Series comparison

-[Qemu-devel] [PULL 00/15] Block layer patches
+[PULL 00/22] Block layer patches
-The following changes since commit 9964e96dc9999cf7f7c936ee854a795415d19b60:
+The following changes since commit 825b96dbcee23d134b691fc75618b59c5f53da32:
-  Merge remote-tracking branch 'jasowang/tags/net-pull-request' into staging (2017-05-23 15:01:31 +0100)
+  Merge tag 'migration-20250310-pull-request' of https://gitlab.com/farosas/qemu into staging (2025-03-11 09:32:07 +0800)
-are available in the git repository at:
+are available in the Git repository at:
+  https://repo.or.cz/qemu/kevin.git tags/for-upstream
-  git://repo.or.cz/qemu/kevin.git tags/for-upstream
+for you to fetch changes up to a93c04f3cbe690877b3297a9df4767aa811fcd97:
-for you to fetch changes up to 42a48128417b3bfade93d1a4721348cc480e9e50:
+  virtio-scsi: only expose cmd vqs via iothread-vq-mapping (2025-03-11 15:49:22 +0100)
   Merge remote-tracking branch 'mreitz/tags/pull-block-2017-05-29-v3' into queue-block (2017-05-29 16:34:27 +0200)
 ----------------------------------------------------------------
 Block layer patches
+- virtio-scsi: add iothread-vq-mapping parameter
+- Improve writethrough performance
+- Fix missing zero init in bdrv_snapshot_goto()
+- Code cleanup and iotests fixes
 ----------------------------------------------------------------
-Alberto Garcia (2):
+Kevin Wolf (8):
-      stream: fix crash in stream_start() when block_job_create() fails
+      block: Remove unused blk_op_is_blocked()
-      qcow2: remove extra local_error variable
+      block: Zero block driver state before reopening
       file-posix: Support FUA writes
       block/io: Ignore FUA with cache.no-flush=on
       aio: Create AioPolledEvent
       aio-posix: Factor out adjust_polling_time()
       aio-posix: Separate AioPolledEvent per AioHandler
       aio-posix: Adjust polling time also for new handlers
-Daniel P. Berrange (4):
+Stefan Hajnoczi (13):
-      qemu-img: add support for --object with 'dd' command
+      scsi-disk: drop unused SCSIDiskState->bh field
-      qemu-img: fix --image-opts usage with dd command
+      dma: use current AioContext for dma_blk_io()
-      qemu-img: introduce --target-image-opts for 'convert' command
+      scsi: track per-SCSIRequest AioContext
-      qemu-img: copy *key-secret opts when opening newly created files
+      scsi: introduce requests_lock
       virtio-scsi: introduce event and ctrl virtqueue locks
       virtio-scsi: protect events_dropped field
       virtio-scsi: perform TMFs in appropriate AioContexts
       virtio-blk: extract cleanup_iothread_vq_mapping() function
       virtio-blk: tidy up iothread_vq_mapping functions
       virtio: extract iothread-vq-mapping.h API
       virtio-scsi: add iothread-vq-mapping parameter
       virtio-scsi: handle ctrl virtqueue in main loop
       virtio-scsi: only expose cmd vqs via iothread-vq-mapping
-Eric Blake (1):
+Thomas Huth (1):
-      block: Tweak error message related to qemu-img amend
+      iotests: Limit qsd-migrate to working formats
-Fam Zheng (3):
+ include/block/aio.h                         |   5 +-
-      iotests: 147: Don't test inet6 if not available
+ include/block/raw-aio.h                     |   8 +-
-      qemu-img: Fix documentation of convert
+ include/hw/scsi/scsi.h                      |   8 +-
-      qemu-img: Fix leakage of options on error
+ include/hw/virtio/iothread-vq-mapping.h     |  45 +++
+ include/hw/virtio/virtio-scsi.h             |  15 +-
-Kevin Wolf (3):
+ include/system/block-backend-global-state.h |   1 -
-      qemu-iotests: Test streaming with missing job ID
+ include/system/dma.h                        |   3 +-
-      mirror: Drop permissions on s->target on completion
+ util/aio-posix.h                            |   1 +
-      Merge remote-tracking branch 'mreitz/tags/pull-block-2017-05-29-v3' into queue-block
+ block/block-backend.c                       |  12 -
+ block/file-posix.c                          |  26 +-
-Max Reitz (2):
+ block/io.c                                  |   4 +
-      block: Fix backing paths for filenames with colons
+ block/io_uring.c                            |  13 +-
-      block/file-*: *_parse_filename() and colons
+ block/linux-aio.c                           |  24 +-
+ block/snapshot.c                            |   1 +
-Stephen Bates (1):
+ hw/block/virtio-blk.c                       | 132 +-------
-      nvme: Add support for Controller Memory Buffers
+ hw/ide/core.c                               |   3 +-
+ hw/ide/macio.c                              |   3 +-
- block.c                    |  50 +++++++++++++--
+ hw/scsi/scsi-bus.c                          | 121 +++++--
- block/file-posix.c         |  17 +-----
+ hw/scsi/scsi-disk.c                         |  24 +-
- block/file-win32.c         |  12 +---
+ hw/scsi/virtio-scsi-dataplane.c             | 103 ++++--
- block/mirror.c             |   7 ++-
+ hw/scsi/virtio-scsi.c                       | 502 ++++++++++++++++------------
- block/qcow2-cluster.c      |   3 +-
+ hw/virtio/iothread-vq-mapping.c             | 131 ++++++++
- block/qcow2.c              |   5 +-
+ system/dma-helpers.c                        |   8 +-
- block/stream.c             |   2 +-
+ util/aio-posix.c                            | 114 ++++---
- hw/block/nvme.c            |  75 +++++++++++++++++++++--
+ util/async.c                                |   1 -
- hw/block/nvme.h            |  73 ++++++++++++++++++++++
+ hw/virtio/meson.build                       |   1 +
- include/block/block_int.h  |   3 +
+ meson.build                                 |   4 +
- qemu-img-cmds.hx           |   4 +-
+ tests/qemu-iotests/tests/qsd-migrate        |   2 +-
- qemu-img.c                 | 148 +++++++++++++++++++++++++++++++++++----------
+files changed, 803 insertions(+), 512 deletions(-)
- qemu-img.texi              |  12 +++-
+ create mode 100644 include/hw/virtio/iothread-vq-mapping.h
- tests/qemu-iotests/030     |   4 ++
+ create mode 100644 hw/virtio/iothread-vq-mapping.c
  tests/qemu-iotests/030.out |   4 +-
  tests/qemu-iotests/060.out |   2 +-
  tests/qemu-iotests/147     |   7 +++
 files changed, 351 insertions(+), 77 deletions(-)

-[Qemu-devel] [PULL 07/15] qemu-img: Fix documentation of convert
+[PULL 01/22] block: Remove unused blk_op_is_blocked()
-From: Fam Zheng <famz@redhat.com>
+Commit fc4e394b28 removed the last caller of blk_op_is_blocked(). Remove
 the now unused function.
-It got lost in commit a8d16f9ca "qemu-img: Update documentation for -U".
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 Message-ID: <20250206165331.379033-1-kwolf@redhat.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
  include/system/block-backend-global-state.h |  1 -
  block/block-backend.c                       | 12 ------------
 files changed, 13 deletions(-)
-Reported-by: Max Reitz <mreitz@redhat.com>
+diff --git a/include/system/block-backend-global-state.h b/include/system/block-backend-global-state.h
 Signed-off-by: Fam Zheng <famz@redhat.com>
 Message-id: 20170515103551.31313-1-famz@redhat.com
 Reviewed-by: Eric Blake <eblake@redhat.com>
 Signed-off-by: Max Reitz <mreitz@redhat.com>
 ---
  qemu-img-cmds.hx | 4 ++--
 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/qemu-img-cmds.hx b/qemu-img-cmds.hx
 index XXXXXXX..XXXXXXX 100644
---- a/qemu-img-cmds.hx
+--- a/include/system/block-backend-global-state.h
-+++ b/qemu-img-cmds.hx
++++ b/include/system/block-backend-global-state.h
-@@ -XXX,XX +XXX,XX @@ STEXI
+@@ -XXX,XX +XXX,XX @@ bool blk_supports_write_perm(BlockBackend *blk);
- ETEXI
+ bool blk_is_sg(BlockBackend *blk);
+ void blk_set_enable_write_cache(BlockBackend *blk, bool wce);
- DEF("convert", img_convert,
+ int blk_get_flags(BlockBackend *blk);
--    "convert [--object objectdef] [--image-opts] [-U] [-c] [-p] [-q] [-n] [-f fmt] [-t cache] [-T src_cache] [-O output_fmt] [-o options] [-s snapshot_id_or_name] [-l snapshot_param] [-S sparse_size] [-m num_coroutines] [-W] filename [filename2 [...]] output_filename")
+-bool blk_op_is_blocked(BlockBackend *blk, BlockOpType op, Error **errp);
-+    "convert [--object objectdef] [--image-opts] [-U] [-c] [-p] [-q] [-n] [-f fmt] [-t cache] [-T src_cache] [-O output_fmt] [-B backing_file] [-o options] [-s snapshot_id_or_name] [-l snapshot_param] [-S sparse_size] [-m num_coroutines] [-W] filename [filename2 [...]] output_filename")
+ int blk_set_aio_context(BlockBackend *blk, AioContext *new_context,
- STEXI
+                         Error **errp);
--@item convert [--object @var{objectdef}] [--image-opts] [-U] [-c] [-p] [-q] [-n] [-f @var{fmt}] [-t @var{cache}] [-T @var{src_cache}] [-O @var{output_fmt}] [-o @var{options}] [-s @var{snapshot_id_or_name}] [-l @var{snapshot_param}] [-S @var{sparse_size}] [-m @var{num_coroutines}] [-W] @var{filename} [@var{filename2} [...]] @var{output_filename}
+ void blk_add_aio_context_notifier(BlockBackend *blk,
-+@item convert [--object @var{objectdef}] [--image-opts] [-U] [-c] [-p] [-q] [-n] [-f @var{fmt}] [-t @var{cache}] [-T @var{src_cache}] [-O @var{output_fmt}] [-B @var{backing_file}] [-o @var{options}] [-s @var{snapshot_id_or_name}] [-l @var{snapshot_param}] [-S @var{sparse_size}] [-m @var{num_coroutines}] [-W] @var{filename} [@var{filename2} [...]] @var{output_filename}
+diff --git a/block/block-backend.c b/block/block-backend.c
- ETEXI
+index XXXXXXX..XXXXXXX 100644
+--- a/block/block-backend.c
- DEF("dd", img_dd,
++++ b/block/block-backend.c
@@ -XXX,XX +XXX,XX @@ void *blk_blockalign(BlockBackend *blk, size_t size)
      return qemu_blockalign(blk ? blk_bs(blk) : NULL, size);
  }
 -bool blk_op_is_blocked(BlockBackend *blk, BlockOpType op, Error **errp)
 -{
 -    BlockDriverState *bs = blk_bs(blk);
 -    GLOBAL_STATE_CODE();
 -    GRAPH_RDLOCK_GUARD_MAINLOOP();
 -
 -    if (!bs) {
 -        return false;
 -    }
 -
 -    return bdrv_op_is_blocked(bs, op, errp);
 -}
  /**
   * Return BB's current AioContext.  Note that this context may change
 --
-.8.3.1
+.48.1

-[Qemu-devel] [PULL 12/15] qemu-img: Fix leakage of options on error
+[PULL 02/22] block: Zero block driver state before reopening
-From: Fam Zheng <famz@redhat.com>
+Block drivers assume in their .bdrv_open() implementation that their
 state in bs->opaque has been zeroed; it is initially allocated with
 g_malloc0() in bdrv_open_driver().
-Reported by Coverity.
+bdrv_snapshot_goto() needs to make sure that it is zeroed again before
 calling drv->bdrv_open() to avoid that block drivers use stale values.
-Signed-off-by: Fam Zheng <famz@redhat.com>
+One symptom of this bug is VMDK running into a double free when the user
-Message-id: 20170515141014.25793-1-famz@redhat.com
+tries to apply an internal snapshot like 'qemu-img snapshot -a test
-Reviewed-by: Eric Blake <eblake@redhat.com>
+test.vmdk'. This should be a graceful error because VMDK doesn't support
-Signed-off-by: Max Reitz <mreitz@redhat.com>
+internal snapshots.
 ==25507== Invalid free() / delete / delete[] / realloc()
 ==25507==    at 0x484B347: realloc (vg_replace_malloc.c:1801)
 ==25507==    by 0x54B592A: g_realloc (gmem.c:171)
 ==25507==    by 0x1B221D: vmdk_add_extent (../block/vmdk.c:570)
 ==25507==    by 0x1B1084: vmdk_open_sparse (../block/vmdk.c:1059)
 ==25507==    by 0x1AF3D8: vmdk_open (../block/vmdk.c:1371)
 ==25507==    by 0x1A2AE0: bdrv_snapshot_goto (../block/snapshot.c:299)
 ==25507==    by 0x205C77: img_snapshot (../qemu-img.c:3500)
 ==25507==    by 0x58FA087: (below main) (libc_start_call_main.h:58)
 ==25507==  Address 0x832f3e0 is 0 bytes inside a block of size 272 free'd
 ==25507==    at 0x4846B83: free (vg_replace_malloc.c:989)
 ==25507==    by 0x54AEAC4: g_free (gmem.c:208)
 ==25507==    by 0x1AF629: vmdk_close (../block/vmdk.c:2889)
 ==25507==    by 0x1A2A9C: bdrv_snapshot_goto (../block/snapshot.c:290)
 ==25507==    by 0x205C77: img_snapshot (../qemu-img.c:3500)
 ==25507==    by 0x58FA087: (below main) (libc_start_call_main.h:58)
 This error was discovered by fuzzing qemu-img.
 Cc: qemu-stable@nongnu.org
 Closes: https://gitlab.com/qemu-project/qemu/-/issues/2853
 Closes: https://gitlab.com/qemu-project/qemu/-/issues/2851
 Reported-by: Denis Rastyogin <gerben@altlinux.org>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 Message-ID: <20250310104858.28221-1-kwolf@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
- qemu-img.c | 1 +
+ block/snapshot.c | 1 +
 file changed, 1 insertion(+)
-diff --git a/qemu-img.c b/qemu-img.c
+diff --git a/block/snapshot.c b/block/snapshot.c
 index XXXXXXX..XXXXXXX 100644
---- a/qemu-img.c
+--- a/block/snapshot.c
-+++ b/qemu-img.c
++++ b/block/snapshot.c
-@@ -XXX,XX +XXX,XX @@ static BlockBackend *img_open_opts(const char *optstr,
+@@ -XXX,XX +XXX,XX @@ int bdrv_snapshot_goto(BlockDriverState *bs,
-         if (qdict_haskey(options, BDRV_OPT_FORCE_SHARE)
+         bdrv_graph_wrunlock();
-             && !qdict_get_bool(options, BDRV_OPT_FORCE_SHARE)) {
-             error_report("--force-share/-U conflicts with image options");
+         ret = bdrv_snapshot_goto(fallback_bs, snapshot_id, errp);
-+            QDECREF(options);
++        memset(bs->opaque, 0, drv->instance_size);
-             return NULL;
+         open_ret = drv->bdrv_open(bs, options, bs->open_flags, &local_err);
-         }
+         qobject_unref(options);
-         qdict_put(options, BDRV_OPT_FORCE_SHARE, qbool_from_bool(true));
+         if (open_ret < 0) {
 --
-.8.3.1
+.48.1

-New patch
+[PULL 03/22] file-posix: Support FUA writes
+Until now, FUA was always emulated with a separate flush after the write
 for file-posix. The overhead of processing a second request can reduce
 performance significantly for a guest disk that has disabled the write
 cache, especially if the host disk is already write through, too, and
 the flush isn't actually doing anything.
 Advertise support for REQ_FUA in write requests and implement it for
 Linux AIO and io_uring using the RWF_DSYNC flag for write requests. The
 thread pool still performs a separate fdatasync() call. This can be
 improved later by using the pwritev2() syscall if available.
 As an example, this is how fio numbers can be improved in some scenarios
 with this patch (all using virtio-blk with cache=directsync on an nvme
 block device for the VM, fio with ioengine=libaio,direct=1,sync=1):
                               | old           | with FUA support
 ------------------------------+---------------+-------------------
 bs=4k, iodepth=1, numjobs=1   |  45.6k iops   |  56.1k iops
 bs=4k, iodepth=1, numjobs=16  | 183.3k iops   | 236.0k iops
 bs=4k, iodepth=16, numjobs=1  | 258.4k iops   | 311.1k iops
 However, not all scenarios are clear wins. On another slower disk I saw
 little to no improvment. In fact, in two corner case scenarios, I even
 observed a regression, which I however consider acceptable:
 . On slow host disks in a write through cache mode, when the guest is
    using virtio-blk in a separate iothread so that polling can be
    enabled, and each completion is quickly followed up with a new
    request (so that polling gets it), it can happen that enabling FUA
    makes things slower - the additional very fast no-op flush we used to
    have gave the adaptive polling algorithm a success so that it kept
    polling. Without it, we only have the slow write request, which
    disables polling. This is a problem in the polling algorithm that
    will be fixed later in this series.
 . With a high queue depth, it can be beneficial to have flush requests
    for another reason: The optimisation in bdrv_co_flush() that flushes
    only once per write generation acts as a synchronisation mechanism
    that lets all requests complete at the same time. This can result in
    better batching and if the disk is very fast (I only saw this with a
    null_blk backend), this can make up for the overhead of the flush and
    improve throughput. In theory, we could optionally introduce a
    similar artificial latency in the normal completion path to achieve
    the same kind of completion batching. This is not implemented in this
    series.
 Compatibility is not a concern for io_uring, it has supported RWF_DSYNC
 from the start. Linux AIO started supporting it in Linux 4.13 and libaio
 .3.111. The kernel is not a problem for any supported build platform,
 so it's not necessary to add runtime checks. However, openSUSE is still
 stuck with an older libaio version that would break the build. We must
 detect this at build time to avoid build failures.
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 Message-ID: <20250307221634.71951-2-kwolf@redhat.com>
 Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
  include/block/raw-aio.h |  8 ++++++--
  block/file-posix.c      | 26 ++++++++++++++++++--------
  block/io_uring.c        | 13 ++++++++-----
  block/linux-aio.c       | 24 +++++++++++++++++++++---
  meson.build             |  4 ++++
 files changed, 57 insertions(+), 18 deletions(-)
 diff --git a/include/block/raw-aio.h b/include/block/raw-aio.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/block/raw-aio.h
 +++ b/include/block/raw-aio.h
@@ -XXX,XX +XXX,XX @@
  #define QEMU_RAW_AIO_H
  #include "block/aio.h"
 +#include "block/block-common.h"
  #include "qemu/iov.h"
  /* AIO request types */
@@ -XXX,XX +XXX,XX @@ void laio_cleanup(LinuxAioState *s);
  /* laio_co_submit: submit I/O requests in the thread's current AioContext. */
  int coroutine_fn laio_co_submit(int fd, uint64_t offset, QEMUIOVector *qiov,
 -                                int type, uint64_t dev_max_batch);
 +                                int type, BdrvRequestFlags flags,
 +                                uint64_t dev_max_batch);
  bool laio_has_fdsync(int);
 +bool laio_has_fua(void);
  void laio_detach_aio_context(LinuxAioState *s, AioContext *old_context);
  void laio_attach_aio_context(LinuxAioState *s, AioContext *new_context);
  #endif
@@ -XXX,XX +XXX,XX @@ void luring_cleanup(LuringState *s);
  /* luring_co_submit: submit I/O requests in the thread's current AioContext. */
  int coroutine_fn luring_co_submit(BlockDriverState *bs, int fd, uint64_t offset,
 -                                  QEMUIOVector *qiov, int type);
 +                                  QEMUIOVector *qiov, int type,
 +                                  BdrvRequestFlags flags);
  void luring_detach_aio_context(LuringState *s, AioContext *old_context);
  void luring_attach_aio_context(LuringState *s, AioContext *new_context);
  #endif
 diff --git a/block/file-posix.c b/block/file-posix.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/file-posix.c
 +++ b/block/file-posix.c
@@ -XXX,XX +XXX,XX @@ static int fd_open(BlockDriverState *bs)
  }
  static int64_t raw_getlength(BlockDriverState *bs);
 +static int coroutine_fn raw_co_flush_to_disk(BlockDriverState *bs);
  typedef struct RawPosixAIOData {
      BlockDriverState *bs;
@@ -XXX,XX +XXX,XX @@ static int raw_open_common(BlockDriverState *bs, QDict *options,
  #endif
      s->needs_alignment = raw_needs_alignment(bs);
 +    if (!s->use_linux_aio || laio_has_fua()) {
 +        bs->supported_write_flags = BDRV_REQ_FUA;
 +    }
 +
      bs->supported_zero_flags = BDRV_REQ_MAY_UNMAP | BDRV_REQ_NO_FALLBACK;
      if (S_ISREG(st.st_mode)) {
          /* When extending regular files, we get zeros from the OS */
@@ -XXX,XX +XXX,XX @@ static inline bool raw_check_linux_aio(BDRVRawState *s)
  #endif
  static int coroutine_fn raw_co_prw(BlockDriverState *bs, int64_t *offset_ptr,
 -                                   uint64_t bytes, QEMUIOVector *qiov, int type)
 +                                   uint64_t bytes, QEMUIOVector *qiov, int type,
 +                                   int flags)
  {
      BDRVRawState *s = bs->opaque;
      RawPosixAIOData acb;
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn raw_co_prw(BlockDriverState *bs, int64_t *offset_ptr,
  #ifdef CONFIG_LINUX_IO_URING
      } else if (raw_check_linux_io_uring(s)) {
          assert(qiov->size == bytes);
 -        ret = luring_co_submit(bs, s->fd, offset, qiov, type);
 +        ret = luring_co_submit(bs, s->fd, offset, qiov, type, flags);
          goto out;
  #endif
  #ifdef CONFIG_LINUX_AIO
      } else if (raw_check_linux_aio(s)) {
          assert(qiov->size == bytes);
 -        ret = laio_co_submit(s->fd, offset, qiov, type,
 +        ret = laio_co_submit(s->fd, offset, qiov, type, flags,
                                s->aio_max_batch);
          goto out;
  #endif
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn raw_co_prw(BlockDriverState *bs, int64_t *offset_ptr,
      assert(qiov->size == bytes);
      ret = raw_thread_pool_submit(handle_aiocb_rw, &acb);
 +    if (ret == 0 && (flags & BDRV_REQ_FUA)) {
 +        /* TODO Use pwritev2() instead if it's available */
 +        ret = raw_co_flush_to_disk(bs);
 +    }
      goto out; /* Avoid the compiler err of unused label */
  out:
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn raw_co_preadv(BlockDriverState *bs, int64_t offset,
                                        int64_t bytes, QEMUIOVector *qiov,
                                        BdrvRequestFlags flags)
  {
 -    return raw_co_prw(bs, &offset, bytes, qiov, QEMU_AIO_READ);
 +    return raw_co_prw(bs, &offset, bytes, qiov, QEMU_AIO_READ, flags);
  }
  static int coroutine_fn raw_co_pwritev(BlockDriverState *bs, int64_t offset,
                                         int64_t bytes, QEMUIOVector *qiov,
                                         BdrvRequestFlags flags)
  {
 -    return raw_co_prw(bs, &offset, bytes, qiov, QEMU_AIO_WRITE);
 +    return raw_co_prw(bs, &offset, bytes, qiov, QEMU_AIO_WRITE, flags);
  }
  static int coroutine_fn raw_co_flush_to_disk(BlockDriverState *bs)
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn raw_co_flush_to_disk(BlockDriverState *bs)
  #ifdef CONFIG_LINUX_IO_URING
      if (raw_check_linux_io_uring(s)) {
 -        return luring_co_submit(bs, s->fd, 0, NULL, QEMU_AIO_FLUSH);
 +        return luring_co_submit(bs, s->fd, 0, NULL, QEMU_AIO_FLUSH, 0);
      }
  #endif
  #ifdef CONFIG_LINUX_AIO
      if (s->has_laio_fdsync && raw_check_linux_aio(s)) {
 -        return laio_co_submit(s->fd, 0, NULL, QEMU_AIO_FLUSH, 0);
 +        return laio_co_submit(s->fd, 0, NULL, QEMU_AIO_FLUSH, 0, 0);
      }
  #endif
      return raw_thread_pool_submit(handle_aiocb_flush, &acb);
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn raw_co_zone_append(BlockDriverState *bs,
      }
      trace_zbd_zone_append(bs, *offset >> BDRV_SECTOR_BITS);
 -    return raw_co_prw(bs, offset, len, qiov, QEMU_AIO_ZONE_APPEND);
 +    return raw_co_prw(bs, offset, len, qiov, QEMU_AIO_ZONE_APPEND, 0);
  }
  #endif
 diff --git a/block/io_uring.c b/block/io_uring.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/io_uring.c
 +++ b/block/io_uring.c
@@ -XXX,XX +XXX,XX @@ static void luring_deferred_fn(void *opaque)
   *
   */
  static int luring_do_submit(int fd, LuringAIOCB *luringcb, LuringState *s,
 -                            uint64_t offset, int type)
 +                            uint64_t offset, int type, BdrvRequestFlags flags)
  {
      int ret;
      struct io_uring_sqe *sqes = &luringcb->sqeq;
 +    int luring_flags;
      switch (type) {
      case QEMU_AIO_WRITE:
 -        io_uring_prep_writev(sqes, fd, luringcb->qiov->iov,
 -                             luringcb->qiov->niov, offset);
 +        luring_flags = (flags & BDRV_REQ_FUA) ? RWF_DSYNC : 0;
 +        io_uring_prep_writev2(sqes, fd, luringcb->qiov->iov,
 +                              luringcb->qiov->niov, offset, luring_flags);
          break;
      case QEMU_AIO_ZONE_APPEND:
          io_uring_prep_writev(sqes, fd, luringcb->qiov->iov,
@@ -XXX,XX +XXX,XX @@ static int luring_do_submit(int fd, LuringAIOCB *luringcb, LuringState *s,
  }
  int coroutine_fn luring_co_submit(BlockDriverState *bs, int fd, uint64_t offset,
 -                                  QEMUIOVector *qiov, int type)
 +                                  QEMUIOVector *qiov, int type,
 +                                  BdrvRequestFlags flags)
  {
      int ret;
      AioContext *ctx = qemu_get_current_aio_context();
@@ -XXX,XX +XXX,XX @@ int coroutine_fn luring_co_submit(BlockDriverState *bs, int fd, uint64_t offset,
      };
      trace_luring_co_submit(bs, s, &luringcb, fd, offset, qiov ? qiov->size : 0,
                             type);
 -    ret = luring_do_submit(fd, &luringcb, s, offset, type);
 +    ret = luring_do_submit(fd, &luringcb, s, offset, type, flags);
      if (ret < 0) {
          return ret;
 diff --git a/block/linux-aio.c b/block/linux-aio.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/linux-aio.c
 +++ b/block/linux-aio.c
@@ -XXX,XX +XXX,XX @@ static void laio_deferred_fn(void *opaque)
  }
  static int laio_do_submit(int fd, struct qemu_laiocb *laiocb, off_t offset,
 -                          int type, uint64_t dev_max_batch)
 +                          int type, BdrvRequestFlags flags,
 +                          uint64_t dev_max_batch)
  {
      LinuxAioState *s = laiocb->ctx;
      struct iocb *iocbs = &laiocb->iocb;
      QEMUIOVector *qiov = laiocb->qiov;
 +    int laio_flags;
      switch (type) {
      case QEMU_AIO_WRITE:
 +#ifdef HAVE_IO_PREP_PWRITEV2
 +        laio_flags = (flags & BDRV_REQ_FUA) ? RWF_DSYNC : 0;
 +        io_prep_pwritev2(iocbs, fd, qiov->iov, qiov->niov, offset, laio_flags);
 +#else
 +        assert(flags == 0);
          io_prep_pwritev(iocbs, fd, qiov->iov, qiov->niov, offset);
 +#endif
          break;
      case QEMU_AIO_ZONE_APPEND:
          io_prep_pwritev(iocbs, fd, qiov->iov, qiov->niov, offset);
@@ -XXX,XX +XXX,XX @@ static int laio_do_submit(int fd, struct qemu_laiocb *laiocb, off_t offset,
  }
  int coroutine_fn laio_co_submit(int fd, uint64_t offset, QEMUIOVector *qiov,
 -                                int type, uint64_t dev_max_batch)
 +                                int type, BdrvRequestFlags flags,
 +                                uint64_t dev_max_batch)
  {
      int ret;
      AioContext *ctx = qemu_get_current_aio_context();
@@ -XXX,XX +XXX,XX @@ int coroutine_fn laio_co_submit(int fd, uint64_t offset, QEMUIOVector *qiov,
          .qiov       = qiov,
      };
 -    ret = laio_do_submit(fd, &laiocb, offset, type, dev_max_batch);
 +    ret = laio_do_submit(fd, &laiocb, offset, type, flags, dev_max_batch);
      if (ret < 0) {
          return ret;
      }
@@ -XXX,XX +XXX,XX @@ bool laio_has_fdsync(int fd)
      io_destroy(ctx);
      return (ret == -EINVAL) ? false : true;
  }
 +
 +bool laio_has_fua(void)
 +{
 +#ifdef HAVE_IO_PREP_PWRITEV2
 +    return true;
 +#else
 +    return false;
 +#endif
 +}
 diff --git a/meson.build b/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/meson.build
 +++ b/meson.build
@@ -XXX,XX +XXX,XX @@ config_host_data.set('HAVE_OPTRESET',
                       cc.has_header_symbol('getopt.h', 'optreset'))
  config_host_data.set('HAVE_IPPROTO_MPTCP',
                       cc.has_header_symbol('netinet/in.h', 'IPPROTO_MPTCP'))
 +if libaio.found()
 +  config_host_data.set('HAVE_IO_PREP_PWRITEV2',
 +                       cc.has_header_symbol('libaio.h', 'io_prep_pwritev2'))
 +endif
  # has_member
  config_host_data.set('HAVE_SIGEV_NOTIFY_THREAD_ID',
 --
 .48.1

-New patch
+[PULL 04/22] block/io: Ignore FUA with cache.no-flush=on
+For block drivers that don't advertise FUA support, we already call
+bdrv_co_flush(), which considers BDRV_O_NO_FLUSH. However, drivers that
+do support FUA still see the FUA flag with BDRV_O_NO_FLUSH and get the
+associated performance penalty that cache.no-flush=on was supposed to
+avoid.
+Clear FUA for write requests if BDRV_O_NO_FLUSH is set.
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+Message-ID: <20250307221634.71951-3-kwolf@redhat.com>
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ block/io.c | 4 ++++
+file changed, 4 insertions(+)
+diff --git a/block/io.c b/block/io.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/io.c
++++ b/block/io.c
+@@ -XXX,XX +XXX,XX @@ bdrv_driver_pwritev(BlockDriverState *bs, int64_t offset, int64_t bytes,
+         return -ENOMEDIUM;
+     }
++    if (bs->open_flags & BDRV_O_NO_FLUSH) {
++        flags &= ~BDRV_REQ_FUA;
++    }
++
+     if ((flags & BDRV_REQ_FUA) &&
+         (~bs->supported_write_flags & BDRV_REQ_FUA)) {
+         flags &= ~BDRV_REQ_FUA;
+--
+.48.1

-[Qemu-devel] [PULL 13/15] block: Tweak error message related to qemu-img amend
+[PULL 05/22] aio: Create AioPolledEvent
-From: Eric Blake <eblake@redhat.com>
+As a preparation for having multiple adaptive polling states per
 AioContext, move the 'ns' field into a separate struct.
-When converting a 1.1 image down to 0.10, qemu-iotests 060 forces
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-a contrived failure where allocating a cluster used to replace a
+Message-ID: <20250307221634.71951-4-kwolf@redhat.com>
-zero cluster reads unaligned data.  Since it is a zero cluster
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-rather than a data cluster being converted, changing the error
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-message to match our earlier change in 'qcow2: Make distinction
+---
-between zero cluster types obvious' is worthwhile.
+ include/block/aio.h |  6 +++++-
  util/aio-posix.c    | 31 ++++++++++++++++---------------
  util/async.c        |  3 ++-
 files changed, 23 insertions(+), 17 deletions(-)
-Suggested-by: Max Reitz <mreitz@redhat.com>
+diff --git a/include/block/aio.h b/include/block/aio.h
 Signed-off-by: Eric Blake <eblake@redhat.com>
 Message-id: 20170508171302.17805-1-eblake@redhat.com
 [mreitz: Commit message fixes]
 Signed-off-by: Max Reitz <mreitz@redhat.com>
 ---
  block/qcow2-cluster.c      | 3 ++-
  tests/qemu-iotests/060.out | 2 +-
 files changed, 3 insertions(+), 2 deletions(-)
 diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
 index XXXXXXX..XXXXXXX 100644
---- a/block/qcow2-cluster.c
+--- a/include/block/aio.h
-+++ b/block/qcow2-cluster.c
++++ b/include/block/aio.h
-@@ -XXX,XX +XXX,XX @@ static int expand_zero_clusters_in_l1(BlockDriverState *bs, uint64_t *l1_table,
+@@ -XXX,XX +XXX,XX @@ struct BHListSlice {
  typedef QSLIST_HEAD(, AioHandler) AioHandlerSList;
 +typedef struct AioPolledEvent {
 +    int64_t ns;        /* current polling time in nanoseconds */
 +} AioPolledEvent;
 +
  struct AioContext {
      GSource source;
@@ -XXX,XX +XXX,XX @@ struct AioContext {
      int poll_disable_cnt;
      /* Polling mode parameters */
 -    int64_t poll_ns;        /* current polling time in nanoseconds */
 +    AioPolledEvent poll;
      int64_t poll_max_ns;    /* maximum polling time in nanoseconds */
      int64_t poll_grow;      /* polling time growth factor */
      int64_t poll_shrink;    /* polling time shrink factor */
 diff --git a/util/aio-posix.c b/util/aio-posix.c
 index XXXXXXX..XXXXXXX 100644
 --- a/util/aio-posix.c
 +++ b/util/aio-posix.c
@@ -XXX,XX +XXX,XX @@ static bool try_poll_mode(AioContext *ctx, AioHandlerList *ready_list,
          return false;
      }
 -    max_ns = qemu_soonest_timeout(*timeout, ctx->poll_ns);
 +    max_ns = qemu_soonest_timeout(*timeout, ctx->poll.ns);
      if (max_ns && !ctx->fdmon_ops->need_wait(ctx)) {
          /*
           * Enable poll mode. It pairs with the poll_set_started() in
@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
      if (ctx->poll_max_ns) {
          int64_t block_ns = qemu_clock_get_ns(QEMU_CLOCK_REALTIME) - start;
 -        if (block_ns <= ctx->poll_ns) {
 +        if (block_ns <= ctx->poll.ns) {
              /* This is the sweet spot, no adjustment needed */
          } else if (block_ns > ctx->poll_max_ns) {
              /* We'd have to poll for too long, poll less */
 -            int64_t old = ctx->poll_ns;
 +            int64_t old = ctx->poll.ns;
              if (ctx->poll_shrink) {
 -                ctx->poll_ns /= ctx->poll_shrink;
 +                ctx->poll.ns /= ctx->poll_shrink;
              } else {
 -                ctx->poll_ns = 0;
 +                ctx->poll.ns = 0;
              }
-             if (offset_into_cluster(s, offset)) {
+-            trace_poll_shrink(ctx, old, ctx->poll_ns);
--                qcow2_signal_corruption(bs, true, -1, -1, "Data cluster offset "
+-        } else if (ctx->poll_ns < ctx->poll_max_ns &&
-+                qcow2_signal_corruption(bs, true, -1, -1,
++            trace_poll_shrink(ctx, old, ctx->poll.ns);
-+                                        "Cluster allocation offset "
++        } else if (ctx->poll.ns < ctx->poll_max_ns &&
-                                         "%#" PRIx64 " unaligned (L2 offset: %#"
+                    block_ns < ctx->poll_max_ns) {
-                                         PRIx64 ", L2 index: %#x)", offset,
+             /* There is room to grow, poll longer */
-                                         l2_offset, j);
+-            int64_t old = ctx->poll_ns;
-diff --git a/tests/qemu-iotests/060.out b/tests/qemu-iotests/060.out
++            int64_t old = ctx->poll.ns;
              int64_t grow = ctx->poll_grow;
              if (grow == 0) {
                  grow = 2;
              }
 -            if (ctx->poll_ns) {
 -                ctx->poll_ns *= grow;
 +            if (ctx->poll.ns) {
 +                ctx->poll.ns *= grow;
              } else {
 -                ctx->poll_ns = 4000; /* start polling at 4 microseconds */
 +                ctx->poll.ns = 4000; /* start polling at 4 microseconds */
              }
 -            if (ctx->poll_ns > ctx->poll_max_ns) {
 -                ctx->poll_ns = ctx->poll_max_ns;
 +            if (ctx->poll.ns > ctx->poll_max_ns) {
 +                ctx->poll.ns = ctx->poll_max_ns;
              }
 -            trace_poll_grow(ctx, old, ctx->poll_ns);
 +            trace_poll_grow(ctx, old, ctx->poll.ns);
          }
      }
@@ -XXX,XX +XXX,XX @@ void aio_context_set_poll_params(AioContext *ctx, int64_t max_ns,
      /* No thread synchronization here, it doesn't matter if an incorrect value
       * is used once.
       */
 +    ctx->poll.ns = 0;
 +
      ctx->poll_max_ns = max_ns;
 -    ctx->poll_ns = 0;
      ctx->poll_grow = grow;
      ctx->poll_shrink = shrink;
 diff --git a/util/async.c b/util/async.c
 index XXXXXXX..XXXXXXX 100644
---- a/tests/qemu-iotests/060.out
+--- a/util/async.c
-+++ b/tests/qemu-iotests/060.out
++++ b/util/async.c
-@@ -XXX,XX +XXX,XX @@ read failed: Input/output error
+@@ -XXX,XX +XXX,XX @@ AioContext *aio_context_new(Error **errp)
- Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
+     qemu_rec_mutex_init(&ctx->lock);
- wrote 65536/65536 bytes at offset 0
+     timerlistgroup_init(&ctx->tlg, aio_timerlist_notify, ctx);
-KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
--qcow2: Marking image as corrupt: Data cluster offset 0x52a00 unaligned (L2 offset: 0x40000, L2 index: 0); further corruption events will be suppressed
+-    ctx->poll_ns = 0;
-+qcow2: Marking image as corrupt: Cluster allocation offset 0x52a00 unaligned (L2 offset: 0x40000, L2 index: 0); further corruption events will be suppressed
++    ctx->poll.ns = 0;
- qemu-img: Error while amending options: Input/output error
++
+     ctx->poll_max_ns = 0;
- === Testing unaligned reftable entry ===
+     ctx->poll_grow = 0;
      ctx->poll_shrink = 0;
 --
-.8.3.1
+.48.1

-[Qemu-devel] [PULL 04/15] nvme: Add support for Controller Memory Buffers
+[PULL 06/22] aio-posix: Factor out adjust_polling_time()
-From: Stephen Bates <sbates@raithlin.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+Message-ID: <20250307221634.71951-5-kwolf@redhat.com>
-Implement NVMe Controller Memory Buffers (CMBs) which were added in
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
 version 1.2 of the NVMe Specification. This patch adds an optional
 argument (cmb_size_mb) which indicates the size of the CMB (in
 MB). Currently only the Submission Queue Support (SQS) is enabled
 which aligns with the current Linux driver for NVMe.
 Signed-off-by: Stephen Bates <sbates@raithlin.com>
 Acked-by: Keith Busch <keith.busch@intel.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
- hw/block/nvme.c | 75 ++++++++++++++++++++++++++++++++++++++++++++++++++++++---
+ util/aio-posix.c | 77 ++++++++++++++++++++++++++----------------------
- hw/block/nvme.h | 73 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
+file changed, 41 insertions(+), 36 deletions(-)
 files changed, 144 insertions(+), 4 deletions(-)
-diff --git a/hw/block/nvme.c b/hw/block/nvme.c
+diff --git a/util/aio-posix.c b/util/aio-posix.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/block/nvme.c
+--- a/util/aio-posix.c
-+++ b/hw/block/nvme.c
++++ b/util/aio-posix.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static bool try_poll_mode(AioContext *ctx, AioHandlerList *ready_list,
-  */
+     return false;
+ }
- /**
-- * Reference Specs: http://www.nvmexpress.org, 1.1, 1.0e
++static void adjust_polling_time(AioContext *ctx, AioPolledEvent *poll,
-+ * Reference Specs: http://www.nvmexpress.org, 1.2, 1.1, 1.0e
++                                int64_t block_ns)
   *
   *  http://www.nvmexpress.org/resources/
   */
@@ -XXX,XX +XXX,XX @@
  /**
   * Usage: add options:
   *      -drive file=<file>,if=none,id=<drive_id>
 - *      -device nvme,drive=<drive_id>,serial=<serial>,id=<id[optional]>
 + *      -device nvme,drive=<drive_id>,serial=<serial>,id=<id[optional]>, \
 + *              cmb_size_mb=<cmb_size_mb[optional]>
 + *
 + * Note cmb_size_mb denotes size of CMB in MB. CMB is assumed to be at
 + * offset 0 in BAR2 and supports SQS only for now.
   */
  #include "qemu/osdep.h"
@@ -XXX,XX +XXX,XX @@
  static void nvme_process_sq(void *opaque);
 +static void nvme_addr_read(NvmeCtrl *n, hwaddr addr, void *buf, int size)
 +{
-+    if (n->cmbsz && addr >= n->ctrl_mem.addr &&
++    if (block_ns <= poll->ns) {
-+                addr < (n->ctrl_mem.addr + int128_get64(n->ctrl_mem.size))) {
++        /* This is the sweet spot, no adjustment needed */
-+        memcpy(buf, (void *)&n->cmbuf[addr - n->ctrl_mem.addr], size);
++    } else if (block_ns > ctx->poll_max_ns) {
-+    } else {
++        /* We'd have to poll for too long, poll less */
-+        pci_dma_read(&n->parent_obj, addr, buf, size);
++        int64_t old = poll->ns;
 +
 +        if (ctx->poll_shrink) {
 +            poll->ns /= ctx->poll_shrink;
 +        } else {
 +            poll->ns = 0;
 +        }
 +
 +        trace_poll_shrink(ctx, old, poll->ns);
 +    } else if (poll->ns < ctx->poll_max_ns &&
 +               block_ns < ctx->poll_max_ns) {
 +        /* There is room to grow, poll longer */
 +        int64_t old = poll->ns;
 +        int64_t grow = ctx->poll_grow;
 +
 +        if (grow == 0) {
 +            grow = 2;
 +        }
 +
 +        if (poll->ns) {
 +            poll->ns *= grow;
 +        } else {
 +            poll->ns = 4000; /* start polling at 4 microseconds */
 +        }
 +
 +        if (poll->ns > ctx->poll_max_ns) {
 +            poll->ns = ctx->poll_max_ns;
 +        }
 +
 +        trace_poll_grow(ctx, old, poll->ns);
 +    }
 +}
 +
- static int nvme_check_sqid(NvmeCtrl *n, uint16_t sqid)
+ bool aio_poll(AioContext *ctx, bool blocking)
  {
-     return sqid < n->num_queues && n->sq[sqid] != NULL ? 0 : -1;
+     AioHandlerList ready_list = QLIST_HEAD_INITIALIZER(ready_list);
-@@ -XXX,XX +XXX,XX @@ static void nvme_process_sq(void *opaque)
+@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
+     /* Adjust polling time */
-     while (!(nvme_sq_empty(sq) || QTAILQ_EMPTY(&sq->req_list))) {
+     if (ctx->poll_max_ns) {
-         addr = sq->dma_addr + sq->head * n->sqe_size;
+         int64_t block_ns = qemu_clock_get_ns(QEMU_CLOCK_REALTIME) - start;
--        pci_dma_read(&n->parent_obj, addr, (void *)&cmd, sizeof(cmd));
+-
-+        nvme_addr_read(n, addr, (void *)&cmd, sizeof(cmd));
+-        if (block_ns <= ctx->poll.ns) {
-         nvme_inc_sq_head(sq);
+-            /* This is the sweet spot, no adjustment needed */
+-        } else if (block_ns > ctx->poll_max_ns) {
-         req = QTAILQ_FIRST(&sq->req_list);
+-            /* We'd have to poll for too long, poll less */
-@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps nvme_mmio_ops = {
+-            int64_t old = ctx->poll.ns;
-     },
+-
- };
+-            if (ctx->poll_shrink) {
+-                ctx->poll.ns /= ctx->poll_shrink;
-+static void nvme_cmb_write(void *opaque, hwaddr addr, uint64_t data,
+-            } else {
-+    unsigned size)
+-                ctx->poll.ns = 0;
-+{
+-            }
-+    NvmeCtrl *n = (NvmeCtrl *)opaque;
+-
-+    memcpy(&n->cmbuf[addr], &data, size);
+-            trace_poll_shrink(ctx, old, ctx->poll.ns);
-+}
+-        } else if (ctx->poll.ns < ctx->poll_max_ns &&
-+
+-                   block_ns < ctx->poll_max_ns) {
-+static uint64_t nvme_cmb_read(void *opaque, hwaddr addr, unsigned size)
+-            /* There is room to grow, poll longer */
-+{
+-            int64_t old = ctx->poll.ns;
-+    uint64_t val;
+-            int64_t grow = ctx->poll_grow;
-+    NvmeCtrl *n = (NvmeCtrl *)opaque;
+-
-+
+-            if (grow == 0) {
-+    memcpy(&val, &n->cmbuf[addr], size);
+-                grow = 2;
-+    return val;
+-            }
-+}
+-
-+
+-            if (ctx->poll.ns) {
-+static const MemoryRegionOps nvme_cmb_ops = {
+-                ctx->poll.ns *= grow;
-+    .read = nvme_cmb_read,
+-            } else {
-+    .write = nvme_cmb_write,
+-                ctx->poll.ns = 4000; /* start polling at 4 microseconds */
-+    .endianness = DEVICE_LITTLE_ENDIAN,
+-            }
-+    .impl = {
+-
-+        .min_access_size = 2,
+-            if (ctx->poll.ns > ctx->poll_max_ns) {
-+        .max_access_size = 8,
+-                ctx->poll.ns = ctx->poll_max_ns;
-+    },
+-            }
-+};
+-
-+
+-            trace_poll_grow(ctx, old, ctx->poll.ns);
- static int nvme_init(PCIDevice *pci_dev)
+-        }
- {
++        adjust_polling_time(ctx, &ctx->poll, block_ns);
-     NvmeCtrl *n = NVME(pci_dev);
+     }
-@@ -XXX,XX +XXX,XX @@ static int nvme_init(PCIDevice *pci_dev)
-     NVME_CAP_SET_CSS(n->bar.cap, 1);
+     progress |= aio_bh_poll(ctx);
      NVME_CAP_SET_MPSMAX(n->bar.cap, 4);
 -    n->bar.vs = 0x00010100;
 +    n->bar.vs = 0x00010200;
      n->bar.intmc = n->bar.intms = 0;
 +    if (n->cmb_size_mb) {
 +
 +        NVME_CMBLOC_SET_BIR(n->bar.cmbloc, 2);
 +        NVME_CMBLOC_SET_OFST(n->bar.cmbloc, 0);
 +
 +        NVME_CMBSZ_SET_SQS(n->bar.cmbsz, 1);
 +        NVME_CMBSZ_SET_CQS(n->bar.cmbsz, 0);
 +        NVME_CMBSZ_SET_LISTS(n->bar.cmbsz, 0);
 +        NVME_CMBSZ_SET_RDS(n->bar.cmbsz, 0);
 +        NVME_CMBSZ_SET_WDS(n->bar.cmbsz, 0);
 +        NVME_CMBSZ_SET_SZU(n->bar.cmbsz, 2); /* MBs */
 +        NVME_CMBSZ_SET_SZ(n->bar.cmbsz, n->cmb_size_mb);
 +
 +        n->cmbuf = g_malloc0(NVME_CMBSZ_GETSIZE(n->bar.cmbsz));
 +        memory_region_init_io(&n->ctrl_mem, OBJECT(n), &nvme_cmb_ops, n,
 +                              "nvme-cmb", NVME_CMBSZ_GETSIZE(n->bar.cmbsz));
 +        pci_register_bar(&n->parent_obj, NVME_CMBLOC_BIR(n->bar.cmbloc),
 +            PCI_BASE_ADDRESS_SPACE_MEMORY | PCI_BASE_ADDRESS_MEM_TYPE_64 |
 +            PCI_BASE_ADDRESS_MEM_PREFETCH, &n->ctrl_mem);
 +
 +    }
 +
      for (i = 0; i < n->num_namespaces; i++) {
          NvmeNamespace *ns = &n->namespaces[i];
          NvmeIdNs *id_ns = &ns->id_ns;
@@ -XXX,XX +XXX,XX @@ static void nvme_exit(PCIDevice *pci_dev)
      g_free(n->namespaces);
      g_free(n->cq);
      g_free(n->sq);
 +    if (n->cmbsz) {
 +        memory_region_unref(&n->ctrl_mem);
 +    }
 +
      msix_uninit_exclusive_bar(pci_dev);
  }
  static Property nvme_props[] = {
      DEFINE_BLOCK_PROPERTIES(NvmeCtrl, conf),
      DEFINE_PROP_STRING("serial", NvmeCtrl, serial),
 +    DEFINE_PROP_UINT32("cmb_size_mb", NvmeCtrl, cmb_size_mb, 0),
      DEFINE_PROP_END_OF_LIST(),
  };
 diff --git a/hw/block/nvme.h b/hw/block/nvme.h
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/block/nvme.h
 +++ b/hw/block/nvme.h
@@ -XXX,XX +XXX,XX @@ typedef struct NvmeBar {
      uint32_t    aqa;
      uint64_t    asq;
      uint64_t    acq;
 +    uint32_t    cmbloc;
 +    uint32_t    cmbsz;
  } NvmeBar;
  enum NvmeCapShift {
@@ -XXX,XX +XXX,XX @@ enum NvmeAqaMask {
  #define NVME_AQA_ASQS(aqa) ((aqa >> AQA_ASQS_SHIFT) & AQA_ASQS_MASK)
  #define NVME_AQA_ACQS(aqa) ((aqa >> AQA_ACQS_SHIFT) & AQA_ACQS_MASK)
 +enum NvmeCmblocShift {
 +    CMBLOC_BIR_SHIFT  = 0,
 +    CMBLOC_OFST_SHIFT = 12,
 +};
 +
 +enum NvmeCmblocMask {
 +    CMBLOC_BIR_MASK  = 0x7,
 +    CMBLOC_OFST_MASK = 0xfffff,
 +};
 +
 +#define NVME_CMBLOC_BIR(cmbloc) ((cmbloc >> CMBLOC_BIR_SHIFT)  & \
 +                                 CMBLOC_BIR_MASK)
 +#define NVME_CMBLOC_OFST(cmbloc)((cmbloc >> CMBLOC_OFST_SHIFT) & \
 +                                 CMBLOC_OFST_MASK)
 +
 +#define NVME_CMBLOC_SET_BIR(cmbloc, val)  \
 +    (cmbloc |= (uint64_t)(val & CMBLOC_BIR_MASK) << CMBLOC_BIR_SHIFT)
 +#define NVME_CMBLOC_SET_OFST(cmbloc, val) \
 +    (cmbloc |= (uint64_t)(val & CMBLOC_OFST_MASK) << CMBLOC_OFST_SHIFT)
 +
 +enum NvmeCmbszShift {
 +    CMBSZ_SQS_SHIFT   = 0,
 +    CMBSZ_CQS_SHIFT   = 1,
 +    CMBSZ_LISTS_SHIFT = 2,
 +    CMBSZ_RDS_SHIFT   = 3,
 +    CMBSZ_WDS_SHIFT   = 4,
 +    CMBSZ_SZU_SHIFT   = 8,
 +    CMBSZ_SZ_SHIFT    = 12,
 +};
 +
 +enum NvmeCmbszMask {
 +    CMBSZ_SQS_MASK   = 0x1,
 +    CMBSZ_CQS_MASK   = 0x1,
 +    CMBSZ_LISTS_MASK = 0x1,
 +    CMBSZ_RDS_MASK   = 0x1,
 +    CMBSZ_WDS_MASK   = 0x1,
 +    CMBSZ_SZU_MASK   = 0xf,
 +    CMBSZ_SZ_MASK    = 0xfffff,
 +};
 +
 +#define NVME_CMBSZ_SQS(cmbsz)  ((cmbsz >> CMBSZ_SQS_SHIFT)   & CMBSZ_SQS_MASK)
 +#define NVME_CMBSZ_CQS(cmbsz)  ((cmbsz >> CMBSZ_CQS_SHIFT)   & CMBSZ_CQS_MASK)
 +#define NVME_CMBSZ_LISTS(cmbsz)((cmbsz >> CMBSZ_LISTS_SHIFT) & CMBSZ_LISTS_MASK)
 +#define NVME_CMBSZ_RDS(cmbsz)  ((cmbsz >> CMBSZ_RDS_SHIFT)   & CMBSZ_RDS_MASK)
 +#define NVME_CMBSZ_WDS(cmbsz)  ((cmbsz >> CMBSZ_WDS_SHIFT)   & CMBSZ_WDS_MASK)
 +#define NVME_CMBSZ_SZU(cmbsz)  ((cmbsz >> CMBSZ_SZU_SHIFT)   & CMBSZ_SZU_MASK)
 +#define NVME_CMBSZ_SZ(cmbsz)   ((cmbsz >> CMBSZ_SZ_SHIFT)    & CMBSZ_SZ_MASK)
 +
 +#define NVME_CMBSZ_SET_SQS(cmbsz, val)   \
 +    (cmbsz |= (uint64_t)(val &  CMBSZ_SQS_MASK)  << CMBSZ_SQS_SHIFT)
 +#define NVME_CMBSZ_SET_CQS(cmbsz, val)   \
 +    (cmbsz |= (uint64_t)(val & CMBSZ_CQS_MASK) << CMBSZ_CQS_SHIFT)
 +#define NVME_CMBSZ_SET_LISTS(cmbsz, val) \
 +    (cmbsz |= (uint64_t)(val & CMBSZ_LISTS_MASK) << CMBSZ_LISTS_SHIFT)
 +#define NVME_CMBSZ_SET_RDS(cmbsz, val)   \
 +    (cmbsz |= (uint64_t)(val & CMBSZ_RDS_MASK) << CMBSZ_RDS_SHIFT)
 +#define NVME_CMBSZ_SET_WDS(cmbsz, val)   \
 +    (cmbsz |= (uint64_t)(val & CMBSZ_WDS_MASK) << CMBSZ_WDS_SHIFT)
 +#define NVME_CMBSZ_SET_SZU(cmbsz, val)   \
 +    (cmbsz |= (uint64_t)(val & CMBSZ_SZU_MASK) << CMBSZ_SZU_SHIFT)
 +#define NVME_CMBSZ_SET_SZ(cmbsz, val)    \
 +    (cmbsz |= (uint64_t)(val & CMBSZ_SZ_MASK) << CMBSZ_SZ_SHIFT)
 +
 +#define NVME_CMBSZ_GETSIZE(cmbsz) \
 +    (NVME_CMBSZ_SZ(cmbsz) * (1 << (12 + 4 * NVME_CMBSZ_SZU(cmbsz))))
 +
  typedef struct NvmeCmd {
      uint8_t     opcode;
      uint8_t     fuse;
@@ -XXX,XX +XXX,XX @@ typedef struct NvmeNamespace {
  typedef struct NvmeCtrl {
      PCIDevice    parent_obj;
      MemoryRegion iomem;
 +    MemoryRegion ctrl_mem;
      NvmeBar      bar;
      BlockConf    conf;
@@ -XXX,XX +XXX,XX @@ typedef struct NvmeCtrl {
      uint32_t    num_queues;
      uint32_t    max_q_ents;
      uint64_t    ns_size;
 +    uint32_t    cmb_size_mb;
 +    uint32_t    cmbsz;
 +    uint32_t    cmbloc;
 +    uint8_t     *cmbuf;
      char            *serial;
      NvmeNamespace   *namespaces;
 --
-.8.3.1
+.48.1

