!652 上游社区Patch回合，Bugfix

From: @omnihorizon 
Reviewed-by: @yezengruan 
Signed-off-by: @yezengruan

exec-memory-Extract-address_space_set-from-dma_memor.patch

@@ -0,0 +1,116 @@
+From d9a1de34f34c853dc8596ba64b5d9c5d33c2f0cd Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
+Date: Sat, 15 Jan 2022 21:37:23 +0100
+Subject: [PATCH 1/5] exec/memory: Extract address_space_set() from
+ dma_memory_set()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+dma_memory_set() does a DMA barrier, set the address space with
+a constant value. The constant value filling code is not specific
+to DMA and can be used for AddressSpace. Extract it as a new
+helper: address_space_set().
+
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Laurent Vivier <laurent@vivier.eu>
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+[lv: rebase]
+Signed-off-by: Laurent Vivier <laurent@vivier.eu>
+Reviewed-by: David Hildenbrand <david@redhat.com>
+Reviewed-by: Peter Xu <peterx@redhat.com>
+Message-Id: <20220115203725.3834712-2-laurent@vivier.eu>
+Signed-off-by: zhangxinhao <zhangxinhao1@huawei.com>
+---
+ include/exec/memory.h | 16 ++++++++++++++++
+ softmmu/dma-helpers.c | 15 +--------------
+ softmmu/physmem.c     | 19 +++++++++++++++++++
+ 3 files changed, 36 insertions(+), 14 deletions(-)
+
+diff --git a/include/exec/memory.h b/include/exec/memory.h
+index 3e84d62e40..afa6039a9f 100644
+--- a/include/exec/memory.h
++++ b/include/exec/memory.h
+@@ -2966,6 +2966,22 @@ address_space_write_cached(MemoryRegionCache *cache, hwaddr addr,
+     }
+ }
+ 
++/**
++ * address_space_set: Fill address space with a constant byte.
++ *
++ * Return a MemTxResult indicating whether the operation succeeded
++ * or failed (eg unassigned memory, device rejected the transaction,
++ * IOMMU fault).
++ *
++ * @as: #AddressSpace to be accessed
++ * @addr: address within that address space
++ * @c: constant byte to fill the memory
++ * @len: the number of bytes to fill with the constant byte
++ * @attrs: memory transaction attributes
++ */
++MemTxResult address_space_set(AddressSpace *as, hwaddr addr,
++                              uint8_t c, hwaddr len, MemTxAttrs attrs);
++
+ #ifdef NEED_CPU_H
+ /* enum device_endian to MemOp.  */
+ static inline MemOp devend_memop(enum device_endian end)
+diff --git a/softmmu/dma-helpers.c b/softmmu/dma-helpers.c
+index b0be156479..c2028b6585 100644
+--- a/softmmu/dma-helpers.c
++++ b/softmmu/dma-helpers.c
+@@ -23,20 +23,7 @@ MemTxResult dma_memory_set(AddressSpace *as, dma_addr_t addr,
+ {
+     dma_barrier(as, DMA_DIRECTION_FROM_DEVICE);
+ 
+-#define FILLBUF_SIZE 512
+-    uint8_t fillbuf[FILLBUF_SIZE];
+-    int l;
+-    MemTxResult error = MEMTX_OK;
+-
+-    memset(fillbuf, c, FILLBUF_SIZE);
+-    while (len > 0) {
+-        l = len < FILLBUF_SIZE ? len : FILLBUF_SIZE;
+-        error |= address_space_write(as, addr, attrs, fillbuf, l);
+-        len -= l;
+-        addr += l;
+-    }
+-
+-    return error;
++    return address_space_set(as, addr, c, len, attrs);
+ }
+ 
+ void qemu_sglist_init(QEMUSGList *qsg, DeviceState *dev, int alloc_hint,
+diff --git a/softmmu/physmem.c b/softmmu/physmem.c
+index be39a49ceb..0e709ae384 100644
+--- a/softmmu/physmem.c
++++ b/softmmu/physmem.c
+@@ -2983,6 +2983,25 @@ MemTxResult address_space_rw(AddressSpace *as, hwaddr addr, MemTxAttrs attrs,
+     }
+ }
+ 
++MemTxResult address_space_set(AddressSpace *as, hwaddr addr,
++                              uint8_t c, hwaddr len, MemTxAttrs attrs)
++{
++#define FILLBUF_SIZE 512
++    uint8_t fillbuf[FILLBUF_SIZE];
++    int l;
++    MemTxResult error = MEMTX_OK;
++
++    memset(fillbuf, c, FILLBUF_SIZE);
++    while (len > 0) {
++        l = len < FILLBUF_SIZE ? len : FILLBUF_SIZE;
++        error |= address_space_write(as, addr, attrs, fillbuf, l);
++        len -= l;
++        addr += l;
++    }
++
++    return error;
++}
++
+ void cpu_physical_memory_rw(hwaddr addr, void *buf,
+                             hwaddr len, bool is_write)
+ {
+-- 
+2.27.0
+

