Series comparison

-[Qemu-devel] [PULL 0/8] Block layer patches
+[PULL 00/15] Block layer patches
-The following changes since commit b55a69fe5f0a504dac6359bb7e99a72b130c3661:
+The following changes since commit 16aaacb307ed607b9780c12702c44f0fe52edc7e:
-  Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20170607' into staging (2017-06-07 15:06:42 +0100)
+  Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20200430' into staging (2020-04-30 14:00:36 +0100)
-are available in the git repository at:
+are available in the Git repository at:
   git://repo.or.cz/qemu/kevin.git tags/for-upstream
-for you to fetch changes up to 2cb8f869e43406ce829ebe3b16fecc78d367dc7f:
+for you to fetch changes up to eaae29ef89d498d0eac553c77b554f310a47f809:
-  block: fix external snapshot abort permission error (2017-06-07 18:51:51 +0200)
+  qemu-storage-daemon: Fix non-string --object properties (2020-04-30 17:51:07 +0200)
 ----------------------------------------------------------------
-Block layer patches
+Block layer patches:
 - Fix resize (extending) of short overlays
 - nvme: introduce PMR support from NVMe 1.4 spec
 - qemu-storage-daemon: Fix non-string --object properties
 ----------------------------------------------------------------
-Jeff Cody (1):
+Alberto Garcia (1):
-      block: fix external snapshot abort permission error
+      qcow2: Add incompatibility note between backing files and raw external data files
-Kevin Wolf (6):
+Andrzej Jakowski (1):
-      block: Fix anonymous BBs in blk_root_inactivate()
+      nvme: introduce PMR support from NVMe 1.4 spec
       migration: Inactivate images after .save_live_complete_precopy()
       migration/block: Clean up BBs in block_save_complete()
       qemu-iotests: Block migration test
       commit: Fix use after free in completion
       qemu-iotests: Test automatic commit job cancel on hot unplug
-Peter Maydell (1):
+Kevin Wolf (12):
-      block/qcow.c: Fix memory leak in qcow_create()
+      block: Add flags to BlockDriver.bdrv_co_truncate()
       block: Add flags to bdrv(_co)_truncate()
       block-backend: Add flags to blk_truncate()
       qcow2: Support BDRV_REQ_ZERO_WRITE for truncate
       raw-format: Support BDRV_REQ_ZERO_WRITE for truncate
       file-posix: Support BDRV_REQ_ZERO_WRITE for truncate
       block: truncate: Don't make backing file data visible
       iotests: Filter testfiles out in filter_img_info()
       iotests: Test committing to short backing file
       qcow2: Forward ZERO_WRITE flag for full preallocation
       qom: Factor out user_creatable_add_dict()
       qemu-storage-daemon: Fix non-string --object properties
- block/block-backend.c      |   2 +-
+Paolo Bonzini (1):
- block/commit.c             |   7 +++
+      qemu-iotests: allow qcow2 external discarded clusters to contain stale data
  block/qcow.c               |   1 +
  blockdev.c                 |   4 ++
  migration/block.c          |  22 +++++--
  migration/migration.c      |  12 ++--
  tests/qemu-iotests/040     |  35 +++++++++++-
  tests/qemu-iotests/040.out |   4 +-
  tests/qemu-iotests/183     | 140 +++++++++++++++++++++++++++++++++++++++++++++
  tests/qemu-iotests/183.out |  46 +++++++++++++++
  tests/qemu-iotests/group   |   1 +
 files changed, 259 insertions(+), 15 deletions(-)
  create mode 100755 tests/qemu-iotests/183
  create mode 100644 tests/qemu-iotests/183.out
+ docs/interop/qcow2.txt          |   3 +
+ hw/block/nvme.h                 |   2 +
+ include/block/block.h           |   5 +-
+ include/block/block_int.h       |  10 +-
+ include/block/nvme.h            | 172 ++++++++++++++++++++++++++
+ include/qom/object_interfaces.h |  16 +++
+ include/sysemu/block-backend.h  |   2 +-
+ block.c                         |   3 +-
+ block/block-backend.c           |   4 +-
+ block/commit.c                  |   4 +-
+ block/crypto.c                  |   7 +-
+ block/file-posix.c              |   6 +-
+ block/file-win32.c              |   2 +-
+ block/gluster.c                 |   1 +
+ block/io.c                      |  43 ++++++-
+ block/iscsi.c                   |   2 +-
+ block/mirror.c                  |   2 +-
+ block/nfs.c                     |   3 +-
+ block/parallels.c               |   6 +-
+ block/qcow.c                    |   4 +-
+ block/qcow2-cluster.c           |   2 +-
+ block/qcow2-refcount.c          |   2 +-
+ block/qcow2.c                   |  73 +++++++++--
+ block/qed.c                     |   3 +-
+ block/raw-format.c              |   6 +-
+ block/rbd.c                     |   1 +
+ block/sheepdog.c                |   4 +-
+ block/ssh.c                     |   2 +-
+ block/vdi.c                     |   2 +-
+ block/vhdx-log.c                |   2 +-
+ block/vhdx.c                    |   6 +-
+ block/vmdk.c                    |   8 +-
+ block/vpc.c                     |   2 +-
+ blockdev.c                      |   2 +-
+ hw/block/nvme.c                 | 109 ++++++++++++++++
+ qemu-img.c                      |   2 +-
+ qemu-io-cmds.c                  |   2 +-
+ qemu-storage-daemon.c           |   4 +-
+ qom/object_interfaces.c         |  31 +++++
+ qom/qom-qmp-cmds.c              |  24 +---
+ tests/test-block-iothread.c     |   9 +-
+ tests/qemu-iotests/iotests.py   |   5 +-
+ hw/block/Makefile.objs          |   2 +-
+ hw/block/trace-events           |   4 +
+ tests/qemu-iotests/244          |  10 +-
+ tests/qemu-iotests/244.out      |   9 +-
+ tests/qemu-iotests/274          | 155 +++++++++++++++++++++++
+ tests/qemu-iotests/274.out      | 268 ++++++++++++++++++++++++++++++++++++++++
+ tests/qemu-iotests/group        |   1 +
+files changed, 951 insertions(+), 96 deletions(-)
+ create mode 100755 tests/qemu-iotests/274
+ create mode 100644 tests/qemu-iotests/274.out