-[Qemu-devel] [PULL 02/15] qemu-iotests: Test streaming with missing job ID
+[PULL 07/22] aio-posix: Separate AioPolledEvent per AioHandler
-This adds a small test for the image streaming error path for failing
+Adaptive polling has a big problem: It doesn't consider that an event
-block_job_create(), which would have found the null pointer dereference
+loop can wait for many different events that may have very different
-in commit a170a91f.
+typical latencies.
 For example, think of a guest that tends to send a new I/O request soon
 after the previous I/O request completes, but the storage on the host is
 rather slow. In this case, getting the new request from guest quickly
 means that polling is enabled, but the next thing is performing the I/O
 request on the backend, which is slow and disables polling again for the
 next guest request. This means that in such a scenario, polling could
 help for every other event, but is only ever enabled when it can't
 succeed.
 In order to fix this, keep a separate AioPolledEvent for each
 AioHandler. We will then know that the backend file descriptor always
 has a high latency and isn't worth polling for, but we also know that
 the guest is always fast and we should poll for it. This solves at least
 half of the problem, we can now keep polling for those cases where it
 makes sense and get the improved performance from it.
 Since the event loop doesn't know which event will be next, we still do
 some unnecessary polling while we're waiting for the slow disk. I made
 some attempts to be more clever than just randomly growing and shrinking
 the polling time, and even to let callers be explicit about when they
 expect a new event, but so far this hasn't resulted in improved
 performance or even caused performance regressions. For now, let's just
 fix the part that is easy enough to fix, we can revisit the rest later.
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Reviewed-by: Alberto Garcia <berto@igalia.com>
+Message-ID: <20250307221634.71951-6-kwolf@redhat.com>
 Reviewed-by: Kashyap Chamarthy <kchamart@redhat.com>
 Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Jeff Cody <jcody@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
- tests/qemu-iotests/030     | 4 ++++
+ include/block/aio.h |  1 -
- tests/qemu-iotests/030.out | 4 ++--
+ util/aio-posix.h    |  1 +
-files changed, 6 insertions(+), 2 deletions(-)
+ util/aio-posix.c    | 26 ++++++++++++++++++++++----
  util/async.c        |  2 --
 files changed, 23 insertions(+), 7 deletions(-)
-diff --git a/tests/qemu-iotests/030 b/tests/qemu-iotests/030
+diff --git a/include/block/aio.h b/include/block/aio.h
-index XXXXXXX..XXXXXXX 100755
+index XXXXXXX..XXXXXXX 100644
---- a/tests/qemu-iotests/030
+--- a/include/block/aio.h
-+++ b/tests/qemu-iotests/030
++++ b/include/block/aio.h
-@@ -XXX,XX +XXX,XX @@ class TestSingleDrive(iotests.QMPTestCase):
+@@ -XXX,XX +XXX,XX @@ struct AioContext {
-         result = self.vm.qmp('block-stream', device='nonexistent')
+     int poll_disable_cnt;
-         self.assert_qmp(result, 'error/class', 'GenericError')
+     /* Polling mode parameters */
-+    def test_job_id_missing(self):
+-    AioPolledEvent poll;
-+        result = self.vm.qmp('block-stream', device='mid')
+     int64_t poll_max_ns;    /* maximum polling time in nanoseconds */
-+        self.assert_qmp(result, 'error/class', 'GenericError')
+     int64_t poll_grow;      /* polling time growth factor */
      int64_t poll_shrink;    /* polling time shrink factor */
 diff --git a/util/aio-posix.h b/util/aio-posix.h
 index XXXXXXX..XXXXXXX 100644
 --- a/util/aio-posix.h
 +++ b/util/aio-posix.h
@@ -XXX,XX +XXX,XX @@ struct AioHandler {
  #endif
      int64_t poll_idle_timeout; /* when to stop userspace polling */
      bool poll_ready; /* has polling detected an event? */
 +    AioPolledEvent poll;
  };
  /* Add a handler to a ready list */
 diff --git a/util/aio-posix.c b/util/aio-posix.c
 index XXXXXXX..XXXXXXX 100644
 --- a/util/aio-posix.c
 +++ b/util/aio-posix.c
@@ -XXX,XX +XXX,XX @@ static bool run_poll_handlers(AioContext *ctx, AioHandlerList *ready_list,
  static bool try_poll_mode(AioContext *ctx, AioHandlerList *ready_list,
                            int64_t *timeout)
  {
 +    AioHandler *node;
      int64_t max_ns;
      if (QLIST_EMPTY_RCU(&ctx->poll_aio_handlers)) {
          return false;
      }
 -    max_ns = qemu_soonest_timeout(*timeout, ctx->poll.ns);
 +    max_ns = 0;
 +    QLIST_FOREACH(node, &ctx->poll_aio_handlers, node_poll) {
 +        max_ns = MAX(max_ns, node->poll.ns);
 +    }
 +    max_ns = qemu_soonest_timeout(*timeout, max_ns);
 +
+     if (max_ns && !ctx->fdmon_ops->need_wait(ctx)) {
- class TestParallelOps(iotests.QMPTestCase):
+         /*
-     num_ops = 4 # Number of parallel block-stream operations
+          * Enable poll mode. It pairs with the poll_set_started() in
-diff --git a/tests/qemu-iotests/030.out b/tests/qemu-iotests/030.out
+@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
      /* Adjust polling time */
      if (ctx->poll_max_ns) {
 +        AioHandler *node;
          int64_t block_ns = qemu_clock_get_ns(QEMU_CLOCK_REALTIME) - start;
 -        adjust_polling_time(ctx, &ctx->poll, block_ns);
 +
 +        QLIST_FOREACH(node, &ctx->poll_aio_handlers, node_poll) {
 +            if (QLIST_IS_INSERTED(node, node_ready)) {
 +                adjust_polling_time(ctx, &node->poll, block_ns);
 +            }
 +        }
      }
      progress |= aio_bh_poll(ctx);
@@ -XXX,XX +XXX,XX @@ void aio_context_use_g_source(AioContext *ctx)
  void aio_context_set_poll_params(AioContext *ctx, int64_t max_ns,
                                   int64_t grow, int64_t shrink, Error **errp)
  {
 +    AioHandler *node;
 +
 +    qemu_lockcnt_inc(&ctx->list_lock);
 +    QLIST_FOREACH(node, &ctx->aio_handlers, node) {
 +        node->poll.ns = 0;
 +    }
 +    qemu_lockcnt_dec(&ctx->list_lock);
 +
      /* No thread synchronization here, it doesn't matter if an incorrect value
       * is used once.
       */
 -    ctx->poll.ns = 0;
 -
      ctx->poll_max_ns = max_ns;
      ctx->poll_grow = grow;
      ctx->poll_shrink = shrink;
 diff --git a/util/async.c b/util/async.c
 index XXXXXXX..XXXXXXX 100644
---- a/tests/qemu-iotests/030.out
+--- a/util/async.c
-+++ b/tests/qemu-iotests/030.out
++++ b/util/async.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ AioContext *aio_context_new(Error **errp)
--......................
+     qemu_rec_mutex_init(&ctx->lock);
-+.......................
+     timerlistgroup_init(&ctx->tlg, aio_timerlist_notify, ctx);
- ----------------------------------------------------------------------
--Ran 22 tests
+-    ctx->poll.ns = 0;
-+Ran 23 tests
+-
+     ctx->poll_max_ns = 0;
- OK
+     ctx->poll_grow = 0;
      ctx->poll_shrink = 0;
 --
-.8.3.1
+.48.1

-New patch
+[PULL 08/22] aio-posix: Adjust polling time also for new handlers
+aio_dispatch_handler() adds handlers to ctx->poll_aio_handlers if
+polling should be enabled. If we call adjust_polling_time() for all
+polling handlers before this, new polling handlers are still left at
+poll->ns = 0 and polling is only actually enabled after the next event.
+Move the adjust_polling_time() call after aio_dispatch_handler().
+This fixes test-nested-aio-poll, which expects that polling becomes
+effective the first time around.
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+Message-ID: <20250311141912.135657-1-kwolf@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ util/aio-posix.c | 28 +++++++++++++++++-----------
+file changed, 17 insertions(+), 11 deletions(-)
+diff --git a/util/aio-posix.c b/util/aio-posix.c
+index XXXXXXX..XXXXXXX 100644
+--- a/util/aio-posix.c
++++ b/util/aio-posix.c
+@@ -XXX,XX +XXX,XX @@
+ /* Stop userspace polling on a handler if it isn't active for some time */
+ #define POLL_IDLE_INTERVAL_NS (7 * NANOSECONDS_PER_SECOND)
++static void adjust_polling_time(AioContext *ctx, AioPolledEvent *poll,
++                                int64_t block_ns);
++
+ bool aio_poll_disabled(AioContext *ctx)
+ {
+     return qatomic_read(&ctx->poll_disable_cnt);
+@@ -XXX,XX +XXX,XX @@ static bool aio_dispatch_handler(AioContext *ctx, AioHandler *node)
+  * scanning all handlers with aio_dispatch_handlers().
+  */
+ static bool aio_dispatch_ready_handlers(AioContext *ctx,
+-                                        AioHandlerList *ready_list)
++                                        AioHandlerList *ready_list,
++                                        int64_t block_ns)
+ {
+     bool progress = false;
+     AioHandler *node;
+@@ -XXX,XX +XXX,XX @@ static bool aio_dispatch_ready_handlers(AioContext *ctx,
+     while ((node = QLIST_FIRST(ready_list))) {
+         QLIST_REMOVE(node, node_ready);
+         progress = aio_dispatch_handler(ctx, node) || progress;
++
++        /*
++         * Adjust polling time only after aio_dispatch_handler(), which can
++         * add the handler to ctx->poll_aio_handlers.
++         */
++        if (ctx->poll_max_ns && QLIST_IS_INSERTED(node, node_poll)) {
++            adjust_polling_time(ctx, &node->poll, block_ns);
++        }
+     }
+     return progress;
+@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
+     bool use_notify_me;
+     int64_t timeout;
+     int64_t start = 0;
++    int64_t block_ns = 0;
+     /*
+      * There cannot be two concurrent aio_poll calls for the same AioContext (or
+@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
+     aio_notify_accept(ctx);
+-    /* Adjust polling time */
++    /* Calculate blocked time for adaptive polling */
+     if (ctx->poll_max_ns) {
+-        AioHandler *node;
+-        int64_t block_ns = qemu_clock_get_ns(QEMU_CLOCK_REALTIME) - start;
+-
+-        QLIST_FOREACH(node, &ctx->poll_aio_handlers, node_poll) {
+-            if (QLIST_IS_INSERTED(node, node_ready)) {
+-                adjust_polling_time(ctx, &node->poll, block_ns);
+-            }
+-        }
++        block_ns = qemu_clock_get_ns(QEMU_CLOCK_REALTIME) - start;
+     }
+     progress |= aio_bh_poll(ctx);
+-    progress |= aio_dispatch_ready_handlers(ctx, &ready_list);
++    progress |= aio_dispatch_ready_handlers(ctx, &ready_list, block_ns);
+     aio_free_deleted_handlers(ctx);
+--
+.48.1

-[Qemu-devel] [PULL 05/15] mirror: Drop permissions on s->target on completion
+[PULL 09/22] iotests: Limit qsd-migrate to working formats
-This fixes an assertion failure that was triggered by qemu-iotests 129
+From: Thomas Huth <thuth@redhat.com>
 on some CI host, while the same test case didn't seem to fail on other
 hosts.
-Essentially the problem is that the blk_unref(s->target) in
+qsd-migrate is currently only working for raw, qcow2 and qed.
-mirror_exit() doesn't necessarily mean that the BlockBackend goes away
+Other formats are failing, e.g. because they don't support migration.
-immediately. It is possible that the job completion was triggered nested
+Thus let's limit this test to the three usable formats now.
 in mirror_drain(), which looks like this:
-    BlockBackend *target = s->target;
+Suggested-by: Kevin Wolf <kwolf@redhat.com>
-    blk_ref(target);
+Signed-off-by: Thomas Huth <thuth@redhat.com>
-    blk_drain(target);
+Message-ID: <20250224214058.205889-1-thuth@redhat.com>
-    blk_unref(target);
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
  tests/qemu-iotests/tests/qsd-migrate | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-In this case, the write permissions for s->target are retained until
+diff --git a/tests/qemu-iotests/tests/qsd-migrate b/tests/qemu-iotests/tests/qsd-migrate
-after blk_drain(), which makes removing mirror_top_bs fail for the
+index XXXXXXX..XXXXXXX 100755
-active commit case (can't have a writable backing file in the chain
+--- a/tests/qemu-iotests/tests/qsd-migrate
-without the filter driver).
++++ b/tests/qemu-iotests/tests/qsd-migrate
+@@ -XXX,XX +XXX,XX @@ import iotests
-Explicitly dropping the permissions first means that the additional
-reference doesn't hurt and the job can complete successfully even if
+ from iotests import filter_qemu_io, filter_qtest
-called from the nested blk_drain().
+-iotests.script_initialize(supported_fmts=['generic'],
-Cc: qemu-stable@nongnu.org
++iotests.script_initialize(supported_fmts=['qcow2', 'qed', 'raw'],
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+                           supported_protocols=['file'],
-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+                           supported_platforms=['linux'])
 Reviewed-by: Max Reitz <mreitz@redhat.com>
 ---
  block/mirror.c | 7 ++++++-
 file changed, 6 insertions(+), 1 deletion(-)
 diff --git a/block/mirror.c b/block/mirror.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/mirror.c
 +++ b/block/mirror.c
@@ -XXX,XX +XXX,XX @@ static void mirror_exit(BlockJob *job, void *opaque)
      /* Remove target parent that still uses BLK_PERM_WRITE/RESIZE before
       * inserting target_bs at s->to_replace, where we might not be able to get
 -     * these permissions. */
 +     * these permissions.
 +     *
 +     * Note that blk_unref() alone doesn't necessarily drop permissions because
 +     * we might be running nested inside mirror_drain(), which takes an extra
 +     * reference, so use an explicit blk_set_perm() first. */
 +    blk_set_perm(s->target, 0, BLK_PERM_ALL, &error_abort);
      blk_unref(s->target);
      s->target = NULL;
 --
-.8.3.1
+.48.1

-[Qemu-devel] [PULL 03/15] iotests: 147: Don't test inet6 if not available
+[PULL 10/22] scsi-disk: drop unused SCSIDiskState->bh field
-From: Fam Zheng <famz@redhat.com>
+From: Stefan Hajnoczi <stefanha@redhat.com>
-This is the case in our docker tests, as we use --net=none there. Skip
+Commit 71544d30a6f8 ("scsi: push request restart to SCSIDevice") removed
-this method.
+the only user of SCSIDiskState->bh.
-Signed-off-by: Fam Zheng <famz@redhat.com>
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Kevin Wolf <kwolf@redhat.com>
 Message-ID: <20250311132616.1049687-2-stefanha@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
- tests/qemu-iotests/147 | 7 +++++++
+ hw/scsi/scsi-disk.c | 1 -
-file changed, 7 insertions(+)
+file changed, 1 deletion(-)
-diff --git a/tests/qemu-iotests/147 b/tests/qemu-iotests/147
+diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
-index XXXXXXX..XXXXXXX 100755
+index XXXXXXX..XXXXXXX 100644
---- a/tests/qemu-iotests/147
+--- a/hw/scsi/scsi-disk.c
-+++ b/tests/qemu-iotests/147
++++ b/hw/scsi/scsi-disk.c
-@@ -XXX,XX +XXX,XX @@ class BuiltinNBD(NBDBlockdevAddBase):
+@@ -XXX,XX +XXX,XX @@ struct SCSIDiskState {
-         self._server_down()
+     uint64_t max_unmap_size;
+     uint64_t max_io_size;
-     def test_inet6(self):
+     uint32_t quirks;
-+        try:
+-    QEMUBH *bh;
-+            socket.getaddrinfo("::0", "0", socket.AF_INET6,
+     char *version;
-+                               socket.SOCK_STREAM, socket.IPPROTO_TCP,
+     char *serial;
-+                               socket.AI_ADDRCONFIG | socket.AI_CANONNAME)
+     char *vendor;
 +        except socket.gaierror:
 +            # IPv6 not available, skip
 +            return
          address = { 'type': 'inet',
                      'data': {
                          'host': '::1',
 --
-.8.3.1
+.48.1

-New patch
+[PULL 11/22] dma: use current AioContext for dma_blk_io()
+From: Stefan Hajnoczi <stefanha@redhat.com>
+In the past a single AioContext was used for block I/O and it was
+fetched using blk_get_aio_context(). Nowadays the block layer supports
+running I/O from any AioContext and multiple AioContexts at the same
+time. Remove the dma_blk_io() AioContext argument and use the current
+AioContext instead.
+This makes calling the function easier and enables multiple IOThreads to
+use dma_blk_io() concurrently for the same block device.
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Message-ID: <20250311132616.1049687-3-stefanha@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ include/system/dma.h | 3 +--
+ hw/ide/core.c        | 3 +--
+ hw/ide/macio.c       | 3 +--
+ hw/scsi/scsi-disk.c  | 6 ++----
+ system/dma-helpers.c | 8 ++++----
+files changed, 9 insertions(+), 14 deletions(-)
+diff --git a/include/system/dma.h b/include/system/dma.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/system/dma.h
++++ b/include/system/dma.h
+@@ -XXX,XX +XXX,XX @@ typedef BlockAIOCB *DMAIOFunc(int64_t offset, QEMUIOVector *iov,
+                               BlockCompletionFunc *cb, void *cb_opaque,
+                               void *opaque);
+-BlockAIOCB *dma_blk_io(AioContext *ctx,
+-                       QEMUSGList *sg, uint64_t offset, uint32_t align,
++BlockAIOCB *dma_blk_io(QEMUSGList *sg, uint64_t offset, uint32_t align,
+                        DMAIOFunc *io_func, void *io_func_opaque,
+                        BlockCompletionFunc *cb, void *opaque, DMADirection dir);
+ BlockAIOCB *dma_blk_read(BlockBackend *blk,
+diff --git a/hw/ide/core.c b/hw/ide/core.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/ide/core.c
++++ b/hw/ide/core.c
+@@ -XXX,XX +XXX,XX @@ static void ide_dma_cb(void *opaque, int ret)
+                                            BDRV_SECTOR_SIZE, ide_dma_cb, s);
+         break;
+     case IDE_DMA_TRIM:
+-        s->bus->dma->aiocb = dma_blk_io(blk_get_aio_context(s->blk),
+-                                        &s->sg, offset, BDRV_SECTOR_SIZE,
++        s->bus->dma->aiocb = dma_blk_io(&s->sg, offset, BDRV_SECTOR_SIZE,
+                                         ide_issue_trim, s, ide_dma_cb, s,
+                                         DMA_DIRECTION_TO_DEVICE);
+         break;
+diff --git a/hw/ide/macio.c b/hw/ide/macio.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/ide/macio.c
++++ b/hw/ide/macio.c
+@@ -XXX,XX +XXX,XX @@ static void pmac_ide_transfer_cb(void *opaque, int ret)
+                                            pmac_ide_transfer_cb, io);
+         break;
+     case IDE_DMA_TRIM:
+-        s->bus->dma->aiocb = dma_blk_io(blk_get_aio_context(s->blk), &s->sg,
+-                                        offset, 0x1, ide_issue_trim, s,
++        s->bus->dma->aiocb = dma_blk_io(&s->sg, offset, 0x1, ide_issue_trim, s,
+                                         pmac_ide_transfer_cb, io,
+                                         DMA_DIRECTION_TO_DEVICE);
+         break;
+diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/scsi/scsi-disk.c
++++ b/hw/scsi/scsi-disk.c
+@@ -XXX,XX +XXX,XX @@ static void scsi_do_read(SCSIDiskReq *r, int ret)
+     if (r->req.sg) {
+         dma_acct_start(s->qdev.conf.blk, &r->acct, r->req.sg, BLOCK_ACCT_READ);
+         r->req.residual -= r->req.sg->size;
+-        r->req.aiocb = dma_blk_io(blk_get_aio_context(s->qdev.conf.blk),
+-                                  r->req.sg, r->sector << BDRV_SECTOR_BITS,
++        r->req.aiocb = dma_blk_io(r->req.sg, r->sector << BDRV_SECTOR_BITS,
+                                   BDRV_SECTOR_SIZE,
+                                   sdc->dma_readv, r, scsi_dma_complete, r,
+                                   DMA_DIRECTION_FROM_DEVICE);
+@@ -XXX,XX +XXX,XX @@ static void scsi_write_data(SCSIRequest *req)
+     if (r->req.sg) {
+         dma_acct_start(s->qdev.conf.blk, &r->acct, r->req.sg, BLOCK_ACCT_WRITE);
+         r->req.residual -= r->req.sg->size;
+-        r->req.aiocb = dma_blk_io(blk_get_aio_context(s->qdev.conf.blk),
+-                                  r->req.sg, r->sector << BDRV_SECTOR_BITS,
++        r->req.aiocb = dma_blk_io(r->req.sg, r->sector << BDRV_SECTOR_BITS,
+                                   BDRV_SECTOR_SIZE,
+                                   sdc->dma_writev, r, scsi_dma_complete, r,
+                                   DMA_DIRECTION_TO_DEVICE);
+diff --git a/system/dma-helpers.c b/system/dma-helpers.c
+index XXXXXXX..XXXXXXX 100644
+--- a/system/dma-helpers.c
++++ b/system/dma-helpers.c
+@@ -XXX,XX +XXX,XX @@ static const AIOCBInfo dma_aiocb_info = {
+     .cancel_async       = dma_aio_cancel,
+ };
+-BlockAIOCB *dma_blk_io(AioContext *ctx,
++BlockAIOCB *dma_blk_io(
+     QEMUSGList *sg, uint64_t offset, uint32_t align,
+     DMAIOFunc *io_func, void *io_func_opaque,
+     BlockCompletionFunc *cb,
+@@ -XXX,XX +XXX,XX @@ BlockAIOCB *dma_blk_io(AioContext *ctx,
+     dbs->acb = NULL;
+     dbs->sg = sg;
+-    dbs->ctx = ctx;
++    dbs->ctx = qemu_get_current_aio_context();
+     dbs->offset = offset;
+     dbs->align = align;
+     dbs->sg_cur_index = 0;
+@@ -XXX,XX +XXX,XX @@ BlockAIOCB *dma_blk_read(BlockBackend *blk,
+                          QEMUSGList *sg, uint64_t offset, uint32_t align,
+                          void (*cb)(void *opaque, int ret), void *opaque)
+ {
+-    return dma_blk_io(blk_get_aio_context(blk), sg, offset, align,
++    return dma_blk_io(sg, offset, align,
+                       dma_blk_read_io_func, blk, cb, opaque,
+                       DMA_DIRECTION_FROM_DEVICE);
+ }
+@@ -XXX,XX +XXX,XX @@ BlockAIOCB *dma_blk_write(BlockBackend *blk,
+                           QEMUSGList *sg, uint64_t offset, uint32_t align,
+                           void (*cb)(void *opaque, int ret), void *opaque)
+ {
+-    return dma_blk_io(blk_get_aio_context(blk), sg, offset, align,
++    return dma_blk_io(sg, offset, align,
+                       dma_blk_write_io_func, blk, cb, opaque,
+                       DMA_DIRECTION_TO_DEVICE);
+ }
+--
+.48.1

-New patch
+[PULL 12/22] scsi: track per-SCSIRequest AioContext
+From: Stefan Hajnoczi <stefanha@redhat.com>
+Until now, a SCSIDevice's I/O requests have run in a single AioContext.
+In order to support multiple IOThreads it will be necessary to move to
+the concept of a per-SCSIRequest AioContext.
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Message-ID: <20250311132616.1049687-4-stefanha@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ include/hw/scsi/scsi.h |  1 +
+ hw/scsi/scsi-bus.c     |  1 +
+ hw/scsi/scsi-disk.c    | 17 ++++++-----------
+files changed, 8 insertions(+), 11 deletions(-)
+diff --git a/include/hw/scsi/scsi.h b/include/hw/scsi/scsi.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/scsi/scsi.h
++++ b/include/hw/scsi/scsi.h
+@@ -XXX,XX +XXX,XX @@ struct SCSIRequest {
+     SCSIBus           *bus;
+     SCSIDevice        *dev;
+     const SCSIReqOps  *ops;
++    AioContext        *ctx;
+     uint32_t          refcount;
+     uint32_t          tag;
+     uint32_t          lun;
+diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/scsi/scsi-bus.c
++++ b/hw/scsi/scsi-bus.c
+@@ -XXX,XX +XXX,XX @@ invalid_opcode:
+         }
+     }
++    req->ctx = qemu_get_current_aio_context();
+     req->cmd = cmd;
+     req->residual = req->cmd.xfer;
+diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/scsi/scsi-disk.c
++++ b/hw/scsi/scsi-disk.c
+@@ -XXX,XX +XXX,XX @@ static void scsi_aio_complete(void *opaque, int ret)
+     SCSIDiskReq *r = (SCSIDiskReq *)opaque;
+     SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
+-    /* The request must only run in the BlockBackend's AioContext */
+-    assert(blk_get_aio_context(s->qdev.conf.blk) ==
+-           qemu_get_current_aio_context());
++    /* The request must run in its AioContext */
++    assert(r->req.ctx == qemu_get_current_aio_context());
+     assert(r->req.aiocb != NULL);
+     r->req.aiocb = NULL;
+@@ -XXX,XX +XXX,XX @@ static void scsi_dma_complete(void *opaque, int ret)
+ static void scsi_read_complete_noio(SCSIDiskReq *r, int ret)
+ {
+-    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
+     uint32_t n;
+-    /* The request must only run in the BlockBackend's AioContext */
+-    assert(blk_get_aio_context(s->qdev.conf.blk) ==
+-           qemu_get_current_aio_context());
++    /* The request must run in its AioContext */
++    assert(r->req.ctx == qemu_get_current_aio_context());
+     assert(r->req.aiocb == NULL);
+     if (scsi_disk_req_check_error(r, ret, ret > 0)) {
+@@ -XXX,XX +XXX,XX @@ static void scsi_read_data(SCSIRequest *req)
+ static void scsi_write_complete_noio(SCSIDiskReq *r, int ret)
+ {
+-    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
+     uint32_t n;
+-    /* The request must only run in the BlockBackend's AioContext */
+-    assert(blk_get_aio_context(s->qdev.conf.blk) ==
+-           qemu_get_current_aio_context());
++    /* The request must run in its AioContext */
++    assert(r->req.ctx == qemu_get_current_aio_context());
+     assert (r->req.aiocb == NULL);
+     if (scsi_disk_req_check_error(r, ret, ret > 0)) {
+--
+.48.1

-New patch
+[PULL 13/22] scsi: introduce requests_lock
+From: Stefan Hajnoczi <stefanha@redhat.com>
+SCSIDevice keeps track of in-flight requests for device reset and Task
+Management Functions (TMFs). The request list requires protection so
+that multi-threaded SCSI emulation can be implemented in commits that
+follow.
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Message-ID: <20250311132616.1049687-5-stefanha@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ include/hw/scsi/scsi.h |   7 ++-
+ hw/scsi/scsi-bus.c     | 120 +++++++++++++++++++++++++++++------------
+files changed, 88 insertions(+), 39 deletions(-)
+diff --git a/include/hw/scsi/scsi.h b/include/hw/scsi/scsi.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/scsi/scsi.h
++++ b/include/hw/scsi/scsi.h
+@@ -XXX,XX +XXX,XX @@ struct SCSIRequest {
+     bool              dma_started;
+     BlockAIOCB        *aiocb;
+     QEMUSGList        *sg;
++
++    /* Protected by SCSIDevice->requests_lock */
+     QTAILQ_ENTRY(SCSIRequest) next;
+ };
+@@ -XXX,XX +XXX,XX @@ struct SCSIDevice
+     uint8_t sense[SCSI_SENSE_BUF_SIZE];
+     uint32_t sense_len;
+-    /*
+-     * The requests list is only accessed from the AioContext that executes
+-     * requests or from the main loop when IOThread processing is stopped.
+-     */
++    QemuMutex requests_lock; /* protects the requests list */
+     QTAILQ_HEAD(, SCSIRequest) requests;
+     uint32_t channel;
+diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/scsi/scsi-bus.c
++++ b/hw/scsi/scsi-bus.c
+@@ -XXX,XX +XXX,XX @@ static void scsi_device_for_each_req_sync(SCSIDevice *s,
+     assert(!runstate_is_running());
+     assert(qemu_in_main_thread());
+-    QTAILQ_FOREACH_SAFE(req, &s->requests, next, next_req) {
+-        fn(req, opaque);
++    /*
++     * Locking is not necessary because the guest is stopped and no other
++     * threads can be accessing the requests list, but take the lock for
++     * consistency.
++     */
++    WITH_QEMU_LOCK_GUARD(&s->requests_lock) {
++        QTAILQ_FOREACH_SAFE(req, &s->requests, next, next_req) {
++            fn(req, opaque);
++        }
+     }
+ }
+@@ -XXX,XX +XXX,XX @@ static void scsi_device_for_each_req_async_bh(void *opaque)
+ {
+     g_autofree SCSIDeviceForEachReqAsyncData *data = opaque;
+     SCSIDevice *s = data->s;
+-    AioContext *ctx;
+-    SCSIRequest *req;
+-    SCSIRequest *next;
++    g_autoptr(GList) reqs = NULL;
+     /*
+-     * The BB cannot have changed contexts between this BH being scheduled and
+-     * now: BBs' AioContexts, when they have a node attached, can only be
+-     * changed via bdrv_try_change_aio_context(), in a drained section.  While
+-     * we have the in-flight counter incremented, that drain must block.
++     * Build a list of requests in this AioContext so fn() can be invoked later
++     * outside requests_lock.
+      */
+-    ctx = blk_get_aio_context(s->conf.blk);
+-    assert(ctx == qemu_get_current_aio_context());
++    WITH_QEMU_LOCK_GUARD(&s->requests_lock) {
++        AioContext *ctx = qemu_get_current_aio_context();
++        SCSIRequest *req;
++        SCSIRequest *next;
++
++        QTAILQ_FOREACH_SAFE(req, &s->requests, next, next) {
++            if (req->ctx == ctx) {
++                scsi_req_ref(req); /* dropped after calling fn() */
++                reqs = g_list_prepend(reqs, req);
++            }
++        }
++    }
+-    QTAILQ_FOREACH_SAFE(req, &s->requests, next, next) {
+-        data->fn(req, data->fn_opaque);
++    /* Call fn() on each request */
++    for (GList *elem = g_list_first(reqs); elem; elem = g_list_next(elem)) {
++        data->fn(elem->data, data->fn_opaque);
++        scsi_req_unref(elem->data);
+     }
+     /* Drop the reference taken by scsi_device_for_each_req_async() */
+@@ -XXX,XX +XXX,XX @@ static void scsi_device_for_each_req_async_bh(void *opaque)
+     blk_dec_in_flight(s->conf.blk);
+ }
++static void scsi_device_for_each_req_async_do_ctx(gpointer key, gpointer value,
++                                                  gpointer user_data)
++{
++    AioContext *ctx = key;
++    SCSIDeviceForEachReqAsyncData *params = user_data;
++    SCSIDeviceForEachReqAsyncData *data;
++
++    data = g_new(SCSIDeviceForEachReqAsyncData, 1);
++    data->s = params->s;
++    data->fn = params->fn;
++    data->fn_opaque = params->fn_opaque;
++
++    /*
++     * Hold a reference to the SCSIDevice until
++     * scsi_device_for_each_req_async_bh() finishes.
++     */
++    object_ref(OBJECT(data->s));
++
++    /* Paired with scsi_device_for_each_req_async_bh() */
++    blk_inc_in_flight(data->s->conf.blk);
++
++    aio_bh_schedule_oneshot(ctx, scsi_device_for_each_req_async_bh, data);
++}
++
+ /*
+  * Schedule @fn() to be invoked for each enqueued request in device @s. @fn()
+- * runs in the AioContext that is executing the request.
++ * must be thread-safe because it runs concurrently in each AioContext that is
++ * executing a request.
++ *
+  * Keeps the BlockBackend's in-flight counter incremented until everything is
+  * done, so draining it will settle all scheduled @fn() calls.
+  */
+@@ -XXX,XX +XXX,XX @@ static void scsi_device_for_each_req_async(SCSIDevice *s,
+ {
+     assert(qemu_in_main_thread());
+-    SCSIDeviceForEachReqAsyncData *data =
+-        g_new(SCSIDeviceForEachReqAsyncData, 1);
+-
+-    data->s = s;
+-    data->fn = fn;
+-    data->fn_opaque = opaque;
+-
+-    /*
+-     * Hold a reference to the SCSIDevice until
+-     * scsi_device_for_each_req_async_bh() finishes.
+-     */
+-    object_ref(OBJECT(s));
++    /* The set of AioContexts where the requests are being processed */
++    g_autoptr(GHashTable) aio_contexts = g_hash_table_new(NULL, NULL);
++    WITH_QEMU_LOCK_GUARD(&s->requests_lock) {
++        SCSIRequest *req;
++        QTAILQ_FOREACH(req, &s->requests, next) {
++            g_hash_table_add(aio_contexts, req->ctx);
++        }
++    }
+-    /* Paired with blk_dec_in_flight() in scsi_device_for_each_req_async_bh() */
+-    blk_inc_in_flight(s->conf.blk);
+-    aio_bh_schedule_oneshot(blk_get_aio_context(s->conf.blk),
+-                            scsi_device_for_each_req_async_bh,
+-                            data);
++    /* Schedule a BH for each AioContext */
++    SCSIDeviceForEachReqAsyncData params = {
++        .s = s,
++        .fn = fn,
++        .fn_opaque = opaque,
++    };
++    g_hash_table_foreach(
++            aio_contexts,
++            scsi_device_for_each_req_async_do_ctx,
++            &params
++    );
+ }
+ static void scsi_device_realize(SCSIDevice *s, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static void scsi_qdev_realize(DeviceState *qdev, Error **errp)
+         dev->lun = lun;
+     }
++    qemu_mutex_init(&dev->requests_lock);
+     QTAILQ_INIT(&dev->requests);
+     scsi_device_realize(dev, &local_err);
+     if (local_err) {
+@@ -XXX,XX +XXX,XX @@ static void scsi_qdev_unrealize(DeviceState *qdev)
+     scsi_device_purge_requests(dev, SENSE_CODE(NO_SENSE));
++    qemu_mutex_destroy(&dev->requests_lock);
++
+     scsi_device_unrealize(dev);
+     blockdev_mark_auto_del(dev->conf.blk);
+@@ -XXX,XX +XXX,XX @@ static void scsi_req_enqueue_internal(SCSIRequest *req)
+         req->sg = NULL;
+     }
+     req->enqueued = true;
+-    QTAILQ_INSERT_TAIL(&req->dev->requests, req, next);
++
++    WITH_QEMU_LOCK_GUARD(&req->dev->requests_lock) {
++        QTAILQ_INSERT_TAIL(&req->dev->requests, req, next);
++    }
+ }
+ int32_t scsi_req_enqueue(SCSIRequest *req)
+@@ -XXX,XX +XXX,XX @@ static void scsi_req_dequeue(SCSIRequest *req)
+     trace_scsi_req_dequeue(req->dev->id, req->lun, req->tag);
+     req->retry = false;
+     if (req->enqueued) {
+-        QTAILQ_REMOVE(&req->dev->requests, req, next);
++        WITH_QEMU_LOCK_GUARD(&req->dev->requests_lock) {
++            QTAILQ_REMOVE(&req->dev->requests, req, next);
++        }
+         req->enqueued = false;
+         scsi_req_unref(req);
+     }
+@@ -XXX,XX +XXX,XX @@ static void scsi_device_class_init(ObjectClass *klass, void *data)
+ static void scsi_dev_instance_init(Object *obj)
+ {
+-    DeviceState *dev = DEVICE(obj);
+-    SCSIDevice *s = SCSI_DEVICE(dev);
++    SCSIDevice *s = SCSI_DEVICE(obj);
+     device_add_bootindex_property(obj, &s->conf.bootindex,
+                                   "bootindex", NULL,
+--
+.48.1

