[Qemu-devel] [PULL 0/8] 9p patches for 2.8 20160916

[Qemu-devel] [PULL 0/8] 9p patches for 2.8 20160916

[Greg Kurz]

The following changes since commit 5f473241ac595452ae0638dc63e7af2a2294f5ec:

  Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging (2016-09-15 18:12:40 +0100)

are available in the git repository at:

  https://github.com/gkurz/qemu.git tags/for-upstream

for you to fetch changes up to 5c574f1bf92cfaf4aae6cbb66b79066c654920e1:

  9pfs: fix potential segfault during walk (2016-09-16 12:16:29 +0200)

----------------------------------------------------------------
This pull request contains:
- a fix for a regression introduced in 2.7
- basic functional testing for virtio-9p
- some code cleanups for 9pfs

----------------------------------------------------------------
Greg Kurz (8):
      9pfs: drop unused fmt strings in the proxy backend
      9pfs: drop duplicate line in proxy backend
      9pfs: drop useless v9fs_string_null() function
      9pfs: introduce v9fs_path_sprintf() helper
      tests: virtio-9p: introduce start/stop functions
      tests: virtio-9p: add basic configuration test
      tests: virtio-9p: add basic transaction test
      9pfs: fix potential segfault during walk

 fsdev/9p-marshal.c     |   5 --
 fsdev/9p-marshal.h     |   1 -
 hw/9pfs/9p-local.c     |   7 +-
 hw/9pfs/9p-proxy.c     |  75 +++++++++------------
 hw/9pfs/9p.c           |  32 ++++++---
 hw/9pfs/9p.h           |   1 +
 tests/Makefile.include |   2 +-
 tests/virtio-9p-test.c | 179 ++++++++++++++++++++++++++++++++++++++++++++-----
 8 files changed, 222 insertions(+), 80 deletions(-)
-- 
2.5.5

[Qemu-devel] [PULL 1/8] 9pfs: drop unused fmt strings in the proxy backend

[Greg Kurz]

The v9fs_request() function doesn't use its fmt argument: it passes literal
format strings to proxy_marshal() for all commands.

This patch simply drops the unused fmt argument and updates all callers
accordingly.

Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
---
 hw/9pfs/9p-proxy.c | 67 ++++++++++++++++++++++++------------------------------
 1 file changed, 30 insertions(+), 37 deletions(-)

diff --git a/hw/9pfs/9p-proxy.c b/hw/9pfs/9p-proxy.c
index f265501eac1d..52bbf4f1b37c 100644
--- a/hw/9pfs/9p-proxy.c
+++ b/hw/9pfs/9p-proxy.c
@@ -294,8 +294,7 @@ static int v9fs_receive_status(V9fsProxy *proxy,
  * This request read by proxy helper process
  * returns 0 on success and -errno on error
  */
-static int v9fs_request(V9fsProxy *proxy, int type,
-                        void *response, const char *fmt, ...)
+static int v9fs_request(V9fsProxy *proxy, int type, void *response, ...)
 {
     dev_t rdev;
     va_list ap;
@@ -317,7 +316,7 @@ static int v9fs_request(V9fsProxy *proxy, int type,
     }
     iovec = &proxy->out_iovec;
     reply = &proxy->in_iovec;
-    va_start(ap, fmt);
+    va_start(ap, response);
     switch (type) {
     case T_OPEN:
         path = va_arg(ap, V9fsString *);
@@ -605,7 +604,7 @@ close_error:
 static int proxy_lstat(FsContext *fs_ctx, V9fsPath *fs_path, struct stat *stbuf)
 {
     int retval;
-    retval = v9fs_request(fs_ctx->private, T_LSTAT, stbuf, "s", fs_path);
+    retval = v9fs_request(fs_ctx->private, T_LSTAT, stbuf, fs_path);
     if (retval < 0) {
         errno = -retval;
         return -1;
@@ -617,8 +616,7 @@ static ssize_t proxy_readlink(FsContext *fs_ctx, V9fsPath *fs_path,
                               char *buf, size_t bufsz)
 {
     int retval;
-    retval = v9fs_request(fs_ctx->private, T_READLINK, buf, "sd",
-                          fs_path, bufsz);
+    retval = v9fs_request(fs_ctx->private, T_READLINK, buf, fs_path, bufsz);
     if (retval < 0) {
         errno = -retval;
         return -1;
@@ -639,7 +637,7 @@ static int proxy_closedir(FsContext *ctx, V9fsFidOpenState *fs)
 static int proxy_open(FsContext *ctx, V9fsPath *fs_path,
                       int flags, V9fsFidOpenState *fs)
 {
-    fs->fd = v9fs_request(ctx->private, T_OPEN, NULL, "sd", fs_path, flags);
+    fs->fd = v9fs_request(ctx->private, T_OPEN, NULL, fs_path, flags);
     if (fs->fd < 0) {
         errno = -fs->fd;
         fs->fd = -1;
@@ -653,7 +651,7 @@ static int proxy_opendir(FsContext *ctx,
     int serrno, fd;
 