hw-elf_ops-clear-uninitialized-segment-space.patch

@@ -0,0 +1,74 @@
+From 081ccc809448bec8e2bf144b2d49e64ed01b0e9f Mon Sep 17 00:00:00 2001
+From: Laurent Vivier <laurent@vivier.eu>
+Date: Sat, 15 Jan 2022 21:37:24 +0100
+Subject: [PATCH 2/5] hw/elf_ops: clear uninitialized segment space
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+When the mem_size of the segment is bigger than the file_size,
+and if this space doesn't overlap another segment, it needs
+to be cleared.
+
+This bug is very similar to the one we had for linux-user,
+22d113b52f41 ("linux-user: Fix loading of BSS segments"),
+where .bss section is encoded as an extension of the the data
+one by setting the segment p_memsz > p_filesz.
+
+Signed-off-by: Laurent Vivier <laurent@vivier.eu>
+[PMD: Use recently added address_space_set()]
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-Id: <20220115203725.3834712-3-laurent@vivier.eu>
+Signed-off-by: zhangxinhao <zhangxinhao1@huawei.com>
+---
+ hw/core/loader.c     |  4 ++++
+ include/hw/elf_ops.h | 13 +++++++++++++
+ 2 files changed, 17 insertions(+)
+
+diff --git a/hw/core/loader.c b/hw/core/loader.c
+index 052a0fd719..19edb928e9 100644
+--- a/hw/core/loader.c
++++ b/hw/core/loader.c
+@@ -1164,9 +1164,13 @@ static void rom_reset(void *unused)
+         if (rom->mr) {
+             void *host = memory_region_get_ram_ptr(rom->mr);
+             memcpy(host, rom->data, rom->datasize);
++            memset(host + rom->datasize, 0, rom->romsize - rom->datasize);
+         } else {
+             address_space_write_rom(rom->as, rom->addr, MEMTXATTRS_UNSPECIFIED,
+                                     rom->data, rom->datasize);
++            address_space_set(rom->as, rom->addr + rom->datasize, 0,
++                              rom->romsize - rom->datasize,
++                              MEMTXATTRS_UNSPECIFIED);
+         }
+         if (rom->isrom) {
+             /* rom needs to be written only once */
+diff --git a/include/hw/elf_ops.h b/include/hw/elf_ops.h
+index 995de8495c..7c3b1d0f6c 100644
+--- a/include/hw/elf_ops.h
++++ b/include/hw/elf_ops.h
+@@ -555,6 +555,19 @@ static ssize_t glue(load_elf, SZ)(const char *name, int fd,
+                     if (res != MEMTX_OK) {
+                         goto fail;
+                     }
++                    /*
++                     * We need to zero'ify the space that is not copied
++                     * from file
++                     */
++                    if (file_size < mem_size) {
++                        res = address_space_set(as ? as : &address_space_memory,
++                                                addr + file_size, 0,
++                                                mem_size - file_size,
++                                                MEMTXATTRS_UNSPECIFIED);
++                        if (res != MEMTX_OK) {
++                            goto fail;
++                        }
++                    }
+                 }
+             }
+ 
+-- 
+2.27.0
+