-[Qemu-devel] [PULL 06/15] qcow2: remove extra local_error variable
+[PULL 14/22] virtio-scsi: introduce event and ctrl virtqueue locks
-From: Alberto Garcia <berto@igalia.com>
+From: Stefan Hajnoczi <stefanha@redhat.com>
-Commit d7086422b1c1e75e320519cfe26176db6ec97a37 added a local_err
+Virtqueues are not thread-safe. Until now this was not a major issue
-variable global to the qcow2_amend_options() function, so there's no
+since all virtqueue processing happened in the same thread. The ctrl
-need to have this other one.
+queue's Task Management Function (TMF) requests sometimes need the main
+loop, so a BH was used to schedule the virtqueue completion back in the
-Signed-off-by: Alberto Garcia <berto@igalia.com>
+thread that has virtqueue access.
-Message-id: 20170511150337.21470-1-berto@igalia.com
-Reviewed-by: Eric Blake <eblake@redhat.com>
+When IOThread Virtqueue Mapping is introduced in later commits, event
-Signed-off-by: Max Reitz <mreitz@redhat.com>
+and ctrl virtqueue accesses from other threads will become necessary.
 Introduce an optional per-virtqueue lock so the event and ctrl
 virtqueues can be protected in the commits that follow.
 The addition of the ctrl virtqueue lock makes
 virtio_scsi_complete_req_from_main_loop() and its BH unnecessary.
 Instead, take the ctrl virtqueue lock from the main loop thread.
 The cmd virtqueue does not have a lock because the entirety of SCSI
 command processing happens in one thread. Only one thread accesses the
 cmd virtqueue and a lock is unnecessary.
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Reviewed-by: Kevin Wolf <kwolf@redhat.com>
 Message-ID: <20250311132616.1049687-6-stefanha@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
- block/qcow2.c | 5 ++---
+ include/hw/virtio/virtio-scsi.h |  3 ++
-file changed, 2 insertions(+), 3 deletions(-)
+ hw/scsi/virtio-scsi.c           | 84 ++++++++++++++++++---------------
+files changed, 49 insertions(+), 38 deletions(-)
-diff --git a/block/qcow2.c b/block/qcow2.c
 diff --git a/include/hw/virtio/virtio-scsi.h b/include/hw/virtio/virtio-scsi.h
 index XXXXXXX..XXXXXXX 100644
---- a/block/qcow2.c
+--- a/include/hw/virtio/virtio-scsi.h
-+++ b/block/qcow2.c
++++ b/include/hw/virtio/virtio-scsi.h
-@@ -XXX,XX +XXX,XX @@ static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts,
+@@ -XXX,XX +XXX,XX @@ struct VirtIOSCSI {
+     int resetting; /* written from main loop thread, read from any thread */
-     if (s->refcount_bits != refcount_bits) {
+     bool events_dropped;
-         int refcount_order = ctz32(refcount_bits);
--        Error *local_error = NULL;
++    QemuMutex ctrl_lock; /* protects ctrl_vq */
++    QemuMutex event_lock; /* protects event_vq */
-         if (new_version < 3 && refcount_bits != 16) {
++
-             error_report("Different refcount widths than 16 bits require "
+     /*
-@@ -XXX,XX +XXX,XX @@ static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts,
+      * TMFs deferred to main loop BH. These fields are protected by
-         helper_cb_info.current_operation = QCOW2_CHANGING_REFCOUNT_ORDER;
+      * tmf_bh_lock.
-         ret = qcow2_change_refcount_order(bs, refcount_order,
+diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
-                                           &qcow2_amend_helper_cb,
+index XXXXXXX..XXXXXXX 100644
--                                          &helper_cb_info, &local_error);
+--- a/hw/scsi/virtio-scsi.c
-+                                          &helper_cb_info, &local_err);
++++ b/hw/scsi/virtio-scsi.c
-         if (ret < 0) {
+@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_free_req(VirtIOSCSIReq *req)
--            error_report_err(local_error);
+     g_free(req);
-+            error_report_err(local_err);
+ }
-             return ret;
 -static void virtio_scsi_complete_req(VirtIOSCSIReq *req)
 +static void virtio_scsi_complete_req(VirtIOSCSIReq *req, QemuMutex *vq_lock)
  {
      VirtIOSCSI *s = req->dev;
      VirtQueue *vq = req->vq;
      VirtIODevice *vdev = VIRTIO_DEVICE(s);
      qemu_iovec_from_buf(&req->resp_iov, 0, &req->resp, req->resp_size);
 +
 +    if (vq_lock) {
 +        qemu_mutex_lock(vq_lock);
 +    }
 +
      virtqueue_push(vq, &req->elem, req->qsgl.size + req->resp_iov.size);
      if (s->dataplane_started && !s->dataplane_fenced) {
          virtio_notify_irqfd(vdev, vq);
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_complete_req(VirtIOSCSIReq *req)
          virtio_notify(vdev, vq);
      }
 +    if (vq_lock) {
 +        qemu_mutex_unlock(vq_lock);
 +    }
 +
      if (req->sreq) {
          req->sreq->hba_private = NULL;
          scsi_req_unref(req->sreq);
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_complete_req(VirtIOSCSIReq *req)
      virtio_scsi_free_req(req);
  }
 -static void virtio_scsi_complete_req_bh(void *opaque)
 +static void virtio_scsi_bad_req(VirtIOSCSIReq *req, QemuMutex *vq_lock)
  {
 -    VirtIOSCSIReq *req = opaque;
 +    virtio_error(VIRTIO_DEVICE(req->dev), "wrong size for virtio-scsi headers");
 -    virtio_scsi_complete_req(req);
 -}
 +    if (vq_lock) {
 +        qemu_mutex_lock(vq_lock);
 +    }
 -/*
 - * Called from virtio_scsi_do_one_tmf_bh() in main loop thread. The main loop
 - * thread cannot touch the virtqueue since that could race with an IOThread.
 - */
 -static void virtio_scsi_complete_req_from_main_loop(VirtIOSCSIReq *req)
 -{
 -    VirtIOSCSI *s = req->dev;
 +    virtqueue_detach_element(req->vq, &req->elem, 0);
 -    if (!s->ctx || s->ctx == qemu_get_aio_context()) {
 -        /* No need to schedule a BH when there is no IOThread */
 -        virtio_scsi_complete_req(req);
 -    } else {
 -        /* Run request completion in the IOThread */
 -        aio_wait_bh_oneshot(s->ctx, virtio_scsi_complete_req_bh, req);
 +    if (vq_lock) {
 +        qemu_mutex_unlock(vq_lock);
      }
 -}
 -static void virtio_scsi_bad_req(VirtIOSCSIReq *req)
 -{
 -    virtio_error(VIRTIO_DEVICE(req->dev), "wrong size for virtio-scsi headers");
 -    virtqueue_detach_element(req->vq, &req->elem, 0);
      virtio_scsi_free_req(req);
  }
@@ -XXX,XX +XXX,XX @@ static int virtio_scsi_parse_req(VirtIOSCSIReq *req,
      return 0;
  }
 -static VirtIOSCSIReq *virtio_scsi_pop_req(VirtIOSCSI *s, VirtQueue *vq)
 +static VirtIOSCSIReq *virtio_scsi_pop_req(VirtIOSCSI *s, VirtQueue *vq, QemuMutex *vq_lock)
  {
      VirtIOSCSICommon *vs = (VirtIOSCSICommon *)s;
      VirtIOSCSIReq *req;
 +    if (vq_lock) {
 +        qemu_mutex_lock(vq_lock);
 +    }
 +
      req = virtqueue_pop(vq, sizeof(VirtIOSCSIReq) + vs->cdb_size);
 +
 +    if (vq_lock) {
 +        qemu_mutex_unlock(vq_lock);
 +    }
 +
      if (!req) {
          return NULL;
      }
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_cancel_notify(Notifier *notifier, void *data)
          trace_virtio_scsi_tmf_resp(virtio_scsi_get_lun(req->req.tmf.lun),
                                     req->req.tmf.tag, req->resp.tmf.response);
 -        virtio_scsi_complete_req(req);
 +        virtio_scsi_complete_req(req, &req->dev->ctrl_lock);
      }
      g_free(n);
  }
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_do_one_tmf_bh(VirtIOSCSIReq *req)
  out:
      object_unref(OBJECT(d));
 -    virtio_scsi_complete_req_from_main_loop(req);
 +    virtio_scsi_complete_req(req, &s->ctrl_lock);
  }
  /* Some TMFs must be processed from the main loop thread */
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_reset_tmf_bh(VirtIOSCSI *s)
          /* SAM-6 6.3.2 Hard reset */
          req->resp.tmf.response = VIRTIO_SCSI_S_TARGET_FAILURE;
 -        virtio_scsi_complete_req(req);
 +        virtio_scsi_complete_req(req, &req->dev->ctrl_lock);
      }
  }
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_handle_ctrl_req(VirtIOSCSI *s, VirtIOSCSIReq *req)
      if (iov_to_buf(req->elem.out_sg, req->elem.out_num, 0,
                  &type, sizeof(type)) < sizeof(type)) {
 -        virtio_scsi_bad_req(req);
 +        virtio_scsi_bad_req(req, &s->ctrl_lock);
          return;
      }
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_handle_ctrl_req(VirtIOSCSI *s, VirtIOSCSIReq *req)
      if (type == VIRTIO_SCSI_T_TMF) {
          if (virtio_scsi_parse_req(req, sizeof(VirtIOSCSICtrlTMFReq),
                      sizeof(VirtIOSCSICtrlTMFResp)) < 0) {
 -            virtio_scsi_bad_req(req);
 +            virtio_scsi_bad_req(req, &s->ctrl_lock);
              return;
          } else {
              r = virtio_scsi_do_tmf(s, req);
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_handle_ctrl_req(VirtIOSCSI *s, VirtIOSCSIReq *req)
                 type == VIRTIO_SCSI_T_AN_SUBSCRIBE) {
          if (virtio_scsi_parse_req(req, sizeof(VirtIOSCSICtrlANReq),
                      sizeof(VirtIOSCSICtrlANResp)) < 0) {
 -            virtio_scsi_bad_req(req);
 +            virtio_scsi_bad_req(req, &s->ctrl_lock);
              return;
          } else {
              req->req.an.event_requested =
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_handle_ctrl_req(VirtIOSCSI *s, VirtIOSCSIReq *req)
                   type == VIRTIO_SCSI_T_AN_SUBSCRIBE)
              trace_virtio_scsi_an_resp(virtio_scsi_get_lun(req->req.an.lun),
                                        req->resp.an.response);
 -        virtio_scsi_complete_req(req);
 +        virtio_scsi_complete_req(req, &s->ctrl_lock);
      } else {
          assert(r == -EINPROGRESS);
      }
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_handle_ctrl_vq(VirtIOSCSI *s, VirtQueue *vq)
  {
      VirtIOSCSIReq *req;
 -    while ((req = virtio_scsi_pop_req(s, vq))) {
 +    while ((req = virtio_scsi_pop_req(s, vq, &s->ctrl_lock))) {
          virtio_scsi_handle_ctrl_req(s, req);
      }
  }
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_complete_cmd_req(VirtIOSCSIReq *req)
       * in virtio_scsi_command_complete.
       */
      req->resp_size = sizeof(VirtIOSCSICmdResp);
 -    virtio_scsi_complete_req(req);
 +    virtio_scsi_complete_req(req, NULL);
  }
  static void virtio_scsi_command_failed(SCSIRequest *r)
@@ -XXX,XX +XXX,XX @@ static int virtio_scsi_handle_cmd_req_prepare(VirtIOSCSI *s, VirtIOSCSIReq *req)
              virtio_scsi_fail_cmd_req(req);
              return -ENOTSUP;
          } else {
 -            virtio_scsi_bad_req(req);
 +            virtio_scsi_bad_req(req, NULL);
              return -EINVAL;
          }
      }
+@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_handle_cmd_vq(VirtIOSCSI *s, VirtQueue *vq)
+             virtio_queue_set_notification(vq, 0);
+         }
+-        while ((req = virtio_scsi_pop_req(s, vq))) {
++        while ((req = virtio_scsi_pop_req(s, vq, NULL))) {
+             ret = virtio_scsi_handle_cmd_req_prepare(s, req);
+             if (!ret) {
+                 QTAILQ_INSERT_TAIL(&reqs, req, next);
+@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_push_event(VirtIOSCSI *s,
+         return;
+     }
+-    req = virtio_scsi_pop_req(s, vs->event_vq);
++    req = virtio_scsi_pop_req(s, vs->event_vq, &s->event_lock);
+     if (!req) {
+         s->events_dropped = true;
+         return;
+@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_push_event(VirtIOSCSI *s,
+     }
+     if (virtio_scsi_parse_req(req, 0, sizeof(VirtIOSCSIEvent))) {
+-        virtio_scsi_bad_req(req);
++        virtio_scsi_bad_req(req, &s->event_lock);
+         return;
+     }
+@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_push_event(VirtIOSCSI *s,
+     }
+     trace_virtio_scsi_event(virtio_scsi_get_lun(evt->lun), event, reason);
+-    virtio_scsi_complete_req(req);
++    virtio_scsi_complete_req(req, &s->event_lock);
+ }
+ static void virtio_scsi_handle_event_vq(VirtIOSCSI *s, VirtQueue *vq)
+@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_device_realize(DeviceState *dev, Error **errp)
+     Error *err = NULL;
+     QTAILQ_INIT(&s->tmf_bh_list);
++    qemu_mutex_init(&s->ctrl_lock);
++    qemu_mutex_init(&s->event_lock);
+     qemu_mutex_init(&s->tmf_bh_lock);
+     virtio_scsi_common_realize(dev,
+@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_device_unrealize(DeviceState *dev)
+     qbus_set_hotplug_handler(BUS(&s->bus), NULL);
+     virtio_scsi_common_unrealize(dev);
+     qemu_mutex_destroy(&s->tmf_bh_lock);
++    qemu_mutex_destroy(&s->event_lock);
++    qemu_mutex_destroy(&s->ctrl_lock);
+ }
+ static const Property virtio_scsi_properties[] = {
 --
-.8.3.1
+.48.1

-[Qemu-devel] [PULL 08/15] qemu-img: add support for --object with 'dd' command
+[PULL 15/22] virtio-scsi: protect events_dropped field
-From: "Daniel P. Berrange" <berrange@redhat.com>
+From: Stefan Hajnoczi <stefanha@redhat.com>
-The qemu-img dd command added --image-opts support, but missed
+The block layer can invoke the resize callback from any AioContext that
-the corresponding --object support. This prevented passing
+is processing requests. The virtqueue is already protected but the
-secrets (eg auth passwords) needed by certain disk images.
+events_dropped field also needs to be protected against races. Cover it
 using the event virtqueue lock because it is closely associated with
 accesses to the virtqueue.
-Reviewed-by: Fam Zheng <famz@redhat.com>
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Max Reitz <mreitz@redhat.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
+Message-ID: <20250311132616.1049687-7-stefanha@redhat.com>
-Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 Message-id: 20170515164712.6643-2-berrange@redhat.com
 Signed-off-by: Max Reitz <mreitz@redhat.com>
 ---
- qemu-img.c | 18 ++++++++++++++++++
+ include/hw/virtio/virtio-scsi.h |  3 ++-
-file changed, 18 insertions(+)
+ hw/scsi/virtio-scsi.c           | 29 ++++++++++++++++++++---------
 files changed, 22 insertions(+), 10 deletions(-)
-diff --git a/qemu-img.c b/qemu-img.c
+diff --git a/include/hw/virtio/virtio-scsi.h b/include/hw/virtio/virtio-scsi.h
 index XXXXXXX..XXXXXXX 100644
---- a/qemu-img.c
+--- a/include/hw/virtio/virtio-scsi.h
-+++ b/qemu-img.c
++++ b/include/hw/virtio/virtio-scsi.h
-@@ -XXX,XX +XXX,XX @@ static int img_dd(int argc, char **argv)
+@@ -XXX,XX +XXX,XX @@ struct VirtIOSCSI {
-     };
-     const struct option long_options[] = {
+     SCSIBus bus;
-         { "help", no_argument, 0, 'h'},
+     int resetting; /* written from main loop thread, read from any thread */
-+        { "object", required_argument, 0, OPTION_OBJECT},
++
-         { "image-opts", no_argument, 0, OPTION_IMAGE_OPTS},
++    QemuMutex event_lock; /* protects event_vq and events_dropped */
-         { "force-share", no_argument, 0, 'U'},
+     bool events_dropped;
-         { 0, 0, 0, 0 }
-@@ -XXX,XX +XXX,XX @@ static int img_dd(int argc, char **argv)
+     QemuMutex ctrl_lock; /* protects ctrl_vq */
-         case 'U':
+-    QemuMutex event_lock; /* protects event_vq */
-             force_share = true;
-             break;
+     /*
-+        case OPTION_OBJECT: {
+      * TMFs deferred to main loop BH. These fields are protected by
-+            QemuOpts *opts;
+diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
-+            opts = qemu_opts_parse_noisily(&qemu_object_opts,
+index XXXXXXX..XXXXXXX 100644
-+                                           optarg, true);
+--- a/hw/scsi/virtio-scsi.c
-+            if (!opts) {
++++ b/hw/scsi/virtio-scsi.c
-+                ret = -1;
+@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_reset(VirtIODevice *vdev)
-+                goto out;
-+            }
+     vs->sense_size = VIRTIO_SCSI_SENSE_DEFAULT_SIZE;
-+        }   break;
+     vs->cdb_size = VIRTIO_SCSI_CDB_DEFAULT_SIZE;
-         case OPTION_IMAGE_OPTS:
+-    s->events_dropped = false;
-             image_opts = true;
++
-             break;
++    WITH_QEMU_LOCK_GUARD(&s->event_lock) {
-@@ -XXX,XX +XXX,XX @@ static int img_dd(int argc, char **argv)
++        s->events_dropped = false;
-         ret = -1;
++    }
-         goto out;
+ }
  typedef struct {
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_push_event(VirtIOSCSI *s,
      }
+     req = virtio_scsi_pop_req(s, vs->event_vq, &s->event_lock);
+-    if (!req) {
+-        s->events_dropped = true;
+-        return;
+-    }
++    WITH_QEMU_LOCK_GUARD(&s->event_lock) {
++        if (!req) {
++            s->events_dropped = true;
++            return;
++        }
+-    if (s->events_dropped) {
+-        event |= VIRTIO_SCSI_T_EVENTS_MISSED;
+-        s->events_dropped = false;
++        if (s->events_dropped) {
++            event |= VIRTIO_SCSI_T_EVENTS_MISSED;
++            s->events_dropped = false;
++        }
+     }
+     if (virtio_scsi_parse_req(req, 0, sizeof(VirtIOSCSIEvent))) {
+@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_push_event(VirtIOSCSI *s,
+ static void virtio_scsi_handle_event_vq(VirtIOSCSI *s, VirtQueue *vq)
+ {
+-    if (s->events_dropped) {
++    bool events_dropped;
 +
-+    if (qemu_opts_foreach(&qemu_object_opts,
++    WITH_QEMU_LOCK_GUARD(&s->event_lock) {
-+                          user_creatable_add_opts_foreach,
++        events_dropped = s->events_dropped;
 +                          NULL, NULL)) {
 +        ret = -1;
 +        goto out;
 +    }
 +
-     blk1 = img_open(image_opts, in.filename, fmt, 0, false, false,
++    if (events_dropped) {
-                     force_share);
+         VirtIOSCSIEventInfo info = {
+             .event = VIRTIO_SCSI_T_NO_EVENT,
          };
 --
-.8.3.1
+.48.1

-[Qemu-devel] [PULL 01/15] stream: fix crash in stream_start() when block_job_create() fails
+[PULL 16/22] virtio-scsi: perform TMFs in appropriate AioContexts
-From: Alberto Garcia <berto@igalia.com>
+From: Stefan Hajnoczi <stefanha@redhat.com>
-The code that tries to reopen a BlockDriverState in stream_start()
+With IOThread Virtqueue Mapping there will be multiple AioContexts
-when the creation of a new block job fails crashes because it attempts
+processing SCSI requests. scsi_req_cancel() and other SCSI request
-to dereference a pointer that is known to be NULL.
+operations must be performed from the AioContext where the request is
+running.
-This is a regression introduced in a170a91fd3eab6155da39e740381867e,
-likely because the code was copied from stream_complete().
+Introduce a virtio_scsi_defer_tmf_to_aio_context() function and the
+necessary VirtIOSCSIReq->remaining refcount infrastructure to move the
-Cc: qemu-stable@nongnu.org
+TMF code into the AioContext where the request is running.
-Reported-by: Kashyap Chamarthy <kchamart@redhat.com>
-Signed-off-by: Alberto Garcia <berto@igalia.com>
+For the time being there is still just one AioContext: the main loop or
-Tested-by: Kashyap Chamarthy <kchamart@redhat.com>
+the IOThread. When the iothread-vq-mapping parameter is added in a later
 patch this will be changed to per-virtqueue AioContexts.
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Reviewed-by: Kevin Wolf <kwolf@redhat.com>
 Message-ID: <20250311132616.1049687-8-stefanha@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
- block/stream.c | 2 +-
+ hw/scsi/virtio-scsi.c | 270 ++++++++++++++++++++++++++++++++----------
-file changed, 1 insertion(+), 1 deletion(-)
+file changed, 206 insertions(+), 64 deletions(-)
-diff --git a/block/stream.c b/block/stream.c
+diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
 index XXXXXXX..XXXXXXX 100644
---- a/block/stream.c
+--- a/hw/scsi/virtio-scsi.c
-+++ b/block/stream.c
++++ b/hw/scsi/virtio-scsi.c
-@@ -XXX,XX +XXX,XX @@ void stream_start(const char *job_id, BlockDriverState *bs,
+@@ -XXX,XX +XXX,XX @@ typedef struct VirtIOSCSIReq {
+     /* Used for two-stage request submission and TMFs deferred to BH */
- fail:
+     QTAILQ_ENTRY(VirtIOSCSIReq) next;
-     if (orig_bs_flags != bdrv_get_flags(bs)) {
--        bdrv_reopen(bs, s->bs_flags, NULL);
+-    /* Used for cancellation of request during TMFs */
-+        bdrv_reopen(bs, orig_bs_flags, NULL);
++    /* Used for cancellation of request during TMFs. Atomic. */
      int remaining;
      SCSIRequest *sreq;
@@ -XXX,XX +XXX,XX @@ typedef struct {
      VirtIOSCSIReq  *tmf_req;
  } VirtIOSCSICancelNotifier;
 +static void virtio_scsi_tmf_dec_remaining(VirtIOSCSIReq *tmf)
 +{
 +    if (qatomic_fetch_dec(&tmf->remaining) == 1) {
 +        trace_virtio_scsi_tmf_resp(virtio_scsi_get_lun(tmf->req.tmf.lun),
 +                                   tmf->req.tmf.tag, tmf->resp.tmf.response);
 +
 +        virtio_scsi_complete_req(tmf, &tmf->dev->ctrl_lock);
 +    }
 +}
 +
  static void virtio_scsi_cancel_notify(Notifier *notifier, void *data)
  {
      VirtIOSCSICancelNotifier *n = container_of(notifier,
                                                 VirtIOSCSICancelNotifier,
                                                 notifier);
 -    if (--n->tmf_req->remaining == 0) {
 -        VirtIOSCSIReq *req = n->tmf_req;
 -
 -        trace_virtio_scsi_tmf_resp(virtio_scsi_get_lun(req->req.tmf.lun),
 -                                   req->req.tmf.tag, req->resp.tmf.response);
 -        virtio_scsi_complete_req(req, &req->dev->ctrl_lock);
 -    }
 +    virtio_scsi_tmf_dec_remaining(n->tmf_req);
      g_free(n);
  }
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_reset_tmf_bh(VirtIOSCSI *s)
      }
  }
+-static void virtio_scsi_defer_tmf_to_bh(VirtIOSCSIReq *req)
++static void virtio_scsi_defer_tmf_to_main_loop(VirtIOSCSIReq *req)
+ {
+     VirtIOSCSI *s = req->dev;
+@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_defer_tmf_to_bh(VirtIOSCSIReq *req)
+     }
+ }
++static void virtio_scsi_tmf_cancel_req(VirtIOSCSIReq *tmf, SCSIRequest *r)
++{
++    VirtIOSCSICancelNotifier *notifier;
++
++    assert(r->ctx == qemu_get_current_aio_context());
++
++    /* Decremented in virtio_scsi_cancel_notify() */
++    qatomic_inc(&tmf->remaining);
++
++    notifier = g_new(VirtIOSCSICancelNotifier, 1);
++    notifier->notifier.notify = virtio_scsi_cancel_notify;
++    notifier->tmf_req = tmf;
++    scsi_req_cancel_async(r, &notifier->notifier);
++}
++
++/* Execute a TMF on the requests in the current AioContext */
++static void virtio_scsi_do_tmf_aio_context(void *opaque)
++{
++    AioContext *ctx = qemu_get_current_aio_context();
++    VirtIOSCSIReq *tmf = opaque;
++    VirtIOSCSI *s = tmf->dev;
++    SCSIDevice *d = virtio_scsi_device_get(s, tmf->req.tmf.lun);
++    SCSIRequest *r;
++    bool match_tag;
++
++    if (!d) {
++        tmf->resp.tmf.response = VIRTIO_SCSI_S_BAD_TARGET;
++        virtio_scsi_tmf_dec_remaining(tmf);
++        return;
++    }
++
++    /*
++     * This function could handle other subtypes that need to be processed in
++     * the request's AioContext in the future, but for now only request
++     * cancelation subtypes are performed here.
++     */
++    switch (tmf->req.tmf.subtype) {
++    case VIRTIO_SCSI_T_TMF_ABORT_TASK:
++        match_tag = true;
++        break;
++    case VIRTIO_SCSI_T_TMF_ABORT_TASK_SET:
++    case VIRTIO_SCSI_T_TMF_CLEAR_TASK_SET:
++        match_tag = false;
++        break;
++    default:
++        g_assert_not_reached();
++    }
++
++    WITH_QEMU_LOCK_GUARD(&d->requests_lock) {
++        QTAILQ_FOREACH(r, &d->requests, next) {
++            VirtIOSCSIReq *cmd_req = r->hba_private;
++            assert(cmd_req); /* request has hba_private while enqueued */
++
++            if (r->ctx != ctx) {
++                continue;
++            }
++            if (match_tag && cmd_req->req.cmd.tag != tmf->req.tmf.tag) {
++                continue;
++            }
++            virtio_scsi_tmf_cancel_req(tmf, r);
++        }
++    }
++
++    /* Incremented by virtio_scsi_do_tmf() */
++    virtio_scsi_tmf_dec_remaining(tmf);
++
++    object_unref(d);
++}
++
++static void dummy_bh(void *opaque)
++{
++    /* Do nothing */
++}
++
++/*
++ * Wait for pending virtio_scsi_defer_tmf_to_aio_context() BHs.
++ */
++static void virtio_scsi_flush_defer_tmf_to_aio_context(VirtIOSCSI *s)
++{
++    GLOBAL_STATE_CODE();
++
++    assert(!s->dataplane_started);
++
++    if (s->ctx) {
++        /* Our BH only runs after previously scheduled BHs */
++        aio_wait_bh_oneshot(s->ctx, dummy_bh, NULL);
++    }
++}
++
++/*
++ * Run the TMF in a specific AioContext, handling only requests in that
++ * AioContext. This is necessary because requests can run in different
++ * AioContext and it is only possible to cancel them from the AioContext where
++ * they are running.
++ */
++static void virtio_scsi_defer_tmf_to_aio_context(VirtIOSCSIReq *tmf,
++                                                 AioContext *ctx)
++{
++    /* Decremented in virtio_scsi_do_tmf_aio_context() */
++    qatomic_inc(&tmf->remaining);
++
++    /* See virtio_scsi_flush_defer_tmf_to_aio_context() cleanup during reset */
++    aio_bh_schedule_oneshot(ctx, virtio_scsi_do_tmf_aio_context, tmf);
++}
++
++/*
++ * Returns the AioContext for a given TMF's tag field or NULL. Note that the
++ * request identified by the tag may have completed by the time you can execute
++ * a BH in the AioContext, so don't assume the request still exists in your BH.
++ */
++static AioContext *find_aio_context_for_tmf_tag(SCSIDevice *d,
++                                                VirtIOSCSIReq *tmf)
++{
++    WITH_QEMU_LOCK_GUARD(&d->requests_lock) {
++        SCSIRequest *r;
++        SCSIRequest *next;
++
++        QTAILQ_FOREACH_SAFE(r, &d->requests, next, next) {
++            VirtIOSCSIReq *cmd_req = r->hba_private;
++
++            /* hba_private is non-NULL while the request is enqueued */
++            assert(cmd_req);
++
++            if (cmd_req->req.cmd.tag == tmf->req.tmf.tag) {
++                return r->ctx;
++            }
++        }
++    }
++    return NULL;
++}
++
+ /* Return 0 if the request is ready to be completed and return to guest;
+  * -EINPROGRESS if the request is submitted and will be completed later, in the
+  *  case of async cancellation. */
+@@ -XXX,XX +XXX,XX @@ static int virtio_scsi_do_tmf(VirtIOSCSI *s, VirtIOSCSIReq *req)
+ {
+     SCSIDevice *d = virtio_scsi_device_get(s, req->req.tmf.lun);
+     SCSIRequest *r, *next;
++    AioContext *ctx;
+     int ret = 0;
+     virtio_scsi_ctx_check(s, d);
+@@ -XXX,XX +XXX,XX @@ static int virtio_scsi_do_tmf(VirtIOSCSI *s, VirtIOSCSIReq *req)
+                               req->req.tmf.tag, req->req.tmf.subtype);
+     switch (req->req.tmf.subtype) {
+-    case VIRTIO_SCSI_T_TMF_ABORT_TASK:
+-    case VIRTIO_SCSI_T_TMF_QUERY_TASK:
++    case VIRTIO_SCSI_T_TMF_ABORT_TASK: {
+         if (!d) {
+             goto fail;
+         }
+         if (d->lun != virtio_scsi_get_lun(req->req.tmf.lun)) {
+             goto incorrect_lun;
+         }
+-        QTAILQ_FOREACH_SAFE(r, &d->requests, next, next) {
+-            VirtIOSCSIReq *cmd_req = r->hba_private;
+-            if (cmd_req && cmd_req->req.cmd.tag == req->req.tmf.tag) {
+-                break;
+-            }
++
++        ctx = find_aio_context_for_tmf_tag(d, req);
++        if (ctx) {
++            virtio_scsi_defer_tmf_to_aio_context(req, ctx);
++            ret = -EINPROGRESS;
+         }
+-        if (r) {
+-            /*
+-             * Assert that the request has not been completed yet, we
+-             * check for it in the loop above.
+-             */
+-            assert(r->hba_private);
+-            if (req->req.tmf.subtype == VIRTIO_SCSI_T_TMF_QUERY_TASK) {
+-                /* "If the specified command is present in the task set, then
+-                 * return a service response set to FUNCTION SUCCEEDED".
+-                 */
+-                req->resp.tmf.response = VIRTIO_SCSI_S_FUNCTION_SUCCEEDED;
+-            } else {
+-                VirtIOSCSICancelNotifier *notifier;
+-
+-                req->remaining = 1;
+-                notifier = g_new(VirtIOSCSICancelNotifier, 1);
+-                notifier->tmf_req = req;
+-                notifier->notifier.notify = virtio_scsi_cancel_notify;
+-                scsi_req_cancel_async(r, &notifier->notifier);
+-                ret = -EINPROGRESS;
++        break;
++    }
++
++    case VIRTIO_SCSI_T_TMF_QUERY_TASK:
++        if (!d) {
++            goto fail;
++        }
++        if (d->lun != virtio_scsi_get_lun(req->req.tmf.lun)) {
++            goto incorrect_lun;
++        }
++
++        WITH_QEMU_LOCK_GUARD(&d->requests_lock) {
++            QTAILQ_FOREACH(r, &d->requests, next) {
++                VirtIOSCSIReq *cmd_req = r->hba_private;
++                assert(cmd_req); /* request has hba_private while enqueued */
++
++                if (cmd_req->req.cmd.tag == req->req.tmf.tag) {
++                    /*
++                     * "If the specified command is present in the task set,
++                     * then return a service response set to FUNCTION
++                     * SUCCEEDED".
++                     */
++                    req->resp.tmf.response = VIRTIO_SCSI_S_FUNCTION_SUCCEEDED;
++                }
+             }
+         }
+         break;
+     case VIRTIO_SCSI_T_TMF_LOGICAL_UNIT_RESET:
+     case VIRTIO_SCSI_T_TMF_I_T_NEXUS_RESET:
+-        virtio_scsi_defer_tmf_to_bh(req);
++        virtio_scsi_defer_tmf_to_main_loop(req);
+         ret = -EINPROGRESS;
+         break;
+     case VIRTIO_SCSI_T_TMF_ABORT_TASK_SET:
+-    case VIRTIO_SCSI_T_TMF_CLEAR_TASK_SET:
++    case VIRTIO_SCSI_T_TMF_CLEAR_TASK_SET: {
++        if (!d) {
++            goto fail;
++        }
++        if (d->lun != virtio_scsi_get_lun(req->req.tmf.lun)) {
++            goto incorrect_lun;
++        }
++
++        qatomic_inc(&req->remaining);
++
++        ctx = s->ctx ?: qemu_get_aio_context();
++        virtio_scsi_defer_tmf_to_aio_context(req, ctx);
++
++        virtio_scsi_tmf_dec_remaining(req);
++        ret = -EINPROGRESS;
++        break;
++    }
++
+     case VIRTIO_SCSI_T_TMF_QUERY_TASK_SET:
+         if (!d) {
+             goto fail;
+@@ -XXX,XX +XXX,XX @@ static int virtio_scsi_do_tmf(VirtIOSCSI *s, VirtIOSCSIReq *req)
+             goto incorrect_lun;
+         }
+-        /* Add 1 to "remaining" until virtio_scsi_do_tmf returns.
+-         * This way, if the bus starts calling back to the notifiers
+-         * even before we finish the loop, virtio_scsi_cancel_notify
+-         * will not complete the TMF too early.
+-         */
+-        req->remaining = 1;
+-        QTAILQ_FOREACH_SAFE(r, &d->requests, next, next) {
+-            if (r->hba_private) {
+-                if (req->req.tmf.subtype == VIRTIO_SCSI_T_TMF_QUERY_TASK_SET) {
+-                    /* "If there is any command present in the task set, then
+-                     * return a service response set to FUNCTION SUCCEEDED".
+-                     */
+-                    req->resp.tmf.response = VIRTIO_SCSI_S_FUNCTION_SUCCEEDED;
+-                    break;
+-                } else {
+-                    VirtIOSCSICancelNotifier *notifier;
+-
+-                    req->remaining++;
+-                    notifier = g_new(VirtIOSCSICancelNotifier, 1);
+-                    notifier->notifier.notify = virtio_scsi_cancel_notify;
+-                    notifier->tmf_req = req;
+-                    scsi_req_cancel_async(r, &notifier->notifier);
+-                }
++        WITH_QEMU_LOCK_GUARD(&d->requests_lock) {
++            QTAILQ_FOREACH_SAFE(r, &d->requests, next, next) {
++                /* Request has hba_private while enqueued */
++                assert(r->hba_private);
++
++                /*
++                 * "If there is any command present in the task set, then
++                 * return a service response set to FUNCTION SUCCEEDED".
++                 */
++                req->resp.tmf.response = VIRTIO_SCSI_S_FUNCTION_SUCCEEDED;
++                break;
+             }
+         }
+-        if (--req->remaining > 0) {
+-            ret = -EINPROGRESS;
+-        }
+         break;
+     case VIRTIO_SCSI_T_TMF_CLEAR_ACA:
+@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_reset(VirtIODevice *vdev)
+     assert(!s->dataplane_started);
+     virtio_scsi_reset_tmf_bh(s);
++    virtio_scsi_flush_defer_tmf_to_aio_context(s);
+     qatomic_inc(&s->resetting);
+     bus_cold_reset(BUS(&s->bus));
 --
-.8.3.1
+.48.1

-[Qemu-devel] [PULL 15/15] block/file-*: *_parse_filename() and colons
+[PULL 17/22] virtio-blk: extract cleanup_iothread_vq_mapping() function
-From: Max Reitz <mreitz@redhat.com>
+From: Stefan Hajnoczi <stefanha@redhat.com>
-The file drivers' *_parse_filename() implementations just strip the
+This is the cleanup function that must be called after
-optional protocol prefix off the filename. However, for e.g.
+apply_iothread_vq_mapping() succeeds. virtio-scsi will need this
-"file:foo:bar", this would lead to "foo:bar" being stored as the BDS's
+function too, so extract it.
 filename which looks like it should be managed using the "foo" protocol.
 This is especially troublesome if you then try to resolve a backing
 filename based on "foo:bar".
-This issue can only occur if the stripped part is a relative filename
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-("file:/foo:bar" will be shortened to "/foo:bar" and having a slash
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-before the first colon means that "/foo" is not recognized as a protocol
+Message-ID: <20250311132616.1049687-9-stefanha@redhat.com>
-part). Therefore, we can easily fix it by prepending "./" to such
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-filenames.
+---
  hw/block/virtio-blk.c | 27 +++++++++++++++++++++------
 file changed, 21 insertions(+), 6 deletions(-)
-Before this patch:
+diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
 $ ./qemu-img create -f qcow2 backing.qcow2 64M
 Formatting 'backing.qcow2', fmt=qcow2 size=67108864 encryption=off
     cluster_size=65536 lazy_refcounts=off refcount_bits=16
 $ ./qemu-img create -f qcow2 -b backing.qcow2 file:top:image.qcow2
 Formatting 'file:top:image.qcow2', fmt=qcow2 size=67108864
     backing_file=backing.qcow2 encryption=off cluster_size=65536
     lazy_refcounts=off refcount_bits=16
 $ ./qemu-io file:top:image.qcow2
 can't open device file:top:image.qcow2: Could not open backing file:
     Unknown protocol 'top'
 After this patch:
 $ ./qemu-io file:top:image.qcow2
 [no error]
 Signed-off-by: Max Reitz <mreitz@redhat.com>
 Message-id: 20170522195217.12991-3-mreitz@redhat.com
 Reviewed-by: Eric Blake <eblake@redhat.com>
 Signed-off-by: Max Reitz <mreitz@redhat.com>
 ---
  block.c                   | 35 +++++++++++++++++++++++++++++++++++
  block/file-posix.c        | 17 +++--------------
  block/file-win32.c        | 12 ++----------
  include/block/block_int.h |  3 +++
 files changed, 43 insertions(+), 24 deletions(-)
 diff --git a/block.c b/block.c
 index XXXXXXX..XXXXXXX 100644
---- a/block.c
+--- a/hw/block/virtio-blk.c
-+++ b/block.c
++++ b/hw/block/virtio-blk.c
-@@ -XXX,XX +XXX,XX @@ void path_combine(char *dest, int dest_size,
+@@ -XXX,XX +XXX,XX @@ validate_iothread_vq_mapping_list(IOThreadVirtQueueMappingList *list,
-     }
+  * Fill in the AioContext for each virtqueue in the @vq_aio_context array given
   * the iothread-vq-mapping parameter in @iothread_vq_mapping_list.
   *
 + * cleanup_iothread_vq_mapping() must be called to free IOThread object
 + * references after this function returns success.
 + *
   * Returns: %true on success, %false on failure.
   **/
  static bool apply_iothread_vq_mapping(
@@ -XXX,XX +XXX,XX @@ static bool apply_iothread_vq_mapping(
      return true;
  }
-+/*
++/**
-+ * Helper function for bdrv_parse_filename() implementations to remove optional
++ * cleanup_iothread_vq_mapping:
-+ * protocol prefixes (especially "file:") from a filename and for putting the
++ * @list: The mapping of virtqueues to IOThreads.
-+ * stripped filename into the options QDict if there is such a prefix.
++ *
 + * Release IOThread object references that were acquired by
 + * apply_iothread_vq_mapping().
 + */
-+void bdrv_parse_filename_strip_prefix(const char *filename, const char *prefix,
++static void cleanup_iothread_vq_mapping(IOThreadVirtQueueMappingList *list)
 +                                      QDict *options)
 +{
-+    if (strstart(filename, prefix, &filename)) {
++    IOThreadVirtQueueMappingList *node;
 +        /* Stripping the explicit protocol prefix may result in a protocol
 +         * prefix being (wrongly) detected (if the filename contains a colon) */
 +        if (path_has_protocol(filename)) {
 +            QString *fat_filename;
 +
-+            /* This means there is some colon before the first slash; therefore,
++    for (node = list; node; node = node->next) {
-+             * this cannot be an absolute path */
++        IOThread *iothread = iothread_by_id(node->value->iothread);
-+            assert(!path_is_absolute(filename));
++        object_unref(OBJECT(iothread));
 +
 +            /* And we can thus fix the protocol detection issue by prefixing it
 +             * by "./" */
 +            fat_filename = qstring_from_str("./");
 +            qstring_append(fat_filename, filename);
 +
 +            assert(!path_has_protocol(qstring_get_str(fat_filename)));
 +
 +            qdict_put(options, "filename", fat_filename);
 +        } else {
 +            /* If no protocol prefix was detected, we can use the shortened
 +             * filename as-is */
 +            qdict_put_str(options, "filename", filename);
 +        }
 +    }
 +}
 +
-+
+ /* Context: BQL held */
- /* Returns whether the image file is opened as read-only. Note that this can
+ static bool virtio_blk_vq_aio_context_init(VirtIOBlock *s, Error **errp)
   * return false and writing to the image file is still not possible because the
   * image is inactivated. */
 diff --git a/block/file-posix.c b/block/file-posix.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/file-posix.c
 +++ b/block/file-posix.c
@@ -XXX,XX +XXX,XX @@ static void raw_parse_flags(int bdrv_flags, int *open_flags)
  static void raw_parse_filename(const char *filename, QDict *options,
                                 Error **errp)
  {
--    /* The filename does not have to be prefixed by the protocol name, since
+@@ -XXX,XX +XXX,XX @@ static void virtio_blk_vq_aio_context_cleanup(VirtIOBlock *s)
--     * "file" is the default protocol; therefore, the return value of this
+     assert(!s->ioeventfd_started);
--     * function call can be ignored. */
--    strstart(filename, "file:", &filename);
+     if (conf->iothread_vq_mapping_list) {
 -        IOThreadVirtQueueMappingList *node;
 -
--    qdict_put_str(options, "filename", filename);
+-        for (node = conf->iothread_vq_mapping_list; node; node = node->next) {
-+    bdrv_parse_filename_strip_prefix(filename, "file:", options);
+-            IOThread *iothread = iothread_by_id(node->value->iothread);
- }
+-            object_unref(OBJECT(iothread));
+-        }
- static QemuOptsList raw_runtime_opts = {
++        cleanup_iothread_vq_mapping(conf->iothread_vq_mapping_list);
-@@ -XXX,XX +XXX,XX @@ static int check_hdev_writable(BDRVRawState *s)
+     }
- static void hdev_parse_filename(const char *filename, QDict *options,
-                                 Error **errp)
+     if (conf->iothread) {
  {
 -    /* The prefix is optional, just as for "file". */
 -    strstart(filename, "host_device:", &filename);
 -
 -    qdict_put_str(options, "filename", filename);
 +    bdrv_parse_filename_strip_prefix(filename, "host_device:", options);
  }
  static bool hdev_is_sg(BlockDriverState *bs)
@@ -XXX,XX +XXX,XX @@ static BlockDriver bdrv_host_device = {
  static void cdrom_parse_filename(const char *filename, QDict *options,
                                   Error **errp)
  {
 -    /* The prefix is optional, just as for "file". */
 -    strstart(filename, "host_cdrom:", &filename);
 -
 -    qdict_put_str(options, "filename", filename);
 +    bdrv_parse_filename_strip_prefix(filename, "host_cdrom:", options);
  }
  #endif
 diff --git a/block/file-win32.c b/block/file-win32.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/file-win32.c
 +++ b/block/file-win32.c
@@ -XXX,XX +XXX,XX @@ static void raw_parse_flags(int flags, bool use_aio, int *access_flags,
  static void raw_parse_filename(const char *filename, QDict *options,
                                 Error **errp)
  {
 -    /* The filename does not have to be prefixed by the protocol name, since
 -     * "file" is the default protocol; therefore, the return value of this
 -     * function call can be ignored. */
 -    strstart(filename, "file:", &filename);
 -
 -    qdict_put_str(options, "filename", filename);
 +    bdrv_parse_filename_strip_prefix(filename, "file:", options);
  }
  static QemuOptsList raw_runtime_opts = {
@@ -XXX,XX +XXX,XX @@ static int hdev_probe_device(const char *filename)
  static void hdev_parse_filename(const char *filename, QDict *options,
                                  Error **errp)
  {
 -    /* The prefix is optional, just as for "file". */
 -    strstart(filename, "host_device:", &filename);
 -
 -    qdict_put_str(options, "filename", filename);
 +    bdrv_parse_filename_strip_prefix(filename, "host_device:", options);
  }
  static int hdev_open(BlockDriverState *bs, QDict *options, int flags,
 diff --git a/include/block/block_int.h b/include/block/block_int.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/block/block_int.h
 +++ b/include/block/block_int.h
@@ -XXX,XX +XXX,XX @@ int get_tmp_filename(char *filename, int size);
  BlockDriver *bdrv_probe_all(const uint8_t *buf, int buf_size,
                              const char *filename);
 +void bdrv_parse_filename_strip_prefix(const char *filename, const char *prefix,
 +                                      QDict *options);
 +
  /**
   * bdrv_add_before_write_notifier:
 --
-.8.3.1
+.48.1

-[Qemu-devel] [PULL 10/15] qemu-img: introduce --target-image-opts for 'convert' command
+[PULL 18/22] virtio-blk: tidy up iothread_vq_mapping functions
-From: "Daniel P. Berrange" <berrange@redhat.com>
+From: Stefan Hajnoczi <stefanha@redhat.com>
-The '--image-opts' flag indicates whether the source filename
+Use noun_verb() function naming instead of verb_noun() because the
-includes options. The target filename has to remain in the
+former is the most common naming style for APIs. The next commit will
-plain filename format though, since it needs to be passed to
+move these functions into a header file so that virtio-scsi can call
-bdrv_create().  When using --skip-create though, it would be
+them.
 possible to use image-opts syntax. This adds --target-image-opts
 to indicate that the target filename includes options. Currently
 this mandates use of the --skip-create flag too.
-Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
+Shorten iothread_vq_mapping_apply()'s iothread_vq_mapping_list argument
-Message-id: 20170515164712.6643-4-berrange@redhat.com
+to just "list" like in the other functions.
-Reviewed-by: Max Reitz <mreitz@redhat.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Signed-off-by: Max Reitz <mreitz@redhat.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
 Message-ID: <20250311132616.1049687-10-stefanha@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
- qemu-img-cmds.hx |  4 +--
+ hw/block/virtio-blk.c | 33 ++++++++++++++++-----------------
- qemu-img.c       | 84 ++++++++++++++++++++++++++++++++++++++------------------
+file changed, 16 insertions(+), 17 deletions(-)
  qemu-img.texi    | 12 ++++++--
 files changed, 69 insertions(+), 31 deletions(-)
-diff --git a/qemu-img-cmds.hx b/qemu-img-cmds.hx
+diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
 index XXXXXXX..XXXXXXX 100644
---- a/qemu-img-cmds.hx
+--- a/hw/block/virtio-blk.c
-+++ b/qemu-img-cmds.hx
++++ b/hw/block/virtio-blk.c
-@@ -XXX,XX +XXX,XX @@ STEXI
+@@ -XXX,XX +XXX,XX @@ static const BlockDevOps virtio_block_ops = {
  ETEXI
  DEF("convert", img_convert,
 -    "convert [--object objectdef] [--image-opts] [-U] [-c] [-p] [-q] [-n] [-f fmt] [-t cache] [-T src_cache] [-O output_fmt] [-B backing_file] [-o options] [-s snapshot_id_or_name] [-l snapshot_param] [-S sparse_size] [-m num_coroutines] [-W] filename [filename2 [...]] output_filename")
 +    "convert [--object objectdef] [--image-opts] [--target-image-opts] [-U] [-c] [-p] [-q] [-n] [-f fmt] [-t cache] [-T src_cache] [-O output_fmt] [-B backing_file] [-o options] [-s snapshot_id_or_name] [-l snapshot_param] [-S sparse_size] [-m num_coroutines] [-W] filename [filename2 [...]] output_filename")
  STEXI
 -@item convert [--object @var{objectdef}] [--image-opts] [-U] [-c] [-p] [-q] [-n] [-f @var{fmt}] [-t @var{cache}] [-T @var{src_cache}] [-O @var{output_fmt}] [-B @var{backing_file}] [-o @var{options}] [-s @var{snapshot_id_or_name}] [-l @var{snapshot_param}] [-S @var{sparse_size}] [-m @var{num_coroutines}] [-W] @var{filename} [@var{filename2} [...]] @var{output_filename}
 +@item convert [--object @var{objectdef}] [--image-opts] [--target-image-opts] [-U] [-c] [-p] [-q] [-n] [-f @var{fmt}] [-t @var{cache}] [-T @var{src_cache}] [-O @var{output_fmt}] [-B @var{backing_file}] [-o @var{options}] [-s @var{snapshot_id_or_name}] [-l @var{snapshot_param}] [-S @var{sparse_size}] [-m @var{num_coroutines}] [-W] @var{filename} [@var{filename2} [...]] @var{output_filename}
  ETEXI
  DEF("dd", img_dd,
 diff --git a/qemu-img.c b/qemu-img.c
 index XXXXXXX..XXXXXXX 100644
 --- a/qemu-img.c
 +++ b/qemu-img.c
@@ -XXX,XX +XXX,XX @@ enum {
      OPTION_PATTERN = 260,
      OPTION_FLUSH_INTERVAL = 261,
      OPTION_NO_DRAIN = 262,
 +    OPTION_TARGET_IMAGE_OPTS = 263,
  };
- typedef enum OutputFormat {
+ static bool
-@@ -XXX,XX +XXX,XX @@ static int convert_do_copy(ImgConvertState *s)
+-validate_iothread_vq_mapping_list(IOThreadVirtQueueMappingList *list,
- static int img_convert(int argc, char **argv)
+-        uint16_t num_queues, Error **errp)
 +iothread_vq_mapping_validate(IOThreadVirtQueueMappingList *list, uint16_t
 +        num_queues, Error **errp)
  {
-     int c, bs_i, flags, src_flags = 0;
+     g_autofree unsigned long *vqs = bitmap_new(num_queues);
--    const char *fmt = NULL, *out_fmt = "raw", *cache = "unsafe",
+     g_autoptr(GHashTable) iothreads =
-+    const char *fmt = NULL, *out_fmt = NULL, *cache = "unsafe",
+@@ -XXX,XX +XXX,XX @@ validate_iothread_vq_mapping_list(IOThreadVirtQueueMappingList *list,
-                *src_cache = BDRV_DEFAULT_CACHE, *out_baseimg = NULL,
+ }
-                *out_filename, *out_baseimg_param, *snapshot_name = NULL;
--    BlockDriver *drv, *proto_drv;
+ /**
-+    BlockDriver *drv = NULL, *proto_drv = NULL;
+- * apply_iothread_vq_mapping:
-     BlockDriverInfo bdi;
+- * @iothread_vq_mapping_list: The mapping of virtqueues to IOThreads.
-     BlockDriverState *out_bs;
++ * iothread_vq_mapping_apply:
-     QemuOpts *opts = NULL, *sn_opts = NULL;
++ * @list: The mapping of virtqueues to IOThreads.
-@@ -XXX,XX +XXX,XX @@ static int img_convert(int argc, char **argv)
+  * @vq_aio_context: The array of AioContext pointers to fill in.
-     char *options = NULL;
+  * @num_queues: The length of @vq_aio_context.
-     Error *local_err = NULL;
+  * @errp: If an error occurs, a pointer to the area to store the error.
-     bool writethrough, src_writethrough, quiet = false, image_opts = false,
+  *
--         skip_create = false, progress = false;
+  * Fill in the AioContext for each virtqueue in the @vq_aio_context array given
-+         skip_create = false, progress = false, tgt_image_opts = false;
+- * the iothread-vq-mapping parameter in @iothread_vq_mapping_list.
-     int64_t ret = -EINVAL;
++ * the iothread-vq-mapping parameter in @list.
-     bool force_share = false;
+  *
+- * cleanup_iothread_vq_mapping() must be called to free IOThread object
-@@ -XXX,XX +XXX,XX @@ static int img_convert(int argc, char **argv)
++ * iothread_vq_mapping_cleanup() must be called to free IOThread object
-             {"object", required_argument, 0, OPTION_OBJECT},
+  * references after this function returns success.
-             {"image-opts", no_argument, 0, OPTION_IMAGE_OPTS},
+  *
-             {"force-share", no_argument, 0, 'U'},
+  * Returns: %true on success, %false on failure.
-+            {"target-image-opts", no_argument, 0, OPTION_TARGET_IMAGE_OPTS},
+  **/
-             {0, 0, 0, 0}
+-static bool apply_iothread_vq_mapping(
-         };
+-        IOThreadVirtQueueMappingList *iothread_vq_mapping_list,
-         c = getopt_long(argc, argv, ":hf:O:B:ce6o:s:l:S:pt:T:qnm:WU",
++static bool iothread_vq_mapping_apply(
-@@ -XXX,XX +XXX,XX @@ static int img_convert(int argc, char **argv)
++        IOThreadVirtQueueMappingList *list,
-         case OPTION_IMAGE_OPTS:
+         AioContext **vq_aio_context,
-             image_opts = true;
+         uint16_t num_queues,
-             break;
+         Error **errp)
-+        case OPTION_TARGET_IMAGE_OPTS:
+@@ -XXX,XX +XXX,XX @@ static bool apply_iothread_vq_mapping(
-+            tgt_image_opts = true;
+     size_t num_iothreads = 0;
-+            break;
+     size_t cur_iothread = 0;
-         }
 -    if (!validate_iothread_vq_mapping_list(iothread_vq_mapping_list,
 -                                           num_queues, errp)) {
 +    if (!iothread_vq_mapping_validate(list, num_queues, errp)) {
          return false;
      }
-+    if (!out_fmt && !tgt_image_opts) {
+-    for (node = iothread_vq_mapping_list; node; node = node->next) {
-+        out_fmt = "raw";
++    for (node = list; node; node = node->next) {
-+    }
+         num_iothreads++;
 +
      if (qemu_opts_foreach(&qemu_object_opts,
                            user_creatable_add_opts_foreach,
                            NULL, NULL)) {
@@ -XXX,XX +XXX,XX @@ static int img_convert(int argc, char **argv)
          goto fail_getopt;
      }
-+    if (tgt_image_opts && !skip_create) {
+-    for (node = iothread_vq_mapping_list; node; node = node->next) {
-+        error_report("--target-image-opts requires use of -n flag");
++    for (node = list; node; node = node->next) {
-+        goto fail_getopt;
+         IOThread *iothread = iothread_by_id(node->value->iothread);
-+    }
+         AioContext *ctx = iothread_get_aio_context(iothread);
-+
-     s.src_num = argc - optind - 1;
+@@ -XXX,XX +XXX,XX @@ static bool apply_iothread_vq_mapping(
-     out_filename = s.src_num >= 1 ? argv[argc - 1] : NULL;
+ }
-     if (options && has_help_option(options)) {
+ /**
--        ret = print_block_option_help(out_filename, out_fmt);
+- * cleanup_iothread_vq_mapping:
--        goto fail_getopt;
++ * iothread_vq_mapping_cleanup:
-+        if (out_fmt) {
+  * @list: The mapping of virtqueues to IOThreads.
-+            ret = print_block_option_help(out_filename, out_fmt);
+  *
-+            goto fail_getopt;
+  * Release IOThread object references that were acquired by
-+        } else {
+- * apply_iothread_vq_mapping().
-+            error_report("Option help requires a format be specified");
++ * iothread_vq_mapping_apply().
-+            goto fail_getopt;
+  */
-+        }
+-static void cleanup_iothread_vq_mapping(IOThreadVirtQueueMappingList *list)
 +static void iothread_vq_mapping_cleanup(IOThreadVirtQueueMappingList *list)
  {
      IOThreadVirtQueueMappingList *node;
@@ -XXX,XX +XXX,XX @@ static bool virtio_blk_vq_aio_context_init(VirtIOBlock *s, Error **errp)
      s->vq_aio_context = g_new(AioContext *, conf->num_queues);
      if (conf->iothread_vq_mapping_list) {
 -        if (!apply_iothread_vq_mapping(conf->iothread_vq_mapping_list,
 +        if (!iothread_vq_mapping_apply(conf->iothread_vq_mapping_list,
                                         s->vq_aio_context,
                                         conf->num_queues,
                                         errp)) {
@@ -XXX,XX +XXX,XX @@ static void virtio_blk_vq_aio_context_cleanup(VirtIOBlock *s)
      assert(!s->ioeventfd_started);
      if (conf->iothread_vq_mapping_list) {
 -        cleanup_iothread_vq_mapping(conf->iothread_vq_mapping_list);
 +        iothread_vq_mapping_cleanup(conf->iothread_vq_mapping_list);
      }
-     if (s.src_num < 1) {
+     if (conf->iothread) {
@@ -XXX,XX +XXX,XX @@ static int img_convert(int argc, char **argv)
          goto out;
      }
 -    /* Find driver and parse its options */
 -    drv = bdrv_find_format(out_fmt);
 -    if (!drv) {
 -        error_report("Unknown file format '%s'", out_fmt);
 -        ret = -1;
 -        goto out;
 -    }
 +    if (!skip_create) {
 +        /* Find driver and parse its options */
 +        drv = bdrv_find_format(out_fmt);
 +        if (!drv) {
 +            error_report("Unknown file format '%s'", out_fmt);
 +            ret = -1;
 +            goto out;
 +        }
 -    proto_drv = bdrv_find_protocol(out_filename, true, &local_err);
 -    if (!proto_drv) {
 -        error_report_err(local_err);
 -        ret = -1;
 -        goto out;
 -    }
 +        proto_drv = bdrv_find_protocol(out_filename, true, &local_err);
 +        if (!proto_drv) {
 +            error_report_err(local_err);
 +            ret = -1;
 +            goto out;
 +        }
 -    if (!skip_create) {
          if (!drv->create_opts) {
              error_report("Format driver '%s' does not support image creation",
                           drv->format_name);
@@ -XXX,XX +XXX,XX @@ static int img_convert(int argc, char **argv)
          const char *preallocation =
              qemu_opt_get(opts, BLOCK_OPT_PREALLOC);
 -        if (!drv->bdrv_co_pwritev_compressed) {
 +        if (drv && !drv->bdrv_co_pwritev_compressed) {
              error_report("Compression not supported for this file format");
              ret = -1;
              goto out;
@@ -XXX,XX +XXX,XX @@ static int img_convert(int argc, char **argv)
          goto out;
      }
 -    /* XXX we should allow --image-opts to trigger use of
 -     * img_open() here, but then we have trouble with
 -     * the bdrv_create() call which takes different params.
 -     * Not critical right now, so fix can wait...
 -     */
 -    s.target = img_open_file(out_filename, out_fmt, flags, writethrough, quiet,
 -                             false);
 +    if (skip_create) {
 +        s.target = img_open(tgt_image_opts, out_filename, out_fmt,
 +                            flags, writethrough, quiet, false);
 +    } else {
 +        /* TODO ultimately we should allow --target-image-opts
 +         * to be used even when -n is not given.
 +         * That has to wait for bdrv_create to be improved
 +         * to allow filenames in option syntax
 +         */
 +        s.target = img_open_file(out_filename, out_fmt, flags,
 +                                 writethrough, quiet, false);
 +    }
      if (!s.target) {
          ret = -1;
          goto out;
      }
      out_bs = blk_bs(s.target);
 +    if (s.compressed && !out_bs->drv->bdrv_co_pwritev_compressed) {
 +        error_report("Compression not supported for this file format");
 +        ret = -1;
 +        goto out;
 +    }
 +
      /* increase bufsectors from the default 4096 (2M) if opt_transfer
       * or discard_alignment of the out_bs is greater. Limit to 32768 (16MB)
       * as maximum. */
 diff --git a/qemu-img.texi b/qemu-img.texi
 index XXXXXXX..XXXXXXX 100644
 --- a/qemu-img.texi
 +++ b/qemu-img.texi
@@ -XXX,XX +XXX,XX @@ keys.
  @item --image-opts
 -Indicates that the @var{filename} parameter is to be interpreted as a
 +Indicates that the source @var{filename} parameter is to be interpreted as a
  full option string, not a plain filename. This parameter is mutually
 -exclusive with the @var{-f} and @var{-F} parameters.
 +exclusive with the @var{-f} parameter.
 +
 +@item --target-image-opts
 +
 +Indicates that the @var{output_filename} parameter(s) are to be interpreted as
 +a full option string, not a plain filename. This parameter is mutually
 +exclusive with the @var{-O} parameters. It is currently required to also use
 +the @var{-n} parameter to skip image creation. This restriction may be relaxed
 +in a future release.
  @item fmt
  is the disk image format. It is guessed automatically in most cases. See below
 --
-.8.3.1
+.48.1