     fs->dir.stream = NULL;
-    fd = v9fs_request(ctx->private, T_OPEN, NULL, "sd", fs_path, O_DIRECTORY);
+    fd = v9fs_request(ctx->private, T_OPEN, NULL, fs_path, O_DIRECTORY);
     if (fd < 0) {
         errno = -fd;
         return -1;
@@ -735,8 +733,8 @@ static ssize_t proxy_pwritev(FsContext *ctx, V9fsFidOpenState *fs,
 static int proxy_chmod(FsContext *fs_ctx, V9fsPath *fs_path, FsCred *credp)
 {
     int retval;
-    retval = v9fs_request(fs_ctx->private, T_CHMOD, NULL, "sd",
-                          fs_path, credp->fc_mode);
+    retval = v9fs_request(fs_ctx->private, T_CHMOD, NULL, fs_path,
+                          credp->fc_mode);
     if (retval < 0) {
         errno = -retval;
     }
@@ -752,8 +750,8 @@ static int proxy_mknod(FsContext *fs_ctx, V9fsPath *dir_path,
     v9fs_string_init(&fullname);
     v9fs_string_sprintf(&fullname, "%s/%s", dir_path->data, name);
 
-    retval = v9fs_request(fs_ctx->private, T_MKNOD, NULL, "sdqdd",
-                          &fullname, credp->fc_mode, credp->fc_rdev,
+    retval = v9fs_request(fs_ctx->private, T_MKNOD, NULL, &fullname,
+                          credp->fc_mode, credp->fc_rdev,
                           credp->fc_uid, credp->fc_gid);
     v9fs_string_free(&fullname);
     if (retval < 0) {
@@ -772,7 +770,7 @@ static int proxy_mkdir(FsContext *fs_ctx, V9fsPath *dir_path,
     v9fs_string_init(&fullname);
     v9fs_string_sprintf(&fullname, "%s/%s", dir_path->data, name);
 
-    retval = v9fs_request(fs_ctx->private, T_MKDIR, NULL, "sddd", &fullname,
+    retval = v9fs_request(fs_ctx->private, T_MKDIR, NULL, &fullname,
                           credp->fc_mode, credp->fc_uid, credp->fc_gid);
     v9fs_string_free(&fullname);
     if (retval < 0) {
@@ -804,9 +802,8 @@ static int proxy_open2(FsContext *fs_ctx, V9fsPath *dir_path, const char *name,
     v9fs_string_init(&fullname);
     v9fs_string_sprintf(&fullname, "%s/%s", dir_path->data, name);
 
-    fs->fd = v9fs_request(fs_ctx->private, T_CREATE, NULL, "sdddd",
-                          &fullname, flags, credp->fc_mode,
-                          credp->fc_uid, credp->fc_gid);
+    fs->fd = v9fs_request(fs_ctx->private, T_CREATE, NULL, &fullname, flags,
+                          credp->fc_mode, credp->fc_uid, credp->fc_gid);
     v9fs_string_free(&fullname);
     if (fs->fd < 0) {
         errno = -fs->fd;
@@ -827,8 +824,8 @@ static int proxy_symlink(FsContext *fs_ctx, const char *oldpath,
     v9fs_string_sprintf(&fullname, "%s/%s", dir_path->data, name);
     v9fs_string_sprintf(&target, "%s", oldpath);
 
-    retval = v9fs_request(fs_ctx->private, T_SYMLINK, NULL, "ssdd",
-                          &target, &fullname, credp->fc_uid, credp->fc_gid);
+    retval = v9fs_request(fs_ctx->private, T_SYMLINK, NULL, &target, &fullname,
+                          credp->fc_uid, credp->fc_gid);
     v9fs_string_free(&fullname);
     v9fs_string_free(&target);
     if (retval < 0) {
@@ -847,7 +844,7 @@ static int proxy_link(FsContext *ctx, V9fsPath *oldpath,
     v9fs_string_init(&newpath);
     v9fs_string_sprintf(&newpath, "%s/%s", dirpath->data, name);
 
-    retval = v9fs_request(ctx->private, T_LINK, NULL, "ss", oldpath, &newpath);
+    retval = v9fs_request(ctx->private, T_LINK, NULL, oldpath, &newpath);
     v9fs_string_free(&newpath);
     if (retval < 0) {
         errno = -retval;
@@ -860,7 +857,7 @@ static int proxy_truncate(FsContext *ctx, V9fsPath *fs_path, off_t size)
 {
     int retval;
 
-    retval = v9fs_request(ctx->private, T_TRUNCATE, NULL, "sq", fs_path, size);
+    retval = v9fs_request(ctx->private, T_TRUNCATE, NULL, fs_path, size);
     if (retval < 0) {
         errno = -retval;
         return -1;
@@ -879,8 +876,7 @@ static int proxy_rename(FsContext *ctx, const char *oldpath,
 