qemu.spec

@@ -1,6 +1,6 @@
 Name: qemu
 Version: 6.2.0
-Release: 50
+Release: 51
 Epoch: 10
 Summary: QEMU is a generic and open source machine emulator and virtualizer
 License: GPLv2 and BSD and MIT and CC-BY-SA-4.0
@@ -305,6 +305,11 @@ Patch0292: scsi-lsi53c895a-fix-use-after-free-in-lsi_do_msgout-.patch
 Patch0293: scsi-lsi53c895a-really-fix-use-after-free-in-lsi_do_.patch
 Patch0294: hw-usb-hcd-xhci-Fix-unbounded-loop-in-xhci_ring_chai.patch
 Patch0295: net-tulip-Restrict-DMA-engine-to-memories.patch
+Patch0296: exec-memory-Extract-address_space_set-from-dma_memor.patch
+Patch0297: hw-elf_ops-clear-uninitialized-segment-space.patch
+Patch0298: vhost-also-check-queue-state-in-the-vhost_dev_set_lo.patch
+Patch0299: vhost-net-fix-improper-cleanup-in-vhost_net_start.patch
+Patch0300: virtio-net-setup-vhost_dev-and-notifiers-for-cvq-onl.patch
 
 BuildRequires: flex
 BuildRequires: gcc
@@ -817,6 +822,13 @@ getent passwd qemu >/dev/null || \
 %endif
 
 %changelog
+* Fri Sep 30 2022 zhangxinhao <zhangxinhao1@huawei.com> - 10:6.2.0-51
+- exec/memory: Extract address_space_set() from dma_memory_set()
+- hw/elf_ops: clear uninitialized segment space
+- vhost: also check queue state in the vhost_dev_set_log
+- vhost-net: fix improper cleanup in vhost_net_start
+- virtio-net: setup vhost_dev and notifiers for cvq only
+
 * Fri Sep 30 2022 zhangbo <oscar.zhangbo@huawei.com> - 10:6.2.0-50
 - net: tulip: Restrict DMA engine to memories (CVE-2020-14394)
 

vhost-also-check-queue-state-in-the-vhost_dev_set_lo.patch

@@ -0,0 +1,39 @@
+From cb16f58f6db98113f9079b27e7e313c91060e6e4 Mon Sep 17 00:00:00 2001
+From: Ni Xun <richardni@tencent.com>
+Date: Thu, 9 Jun 2022 21:10:12 +0800
+Subject: [PATCH 3/5] vhost: also check queue state in the vhost_dev_set_log
+ error routine
+
+When check queue state in the vhost_dev_set_log routine, it miss the error
+routine check, this patch also check queue state in error case.
+
+Fixes: 1e5a050f5798 ("check queue state in the vhost_dev_set_log routine")
+Signed-off-by: Ni Xun <richardni@tencent.com>
+Reviewed-by: Zhigang Lu <tonnylu@tencent.com>
+Message-Id: <OS0PR01MB57139163F3F3955960675B52EAA79@OS0PR01MB5713.jpnprd01.prod.outlook.com>
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: zhangxinhao <zhangxinhao1@huawei.com>
+---
+ hw/virtio/vhost.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
+index 4c4072951c..3ac6cfde03 100644
+--- a/hw/virtio/vhost.c
++++ b/hw/virtio/vhost.c
+@@ -900,6 +900,10 @@ static int vhost_dev_set_log(struct vhost_dev *dev, bool enable_log)
+ err_vq:
+     for (; i >= 0; --i) {
+         idx = dev->vhost_ops->vhost_get_vq_index(dev, dev->vq_index + i);
++        addr = virtio_queue_get_desc_addr(dev->vdev, idx);
++        if (!addr) {
++            continue;
++        }
+         vhost_virtqueue_set_addr(dev, dev->vqs + i, idx,
+                                  dev->log_enabled);
+     }
+-- 
+2.27.0
+