-[Qemu-devel] [PULL 11/15] qemu-img: copy *key-secret opts when opening newly created files
+[PULL 19/22] virtio: extract iothread-vq-mapping.h API
-From: "Daniel P. Berrange" <berrange@redhat.com>
+From: Stefan Hajnoczi <stefanha@redhat.com>
-The qemu-img dd/convert commands will create an image file and
+The code that builds an array of AioContext pointers indexed by the
-then try to open it. Historically it has been possible to open
+virtqueue is not specific to virtio-blk. virtio-scsi will need to do the
-new files without passing any options. With encrypted files
+same thing, so extract the functions.
 though, the *key-secret options are mandatory, so we need to
 provide those options when opening the newly created file.
-Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20170515164712.6643-5-berrange@redhat.com
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Reviewed-by: Max Reitz <mreitz@redhat.com>
+Message-ID: <20250311132616.1049687-11-stefanha@redhat.com>
-Signed-off-by: Max Reitz <mreitz@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
- qemu-img.c | 42 +++++++++++++++++++++++++++++++++++++-----
+ include/hw/virtio/iothread-vq-mapping.h |  45 ++++++++
-file changed, 37 insertions(+), 5 deletions(-)
+ hw/block/virtio-blk.c                   | 142 +-----------------------
  hw/virtio/iothread-vq-mapping.c         | 131 ++++++++++++++++++++++
  hw/virtio/meson.build                   |   1 +
 files changed, 178 insertions(+), 141 deletions(-)
  create mode 100644 include/hw/virtio/iothread-vq-mapping.h
  create mode 100644 hw/virtio/iothread-vq-mapping.c
-diff --git a/qemu-img.c b/qemu-img.c
+diff --git a/include/hw/virtio/iothread-vq-mapping.h b/include/hw/virtio/iothread-vq-mapping.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/include/hw/virtio/iothread-vq-mapping.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * IOThread Virtqueue Mapping
 + *
 + * Copyright Red Hat, Inc
 + *
 + * SPDX-License-Identifier: GPL-2.0-only
 + */
 +
 +#ifndef HW_VIRTIO_IOTHREAD_VQ_MAPPING_H
 +#define HW_VIRTIO_IOTHREAD_VQ_MAPPING_H
 +
 +#include "qapi/error.h"
 +#include "qapi/qapi-types-virtio.h"
 +
 +/**
 + * iothread_vq_mapping_apply:
 + * @list: The mapping of virtqueues to IOThreads.
 + * @vq_aio_context: The array of AioContext pointers to fill in.
 + * @num_queues: The length of @vq_aio_context.
 + * @errp: If an error occurs, a pointer to the area to store the error.
 + *
 + * Fill in the AioContext for each virtqueue in the @vq_aio_context array given
 + * the iothread-vq-mapping parameter in @list.
 + *
 + * iothread_vq_mapping_cleanup() must be called to free IOThread object
 + * references after this function returns success.
 + *
 + * Returns: %true on success, %false on failure.
 + **/
 +bool iothread_vq_mapping_apply(
 +        IOThreadVirtQueueMappingList *list,
 +        AioContext **vq_aio_context,
 +        uint16_t num_queues,
 +        Error **errp);
 +
 +/**
 + * iothread_vq_mapping_cleanup:
 + * @list: The mapping of virtqueues to IOThreads.
 + *
 + * Release IOThread object references that were acquired by
 + * iothread_vq_mapping_apply().
 + */
 +void iothread_vq_mapping_cleanup(IOThreadVirtQueueMappingList *list);
 +
 +#endif /* HW_VIRTIO_IOTHREAD_VQ_MAPPING_H */
 diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
 index XXXXXXX..XXXXXXX 100644
---- a/qemu-img.c
+--- a/hw/block/virtio-blk.c
-+++ b/qemu-img.c
++++ b/hw/block/virtio-blk.c
-@@ -XXX,XX +XXX,XX @@ static BlockBackend *img_open_opts(const char *optstr,
+@@ -XXX,XX +XXX,XX @@
- }
+ #endif
+ #include "hw/virtio/virtio-bus.h"
- static BlockBackend *img_open_file(const char *filename,
+ #include "migration/qemu-file-types.h"
-+                                   QDict *options,
++#include "hw/virtio/iothread-vq-mapping.h"
-                                    const char *fmt, int flags,
+ #include "hw/virtio/virtio-access.h"
-                                    bool writethrough, bool quiet,
+ #include "hw/virtio/virtio-blk-common.h"
-                                    bool force_share)
+ #include "qemu/coroutine.h"
@@ -XXX,XX +XXX,XX @@ static const BlockDevOps virtio_block_ops = {
      .drained_end   = virtio_blk_drained_end,
  };
 -static bool
 -iothread_vq_mapping_validate(IOThreadVirtQueueMappingList *list, uint16_t
 -        num_queues, Error **errp)
 -{
 -    g_autofree unsigned long *vqs = bitmap_new(num_queues);
 -    g_autoptr(GHashTable) iothreads =
 -        g_hash_table_new(g_str_hash, g_str_equal);
 -
 -    for (IOThreadVirtQueueMappingList *node = list; node; node = node->next) {
 -        const char *name = node->value->iothread;
 -        uint16List *vq;
 -
 -        if (!iothread_by_id(name)) {
 -            error_setg(errp, "IOThread \"%s\" object does not exist", name);
 -            return false;
 -        }
 -
 -        if (!g_hash_table_add(iothreads, (gpointer)name)) {
 -            error_setg(errp,
 -                    "duplicate IOThread name \"%s\" in iothread-vq-mapping",
 -                    name);
 -            return false;
 -        }
 -
 -        if (node != list) {
 -            if (!!node->value->vqs != !!list->value->vqs) {
 -                error_setg(errp, "either all items in iothread-vq-mapping "
 -                                 "must have vqs or none of them must have it");
 -                return false;
 -            }
 -        }
 -
 -        for (vq = node->value->vqs; vq; vq = vq->next) {
 -            if (vq->value >= num_queues) {
 -                error_setg(errp, "vq index %u for IOThread \"%s\" must be "
 -                        "less than num_queues %u in iothread-vq-mapping",
 -                        vq->value, name, num_queues);
 -                return false;
 -            }
 -
 -            if (test_and_set_bit(vq->value, vqs)) {
 -                error_setg(errp, "cannot assign vq %u to IOThread \"%s\" "
 -                        "because it is already assigned", vq->value, name);
 -                return false;
 -            }
 -        }
 -    }
 -
 -    if (list->value->vqs) {
 -        for (uint16_t i = 0; i < num_queues; i++) {
 -            if (!test_bit(i, vqs)) {
 -                error_setg(errp,
 -                        "missing vq %u IOThread assignment in iothread-vq-mapping",
 -                        i);
 -                return false;
 -            }
 -        }
 -    }
 -
 -    return true;
 -}
 -
 -/**
 - * iothread_vq_mapping_apply:
 - * @list: The mapping of virtqueues to IOThreads.
 - * @vq_aio_context: The array of AioContext pointers to fill in.
 - * @num_queues: The length of @vq_aio_context.
 - * @errp: If an error occurs, a pointer to the area to store the error.
 - *
 - * Fill in the AioContext for each virtqueue in the @vq_aio_context array given
 - * the iothread-vq-mapping parameter in @list.
 - *
 - * iothread_vq_mapping_cleanup() must be called to free IOThread object
 - * references after this function returns success.
 - *
 - * Returns: %true on success, %false on failure.
 - **/
 -static bool iothread_vq_mapping_apply(
 -        IOThreadVirtQueueMappingList *list,
 -        AioContext **vq_aio_context,
 -        uint16_t num_queues,
 -        Error **errp)
 -{
 -    IOThreadVirtQueueMappingList *node;
 -    size_t num_iothreads = 0;
 -    size_t cur_iothread = 0;
 -
 -    if (!iothread_vq_mapping_validate(list, num_queues, errp)) {
 -        return false;
 -    }
 -
 -    for (node = list; node; node = node->next) {
 -        num_iothreads++;
 -    }
 -
 -    for (node = list; node; node = node->next) {
 -        IOThread *iothread = iothread_by_id(node->value->iothread);
 -        AioContext *ctx = iothread_get_aio_context(iothread);
 -
 -        /* Released in virtio_blk_vq_aio_context_cleanup() */
 -        object_ref(OBJECT(iothread));
 -
 -        if (node->value->vqs) {
 -            uint16List *vq;
 -
 -            /* Explicit vq:IOThread assignment */
 -            for (vq = node->value->vqs; vq; vq = vq->next) {
 -                assert(vq->value < num_queues);
 -                vq_aio_context[vq->value] = ctx;
 -            }
 -        } else {
 -            /* Round-robin vq:IOThread assignment */
 -            for (unsigned i = cur_iothread; i < num_queues;
 -                 i += num_iothreads) {
 -                vq_aio_context[i] = ctx;
 -            }
 -        }
 -
 -        cur_iothread++;
 -    }
 -
 -    return true;
 -}
 -
 -/**
 - * iothread_vq_mapping_cleanup:
 - * @list: The mapping of virtqueues to IOThreads.
 - *
 - * Release IOThread object references that were acquired by
 - * iothread_vq_mapping_apply().
 - */
 -static void iothread_vq_mapping_cleanup(IOThreadVirtQueueMappingList *list)
 -{
 -    IOThreadVirtQueueMappingList *node;
 -
 -    for (node = list; node; node = node->next) {
 -        IOThread *iothread = iothread_by_id(node->value->iothread);
 -        object_unref(OBJECT(iothread));
 -    }
 -}
 -
  /* Context: BQL held */
  static bool virtio_blk_vq_aio_context_init(VirtIOBlock *s, Error **errp)
  {
-     BlockBackend *blk;
+diff --git a/hw/virtio/iothread-vq-mapping.c b/hw/virtio/iothread-vq-mapping.c
-     Error *local_err = NULL;
+new file mode 100644
--    QDict *options = qdict_new();
+index XXXXXXX..XXXXXXX
+--- /dev/null
-+    if (!options) {
++++ b/hw/virtio/iothread-vq-mapping.c
-+        options = qdict_new();
+@@ -XXX,XX +XXX,XX @@
-+    }
++/*
-     if (fmt) {
++ * IOThread Virtqueue Mapping
-         qdict_put_str(options, "driver", fmt);
++ *
-     }
++ * Copyright Red Hat, Inc
-@@ -XXX,XX +XXX,XX @@ static BlockBackend *img_open_file(const char *filename,
++ *
- }
++ * SPDX-License-Identifier: GPL-2.0-only
++ */
++
-+static int img_add_key_secrets(void *opaque,
++#include "qemu/osdep.h"
-+                               const char *name, const char *value,
++#include "system/iothread.h"
-+                               Error **errp)
++#include "hw/virtio/iothread-vq-mapping.h"
 +
 +static bool
 +iothread_vq_mapping_validate(IOThreadVirtQueueMappingList *list, uint16_t
 +        num_queues, Error **errp)
 +{
-+    QDict *options = opaque;
++    g_autofree unsigned long *vqs = bitmap_new(num_queues);
-+
++    g_autoptr(GHashTable) iothreads =
-+    if (g_str_has_suffix(name, "key-secret")) {
++        g_hash_table_new(g_str_hash, g_str_equal);
-+        qdict_put(options, name, qstring_from_str(value));
++
-+    }
++    for (IOThreadVirtQueueMappingList *node = list; node; node = node->next) {
-+
++        const char *name = node->value->iothread;
-+    return 0;
++        uint16List *vq;
 +
 +        if (!iothread_by_id(name)) {
 +            error_setg(errp, "IOThread \"%s\" object does not exist", name);
 +            return false;
 +        }
 +
 +        if (!g_hash_table_add(iothreads, (gpointer)name)) {
 +            error_setg(errp,
 +                    "duplicate IOThread name \"%s\" in iothread-vq-mapping",
 +                    name);
 +            return false;
 +        }
 +
 +        if (node != list) {
 +            if (!!node->value->vqs != !!list->value->vqs) {
 +                error_setg(errp, "either all items in iothread-vq-mapping "
 +                                 "must have vqs or none of them must have it");
 +                return false;
 +            }
 +        }
 +
 +        for (vq = node->value->vqs; vq; vq = vq->next) {
 +            if (vq->value >= num_queues) {
 +                error_setg(errp, "vq index %u for IOThread \"%s\" must be "
 +                        "less than num_queues %u in iothread-vq-mapping",
 +                        vq->value, name, num_queues);
 +                return false;
 +            }
 +
 +            if (test_and_set_bit(vq->value, vqs)) {
 +                error_setg(errp, "cannot assign vq %u to IOThread \"%s\" "
 +                        "because it is already assigned", vq->value, name);
 +                return false;
 +            }
 +        }
 +    }
 +
 +    if (list->value->vqs) {
 +        for (uint16_t i = 0; i < num_queues; i++) {
 +            if (!test_bit(i, vqs)) {
 +                error_setg(errp,
 +                        "missing vq %u IOThread assignment in iothread-vq-mapping",
 +                        i);
 +                return false;
 +            }
 +        }
 +    }
 +
 +    return true;
 +}
 +
-+static BlockBackend *img_open_new_file(const char *filename,
++bool iothread_vq_mapping_apply(
-+                                       QemuOpts *create_opts,
++        IOThreadVirtQueueMappingList *list,
-+                                       const char *fmt, int flags,
++        AioContext **vq_aio_context,
-+                                       bool writethrough, bool quiet,
++        uint16_t num_queues,
-+                                       bool force_share)
++        Error **errp)
 +{
-+    QDict *options = NULL;
++    IOThreadVirtQueueMappingList *node;
-+
++    size_t num_iothreads = 0;
-+    options = qdict_new();
++    size_t cur_iothread = 0;
-+    qemu_opt_foreach(create_opts, img_add_key_secrets, options, &error_abort);
++
-+
++    if (!iothread_vq_mapping_validate(list, num_queues, errp)) {
-+    return img_open_file(filename, options, fmt, flags, writethrough, quiet,
++        return false;
-+                         force_share);
++    }
 +
 +    for (node = list; node; node = node->next) {
 +        num_iothreads++;
 +    }
 +
 +    for (node = list; node; node = node->next) {
 +        IOThread *iothread = iothread_by_id(node->value->iothread);
 +        AioContext *ctx = iothread_get_aio_context(iothread);
 +
 +        /* Released in virtio_blk_vq_aio_context_cleanup() */
 +        object_ref(OBJECT(iothread));
 +
 +        if (node->value->vqs) {
 +            uint16List *vq;
 +
 +            /* Explicit vq:IOThread assignment */
 +            for (vq = node->value->vqs; vq; vq = vq->next) {
 +                assert(vq->value < num_queues);
 +                vq_aio_context[vq->value] = ctx;
 +            }
 +        } else {
 +            /* Round-robin vq:IOThread assignment */
 +            for (unsigned i = cur_iothread; i < num_queues;
 +                 i += num_iothreads) {
 +                vq_aio_context[i] = ctx;
 +            }
 +        }
 +
 +        cur_iothread++;
 +    }
 +
 +    return true;
 +}
 +
-+
++void iothread_vq_mapping_cleanup(IOThreadVirtQueueMappingList *list)
- static BlockBackend *img_open(bool image_opts,
++{
-                               const char *filename,
++    IOThreadVirtQueueMappingList *node;
-                               const char *fmt, int flags, bool writethrough,
++
-@@ -XXX,XX +XXX,XX @@ static BlockBackend *img_open(bool image_opts,
++    for (node = list; node; node = node->next) {
-         blk = img_open_opts(filename, opts, flags, writethrough, quiet,
++        IOThread *iothread = iothread_by_id(node->value->iothread);
-                             force_share);
++        object_unref(OBJECT(iothread));
-     } else {
++    }
--        blk = img_open_file(filename, fmt, flags, writethrough, quiet,
++}
-+        blk = img_open_file(filename, NULL, fmt, flags, writethrough, quiet,
++
-                             force_share);
+diff --git a/hw/virtio/meson.build b/hw/virtio/meson.build
-     }
+index XXXXXXX..XXXXXXX 100644
-     return blk;
+--- a/hw/virtio/meson.build
-@@ -XXX,XX +XXX,XX @@ static int img_convert(int argc, char **argv)
++++ b/hw/virtio/meson.build
-          * That has to wait for bdrv_create to be improved
+@@ -XXX,XX +XXX,XX @@
-          * to allow filenames in option syntax
+ system_virtio_ss = ss.source_set()
-          */
+ system_virtio_ss.add(files('virtio-bus.c'))
--        s.target = img_open_file(out_filename, out_fmt, flags,
++system_virtio_ss.add(files('iothread-vq-mapping.c'))
--                                 writethrough, quiet, false);
+ system_virtio_ss.add(when: 'CONFIG_VIRTIO_PCI', if_true: files('virtio-pci.c'))
-+        s.target = img_open_new_file(out_filename, opts, out_fmt,
+ system_virtio_ss.add(when: 'CONFIG_VIRTIO_MMIO', if_true: files('virtio-mmio.c'))
-+                                     flags, writethrough, quiet, false);
+ system_virtio_ss.add(when: 'CONFIG_VIRTIO_CRYPTO', if_true: files('virtio-crypto.c'))
      }
      if (!s.target) {
          ret = -1;
@@ -XXX,XX +XXX,XX @@ static int img_dd(int argc, char **argv)
       * with the bdrv_create() call above which does not
       * support image-opts style.
       */
 -    blk2 = img_open_file(out.filename, out_fmt, BDRV_O_RDWR,
 +    blk2 = img_open_file(out.filename, NULL, out_fmt, BDRV_O_RDWR,
                           false, false, false);
      if (!blk2) {
 --
-.8.3.1
+.48.1

-New patch
+[PULL 20/22] virtio-scsi: add iothread-vq-mapping parameter
+From: Stefan Hajnoczi <stefanha@redhat.com>
+Allow virtio-scsi virtqueues to be assigned to different IOThreads. This
+makes it possible to take advantage of host multi-queue block layer
+scalability by assigning virtqueues that have affinity with vCPUs to
+different IOThreads that have affinity with host CPUs. The same feature
+was introduced for virtio-blk in the past:
+https://developers.redhat.com/articles/2024/09/05/scaling-virtio-blk-disk-io-iothread-virtqueue-mapping
+Here are fio randread 4k iodepth=64 results from a 4 vCPU guest with an
+Intel P4800X SSD:
+iothreads IOPS
+------------------------------
+189576
+312698
+346744
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Message-ID: <20250311132616.1049687-12-stefanha@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ include/hw/virtio/virtio-scsi.h |  5 +-
+ hw/scsi/virtio-scsi-dataplane.c | 90 ++++++++++++++++++++++++---------
+ hw/scsi/virtio-scsi.c           | 63 ++++++++++++++---------
+files changed, 107 insertions(+), 51 deletions(-)
+diff --git a/include/hw/virtio/virtio-scsi.h b/include/hw/virtio/virtio-scsi.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/virtio/virtio-scsi.h
++++ b/include/hw/virtio/virtio-scsi.h
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/virtio/virtio.h"
+ #include "hw/scsi/scsi.h"
+ #include "chardev/char-fe.h"
++#include "qapi/qapi-types-virtio.h"
+ #include "system/iothread.h"
+ #define TYPE_VIRTIO_SCSI_COMMON "virtio-scsi-common"
+@@ -XXX,XX +XXX,XX @@ struct VirtIOSCSIConf {
+     CharBackend chardev;
+     uint32_t boot_tpgt;
+     IOThread *iothread;
++    IOThreadVirtQueueMappingList *iothread_vq_mapping_list;
+ };
+ struct VirtIOSCSI;
+@@ -XXX,XX +XXX,XX @@ struct VirtIOSCSI {
+     QTAILQ_HEAD(, VirtIOSCSIReq) tmf_bh_list;
+     /* Fields for dataplane below */
+-    AioContext *ctx; /* one iothread per virtio-scsi-pci for now */
++    AioContext **vq_aio_context; /* per-virtqueue AioContext pointer */
+     bool dataplane_started;
+     bool dataplane_starting;
+@@ -XXX,XX +XXX,XX @@ void virtio_scsi_common_realize(DeviceState *dev,
+ void virtio_scsi_common_unrealize(DeviceState *dev);
+ void virtio_scsi_dataplane_setup(VirtIOSCSI *s, Error **errp);
++void virtio_scsi_dataplane_cleanup(VirtIOSCSI *s);
+ int virtio_scsi_dataplane_start(VirtIODevice *s);
+ void virtio_scsi_dataplane_stop(VirtIODevice *s);
+diff --git a/hw/scsi/virtio-scsi-dataplane.c b/hw/scsi/virtio-scsi-dataplane.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/scsi/virtio-scsi-dataplane.c
++++ b/hw/scsi/virtio-scsi-dataplane.c
+@@ -XXX,XX +XXX,XX @@
+ #include "system/block-backend.h"
+ #include "hw/scsi/scsi.h"
+ #include "scsi/constants.h"
++#include "hw/virtio/iothread-vq-mapping.h"
+ #include "hw/virtio/virtio-bus.h"
+ /* Context: BQL held */
+@@ -XXX,XX +XXX,XX @@ void virtio_scsi_dataplane_setup(VirtIOSCSI *s, Error **errp)
+     VirtIODevice *vdev = VIRTIO_DEVICE(s);
+     BusState *qbus = qdev_get_parent_bus(DEVICE(vdev));
+     VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(qbus);
++    uint16_t num_vqs = vs->conf.num_queues + VIRTIO_SCSI_VQ_NUM_FIXED;
+-    if (vs->conf.iothread) {
++    if (vs->conf.iothread && vs->conf.iothread_vq_mapping_list) {
++        error_setg(errp,
++                   "iothread and iothread-vq-mapping properties cannot be set "
++                   "at the same time");
++        return;
++    }
++
++    if (vs->conf.iothread || vs->conf.iothread_vq_mapping_list) {
+         if (!k->set_guest_notifiers || !k->ioeventfd_assign) {
+             error_setg(errp,
+                        "device is incompatible with iothread "
+@@ -XXX,XX +XXX,XX @@ void virtio_scsi_dataplane_setup(VirtIOSCSI *s, Error **errp)
+             error_setg(errp, "ioeventfd is required for iothread");
+             return;
+         }
+-        s->ctx = iothread_get_aio_context(vs->conf.iothread);
+-    } else {
+-        if (!virtio_device_ioeventfd_enabled(vdev)) {
++    }
++
++    s->vq_aio_context = g_new(AioContext *, num_vqs);
++
++    if (vs->conf.iothread_vq_mapping_list) {
++        if (!iothread_vq_mapping_apply(vs->conf.iothread_vq_mapping_list,
++                                       s->vq_aio_context, num_vqs, errp)) {
++            g_free(s->vq_aio_context);
++            s->vq_aio_context = NULL;
+             return;
+         }
+-        s->ctx = qemu_get_aio_context();
++    } else if (vs->conf.iothread) {
++        AioContext *ctx = iothread_get_aio_context(vs->conf.iothread);
++        for (uint16_t i = 0; i < num_vqs; i++) {
++            s->vq_aio_context[i] = ctx;
++        }
++
++        /* Released in virtio_scsi_dataplane_cleanup() */
++        object_ref(OBJECT(vs->conf.iothread));
++    } else {
++        AioContext *ctx = qemu_get_aio_context();
++        for (unsigned i = 0; i < num_vqs; i++) {
++            s->vq_aio_context[i] = ctx;
++        }
++    }
++}
++
++/* Context: BQL held */
++void virtio_scsi_dataplane_cleanup(VirtIOSCSI *s)
++{
++    VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(s);
++
++    if (vs->conf.iothread_vq_mapping_list) {
++        iothread_vq_mapping_cleanup(vs->conf.iothread_vq_mapping_list);
+     }
++
++    if (vs->conf.iothread) {
++        object_unref(OBJECT(vs->conf.iothread));
++    }
++
++    g_free(s->vq_aio_context);
++    s->vq_aio_context = NULL;
+ }
+ static int virtio_scsi_set_host_notifier(VirtIOSCSI *s, VirtQueue *vq, int n)
+@@ -XXX,XX +XXX,XX @@ static int virtio_scsi_set_host_notifier(VirtIOSCSI *s, VirtQueue *vq, int n)
+ }
+ /* Context: BH in IOThread */
+-static void virtio_scsi_dataplane_stop_bh(void *opaque)
++static void virtio_scsi_dataplane_stop_vq_bh(void *opaque)
+ {
+-    VirtIOSCSI *s = opaque;
+-    VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(s);
++    AioContext *ctx = qemu_get_current_aio_context();
++    VirtQueue *vq = opaque;
+     EventNotifier *host_notifier;
+-    int i;
+-    virtio_queue_aio_detach_host_notifier(vs->ctrl_vq, s->ctx);
+-    host_notifier = virtio_queue_get_host_notifier(vs->ctrl_vq);
++    virtio_queue_aio_detach_host_notifier(vq, ctx);
++    host_notifier = virtio_queue_get_host_notifier(vq);
+     /*
+      * Test and clear notifier after disabling event, in case poll callback
+      * didn't have time to run.
+      */
+     virtio_queue_host_notifier_read(host_notifier);
+-
+-    virtio_queue_aio_detach_host_notifier(vs->event_vq, s->ctx);
+-    host_notifier = virtio_queue_get_host_notifier(vs->event_vq);
+-    virtio_queue_host_notifier_read(host_notifier);
+-
+-    for (i = 0; i < vs->conf.num_queues; i++) {
+-        virtio_queue_aio_detach_host_notifier(vs->cmd_vqs[i], s->ctx);
+-        host_notifier = virtio_queue_get_host_notifier(vs->cmd_vqs[i]);
+-        virtio_queue_host_notifier_read(host_notifier);
+-    }
+ }
+ /* Context: BQL held */
+@@ -XXX,XX +XXX,XX @@ int virtio_scsi_dataplane_start(VirtIODevice *vdev)
+     smp_wmb(); /* paired with aio_notify_accept() */
+     if (s->bus.drain_count == 0) {
+-        virtio_queue_aio_attach_host_notifier(vs->ctrl_vq, s->ctx);
+-        virtio_queue_aio_attach_host_notifier_no_poll(vs->event_vq, s->ctx);
++        virtio_queue_aio_attach_host_notifier(vs->ctrl_vq,
++                                              s->vq_aio_context[0]);
++        virtio_queue_aio_attach_host_notifier_no_poll(vs->event_vq,
++                                                      s->vq_aio_context[1]);
+         for (i = 0; i < vs->conf.num_queues; i++) {
+-            virtio_queue_aio_attach_host_notifier(vs->cmd_vqs[i], s->ctx);
++            AioContext *ctx = s->vq_aio_context[VIRTIO_SCSI_VQ_NUM_FIXED + i];
++            virtio_queue_aio_attach_host_notifier(vs->cmd_vqs[i], ctx);
+         }
+     }
+     return 0;
+@@ -XXX,XX +XXX,XX @@ void virtio_scsi_dataplane_stop(VirtIODevice *vdev)
+     s->dataplane_stopping = true;
+     if (s->bus.drain_count == 0) {
+-        aio_wait_bh_oneshot(s->ctx, virtio_scsi_dataplane_stop_bh, s);
++        for (i = 0; i < vs->conf.num_queues + VIRTIO_SCSI_VQ_NUM_FIXED; i++) {
++            VirtQueue *vq = virtio_get_queue(&vs->parent_obj, i);
++            AioContext *ctx = s->vq_aio_context[i];
++            aio_wait_bh_oneshot(ctx, virtio_scsi_dataplane_stop_vq_bh, vq);
++        }
+     }
+     blk_drain_all(); /* ensure there are no in-flight requests */
+diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/scsi/virtio-scsi.c
++++ b/hw/scsi/virtio-scsi.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/qdev-properties.h"
+ #include "hw/scsi/scsi.h"
+ #include "scsi/constants.h"
++#include "hw/virtio/iothread-vq-mapping.h"
+ #include "hw/virtio/virtio-bus.h"
+ #include "hw/virtio/virtio-access.h"
+ #include "trace.h"
+@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_cancel_notify(Notifier *notifier, void *data)
+     g_free(n);
+ }
+-static inline void virtio_scsi_ctx_check(VirtIOSCSI *s, SCSIDevice *d)
+-{
+-    if (s->dataplane_started && d && blk_is_available(d->conf.blk)) {
+-        assert(blk_get_aio_context(d->conf.blk) == s->ctx);
+-    }
+-}
+-
+ static void virtio_scsi_do_one_tmf_bh(VirtIOSCSIReq *req)
+ {
+     VirtIOSCSI *s = req->dev;
+@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_flush_defer_tmf_to_aio_context(VirtIOSCSI *s)
+     assert(!s->dataplane_started);
+-    if (s->ctx) {
++    for (uint32_t i = 0; i < s->parent_obj.conf.num_queues; i++) {
++        AioContext *ctx = s->vq_aio_context[VIRTIO_SCSI_VQ_NUM_FIXED + i];
++
+         /* Our BH only runs after previously scheduled BHs */
+-        aio_wait_bh_oneshot(s->ctx, dummy_bh, NULL);
++        aio_wait_bh_oneshot(ctx, dummy_bh, NULL);
+     }
+ }
+@@ -XXX,XX +XXX,XX @@ static int virtio_scsi_do_tmf(VirtIOSCSI *s, VirtIOSCSIReq *req)
+     AioContext *ctx;
+     int ret = 0;
+-    virtio_scsi_ctx_check(s, d);
+     /* Here VIRTIO_SCSI_S_OK means "FUNCTION COMPLETE".  */
+     req->resp.tmf.response = VIRTIO_SCSI_S_OK;
+@@ -XXX,XX +XXX,XX @@ static int virtio_scsi_do_tmf(VirtIOSCSI *s, VirtIOSCSIReq *req)
+     case VIRTIO_SCSI_T_TMF_ABORT_TASK_SET:
+     case VIRTIO_SCSI_T_TMF_CLEAR_TASK_SET: {
++        g_autoptr(GHashTable) aio_contexts = g_hash_table_new(NULL, NULL);
++
+         if (!d) {
+             goto fail;
+         }
+@@ -XXX,XX +XXX,XX @@ static int virtio_scsi_do_tmf(VirtIOSCSI *s, VirtIOSCSIReq *req)
+         qatomic_inc(&req->remaining);
+-        ctx = s->ctx ?: qemu_get_aio_context();
+-        virtio_scsi_defer_tmf_to_aio_context(req, ctx);
++        for (uint32_t i = 0; i < s->parent_obj.conf.num_queues; i++) {
++            ctx = s->vq_aio_context[VIRTIO_SCSI_VQ_NUM_FIXED + i];
++
++            if (!g_hash_table_add(aio_contexts, ctx)) {
++                continue; /* skip previously added AioContext */
++            }
++
++            virtio_scsi_defer_tmf_to_aio_context(req, ctx);
++        }
+         virtio_scsi_tmf_dec_remaining(req);
+         ret = -EINPROGRESS;
+@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_handle_ctrl_vq(VirtIOSCSI *s, VirtQueue *vq)
+  */
+ static bool virtio_scsi_defer_to_dataplane(VirtIOSCSI *s)
+ {
+-    if (!s->ctx || s->dataplane_started) {
++    if (s->dataplane_started) {
+         return false;
+     }
++    if (s->vq_aio_context[0] == qemu_get_aio_context()) {
++        return false; /* not using IOThreads */
++    }
+     virtio_device_start_ioeventfd(&s->parent_obj.parent_obj);
+     return !s->dataplane_fenced;
+@@ -XXX,XX +XXX,XX @@ static int virtio_scsi_handle_cmd_req_prepare(VirtIOSCSI *s, VirtIOSCSIReq *req)
+         virtio_scsi_complete_cmd_req(req);
+         return -ENOENT;
+     }
+-    virtio_scsi_ctx_check(s, d);
+     req->sreq = scsi_req_new(d, req->req.cmd.tag,
+                              virtio_scsi_get_lun(req->req.cmd.lun),
+                              req->req.cmd.cdb, vs->cdb_size, req);
+@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_hotplug(HotplugHandler *hotplug_dev, DeviceState *dev,
+ {
+     VirtIODevice *vdev = VIRTIO_DEVICE(hotplug_dev);
+     VirtIOSCSI *s = VIRTIO_SCSI(vdev);
++    AioContext *ctx = s->vq_aio_context[VIRTIO_SCSI_VQ_NUM_FIXED];
+     SCSIDevice *sd = SCSI_DEVICE(dev);
+-    int ret;
+-    if (s->ctx && !s->dataplane_fenced) {
+-        ret = blk_set_aio_context(sd->conf.blk, s->ctx, errp);
+-        if (ret < 0) {
+-            return;
+-        }
++    if (ctx != qemu_get_aio_context() && !s->dataplane_fenced) {
++        /*
++         * Try to make the BlockBackend's AioContext match ours. Ignore failure
++         * because I/O will still work although block jobs and other users
++         * might be slower when multiple AioContexts use a BlockBackend.
++         */
++        blk_set_aio_context(sd->conf.blk, ctx, errp);
+     }
+     if (virtio_vdev_has_feature(vdev, VIRTIO_SCSI_F_HOTPLUG)) {
+@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_hotunplug(HotplugHandler *hotplug_dev, DeviceState *dev,
+     qdev_simple_device_unplug_cb(hotplug_dev, dev, errp);
+-    if (s->ctx) {
++    if (s->vq_aio_context[VIRTIO_SCSI_VQ_NUM_FIXED] != qemu_get_aio_context()) {
+         /* If other users keep the BlockBackend in the iothread, that's ok */
+         blk_set_aio_context(sd->conf.blk, qemu_get_aio_context(), NULL);
+     }
+@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_drained_begin(SCSIBus *bus)
+     for (uint32_t i = 0; i < total_queues; i++) {
+         VirtQueue *vq = virtio_get_queue(vdev, i);
+-        virtio_queue_aio_detach_host_notifier(vq, s->ctx);
++        virtio_queue_aio_detach_host_notifier(vq, s->vq_aio_context[i]);
+     }
+ }
+@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_drained_end(SCSIBus *bus)
+     for (uint32_t i = 0; i < total_queues; i++) {
+         VirtQueue *vq = virtio_get_queue(vdev, i);
++        AioContext *ctx = s->vq_aio_context[i];
++
+         if (vq == vs->event_vq) {
+-            virtio_queue_aio_attach_host_notifier_no_poll(vq, s->ctx);
++            virtio_queue_aio_attach_host_notifier_no_poll(vq, ctx);
+         } else {
+-            virtio_queue_aio_attach_host_notifier(vq, s->ctx);
++            virtio_queue_aio_attach_host_notifier(vq, ctx);
+         }
+     }
+ }
+@@ -XXX,XX +XXX,XX @@ void virtio_scsi_common_unrealize(DeviceState *dev)
+     virtio_cleanup(vdev);
+ }
++/* main loop */
+ static void virtio_scsi_device_unrealize(DeviceState *dev)
+ {
+     VirtIOSCSI *s = VIRTIO_SCSI(dev);
+     virtio_scsi_reset_tmf_bh(s);
+-
++    virtio_scsi_dataplane_cleanup(s);
+     qbus_set_hotplug_handler(BUS(&s->bus), NULL);
+     virtio_scsi_common_unrealize(dev);
+     qemu_mutex_destroy(&s->tmf_bh_lock);
+@@ -XXX,XX +XXX,XX @@ static const Property virtio_scsi_properties[] = {
+                                                 VIRTIO_SCSI_F_CHANGE, true),
+     DEFINE_PROP_LINK("iothread", VirtIOSCSI, parent_obj.conf.iothread,
+                      TYPE_IOTHREAD, IOThread *),
++    DEFINE_PROP_IOTHREAD_VQ_MAPPING_LIST("iothread-vq-mapping", VirtIOSCSI,
++            parent_obj.conf.iothread_vq_mapping_list),
+ };
+ static const VMStateDescription vmstate_virtio_scsi = {
+--
+.48.1

-[Qemu-devel] [PULL 14/15] block: Fix backing paths for filenames with colons
+[PULL 21/22] virtio-scsi: handle ctrl virtqueue in main loop
-From: Max Reitz <mreitz@redhat.com>
+From: Stefan Hajnoczi <stefanha@redhat.com>
-path_combine() naturally tries to preserve a protocol prefix. However,
+Previously the ctrl virtqueue was handled in the AioContext where SCSI
-it recognizes such a prefix by scanning for the first colon; which is
+requests are processed. When IOThread Virtqueue Mapping was added things
-different from what path_has_protocol() does: There only is a protocol
+become more complicated because SCSI requests could run in other
-prefix if there is a colon before the first slash.
+AioContexts.
-A protocol prefix that is not recognized by path_has_protocol() is none,
+Simplify by handling the ctrl virtqueue in the main loop where reset
-and should thus not be taken as one.
+operations can be performed. Note that BHs are still used canceling SCSI
+requests in their AioContexts but at least the mean loop activity
-Case in point, before this patch:
+doesn't need BHs anymore.
-$ ./qemu-img create -f qcow2 -b backing.qcow2 ./top:image.qcow2
-qemu-img: ./top:image.qcow2: Could not open './top:backing.qcow2':
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-    No such file or directory
+Message-ID: <20250311132616.1049687-13-stefanha@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 Afterwards:
 $ ./qemu-img create -f qcow2 -b backing.qcow2 ./top:image.qcow2
 qemu-img: ./top:image.qcow2: Could not open './backing.qcow2':
     No such file or directory
 Reported-by: yangyang <yangyang@redhat.com>
 Signed-off-by: Max Reitz <mreitz@redhat.com>
 Reviewed-by: Eric Blake <eblake@redhat.com>
 Message-id: 20170522195217.12991-2-mreitz@redhat.com
 Signed-off-by: Max Reitz <mreitz@redhat.com>
 ---
- block.c | 15 ++++++++++-----
+ include/hw/virtio/virtio-scsi.h |   8 --
-file changed, 10 insertions(+), 5 deletions(-)
+ hw/scsi/virtio-scsi-dataplane.c |   6 ++
+ hw/scsi/virtio-scsi.c           | 144 ++++++--------------------------
-diff --git a/block.c b/block.c
+files changed, 33 insertions(+), 125 deletions(-)
 diff --git a/include/hw/virtio/virtio-scsi.h b/include/hw/virtio/virtio-scsi.h
 index XXXXXXX..XXXXXXX 100644
---- a/block.c
+--- a/include/hw/virtio/virtio-scsi.h
-+++ b/block.c
++++ b/include/hw/virtio/virtio-scsi.h
-@@ -XXX,XX +XXX,XX @@ void path_combine(char *dest, int dest_size,
+@@ -XXX,XX +XXX,XX @@ struct VirtIOSCSI {
-     if (path_is_absolute(filename)) {
-         pstrcpy(dest, dest_size, filename);
+     QemuMutex ctrl_lock; /* protects ctrl_vq */
-     } else {
--        p = strchr(base_path, ':');
+-    /*
--        if (p)
+-     * TMFs deferred to main loop BH. These fields are protected by
--            p++;
+-     * tmf_bh_lock.
--        else
+-     */
--            p = base_path;
+-    QemuMutex tmf_bh_lock;
-+        const char *protocol_stripped = NULL;
+-    QEMUBH *tmf_bh;
-+
+-    QTAILQ_HEAD(, VirtIOSCSIReq) tmf_bh_list;
-+        if (path_has_protocol(base_path)) {
+-
-+            protocol_stripped = strchr(base_path, ':');
+     /* Fields for dataplane below */
-+            if (protocol_stripped) {
+     AioContext **vq_aio_context; /* per-virtqueue AioContext pointer */
-+                protocol_stripped++;
 diff --git a/hw/scsi/virtio-scsi-dataplane.c b/hw/scsi/virtio-scsi-dataplane.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/scsi/virtio-scsi-dataplane.c
 +++ b/hw/scsi/virtio-scsi-dataplane.c
@@ -XXX,XX +XXX,XX @@ void virtio_scsi_dataplane_setup(VirtIOSCSI *s, Error **errp)
              s->vq_aio_context[i] = ctx;
          }
      }
 +
 +    /*
 +     * Always handle the ctrl virtqueue in the main loop thread where device
 +     * resets can be performed.
 +     */
 +    s->vq_aio_context[0] = qemu_get_aio_context();
  }
  /* Context: BQL held */
 diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/scsi/virtio-scsi.c
 +++ b/hw/scsi/virtio-scsi.c
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_cancel_notify(Notifier *notifier, void *data)
      g_free(n);
  }
 -static void virtio_scsi_do_one_tmf_bh(VirtIOSCSIReq *req)
 -{
 -    VirtIOSCSI *s = req->dev;
 -    SCSIDevice *d = virtio_scsi_device_get(s, req->req.tmf.lun);
 -    BusChild *kid;
 -    int target;
 -
 -    switch (req->req.tmf.subtype) {
 -    case VIRTIO_SCSI_T_TMF_LOGICAL_UNIT_RESET:
 -        if (!d) {
 -            req->resp.tmf.response = VIRTIO_SCSI_S_BAD_TARGET;
 -            goto out;
 -        }
 -        if (d->lun != virtio_scsi_get_lun(req->req.tmf.lun)) {
 -            req->resp.tmf.response = VIRTIO_SCSI_S_INCORRECT_LUN;
 -            goto out;
 -        }
 -        qatomic_inc(&s->resetting);
 -        device_cold_reset(&d->qdev);
 -        qatomic_dec(&s->resetting);
 -        break;
 -
 -    case VIRTIO_SCSI_T_TMF_I_T_NEXUS_RESET:
 -        target = req->req.tmf.lun[1];
 -        qatomic_inc(&s->resetting);
 -
 -        rcu_read_lock();
 -        QTAILQ_FOREACH_RCU(kid, &s->bus.qbus.children, sibling) {
 -            SCSIDevice *d1 = SCSI_DEVICE(kid->child);
 -            if (d1->channel == 0 && d1->id == target) {
 -                device_cold_reset(&d1->qdev);
 -            }
 -        }
 -        rcu_read_unlock();
 -
 -        qatomic_dec(&s->resetting);
 -        break;
 -
 -    default:
 -        g_assert_not_reached();
 -    }
 -
 -out:
 -    object_unref(OBJECT(d));
 -    virtio_scsi_complete_req(req, &s->ctrl_lock);
 -}
 -
 -/* Some TMFs must be processed from the main loop thread */
 -static void virtio_scsi_do_tmf_bh(void *opaque)
 -{
 -    VirtIOSCSI *s = opaque;
 -    QTAILQ_HEAD(, VirtIOSCSIReq) reqs = QTAILQ_HEAD_INITIALIZER(reqs);
 -    VirtIOSCSIReq *req;
 -    VirtIOSCSIReq *tmp;
 -
 -    GLOBAL_STATE_CODE();
 -
 -    WITH_QEMU_LOCK_GUARD(&s->tmf_bh_lock) {
 -        QTAILQ_FOREACH_SAFE(req, &s->tmf_bh_list, next, tmp) {
 -            QTAILQ_REMOVE(&s->tmf_bh_list, req, next);
 -            QTAILQ_INSERT_TAIL(&reqs, req, next);
 -        }
 -
 -        qemu_bh_delete(s->tmf_bh);
 -        s->tmf_bh = NULL;
 -    }
 -
 -    QTAILQ_FOREACH_SAFE(req, &reqs, next, tmp) {
 -        QTAILQ_REMOVE(&reqs, req, next);
 -        virtio_scsi_do_one_tmf_bh(req);
 -    }
 -}
 -
 -static void virtio_scsi_reset_tmf_bh(VirtIOSCSI *s)
 -{
 -    VirtIOSCSIReq *req;
 -    VirtIOSCSIReq *tmp;
 -
 -    GLOBAL_STATE_CODE();
 -
 -    /* Called after ioeventfd has been stopped, so tmf_bh_lock is not needed */
 -    if (s->tmf_bh) {
 -        qemu_bh_delete(s->tmf_bh);
 -        s->tmf_bh = NULL;
 -    }
 -
 -    QTAILQ_FOREACH_SAFE(req, &s->tmf_bh_list, next, tmp) {
 -        QTAILQ_REMOVE(&s->tmf_bh_list, req, next);
 -
 -        /* SAM-6 6.3.2 Hard reset */
 -        req->resp.tmf.response = VIRTIO_SCSI_S_TARGET_FAILURE;
 -        virtio_scsi_complete_req(req, &req->dev->ctrl_lock);
 -    }
 -}
 -
 -static void virtio_scsi_defer_tmf_to_main_loop(VirtIOSCSIReq *req)
 -{
 -    VirtIOSCSI *s = req->dev;
 -
 -    WITH_QEMU_LOCK_GUARD(&s->tmf_bh_lock) {
 -        QTAILQ_INSERT_TAIL(&s->tmf_bh_list, req, next);
 -
 -        if (!s->tmf_bh) {
 -            s->tmf_bh = qemu_bh_new(virtio_scsi_do_tmf_bh, s);
 -            qemu_bh_schedule(s->tmf_bh);
 -        }
 -    }
 -}
 -
  static void virtio_scsi_tmf_cancel_req(VirtIOSCSIReq *tmf, SCSIRequest *r)
  {
      VirtIOSCSICancelNotifier *notifier;
@@ -XXX,XX +XXX,XX @@ static int virtio_scsi_do_tmf(VirtIOSCSI *s, VirtIOSCSIReq *req)
          break;
      case VIRTIO_SCSI_T_TMF_LOGICAL_UNIT_RESET:
 -    case VIRTIO_SCSI_T_TMF_I_T_NEXUS_RESET:
 -        virtio_scsi_defer_tmf_to_main_loop(req);
 -        ret = -EINPROGRESS;
 +        if (!d) {
 +            goto fail;
 +        }
 +        if (d->lun != virtio_scsi_get_lun(req->req.tmf.lun)) {
 +            goto incorrect_lun;
 +        }
 +        qatomic_inc(&s->resetting);
 +        device_cold_reset(&d->qdev);
 +        qatomic_dec(&s->resetting);
          break;
 +    case VIRTIO_SCSI_T_TMF_I_T_NEXUS_RESET: {
 +        BusChild *kid;
 +        int target = req->req.tmf.lun[1];
 +        qatomic_inc(&s->resetting);
 +
 +        rcu_read_lock();
 +        QTAILQ_FOREACH_RCU(kid, &s->bus.qbus.children, sibling) {
 +            SCSIDevice *d1 = SCSI_DEVICE(kid->child);
 +            if (d1->channel == 0 && d1->id == target) {
 +                device_cold_reset(&d1->qdev);
 +            }
 +        }
-+        p = protocol_stripped ?: base_path;
++        rcu_read_unlock();
 +
-         p1 = strrchr(base_path, '/');
++        qatomic_dec(&s->resetting);
- #ifdef _WIN32
++        break;
-         {
++    }
 +
      case VIRTIO_SCSI_T_TMF_ABORT_TASK_SET:
      case VIRTIO_SCSI_T_TMF_CLEAR_TASK_SET: {
          g_autoptr(GHashTable) aio_contexts = g_hash_table_new(NULL, NULL);
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_reset(VirtIODevice *vdev)
      assert(!s->dataplane_started);
 -    virtio_scsi_reset_tmf_bh(s);
      virtio_scsi_flush_defer_tmf_to_aio_context(s);
      qatomic_inc(&s->resetting);
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_device_realize(DeviceState *dev, Error **errp)
      VirtIOSCSI *s = VIRTIO_SCSI(dev);
      Error *err = NULL;
 -    QTAILQ_INIT(&s->tmf_bh_list);
      qemu_mutex_init(&s->ctrl_lock);
      qemu_mutex_init(&s->event_lock);
 -    qemu_mutex_init(&s->tmf_bh_lock);
      virtio_scsi_common_realize(dev,
                                 virtio_scsi_handle_ctrl,
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_device_unrealize(DeviceState *dev)
  {
      VirtIOSCSI *s = VIRTIO_SCSI(dev);
 -    virtio_scsi_reset_tmf_bh(s);
      virtio_scsi_dataplane_cleanup(s);
      qbus_set_hotplug_handler(BUS(&s->bus), NULL);
      virtio_scsi_common_unrealize(dev);
 -    qemu_mutex_destroy(&s->tmf_bh_lock);
      qemu_mutex_destroy(&s->event_lock);
      qemu_mutex_destroy(&s->ctrl_lock);
  }
 --
-.8.3.1
+.48.1