     v9fs_string_sprintf(&oldname, "%s", oldpath);
     v9fs_string_sprintf(&newname, "%s", newpath);
-    retval = v9fs_request(ctx->private, T_RENAME, NULL, "ss",
-                          &oldname, &newname);
+    retval = v9fs_request(ctx->private, T_RENAME, NULL, &oldname, &newname);
     v9fs_string_free(&oldname);
     v9fs_string_free(&newname);
     if (retval < 0) {
@@ -892,8 +888,8 @@ static int proxy_rename(FsContext *ctx, const char *oldpath,
 static int proxy_chown(FsContext *fs_ctx, V9fsPath *fs_path, FsCred *credp)
 {
     int retval;
-    retval = v9fs_request(fs_ctx->private, T_CHOWN, NULL, "sdd",
-                          fs_path, credp->fc_uid, credp->fc_gid);
+    retval = v9fs_request(fs_ctx->private, T_CHOWN, NULL, fs_path,
+                          credp->fc_uid, credp->fc_gid);
     if (retval < 0) {
         errno = -retval;
     }
@@ -904,8 +900,7 @@ static int proxy_utimensat(FsContext *s, V9fsPath *fs_path,
                            const struct timespec *buf)
 {
     int retval;
-    retval = v9fs_request(s->private, T_UTIME, NULL, "sqqqq",
-                          fs_path,
+    retval = v9fs_request(s->private, T_UTIME, NULL, fs_path,
                           buf[0].tv_sec, buf[0].tv_nsec,
                           buf[1].tv_sec, buf[1].tv_nsec);
     if (retval < 0) {
@@ -920,7 +915,7 @@ static int proxy_remove(FsContext *ctx, const char *path)
     V9fsString name;
     v9fs_string_init(&name);
     v9fs_string_sprintf(&name, "%s", path);
-    retval = v9fs_request(ctx->private, T_REMOVE, NULL, "s", &name);
+    retval = v9fs_request(ctx->private, T_REMOVE, NULL, &name);
     v9fs_string_free(&name);
     if (retval < 0) {
         errno = -retval;
@@ -949,7 +944,7 @@ static int proxy_fsync(FsContext *ctx, int fid_type,
 static int proxy_statfs(FsContext *s, V9fsPath *fs_path, struct statfs *stbuf)
 {
     int retval;
-    retval = v9fs_request(s->private, T_STATFS, stbuf, "s", fs_path);
+    retval = v9fs_request(s->private, T_STATFS, stbuf, fs_path);
     if (retval < 0) {
         errno = -retval;
         return -1;
@@ -965,8 +960,8 @@ static ssize_t proxy_lgetxattr(FsContext *ctx, V9fsPath *fs_path,
 
     v9fs_string_init(&xname);
     v9fs_string_sprintf(&xname, "%s", name);
-    retval = v9fs_request(ctx->private, T_LGETXATTR, value, "dss", size,
-                          fs_path, &xname);
+    retval = v9fs_request(ctx->private, T_LGETXATTR, value, size, fs_path,
+                          &xname);
     v9fs_string_free(&xname);
     if (retval < 0) {
         errno = -retval;
@@ -978,8 +973,7 @@ static ssize_t proxy_llistxattr(FsContext *ctx, V9fsPath *fs_path,
                                 void *value, size_t size)
 {
     int retval;
-    retval = v9fs_request(ctx->private, T_LLISTXATTR, value, "ds", size,
-                        fs_path);
+    retval = v9fs_request(ctx->private, T_LLISTXATTR, value, size, fs_path);
     if (retval < 0) {
         errno = -retval;
     }
@@ -1000,8 +994,8 @@ static int proxy_lsetxattr(FsContext *ctx, V9fsPath *fs_path, const char *name,
     xvalue.data = g_malloc(size);
     memcpy(xvalue.data, value, size);
 
-    retval = v9fs_request(ctx->private, T_LSETXATTR, value, "sssdd",
-                          fs_path, &xname, &xvalue, size, flags);
+    retval = v9fs_request(ctx->private, T_LSETXATTR, value, fs_path, &xname,
+                          &xvalue, size, flags);
     v9fs_string_free(&xname);
     v9fs_string_free(&xvalue);
     if (retval < 0) {
@@ -1018,8 +1012,7 @@ static int proxy_lremovexattr(FsContext *ctx, V9fsPath *fs_path,
 
     v9fs_string_init(&xname);
     v9fs_string_sprintf(&xname, "%s", name);
-    retval = v9fs_request(ctx->private, T_LREMOVEXATTR, NULL, "ss",
-                          fs_path, &xname);
+    retval = v9fs_request(ctx->private, T_LREMOVEXATTR, NULL, fs_path, &xname);
     v9fs_string_free(&xname);
     if (retval < 0) {
         errno = -retval;
@@ -1086,7 +1079,7 @@ static int proxy_ioc_getversion(FsContext *fs_ctx, V9fsPath *path,
         errno = ENOTTY;
         return -1;
     }
-    err = v9fs_request(fs_ctx->private, T_GETVERSION, st_gen, "s", path);
+    err = v9fs_request(fs_ctx->private, T_GETVERSION, st_gen, path);
     if (err < 0) {
         errno = -err;
         err = -1;
-- 
2.5.5

[Qemu-devel] [PULL 2/8] 9pfs: drop duplicate line in proxy backend

[Greg Kurz]

This double free did not cause harm because v9fs_string_free() sets
str->data to NULL and g_free(NULL) is valid.

Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
---
 hw/9pfs/9p-proxy.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/hw/9pfs/9p-proxy.c b/hw/9pfs/9p-proxy.c
index 52bbf4f1b37c..d091564b6fd2 100644
--- a/hw/9pfs/9p-proxy.c
+++ b/hw/9pfs/9p-proxy.c
@@ -777,7 +777,6 @@ static int proxy_mkdir(FsContext *fs_ctx, V9fsPath *dir_path,
         errno = -retval;
         retval = -1;
     }
-    v9fs_string_free(&fullname);
     return retval;
 }
 
-- 
2.5.5

[Qemu-devel] [PULL 3/8] 9pfs: drop useless v9fs_string_null() function

[Greg Kurz]

The v9fs_string_null() function just calls v9fs_string_free(). Also it
only has 4 users, whereas v9fs_string_free() has 87.

