSE' }

} }

2.31.1

From: Stefan Hajnoczi <stefanha@redhat.com>

The BlockBackend root child can change when aio_poll() is invoked. This

happens when a temporary filter node is removed upon blockjob

completion, for example.

Functions in block/block-backend.c must be aware of this when using a

blk_bs() pointer across aio_poll() because the BlockDriverState refcnt

may reach 0, resulting in a stale pointer.

One example is scsi_device_purge_requests(), which calls blk_drain() to

wait for in-flight requests to cancel. If the backup blockjob is active,

then the BlockBackend root child is a temporary filter BDS owned by the

blockjob. The blockjob can complete during bdrv_drained_begin() and the

last reference to the BDS is released when the temporary filter node is

removed. This results in a use-after-free when blk_drain() calls

bdrv_drained_end(bs) on the dangling pointer.

Explicitly hold a reference to bs across block APIs that invoke

aio_poll().

Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2021778

Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2036178

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Message-Id: <20220111153613.25453-2-stefanha@redhat.com>

block/block-backend.c | 19 +++++++++++++++++--

1 file changed, 17 insertions(+), 2 deletions(-)

@@ -XXX,XX +XXX,XX @@ BlockBackend *blk_by_public(BlockBackendPublic *public)

void blk_remove_bs(BlockBackend *blk)

{

ThrottleGroupMember *tgm = &blk->public.throttle_group_member;

- BlockDriverState *bs;

BdrvChild *root;

notifier_list_notify(&blk->remove_bs_notifiers, blk);

if (tgm->throttle_state) {

- bs = blk_bs(blk);

+ BlockDriverState *bs = blk_bs(blk);

+

+ /*

+ * Take a ref in case blk_bs() changes across bdrv_drained_begin(), for

+ * example, if a temporary filter node is removed by a blockjob.

+ */

+ bdrv_ref(bs);

bdrv_drained_begin(bs);

throttle_group_detach_aio_context(tgm);

throttle_group_attach_aio_context(tgm, qemu_get_aio_context());

bdrv_drained_end(bs);

+ bdrv_unref(bs);

blk_update_root_state(blk);

@@ -XXX,XX +XXX,XX @@ void blk_drain(BlockBackend *blk)

BlockDriverState *bs = blk_bs(blk);

if (bs) {

+ bdrv_ref(bs);

bdrv_drained_begin(bs);

}

@@ -XXX,XX +XXX,XX @@ void blk_drain(BlockBackend *blk)

if (bs) {

bdrv_drained_end(bs);

+ bdrv_unref(bs);

}

@@ -XXX,XX +XXX,XX @@ static int blk_do_set_aio_context(BlockBackend *blk, AioContext *new_context,

if (bs) {

+ bdrv_ref(bs);

+

if (update_root_node) {

ret = bdrv_child_try_set_aio_context(bs, new_context, blk->root,

errp);

+ bdrv_unref(bs);