-[Qemu-devel] [PULL 09/15] qemu-img: fix --image-opts usage with dd command
+[PULL 22/22] virtio-scsi: only expose cmd vqs via iothread-vq-mapping
-From: "Daniel P. Berrange" <berrange@redhat.com>
+From: Stefan Hajnoczi <stefanha@redhat.com>
-The --image-opts flag can only be used to affect the parsing
+Peter Krempa and Kevin Wolf observed that iothread-vq-mapping is
-of the source image. The target image has to be specified in
+confusing to use because the control and event virtqueues have a fixed
-the traditional style regardless, since it needs to be passed
+location before the command virtqueues but need to be treated
-to the bdrv_create() API which does not support the new style
+differently.
 opts.
-Reviewed-by: Fam Zheng <famz@redhat.com>
+Only expose the command virtqueues via iothread-vq-mapping so that the
-Reviewed-by: Max Reitz <mreitz@redhat.com>
+command-line parameter is intuitive: it controls where SCSI requests are
-Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
+processed.
-Message-id: 20170515164712.6643-3-berrange@redhat.com
-Signed-off-by: Max Reitz <mreitz@redhat.com>
+The control virtqueue needs to be hardcoded to the main loop thread for
 technical reasons anyway. Kevin also pointed out that it's better to
 place the event virtqueue in the main loop thread since its no poll
 behavior would prevent polling if assigned to an IOThread.
 This change is its own commit to avoid squashing the previous commit.
 Suggested-by: Kevin Wolf <kwolf@redhat.com>
 Suggested-by: Peter Krempa <pkrempa@redhat.com>
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Message-ID: <20250311132616.1049687-14-stefanha@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
- qemu-img.c | 9 +++++++--
+ hw/scsi/virtio-scsi-dataplane.c | 33 ++++++++++++++++++++-------------
-file changed, 7 insertions(+), 2 deletions(-)
+file changed, 20 insertions(+), 13 deletions(-)
-diff --git a/qemu-img.c b/qemu-img.c
+diff --git a/hw/scsi/virtio-scsi-dataplane.c b/hw/scsi/virtio-scsi-dataplane.c
 index XXXXXXX..XXXXXXX 100644
---- a/qemu-img.c
+--- a/hw/scsi/virtio-scsi-dataplane.c
-+++ b/qemu-img.c
++++ b/hw/scsi/virtio-scsi-dataplane.c
-@@ -XXX,XX +XXX,XX @@ static int img_dd(int argc, char **argv)
+@@ -XXX,XX +XXX,XX @@ void virtio_scsi_dataplane_setup(VirtIOSCSI *s, Error **errp)
-         goto out;
+     VirtIODevice *vdev = VIRTIO_DEVICE(s);
      BusState *qbus = qdev_get_parent_bus(DEVICE(vdev));
      VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(qbus);
 -    uint16_t num_vqs = vs->conf.num_queues + VIRTIO_SCSI_VQ_NUM_FIXED;
      if (vs->conf.iothread && vs->conf.iothread_vq_mapping_list) {
          error_setg(errp,
@@ -XXX,XX +XXX,XX @@ void virtio_scsi_dataplane_setup(VirtIOSCSI *s, Error **errp)
          }
      }
--    blk2 = img_open(image_opts, out.filename, out_fmt, BDRV_O_RDWR,
+-    s->vq_aio_context = g_new(AioContext *, num_vqs);
--                    false, false, false);
++    s->vq_aio_context = g_new(AioContext *, vs->conf.num_queues +
-+    /* TODO, we can't honour --image-opts for the target,
++                                            VIRTIO_SCSI_VQ_NUM_FIXED);
-+     * since it needs to be given in a format compatible
++
-+     * with the bdrv_create() call above which does not
++    /*
-+     * support image-opts style.
++     * Handle the ctrl virtqueue in the main loop thread where device resets
 +     * can be performed.
 +     */
-+    blk2 = img_open_file(out.filename, out_fmt, BDRV_O_RDWR,
++    s->vq_aio_context[0] = qemu_get_aio_context();
-+                         false, false, false);
++
++    /*
-     if (!blk2) {
++     * Handle the event virtqueue in the main loop thread where its no_poll
-         ret = -1;
++     * behavior won't stop IOThread polling.
 +     */
 +    s->vq_aio_context[1] = qemu_get_aio_context();
      if (vs->conf.iothread_vq_mapping_list) {
          if (!iothread_vq_mapping_apply(vs->conf.iothread_vq_mapping_list,
 -                                       s->vq_aio_context, num_vqs, errp)) {
 +                    &s->vq_aio_context[VIRTIO_SCSI_VQ_NUM_FIXED],
 +                    vs->conf.num_queues, errp)) {
              g_free(s->vq_aio_context);
              s->vq_aio_context = NULL;
              return;
          }
      } else if (vs->conf.iothread) {
          AioContext *ctx = iothread_get_aio_context(vs->conf.iothread);
 -        for (uint16_t i = 0; i < num_vqs; i++) {
 -            s->vq_aio_context[i] = ctx;
 +        for (uint16_t i = 0; i < vs->conf.num_queues; i++) {
 +            s->vq_aio_context[VIRTIO_SCSI_VQ_NUM_FIXED + i] = ctx;
          }
          /* Released in virtio_scsi_dataplane_cleanup() */
          object_ref(OBJECT(vs->conf.iothread));
      } else {
          AioContext *ctx = qemu_get_aio_context();
 -        for (unsigned i = 0; i < num_vqs; i++) {
 -            s->vq_aio_context[i] = ctx;
 +        for (unsigned i = 0; i < vs->conf.num_queues; i++) {
 +            s->vq_aio_context[VIRTIO_SCSI_VQ_NUM_FIXED + i] = ctx;
          }
      }
 -
 -    /*
 -     * Always handle the ctrl virtqueue in the main loop thread where device
 -     * resets can be performed.
 -     */
 -    s->vq_aio_context[0] = qemu_get_aio_context();
  }
  /* Context: BQL held */
 --
-.8.3.1
+.48.1

The following changes since commit 9964e96dc9999cf7f7c936ee854a795415d19b60:

Merge remote-tracking branch 'jasowang/tags/net-pull-request' into staging (2017-05-23 15:01:31 +0100)

are available in the git repository at:

git://repo.or.cz/qemu/kevin.git tags/for-upstream

for you to fetch changes up to 42a48128417b3bfade93d1a4721348cc480e9e50:

Merge remote-tracking branch 'mreitz/tags/pull-block-2017-05-29-v3' into queue-block (2017-05-29 16:34:27 +0200)

----------------------------------------------------------------

Block layer patches

----------------------------------------------------------------
Alberto Garcia (2):
      stream: fix crash in stream_start() when block_job_create() fails
      qcow2: remove extra local_error variable

Daniel P. Berrange (4):
      qemu-img: add support for --object with 'dd' command
      qemu-img: fix --image-opts usage with dd command
      qemu-img: introduce --target-image-opts for 'convert' command
      qemu-img: copy *key-secret opts when opening newly created files

Eric Blake (1):
      block: Tweak error message related to qemu-img amend

Fam Zheng (3):
      iotests: 147: Don't test inet6 if not available
      qemu-img: Fix documentation of convert
      qemu-img: Fix leakage of options on error

Kevin Wolf (3):
      qemu-iotests: Test streaming with missing job ID
      mirror: Drop permissions on s->target on completion
      Merge remote-tracking branch 'mreitz/tags/pull-block-2017-05-29-v3' into queue-block

Max Reitz (2):
      block: Fix backing paths for filenames with colons
      block/file-*: *_parse_filename() and colons

Stephen Bates (1):
      nvme: Add support for Controller Memory Buffers

From: Alberto Garcia <berto@igalia.com>

The code that tries to reopen a BlockDriverState in stream_start()
when the creation of a new block job fails crashes because it attempts
to dereference a pointer that is known to be NULL.

This is a regression introduced in a170a91fd3eab6155da39e740381867e,
likely because the code was copied from stream_complete().

Cc: qemu-stable@nongnu.org
Reported-by: Kashyap Chamarthy <kchamart@redhat.com>
Signed-off-by: Alberto Garcia <berto@igalia.com>
Tested-by: Kashyap Chamarthy <kchamart@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/stream.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/block/stream.c b/block/stream.c
index XXXXXXX..XXXXXXX 100644
--- a/block/stream.c
+++ b/block/stream.c
@@ -XXX,XX +XXX,XX @@ void stream_start(const char *job_id, BlockDriverState *bs,
 
 fail:
     if (orig_bs_flags != bdrv_get_flags(bs)) {
-        bdrv_reopen(bs, s->bs_flags, NULL);
+        bdrv_reopen(bs, orig_bs_flags, NULL);
     }
 }
-- 
1.8.3.1

This adds a small test for the image streaming error path for failing
block_job_create(), which would have found the null pointer dereference
in commit a170a91f.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Reviewed-by: Kashyap Chamarthy <kchamart@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Jeff Cody <jcody@redhat.com>
---
 tests/qemu-iotests/030     | 4 ++++
 tests/qemu-iotests/030.out | 4 ++--
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/tests/qemu-iotests/030 b/tests/qemu-iotests/030
index XXXXXXX..XXXXXXX 100755
--- a/tests/qemu-iotests/030
+++ b/tests/qemu-iotests/030
@@ -XXX,XX +XXX,XX @@ class TestSingleDrive(iotests.QMPTestCase):
         result = self.vm.qmp('block-stream', device='nonexistent')
         self.assert_qmp(result, 'error/class', 'GenericError')
 
+    def test_job_id_missing(self):
+        result = self.vm.qmp('block-stream', device='mid')
+        self.assert_qmp(result, 'error/class', 'GenericError')
+
 
 class TestParallelOps(iotests.QMPTestCase):
     num_ops = 4 # Number of parallel block-stream operations
diff --git a/tests/qemu-iotests/030.out b/tests/qemu-iotests/030.out
index XXXXXXX..XXXXXXX 100644
--- a/tests/qemu-iotests/030.out
+++ b/tests/qemu-iotests/030.out
@@ -XXX,XX +XXX,XX @@
-......................
+.......................
 ----------------------------------------------------------------------
-Ran 22 tests
+Ran 23 tests
 
 OK
-- 
1.8.3.1

From: Stephen Bates <sbates@raithlin.com>

Implement NVMe Controller Memory Buffers (CMBs) which were added in
version 1.2 of the NVMe Specification. This patch adds an optional
argument (cmb_size_mb) which indicates the size of the CMB (in
MB). Currently only the Submission Queue Support (SQS) is enabled
which aligns with the current Linux driver for NVMe.

Signed-off-by: Stephen Bates <sbates@raithlin.com>
Acked-by: Keith Busch <keith.busch@intel.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 hw/block/nvme.c | 75 ++++++++++++++++++++++++++++++++++++++++++++++++++++++---
 hw/block/nvme.h | 73 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 144 insertions(+), 4 deletions(-)

diff --git a/hw/block/nvme.c b/hw/block/nvme.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/nvme.c
+++ b/hw/block/nvme.c
@@ -XXX,XX +XXX,XX @@
  */
 
 /**
- * Reference Specs: http://www.nvmexpress.org, 1.1, 1.0e
+ * Reference Specs: http://www.nvmexpress.org, 1.2, 1.1, 1.0e
  *
  *  http://www.nvmexpress.org/resources/
  */
@@ -XXX,XX +XXX,XX @@
 /**
  * Usage: add options:
  *      -drive file=<file>,if=none,id=<drive_id>
- *      -device nvme,drive=<drive_id>,serial=<serial>,id=<id[optional]>
+ *      -device nvme,drive=<drive_id>,serial=<serial>,id=<id[optional]>, \
+ *              cmb_size_mb=<cmb_size_mb[optional]>
+ *
+ * Note cmb_size_mb denotes size of CMB in MB. CMB is assumed to be at
+ * offset 0 in BAR2 and supports SQS only for now.
  */
 
 #include "qemu/osdep.h"
@@ -XXX,XX +XXX,XX @@
 
 static void nvme_process_sq(void *opaque);
 
+static void nvme_addr_read(NvmeCtrl *n, hwaddr addr, void *buf, int size)
+{
+    if (n->cmbsz && addr >= n->ctrl_mem.addr &&
+                addr < (n->ctrl_mem.addr + int128_get64(n->ctrl_mem.size))) {
+        memcpy(buf, (void *)&n->cmbuf[addr - n->ctrl_mem.addr], size);
+    } else {
+        pci_dma_read(&n->parent_obj, addr, buf, size);
+    }
+}
+
 static int nvme_check_sqid(NvmeCtrl *n, uint16_t sqid)
 {
     return sqid < n->num_queues && n->sq[sqid] != NULL ? 0 : -1;
@@ -XXX,XX +XXX,XX @@ static void nvme_process_sq(void *opaque)
 
     while (!(nvme_sq_empty(sq) || QTAILQ_EMPTY(&sq->req_list))) {
         addr = sq->dma_addr + sq->head * n->sqe_size;
-        pci_dma_read(&n->parent_obj, addr, (void *)&cmd, sizeof(cmd));
+        nvme_addr_read(n, addr, (void *)&cmd, sizeof(cmd));
         nvme_inc_sq_head(sq);
 
         req = QTAILQ_FIRST(&sq->req_list);
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps nvme_mmio_ops = {
     },
 };
 
+static void nvme_cmb_write(void *opaque, hwaddr addr, uint64_t data,
+    unsigned size)
+{
+    NvmeCtrl *n = (NvmeCtrl *)opaque;
+    memcpy(&n->cmbuf[addr], &data, size);
+}
+
+static uint64_t nvme_cmb_read(void *opaque, hwaddr addr, unsigned size)
+{
+    uint64_t val;
+    NvmeCtrl *n = (NvmeCtrl *)opaque;
+
+    memcpy(&val, &n->cmbuf[addr], size);
+    return val;
+}
+
+static const MemoryRegionOps nvme_cmb_ops = {
+    .read = nvme_cmb_read,
+    .write = nvme_cmb_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .impl = {
+        .min_access_size = 2,
+        .max_access_size = 8,
+    },
+};
+
 static int nvme_init(PCIDevice *pci_dev)
 {
     NvmeCtrl *n = NVME(pci_dev);
@@ -XXX,XX +XXX,XX @@ static int nvme_init(PCIDevice *pci_dev)
     NVME_CAP_SET_CSS(n->bar.cap, 1);
     NVME_CAP_SET_MPSMAX(n->bar.cap, 4);
 
-    n->bar.vs = 0x00010100;
+    n->bar.vs = 0x00010200;
     n->bar.intmc = n->bar.intms = 0;
 
+    if (n->cmb_size_mb) {
+
+        NVME_CMBLOC_SET_BIR(n->bar.cmbloc, 2);
+        NVME_CMBLOC_SET_OFST(n->bar.cmbloc, 0);
+
+        NVME_CMBSZ_SET_SQS(n->bar.cmbsz, 1);
+        NVME_CMBSZ_SET_CQS(n->bar.cmbsz, 0);
+        NVME_CMBSZ_SET_LISTS(n->bar.cmbsz, 0);
+        NVME_CMBSZ_SET_RDS(n->bar.cmbsz, 0);
+        NVME_CMBSZ_SET_WDS(n->bar.cmbsz, 0);
+        NVME_CMBSZ_SET_SZU(n->bar.cmbsz, 2); /* MBs */
+        NVME_CMBSZ_SET_SZ(n->bar.cmbsz, n->cmb_size_mb);
+
+        n->cmbuf = g_malloc0(NVME_CMBSZ_GETSIZE(n->bar.cmbsz));
+        memory_region_init_io(&n->ctrl_mem, OBJECT(n), &nvme_cmb_ops, n,
+                              "nvme-cmb", NVME_CMBSZ_GETSIZE(n->bar.cmbsz));
+        pci_register_bar(&n->parent_obj, NVME_CMBLOC_BIR(n->bar.cmbloc),
+            PCI_BASE_ADDRESS_SPACE_MEMORY | PCI_BASE_ADDRESS_MEM_TYPE_64 |
+            PCI_BASE_ADDRESS_MEM_PREFETCH, &n->ctrl_mem);
+
+    }
+
     for (i = 0; i < n->num_namespaces; i++) {
         NvmeNamespace *ns = &n->namespaces[i];
         NvmeIdNs *id_ns = &ns->id_ns;
@@ -XXX,XX +XXX,XX @@ static void nvme_exit(PCIDevice *pci_dev)
     g_free(n->namespaces);
     g_free(n->cq);
     g_free(n->sq);
+    if (n->cmbsz) {
+        memory_region_unref(&n->ctrl_mem);
+    }
+
     msix_uninit_exclusive_bar(pci_dev);
 }
 
 static Property nvme_props[] = {
     DEFINE_BLOCK_PROPERTIES(NvmeCtrl, conf),
     DEFINE_PROP_STRING("serial", NvmeCtrl, serial),
+    DEFINE_PROP_UINT32("cmb_size_mb", NvmeCtrl, cmb_size_mb, 0),
     DEFINE_PROP_END_OF_LIST(),
 };
 
diff --git a/hw/block/nvme.h b/hw/block/nvme.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/nvme.h
+++ b/hw/block/nvme.h
@@ -XXX,XX +XXX,XX @@ typedef struct NvmeBar {
     uint32_t    aqa;
     uint64_t    asq;
     uint64_t    acq;
+    uint32_t    cmbloc;
+    uint32_t    cmbsz;
 } NvmeBar;
 
 enum NvmeCapShift {
@@ -XXX,XX +XXX,XX @@ enum NvmeAqaMask {
 #define NVME_AQA_ASQS(aqa) ((aqa >> AQA_ASQS_SHIFT) & AQA_ASQS_MASK)
 #define NVME_AQA_ACQS(aqa) ((aqa >> AQA_ACQS_SHIFT) & AQA_ACQS_MASK)
 
+enum NvmeCmblocShift {
+    CMBLOC_BIR_SHIFT  = 0,
+    CMBLOC_OFST_SHIFT = 12,
+};
+
+enum NvmeCmblocMask {
+    CMBLOC_BIR_MASK  = 0x7,
+    CMBLOC_OFST_MASK = 0xfffff,
+};
+
+#define NVME_CMBLOC_BIR(cmbloc) ((cmbloc >> CMBLOC_BIR_SHIFT)  & \
+                                 CMBLOC_BIR_MASK)
+#define NVME_CMBLOC_OFST(cmbloc)((cmbloc >> CMBLOC_OFST_SHIFT) & \
+                                 CMBLOC_OFST_MASK)
+
+#define NVME_CMBLOC_SET_BIR(cmbloc, val)  \
+    (cmbloc |= (uint64_t)(val & CMBLOC_BIR_MASK) << CMBLOC_BIR_SHIFT)
+#define NVME_CMBLOC_SET_OFST(cmbloc, val) \
+    (cmbloc |= (uint64_t)(val & CMBLOC_OFST_MASK) << CMBLOC_OFST_SHIFT)
+
+enum NvmeCmbszShift {
+    CMBSZ_SQS_SHIFT   = 0,
+    CMBSZ_CQS_SHIFT   = 1,
+    CMBSZ_LISTS_SHIFT = 2,
+    CMBSZ_RDS_SHIFT   = 3,
+    CMBSZ_WDS_SHIFT   = 4,
+    CMBSZ_SZU_SHIFT   = 8,
+    CMBSZ_SZ_SHIFT    = 12,
+};
+
+enum NvmeCmbszMask {
+    CMBSZ_SQS_MASK   = 0x1,
+    CMBSZ_CQS_MASK   = 0x1,
+    CMBSZ_LISTS_MASK = 0x1,
+    CMBSZ_RDS_MASK   = 0x1,
+    CMBSZ_WDS_MASK   = 0x1,
+    CMBSZ_SZU_MASK   = 0xf,
+    CMBSZ_SZ_MASK    = 0xfffff,
+};
+
+#define NVME_CMBSZ_SQS(cmbsz)  ((cmbsz >> CMBSZ_SQS_SHIFT)   & CMBSZ_SQS_MASK)
+#define NVME_CMBSZ_CQS(cmbsz)  ((cmbsz >> CMBSZ_CQS_SHIFT)   & CMBSZ_CQS_MASK)
+#define NVME_CMBSZ_LISTS(cmbsz)((cmbsz >> CMBSZ_LISTS_SHIFT) & CMBSZ_LISTS_MASK)
+#define NVME_CMBSZ_RDS(cmbsz)  ((cmbsz >> CMBSZ_RDS_SHIFT)   & CMBSZ_RDS_MASK)
+#define NVME_CMBSZ_WDS(cmbsz)  ((cmbsz >> CMBSZ_WDS_SHIFT)   & CMBSZ_WDS_MASK)
+#define NVME_CMBSZ_SZU(cmbsz)  ((cmbsz >> CMBSZ_SZU_SHIFT)   & CMBSZ_SZU_MASK)
+#define NVME_CMBSZ_SZ(cmbsz)   ((cmbsz >> CMBSZ_SZ_SHIFT)    & CMBSZ_SZ_MASK)
+
+#define NVME_CMBSZ_SET_SQS(cmbsz, val)   \
+    (cmbsz |= (uint64_t)(val &  CMBSZ_SQS_MASK)  << CMBSZ_SQS_SHIFT)
+#define NVME_CMBSZ_SET_CQS(cmbsz, val)   \
+    (cmbsz |= (uint64_t)(val & CMBSZ_CQS_MASK) << CMBSZ_CQS_SHIFT)
+#define NVME_CMBSZ_SET_LISTS(cmbsz, val) \
+    (cmbsz |= (uint64_t)(val & CMBSZ_LISTS_MASK) << CMBSZ_LISTS_SHIFT)
+#define NVME_CMBSZ_SET_RDS(cmbsz, val)   \
+    (cmbsz |= (uint64_t)(val & CMBSZ_RDS_MASK) << CMBSZ_RDS_SHIFT)
+#define NVME_CMBSZ_SET_WDS(cmbsz, val)   \
+    (cmbsz |= (uint64_t)(val & CMBSZ_WDS_MASK) << CMBSZ_WDS_SHIFT)
+#define NVME_CMBSZ_SET_SZU(cmbsz, val)   \
+    (cmbsz |= (uint64_t)(val & CMBSZ_SZU_MASK) << CMBSZ_SZU_SHIFT)
+#define NVME_CMBSZ_SET_SZ(cmbsz, val)    \
+    (cmbsz |= (uint64_t)(val & CMBSZ_SZ_MASK) << CMBSZ_SZ_SHIFT)
+
+#define NVME_CMBSZ_GETSIZE(cmbsz) \
+    (NVME_CMBSZ_SZ(cmbsz) * (1 << (12 + 4 * NVME_CMBSZ_SZU(cmbsz))))
+
 typedef struct NvmeCmd {
     uint8_t     opcode;
     uint8_t     fuse;
@@ -XXX,XX +XXX,XX @@ typedef struct NvmeNamespace {
 typedef struct NvmeCtrl {
     PCIDevice    parent_obj;
     MemoryRegion iomem;
+    MemoryRegion ctrl_mem;
     NvmeBar      bar;
     BlockConf    conf;
 
@@ -XXX,XX +XXX,XX @@ typedef struct NvmeCtrl {
     uint32_t    num_queues;
     uint32_t    max_q_ents;
     uint64_t    ns_size;
+    uint32_t    cmb_size_mb;
+    uint32_t    cmbsz;
+    uint32_t    cmbloc;
+    uint8_t     *cmbuf;
 
     char            *serial;
     NvmeNamespace   *namespaces;
-- 
1.8.3.1

This fixes an assertion failure that was triggered by qemu-iotests 129
on some CI host, while the same test case didn't seem to fail on other
hosts.

Essentially the problem is that the blk_unref(s->target) in
mirror_exit() doesn't necessarily mean that the BlockBackend goes away
immediately. It is possible that the job completion was triggered nested
in mirror_drain(), which looks like this:

BlockBackend *target = s->target;
    blk_ref(target);
    blk_drain(target);
    blk_unref(target);

In this case, the write permissions for s->target are retained until
after blk_drain(), which makes removing mirror_top_bs fail for the
active commit case (can't have a writable backing file in the chain
without the filter driver).

Explicitly dropping the permissions first means that the additional
reference doesn't hurt and the job can complete successfully even if
called from the nested blk_drain().

Cc: qemu-stable@nongnu.org
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
---
 block/mirror.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/block/mirror.c b/block/mirror.c
index XXXXXXX..XXXXXXX 100644
--- a/block/mirror.c
+++ b/block/mirror.c
@@ -XXX,XX +XXX,XX @@ static void mirror_exit(BlockJob *job, void *opaque)
 
     /* Remove target parent that still uses BLK_PERM_WRITE/RESIZE before
      * inserting target_bs at s->to_replace, where we might not be able to get
-     * these permissions. */
+     * these permissions.
+     *
+     * Note that blk_unref() alone doesn't necessarily drop permissions because
+     * we might be running nested inside mirror_drain(), which takes an extra
+     * reference, so use an explicit blk_set_perm() first. */
+    blk_set_perm(s->target, 0, BLK_PERM_ALL, &error_abort);
     blk_unref(s->target);
     s->target = NULL;
 
-- 
1.8.3.1

From: Alberto Garcia <berto@igalia.com>

Commit d7086422b1c1e75e320519cfe26176db6ec97a37 added a local_err
variable global to the qcow2_amend_options() function, so there's no
need to have this other one.

Signed-off-by: Alberto Garcia <berto@igalia.com>
Message-id: 20170511150337.21470-1-berto@igalia.com
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
---
 block/qcow2.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/block/qcow2.c b/block/qcow2.c
index XXXXXXX..XXXXXXX 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -XXX,XX +XXX,XX @@ static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts,
 
     if (s->refcount_bits != refcount_bits) {
         int refcount_order = ctz32(refcount_bits);
-        Error *local_error = NULL;
 
         if (new_version < 3 && refcount_bits != 16) {
             error_report("Different refcount widths than 16 bits require "
@@ -XXX,XX +XXX,XX @@ static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts,
         helper_cb_info.current_operation = QCOW2_CHANGING_REFCOUNT_ORDER;
         ret = qcow2_change_refcount_order(bs, refcount_order,
                                           &qcow2_amend_helper_cb,
-                                          &helper_cb_info, &local_error);
+                                          &helper_cb_info, &local_err);
         if (ret < 0) {
-            error_report_err(local_error);
+            error_report_err(local_err);
             return ret;
         }
     }
-- 
1.8.3.1

From: Fam Zheng <famz@redhat.com>

It got lost in commit a8d16f9ca "qemu-img: Update documentation for -U".

Reported-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Fam Zheng <famz@redhat.com>
Message-id: 20170515103551.31313-1-famz@redhat.com
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
---
 qemu-img-cmds.hx | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

From: "Daniel P. Berrange" <berrange@redhat.com>

The qemu-img dd command added --image-opts support, but missed
the corresponding --object support. This prevented passing
secrets (eg auth passwords) needed by certain disk images.

Reviewed-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 20170515164712.6643-2-berrange@redhat.com
Signed-off-by: Max Reitz <mreitz@redhat.com>
---
 qemu-img.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/qemu-img.c b/qemu-img.c
index XXXXXXX..XXXXXXX 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -XXX,XX +XXX,XX @@ static int img_dd(int argc, char **argv)
     };
     const struct option long_options[] = {
         { "help", no_argument, 0, 'h'},
+        { "object", required_argument, 0, OPTION_OBJECT},
         { "image-opts", no_argument, 0, OPTION_IMAGE_OPTS},
         { "force-share", no_argument, 0, 'U'},
         { 0, 0, 0, 0 }
@@ -XXX,XX +XXX,XX @@ static int img_dd(int argc, char **argv)
         case 'U':
             force_share = true;
             break;
+        case OPTION_OBJECT: {
+            QemuOpts *opts;
+            opts = qemu_opts_parse_noisily(&qemu_object_opts,
+                                           optarg, true);
+            if (!opts) {
+                ret = -1;
+                goto out;
+            }
+        }   break;
         case OPTION_IMAGE_OPTS:
             image_opts = true;
             break;
@@ -XXX,XX +XXX,XX @@ static int img_dd(int argc, char **argv)
         ret = -1;
         goto out;
     }
+
+    if (qemu_opts_foreach(&qemu_object_opts,
+                          user_creatable_add_opts_foreach,
+                          NULL, NULL)) {
+        ret = -1;
+        goto out;
+    }
+
     blk1 = img_open(image_opts, in.filename, fmt, 0, false, false,
                     force_share);
 
-- 
1.8.3.1

From: "Daniel P. Berrange" <berrange@redhat.com>

The --image-opts flag can only be used to affect the parsing
of the source image. The target image has to be specified in
the traditional style regardless, since it needs to be passed
to the bdrv_create() API which does not support the new style
opts.

Reviewed-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 20170515164712.6643-3-berrange@redhat.com
Signed-off-by: Max Reitz <mreitz@redhat.com>
---
 qemu-img.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/qemu-img.c b/qemu-img.c
index XXXXXXX..XXXXXXX 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -XXX,XX +XXX,XX @@ static int img_dd(int argc, char **argv)
         goto out;
     }
 
-    blk2 = img_open(image_opts, out.filename, out_fmt, BDRV_O_RDWR,
-                    false, false, false);
+    /* TODO, we can't honour --image-opts for the target,
+     * since it needs to be given in a format compatible
+     * with the bdrv_create() call above which does not
+     * support image-opts style.
+     */
+    blk2 = img_open_file(out.filename, out_fmt, BDRV_O_RDWR,
+                         false, false, false);
 
     if (!blk2) {
         ret = -1;
-- 
1.8.3.1

From: "Daniel P. Berrange" <berrange@redhat.com>

The '--image-opts' flag indicates whether the source filename
includes options. The target filename has to remain in the
plain filename format though, since it needs to be passed to
bdrv_create().  When using --skip-create though, it would be
possible to use image-opts syntax. This adds --target-image-opts
to indicate that the target filename includes options. Currently
this mandates use of the --skip-create flag too.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 20170515164712.6643-4-berrange@redhat.com
Reviewed-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
---
 qemu-img-cmds.hx |  4 +--
 qemu-img.c       | 84 ++++++++++++++++++++++++++++++++++++++------------------
 qemu-img.texi    | 12 ++++++--
 3 files changed, 69 insertions(+), 31 deletions(-)

diff --git a/qemu-img-cmds.hx b/qemu-img-cmds.hx
index XXXXXXX..XXXXXXX 100644
--- a/qemu-img-cmds.hx
+++ b/qemu-img-cmds.hx
@@ -XXX,XX +XXX,XX @@ STEXI
 ETEXI
 
 DEF("convert", img_convert,
-    "convert [--object objectdef] [--image-opts] [-U] [-c] [-p] [-q] [-n] [-f fmt] [-t cache] [-T src_cache] [-O output_fmt] [-B backing_file] [-o options] [-s snapshot_id_or_name] [-l snapshot_param] [-S sparse_size] [-m num_coroutines] [-W] filename [filename2 [...]] output_filename")
+    "convert [--object objectdef] [--image-opts] [--target-image-opts] [-U] [-c] [-p] [-q] [-n] [-f fmt] [-t cache] [-T src_cache] [-O output_fmt] [-B backing_file] [-o options] [-s snapshot_id_or_name] [-l snapshot_param] [-S sparse_size] [-m num_coroutines] [-W] filename [filename2 [...]] output_filename")
 STEXI
-@item convert [--object @var{objectdef}] [--image-opts] [-U] [-c] [-p] [-q] [-n] [-f @var{fmt}] [-t @var{cache}] [-T @var{src_cache}] [-O @var{output_fmt}] [-B @var{backing_file}] [-o @var{options}] [-s @var{snapshot_id_or_name}] [-l @var{snapshot_param}] [-S @var{sparse_size}] [-m @var{num_coroutines}] [-W] @var{filename} [@var{filename2} [...]] @var{output_filename}
+@item convert [--object @var{objectdef}] [--image-opts] [--target-image-opts] [-U] [-c] [-p] [-q] [-n] [-f @var{fmt}] [-t @var{cache}] [-T @var{src_cache}] [-O @var{output_fmt}] [-B @var{backing_file}] [-o @var{options}] [-s @var{snapshot_id_or_name}] [-l @var{snapshot_param}] [-S @var{sparse_size}] [-m @var{num_coroutines}] [-W] @var{filename} [@var{filename2} [...]] @var{output_filename}
 ETEXI
 
 DEF("dd", img_dd,
diff --git a/qemu-img.c b/qemu-img.c
index XXXXXXX..XXXXXXX 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -XXX,XX +XXX,XX @@ enum {
     OPTION_PATTERN = 260,
     OPTION_FLUSH_INTERVAL = 261,
     OPTION_NO_DRAIN = 262,
+    OPTION_TARGET_IMAGE_OPTS = 263,
 };
 
 typedef enum OutputFormat {
@@ -XXX,XX +XXX,XX @@ static int convert_do_copy(ImgConvertState *s)
 static int img_convert(int argc, char **argv)
 {
     int c, bs_i, flags, src_flags = 0;
-    const char *fmt = NULL, *out_fmt = "raw", *cache = "unsafe",
+    const char *fmt = NULL, *out_fmt = NULL, *cache = "unsafe",
                *src_cache = BDRV_DEFAULT_CACHE, *out_baseimg = NULL,
                *out_filename, *out_baseimg_param, *snapshot_name = NULL;
-    BlockDriver *drv, *proto_drv;
+    BlockDriver *drv = NULL, *proto_drv = NULL;
     BlockDriverInfo bdi;
     BlockDriverState *out_bs;
     QemuOpts *opts = NULL, *sn_opts = NULL;
@@ -XXX,XX +XXX,XX @@ static int img_convert(int argc, char **argv)
     char *options = NULL;
     Error *local_err = NULL;
     bool writethrough, src_writethrough, quiet = false, image_opts = false,
-         skip_create = false, progress = false;
+         skip_create = false, progress = false, tgt_image_opts = false;
     int64_t ret = -EINVAL;
     bool force_share = false;
 
@@ -XXX,XX +XXX,XX @@ static int img_convert(int argc, char **argv)
             {"object", required_argument, 0, OPTION_OBJECT},
             {"image-opts", no_argument, 0, OPTION_IMAGE_OPTS},
             {"force-share", no_argument, 0, 'U'},
+            {"target-image-opts", no_argument, 0, OPTION_TARGET_IMAGE_OPTS},
             {0, 0, 0, 0}
         };
         c = getopt_long(argc, argv, ":hf:O:B:ce6o:s:l:S:pt:T:qnm:WU",
@@ -XXX,XX +XXX,XX @@ static int img_convert(int argc, char **argv)
         case OPTION_IMAGE_OPTS:
             image_opts = true;
             break;
+        case OPTION_TARGET_IMAGE_OPTS:
+            tgt_image_opts = true;
+            break;
         }
     }
 
+    if (!out_fmt && !tgt_image_opts) {
+        out_fmt = "raw";
+    }
+
     if (qemu_opts_foreach(&qemu_object_opts,
                           user_creatable_add_opts_foreach,
                           NULL, NULL)) {
@@ -XXX,XX +XXX,XX @@ static int img_convert(int argc, char **argv)
         goto fail_getopt;
     }
 
+    if (tgt_image_opts && !skip_create) {
+        error_report("--target-image-opts requires use of -n flag");
+        goto fail_getopt;
+    }
+
     s.src_num = argc - optind - 1;
     out_filename = s.src_num >= 1 ? argv[argc - 1] : NULL;
 
     if (options && has_help_option(options)) {
-        ret = print_block_option_help(out_filename, out_fmt);
-        goto fail_getopt;
+        if (out_fmt) {
+            ret = print_block_option_help(out_filename, out_fmt);
+            goto fail_getopt;
+        } else {
+            error_report("Option help requires a format be specified");
+            goto fail_getopt;
+        }
     }
 
     if (s.src_num < 1) {
@@ -XXX,XX +XXX,XX @@ static int img_convert(int argc, char **argv)
         goto out;
     }
 
-    /* Find driver and parse its options */
-    drv = bdrv_find_format(out_fmt);
-    if (!drv) {
-        error_report("Unknown file format '%s'", out_fmt);
-        ret = -1;
-        goto out;
-    }
+    if (!skip_create) {
+        /* Find driver and parse its options */
+        drv = bdrv_find_format(out_fmt);
+        if (!drv) {
+            error_report("Unknown file format '%s'", out_fmt);
+            ret = -1;
+            goto out;
+        }
 
-    proto_drv = bdrv_find_protocol(out_filename, true, &local_err);
-    if (!proto_drv) {
-        error_report_err(local_err);
-        ret = -1;
-        goto out;
-    }
+        proto_drv = bdrv_find_protocol(out_filename, true, &local_err);
+        if (!proto_drv) {
+            error_report_err(local_err);
+            ret = -1;
+            goto out;
+        }
 
-    if (!skip_create) {
         if (!drv->create_opts) {
             error_report("Format driver '%s' does not support image creation",
                          drv->format_name);
@@ -XXX,XX +XXX,XX @@ static int img_convert(int argc, char **argv)
         const char *preallocation =
             qemu_opt_get(opts, BLOCK_OPT_PREALLOC);
 
-        if (!drv->bdrv_co_pwritev_compressed) {
+        if (drv && !drv->bdrv_co_pwritev_compressed) {
             error_report("Compression not supported for this file format");
             ret = -1;
             goto out;
@@ -XXX,XX +XXX,XX @@ static int img_convert(int argc, char **argv)
         goto out;
     }
 
-    /* XXX we should allow --image-opts to trigger use of
-     * img_open() here, but then we have trouble with
-     * the bdrv_create() call which takes different params.
-     * Not critical right now, so fix can wait...
-     */
-    s.target = img_open_file(out_filename, out_fmt, flags, writethrough, quiet,
-                             false);
+    if (skip_create) {
+        s.target = img_open(tgt_image_opts, out_filename, out_fmt,
+                            flags, writethrough, quiet, false);
+    } else {
+        /* TODO ultimately we should allow --target-image-opts
+         * to be used even when -n is not given.
+         * That has to wait for bdrv_create to be improved
+         * to allow filenames in option syntax
+         */
+        s.target = img_open_file(out_filename, out_fmt, flags,
+                                 writethrough, quiet, false);
+    }
     if (!s.target) {
         ret = -1;
         goto out;
     }
     out_bs = blk_bs(s.target);
 
+    if (s.compressed && !out_bs->drv->bdrv_co_pwritev_compressed) {
+        error_report("Compression not supported for this file format");
+        ret = -1;
+        goto out;
+    }
+
     /* increase bufsectors from the default 4096 (2M) if opt_transfer
      * or discard_alignment of the out_bs is greater. Limit to 32768 (16MB)
      * as maximum. */
diff --git a/qemu-img.texi b/qemu-img.texi
index XXXXXXX..XXXXXXX 100644
--- a/qemu-img.texi
+++ b/qemu-img.texi
@@ -XXX,XX +XXX,XX @@ keys.
 
 @item --image-opts
 
-Indicates that the @var{filename} parameter is to be interpreted as a
+Indicates that the source @var{filename} parameter is to be interpreted as a
 full option string, not a plain filename. This parameter is mutually
-exclusive with the @var{-f} and @var{-F} parameters.
+exclusive with the @var{-f} parameter.
+
+@item --target-image-opts
+
+Indicates that the @var{output_filename} parameter(s) are to be interpreted as
+a full option string, not a plain filename. This parameter is mutually
+exclusive with the @var{-O} parameters. It is currently required to also use
+the @var{-n} parameter to skip image creation. This restriction may be relaxed
+in a future release.
 
 @item fmt
 is the disk image format. It is guessed automatically in most cases. See below
-- 
1.8.3.1

From: "Daniel P. Berrange" <berrange@redhat.com>

The qemu-img dd/convert commands will create an image file and
then try to open it. Historically it has been possible to open
new files without passing any options. With encrypted files
though, the *key-secret options are mandatory, so we need to
provide those options when opening the newly created file.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 20170515164712.6643-5-berrange@redhat.com
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
---
 qemu-img.c | 42 +++++++++++++++++++++++++++++++++++++-----
 1 file changed, 37 insertions(+), 5 deletions(-)

diff --git a/qemu-img.c b/qemu-img.c
index XXXXXXX..XXXXXXX 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -XXX,XX +XXX,XX @@ static BlockBackend *img_open_opts(const char *optstr,
 }
 
 static BlockBackend *img_open_file(const char *filename,
+                                   QDict *options,
                                    const char *fmt, int flags,
                                    bool writethrough, bool quiet,
                                    bool force_share)
 {
     BlockBackend *blk;
     Error *local_err = NULL;
-    QDict *options = qdict_new();
 
+    if (!options) {
+        options = qdict_new();
+    }
     if (fmt) {
         qdict_put_str(options, "driver", fmt);
     }
@@ -XXX,XX +XXX,XX @@ static BlockBackend *img_open_file(const char *filename,
 }
 
 
+static int img_add_key_secrets(void *opaque,
+                               const char *name, const char *value,
+                               Error **errp)
+{
+    QDict *options = opaque;
+
+    if (g_str_has_suffix(name, "key-secret")) {
+        qdict_put(options, name, qstring_from_str(value));
+    }
+
+    return 0;
+}
+
+static BlockBackend *img_open_new_file(const char *filename,
+                                       QemuOpts *create_opts,
+                                       const char *fmt, int flags,
+                                       bool writethrough, bool quiet,
+                                       bool force_share)
+{
+    QDict *options = NULL;
+
+    options = qdict_new();
+    qemu_opt_foreach(create_opts, img_add_key_secrets, options, &error_abort);
+
+    return img_open_file(filename, options, fmt, flags, writethrough, quiet,
+                         force_share);
+}
+
+
 static BlockBackend *img_open(bool image_opts,
                               const char *filename,
                               const char *fmt, int flags, bool writethrough,
@@ -XXX,XX +XXX,XX @@ static BlockBackend *img_open(bool image_opts,
         blk = img_open_opts(filename, opts, flags, writethrough, quiet,
                             force_share);
     } else {
-        blk = img_open_file(filename, fmt, flags, writethrough, quiet,
+        blk = img_open_file(filename, NULL, fmt, flags, writethrough, quiet,
                             force_share);
     }
     return blk;
@@ -XXX,XX +XXX,XX @@ static int img_convert(int argc, char **argv)
          * That has to wait for bdrv_create to be improved
          * to allow filenames in option syntax
          */
-        s.target = img_open_file(out_filename, out_fmt, flags,
-                                 writethrough, quiet, false);
+        s.target = img_open_new_file(out_filename, opts, out_fmt,
+                                     flags, writethrough, quiet, false);
     }
     if (!s.target) {
         ret = -1;
@@ -XXX,XX +XXX,XX @@ static int img_dd(int argc, char **argv)
      * with the bdrv_create() call above which does not
      * support image-opts style.
      */
-    blk2 = img_open_file(out.filename, out_fmt, BDRV_O_RDWR,
+    blk2 = img_open_file(out.filename, NULL, out_fmt, BDRV_O_RDWR,
                          false, false, false);
 
     if (!blk2) {
-- 
1.8.3.1

From: Eric Blake <eblake@redhat.com>

When converting a 1.1 image down to 0.10, qemu-iotests 060 forces
a contrived failure where allocating a cluster used to replace a
zero cluster reads unaligned data.  Since it is a zero cluster
rather than a data cluster being converted, changing the error
message to match our earlier change in 'qcow2: Make distinction
between zero cluster types obvious' is worthwhile.

Suggested-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
Message-id: 20170508171302.17805-1-eblake@redhat.com
[mreitz: Commit message fixes]
Signed-off-by: Max Reitz <mreitz@redhat.com>
---
 block/qcow2-cluster.c      | 3 ++-
 tests/qemu-iotests/060.out | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
index XXXXXXX..XXXXXXX 100644
--- a/block/qcow2-cluster.c
+++ b/block/qcow2-cluster.c
@@ -XXX,XX +XXX,XX @@ static int expand_zero_clusters_in_l1(BlockDriverState *bs, uint64_t *l1_table,
             }
 
             if (offset_into_cluster(s, offset)) {
-                qcow2_signal_corruption(bs, true, -1, -1, "Data cluster offset "
+                qcow2_signal_corruption(bs, true, -1, -1,
+                                        "Cluster allocation offset "
                                         "%#" PRIx64 " unaligned (L2 offset: %#"
                                         PRIx64 ", L2 index: %#x)", offset,
                                         l2_offset, j);
diff --git a/tests/qemu-iotests/060.out b/tests/qemu-iotests/060.out
index XXXXXXX..XXXXXXX 100644
--- a/tests/qemu-iotests/060.out
+++ b/tests/qemu-iotests/060.out
@@ -XXX,XX +XXX,XX @@ read failed: Input/output error
 Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
 wrote 65536/65536 bytes at offset 0
 64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-qcow2: Marking image as corrupt: Data cluster offset 0x52a00 unaligned (L2 offset: 0x40000, L2 index: 0); further corruption events will be suppressed
+qcow2: Marking image as corrupt: Cluster allocation offset 0x52a00 unaligned (L2 offset: 0x40000, L2 index: 0); further corruption events will be suppressed
 qemu-img: Error while amending options: Input/output error
 
 === Testing unaligned reftable entry ===
-- 
1.8.3.1

From: Max Reitz <mreitz@redhat.com>

path_combine() naturally tries to preserve a protocol prefix. However,
it recognizes such a prefix by scanning for the first colon; which is
different from what path_has_protocol() does: There only is a protocol
prefix if there is a colon before the first slash.

A protocol prefix that is not recognized by path_has_protocol() is none,
and should thus not be taken as one.