This patch converts users to call directly v9fs_string_free() and drops
the useless function.

Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
---
 fsdev/9p-marshal.c | 5 -----
 fsdev/9p-marshal.h | 1 -
 hw/9pfs/9p.c       | 8 ++++----
 3 files changed, 4 insertions(+), 10 deletions(-)

diff --git a/fsdev/9p-marshal.c b/fsdev/9p-marshal.c
index 238dbf21b1d5..a01bba6908a8 100644
--- a/fsdev/9p-marshal.c
+++ b/fsdev/9p-marshal.c
@@ -25,11 +25,6 @@ void v9fs_string_free(V9fsString *str)
     str->size = 0;
 }
 
-void v9fs_string_null(V9fsString *str)
-{
-    v9fs_string_free(str);
-}
-
 void GCC_FMT_ATTR(2, 3)
 v9fs_string_sprintf(V9fsString *str, const char *fmt, ...)
 {
diff --git a/fsdev/9p-marshal.h b/fsdev/9p-marshal.h
index 140db6d99f9c..77f7fef326ee 100644
--- a/fsdev/9p-marshal.h
+++ b/fsdev/9p-marshal.h
@@ -77,7 +77,6 @@ static inline void v9fs_string_init(V9fsString *str)
     str->size = 0;
 }
 extern void v9fs_string_free(V9fsString *str);
-extern void v9fs_string_null(V9fsString *str);
 extern void v9fs_string_sprintf(V9fsString *str, const char *fmt, ...);
 extern void v9fs_string_copy(V9fsString *lhs, V9fsString *rhs);
 
diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
index dfe293d11d1c..d8f48ca76c47 100644
--- a/hw/9pfs/9p.c
+++ b/hw/9pfs/9p.c
@@ -810,15 +810,15 @@ static int stat_to_v9stat(V9fsPDU *pdu, V9fsPath *name,
     v9stat->mtime = stbuf->st_mtime;
     v9stat->length = stbuf->st_size;
 
-    v9fs_string_null(&v9stat->uid);
-    v9fs_string_null(&v9stat->gid);
-    v9fs_string_null(&v9stat->muid);
+    v9fs_string_free(&v9stat->uid);
+    v9fs_string_free(&v9stat->gid);
+    v9fs_string_free(&v9stat->muid);
 
     v9stat->n_uid = stbuf->st_uid;
     v9stat->n_gid = stbuf->st_gid;
     v9stat->n_muid = 0;
 
-    v9fs_string_null(&v9stat->extension);
+    v9fs_string_free(&v9stat->extension);
 
     if (v9stat->mode & P9_STAT_MODE_SYMLINK) {
         err = v9fs_co_readlink(pdu, name, &v9stat->extension);
-- 
2.5.5

[Qemu-devel] [PULL 4/8] 9pfs: introduce v9fs_path_sprintf() helper

[Greg Kurz]

This helper is similar to v9fs_string_sprintf(), but it includes the
terminating NUL character in the size field.

This is to avoid doing v9fs_string_sprintf((V9fsString *) &path) and
then bumping the size.

Affected users are changed to use this new helper.

Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
---
 hw/9pfs/9p-local.c |  7 ++-----
 hw/9pfs/9p-proxy.c |  7 ++-----
 hw/9pfs/9p.c       | 19 ++++++++++++++++---
 hw/9pfs/9p.h       |  1 +
 4 files changed, 21 insertions(+), 13 deletions(-)

diff --git a/hw/9pfs/9p-local.c b/hw/9pfs/9p-local.c
index 3f271fcbd2c5..845675e7a1bb 100644
--- a/hw/9pfs/9p-local.c
+++ b/hw/9pfs/9p-local.c
@@ -1060,13 +1060,10 @@ static int local_name_to_path(FsContext *ctx, V9fsPath *dir_path,
                               const char *name, V9fsPath *target)
 {
     if (dir_path) {
-        v9fs_string_sprintf((V9fsString *)target, "%s/%s",
-                            dir_path->data, name);
+        v9fs_path_sprintf(target, "%s/%s", dir_path->data, name);
     } else {
-        v9fs_string_sprintf((V9fsString *)target, "%s", name);
+        v9fs_path_sprintf(target, "%s", name);
     }
-    /* Bump the size for including terminating NULL */
-    target->size++;
     return 0;
 }
 
diff --git a/hw/9pfs/9p-proxy.c b/hw/9pfs/9p-proxy.c
index d091564b6fd2..f2417b7fd73d 100644
--- a/hw/9pfs/9p-proxy.c
+++ b/hw/9pfs/9p-proxy.c
@@ -1023,13 +1023,10 @@ static int proxy_name_to_path(FsContext *ctx, V9fsPath *dir_path,
                               const char *name, V9fsPath *target)
 {
     if (dir_path) {
-        v9fs_string_sprintf((V9fsString *)target, "%s/%s",
-                            dir_path->data, name);
+        v9fs_path_sprintf(target, "%s/%s", dir_path->data, name);
     } else {
-        v9fs_string_sprintf((V9fsString *)target, "%s", name);
+        v9fs_path_sprintf(target, "%s", name);
     }
-    /* Bump the size for including terminating NULL */
-    target->size++;
     return 0;
 }
 
diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
index d8f48ca76c47..639f93930285 100644
--- a/hw/9pfs/9p.c
+++ b/hw/9pfs/9p.c
@@ -12,6 +12,7 @@
  */
 