vhost-net-fix-improper-cleanup-in-vhost_net_start.patch

@@ -0,0 +1,44 @@
+From 4670dbaa57d7f034c2b5720d2a4c141a82f73025 Mon Sep 17 00:00:00 2001
+From: Si-Wei Liu <si-wei.liu@oracle.com>
+Date: Fri, 6 May 2022 19:28:15 -0700
+Subject: [PATCH 4/5] vhost-net: fix improper cleanup in vhost_net_start
+
+vhost_net_start() missed a corresponding stop_one() upon error from
+vhost_set_vring_enable(). While at it, make the error handling for
+err_start more robust. No real issue was found due to this though.
+
+Signed-off-by: Si-Wei Liu <si-wei.liu@oracle.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Message-Id: <1651890498-24478-5-git-send-email-si-wei.liu@oracle.com>
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: zhangxinhao <zhangxinhao1@huawei.com>
+---
+ hw/net/vhost_net.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/hw/net/vhost_net.c b/hw/net/vhost_net.c
+index e8a79db94d..1911ffd7ed 100644
+--- a/hw/net/vhost_net.c
++++ b/hw/net/vhost_net.c
+@@ -439,6 +439,7 @@ int vhost_net_start(VirtIODevice *dev, NetClientState *ncs,
+             r = vhost_set_vring_enable(peer, peer->vring_enable);
+ 
+             if (r < 0) {
++                vhost_net_stop_one(get_vhost_net(peer), dev);
+                 goto err_start;
+             }
+         }
+@@ -448,7 +449,8 @@ int vhost_net_start(VirtIODevice *dev, NetClientState *ncs,
+ 
+ err_start:
+     while (--i >= 0) {
+-        peer = qemu_get_peer(ncs , i);
++        peer = qemu_get_peer(ncs, i < data_queue_pairs ?
++                                  i : n->max_queue_pairs);
+         vhost_net_stop_one(get_vhost_net(peer), dev);
+     }
+     e = k->set_guest_notifiers(qbus->parent, total_notifiers, false);
+-- 
+2.27.0
+

virtio-net-setup-vhost_dev-and-notifiers-for-cvq-onl.patch

@@ -0,0 +1,40 @@
+From 89409c7268be2feb85d33af1f3571c0cb62298fb Mon Sep 17 00:00:00 2001
+From: Si-Wei Liu <si-wei.liu@oracle.com>
+Date: Fri, 6 May 2022 19:28:12 -0700
+Subject: [PATCH 5/5] virtio-net: setup vhost_dev and notifiers for cvq only
+ when feature is negotiated
+
+When the control virtqueue feature is absent or not negotiated,
+vhost_net_start() still tries to set up vhost_dev and install
+vhost notifiers for the control virtqueue, which results in
+erroneous ioctl calls with incorrect queue index sending down
+to driver. Do that only when needed.
+
+Fixes: 22288fe ("virtio-net: vhost control virtqueue support")
+Signed-off-by: Si-Wei Liu <si-wei.liu@oracle.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Message-Id: <1651890498-24478-2-git-send-email-si-wei.liu@oracle.com>
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: zhangxinhao <zhangxinhao1@huawei.com>
+---
+ hw/net/virtio-net.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
+index d33da9b7ef..918a7aba89 100644
+--- a/hw/net/virtio-net.c
++++ b/hw/net/virtio-net.c
+@@ -243,7 +243,8 @@ static void virtio_net_vhost_status(VirtIONet *n, uint8_t status)
+     VirtIODevice *vdev = VIRTIO_DEVICE(n);
+     NetClientState *nc = qemu_get_queue(n->nic);
+     int queue_pairs = n->multiqueue ? n->max_queue_pairs : 1;
+-    int cvq = n->max_ncs - n->max_queue_pairs;
++    int cvq = virtio_vdev_has_feature(vdev, VIRTIO_NET_F_CTRL_VQ) ?
++              n->max_ncs - n->max_queue_pairs : 0;
+ 
+     if (!get_vhost_net(nc->peer)) {
+         return;
+-- 
+2.27.0
+