Case in point, before this patch:
$ ./qemu-img create -f qcow2 -b backing.qcow2 ./top:image.qcow2
qemu-img: ./top:image.qcow2: Could not open './top:backing.qcow2':
    No such file or directory

Afterwards:
$ ./qemu-img create -f qcow2 -b backing.qcow2 ./top:image.qcow2
qemu-img: ./top:image.qcow2: Could not open './backing.qcow2':
    No such file or directory

Reported-by: yangyang <yangyang@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id: 20170522195217.12991-2-mreitz@redhat.com
Signed-off-by: Max Reitz <mreitz@redhat.com>
---
 block.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/block.c b/block.c
index XXXXXXX..XXXXXXX 100644
--- a/block.c
+++ b/block.c
@@ -XXX,XX +XXX,XX @@ void path_combine(char *dest, int dest_size,
     if (path_is_absolute(filename)) {
         pstrcpy(dest, dest_size, filename);
     } else {
-        p = strchr(base_path, ':');
-        if (p)
-            p++;
-        else
-            p = base_path;
+        const char *protocol_stripped = NULL;
+
+        if (path_has_protocol(base_path)) {
+            protocol_stripped = strchr(base_path, ':');
+            if (protocol_stripped) {
+                protocol_stripped++;
+            }
+        }
+        p = protocol_stripped ?: base_path;
+
         p1 = strrchr(base_path, '/');
 #ifdef _WIN32
         {
-- 
1.8.3.1

From: Max Reitz <mreitz@redhat.com>

The file drivers' *_parse_filename() implementations just strip the
optional protocol prefix off the filename. However, for e.g.
"file:foo:bar", this would lead to "foo:bar" being stored as the BDS's
filename which looks like it should be managed using the "foo" protocol.
This is especially troublesome if you then try to resolve a backing
filename based on "foo:bar".

This issue can only occur if the stripped part is a relative filename
("file:/foo:bar" will be shortened to "/foo:bar" and having a slash
before the first colon means that "/foo" is not recognized as a protocol
part). Therefore, we can easily fix it by prepending "./" to such
filenames.

Before this patch:
$ ./qemu-img create -f qcow2 backing.qcow2 64M
Formatting 'backing.qcow2', fmt=qcow2 size=67108864 encryption=off
    cluster_size=65536 lazy_refcounts=off refcount_bits=16
$ ./qemu-img create -f qcow2 -b backing.qcow2 file:top:image.qcow2
Formatting 'file:top:image.qcow2', fmt=qcow2 size=67108864
    backing_file=backing.qcow2 encryption=off cluster_size=65536
    lazy_refcounts=off refcount_bits=16
$ ./qemu-io file:top:image.qcow2
can't open device file:top:image.qcow2: Could not open backing file:
    Unknown protocol 'top'

After this patch:
$ ./qemu-io file:top:image.qcow2
[no error]

Signed-off-by: Max Reitz <mreitz@redhat.com>
Message-id: 20170522195217.12991-3-mreitz@redhat.com
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
---
 block.c                   | 35 +++++++++++++++++++++++++++++++++++
 block/file-posix.c        | 17 +++--------------
 block/file-win32.c        | 12 ++----------
 include/block/block_int.h |  3 +++
 4 files changed, 43 insertions(+), 24 deletions(-)

diff --git a/block.c b/block.c
index XXXXXXX..XXXXXXX 100644
--- a/block.c
+++ b/block.c
@@ -XXX,XX +XXX,XX @@ void path_combine(char *dest, int dest_size,
     }
 }
 
+/*
+ * Helper function for bdrv_parse_filename() implementations to remove optional
+ * protocol prefixes (especially "file:") from a filename and for putting the
+ * stripped filename into the options QDict if there is such a prefix.
+ */
+void bdrv_parse_filename_strip_prefix(const char *filename, const char *prefix,
+                                      QDict *options)
+{
+    if (strstart(filename, prefix, &filename)) {
+        /* Stripping the explicit protocol prefix may result in a protocol
+         * prefix being (wrongly) detected (if the filename contains a colon) */
+        if (path_has_protocol(filename)) {
+            QString *fat_filename;
+
+            /* This means there is some colon before the first slash; therefore,
+             * this cannot be an absolute path */
+            assert(!path_is_absolute(filename));
+
+            /* And we can thus fix the protocol detection issue by prefixing it
+             * by "./" */
+            fat_filename = qstring_from_str("./");
+            qstring_append(fat_filename, filename);
+
+            assert(!path_has_protocol(qstring_get_str(fat_filename)));
+
+            qdict_put(options, "filename", fat_filename);
+        } else {
+            /* If no protocol prefix was detected, we can use the shortened
+             * filename as-is */
+            qdict_put_str(options, "filename", filename);
+        }
+    }
+}
+
+
 /* Returns whether the image file is opened as read-only. Note that this can
  * return false and writing to the image file is still not possible because the
  * image is inactivated. */
diff --git a/block/file-posix.c b/block/file-posix.c
index XXXXXXX..XXXXXXX 100644
--- a/block/file-posix.c
+++ b/block/file-posix.c
@@ -XXX,XX +XXX,XX @@ static void raw_parse_flags(int bdrv_flags, int *open_flags)
 static void raw_parse_filename(const char *filename, QDict *options,
                                Error **errp)
 {
-    /* The filename does not have to be prefixed by the protocol name, since
-     * "file" is the default protocol; therefore, the return value of this
-     * function call can be ignored. */
-    strstart(filename, "file:", &filename);
-
-    qdict_put_str(options, "filename", filename);
+    bdrv_parse_filename_strip_prefix(filename, "file:", options);
 }
 
 static QemuOptsList raw_runtime_opts = {
@@ -XXX,XX +XXX,XX @@ static int check_hdev_writable(BDRVRawState *s)
 static void hdev_parse_filename(const char *filename, QDict *options,
                                 Error **errp)
 {
-    /* The prefix is optional, just as for "file". */
-    strstart(filename, "host_device:", &filename);
-
-    qdict_put_str(options, "filename", filename);
+    bdrv_parse_filename_strip_prefix(filename, "host_device:", options);
 }
 
 static bool hdev_is_sg(BlockDriverState *bs)
@@ -XXX,XX +XXX,XX @@ static BlockDriver bdrv_host_device = {
 static void cdrom_parse_filename(const char *filename, QDict *options,
                                  Error **errp)
 {
-    /* The prefix is optional, just as for "file". */
-    strstart(filename, "host_cdrom:", &filename);
-
-    qdict_put_str(options, "filename", filename);
+    bdrv_parse_filename_strip_prefix(filename, "host_cdrom:", options);
 }
 #endif
 
diff --git a/block/file-win32.c b/block/file-win32.c
index XXXXXXX..XXXXXXX 100644
--- a/block/file-win32.c
+++ b/block/file-win32.c
@@ -XXX,XX +XXX,XX @@ static void raw_parse_flags(int flags, bool use_aio, int *access_flags,
 static void raw_parse_filename(const char *filename, QDict *options,
                                Error **errp)
 {
-    /* The filename does not have to be prefixed by the protocol name, since
-     * "file" is the default protocol; therefore, the return value of this
-     * function call can be ignored. */
-    strstart(filename, "file:", &filename);
-
-    qdict_put_str(options, "filename", filename);
+    bdrv_parse_filename_strip_prefix(filename, "file:", options);
 }
 
 static QemuOptsList raw_runtime_opts = {
@@ -XXX,XX +XXX,XX @@ static int hdev_probe_device(const char *filename)
 static void hdev_parse_filename(const char *filename, QDict *options,
                                 Error **errp)
 {
-    /* The prefix is optional, just as for "file". */
-    strstart(filename, "host_device:", &filename);
-
-    qdict_put_str(options, "filename", filename);
+    bdrv_parse_filename_strip_prefix(filename, "host_device:", options);
 }
 
 static int hdev_open(BlockDriverState *bs, QDict *options, int flags,
diff --git a/include/block/block_int.h b/include/block/block_int.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/block_int.h
+++ b/include/block/block_int.h
@@ -XXX,XX +XXX,XX @@ int get_tmp_filename(char *filename, int size);
 BlockDriver *bdrv_probe_all(const uint8_t *buf, int buf_size,
                             const char *filename);
 
+void bdrv_parse_filename_strip_prefix(const char *filename, const char *prefix,
+                                      QDict *options);
+
 
 /**
  * bdrv_add_before_write_notifier:
-- 
1.8.3.1

The following changes since commit 825b96dbcee23d134b691fc75618b59c5f53da32:

Merge tag 'migration-20250310-pull-request' of https://gitlab.com/farosas/qemu into staging (2025-03-11 09:32:07 +0800)

are available in the Git repository at:

https://repo.or.cz/qemu/kevin.git tags/for-upstream

for you to fetch changes up to a93c04f3cbe690877b3297a9df4767aa811fcd97:

virtio-scsi: only expose cmd vqs via iothread-vq-mapping (2025-03-11 15:49:22 +0100)

----------------------------------------------------------------
Block layer patches

- virtio-scsi: add iothread-vq-mapping parameter
- Improve writethrough performance
- Fix missing zero init in bdrv_snapshot_goto()
- Code cleanup and iotests fixes

----------------------------------------------------------------
Kevin Wolf (8):
      block: Remove unused blk_op_is_blocked()
      block: Zero block driver state before reopening
      file-posix: Support FUA writes
      block/io: Ignore FUA with cache.no-flush=on
      aio: Create AioPolledEvent
      aio-posix: Factor out adjust_polling_time()
      aio-posix: Separate AioPolledEvent per AioHandler
      aio-posix: Adjust polling time also for new handlers

Stefan Hajnoczi (13):
      scsi-disk: drop unused SCSIDiskState->bh field
      dma: use current AioContext for dma_blk_io()
      scsi: track per-SCSIRequest AioContext
      scsi: introduce requests_lock
      virtio-scsi: introduce event and ctrl virtqueue locks
      virtio-scsi: protect events_dropped field
      virtio-scsi: perform TMFs in appropriate AioContexts
      virtio-blk: extract cleanup_iothread_vq_mapping() function
      virtio-blk: tidy up iothread_vq_mapping functions
      virtio: extract iothread-vq-mapping.h API
      virtio-scsi: add iothread-vq-mapping parameter
      virtio-scsi: handle ctrl virtqueue in main loop
      virtio-scsi: only expose cmd vqs via iothread-vq-mapping

Thomas Huth (1):
      iotests: Limit qsd-migrate to working formats

Commit fc4e394b28 removed the last caller of blk_op_is_blocked(). Remove
the now unused function.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20250206165331.379033-1-kwolf@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/system/block-backend-global-state.h |  1 -
 block/block-backend.c                       | 12 ------------
 2 files changed, 13 deletions(-)

diff --git a/include/system/block-backend-global-state.h b/include/system/block-backend-global-state.h
index XXXXXXX..XXXXXXX 100644
--- a/include/system/block-backend-global-state.h
+++ b/include/system/block-backend-global-state.h
@@ -XXX,XX +XXX,XX @@ bool blk_supports_write_perm(BlockBackend *blk);
 bool blk_is_sg(BlockBackend *blk);
 void blk_set_enable_write_cache(BlockBackend *blk, bool wce);
 int blk_get_flags(BlockBackend *blk);
-bool blk_op_is_blocked(BlockBackend *blk, BlockOpType op, Error **errp);
 int blk_set_aio_context(BlockBackend *blk, AioContext *new_context,
                         Error **errp);
 void blk_add_aio_context_notifier(BlockBackend *blk,
diff --git a/block/block-backend.c b/block/block-backend.c
index XXXXXXX..XXXXXXX 100644
--- a/block/block-backend.c
+++ b/block/block-backend.c
@@ -XXX,XX +XXX,XX @@ void *blk_blockalign(BlockBackend *blk, size_t size)
     return qemu_blockalign(blk ? blk_bs(blk) : NULL, size);
 }
 
-bool blk_op_is_blocked(BlockBackend *blk, BlockOpType op, Error **errp)
-{
-    BlockDriverState *bs = blk_bs(blk);
-    GLOBAL_STATE_CODE();
-    GRAPH_RDLOCK_GUARD_MAINLOOP();
-
-    if (!bs) {
-        return false;
-    }
-
-    return bdrv_op_is_blocked(bs, op, errp);
-}
 
 /**
  * Return BB's current AioContext.  Note that this context may change
-- 
2.48.1

Block drivers assume in their .bdrv_open() implementation that their
state in bs->opaque has been zeroed; it is initially allocated with
g_malloc0() in bdrv_open_driver().

bdrv_snapshot_goto() needs to make sure that it is zeroed again before
calling drv->bdrv_open() to avoid that block drivers use stale values.

One symptom of this bug is VMDK running into a double free when the user
tries to apply an internal snapshot like 'qemu-img snapshot -a test
test.vmdk'. This should be a graceful error because VMDK doesn't support
internal snapshots.

==25507== Invalid free() / delete / delete[] / realloc()
==25507==    at 0x484B347: realloc (vg_replace_malloc.c:1801)
==25507==    by 0x54B592A: g_realloc (gmem.c:171)
==25507==    by 0x1B221D: vmdk_add_extent (../block/vmdk.c:570)
==25507==    by 0x1B1084: vmdk_open_sparse (../block/vmdk.c:1059)
==25507==    by 0x1AF3D8: vmdk_open (../block/vmdk.c:1371)
==25507==    by 0x1A2AE0: bdrv_snapshot_goto (../block/snapshot.c:299)
==25507==    by 0x205C77: img_snapshot (../qemu-img.c:3500)
==25507==    by 0x58FA087: (below main) (libc_start_call_main.h:58)
==25507==  Address 0x832f3e0 is 0 bytes inside a block of size 272 free'd
==25507==    at 0x4846B83: free (vg_replace_malloc.c:989)
==25507==    by 0x54AEAC4: g_free (gmem.c:208)
==25507==    by 0x1AF629: vmdk_close (../block/vmdk.c:2889)
==25507==    by 0x1A2A9C: bdrv_snapshot_goto (../block/snapshot.c:290)
==25507==    by 0x205C77: img_snapshot (../qemu-img.c:3500)
==25507==    by 0x58FA087: (below main) (libc_start_call_main.h:58)

This error was discovered by fuzzing qemu-img.

Cc: qemu-stable@nongnu.org
Closes: https://gitlab.com/qemu-project/qemu/-/issues/2853
Closes: https://gitlab.com/qemu-project/qemu/-/issues/2851
Reported-by: Denis Rastyogin <gerben@altlinux.org>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20250310104858.28221-1-kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/snapshot.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/block/snapshot.c b/block/snapshot.c
index XXXXXXX..XXXXXXX 100644
--- a/block/snapshot.c
+++ b/block/snapshot.c
@@ -XXX,XX +XXX,XX @@ int bdrv_snapshot_goto(BlockDriverState *bs,
         bdrv_graph_wrunlock();
 
         ret = bdrv_snapshot_goto(fallback_bs, snapshot_id, errp);
+        memset(bs->opaque, 0, drv->instance_size);
         open_ret = drv->bdrv_open(bs, options, bs->open_flags, &local_err);
         qobject_unref(options);
         if (open_ret < 0) {
-- 
2.48.1

Until now, FUA was always emulated with a separate flush after the write
for file-posix. The overhead of processing a second request can reduce
performance significantly for a guest disk that has disabled the write
cache, especially if the host disk is already write through, too, and
the flush isn't actually doing anything.

Advertise support for REQ_FUA in write requests and implement it for
Linux AIO and io_uring using the RWF_DSYNC flag for write requests. The
thread pool still performs a separate fdatasync() call. This can be
improved later by using the pwritev2() syscall if available.

As an example, this is how fio numbers can be improved in some scenarios
with this patch (all using virtio-blk with cache=directsync on an nvme
block device for the VM, fio with ioengine=libaio,direct=1,sync=1):

However, not all scenarios are clear wins. On another slower disk I saw
little to no improvment. In fact, in two corner case scenarios, I even
observed a regression, which I however consider acceptable:

1. On slow host disks in a write through cache mode, when the guest is
   using virtio-blk in a separate iothread so that polling can be
   enabled, and each completion is quickly followed up with a new
   request (so that polling gets it), it can happen that enabling FUA
   makes things slower - the additional very fast no-op flush we used to
   have gave the adaptive polling algorithm a success so that it kept
   polling. Without it, we only have the slow write request, which
   disables polling. This is a problem in the polling algorithm that
   will be fixed later in this series.

2. With a high queue depth, it can be beneficial to have flush requests
   for another reason: The optimisation in bdrv_co_flush() that flushes
   only once per write generation acts as a synchronisation mechanism
   that lets all requests complete at the same time. This can result in
   better batching and if the disk is very fast (I only saw this with a
   null_blk backend), this can make up for the overhead of the flush and
   improve throughput. In theory, we could optionally introduce a
   similar artificial latency in the normal completion path to achieve
   the same kind of completion batching. This is not implemented in this
   series.

Compatibility is not a concern for io_uring, it has supported RWF_DSYNC
from the start. Linux AIO started supporting it in Linux 4.13 and libaio
0.3.111. The kernel is not a problem for any supported build platform,
so it's not necessary to add runtime checks. However, openSUSE is still
stuck with an older libaio version that would break the build. We must
detect this at build time to avoid build failures.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20250307221634.71951-2-kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/block/raw-aio.h |  8 ++++++--
 block/file-posix.c      | 26 ++++++++++++++++++--------
 block/io_uring.c        | 13 ++++++++-----
 block/linux-aio.c       | 24 +++++++++++++++++++++---
 meson.build             |  4 ++++
 5 files changed, 57 insertions(+), 18 deletions(-)

diff --git a/include/block/raw-aio.h b/include/block/raw-aio.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/raw-aio.h
+++ b/include/block/raw-aio.h
@@ -XXX,XX +XXX,XX @@
 #define QEMU_RAW_AIO_H
 
 #include "block/aio.h"
+#include "block/block-common.h"
 #include "qemu/iov.h"
 
 /* AIO request types */
@@ -XXX,XX +XXX,XX @@ void laio_cleanup(LinuxAioState *s);
 
 /* laio_co_submit: submit I/O requests in the thread's current AioContext. */
 int coroutine_fn laio_co_submit(int fd, uint64_t offset, QEMUIOVector *qiov,
-                                int type, uint64_t dev_max_batch);
+                                int type, BdrvRequestFlags flags,
+                                uint64_t dev_max_batch);
 
 bool laio_has_fdsync(int);
+bool laio_has_fua(void);
 void laio_detach_aio_context(LinuxAioState *s, AioContext *old_context);
 void laio_attach_aio_context(LinuxAioState *s, AioContext *new_context);
 #endif
@@ -XXX,XX +XXX,XX @@ void luring_cleanup(LuringState *s);
 
 /* luring_co_submit: submit I/O requests in the thread's current AioContext. */
 int coroutine_fn luring_co_submit(BlockDriverState *bs, int fd, uint64_t offset,
-                                  QEMUIOVector *qiov, int type);
+                                  QEMUIOVector *qiov, int type,
+                                  BdrvRequestFlags flags);
 void luring_detach_aio_context(LuringState *s, AioContext *old_context);
 void luring_attach_aio_context(LuringState *s, AioContext *new_context);
 #endif
diff --git a/block/file-posix.c b/block/file-posix.c
index XXXXXXX..XXXXXXX 100644
--- a/block/file-posix.c
+++ b/block/file-posix.c
@@ -XXX,XX +XXX,XX @@ static int fd_open(BlockDriverState *bs)
 }
 
 static int64_t raw_getlength(BlockDriverState *bs);
+static int coroutine_fn raw_co_flush_to_disk(BlockDriverState *bs);
 
 typedef struct RawPosixAIOData {
     BlockDriverState *bs;
@@ -XXX,XX +XXX,XX @@ static int raw_open_common(BlockDriverState *bs, QDict *options,
 #endif
     s->needs_alignment = raw_needs_alignment(bs);
 
+    if (!s->use_linux_aio || laio_has_fua()) {
+        bs->supported_write_flags = BDRV_REQ_FUA;
+    }
+
     bs->supported_zero_flags = BDRV_REQ_MAY_UNMAP | BDRV_REQ_NO_FALLBACK;
     if (S_ISREG(st.st_mode)) {
         /* When extending regular files, we get zeros from the OS */
@@ -XXX,XX +XXX,XX @@ static inline bool raw_check_linux_aio(BDRVRawState *s)
 #endif
 
 static int coroutine_fn raw_co_prw(BlockDriverState *bs, int64_t *offset_ptr,
-                                   uint64_t bytes, QEMUIOVector *qiov, int type)
+                                   uint64_t bytes, QEMUIOVector *qiov, int type,
+                                   int flags)
 {
     BDRVRawState *s = bs->opaque;
     RawPosixAIOData acb;
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn raw_co_prw(BlockDriverState *bs, int64_t *offset_ptr,
 #ifdef CONFIG_LINUX_IO_URING
     } else if (raw_check_linux_io_uring(s)) {
         assert(qiov->size == bytes);
-        ret = luring_co_submit(bs, s->fd, offset, qiov, type);
+        ret = luring_co_submit(bs, s->fd, offset, qiov, type, flags);
         goto out;
 #endif
 #ifdef CONFIG_LINUX_AIO
     } else if (raw_check_linux_aio(s)) {
         assert(qiov->size == bytes);
-        ret = laio_co_submit(s->fd, offset, qiov, type,
+        ret = laio_co_submit(s->fd, offset, qiov, type, flags,
                               s->aio_max_batch);
         goto out;
 #endif
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn raw_co_prw(BlockDriverState *bs, int64_t *offset_ptr,
 
     assert(qiov->size == bytes);
     ret = raw_thread_pool_submit(handle_aiocb_rw, &acb);
+    if (ret == 0 && (flags & BDRV_REQ_FUA)) {
+        /* TODO Use pwritev2() instead if it's available */
+        ret = raw_co_flush_to_disk(bs);
+    }
     goto out; /* Avoid the compiler err of unused label */
 
 out:
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn raw_co_preadv(BlockDriverState *bs, int64_t offset,
                                       int64_t bytes, QEMUIOVector *qiov,
                                       BdrvRequestFlags flags)
 {
-    return raw_co_prw(bs, &offset, bytes, qiov, QEMU_AIO_READ);
+    return raw_co_prw(bs, &offset, bytes, qiov, QEMU_AIO_READ, flags);
 }
 
 static int coroutine_fn raw_co_pwritev(BlockDriverState *bs, int64_t offset,
                                        int64_t bytes, QEMUIOVector *qiov,
                                        BdrvRequestFlags flags)
 {
-    return raw_co_prw(bs, &offset, bytes, qiov, QEMU_AIO_WRITE);
+    return raw_co_prw(bs, &offset, bytes, qiov, QEMU_AIO_WRITE, flags);
 }
 
 static int coroutine_fn raw_co_flush_to_disk(BlockDriverState *bs)
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn raw_co_flush_to_disk(BlockDriverState *bs)
 
 #ifdef CONFIG_LINUX_IO_URING
     if (raw_check_linux_io_uring(s)) {
-        return luring_co_submit(bs, s->fd, 0, NULL, QEMU_AIO_FLUSH);
+        return luring_co_submit(bs, s->fd, 0, NULL, QEMU_AIO_FLUSH, 0);
     }
 #endif
 #ifdef CONFIG_LINUX_AIO
     if (s->has_laio_fdsync && raw_check_linux_aio(s)) {
-        return laio_co_submit(s->fd, 0, NULL, QEMU_AIO_FLUSH, 0);
+        return laio_co_submit(s->fd, 0, NULL, QEMU_AIO_FLUSH, 0, 0);
     }
 #endif
     return raw_thread_pool_submit(handle_aiocb_flush, &acb);
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn raw_co_zone_append(BlockDriverState *bs,
     }
 
     trace_zbd_zone_append(bs, *offset >> BDRV_SECTOR_BITS);
-    return raw_co_prw(bs, offset, len, qiov, QEMU_AIO_ZONE_APPEND);
+    return raw_co_prw(bs, offset, len, qiov, QEMU_AIO_ZONE_APPEND, 0);
 }
 #endif
 
diff --git a/block/io_uring.c b/block/io_uring.c
index XXXXXXX..XXXXXXX 100644
--- a/block/io_uring.c
+++ b/block/io_uring.c
@@ -XXX,XX +XXX,XX @@ static void luring_deferred_fn(void *opaque)
  *
  */
 static int luring_do_submit(int fd, LuringAIOCB *luringcb, LuringState *s,
-                            uint64_t offset, int type)
+                            uint64_t offset, int type, BdrvRequestFlags flags)
 {
     int ret;
     struct io_uring_sqe *sqes = &luringcb->sqeq;
+    int luring_flags;
 
     switch (type) {
     case QEMU_AIO_WRITE:
-        io_uring_prep_writev(sqes, fd, luringcb->qiov->iov,
-                             luringcb->qiov->niov, offset);
+        luring_flags = (flags & BDRV_REQ_FUA) ? RWF_DSYNC : 0;
+        io_uring_prep_writev2(sqes, fd, luringcb->qiov->iov,
+                              luringcb->qiov->niov, offset, luring_flags);
         break;
     case QEMU_AIO_ZONE_APPEND:
         io_uring_prep_writev(sqes, fd, luringcb->qiov->iov,
@@ -XXX,XX +XXX,XX @@ static int luring_do_submit(int fd, LuringAIOCB *luringcb, LuringState *s,
 }
 
 int coroutine_fn luring_co_submit(BlockDriverState *bs, int fd, uint64_t offset,
-                                  QEMUIOVector *qiov, int type)
+                                  QEMUIOVector *qiov, int type,
+                                  BdrvRequestFlags flags)
 {
     int ret;
     AioContext *ctx = qemu_get_current_aio_context();
@@ -XXX,XX +XXX,XX @@ int coroutine_fn luring_co_submit(BlockDriverState *bs, int fd, uint64_t offset,
     };
     trace_luring_co_submit(bs, s, &luringcb, fd, offset, qiov ? qiov->size : 0,
                            type);
-    ret = luring_do_submit(fd, &luringcb, s, offset, type);
+    ret = luring_do_submit(fd, &luringcb, s, offset, type, flags);
 
     if (ret < 0) {
         return ret;
diff --git a/block/linux-aio.c b/block/linux-aio.c
index XXXXXXX..XXXXXXX 100644
--- a/block/linux-aio.c
+++ b/block/linux-aio.c
@@ -XXX,XX +XXX,XX @@ static void laio_deferred_fn(void *opaque)
 }
 
 static int laio_do_submit(int fd, struct qemu_laiocb *laiocb, off_t offset,
-                          int type, uint64_t dev_max_batch)
+                          int type, BdrvRequestFlags flags,
+                          uint64_t dev_max_batch)
 {
     LinuxAioState *s = laiocb->ctx;
     struct iocb *iocbs = &laiocb->iocb;
     QEMUIOVector *qiov = laiocb->qiov;
+    int laio_flags;
 
     switch (type) {
     case QEMU_AIO_WRITE:
+#ifdef HAVE_IO_PREP_PWRITEV2
+        laio_flags = (flags & BDRV_REQ_FUA) ? RWF_DSYNC : 0;
+        io_prep_pwritev2(iocbs, fd, qiov->iov, qiov->niov, offset, laio_flags);
+#else
+        assert(flags == 0);
         io_prep_pwritev(iocbs, fd, qiov->iov, qiov->niov, offset);
+#endif
         break;
     case QEMU_AIO_ZONE_APPEND:
         io_prep_pwritev(iocbs, fd, qiov->iov, qiov->niov, offset);
@@ -XXX,XX +XXX,XX @@ static int laio_do_submit(int fd, struct qemu_laiocb *laiocb, off_t offset,
 }
 
 int coroutine_fn laio_co_submit(int fd, uint64_t offset, QEMUIOVector *qiov,
-                                int type, uint64_t dev_max_batch)
+                                int type, BdrvRequestFlags flags,
+                                uint64_t dev_max_batch)
 {
     int ret;
     AioContext *ctx = qemu_get_current_aio_context();
@@ -XXX,XX +XXX,XX @@ int coroutine_fn laio_co_submit(int fd, uint64_t offset, QEMUIOVector *qiov,
         .qiov       = qiov,
     };
 
-    ret = laio_do_submit(fd, &laiocb, offset, type, dev_max_batch);
+    ret = laio_do_submit(fd, &laiocb, offset, type, flags, dev_max_batch);
     if (ret < 0) {
         return ret;
     }
@@ -XXX,XX +XXX,XX @@ bool laio_has_fdsync(int fd)
     io_destroy(ctx);
     return (ret == -EINVAL) ? false : true;
 }
+
+bool laio_has_fua(void)
+{
+#ifdef HAVE_IO_PREP_PWRITEV2
+    return true;
+#else
+    return false;
+#endif
+}
diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ config_host_data.set('HAVE_OPTRESET',
                      cc.has_header_symbol('getopt.h', 'optreset'))
 config_host_data.set('HAVE_IPPROTO_MPTCP',
                      cc.has_header_symbol('netinet/in.h', 'IPPROTO_MPTCP'))
+if libaio.found()
+  config_host_data.set('HAVE_IO_PREP_PWRITEV2',
+                       cc.has_header_symbol('libaio.h', 'io_prep_pwritev2'))
+endif
 
 # has_member
 config_host_data.set('HAVE_SIGEV_NOTIFY_THREAD_ID',
-- 
2.48.1

For block drivers that don't advertise FUA support, we already call
bdrv_co_flush(), which considers BDRV_O_NO_FLUSH. However, drivers that
do support FUA still see the FUA flag with BDRV_O_NO_FLUSH and get the
associated performance penalty that cache.no-flush=on was supposed to
avoid.

Clear FUA for write requests if BDRV_O_NO_FLUSH is set.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20250307221634.71951-3-kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/io.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/block/io.c b/block/io.c
index XXXXXXX..XXXXXXX 100644
--- a/block/io.c
+++ b/block/io.c
@@ -XXX,XX +XXX,XX @@ bdrv_driver_pwritev(BlockDriverState *bs, int64_t offset, int64_t bytes,
         return -ENOMEDIUM;
     }
 
+    if (bs->open_flags & BDRV_O_NO_FLUSH) {
+        flags &= ~BDRV_REQ_FUA;
+    }
+
     if ((flags & BDRV_REQ_FUA) &&
         (~bs->supported_write_flags & BDRV_REQ_FUA)) {
         flags &= ~BDRV_REQ_FUA;
-- 
2.48.1

As a preparation for having multiple adaptive polling states per
AioContext, move the 'ns' field into a separate struct.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20250307221634.71951-4-kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/block/aio.h |  6 +++++-
 util/aio-posix.c    | 31 ++++++++++++++++---------------
 util/async.c        |  3 ++-
 3 files changed, 23 insertions(+), 17 deletions(-)

diff --git a/include/block/aio.h b/include/block/aio.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/aio.h
+++ b/include/block/aio.h
@@ -XXX,XX +XXX,XX @@ struct BHListSlice {
 
 typedef QSLIST_HEAD(, AioHandler) AioHandlerSList;
 
+typedef struct AioPolledEvent {
+    int64_t ns;        /* current polling time in nanoseconds */
+} AioPolledEvent;
+
 struct AioContext {
     GSource source;
 
@@ -XXX,XX +XXX,XX @@ struct AioContext {
     int poll_disable_cnt;
 
     /* Polling mode parameters */
-    int64_t poll_ns;        /* current polling time in nanoseconds */
+    AioPolledEvent poll;
     int64_t poll_max_ns;    /* maximum polling time in nanoseconds */
     int64_t poll_grow;      /* polling time growth factor */
     int64_t poll_shrink;    /* polling time shrink factor */
diff --git a/util/aio-posix.c b/util/aio-posix.c
index XXXXXXX..XXXXXXX 100644
--- a/util/aio-posix.c
+++ b/util/aio-posix.c
@@ -XXX,XX +XXX,XX @@ static bool try_poll_mode(AioContext *ctx, AioHandlerList *ready_list,
         return false;
     }
 
-    max_ns = qemu_soonest_timeout(*timeout, ctx->poll_ns);
+    max_ns = qemu_soonest_timeout(*timeout, ctx->poll.ns);
     if (max_ns && !ctx->fdmon_ops->need_wait(ctx)) {
         /*
          * Enable poll mode. It pairs with the poll_set_started() in
@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
     if (ctx->poll_max_ns) {
         int64_t block_ns = qemu_clock_get_ns(QEMU_CLOCK_REALTIME) - start;
 
-        if (block_ns <= ctx->poll_ns) {
+        if (block_ns <= ctx->poll.ns) {
             /* This is the sweet spot, no adjustment needed */
         } else if (block_ns > ctx->poll_max_ns) {
             /* We'd have to poll for too long, poll less */
-            int64_t old = ctx->poll_ns;
+            int64_t old = ctx->poll.ns;
 
             if (ctx->poll_shrink) {
-                ctx->poll_ns /= ctx->poll_shrink;
+                ctx->poll.ns /= ctx->poll_shrink;
             } else {
-                ctx->poll_ns = 0;
+                ctx->poll.ns = 0;
             }
 
-            trace_poll_shrink(ctx, old, ctx->poll_ns);
-        } else if (ctx->poll_ns < ctx->poll_max_ns &&
+            trace_poll_shrink(ctx, old, ctx->poll.ns);
+        } else if (ctx->poll.ns < ctx->poll_max_ns &&
                    block_ns < ctx->poll_max_ns) {
             /* There is room to grow, poll longer */
-            int64_t old = ctx->poll_ns;
+            int64_t old = ctx->poll.ns;
             int64_t grow = ctx->poll_grow;
 
             if (grow == 0) {
                 grow = 2;
             }
 
-            if (ctx->poll_ns) {
-                ctx->poll_ns *= grow;
+            if (ctx->poll.ns) {
+                ctx->poll.ns *= grow;
             } else {
-                ctx->poll_ns = 4000; /* start polling at 4 microseconds */
+                ctx->poll.ns = 4000; /* start polling at 4 microseconds */
             }
 
-            if (ctx->poll_ns > ctx->poll_max_ns) {
-                ctx->poll_ns = ctx->poll_max_ns;
+            if (ctx->poll.ns > ctx->poll_max_ns) {
+                ctx->poll.ns = ctx->poll_max_ns;
             }
 
-            trace_poll_grow(ctx, old, ctx->poll_ns);
+            trace_poll_grow(ctx, old, ctx->poll.ns);
         }
     }
 
@@ -XXX,XX +XXX,XX @@ void aio_context_set_poll_params(AioContext *ctx, int64_t max_ns,
     /* No thread synchronization here, it doesn't matter if an incorrect value
      * is used once.
      */
+    ctx->poll.ns = 0;
+
     ctx->poll_max_ns = max_ns;
-    ctx->poll_ns = 0;
     ctx->poll_grow = grow;
     ctx->poll_shrink = shrink;
 
diff --git a/util/async.c b/util/async.c
index XXXXXXX..XXXXXXX 100644
--- a/util/async.c
+++ b/util/async.c
@@ -XXX,XX +XXX,XX @@ AioContext *aio_context_new(Error **errp)
     qemu_rec_mutex_init(&ctx->lock);
     timerlistgroup_init(&ctx->tlg, aio_timerlist_notify, ctx);
 
-    ctx->poll_ns = 0;
+    ctx->poll.ns = 0;
+
     ctx->poll_max_ns = 0;
     ctx->poll_grow = 0;
     ctx->poll_shrink = 0;
-- 
2.48.1

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20250307221634.71951-5-kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 util/aio-posix.c | 77 ++++++++++++++++++++++++++----------------------
 1 file changed, 41 insertions(+), 36 deletions(-)

diff --git a/util/aio-posix.c b/util/aio-posix.c
index XXXXXXX..XXXXXXX 100644
--- a/util/aio-posix.c
+++ b/util/aio-posix.c
@@ -XXX,XX +XXX,XX @@ static bool try_poll_mode(AioContext *ctx, AioHandlerList *ready_list,
     return false;
 }
 
+static void adjust_polling_time(AioContext *ctx, AioPolledEvent *poll,
+                                int64_t block_ns)
+{
+    if (block_ns <= poll->ns) {
+        /* This is the sweet spot, no adjustment needed */
+    } else if (block_ns > ctx->poll_max_ns) {
+        /* We'd have to poll for too long, poll less */
+        int64_t old = poll->ns;
+
+        if (ctx->poll_shrink) {
+            poll->ns /= ctx->poll_shrink;
+        } else {
+            poll->ns = 0;
+        }
+
+        trace_poll_shrink(ctx, old, poll->ns);
+    } else if (poll->ns < ctx->poll_max_ns &&
+               block_ns < ctx->poll_max_ns) {
+        /* There is room to grow, poll longer */
+        int64_t old = poll->ns;
+        int64_t grow = ctx->poll_grow;
+
+        if (grow == 0) {
+            grow = 2;
+        }
+
+        if (poll->ns) {
+            poll->ns *= grow;
+        } else {
+            poll->ns = 4000; /* start polling at 4 microseconds */
+        }
+
+        if (poll->ns > ctx->poll_max_ns) {
+            poll->ns = ctx->poll_max_ns;
+        }
+
+        trace_poll_grow(ctx, old, poll->ns);
+    }
+}
+
 bool aio_poll(AioContext *ctx, bool blocking)
 {
     AioHandlerList ready_list = QLIST_HEAD_INITIALIZER(ready_list);
@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
     /* Adjust polling time */
     if (ctx->poll_max_ns) {
         int64_t block_ns = qemu_clock_get_ns(QEMU_CLOCK_REALTIME) - start;
-
-        if (block_ns <= ctx->poll.ns) {
-            /* This is the sweet spot, no adjustment needed */
-        } else if (block_ns > ctx->poll_max_ns) {
-            /* We'd have to poll for too long, poll less */
-            int64_t old = ctx->poll.ns;
-
-            if (ctx->poll_shrink) {
-                ctx->poll.ns /= ctx->poll_shrink;
-            } else {
-                ctx->poll.ns = 0;
-            }
-
-            trace_poll_shrink(ctx, old, ctx->poll.ns);
-        } else if (ctx->poll.ns < ctx->poll_max_ns &&
-                   block_ns < ctx->poll_max_ns) {
-            /* There is room to grow, poll longer */
-            int64_t old = ctx->poll.ns;
-            int64_t grow = ctx->poll_grow;
-
-            if (grow == 0) {
-                grow = 2;
-            }
-
-            if (ctx->poll.ns) {
-                ctx->poll.ns *= grow;
-            } else {
-                ctx->poll.ns = 4000; /* start polling at 4 microseconds */
-            }
-
-            if (ctx->poll.ns > ctx->poll_max_ns) {
-                ctx->poll.ns = ctx->poll_max_ns;
-            }
-
-            trace_poll_grow(ctx, old, ctx->poll.ns);
-        }
+        adjust_polling_time(ctx, &ctx->poll, block_ns);
     }
 
     progress |= aio_bh_poll(ctx);
-- 
2.48.1

Adaptive polling has a big problem: It doesn't consider that an event
loop can wait for many different events that may have very different
typical latencies.

For example, think of a guest that tends to send a new I/O request soon
after the previous I/O request completes, but the storage on the host is
rather slow. In this case, getting the new request from guest quickly
means that polling is enabled, but the next thing is performing the I/O
request on the backend, which is slow and disables polling again for the
next guest request. This means that in such a scenario, polling could
help for every other event, but is only ever enabled when it can't
succeed.

In order to fix this, keep a separate AioPolledEvent for each
AioHandler. We will then know that the backend file descriptor always
has a high latency and isn't worth polling for, but we also know that
the guest is always fast and we should poll for it. This solves at least
half of the problem, we can now keep polling for those cases where it
makes sense and get the improved performance from it.

Since the event loop doesn't know which event will be next, we still do
some unnecessary polling while we're waiting for the slow disk. I made
some attempts to be more clever than just randomly growing and shrinking
the polling time, and even to let callers be explicit about when they
expect a new event, but so far this hasn't resulted in improved
performance or even caused performance regressions. For now, let's just
fix the part that is easy enough to fix, we can revisit the rest later.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20250307221634.71951-6-kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/block/aio.h |  1 -
 util/aio-posix.h    |  1 +
 util/aio-posix.c    | 26 ++++++++++++++++++++++----
 util/async.c        |  2 --
 4 files changed, 23 insertions(+), 7 deletions(-)

diff --git a/include/block/aio.h b/include/block/aio.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/aio.h
+++ b/include/block/aio.h
@@ -XXX,XX +XXX,XX @@ struct AioContext {
     int poll_disable_cnt;
 
     /* Polling mode parameters */
-    AioPolledEvent poll;
     int64_t poll_max_ns;    /* maximum polling time in nanoseconds */
     int64_t poll_grow;      /* polling time growth factor */
     int64_t poll_shrink;    /* polling time shrink factor */
diff --git a/util/aio-posix.h b/util/aio-posix.h
index XXXXXXX..XXXXXXX 100644
--- a/util/aio-posix.h
+++ b/util/aio-posix.h
@@ -XXX,XX +XXX,XX @@ struct AioHandler {
 #endif
     int64_t poll_idle_timeout; /* when to stop userspace polling */
     bool poll_ready; /* has polling detected an event? */
+    AioPolledEvent poll;
 };
 
 /* Add a handler to a ready list */
diff --git a/util/aio-posix.c b/util/aio-posix.c
index XXXXXXX..XXXXXXX 100644
--- a/util/aio-posix.c
+++ b/util/aio-posix.c
@@ -XXX,XX +XXX,XX @@ static bool run_poll_handlers(AioContext *ctx, AioHandlerList *ready_list,
 static bool try_poll_mode(AioContext *ctx, AioHandlerList *ready_list,
                           int64_t *timeout)
 {
+    AioHandler *node;
     int64_t max_ns;
 
     if (QLIST_EMPTY_RCU(&ctx->poll_aio_handlers)) {
         return false;
     }
 
-    max_ns = qemu_soonest_timeout(*timeout, ctx->poll.ns);
+    max_ns = 0;
+    QLIST_FOREACH(node, &ctx->poll_aio_handlers, node_poll) {
+        max_ns = MAX(max_ns, node->poll.ns);
+    }
+    max_ns = qemu_soonest_timeout(*timeout, max_ns);
+
     if (max_ns && !ctx->fdmon_ops->need_wait(ctx)) {
         /*
          * Enable poll mode. It pairs with the poll_set_started() in
@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
 
     /* Adjust polling time */
     if (ctx->poll_max_ns) {
+        AioHandler *node;
         int64_t block_ns = qemu_clock_get_ns(QEMU_CLOCK_REALTIME) - start;
-        adjust_polling_time(ctx, &ctx->poll, block_ns);
+
+        QLIST_FOREACH(node, &ctx->poll_aio_handlers, node_poll) {
+            if (QLIST_IS_INSERTED(node, node_ready)) {
+                adjust_polling_time(ctx, &node->poll, block_ns);
+            }
+        }
     }
 
     progress |= aio_bh_poll(ctx);
@@ -XXX,XX +XXX,XX @@ void aio_context_use_g_source(AioContext *ctx)
 void aio_context_set_poll_params(AioContext *ctx, int64_t max_ns,
                                  int64_t grow, int64_t shrink, Error **errp)
 {
+    AioHandler *node;
+
+    qemu_lockcnt_inc(&ctx->list_lock);
+    QLIST_FOREACH(node, &ctx->aio_handlers, node) {
+        node->poll.ns = 0;
+    }
+    qemu_lockcnt_dec(&ctx->list_lock);
+
     /* No thread synchronization here, it doesn't matter if an incorrect value
      * is used once.
      */
-    ctx->poll.ns = 0;
-
     ctx->poll_max_ns = max_ns;
     ctx->poll_grow = grow;
     ctx->poll_shrink = shrink;
diff --git a/util/async.c b/util/async.c
index XXXXXXX..XXXXXXX 100644
--- a/util/async.c
+++ b/util/async.c
@@ -XXX,XX +XXX,XX @@ AioContext *aio_context_new(Error **errp)
     qemu_rec_mutex_init(&ctx->lock);
     timerlistgroup_init(&ctx->tlg, aio_timerlist_notify, ctx);
 
-    ctx->poll.ns = 0;
-
     ctx->poll_max_ns = 0;
     ctx->poll_grow = 0;
     ctx->poll_shrink = 0;
-- 
2.48.1

aio_dispatch_handler() adds handlers to ctx->poll_aio_handlers if
polling should be enabled. If we call adjust_polling_time() for all
polling handlers before this, new polling handlers are still left at
poll->ns = 0 and polling is only actually enabled after the next event.
Move the adjust_polling_time() call after aio_dispatch_handler().

This fixes test-nested-aio-poll, which expects that polling becomes
effective the first time around.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20250311141912.135657-1-kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 util/aio-posix.c | 28 +++++++++++++++++-----------
 1 file changed, 17 insertions(+), 11 deletions(-)

diff --git a/util/aio-posix.c b/util/aio-posix.c
index XXXXXXX..XXXXXXX 100644
--- a/util/aio-posix.c
+++ b/util/aio-posix.c
@@ -XXX,XX +XXX,XX @@
 /* Stop userspace polling on a handler if it isn't active for some time */
 #define POLL_IDLE_INTERVAL_NS (7 * NANOSECONDS_PER_SECOND)
 
+static void adjust_polling_time(AioContext *ctx, AioPolledEvent *poll,
+                                int64_t block_ns);
+
 bool aio_poll_disabled(AioContext *ctx)
 {
     return qatomic_read(&ctx->poll_disable_cnt);
@@ -XXX,XX +XXX,XX @@ static bool aio_dispatch_handler(AioContext *ctx, AioHandler *node)
  * scanning all handlers with aio_dispatch_handlers().
  */
 static bool aio_dispatch_ready_handlers(AioContext *ctx,
-                                        AioHandlerList *ready_list)
+                                        AioHandlerList *ready_list,
+                                        int64_t block_ns)
 {
     bool progress = false;
     AioHandler *node;
@@ -XXX,XX +XXX,XX @@ static bool aio_dispatch_ready_handlers(AioContext *ctx,
     while ((node = QLIST_FIRST(ready_list))) {
         QLIST_REMOVE(node, node_ready);
         progress = aio_dispatch_handler(ctx, node) || progress;
+
+        /*
+         * Adjust polling time only after aio_dispatch_handler(), which can
+         * add the handler to ctx->poll_aio_handlers.
+         */
+        if (ctx->poll_max_ns && QLIST_IS_INSERTED(node, node_poll)) {
+            adjust_polling_time(ctx, &node->poll, block_ns);
+        }
     }
 
     return progress;
@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
     bool use_notify_me;
     int64_t timeout;
     int64_t start = 0;
+    int64_t block_ns = 0;
 
     /*
      * There cannot be two concurrent aio_poll calls for the same AioContext (or
@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
 
     aio_notify_accept(ctx);
 
-    /* Adjust polling time */
+    /* Calculate blocked time for adaptive polling */
     if (ctx->poll_max_ns) {
-        AioHandler *node;
-        int64_t block_ns = qemu_clock_get_ns(QEMU_CLOCK_REALTIME) - start;
-
-        QLIST_FOREACH(node, &ctx->poll_aio_handlers, node_poll) {
-            if (QLIST_IS_INSERTED(node, node_ready)) {
-                adjust_polling_time(ctx, &node->poll, block_ns);
-            }
-        }
+        block_ns = qemu_clock_get_ns(QEMU_CLOCK_REALTIME) - start;
     }
 
     progress |= aio_bh_poll(ctx);
-    progress |= aio_dispatch_ready_handlers(ctx, &ready_list);
+    progress |= aio_dispatch_ready_handlers(ctx, &ready_list, block_ns);
 
     aio_free_deleted_handlers(ctx);
 
-- 
2.48.1

From: Thomas Huth <thuth@redhat.com>

qsd-migrate is currently only working for raw, qcow2 and qed.
Other formats are failing, e.g. because they don't support migration.
Thus let's limit this test to the three usable formats now.

Suggested-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250224214058.205889-1-thuth@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 tests/qemu-iotests/tests/qsd-migrate | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/qemu-iotests/tests/qsd-migrate b/tests/qemu-iotests/tests/qsd-migrate
index XXXXXXX..XXXXXXX 100755
--- a/tests/qemu-iotests/tests/qsd-migrate
+++ b/tests/qemu-iotests/tests/qsd-migrate
@@ -XXX,XX +XXX,XX @@ import iotests
 
 from iotests import filter_qemu_io, filter_qtest
 
-iotests.script_initialize(supported_fmts=['generic'],
+iotests.script_initialize(supported_fmts=['qcow2', 'qed', 'raw'],
                           supported_protocols=['file'],
                           supported_platforms=['linux'])
 
-- 
2.48.1

From: Stefan Hajnoczi <stefanha@redhat.com>

In the past a single AioContext was used for block I/O and it was
fetched using blk_get_aio_context(). Nowadays the block layer supports
running I/O from any AioContext and multiple AioContexts at the same
time. Remove the dma_blk_io() AioContext argument and use the current
AioContext instead.