 #include "qemu/osdep.h"
+#include <glib/gprintf.h>
 #include "hw/virtio/virtio.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
@@ -179,6 +180,20 @@ void v9fs_path_free(V9fsPath *path)
     path->size = 0;
 }
 
+
+void GCC_FMT_ATTR(2, 3)
+v9fs_path_sprintf(V9fsPath *path, const char *fmt, ...)
+{
+    va_list ap;
+
+    v9fs_path_free(path);
+
+    va_start(ap, fmt);
+    /* Bump the size for including terminating NULL */
+    path->size = g_vasprintf(&path->data, fmt, ap) + 1;
+    va_end(ap);
+}
+
 void v9fs_path_copy(V9fsPath *lhs, V9fsPath *rhs)
 {
     v9fs_path_free(lhs);
@@ -917,10 +932,8 @@ static void v9fs_fix_path(V9fsPath *dst, V9fsPath *src, int len)
     V9fsPath str;
     v9fs_path_init(&str);
     v9fs_path_copy(&str, dst);
-    v9fs_string_sprintf((V9fsString *)dst, "%s%s", src->data, str.data+len);
+    v9fs_path_sprintf(dst, "%s%s", src->data, str.data + len);
     v9fs_path_free(&str);
-    /* +1 to include terminating NULL */
-    dst->size++;
 }
 
 static inline bool is_ro_export(FsContext *ctx)
diff --git a/hw/9pfs/9p.h b/hw/9pfs/9p.h
index a38603398ef5..d539d2ebe9c0 100644
--- a/hw/9pfs/9p.h
+++ b/hw/9pfs/9p.h
@@ -327,6 +327,7 @@ static inline uint8_t v9fs_request_cancelled(V9fsPDU *pdu)
 extern void v9fs_reclaim_fd(V9fsPDU *pdu);
 extern void v9fs_path_init(V9fsPath *path);
 extern void v9fs_path_free(V9fsPath *path);
+extern void v9fs_path_sprintf(V9fsPath *path, const char *fmt, ...);
 extern void v9fs_path_copy(V9fsPath *lhs, V9fsPath *rhs);
 extern int v9fs_name_to_path(V9fsState *s, V9fsPath *dirpath,
                              const char *name, V9fsPath *path);
-- 
2.5.5

[Qemu-devel] [PULL 5/8] tests: virtio-9p: introduce start/stop functions

[Greg Kurz]

First step to be able to run several functional steps.

Signed-off-by: Greg Kurz <groug@kaod.org>
Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
---
 tests/virtio-9p-test.c | 42 +++++++++++++++++++++++++-----------------
 1 file changed, 25 insertions(+), 17 deletions(-)

diff --git a/tests/virtio-9p-test.c b/tests/virtio-9p-test.c
index 1e39335a7945..45fc8041d7f3 100644
--- a/tests/virtio-9p-test.c
+++ b/tests/virtio-9p-test.c
@@ -11,33 +11,41 @@
 #include "libqtest.h"
 #include "qemu-common.h"
 
-/* Tests only initialization so far. TODO: Replace with functional tests */
-static void pci_nop(void)
-{
-}
+static const char mount_tag[] = "qtest";
+static char *test_share;
 
-static char test_share[] = "/tmp/qtest.XXXXXX";
-
-int main(int argc, char **argv)
+static void qvirtio_9p_start(void)
 {
     char *args;
-    int ret;
 
-    g_test_init(&argc, &argv, NULL);
-    qtest_add_func("/virtio/9p/pci/nop", pci_nop);
-
-    g_assert(mkdtemp(test_share));
+    test_share = g_strdup("/tmp/qtest.XXXXXX");
+    g_assert_nonnull(mkdtemp(test_share));
 
     args = g_strdup_printf("-fsdev local,id=fsdev0,security_model=none,path=%s "
-                           "-device virtio-9p-pci,fsdev=fsdev0,mount_tag=qtest",
-                           test_share);
+                           "-device virtio-9p-pci,fsdev=fsdev0,mount_tag=%s",
+                           test_share, mount_tag);
+
     qtest_start(args);
     g_free(args);
+}
 
-    ret = g_test_run();
-
+static void qvirtio_9p_stop(void)
+{
     qtest_end();
     rmdir(test_share);
+    g_free(test_share);
+}
+
+static void pci_nop(void)
+{
+    qvirtio_9p_start();
+    qvirtio_9p_stop();
+}
+
+int main(int argc, char **argv)
+{
+    g_test_init(&argc, &argv, NULL);
+    qtest_add_func("/virtio/9p/pci/nop", pci_nop);
 
-    return ret;
+    return g_test_run();
 }
-- 
2.5.5

[Qemu-devel] [PULL 6/8] tests: virtio-9p: add basic configuration test

[Greg Kurz]

This adds PCI init code and a basic test that checks the device config
matches what is passed on the command line.