This makes calling the function easier and enables multiple IOThreads to
use dma_blk_io() concurrently for the same block device.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20250311132616.1049687-3-stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/system/dma.h | 3 +--
 hw/ide/core.c        | 3 +--
 hw/ide/macio.c       | 3 +--
 hw/scsi/scsi-disk.c  | 6 ++----
 system/dma-helpers.c | 8 ++++----
 5 files changed, 9 insertions(+), 14 deletions(-)

diff --git a/include/system/dma.h b/include/system/dma.h
index XXXXXXX..XXXXXXX 100644
--- a/include/system/dma.h
+++ b/include/system/dma.h
@@ -XXX,XX +XXX,XX @@ typedef BlockAIOCB *DMAIOFunc(int64_t offset, QEMUIOVector *iov,
                               BlockCompletionFunc *cb, void *cb_opaque,
                               void *opaque);
 
-BlockAIOCB *dma_blk_io(AioContext *ctx,
-                       QEMUSGList *sg, uint64_t offset, uint32_t align,
+BlockAIOCB *dma_blk_io(QEMUSGList *sg, uint64_t offset, uint32_t align,
                        DMAIOFunc *io_func, void *io_func_opaque,
                        BlockCompletionFunc *cb, void *opaque, DMADirection dir);
 BlockAIOCB *dma_blk_read(BlockBackend *blk,
diff --git a/hw/ide/core.c b/hw/ide/core.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -XXX,XX +XXX,XX @@ static void ide_dma_cb(void *opaque, int ret)
                                            BDRV_SECTOR_SIZE, ide_dma_cb, s);
         break;
     case IDE_DMA_TRIM:
-        s->bus->dma->aiocb = dma_blk_io(blk_get_aio_context(s->blk),
-                                        &s->sg, offset, BDRV_SECTOR_SIZE,
+        s->bus->dma->aiocb = dma_blk_io(&s->sg, offset, BDRV_SECTOR_SIZE,
                                         ide_issue_trim, s, ide_dma_cb, s,
                                         DMA_DIRECTION_TO_DEVICE);
         break;
diff --git a/hw/ide/macio.c b/hw/ide/macio.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ide/macio.c
+++ b/hw/ide/macio.c
@@ -XXX,XX +XXX,XX @@ static void pmac_ide_transfer_cb(void *opaque, int ret)
                                            pmac_ide_transfer_cb, io);
         break;
     case IDE_DMA_TRIM:
-        s->bus->dma->aiocb = dma_blk_io(blk_get_aio_context(s->blk), &s->sg,
-                                        offset, 0x1, ide_issue_trim, s,
+        s->bus->dma->aiocb = dma_blk_io(&s->sg, offset, 0x1, ide_issue_trim, s,
                                         pmac_ide_transfer_cb, io,
                                         DMA_DIRECTION_TO_DEVICE);
         break;
diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/scsi/scsi-disk.c
+++ b/hw/scsi/scsi-disk.c
@@ -XXX,XX +XXX,XX @@ static void scsi_do_read(SCSIDiskReq *r, int ret)
     if (r->req.sg) {
         dma_acct_start(s->qdev.conf.blk, &r->acct, r->req.sg, BLOCK_ACCT_READ);
         r->req.residual -= r->req.sg->size;
-        r->req.aiocb = dma_blk_io(blk_get_aio_context(s->qdev.conf.blk),
-                                  r->req.sg, r->sector << BDRV_SECTOR_BITS,
+        r->req.aiocb = dma_blk_io(r->req.sg, r->sector << BDRV_SECTOR_BITS,
                                   BDRV_SECTOR_SIZE,
                                   sdc->dma_readv, r, scsi_dma_complete, r,
                                   DMA_DIRECTION_FROM_DEVICE);
@@ -XXX,XX +XXX,XX @@ static void scsi_write_data(SCSIRequest *req)
     if (r->req.sg) {
         dma_acct_start(s->qdev.conf.blk, &r->acct, r->req.sg, BLOCK_ACCT_WRITE);
         r->req.residual -= r->req.sg->size;
-        r->req.aiocb = dma_blk_io(blk_get_aio_context(s->qdev.conf.blk),
-                                  r->req.sg, r->sector << BDRV_SECTOR_BITS,
+        r->req.aiocb = dma_blk_io(r->req.sg, r->sector << BDRV_SECTOR_BITS,
                                   BDRV_SECTOR_SIZE,
                                   sdc->dma_writev, r, scsi_dma_complete, r,
                                   DMA_DIRECTION_TO_DEVICE);
diff --git a/system/dma-helpers.c b/system/dma-helpers.c
index XXXXXXX..XXXXXXX 100644
--- a/system/dma-helpers.c
+++ b/system/dma-helpers.c
@@ -XXX,XX +XXX,XX @@ static const AIOCBInfo dma_aiocb_info = {
     .cancel_async       = dma_aio_cancel,
 };
 
-BlockAIOCB *dma_blk_io(AioContext *ctx,
+BlockAIOCB *dma_blk_io(
     QEMUSGList *sg, uint64_t offset, uint32_t align,
     DMAIOFunc *io_func, void *io_func_opaque,
     BlockCompletionFunc *cb,
@@ -XXX,XX +XXX,XX @@ BlockAIOCB *dma_blk_io(AioContext *ctx,
 
     dbs->acb = NULL;
     dbs->sg = sg;
-    dbs->ctx = ctx;
+    dbs->ctx = qemu_get_current_aio_context();
     dbs->offset = offset;
     dbs->align = align;
     dbs->sg_cur_index = 0;
@@ -XXX,XX +XXX,XX @@ BlockAIOCB *dma_blk_read(BlockBackend *blk,
                          QEMUSGList *sg, uint64_t offset, uint32_t align,
                          void (*cb)(void *opaque, int ret), void *opaque)
 {
-    return dma_blk_io(blk_get_aio_context(blk), sg, offset, align,
+    return dma_blk_io(sg, offset, align,
                       dma_blk_read_io_func, blk, cb, opaque,
                       DMA_DIRECTION_FROM_DEVICE);
 }
@@ -XXX,XX +XXX,XX @@ BlockAIOCB *dma_blk_write(BlockBackend *blk,
                           QEMUSGList *sg, uint64_t offset, uint32_t align,
                           void (*cb)(void *opaque, int ret), void *opaque)
 {
-    return dma_blk_io(blk_get_aio_context(blk), sg, offset, align,
+    return dma_blk_io(sg, offset, align,
                       dma_blk_write_io_func, blk, cb, opaque,
                       DMA_DIRECTION_TO_DEVICE);
 }
-- 
2.48.1

From: Stefan Hajnoczi <stefanha@redhat.com>

Until now, a SCSIDevice's I/O requests have run in a single AioContext.
In order to support multiple IOThreads it will be necessary to move to
the concept of a per-SCSIRequest AioContext.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20250311132616.1049687-4-stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/hw/scsi/scsi.h |  1 +
 hw/scsi/scsi-bus.c     |  1 +
 hw/scsi/scsi-disk.c    | 17 ++++++-----------
 3 files changed, 8 insertions(+), 11 deletions(-)

diff --git a/include/hw/scsi/scsi.h b/include/hw/scsi/scsi.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/scsi/scsi.h
+++ b/include/hw/scsi/scsi.h
@@ -XXX,XX +XXX,XX @@ struct SCSIRequest {
     SCSIBus           *bus;
     SCSIDevice        *dev;
     const SCSIReqOps  *ops;
+    AioContext        *ctx;
     uint32_t          refcount;
     uint32_t          tag;
     uint32_t          lun;
diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/scsi/scsi-bus.c
+++ b/hw/scsi/scsi-bus.c
@@ -XXX,XX +XXX,XX @@ invalid_opcode:
         }
     }
 
+    req->ctx = qemu_get_current_aio_context();
     req->cmd = cmd;
     req->residual = req->cmd.xfer;
 
diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/scsi/scsi-disk.c
+++ b/hw/scsi/scsi-disk.c
@@ -XXX,XX +XXX,XX @@ static void scsi_aio_complete(void *opaque, int ret)
     SCSIDiskReq *r = (SCSIDiskReq *)opaque;
     SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
 
-    /* The request must only run in the BlockBackend's AioContext */
-    assert(blk_get_aio_context(s->qdev.conf.blk) ==
-           qemu_get_current_aio_context());
+    /* The request must run in its AioContext */
+    assert(r->req.ctx == qemu_get_current_aio_context());
 
     assert(r->req.aiocb != NULL);
     r->req.aiocb = NULL;
@@ -XXX,XX +XXX,XX @@ static void scsi_dma_complete(void *opaque, int ret)
 
 static void scsi_read_complete_noio(SCSIDiskReq *r, int ret)
 {
-    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
     uint32_t n;
 
-    /* The request must only run in the BlockBackend's AioContext */
-    assert(blk_get_aio_context(s->qdev.conf.blk) ==
-           qemu_get_current_aio_context());
+    /* The request must run in its AioContext */
+    assert(r->req.ctx == qemu_get_current_aio_context());
 
     assert(r->req.aiocb == NULL);
     if (scsi_disk_req_check_error(r, ret, ret > 0)) {
@@ -XXX,XX +XXX,XX @@ static void scsi_read_data(SCSIRequest *req)
 
 static void scsi_write_complete_noio(SCSIDiskReq *r, int ret)
 {
-    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
     uint32_t n;
 
-    /* The request must only run in the BlockBackend's AioContext */
-    assert(blk_get_aio_context(s->qdev.conf.blk) ==
-           qemu_get_current_aio_context());
+    /* The request must run in its AioContext */
+    assert(r->req.ctx == qemu_get_current_aio_context());
 
     assert (r->req.aiocb == NULL);
     if (scsi_disk_req_check_error(r, ret, ret > 0)) {
-- 
2.48.1

From: Stefan Hajnoczi <stefanha@redhat.com>

SCSIDevice keeps track of in-flight requests for device reset and Task
Management Functions (TMFs). The request list requires protection so
that multi-threaded SCSI emulation can be implemented in commits that
follow.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20250311132616.1049687-5-stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/hw/scsi/scsi.h |   7 ++-
 hw/scsi/scsi-bus.c     | 120 +++++++++++++++++++++++++++++------------
 2 files changed, 88 insertions(+), 39 deletions(-)

diff --git a/include/hw/scsi/scsi.h b/include/hw/scsi/scsi.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/scsi/scsi.h
+++ b/include/hw/scsi/scsi.h
@@ -XXX,XX +XXX,XX @@ struct SCSIRequest {
     bool              dma_started;
     BlockAIOCB        *aiocb;
     QEMUSGList        *sg;
+
+    /* Protected by SCSIDevice->requests_lock */
     QTAILQ_ENTRY(SCSIRequest) next;
 };
 
@@ -XXX,XX +XXX,XX @@ struct SCSIDevice
     uint8_t sense[SCSI_SENSE_BUF_SIZE];
     uint32_t sense_len;
 
-    /*
-     * The requests list is only accessed from the AioContext that executes
-     * requests or from the main loop when IOThread processing is stopped.
-     */
+    QemuMutex requests_lock; /* protects the requests list */
     QTAILQ_HEAD(, SCSIRequest) requests;
 
     uint32_t channel;
diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/scsi/scsi-bus.c
+++ b/hw/scsi/scsi-bus.c
@@ -XXX,XX +XXX,XX @@ static void scsi_device_for_each_req_sync(SCSIDevice *s,
     assert(!runstate_is_running());
     assert(qemu_in_main_thread());
 
-    QTAILQ_FOREACH_SAFE(req, &s->requests, next, next_req) {
-        fn(req, opaque);
+    /*
+     * Locking is not necessary because the guest is stopped and no other
+     * threads can be accessing the requests list, but take the lock for
+     * consistency.
+     */
+    WITH_QEMU_LOCK_GUARD(&s->requests_lock) {
+        QTAILQ_FOREACH_SAFE(req, &s->requests, next, next_req) {
+            fn(req, opaque);
+        }
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void scsi_device_for_each_req_async_bh(void *opaque)
 {
     g_autofree SCSIDeviceForEachReqAsyncData *data = opaque;
     SCSIDevice *s = data->s;
-    AioContext *ctx;
-    SCSIRequest *req;
-    SCSIRequest *next;
+    g_autoptr(GList) reqs = NULL;
 
     /*
-     * The BB cannot have changed contexts between this BH being scheduled and
-     * now: BBs' AioContexts, when they have a node attached, can only be
-     * changed via bdrv_try_change_aio_context(), in a drained section.  While
-     * we have the in-flight counter incremented, that drain must block.
+     * Build a list of requests in this AioContext so fn() can be invoked later
+     * outside requests_lock.
      */
-    ctx = blk_get_aio_context(s->conf.blk);
-    assert(ctx == qemu_get_current_aio_context());
+    WITH_QEMU_LOCK_GUARD(&s->requests_lock) {
+        AioContext *ctx = qemu_get_current_aio_context();
+        SCSIRequest *req;
+        SCSIRequest *next;
+
+        QTAILQ_FOREACH_SAFE(req, &s->requests, next, next) {
+            if (req->ctx == ctx) {
+                scsi_req_ref(req); /* dropped after calling fn() */
+                reqs = g_list_prepend(reqs, req);
+            }
+        }
+    }
 
-    QTAILQ_FOREACH_SAFE(req, &s->requests, next, next) {
-        data->fn(req, data->fn_opaque);
+    /* Call fn() on each request */
+    for (GList *elem = g_list_first(reqs); elem; elem = g_list_next(elem)) {
+        data->fn(elem->data, data->fn_opaque);
+        scsi_req_unref(elem->data);
     }
 
     /* Drop the reference taken by scsi_device_for_each_req_async() */
@@ -XXX,XX +XXX,XX @@ static void scsi_device_for_each_req_async_bh(void *opaque)
     blk_dec_in_flight(s->conf.blk);
 }
 
+static void scsi_device_for_each_req_async_do_ctx(gpointer key, gpointer value,
+                                                  gpointer user_data)
+{
+    AioContext *ctx = key;
+    SCSIDeviceForEachReqAsyncData *params = user_data;
+    SCSIDeviceForEachReqAsyncData *data;
+
+    data = g_new(SCSIDeviceForEachReqAsyncData, 1);
+    data->s = params->s;
+    data->fn = params->fn;
+    data->fn_opaque = params->fn_opaque;
+
+    /*
+     * Hold a reference to the SCSIDevice until
+     * scsi_device_for_each_req_async_bh() finishes.
+     */
+    object_ref(OBJECT(data->s));
+
+    /* Paired with scsi_device_for_each_req_async_bh() */
+    blk_inc_in_flight(data->s->conf.blk);
+
+    aio_bh_schedule_oneshot(ctx, scsi_device_for_each_req_async_bh, data);
+}
+
 /*
  * Schedule @fn() to be invoked for each enqueued request in device @s. @fn()
- * runs in the AioContext that is executing the request.
+ * must be thread-safe because it runs concurrently in each AioContext that is
+ * executing a request.
+ *
  * Keeps the BlockBackend's in-flight counter incremented until everything is
  * done, so draining it will settle all scheduled @fn() calls.
  */
@@ -XXX,XX +XXX,XX @@ static void scsi_device_for_each_req_async(SCSIDevice *s,
 {
     assert(qemu_in_main_thread());
 
-    SCSIDeviceForEachReqAsyncData *data =
-        g_new(SCSIDeviceForEachReqAsyncData, 1);
-
-    data->s = s;
-    data->fn = fn;
-    data->fn_opaque = opaque;
-
-    /*
-     * Hold a reference to the SCSIDevice until
-     * scsi_device_for_each_req_async_bh() finishes.
-     */
-    object_ref(OBJECT(s));
+    /* The set of AioContexts where the requests are being processed */
+    g_autoptr(GHashTable) aio_contexts = g_hash_table_new(NULL, NULL);
+    WITH_QEMU_LOCK_GUARD(&s->requests_lock) {
+        SCSIRequest *req;
+        QTAILQ_FOREACH(req, &s->requests, next) {
+            g_hash_table_add(aio_contexts, req->ctx);
+        }
+    }
 
-    /* Paired with blk_dec_in_flight() in scsi_device_for_each_req_async_bh() */
-    blk_inc_in_flight(s->conf.blk);
-    aio_bh_schedule_oneshot(blk_get_aio_context(s->conf.blk),
-                            scsi_device_for_each_req_async_bh,
-                            data);
+    /* Schedule a BH for each AioContext */
+    SCSIDeviceForEachReqAsyncData params = {
+        .s = s,
+        .fn = fn,
+        .fn_opaque = opaque,
+    };
+    g_hash_table_foreach(
+            aio_contexts,
+            scsi_device_for_each_req_async_do_ctx,
+            &params
+    );
 }
 
 static void scsi_device_realize(SCSIDevice *s, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void scsi_qdev_realize(DeviceState *qdev, Error **errp)
         dev->lun = lun;
     }
 
+    qemu_mutex_init(&dev->requests_lock);
     QTAILQ_INIT(&dev->requests);
     scsi_device_realize(dev, &local_err);
     if (local_err) {
@@ -XXX,XX +XXX,XX @@ static void scsi_qdev_unrealize(DeviceState *qdev)
 
     scsi_device_purge_requests(dev, SENSE_CODE(NO_SENSE));
 
+    qemu_mutex_destroy(&dev->requests_lock);
+
     scsi_device_unrealize(dev);
 
     blockdev_mark_auto_del(dev->conf.blk);
@@ -XXX,XX +XXX,XX @@ static void scsi_req_enqueue_internal(SCSIRequest *req)
         req->sg = NULL;
     }
     req->enqueued = true;
-    QTAILQ_INSERT_TAIL(&req->dev->requests, req, next);
+
+    WITH_QEMU_LOCK_GUARD(&req->dev->requests_lock) {
+        QTAILQ_INSERT_TAIL(&req->dev->requests, req, next);
+    }
 }
 
 int32_t scsi_req_enqueue(SCSIRequest *req)
@@ -XXX,XX +XXX,XX @@ static void scsi_req_dequeue(SCSIRequest *req)
     trace_scsi_req_dequeue(req->dev->id, req->lun, req->tag);
     req->retry = false;
     if (req->enqueued) {
-        QTAILQ_REMOVE(&req->dev->requests, req, next);
+        WITH_QEMU_LOCK_GUARD(&req->dev->requests_lock) {
+            QTAILQ_REMOVE(&req->dev->requests, req, next);
+        }
         req->enqueued = false;
         scsi_req_unref(req);
     }
@@ -XXX,XX +XXX,XX @@ static void scsi_device_class_init(ObjectClass *klass, void *data)
 
 static void scsi_dev_instance_init(Object *obj)
 {
-    DeviceState *dev = DEVICE(obj);
-    SCSIDevice *s = SCSI_DEVICE(dev);
+    SCSIDevice *s = SCSI_DEVICE(obj);
 
     device_add_bootindex_property(obj, &s->conf.bootindex,
                                   "bootindex", NULL,
-- 
2.48.1

From: Stefan Hajnoczi <stefanha@redhat.com>

Virtqueues are not thread-safe. Until now this was not a major issue
since all virtqueue processing happened in the same thread. The ctrl
queue's Task Management Function (TMF) requests sometimes need the main
loop, so a BH was used to schedule the virtqueue completion back in the
thread that has virtqueue access.

When IOThread Virtqueue Mapping is introduced in later commits, event
and ctrl virtqueue accesses from other threads will become necessary.
Introduce an optional per-virtqueue lock so the event and ctrl
virtqueues can be protected in the commits that follow.

The addition of the ctrl virtqueue lock makes
virtio_scsi_complete_req_from_main_loop() and its BH unnecessary.
Instead, take the ctrl virtqueue lock from the main loop thread.

The cmd virtqueue does not have a lock because the entirety of SCSI
command processing happens in one thread. Only one thread accesses the
cmd virtqueue and a lock is unnecessary.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20250311132616.1049687-6-stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/hw/virtio/virtio-scsi.h |  3 ++
 hw/scsi/virtio-scsi.c           | 84 ++++++++++++++++++---------------
 2 files changed, 49 insertions(+), 38 deletions(-)

diff --git a/include/hw/virtio/virtio-scsi.h b/include/hw/virtio/virtio-scsi.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/virtio/virtio-scsi.h
+++ b/include/hw/virtio/virtio-scsi.h
@@ -XXX,XX +XXX,XX @@ struct VirtIOSCSI {
     int resetting; /* written from main loop thread, read from any thread */
     bool events_dropped;
 
+    QemuMutex ctrl_lock; /* protects ctrl_vq */
+    QemuMutex event_lock; /* protects event_vq */
+
     /*
      * TMFs deferred to main loop BH. These fields are protected by
      * tmf_bh_lock.
diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/scsi/virtio-scsi.c
+++ b/hw/scsi/virtio-scsi.c
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_free_req(VirtIOSCSIReq *req)
     g_free(req);
 }
 
-static void virtio_scsi_complete_req(VirtIOSCSIReq *req)
+static void virtio_scsi_complete_req(VirtIOSCSIReq *req, QemuMutex *vq_lock)
 {
     VirtIOSCSI *s = req->dev;
     VirtQueue *vq = req->vq;
     VirtIODevice *vdev = VIRTIO_DEVICE(s);
 
     qemu_iovec_from_buf(&req->resp_iov, 0, &req->resp, req->resp_size);
+
+    if (vq_lock) {
+        qemu_mutex_lock(vq_lock);
+    }
+
     virtqueue_push(vq, &req->elem, req->qsgl.size + req->resp_iov.size);
     if (s->dataplane_started && !s->dataplane_fenced) {
         virtio_notify_irqfd(vdev, vq);
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_complete_req(VirtIOSCSIReq *req)
         virtio_notify(vdev, vq);
     }
 
+    if (vq_lock) {
+        qemu_mutex_unlock(vq_lock);
+    }
+
     if (req->sreq) {
         req->sreq->hba_private = NULL;
         scsi_req_unref(req->sreq);
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_complete_req(VirtIOSCSIReq *req)
     virtio_scsi_free_req(req);
 }
 
-static void virtio_scsi_complete_req_bh(void *opaque)
+static void virtio_scsi_bad_req(VirtIOSCSIReq *req, QemuMutex *vq_lock)
 {
-    VirtIOSCSIReq *req = opaque;
+    virtio_error(VIRTIO_DEVICE(req->dev), "wrong size for virtio-scsi headers");
 
-    virtio_scsi_complete_req(req);
-}
+    if (vq_lock) {
+        qemu_mutex_lock(vq_lock);
+    }
 
-/*
- * Called from virtio_scsi_do_one_tmf_bh() in main loop thread. The main loop
- * thread cannot touch the virtqueue since that could race with an IOThread.
- */
-static void virtio_scsi_complete_req_from_main_loop(VirtIOSCSIReq *req)
-{
-    VirtIOSCSI *s = req->dev;
+    virtqueue_detach_element(req->vq, &req->elem, 0);
 
-    if (!s->ctx || s->ctx == qemu_get_aio_context()) {
-        /* No need to schedule a BH when there is no IOThread */
-        virtio_scsi_complete_req(req);
-    } else {
-        /* Run request completion in the IOThread */
-        aio_wait_bh_oneshot(s->ctx, virtio_scsi_complete_req_bh, req);
+    if (vq_lock) {
+        qemu_mutex_unlock(vq_lock);
     }
-}
 
-static void virtio_scsi_bad_req(VirtIOSCSIReq *req)
-{
-    virtio_error(VIRTIO_DEVICE(req->dev), "wrong size for virtio-scsi headers");
-    virtqueue_detach_element(req->vq, &req->elem, 0);
     virtio_scsi_free_req(req);
 }
 
@@ -XXX,XX +XXX,XX @@ static int virtio_scsi_parse_req(VirtIOSCSIReq *req,
     return 0;
 }
 
-static VirtIOSCSIReq *virtio_scsi_pop_req(VirtIOSCSI *s, VirtQueue *vq)
+static VirtIOSCSIReq *virtio_scsi_pop_req(VirtIOSCSI *s, VirtQueue *vq, QemuMutex *vq_lock)
 {
     VirtIOSCSICommon *vs = (VirtIOSCSICommon *)s;
     VirtIOSCSIReq *req;
 
+    if (vq_lock) {
+        qemu_mutex_lock(vq_lock);
+    }
+
     req = virtqueue_pop(vq, sizeof(VirtIOSCSIReq) + vs->cdb_size);
+
+    if (vq_lock) {
+        qemu_mutex_unlock(vq_lock);
+    }
+
     if (!req) {
         return NULL;
     }
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_cancel_notify(Notifier *notifier, void *data)
 
         trace_virtio_scsi_tmf_resp(virtio_scsi_get_lun(req->req.tmf.lun),
                                    req->req.tmf.tag, req->resp.tmf.response);
-        virtio_scsi_complete_req(req);
+        virtio_scsi_complete_req(req, &req->dev->ctrl_lock);
     }
     g_free(n);
 }
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_do_one_tmf_bh(VirtIOSCSIReq *req)
 
 out:
     object_unref(OBJECT(d));
-    virtio_scsi_complete_req_from_main_loop(req);
+    virtio_scsi_complete_req(req, &s->ctrl_lock);
 }
 
 /* Some TMFs must be processed from the main loop thread */
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_reset_tmf_bh(VirtIOSCSI *s)
 
         /* SAM-6 6.3.2 Hard reset */
         req->resp.tmf.response = VIRTIO_SCSI_S_TARGET_FAILURE;
-        virtio_scsi_complete_req(req);
+        virtio_scsi_complete_req(req, &req->dev->ctrl_lock);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_handle_ctrl_req(VirtIOSCSI *s, VirtIOSCSIReq *req)
 
     if (iov_to_buf(req->elem.out_sg, req->elem.out_num, 0,
                 &type, sizeof(type)) < sizeof(type)) {
-        virtio_scsi_bad_req(req);
+        virtio_scsi_bad_req(req, &s->ctrl_lock);
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_handle_ctrl_req(VirtIOSCSI *s, VirtIOSCSIReq *req)
     if (type == VIRTIO_SCSI_T_TMF) {
         if (virtio_scsi_parse_req(req, sizeof(VirtIOSCSICtrlTMFReq),
                     sizeof(VirtIOSCSICtrlTMFResp)) < 0) {
-            virtio_scsi_bad_req(req);
+            virtio_scsi_bad_req(req, &s->ctrl_lock);
             return;
         } else {
             r = virtio_scsi_do_tmf(s, req);
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_handle_ctrl_req(VirtIOSCSI *s, VirtIOSCSIReq *req)
                type == VIRTIO_SCSI_T_AN_SUBSCRIBE) {
         if (virtio_scsi_parse_req(req, sizeof(VirtIOSCSICtrlANReq),
                     sizeof(VirtIOSCSICtrlANResp)) < 0) {
-            virtio_scsi_bad_req(req);
+            virtio_scsi_bad_req(req, &s->ctrl_lock);
             return;
         } else {
             req->req.an.event_requested =
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_handle_ctrl_req(VirtIOSCSI *s, VirtIOSCSIReq *req)
                  type == VIRTIO_SCSI_T_AN_SUBSCRIBE)
             trace_virtio_scsi_an_resp(virtio_scsi_get_lun(req->req.an.lun),
                                       req->resp.an.response);
-        virtio_scsi_complete_req(req);
+        virtio_scsi_complete_req(req, &s->ctrl_lock);
     } else {
         assert(r == -EINPROGRESS);
     }
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_handle_ctrl_vq(VirtIOSCSI *s, VirtQueue *vq)
 {
     VirtIOSCSIReq *req;
 
-    while ((req = virtio_scsi_pop_req(s, vq))) {
+    while ((req = virtio_scsi_pop_req(s, vq, &s->ctrl_lock))) {
         virtio_scsi_handle_ctrl_req(s, req);
     }
 }
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_complete_cmd_req(VirtIOSCSIReq *req)
      * in virtio_scsi_command_complete.
      */
     req->resp_size = sizeof(VirtIOSCSICmdResp);
-    virtio_scsi_complete_req(req);
+    virtio_scsi_complete_req(req, NULL);
 }
 
 static void virtio_scsi_command_failed(SCSIRequest *r)
@@ -XXX,XX +XXX,XX @@ static int virtio_scsi_handle_cmd_req_prepare(VirtIOSCSI *s, VirtIOSCSIReq *req)
             virtio_scsi_fail_cmd_req(req);
             return -ENOTSUP;
         } else {
-            virtio_scsi_bad_req(req);
+            virtio_scsi_bad_req(req, NULL);
             return -EINVAL;
         }
     }
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_handle_cmd_vq(VirtIOSCSI *s, VirtQueue *vq)
             virtio_queue_set_notification(vq, 0);
         }
 
-        while ((req = virtio_scsi_pop_req(s, vq))) {
+        while ((req = virtio_scsi_pop_req(s, vq, NULL))) {
             ret = virtio_scsi_handle_cmd_req_prepare(s, req);
             if (!ret) {
                 QTAILQ_INSERT_TAIL(&reqs, req, next);
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_push_event(VirtIOSCSI *s,
         return;
     }
 
-    req = virtio_scsi_pop_req(s, vs->event_vq);
+    req = virtio_scsi_pop_req(s, vs->event_vq, &s->event_lock);
     if (!req) {
         s->events_dropped = true;
         return;
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_push_event(VirtIOSCSI *s,
     }
 
     if (virtio_scsi_parse_req(req, 0, sizeof(VirtIOSCSIEvent))) {
-        virtio_scsi_bad_req(req);
+        virtio_scsi_bad_req(req, &s->event_lock);
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_push_event(VirtIOSCSI *s,
     }
     trace_virtio_scsi_event(virtio_scsi_get_lun(evt->lun), event, reason);
 
-    virtio_scsi_complete_req(req);
+    virtio_scsi_complete_req(req, &s->event_lock);
 }
 
 static void virtio_scsi_handle_event_vq(VirtIOSCSI *s, VirtQueue *vq)
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_device_realize(DeviceState *dev, Error **errp)
     Error *err = NULL;
 
     QTAILQ_INIT(&s->tmf_bh_list);
+    qemu_mutex_init(&s->ctrl_lock);
+    qemu_mutex_init(&s->event_lock);
     qemu_mutex_init(&s->tmf_bh_lock);
 
     virtio_scsi_common_realize(dev,
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_device_unrealize(DeviceState *dev)
     qbus_set_hotplug_handler(BUS(&s->bus), NULL);
     virtio_scsi_common_unrealize(dev);
     qemu_mutex_destroy(&s->tmf_bh_lock);
+    qemu_mutex_destroy(&s->event_lock);
+    qemu_mutex_destroy(&s->ctrl_lock);
 }
 
 static const Property virtio_scsi_properties[] = {
-- 
2.48.1

From: Stefan Hajnoczi <stefanha@redhat.com>

The block layer can invoke the resize callback from any AioContext that
is processing requests. The virtqueue is already protected but the
events_dropped field also needs to be protected against races. Cover it
using the event virtqueue lock because it is closely associated with
accesses to the virtqueue.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20250311132616.1049687-7-stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/hw/virtio/virtio-scsi.h |  3 ++-
 hw/scsi/virtio-scsi.c           | 29 ++++++++++++++++++++---------
 2 files changed, 22 insertions(+), 10 deletions(-)

diff --git a/include/hw/virtio/virtio-scsi.h b/include/hw/virtio/virtio-scsi.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/virtio/virtio-scsi.h
+++ b/include/hw/virtio/virtio-scsi.h
@@ -XXX,XX +XXX,XX @@ struct VirtIOSCSI {
 
     SCSIBus bus;
     int resetting; /* written from main loop thread, read from any thread */
+
+    QemuMutex event_lock; /* protects event_vq and events_dropped */
     bool events_dropped;
 
     QemuMutex ctrl_lock; /* protects ctrl_vq */
-    QemuMutex event_lock; /* protects event_vq */
 
     /*
      * TMFs deferred to main loop BH. These fields are protected by
diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/scsi/virtio-scsi.c
+++ b/hw/scsi/virtio-scsi.c
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_reset(VirtIODevice *vdev)
 
     vs->sense_size = VIRTIO_SCSI_SENSE_DEFAULT_SIZE;
     vs->cdb_size = VIRTIO_SCSI_CDB_DEFAULT_SIZE;
-    s->events_dropped = false;
+
+    WITH_QEMU_LOCK_GUARD(&s->event_lock) {
+        s->events_dropped = false;
+    }
 }
 
 typedef struct {
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_push_event(VirtIOSCSI *s,
     }
 
     req = virtio_scsi_pop_req(s, vs->event_vq, &s->event_lock);
-    if (!req) {
-        s->events_dropped = true;
-        return;
-    }
+    WITH_QEMU_LOCK_GUARD(&s->event_lock) {
+        if (!req) {
+            s->events_dropped = true;
+            return;
+        }
 
-    if (s->events_dropped) {
-        event |= VIRTIO_SCSI_T_EVENTS_MISSED;
-        s->events_dropped = false;
+        if (s->events_dropped) {
+            event |= VIRTIO_SCSI_T_EVENTS_MISSED;
+            s->events_dropped = false;
+        }
     }
 
     if (virtio_scsi_parse_req(req, 0, sizeof(VirtIOSCSIEvent))) {
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_push_event(VirtIOSCSI *s,
 
 static void virtio_scsi_handle_event_vq(VirtIOSCSI *s, VirtQueue *vq)
 {
-    if (s->events_dropped) {
+    bool events_dropped;
+
+    WITH_QEMU_LOCK_GUARD(&s->event_lock) {
+        events_dropped = s->events_dropped;
+    }
+
+    if (events_dropped) {
         VirtIOSCSIEventInfo info = {
             .event = VIRTIO_SCSI_T_NO_EVENT,
         };
-- 
2.48.1

From: Stefan Hajnoczi <stefanha@redhat.com>

With IOThread Virtqueue Mapping there will be multiple AioContexts
processing SCSI requests. scsi_req_cancel() and other SCSI request
operations must be performed from the AioContext where the request is
running.

Introduce a virtio_scsi_defer_tmf_to_aio_context() function and the
necessary VirtIOSCSIReq->remaining refcount infrastructure to move the
TMF code into the AioContext where the request is running.

For the time being there is still just one AioContext: the main loop or
the IOThread. When the iothread-vq-mapping parameter is added in a later
patch this will be changed to per-virtqueue AioContexts.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20250311132616.1049687-8-stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 hw/scsi/virtio-scsi.c | 270 ++++++++++++++++++++++++++++++++----------
 1 file changed, 206 insertions(+), 64 deletions(-)

diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/scsi/virtio-scsi.c
+++ b/hw/scsi/virtio-scsi.c
@@ -XXX,XX +XXX,XX @@ typedef struct VirtIOSCSIReq {
     /* Used for two-stage request submission and TMFs deferred to BH */
     QTAILQ_ENTRY(VirtIOSCSIReq) next;
 
-    /* Used for cancellation of request during TMFs */
+    /* Used for cancellation of request during TMFs. Atomic. */
     int remaining;
 
     SCSIRequest *sreq;
@@ -XXX,XX +XXX,XX @@ typedef struct {
     VirtIOSCSIReq  *tmf_req;
 } VirtIOSCSICancelNotifier;
 
+static void virtio_scsi_tmf_dec_remaining(VirtIOSCSIReq *tmf)
+{
+    if (qatomic_fetch_dec(&tmf->remaining) == 1) {
+        trace_virtio_scsi_tmf_resp(virtio_scsi_get_lun(tmf->req.tmf.lun),
+                                   tmf->req.tmf.tag, tmf->resp.tmf.response);
+
+        virtio_scsi_complete_req(tmf, &tmf->dev->ctrl_lock);
+    }
+}
+
 static void virtio_scsi_cancel_notify(Notifier *notifier, void *data)
 {
     VirtIOSCSICancelNotifier *n = container_of(notifier,
                                                VirtIOSCSICancelNotifier,
                                                notifier);
 
-    if (--n->tmf_req->remaining == 0) {
-        VirtIOSCSIReq *req = n->tmf_req;
-
-        trace_virtio_scsi_tmf_resp(virtio_scsi_get_lun(req->req.tmf.lun),
-                                   req->req.tmf.tag, req->resp.tmf.response);
-        virtio_scsi_complete_req(req, &req->dev->ctrl_lock);
-    }
+    virtio_scsi_tmf_dec_remaining(n->tmf_req);
     g_free(n);
 }
 
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_reset_tmf_bh(VirtIOSCSI *s)
     }
 }
 
-static void virtio_scsi_defer_tmf_to_bh(VirtIOSCSIReq *req)
+static void virtio_scsi_defer_tmf_to_main_loop(VirtIOSCSIReq *req)
 {
     VirtIOSCSI *s = req->dev;
 
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_defer_tmf_to_bh(VirtIOSCSIReq *req)
     }
 }
 
+static void virtio_scsi_tmf_cancel_req(VirtIOSCSIReq *tmf, SCSIRequest *r)
+{
+    VirtIOSCSICancelNotifier *notifier;
+
+    assert(r->ctx == qemu_get_current_aio_context());
+
+    /* Decremented in virtio_scsi_cancel_notify() */
+    qatomic_inc(&tmf->remaining);
+
+    notifier = g_new(VirtIOSCSICancelNotifier, 1);
+    notifier->notifier.notify = virtio_scsi_cancel_notify;
+    notifier->tmf_req = tmf;
+    scsi_req_cancel_async(r, &notifier->notifier);
+}
+
+/* Execute a TMF on the requests in the current AioContext */
+static void virtio_scsi_do_tmf_aio_context(void *opaque)
+{
+    AioContext *ctx = qemu_get_current_aio_context();
+    VirtIOSCSIReq *tmf = opaque;
+    VirtIOSCSI *s = tmf->dev;
+    SCSIDevice *d = virtio_scsi_device_get(s, tmf->req.tmf.lun);
+    SCSIRequest *r;
+    bool match_tag;
+
+    if (!d) {
+        tmf->resp.tmf.response = VIRTIO_SCSI_S_BAD_TARGET;
+        virtio_scsi_tmf_dec_remaining(tmf);
+        return;
+    }
+
+    /*
+     * This function could handle other subtypes that need to be processed in
+     * the request's AioContext in the future, but for now only request
+     * cancelation subtypes are performed here.
+     */
+    switch (tmf->req.tmf.subtype) {
+    case VIRTIO_SCSI_T_TMF_ABORT_TASK:
+        match_tag = true;
+        break;
+    case VIRTIO_SCSI_T_TMF_ABORT_TASK_SET:
+    case VIRTIO_SCSI_T_TMF_CLEAR_TASK_SET:
+        match_tag = false;
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    WITH_QEMU_LOCK_GUARD(&d->requests_lock) {
+        QTAILQ_FOREACH(r, &d->requests, next) {
+            VirtIOSCSIReq *cmd_req = r->hba_private;
+            assert(cmd_req); /* request has hba_private while enqueued */
+
+            if (r->ctx != ctx) {
+                continue;
+            }
+            if (match_tag && cmd_req->req.cmd.tag != tmf->req.tmf.tag) {
+                continue;
+            }
+            virtio_scsi_tmf_cancel_req(tmf, r);
+        }
+    }
+
+    /* Incremented by virtio_scsi_do_tmf() */
+    virtio_scsi_tmf_dec_remaining(tmf);
+
+    object_unref(d);
+}
+
+static void dummy_bh(void *opaque)
+{
+    /* Do nothing */
+}
+
+/*
+ * Wait for pending virtio_scsi_defer_tmf_to_aio_context() BHs.
+ */
+static void virtio_scsi_flush_defer_tmf_to_aio_context(VirtIOSCSI *s)
+{
+    GLOBAL_STATE_CODE();
+
+    assert(!s->dataplane_started);
+
+    if (s->ctx) {
+        /* Our BH only runs after previously scheduled BHs */
+        aio_wait_bh_oneshot(s->ctx, dummy_bh, NULL);
+    }
+}
+
+/*
+ * Run the TMF in a specific AioContext, handling only requests in that
+ * AioContext. This is necessary because requests can run in different
+ * AioContext and it is only possible to cancel them from the AioContext where
+ * they are running.
+ */
+static void virtio_scsi_defer_tmf_to_aio_context(VirtIOSCSIReq *tmf,
+                                                 AioContext *ctx)
+{
+    /* Decremented in virtio_scsi_do_tmf_aio_context() */
+    qatomic_inc(&tmf->remaining);
+
+    /* See virtio_scsi_flush_defer_tmf_to_aio_context() cleanup during reset */
+    aio_bh_schedule_oneshot(ctx, virtio_scsi_do_tmf_aio_context, tmf);
+}
+
+/*
+ * Returns the AioContext for a given TMF's tag field or NULL. Note that the
+ * request identified by the tag may have completed by the time you can execute
+ * a BH in the AioContext, so don't assume the request still exists in your BH.
+ */
+static AioContext *find_aio_context_for_tmf_tag(SCSIDevice *d,
+                                                VirtIOSCSIReq *tmf)
+{
+    WITH_QEMU_LOCK_GUARD(&d->requests_lock) {
+        SCSIRequest *r;
+        SCSIRequest *next;
+
+        QTAILQ_FOREACH_SAFE(r, &d->requests, next, next) {
+            VirtIOSCSIReq *cmd_req = r->hba_private;
+
+            /* hba_private is non-NULL while the request is enqueued */
+            assert(cmd_req);
+
+            if (cmd_req->req.cmd.tag == tmf->req.tmf.tag) {
+                return r->ctx;
+            }
+        }
+    }
+    return NULL;
+}
+
 /* Return 0 if the request is ready to be completed and return to guest;
  * -EINPROGRESS if the request is submitted and will be completed later, in the
  *  case of async cancellation. */
@@ -XXX,XX +XXX,XX @@ static int virtio_scsi_do_tmf(VirtIOSCSI *s, VirtIOSCSIReq *req)
 {
     SCSIDevice *d = virtio_scsi_device_get(s, req->req.tmf.lun);
     SCSIRequest *r, *next;
+    AioContext *ctx;
     int ret = 0;
 
     virtio_scsi_ctx_check(s, d);
@@ -XXX,XX +XXX,XX @@ static int virtio_scsi_do_tmf(VirtIOSCSI *s, VirtIOSCSIReq *req)
                               req->req.tmf.tag, req->req.tmf.subtype);
 
     switch (req->req.tmf.subtype) {
-    case VIRTIO_SCSI_T_TMF_ABORT_TASK:
-    case VIRTIO_SCSI_T_TMF_QUERY_TASK:
+    case VIRTIO_SCSI_T_TMF_ABORT_TASK: {
         if (!d) {
             goto fail;
         }
         if (d->lun != virtio_scsi_get_lun(req->req.tmf.lun)) {
             goto incorrect_lun;
         }
-        QTAILQ_FOREACH_SAFE(r, &d->requests, next, next) {
-            VirtIOSCSIReq *cmd_req = r->hba_private;
-            if (cmd_req && cmd_req->req.cmd.tag == req->req.tmf.tag) {
-                break;
-            }
+
+        ctx = find_aio_context_for_tmf_tag(d, req);
+        if (ctx) {
+            virtio_scsi_defer_tmf_to_aio_context(req, ctx);
+            ret = -EINPROGRESS;
         }
-        if (r) {
-            /*
-             * Assert that the request has not been completed yet, we
-             * check for it in the loop above.
-             */
-            assert(r->hba_private);
-            if (req->req.tmf.subtype == VIRTIO_SCSI_T_TMF_QUERY_TASK) {
-                /* "If the specified command is present in the task set, then
-                 * return a service response set to FUNCTION SUCCEEDED".
-                 */
-                req->resp.tmf.response = VIRTIO_SCSI_S_FUNCTION_SUCCEEDED;
-            } else {
-                VirtIOSCSICancelNotifier *notifier;
-
-                req->remaining = 1;
-                notifier = g_new(VirtIOSCSICancelNotifier, 1);
-                notifier->tmf_req = req;
-                notifier->notifier.notify = virtio_scsi_cancel_notify;
-                scsi_req_cancel_async(r, &notifier->notifier);
-                ret = -EINPROGRESS;
+        break;
+    }
+
+    case VIRTIO_SCSI_T_TMF_QUERY_TASK:
+        if (!d) {
+            goto fail;
+        }
+        if (d->lun != virtio_scsi_get_lun(req->req.tmf.lun)) {
+            goto incorrect_lun;
+        }
+
+        WITH_QEMU_LOCK_GUARD(&d->requests_lock) {
+            QTAILQ_FOREACH(r, &d->requests, next) {
+                VirtIOSCSIReq *cmd_req = r->hba_private;
+                assert(cmd_req); /* request has hba_private while enqueued */
+
+                if (cmd_req->req.cmd.tag == req->req.tmf.tag) {
+                    /*
+                     * "If the specified command is present in the task set,
+                     * then return a service response set to FUNCTION
+                     * SUCCEEDED".
+                     */
+                    req->resp.tmf.response = VIRTIO_SCSI_S_FUNCTION_SUCCEEDED;
+                }
             }
         }
         break;
 
     case VIRTIO_SCSI_T_TMF_LOGICAL_UNIT_RESET:
     case VIRTIO_SCSI_T_TMF_I_T_NEXUS_RESET:
-        virtio_scsi_defer_tmf_to_bh(req);
+        virtio_scsi_defer_tmf_to_main_loop(req);
         ret = -EINPROGRESS;
         break;
 
     case VIRTIO_SCSI_T_TMF_ABORT_TASK_SET:
-    case VIRTIO_SCSI_T_TMF_CLEAR_TASK_SET:
+    case VIRTIO_SCSI_T_TMF_CLEAR_TASK_SET: {
+        if (!d) {
+            goto fail;
+        }
+        if (d->lun != virtio_scsi_get_lun(req->req.tmf.lun)) {
+            goto incorrect_lun;
+        }
+
+        qatomic_inc(&req->remaining);
+
+        ctx = s->ctx ?: qemu_get_aio_context();
+        virtio_scsi_defer_tmf_to_aio_context(req, ctx);
+
+        virtio_scsi_tmf_dec_remaining(req);
+        ret = -EINPROGRESS;
+        break;
+    }
+
     case VIRTIO_SCSI_T_TMF_QUERY_TASK_SET:
         if (!d) {
             goto fail;
@@ -XXX,XX +XXX,XX @@ static int virtio_scsi_do_tmf(VirtIOSCSI *s, VirtIOSCSIReq *req)
             goto incorrect_lun;
         }
 
-        /* Add 1 to "remaining" until virtio_scsi_do_tmf returns.
-         * This way, if the bus starts calling back to the notifiers
-         * even before we finish the loop, virtio_scsi_cancel_notify
-         * will not complete the TMF too early.
-         */
-        req->remaining = 1;
-        QTAILQ_FOREACH_SAFE(r, &d->requests, next, next) {
-            if (r->hba_private) {
-                if (req->req.tmf.subtype == VIRTIO_SCSI_T_TMF_QUERY_TASK_SET) {
-                    /* "If there is any command present in the task set, then
-                     * return a service response set to FUNCTION SUCCEEDED".
-                     */
-                    req->resp.tmf.response = VIRTIO_SCSI_S_FUNCTION_SUCCEEDED;
-                    break;
-                } else {
-                    VirtIOSCSICancelNotifier *notifier;
-
-                    req->remaining++;
-                    notifier = g_new(VirtIOSCSICancelNotifier, 1);
-                    notifier->notifier.notify = virtio_scsi_cancel_notify;
-                    notifier->tmf_req = req;
-                    scsi_req_cancel_async(r, &notifier->notifier);
-                }
+        WITH_QEMU_LOCK_GUARD(&d->requests_lock) {
+            QTAILQ_FOREACH_SAFE(r, &d->requests, next, next) {
+                /* Request has hba_private while enqueued */
+                assert(r->hba_private);
+
+                /*
+                 * "If there is any command present in the task set, then
+                 * return a service response set to FUNCTION SUCCEEDED".
+                 */
+                req->resp.tmf.response = VIRTIO_SCSI_S_FUNCTION_SUCCEEDED;
+                break;
             }
         }
-        if (--req->remaining > 0) {
-            ret = -EINPROGRESS;
-        }
         break;
 
     case VIRTIO_SCSI_T_TMF_CLEAR_ACA:
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_reset(VirtIODevice *vdev)
     assert(!s->dataplane_started);
 
     virtio_scsi_reset_tmf_bh(s);
+    virtio_scsi_flush_defer_tmf_to_aio_context(s);
 
     qatomic_inc(&s->resetting);
     bus_cold_reset(BUS(&s->bus));
-- 
2.48.1

From: Stefan Hajnoczi <stefanha@redhat.com>

This is the cleanup function that must be called after
apply_iothread_vq_mapping() succeeds. virtio-scsi will need this
function too, so extract it.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20250311132616.1049687-9-stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 hw/block/virtio-blk.c | 27 +++++++++++++++++++++------
 1 file changed, 21 insertions(+), 6 deletions(-)

diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/virtio-blk.c
+++ b/hw/block/virtio-blk.c
@@ -XXX,XX +XXX,XX @@ validate_iothread_vq_mapping_list(IOThreadVirtQueueMappingList *list,
  * Fill in the AioContext for each virtqueue in the @vq_aio_context array given
  * the iothread-vq-mapping parameter in @iothread_vq_mapping_list.
  *
+ * cleanup_iothread_vq_mapping() must be called to free IOThread object
+ * references after this function returns success.
+ *
  * Returns: %true on success, %false on failure.
  **/
 static bool apply_iothread_vq_mapping(
@@ -XXX,XX +XXX,XX @@ static bool apply_iothread_vq_mapping(
     return true;
 }
 
+/**
+ * cleanup_iothread_vq_mapping:
+ * @list: The mapping of virtqueues to IOThreads.
+ *
+ * Release IOThread object references that were acquired by
+ * apply_iothread_vq_mapping().
+ */
+static void cleanup_iothread_vq_mapping(IOThreadVirtQueueMappingList *list)
+{
+    IOThreadVirtQueueMappingList *node;
+
+    for (node = list; node; node = node->next) {
+        IOThread *iothread = iothread_by_id(node->value->iothread);
+        object_unref(OBJECT(iothread));
+    }
+}
+
 /* Context: BQL held */
 static bool virtio_blk_vq_aio_context_init(VirtIOBlock *s, Error **errp)
 {
@@ -XXX,XX +XXX,XX @@ static void virtio_blk_vq_aio_context_cleanup(VirtIOBlock *s)
     assert(!s->ioeventfd_started);
 
     if (conf->iothread_vq_mapping_list) {
-        IOThreadVirtQueueMappingList *node;
-
-        for (node = conf->iothread_vq_mapping_list; node; node = node->next) {
-            IOThread *iothread = iothread_by_id(node->value->iothread);
-            object_unref(OBJECT(iothread));
-        }
+        cleanup_iothread_vq_mapping(conf->iothread_vq_mapping_list);
     }
 
     if (conf->iothread) {
-- 
2.48.1

From: Stefan Hajnoczi <stefanha@redhat.com>

Use noun_verb() function naming instead of verb_noun() because the
former is the most common naming style for APIs. The next commit will
move these functions into a header file so that virtio-scsi can call
them.

Shorten iothread_vq_mapping_apply()'s iothread_vq_mapping_list argument
to just "list" like in the other functions.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20250311132616.1049687-10-stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 hw/block/virtio-blk.c | 33 ++++++++++++++++-----------------
 1 file changed, 16 insertions(+), 17 deletions(-)

diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/virtio-blk.c
+++ b/hw/block/virtio-blk.c
@@ -XXX,XX +XXX,XX @@ static const BlockDevOps virtio_block_ops = {
 };
 
 static bool
-validate_iothread_vq_mapping_list(IOThreadVirtQueueMappingList *list,
-        uint16_t num_queues, Error **errp)
+iothread_vq_mapping_validate(IOThreadVirtQueueMappingList *list, uint16_t
+        num_queues, Error **errp)
 {
     g_autofree unsigned long *vqs = bitmap_new(num_queues);
     g_autoptr(GHashTable) iothreads =
@@ -XXX,XX +XXX,XX @@ validate_iothread_vq_mapping_list(IOThreadVirtQueueMappingList *list,
 }
 
 /**
- * apply_iothread_vq_mapping:
- * @iothread_vq_mapping_list: The mapping of virtqueues to IOThreads.
+ * iothread_vq_mapping_apply:
+ * @list: The mapping of virtqueues to IOThreads.
  * @vq_aio_context: The array of AioContext pointers to fill in.
  * @num_queues: The length of @vq_aio_context.
  * @errp: If an error occurs, a pointer to the area to store the error.
  *
  * Fill in the AioContext for each virtqueue in the @vq_aio_context array given
- * the iothread-vq-mapping parameter in @iothread_vq_mapping_list.
+ * the iothread-vq-mapping parameter in @list.
  *
- * cleanup_iothread_vq_mapping() must be called to free IOThread object
+ * iothread_vq_mapping_cleanup() must be called to free IOThread object
  * references after this function returns success.
  *
  * Returns: %true on success, %false on failure.
  **/
-static bool apply_iothread_vq_mapping(
-        IOThreadVirtQueueMappingList *iothread_vq_mapping_list,
+static bool iothread_vq_mapping_apply(
+        IOThreadVirtQueueMappingList *list,
         AioContext **vq_aio_context,
         uint16_t num_queues,
         Error **errp)
@@ -XXX,XX +XXX,XX @@ static bool apply_iothread_vq_mapping(
     size_t num_iothreads = 0;
     size_t cur_iothread = 0;
 
-    if (!validate_iothread_vq_mapping_list(iothread_vq_mapping_list,
-                                           num_queues, errp)) {
+    if (!iothread_vq_mapping_validate(list, num_queues, errp)) {
         return false;
     }
 
-    for (node = iothread_vq_mapping_list; node; node = node->next) {
+    for (node = list; node; node = node->next) {
         num_iothreads++;
     }
 
-    for (node = iothread_vq_mapping_list; node; node = node->next) {
+    for (node = list; node; node = node->next) {
         IOThread *iothread = iothread_by_id(node->value->iothread);
         AioContext *ctx = iothread_get_aio_context(iothread);
 
@@ -XXX,XX +XXX,XX @@ static bool apply_iothread_vq_mapping(
 }
 
 /**
- * cleanup_iothread_vq_mapping:
+ * iothread_vq_mapping_cleanup:
  * @list: The mapping of virtqueues to IOThreads.
  *
  * Release IOThread object references that were acquired by
- * apply_iothread_vq_mapping().
+ * iothread_vq_mapping_apply().
  */
-static void cleanup_iothread_vq_mapping(IOThreadVirtQueueMappingList *list)
+static void iothread_vq_mapping_cleanup(IOThreadVirtQueueMappingList *list)
 {
     IOThreadVirtQueueMappingList *node;
 
@@ -XXX,XX +XXX,XX @@ static bool virtio_blk_vq_aio_context_init(VirtIOBlock *s, Error **errp)
     s->vq_aio_context = g_new(AioContext *, conf->num_queues);
 
     if (conf->iothread_vq_mapping_list) {
-        if (!apply_iothread_vq_mapping(conf->iothread_vq_mapping_list,
+        if (!iothread_vq_mapping_apply(conf->iothread_vq_mapping_list,
                                        s->vq_aio_context,
                                        conf->num_queues,
                                        errp)) {
@@ -XXX,XX +XXX,XX @@ static void virtio_blk_vq_aio_context_cleanup(VirtIOBlock *s)
     assert(!s->ioeventfd_started);
 
     if (conf->iothread_vq_mapping_list) {
-        cleanup_iothread_vq_mapping(conf->iothread_vq_mapping_list);
+        iothread_vq_mapping_cleanup(conf->iothread_vq_mapping_list);
     }
 
     if (conf->iothread) {
-- 
2.48.1

From: Stefan Hajnoczi <stefanha@redhat.com>

The code that builds an array of AioContext pointers indexed by the
virtqueue is not specific to virtio-blk. virtio-scsi will need to do the
same thing, so extract the functions.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20250311132616.1049687-11-stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/hw/virtio/iothread-vq-mapping.h |  45 ++++++++
 hw/block/virtio-blk.c                   | 142 +-----------------------
 hw/virtio/iothread-vq-mapping.c         | 131 ++++++++++++++++++++++
 hw/virtio/meson.build                   |   1 +
 4 files changed, 178 insertions(+), 141 deletions(-)
 create mode 100644 include/hw/virtio/iothread-vq-mapping.h
 create mode 100644 hw/virtio/iothread-vq-mapping.c

diff --git a/include/hw/virtio/iothread-vq-mapping.h b/include/hw/virtio/iothread-vq-mapping.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/virtio/iothread-vq-mapping.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * IOThread Virtqueue Mapping
+ *
+ * Copyright Red Hat, Inc
+ *
+ * SPDX-License-Identifier: GPL-2.0-only
+ */
+
+#ifndef HW_VIRTIO_IOTHREAD_VQ_MAPPING_H
+#define HW_VIRTIO_IOTHREAD_VQ_MAPPING_H
+
+#include "qapi/error.h"
+#include "qapi/qapi-types-virtio.h"
+
+/**
+ * iothread_vq_mapping_apply:
+ * @list: The mapping of virtqueues to IOThreads.
+ * @vq_aio_context: The array of AioContext pointers to fill in.
+ * @num_queues: The length of @vq_aio_context.
+ * @errp: If an error occurs, a pointer to the area to store the error.
+ *
+ * Fill in the AioContext for each virtqueue in the @vq_aio_context array given
+ * the iothread-vq-mapping parameter in @list.
+ *
+ * iothread_vq_mapping_cleanup() must be called to free IOThread object
+ * references after this function returns success.
+ *
+ * Returns: %true on success, %false on failure.
+ **/
+bool iothread_vq_mapping_apply(
+        IOThreadVirtQueueMappingList *list,
+        AioContext **vq_aio_context,
+        uint16_t num_queues,
+        Error **errp);
+
+/**
+ * iothread_vq_mapping_cleanup:
+ * @list: The mapping of virtqueues to IOThreads.
+ *
+ * Release IOThread object references that were acquired by
+ * iothread_vq_mapping_apply().
+ */
+void iothread_vq_mapping_cleanup(IOThreadVirtQueueMappingList *list);
+
+#endif /* HW_VIRTIO_IOTHREAD_VQ_MAPPING_H */
diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/virtio-blk.c
+++ b/hw/block/virtio-blk.c
@@ -XXX,XX +XXX,XX @@
 #endif
 #include "hw/virtio/virtio-bus.h"
 #include "migration/qemu-file-types.h"
+#include "hw/virtio/iothread-vq-mapping.h"
 #include "hw/virtio/virtio-access.h"
 #include "hw/virtio/virtio-blk-common.h"
 #include "qemu/coroutine.h"
@@ -XXX,XX +XXX,XX @@ static const BlockDevOps virtio_block_ops = {
     .drained_end   = virtio_blk_drained_end,
 };
 
-static bool
-iothread_vq_mapping_validate(IOThreadVirtQueueMappingList *list, uint16_t
-        num_queues, Error **errp)
-{
-    g_autofree unsigned long *vqs = bitmap_new(num_queues);
-    g_autoptr(GHashTable) iothreads =
-        g_hash_table_new(g_str_hash, g_str_equal);
-
-    for (IOThreadVirtQueueMappingList *node = list; node; node = node->next) {
-        const char *name = node->value->iothread;
-        uint16List *vq;
-
-        if (!iothread_by_id(name)) {
-            error_setg(errp, "IOThread \"%s\" object does not exist", name);
-            return false;
-        }
-
-        if (!g_hash_table_add(iothreads, (gpointer)name)) {
-            error_setg(errp,
-                    "duplicate IOThread name \"%s\" in iothread-vq-mapping",
-                    name);
-            return false;
-        }
-
-        if (node != list) {
-            if (!!node->value->vqs != !!list->value->vqs) {
-                error_setg(errp, "either all items in iothread-vq-mapping "
-                                 "must have vqs or none of them must have it");
-                return false;
-            }
-        }
-
-        for (vq = node->value->vqs; vq; vq = vq->next) {
-            if (vq->value >= num_queues) {
-                error_setg(errp, "vq index %u for IOThread \"%s\" must be "
-                        "less than num_queues %u in iothread-vq-mapping",
-                        vq->value, name, num_queues);
-                return false;
-            }
-
-            if (test_and_set_bit(vq->value, vqs)) {
-                error_setg(errp, "cannot assign vq %u to IOThread \"%s\" "
-                        "because it is already assigned", vq->value, name);
-                return false;
-            }
-        }
-    }
-
-    if (list->value->vqs) {
-        for (uint16_t i = 0; i < num_queues; i++) {
-            if (!test_bit(i, vqs)) {
-                error_setg(errp,
-                        "missing vq %u IOThread assignment in iothread-vq-mapping",
-                        i);
-                return false;
-            }
-        }
-    }
-
-    return true;
-}
-
-/**
- * iothread_vq_mapping_apply:
- * @list: The mapping of virtqueues to IOThreads.
- * @vq_aio_context: The array of AioContext pointers to fill in.
- * @num_queues: The length of @vq_aio_context.
- * @errp: If an error occurs, a pointer to the area to store the error.
- *
- * Fill in the AioContext for each virtqueue in the @vq_aio_context array given
- * the iothread-vq-mapping parameter in @list.
- *
- * iothread_vq_mapping_cleanup() must be called to free IOThread object
- * references after this function returns success.
- *
- * Returns: %true on success, %false on failure.
- **/
-static bool iothread_vq_mapping_apply(
-        IOThreadVirtQueueMappingList *list,
-        AioContext **vq_aio_context,
-        uint16_t num_queues,
-        Error **errp)
-{
-    IOThreadVirtQueueMappingList *node;
-    size_t num_iothreads = 0;
-    size_t cur_iothread = 0;
-
-    if (!iothread_vq_mapping_validate(list, num_queues, errp)) {
-        return false;
-    }
-
-    for (node = list; node; node = node->next) {
-        num_iothreads++;
-    }
-
-    for (node = list; node; node = node->next) {
-        IOThread *iothread = iothread_by_id(node->value->iothread);
-        AioContext *ctx = iothread_get_aio_context(iothread);
-
-        /* Released in virtio_blk_vq_aio_context_cleanup() */
-        object_ref(OBJECT(iothread));
-
-        if (node->value->vqs) {
-            uint16List *vq;
-
-            /* Explicit vq:IOThread assignment */
-            for (vq = node->value->vqs; vq; vq = vq->next) {
-                assert(vq->value < num_queues);
-                vq_aio_context[vq->value] = ctx;
-            }
-        } else {
-            /* Round-robin vq:IOThread assignment */
-            for (unsigned i = cur_iothread; i < num_queues;
-                 i += num_iothreads) {
-                vq_aio_context[i] = ctx;
-            }
-        }
-
-        cur_iothread++;
-    }
-
-    return true;
-}
-
-/**
- * iothread_vq_mapping_cleanup:
- * @list: The mapping of virtqueues to IOThreads.
- *
- * Release IOThread object references that were acquired by
- * iothread_vq_mapping_apply().
- */
-static void iothread_vq_mapping_cleanup(IOThreadVirtQueueMappingList *list)
-{
-    IOThreadVirtQueueMappingList *node;
-
-    for (node = list; node; node = node->next) {
-        IOThread *iothread = iothread_by_id(node->value->iothread);
-        object_unref(OBJECT(iothread));
-    }
-}
-
 /* Context: BQL held */
 static bool virtio_blk_vq_aio_context_init(VirtIOBlock *s, Error **errp)
 {
diff --git a/hw/virtio/iothread-vq-mapping.c b/hw/virtio/iothread-vq-mapping.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/virtio/iothread-vq-mapping.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * IOThread Virtqueue Mapping
+ *
+ * Copyright Red Hat, Inc
+ *
+ * SPDX-License-Identifier: GPL-2.0-only
+ */
+
+#include "qemu/osdep.h"
+#include "system/iothread.h"
+#include "hw/virtio/iothread-vq-mapping.h"
+
+static bool
+iothread_vq_mapping_validate(IOThreadVirtQueueMappingList *list, uint16_t
+        num_queues, Error **errp)
+{
+    g_autofree unsigned long *vqs = bitmap_new(num_queues);
+    g_autoptr(GHashTable) iothreads =
+        g_hash_table_new(g_str_hash, g_str_equal);
+
+    for (IOThreadVirtQueueMappingList *node = list; node; node = node->next) {
+        const char *name = node->value->iothread;
+        uint16List *vq;
+
+        if (!iothread_by_id(name)) {
+            error_setg(errp, "IOThread \"%s\" object does not exist", name);
+            return false;
+        }
+
+        if (!g_hash_table_add(iothreads, (gpointer)name)) {
+            error_setg(errp,
+                    "duplicate IOThread name \"%s\" in iothread-vq-mapping",
+                    name);
+            return false;
+        }
+
+        if (node != list) {
+            if (!!node->value->vqs != !!list->value->vqs) {
+                error_setg(errp, "either all items in iothread-vq-mapping "
+                                 "must have vqs or none of them must have it");
+                return false;
+            }
+        }
+
+        for (vq = node->value->vqs; vq; vq = vq->next) {
+            if (vq->value >= num_queues) {
+                error_setg(errp, "vq index %u for IOThread \"%s\" must be "
+                        "less than num_queues %u in iothread-vq-mapping",
+                        vq->value, name, num_queues);
+                return false;
+            }
+
+            if (test_and_set_bit(vq->value, vqs)) {
+                error_setg(errp, "cannot assign vq %u to IOThread \"%s\" "
+                        "because it is already assigned", vq->value, name);
+                return false;
+            }
+        }
+    }
+
+    if (list->value->vqs) {
+        for (uint16_t i = 0; i < num_queues; i++) {
+            if (!test_bit(i, vqs)) {
+                error_setg(errp,
+                        "missing vq %u IOThread assignment in iothread-vq-mapping",
+                        i);
+                return false;
+            }
+        }
+    }
+
+    return true;
+}
+
+bool iothread_vq_mapping_apply(
+        IOThreadVirtQueueMappingList *list,
+        AioContext **vq_aio_context,
+        uint16_t num_queues,
+        Error **errp)
+{
+    IOThreadVirtQueueMappingList *node;
+    size_t num_iothreads = 0;
+    size_t cur_iothread = 0;
+
+    if (!iothread_vq_mapping_validate(list, num_queues, errp)) {
+        return false;
+    }
+
+    for (node = list; node; node = node->next) {
+        num_iothreads++;
+    }
+
+    for (node = list; node; node = node->next) {
+        IOThread *iothread = iothread_by_id(node->value->iothread);
+        AioContext *ctx = iothread_get_aio_context(iothread);
+
+        /* Released in virtio_blk_vq_aio_context_cleanup() */
+        object_ref(OBJECT(iothread));
+
+        if (node->value->vqs) {
+            uint16List *vq;
+
+            /* Explicit vq:IOThread assignment */
+            for (vq = node->value->vqs; vq; vq = vq->next) {
+                assert(vq->value < num_queues);
+                vq_aio_context[vq->value] = ctx;
+            }
+        } else {
+            /* Round-robin vq:IOThread assignment */
+            for (unsigned i = cur_iothread; i < num_queues;
+                 i += num_iothreads) {
+                vq_aio_context[i] = ctx;
+            }
+        }
+
+        cur_iothread++;
+    }
+
+    return true;
+}
+
+void iothread_vq_mapping_cleanup(IOThreadVirtQueueMappingList *list)
+{
+    IOThreadVirtQueueMappingList *node;
+
+    for (node = list; node; node = node->next) {
+        IOThread *iothread = iothread_by_id(node->value->iothread);
+        object_unref(OBJECT(iothread));
+    }
+}
+
diff --git a/hw/virtio/meson.build b/hw/virtio/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/virtio/meson.build
+++ b/hw/virtio/meson.build
@@ -XXX,XX +XXX,XX @@
 system_virtio_ss = ss.source_set()
 system_virtio_ss.add(files('virtio-bus.c'))
+system_virtio_ss.add(files('iothread-vq-mapping.c'))
 system_virtio_ss.add(when: 'CONFIG_VIRTIO_PCI', if_true: files('virtio-pci.c'))
 system_virtio_ss.add(when: 'CONFIG_VIRTIO_MMIO', if_true: files('virtio-mmio.c'))
 system_virtio_ss.add(when: 'CONFIG_VIRTIO_CRYPTO', if_true: files('virtio-crypto.c'))
-- 
2.48.1

From: Stefan Hajnoczi <stefanha@redhat.com>

Allow virtio-scsi virtqueues to be assigned to different IOThreads. This
makes it possible to take advantage of host multi-queue block layer
scalability by assigning virtqueues that have affinity with vCPUs to
different IOThreads that have affinity with host CPUs. The same feature
was introduced for virtio-blk in the past:
https://developers.redhat.com/articles/2024/09/05/scaling-virtio-blk-disk-io-iothread-virtqueue-mapping

Here are fio randread 4k iodepth=64 results from a 4 vCPU guest with an
Intel P4800X SSD:
iothreads IOPS
------------------------------
1         189576
2         312698
4         346744

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20250311132616.1049687-12-stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/hw/virtio/virtio-scsi.h |  5 +-
 hw/scsi/virtio-scsi-dataplane.c | 90 ++++++++++++++++++++++++---------
 hw/scsi/virtio-scsi.c           | 63 ++++++++++++++---------
 3 files changed, 107 insertions(+), 51 deletions(-)

diff --git a/include/hw/virtio/virtio-scsi.h b/include/hw/virtio/virtio-scsi.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/virtio/virtio-scsi.h
+++ b/include/hw/virtio/virtio-scsi.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/virtio/virtio.h"
 #include "hw/scsi/scsi.h"
 #include "chardev/char-fe.h"
+#include "qapi/qapi-types-virtio.h"
 #include "system/iothread.h"
 
 #define TYPE_VIRTIO_SCSI_COMMON "virtio-scsi-common"
@@ -XXX,XX +XXX,XX @@ struct VirtIOSCSIConf {
     CharBackend chardev;
     uint32_t boot_tpgt;
     IOThread *iothread;
+    IOThreadVirtQueueMappingList *iothread_vq_mapping_list;
 };
 
 struct VirtIOSCSI;
@@ -XXX,XX +XXX,XX @@ struct VirtIOSCSI {
     QTAILQ_HEAD(, VirtIOSCSIReq) tmf_bh_list;
 
     /* Fields for dataplane below */
-    AioContext *ctx; /* one iothread per virtio-scsi-pci for now */
+    AioContext **vq_aio_context; /* per-virtqueue AioContext pointer */
 
     bool dataplane_started;
     bool dataplane_starting;
@@ -XXX,XX +XXX,XX @@ void virtio_scsi_common_realize(DeviceState *dev,
 void virtio_scsi_common_unrealize(DeviceState *dev);
 
 void virtio_scsi_dataplane_setup(VirtIOSCSI *s, Error **errp);
+void virtio_scsi_dataplane_cleanup(VirtIOSCSI *s);
 int virtio_scsi_dataplane_start(VirtIODevice *s);
 void virtio_scsi_dataplane_stop(VirtIODevice *s);
 
diff --git a/hw/scsi/virtio-scsi-dataplane.c b/hw/scsi/virtio-scsi-dataplane.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/scsi/virtio-scsi-dataplane.c
+++ b/hw/scsi/virtio-scsi-dataplane.c
@@ -XXX,XX +XXX,XX @@
 #include "system/block-backend.h"
 #include "hw/scsi/scsi.h"
 #include "scsi/constants.h"
+#include "hw/virtio/iothread-vq-mapping.h"
 #include "hw/virtio/virtio-bus.h"
 
 /* Context: BQL held */
@@ -XXX,XX +XXX,XX @@ void virtio_scsi_dataplane_setup(VirtIOSCSI *s, Error **errp)
     VirtIODevice *vdev = VIRTIO_DEVICE(s);
     BusState *qbus = qdev_get_parent_bus(DEVICE(vdev));
     VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(qbus);
+    uint16_t num_vqs = vs->conf.num_queues + VIRTIO_SCSI_VQ_NUM_FIXED;
 
-    if (vs->conf.iothread) {
+    if (vs->conf.iothread && vs->conf.iothread_vq_mapping_list) {
+        error_setg(errp,
+                   "iothread and iothread-vq-mapping properties cannot be set "
+                   "at the same time");
+        return;
+    }
+
+    if (vs->conf.iothread || vs->conf.iothread_vq_mapping_list) {
         if (!k->set_guest_notifiers || !k->ioeventfd_assign) {
             error_setg(errp,
                        "device is incompatible with iothread "
@@ -XXX,XX +XXX,XX @@ void virtio_scsi_dataplane_setup(VirtIOSCSI *s, Error **errp)
             error_setg(errp, "ioeventfd is required for iothread");
             return;
         }
-        s->ctx = iothread_get_aio_context(vs->conf.iothread);
-    } else {
-        if (!virtio_device_ioeventfd_enabled(vdev)) {
+    }
+
+    s->vq_aio_context = g_new(AioContext *, num_vqs);
+
+    if (vs->conf.iothread_vq_mapping_list) {
+        if (!iothread_vq_mapping_apply(vs->conf.iothread_vq_mapping_list,
+                                       s->vq_aio_context, num_vqs, errp)) {
+            g_free(s->vq_aio_context);
+            s->vq_aio_context = NULL;
             return;
         }
-        s->ctx = qemu_get_aio_context();
+    } else if (vs->conf.iothread) {
+        AioContext *ctx = iothread_get_aio_context(vs->conf.iothread);
+        for (uint16_t i = 0; i < num_vqs; i++) {
+            s->vq_aio_context[i] = ctx;
+        }
+
+        /* Released in virtio_scsi_dataplane_cleanup() */
+        object_ref(OBJECT(vs->conf.iothread));
+    } else {
+        AioContext *ctx = qemu_get_aio_context();
+        for (unsigned i = 0; i < num_vqs; i++) {
+            s->vq_aio_context[i] = ctx;
+        }
+    }
+}
+
+/* Context: BQL held */
+void virtio_scsi_dataplane_cleanup(VirtIOSCSI *s)
+{
+    VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(s);
+
+    if (vs->conf.iothread_vq_mapping_list) {
+        iothread_vq_mapping_cleanup(vs->conf.iothread_vq_mapping_list);
     }
+
+    if (vs->conf.iothread) {
+        object_unref(OBJECT(vs->conf.iothread));
+    }
+
+    g_free(s->vq_aio_context);
+    s->vq_aio_context = NULL;
 }
 
 static int virtio_scsi_set_host_notifier(VirtIOSCSI *s, VirtQueue *vq, int n)
@@ -XXX,XX +XXX,XX @@ static int virtio_scsi_set_host_notifier(VirtIOSCSI *s, VirtQueue *vq, int n)
 }
 
 /* Context: BH in IOThread */
-static void virtio_scsi_dataplane_stop_bh(void *opaque)
+static void virtio_scsi_dataplane_stop_vq_bh(void *opaque)
 {
-    VirtIOSCSI *s = opaque;
-    VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(s);
+    AioContext *ctx = qemu_get_current_aio_context();
+    VirtQueue *vq = opaque;
     EventNotifier *host_notifier;
-    int i;
 
-    virtio_queue_aio_detach_host_notifier(vs->ctrl_vq, s->ctx);
-    host_notifier = virtio_queue_get_host_notifier(vs->ctrl_vq);
+    virtio_queue_aio_detach_host_notifier(vq, ctx);
+    host_notifier = virtio_queue_get_host_notifier(vq);
 
     /*
      * Test and clear notifier after disabling event, in case poll callback
      * didn't have time to run.
      */
     virtio_queue_host_notifier_read(host_notifier);
-
-    virtio_queue_aio_detach_host_notifier(vs->event_vq, s->ctx);
-    host_notifier = virtio_queue_get_host_notifier(vs->event_vq);
-    virtio_queue_host_notifier_read(host_notifier);
-
-    for (i = 0; i < vs->conf.num_queues; i++) {
-        virtio_queue_aio_detach_host_notifier(vs->cmd_vqs[i], s->ctx);
-        host_notifier = virtio_queue_get_host_notifier(vs->cmd_vqs[i]);
-        virtio_queue_host_notifier_read(host_notifier);
-    }
 }
 
 /* Context: BQL held */
@@ -XXX,XX +XXX,XX @@ int virtio_scsi_dataplane_start(VirtIODevice *vdev)
     smp_wmb(); /* paired with aio_notify_accept() */
 
     if (s->bus.drain_count == 0) {
-        virtio_queue_aio_attach_host_notifier(vs->ctrl_vq, s->ctx);
-        virtio_queue_aio_attach_host_notifier_no_poll(vs->event_vq, s->ctx);
+        virtio_queue_aio_attach_host_notifier(vs->ctrl_vq,
+                                              s->vq_aio_context[0]);
+        virtio_queue_aio_attach_host_notifier_no_poll(vs->event_vq,
+                                                      s->vq_aio_context[1]);
 
         for (i = 0; i < vs->conf.num_queues; i++) {
-            virtio_queue_aio_attach_host_notifier(vs->cmd_vqs[i], s->ctx);
+            AioContext *ctx = s->vq_aio_context[VIRTIO_SCSI_VQ_NUM_FIXED + i];
+            virtio_queue_aio_attach_host_notifier(vs->cmd_vqs[i], ctx);
         }
     }
     return 0;
@@ -XXX,XX +XXX,XX @@ void virtio_scsi_dataplane_stop(VirtIODevice *vdev)
     s->dataplane_stopping = true;
 
     if (s->bus.drain_count == 0) {
-        aio_wait_bh_oneshot(s->ctx, virtio_scsi_dataplane_stop_bh, s);
+        for (i = 0; i < vs->conf.num_queues + VIRTIO_SCSI_VQ_NUM_FIXED; i++) {
+            VirtQueue *vq = virtio_get_queue(&vs->parent_obj, i);
+            AioContext *ctx = s->vq_aio_context[i];
+            aio_wait_bh_oneshot(ctx, virtio_scsi_dataplane_stop_vq_bh, vq);
+        }
     }
 
     blk_drain_all(); /* ensure there are no in-flight requests */
diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/scsi/virtio-scsi.c
+++ b/hw/scsi/virtio-scsi.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/qdev-properties.h"
 #include "hw/scsi/scsi.h"
 #include "scsi/constants.h"
+#include "hw/virtio/iothread-vq-mapping.h"
 #include "hw/virtio/virtio-bus.h"
 #include "hw/virtio/virtio-access.h"
 #include "trace.h"
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_cancel_notify(Notifier *notifier, void *data)
     g_free(n);
 }
 
-static inline void virtio_scsi_ctx_check(VirtIOSCSI *s, SCSIDevice *d)
-{
-    if (s->dataplane_started && d && blk_is_available(d->conf.blk)) {
-        assert(blk_get_aio_context(d->conf.blk) == s->ctx);
-    }
-}
-
 static void virtio_scsi_do_one_tmf_bh(VirtIOSCSIReq *req)
 {
     VirtIOSCSI *s = req->dev;
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_flush_defer_tmf_to_aio_context(VirtIOSCSI *s)
 
     assert(!s->dataplane_started);
 
-    if (s->ctx) {
+    for (uint32_t i = 0; i < s->parent_obj.conf.num_queues; i++) {
+        AioContext *ctx = s->vq_aio_context[VIRTIO_SCSI_VQ_NUM_FIXED + i];
+
         /* Our BH only runs after previously scheduled BHs */
-        aio_wait_bh_oneshot(s->ctx, dummy_bh, NULL);
+        aio_wait_bh_oneshot(ctx, dummy_bh, NULL);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static int virtio_scsi_do_tmf(VirtIOSCSI *s, VirtIOSCSIReq *req)
     AioContext *ctx;
     int ret = 0;
 
-    virtio_scsi_ctx_check(s, d);
     /* Here VIRTIO_SCSI_S_OK means "FUNCTION COMPLETE".  */
     req->resp.tmf.response = VIRTIO_SCSI_S_OK;
 
@@ -XXX,XX +XXX,XX @@ static int virtio_scsi_do_tmf(VirtIOSCSI *s, VirtIOSCSIReq *req)
 
     case VIRTIO_SCSI_T_TMF_ABORT_TASK_SET:
     case VIRTIO_SCSI_T_TMF_CLEAR_TASK_SET: {
+        g_autoptr(GHashTable) aio_contexts = g_hash_table_new(NULL, NULL);
+
         if (!d) {
             goto fail;
         }
@@ -XXX,XX +XXX,XX @@ static int virtio_scsi_do_tmf(VirtIOSCSI *s, VirtIOSCSIReq *req)
 
         qatomic_inc(&req->remaining);
 
-        ctx = s->ctx ?: qemu_get_aio_context();
-        virtio_scsi_defer_tmf_to_aio_context(req, ctx);
+        for (uint32_t i = 0; i < s->parent_obj.conf.num_queues; i++) {
+            ctx = s->vq_aio_context[VIRTIO_SCSI_VQ_NUM_FIXED + i];
+
+            if (!g_hash_table_add(aio_contexts, ctx)) {
+                continue; /* skip previously added AioContext */
+            }
+
+            virtio_scsi_defer_tmf_to_aio_context(req, ctx);
+        }
 
         virtio_scsi_tmf_dec_remaining(req);
         ret = -EINPROGRESS;
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_handle_ctrl_vq(VirtIOSCSI *s, VirtQueue *vq)
  */
 static bool virtio_scsi_defer_to_dataplane(VirtIOSCSI *s)
 {
-    if (!s->ctx || s->dataplane_started) {
+    if (s->dataplane_started) {
         return false;
     }
+    if (s->vq_aio_context[0] == qemu_get_aio_context()) {
+        return false; /* not using IOThreads */
+    }
 
     virtio_device_start_ioeventfd(&s->parent_obj.parent_obj);
     return !s->dataplane_fenced;
@@ -XXX,XX +XXX,XX @@ static int virtio_scsi_handle_cmd_req_prepare(VirtIOSCSI *s, VirtIOSCSIReq *req)
         virtio_scsi_complete_cmd_req(req);
         return -ENOENT;
     }
-    virtio_scsi_ctx_check(s, d);
     req->sreq = scsi_req_new(d, req->req.cmd.tag,
                              virtio_scsi_get_lun(req->req.cmd.lun),
                              req->req.cmd.cdb, vs->cdb_size, req);
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_hotplug(HotplugHandler *hotplug_dev, DeviceState *dev,
 {
     VirtIODevice *vdev = VIRTIO_DEVICE(hotplug_dev);
     VirtIOSCSI *s = VIRTIO_SCSI(vdev);
+    AioContext *ctx = s->vq_aio_context[VIRTIO_SCSI_VQ_NUM_FIXED];
     SCSIDevice *sd = SCSI_DEVICE(dev);
-    int ret;
 
-    if (s->ctx && !s->dataplane_fenced) {
-        ret = blk_set_aio_context(sd->conf.blk, s->ctx, errp);
-        if (ret < 0) {
-            return;
-        }
+    if (ctx != qemu_get_aio_context() && !s->dataplane_fenced) {
+        /*
+         * Try to make the BlockBackend's AioContext match ours. Ignore failure
+         * because I/O will still work although block jobs and other users
+         * might be slower when multiple AioContexts use a BlockBackend.
+         */
+        blk_set_aio_context(sd->conf.blk, ctx, errp);
     }
 
     if (virtio_vdev_has_feature(vdev, VIRTIO_SCSI_F_HOTPLUG)) {
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_hotunplug(HotplugHandler *hotplug_dev, DeviceState *dev,
 
     qdev_simple_device_unplug_cb(hotplug_dev, dev, errp);
 
-    if (s->ctx) {
+    if (s->vq_aio_context[VIRTIO_SCSI_VQ_NUM_FIXED] != qemu_get_aio_context()) {
         /* If other users keep the BlockBackend in the iothread, that's ok */
         blk_set_aio_context(sd->conf.blk, qemu_get_aio_context(), NULL);
     }
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_drained_begin(SCSIBus *bus)
 
     for (uint32_t i = 0; i < total_queues; i++) {
         VirtQueue *vq = virtio_get_queue(vdev, i);
-        virtio_queue_aio_detach_host_notifier(vq, s->ctx);
+        virtio_queue_aio_detach_host_notifier(vq, s->vq_aio_context[i]);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_drained_end(SCSIBus *bus)
 
     for (uint32_t i = 0; i < total_queues; i++) {
         VirtQueue *vq = virtio_get_queue(vdev, i);
+        AioContext *ctx = s->vq_aio_context[i];
+
         if (vq == vs->event_vq) {
-            virtio_queue_aio_attach_host_notifier_no_poll(vq, s->ctx);
+            virtio_queue_aio_attach_host_notifier_no_poll(vq, ctx);
         } else {
-            virtio_queue_aio_attach_host_notifier(vq, s->ctx);
+            virtio_queue_aio_attach_host_notifier(vq, ctx);
         }
     }
 }
@@ -XXX,XX +XXX,XX @@ void virtio_scsi_common_unrealize(DeviceState *dev)
     virtio_cleanup(vdev);
 }
 
+/* main loop */
 static void virtio_scsi_device_unrealize(DeviceState *dev)
 {
     VirtIOSCSI *s = VIRTIO_SCSI(dev);
 
     virtio_scsi_reset_tmf_bh(s);
-
+    virtio_scsi_dataplane_cleanup(s);
     qbus_set_hotplug_handler(BUS(&s->bus), NULL);
     virtio_scsi_common_unrealize(dev);
     qemu_mutex_destroy(&s->tmf_bh_lock);
@@ -XXX,XX +XXX,XX @@ static const Property virtio_scsi_properties[] = {
                                                 VIRTIO_SCSI_F_CHANGE, true),
     DEFINE_PROP_LINK("iothread", VirtIOSCSI, parent_obj.conf.iothread,
                      TYPE_IOTHREAD, IOThread *),
+    DEFINE_PROP_IOTHREAD_VQ_MAPPING_LIST("iothread-vq-mapping", VirtIOSCSI,
+            parent_obj.conf.iothread_vq_mapping_list),
 };
 
 static const VMStateDescription vmstate_virtio_scsi = {
-- 
2.48.1

From: Stefan Hajnoczi <stefanha@redhat.com>

Previously the ctrl virtqueue was handled in the AioContext where SCSI
requests are processed. When IOThread Virtqueue Mapping was added things
become more complicated because SCSI requests could run in other
AioContexts.

Simplify by handling the ctrl virtqueue in the main loop where reset
operations can be performed. Note that BHs are still used canceling SCSI
requests in their AioContexts but at least the mean loop activity
doesn't need BHs anymore.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20250311132616.1049687-13-stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/hw/virtio/virtio-scsi.h |   8 --
 hw/scsi/virtio-scsi-dataplane.c |   6 ++
 hw/scsi/virtio-scsi.c           | 144 ++++++--------------------------
 3 files changed, 33 insertions(+), 125 deletions(-)

diff --git a/include/hw/virtio/virtio-scsi.h b/include/hw/virtio/virtio-scsi.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/virtio/virtio-scsi.h
+++ b/include/hw/virtio/virtio-scsi.h
@@ -XXX,XX +XXX,XX @@ struct VirtIOSCSI {
 
     QemuMutex ctrl_lock; /* protects ctrl_vq */
 
-    /*
-     * TMFs deferred to main loop BH. These fields are protected by
-     * tmf_bh_lock.
-     */
-    QemuMutex tmf_bh_lock;
-    QEMUBH *tmf_bh;
-    QTAILQ_HEAD(, VirtIOSCSIReq) tmf_bh_list;
-
     /* Fields for dataplane below */
     AioContext **vq_aio_context; /* per-virtqueue AioContext pointer */
 
diff --git a/hw/scsi/virtio-scsi-dataplane.c b/hw/scsi/virtio-scsi-dataplane.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/scsi/virtio-scsi-dataplane.c
+++ b/hw/scsi/virtio-scsi-dataplane.c
@@ -XXX,XX +XXX,XX @@ void virtio_scsi_dataplane_setup(VirtIOSCSI *s, Error **errp)
             s->vq_aio_context[i] = ctx;
         }
     }
+
+    /*
+     * Always handle the ctrl virtqueue in the main loop thread where device
+     * resets can be performed.
+     */
+    s->vq_aio_context[0] = qemu_get_aio_context();
 }
 
 /* Context: BQL held */
diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/scsi/virtio-scsi.c
+++ b/hw/scsi/virtio-scsi.c
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_cancel_notify(Notifier *notifier, void *data)
     g_free(n);
 }
 
-static void virtio_scsi_do_one_tmf_bh(VirtIOSCSIReq *req)
-{
-    VirtIOSCSI *s = req->dev;
-    SCSIDevice *d = virtio_scsi_device_get(s, req->req.tmf.lun);
-    BusChild *kid;
-    int target;
-
-    switch (req->req.tmf.subtype) {
-    case VIRTIO_SCSI_T_TMF_LOGICAL_UNIT_RESET:
-        if (!d) {
-            req->resp.tmf.response = VIRTIO_SCSI_S_BAD_TARGET;
-            goto out;
-        }
-        if (d->lun != virtio_scsi_get_lun(req->req.tmf.lun)) {
-            req->resp.tmf.response = VIRTIO_SCSI_S_INCORRECT_LUN;
-            goto out;
-        }
-        qatomic_inc(&s->resetting);
-        device_cold_reset(&d->qdev);
-        qatomic_dec(&s->resetting);
-        break;
-
-    case VIRTIO_SCSI_T_TMF_I_T_NEXUS_RESET:
-        target = req->req.tmf.lun[1];
-        qatomic_inc(&s->resetting);
-
-        rcu_read_lock();
-        QTAILQ_FOREACH_RCU(kid, &s->bus.qbus.children, sibling) {
-            SCSIDevice *d1 = SCSI_DEVICE(kid->child);
-            if (d1->channel == 0 && d1->id == target) {
-                device_cold_reset(&d1->qdev);
-            }
-        }
-        rcu_read_unlock();
-
-        qatomic_dec(&s->resetting);
-        break;
-
-    default:
-        g_assert_not_reached();
-    }
-
-out:
-    object_unref(OBJECT(d));
-    virtio_scsi_complete_req(req, &s->ctrl_lock);
-}
-
-/* Some TMFs must be processed from the main loop thread */
-static void virtio_scsi_do_tmf_bh(void *opaque)
-{
-    VirtIOSCSI *s = opaque;
-    QTAILQ_HEAD(, VirtIOSCSIReq) reqs = QTAILQ_HEAD_INITIALIZER(reqs);
-    VirtIOSCSIReq *req;
-    VirtIOSCSIReq *tmp;
-
-    GLOBAL_STATE_CODE();
-
-    WITH_QEMU_LOCK_GUARD(&s->tmf_bh_lock) {
-        QTAILQ_FOREACH_SAFE(req, &s->tmf_bh_list, next, tmp) {
-            QTAILQ_REMOVE(&s->tmf_bh_list, req, next);
-            QTAILQ_INSERT_TAIL(&reqs, req, next);
-        }
-
-        qemu_bh_delete(s->tmf_bh);
-        s->tmf_bh = NULL;
-    }
-
-    QTAILQ_FOREACH_SAFE(req, &reqs, next, tmp) {
-        QTAILQ_REMOVE(&reqs, req, next);
-        virtio_scsi_do_one_tmf_bh(req);
-    }
-}
-
-static void virtio_scsi_reset_tmf_bh(VirtIOSCSI *s)
-{
-    VirtIOSCSIReq *req;
-    VirtIOSCSIReq *tmp;
-
-    GLOBAL_STATE_CODE();
-
-    /* Called after ioeventfd has been stopped, so tmf_bh_lock is not needed */
-    if (s->tmf_bh) {
-        qemu_bh_delete(s->tmf_bh);
-        s->tmf_bh = NULL;
-    }
-
-    QTAILQ_FOREACH_SAFE(req, &s->tmf_bh_list, next, tmp) {
-        QTAILQ_REMOVE(&s->tmf_bh_list, req, next);
-
-        /* SAM-6 6.3.2 Hard reset */
-        req->resp.tmf.response = VIRTIO_SCSI_S_TARGET_FAILURE;
-        virtio_scsi_complete_req(req, &req->dev->ctrl_lock);
-    }
-}
-
-static void virtio_scsi_defer_tmf_to_main_loop(VirtIOSCSIReq *req)
-{
-    VirtIOSCSI *s = req->dev;
-
-    WITH_QEMU_LOCK_GUARD(&s->tmf_bh_lock) {
-        QTAILQ_INSERT_TAIL(&s->tmf_bh_list, req, next);
-
-        if (!s->tmf_bh) {
-            s->tmf_bh = qemu_bh_new(virtio_scsi_do_tmf_bh, s);
-            qemu_bh_schedule(s->tmf_bh);
-        }
-    }
-}
-
 static void virtio_scsi_tmf_cancel_req(VirtIOSCSIReq *tmf, SCSIRequest *r)
 {
     VirtIOSCSICancelNotifier *notifier;
@@ -XXX,XX +XXX,XX @@ static int virtio_scsi_do_tmf(VirtIOSCSI *s, VirtIOSCSIReq *req)
         break;
 
     case VIRTIO_SCSI_T_TMF_LOGICAL_UNIT_RESET:
-    case VIRTIO_SCSI_T_TMF_I_T_NEXUS_RESET:
-        virtio_scsi_defer_tmf_to_main_loop(req);
-        ret = -EINPROGRESS;
+        if (!d) {
+            goto fail;
+        }
+        if (d->lun != virtio_scsi_get_lun(req->req.tmf.lun)) {
+            goto incorrect_lun;
+        }
+        qatomic_inc(&s->resetting);
+        device_cold_reset(&d->qdev);
+        qatomic_dec(&s->resetting);
         break;
 
+    case VIRTIO_SCSI_T_TMF_I_T_NEXUS_RESET: {
+        BusChild *kid;
+        int target = req->req.tmf.lun[1];
+        qatomic_inc(&s->resetting);
+
+        rcu_read_lock();
+        QTAILQ_FOREACH_RCU(kid, &s->bus.qbus.children, sibling) {
+            SCSIDevice *d1 = SCSI_DEVICE(kid->child);
+            if (d1->channel == 0 && d1->id == target) {
+                device_cold_reset(&d1->qdev);
+            }
+        }
+        rcu_read_unlock();
+
+        qatomic_dec(&s->resetting);
+        break;
+    }
+
     case VIRTIO_SCSI_T_TMF_ABORT_TASK_SET:
     case VIRTIO_SCSI_T_TMF_CLEAR_TASK_SET: {
         g_autoptr(GHashTable) aio_contexts = g_hash_table_new(NULL, NULL);
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_reset(VirtIODevice *vdev)
 
     assert(!s->dataplane_started);
 
-    virtio_scsi_reset_tmf_bh(s);
     virtio_scsi_flush_defer_tmf_to_aio_context(s);
 
     qatomic_inc(&s->resetting);
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_device_realize(DeviceState *dev, Error **errp)
     VirtIOSCSI *s = VIRTIO_SCSI(dev);
     Error *err = NULL;
 
-    QTAILQ_INIT(&s->tmf_bh_list);
     qemu_mutex_init(&s->ctrl_lock);
     qemu_mutex_init(&s->event_lock);
-    qemu_mutex_init(&s->tmf_bh_lock);
 
     virtio_scsi_common_realize(dev,
                                virtio_scsi_handle_ctrl,
@@ -XXX,XX +XXX,XX @@ static void virtio_scsi_device_unrealize(DeviceState *dev)
 {
     VirtIOSCSI *s = VIRTIO_SCSI(dev);
 
-    virtio_scsi_reset_tmf_bh(s);
     virtio_scsi_dataplane_cleanup(s);
     qbus_set_hotplug_handler(BUS(&s->bus), NULL);
     virtio_scsi_common_unrealize(dev);
-    qemu_mutex_destroy(&s->tmf_bh_lock);
     qemu_mutex_destroy(&s->event_lock);
     qemu_mutex_destroy(&s->ctrl_lock);
 }
-- 
2.48.1

From: Stefan Hajnoczi <stefanha@redhat.com>

Peter Krempa and Kevin Wolf observed that iothread-vq-mapping is
confusing to use because the control and event virtqueues have a fixed
location before the command virtqueues but need to be treated
differently.

Only expose the command virtqueues via iothread-vq-mapping so that the
command-line parameter is intuitive: it controls where SCSI requests are
processed.

The control virtqueue needs to be hardcoded to the main loop thread for
technical reasons anyway. Kevin also pointed out that it's better to
place the event virtqueue in the main loop thread since its no poll
behavior would prevent polling if assigned to an IOThread.

This change is its own commit to avoid squashing the previous commit.

Suggested-by: Kevin Wolf <kwolf@redhat.com>
Suggested-by: Peter Krempa <pkrempa@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20250311132616.1049687-14-stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 hw/scsi/virtio-scsi-dataplane.c | 33 ++++++++++++++++++++-------------
 1 file changed, 20 insertions(+), 13 deletions(-)

diff --git a/hw/scsi/virtio-scsi-dataplane.c b/hw/scsi/virtio-scsi-dataplane.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/scsi/virtio-scsi-dataplane.c
+++ b/hw/scsi/virtio-scsi-dataplane.c
@@ -XXX,XX +XXX,XX @@ void virtio_scsi_dataplane_setup(VirtIOSCSI *s, Error **errp)
     VirtIODevice *vdev = VIRTIO_DEVICE(s);
     BusState *qbus = qdev_get_parent_bus(DEVICE(vdev));
     VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(qbus);
-    uint16_t num_vqs = vs->conf.num_queues + VIRTIO_SCSI_VQ_NUM_FIXED;
 
     if (vs->conf.iothread && vs->conf.iothread_vq_mapping_list) {
         error_setg(errp,
@@ -XXX,XX +XXX,XX @@ void virtio_scsi_dataplane_setup(VirtIOSCSI *s, Error **errp)
         }
     }
 
-    s->vq_aio_context = g_new(AioContext *, num_vqs);
+    s->vq_aio_context = g_new(AioContext *, vs->conf.num_queues +
+                                            VIRTIO_SCSI_VQ_NUM_FIXED);
+
+    /*
+     * Handle the ctrl virtqueue in the main loop thread where device resets
+     * can be performed.
+     */
+    s->vq_aio_context[0] = qemu_get_aio_context();
+
+    /*
+     * Handle the event virtqueue in the main loop thread where its no_poll
+     * behavior won't stop IOThread polling.
+     */
+    s->vq_aio_context[1] = qemu_get_aio_context();
 
     if (vs->conf.iothread_vq_mapping_list) {
         if (!iothread_vq_mapping_apply(vs->conf.iothread_vq_mapping_list,
-                                       s->vq_aio_context, num_vqs, errp)) {
+                    &s->vq_aio_context[VIRTIO_SCSI_VQ_NUM_FIXED],
+                    vs->conf.num_queues, errp)) {
             g_free(s->vq_aio_context);
             s->vq_aio_context = NULL;
             return;
         }
     } else if (vs->conf.iothread) {
         AioContext *ctx = iothread_get_aio_context(vs->conf.iothread);
-        for (uint16_t i = 0; i < num_vqs; i++) {
-            s->vq_aio_context[i] = ctx;
+        for (uint16_t i = 0; i < vs->conf.num_queues; i++) {
+            s->vq_aio_context[VIRTIO_SCSI_VQ_NUM_FIXED + i] = ctx;
         }
 
         /* Released in virtio_scsi_dataplane_cleanup() */
         object_ref(OBJECT(vs->conf.iothread));
     } else {
         AioContext *ctx = qemu_get_aio_context();
-        for (unsigned i = 0; i < num_vqs; i++) {
-            s->vq_aio_context[i] = ctx;
+        for (unsigned i = 0; i < vs->conf.num_queues; i++) {
+            s->vq_aio_context[VIRTIO_SCSI_VQ_NUM_FIXED + i] = ctx;
         }
     }
-
-    /*
-     * Always handle the ctrl virtqueue in the main loop thread where device
-     * resets can be performed.
-     */
-    s->vq_aio_context[0] = qemu_get_aio_context();
 }
 
 /* Context: BQL held */
-- 
2.48.1