Signed-off-by: Greg Kurz <groug@kaod.org>
Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
---
 tests/Makefile.include |  2 +-
 tests/virtio-9p-test.c | 77 ++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 78 insertions(+), 1 deletion(-)

diff --git a/tests/Makefile.include b/tests/Makefile.include
index 2f11064699d7..6052a3828f68 100644
--- a/tests/Makefile.include
+++ b/tests/Makefile.include
@@ -627,7 +627,7 @@ tests/virtio-blk-test$(EXESUF): tests/virtio-blk-test.o $(libqos-virtio-obj-y)
 tests/virtio-net-test$(EXESUF): tests/virtio-net-test.o $(libqos-pc-obj-y) $(libqos-virtio-obj-y)
 tests/virtio-rng-test$(EXESUF): tests/virtio-rng-test.o $(libqos-pc-obj-y)
 tests/virtio-scsi-test$(EXESUF): tests/virtio-scsi-test.o $(libqos-virtio-obj-y)
-tests/virtio-9p-test$(EXESUF): tests/virtio-9p-test.o
+tests/virtio-9p-test$(EXESUF): tests/virtio-9p-test.o $(libqos-virtio-obj-y)
 tests/virtio-serial-test$(EXESUF): tests/virtio-serial-test.o
 tests/virtio-console-test$(EXESUF): tests/virtio-console-test.o
 tests/tpci200-test$(EXESUF): tests/tpci200-test.o
diff --git a/tests/virtio-9p-test.c b/tests/virtio-9p-test.c
index 45fc8041d7f3..b8fb6cd869a9 100644
--- a/tests/virtio-9p-test.c
+++ b/tests/virtio-9p-test.c
@@ -10,6 +10,13 @@
 #include "qemu/osdep.h"
 #include "libqtest.h"
 #include "qemu-common.h"
+#include "libqos/pci-pc.h"
+#include "libqos/virtio.h"
+#include "libqos/virtio-pci.h"
+#include "libqos/malloc.h"
+#include "libqos/malloc-pc.h"
+#include "standard-headers/linux/virtio_ids.h"
+#include "standard-headers/linux/virtio_pci.h"
 
 static const char mount_tag[] = "qtest";
 static char *test_share;
@@ -42,10 +49,80 @@ static void pci_nop(void)
     qvirtio_9p_stop();
 }
 
+typedef struct {
+    QVirtioDevice *dev;
+    QGuestAllocator *alloc;
+    QPCIBus *bus;
+    QVirtQueue *vq;
+} QVirtIO9P;
+
+static QVirtIO9P *qvirtio_9p_pci_init(void)
+{
+    QVirtIO9P *v9p;
+    QVirtioPCIDevice *dev;
+
+    v9p = g_new0(QVirtIO9P, 1);
+    v9p->alloc = pc_alloc_init();
+    v9p->bus = qpci_init_pc();
+
+    dev = qvirtio_pci_device_find(v9p->bus, VIRTIO_ID_9P);
+    g_assert_nonnull(dev);
+    g_assert_cmphex(dev->vdev.device_type, ==, VIRTIO_ID_9P);
+    v9p->dev = (QVirtioDevice *) dev;
+
+    qvirtio_pci_device_enable(dev);
+    qvirtio_reset(&qvirtio_pci, v9p->dev);
+    qvirtio_set_acknowledge(&qvirtio_pci, v9p->dev);
+    qvirtio_set_driver(&qvirtio_pci, v9p->dev);
+
+    v9p->vq = qvirtqueue_setup(&qvirtio_pci, v9p->dev, v9p->alloc, 0);
+    return v9p;
+}
+
+static void qvirtio_9p_pci_free(QVirtIO9P *v9p)
+{
+    qvirtqueue_cleanup(&qvirtio_pci, v9p->vq, v9p->alloc);
+    pc_alloc_uninit(v9p->alloc);
+    qvirtio_pci_device_disable(container_of(v9p->dev, QVirtioPCIDevice, vdev));
+    g_free(v9p->dev);
+    qpci_free_pc(v9p->bus);
+    g_free(v9p);
+}
+
+static void pci_basic_config(void)
+{
+    QVirtIO9P *v9p;
+    void *addr;
+    size_t tag_len;
+    char *tag;
+    int i;
+
+    qvirtio_9p_start();
+    v9p = qvirtio_9p_pci_init();
+
+    addr = ((QVirtioPCIDevice *) v9p->dev)->addr + VIRTIO_PCI_CONFIG_OFF(false);
+    tag_len = qvirtio_config_readw(&qvirtio_pci, v9p->dev,
+                                   (uint64_t)(uintptr_t)addr);
+    g_assert_cmpint(tag_len, ==, strlen(mount_tag));
+    addr += sizeof(uint16_t);
+
+    tag = g_malloc(tag_len);
+    for (i = 0; i < tag_len; i++) {
+        tag[i] = qvirtio_config_readb(&qvirtio_pci, v9p->dev,
+                                      (uint64_t)(uintptr_t)addr + i);
+    }
+    g_assert_cmpmem(tag, tag_len, mount_tag, tag_len);
+    g_free(tag);
+
+    qvirtio_9p_pci_free(v9p);
+    qvirtio_9p_stop();
+}
+
 int main(int argc, char **argv)
 {
     g_test_init(&argc, &argv, NULL);
     qtest_add_func("/virtio/9p/pci/nop", pci_nop);
+    qtest_add_func("/virtio/9p/pci/basic/configuration", pci_basic_config);
 
     return g_test_run();
 }
-- 
2.5.5

[Qemu-devel] [PULL 7/8] tests: virtio-9p: add basic transaction test

[Greg Kurz]

This adds a simple test to validate the device is functional: it transmits
a request with type Terror, which is not used by the 9P protocol [1], and
expects QEMU to return a reply with type Rerror and the "Operation not
supported" error string.

[1] http://lxr.free-electrons.com/source/include/net/9p/9p.h#L121

Signed-off-by: Greg Kurz <groug@kaod.org>
Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
---
 tests/virtio-9p-test.c | 62 ++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 62 insertions(+)

diff --git a/tests/virtio-9p-test.c b/tests/virtio-9p-test.c
index b8fb6cd869a9..2f579da6cdbd 100644
--- a/tests/virtio-9p-test.c
+++ b/tests/virtio-9p-test.c
@@ -8,6 +8,7 @@
  */
 
 #include "qemu/osdep.h"
+#include <glib/gprintf.h>
 #include "libqtest.h"
 #include "qemu-common.h"
 #include "libqos/pci-pc.h"
@@ -17,6 +18,9 @@
 #include "libqos/malloc-pc.h"
 #include "standard-headers/linux/virtio_ids.h"
 #include "standard-headers/linux/virtio_pci.h"
+#include "hw/9pfs/9p.h"
+
+#define QVIRTIO_9P_TIMEOUT_US (1 * 1000 * 1000)
 
 static const char mount_tag[] = "qtest";
 static char *test_share;
@@ -118,11 +122,69 @@ static void pci_basic_config(void)
     qvirtio_9p_stop();
 }
 
+typedef struct VirtIO9PHdr {
+    uint32_t size;
+    uint8_t id;
+    uint16_t tag;
+} QEMU_PACKED VirtIO9PHdr;
+
+typedef struct VirtIO9PMsgRError {
+    uint16_t error_len;
+    char error[0];
+} QEMU_PACKED VirtIO9PMsgRError;
+
+#define P9_MAX_SIZE 8192
+
+static void pci_basic_transaction(void)
+{
+    QVirtIO9P *v9p;
+    VirtIO9PHdr hdr;
+    VirtIO9PMsgRError *resp;
+    uint64_t req_addr, resp_addr;
+    uint32_t free_head;
+    char *expected_error = strerror(ENOTSUP);
+
+    qvirtio_9p_start();
+    v9p = qvirtio_9p_pci_init();
+
+    hdr.size = sizeof(hdr);
+    hdr.id = P9_TERROR;
+    hdr.tag = 12345;
+
+    req_addr = guest_alloc(v9p->alloc, hdr.size);
+    memwrite(req_addr, &hdr, sizeof(hdr));
+    free_head = qvirtqueue_add(v9p->vq, req_addr, hdr.size, false, true);
+
+    resp_addr = guest_alloc(v9p->alloc, P9_MAX_SIZE);
+    qvirtqueue_add(v9p->vq, resp_addr, P9_MAX_SIZE, true, false);
+
+    qvirtqueue_kick(&qvirtio_pci, v9p->dev, v9p->vq, free_head);
+    guest_free(v9p->alloc, req_addr);
+    qvirtio_wait_queue_isr(&qvirtio_pci, v9p->dev, v9p->vq,
+                           QVIRTIO_9P_TIMEOUT_US);
+
+    memread(resp_addr, &hdr, sizeof(hdr));
+    g_assert_cmpint(hdr.size, <, (uint32_t) P9_MAX_SIZE);
+    g_assert_cmpint(hdr.id, ==, (uint8_t) P9_RERROR);
+    g_assert_cmpint(hdr.tag, ==, (uint16_t) 12345);
+
+    resp = g_malloc(hdr.size);
+    memread(resp_addr + sizeof(hdr), resp, hdr.size - sizeof(hdr));
+    guest_free(v9p->alloc, resp_addr);
+    g_assert_cmpmem(resp->error, resp->error_len, expected_error,
+                    strlen(expected_error));
+    g_free(resp);
+
+    qvirtio_9p_pci_free(v9p);
+    qvirtio_9p_stop();
+}
+
 int main(int argc, char **argv)
 {
     g_test_init(&argc, &argv, NULL);
     qtest_add_func("/virtio/9p/pci/nop", pci_nop);
     qtest_add_func("/virtio/9p/pci/basic/configuration", pci_basic_config);
+    qtest_add_func("/virtio/9p/pci/basic/transaction", pci_basic_transaction);
 
     return g_test_run();
 }
-- 
2.5.5

[Qemu-devel] [PULL 8/8] 9pfs: fix potential segfault during walk

[Greg Kurz]

If the call to fid_to_qid() returns an error, we will call v9fs_path_free()
on uninitialized paths.

It is a regression introduced by the following commit:

56f101ecce0e 9pfs: handle walk of ".." in the root directory

Let's fix this by initializing dpath and path before calling fid_to_qid().

Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
[groug: updated the changelog to indicate this is regression and to provide
        the offending commit SHA1]
Signed-off-by: Greg Kurz <groug@kaod.org>
---
 hw/9pfs/9p.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
index 639f93930285..119ee584969b 100644
--- a/hw/9pfs/9p.c
+++ b/hw/9pfs/9p.c
@@ -1333,13 +1333,14 @@ static void v9fs_walk(void *opaque)
         goto out_nofid;
     }
 
+    v9fs_path_init(&dpath);
+    v9fs_path_init(&path);
+
     err = fid_to_qid(pdu, fidp, &qid);
     if (err < 0) {
         goto out;
     }
 
-    v9fs_path_init(&dpath);
-    v9fs_path_init(&path);
     /*
      * Both dpath and path initially poin to fidp.
      * Needed to handle request with nwnames == 0
-- 
2.5.5

Re: [Qemu-devel] [PULL 0/8] 9p patches for 2.8 20160916

[Peter Maydell]

On 16 September 2016 at 14:09, Greg Kurz <groug@kaod.org> wrote:
> The following changes since commit 5f473241ac595452ae0638dc63e7af2a2294f5ec:
>
>   Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging (2016-09-15 18:12:40 +0100)
>
> are available in the git repository at:
>
>   https://github.com/gkurz/qemu.git tags/for-upstream
>
> for you to fetch changes up to 5c574f1bf92cfaf4aae6cbb66b79066c654920e1:
>
>   9pfs: fix potential segfault during walk (2016-09-16 12:16:29 +0200)
>
> ----------------------------------------------------------------
> This pull request contains:
> - a fix for a regression introduced in 2.7
> - basic functional testing for virtio-9p
> - some code cleanups for 9pfs
>
> ----------------------------------------------------------------

Fails test on ppc64be:

  /i386/virtio/9p/pci/basic/transaction:                               **
ERROR:/home/pm215/qemu/tests/virtio-9p-test.c:167:pci_basic_transaction:
assertion failed (hdr.size
< (uint32_t) P9_MAX_SIZE): (603979776 < 8192)
FAIL
GTester: last random seed: R02S0ce79f32586824bc8cbd5461f009c62a
(pid=33294)

Looks like an endianness bug.

thanks
-- PMM

Re: [Qemu-devel] [PULL 0/8] 9p patches for 2.8 20160916

[Greg Kurz]

On Fri, 16 Sep 2016 15:25:42 +0100
Peter Maydell <peter.maydell@linaro.org> wrote:

> On 16 September 2016 at 14:09, Greg Kurz <groug@kaod.org> wrote:
> > The following changes since commit 5f473241ac595452ae0638dc63e7af2a2294f5ec:
> >
> >   Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging (2016-09-15 18:12:40 +0100)
> >
> > are available in the git repository at:
> >
> >   https://github.com/gkurz/qemu.git tags/for-upstream
> >
> > for you to fetch changes up to 5c574f1bf92cfaf4aae6cbb66b79066c654920e1:
> >
> >   9pfs: fix potential segfault during walk (2016-09-16 12:16:29 +0200)
> >
> > ----------------------------------------------------------------
> > This pull request contains:
> > - a fix for a regression introduced in 2.7
> > - basic functional testing for virtio-9p
> > - some code cleanups for 9pfs
> >
> > ----------------------------------------------------------------  
> 
> Fails test on ppc64be:
> 
>   /i386/virtio/9p/pci/basic/transaction:                               **
> ERROR:/home/pm215/qemu/tests/virtio-9p-test.c:167:pci_basic_transaction:
> assertion failed (hdr.size
> < (uint32_t) P9_MAX_SIZE): (603979776 < 8192)
> FAIL
> GTester: last random seed: R02S0ce79f32586824bc8cbd5461f009c62a
> (pid=33294)
> 
> Looks like an endianness bug.
> 

Ok, I'll look into it... but the important part in this pull request is
the "9pfs: fix potential segfault during walk" patch. It fixes a regression
introduced in 2.7 by the 9P security fixes. And IIUC, Michael Roth is about
to release 2.6.1.1 with these fixes and the regression...

Should I send a new pull request without the qtest patches ? Or with the
regression fix only ?

Please advise.

Thanks.

--
Greg

> thanks
> -- PMM

Re: [Qemu-devel] [PULL 0/8] 9p patches for 2.8 20160916

[Peter Maydell]

On 16 September 2016 at 15:39, Greg Kurz <groug@kaod.org> wrote:
> Ok, I'll look into it... but the important part in this pull request is
> the "9pfs: fix potential segfault during walk" patch. It fixes a regression
> introduced in 2.7 by the 9P security fixes. And IIUC, Michael Roth is about
> to release 2.6.1.1 with these fixes and the regression...
>
> Should I send a new pull request without the qtest patches ? Or with the
> regression fix only ?

That's up to you, as long as you don't break "make check".
You probably want to investigate at least enough to be happy that
this problem is a bug in the test code, not the feature itself.

thanks
-- PMM

Re: [Qemu-devel] [PULL 0/8] 9p patches for 2.8 20160916

[Greg Kurz]

On Fri, 16 Sep 2016 15:46:26 +0100
Peter Maydell <peter.maydell@linaro.org> wrote:

> On 16 September 2016 at 15:39, Greg Kurz <groug@kaod.org> wrote:
> > Ok, I'll look into it... but the important part in this pull request is
> > the "9pfs: fix potential segfault during walk" patch. It fixes a regression
> > introduced in 2.7 by the 9P security fixes. And IIUC, Michael Roth is about
> > to release 2.6.1.1 with these fixes and the regression...
> >
> > Should I send a new pull request without the qtest patches ? Or with the
> > regression fix only ?  
> 
> That's up to you, as long as you don't break "make check".
> You probably want to investigate at least enough to be happy that
> this problem is a bug in the test code, not the feature itself.
> 

It is the test code actually: 9P uses little-endian ordering :)

I'll post an updated version which doesn't break "make check" on both
BE and LE hosts, and re-send a pull request.

Cheers.

--
Greg

> thanks
> -- PMM