-New patch
+[PULL 01/15] qcow2: Add incompatibility note between backing files and raw external data files
+From: Alberto Garcia <berto@igalia.com>
+Backing files and raw external data files are mutually exclusive.
+The documentation of the raw external data bit (in autoclear_features)
+already indicates that, but we should also mention it on the other
+side.
+Suggested-by: Eric Blake <eblake@redhat.com>
+Signed-off-by: Alberto Garcia <berto@igalia.com>
+Message-Id: <20200410121816.8334-1-berto@igalia.com>
+Reviewed-by: Eric Blake <eblake@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ docs/interop/qcow2.txt | 3 +++
+file changed, 3 insertions(+)
+diff --git a/docs/interop/qcow2.txt b/docs/interop/qcow2.txt
+index XXXXXXX..XXXXXXX 100644
+--- a/docs/interop/qcow2.txt
++++ b/docs/interop/qcow2.txt
+@@ -XXX,XX +XXX,XX @@ The first cluster of a qcow2 image contains the file header:
+                     is stored (NB: The string is not null terminated). 0 if the
+                     image doesn't have a backing file.
++                    Note: backing files are incompatible with raw external data
++                    files (auto-clear feature bit 1).
++
+- 19:   backing_file_size
+                     Length of the backing file name in bytes. Must not be
+                     longer than 1023 bytes. Undefined if the image doesn't have
+--
+.25.3

-New patch
+[PULL 02/15] qemu-iotests: allow qcow2 external discarded clusters to contain stale data
+From: Paolo Bonzini <pbonzini@redhat.com>
+Test 244 checks the expected behavior of qcow2 external data files
+with respect to zero and discarded clusters.  Filesystems however
+are free to ignore discard requests, and this seems to be the
+case for overlayfs.  Relax the tests to skip checks on the
+external data file for discarded areas, which implies not using
+qemu-img compare in the data_file_raw=on case.
+This fixes docker tests on RHEL8.
+Cc: Kevin Wolf <kwolf@redhat.com>
+Cc: qemu-block@nongnu.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Message-Id: <20200409191006.24429-1-pbonzini@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ tests/qemu-iotests/244     | 10 ++++++++--
+ tests/qemu-iotests/244.out |  9 ++++++---
+files changed, 14 insertions(+), 5 deletions(-)
+diff --git a/tests/qemu-iotests/244 b/tests/qemu-iotests/244
+index XXXXXXX..XXXXXXX 100755
+--- a/tests/qemu-iotests/244
++++ b/tests/qemu-iotests/244
+@@ -XXX,XX +XXX,XX @@ $QEMU_IO -c 'read -P 0 0 1M' \
+ echo
+ $QEMU_IO -c 'read -P 0 0 1M' \
+          -c 'read -P 0x11 1M 1M' \
+-         -c 'read -P 0 2M 2M' \
+          -c 'read -P 0x11 4M 1M' \
+          -c 'read -P 0 5M 1M' \
+          -f raw "$TEST_IMG.data" |
+@@ -XXX,XX +XXX,XX @@ $QEMU_IO -c 'read -P 0 0 1M' \
+          -f $IMGFMT "$TEST_IMG" |
+          _filter_qemu_io
++# Discarded clusters are only marked as such in the qcow2 metadata, but
++# they can contain stale data in the external data file.  Instead, zero
++# clusters must be zeroed in the external data file too.
+ echo
+-$QEMU_IMG compare "$TEST_IMG" "$TEST_IMG.data"
++$QEMU_IO -c 'read -P 0 0 1M' \
++         -c 'read -P 0x11 1M 1M' \
++         -c 'read -P 0 3M 3M' \
++         -f raw "$TEST_IMG".data |
++         _filter_qemu_io
+ echo -n "qcow2 file size after I/O: "
+ du -b $TEST_IMG | cut -f1
+diff --git a/tests/qemu-iotests/244.out b/tests/qemu-iotests/244.out
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/qemu-iotests/244.out
++++ b/tests/qemu-iotests/244.out
+@@ -XXX,XX +XXX,XX @@ read 1048576/1048576 bytes at offset 0
+MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+ read 1048576/1048576 bytes at offset 1048576
+MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+-read 2097152/2097152 bytes at offset 2097152
+-2 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+ read 1048576/1048576 bytes at offset 4194304
+MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+ read 1048576/1048576 bytes at offset 5242880
+@@ -XXX,XX +XXX,XX @@ read 1048576/1048576 bytes at offset 1048576
+ read 4194304/4194304 bytes at offset 2097152
+MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+-Images are identical.
++read 1048576/1048576 bytes at offset 0
++1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
++read 1048576/1048576 bytes at offset 1048576
++1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
++read 3145728/3145728 bytes at offset 3145728
++3 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+ qcow2 file size after I/O: 327680
+ === bdrv_co_block_status test for file and offset=0 ===
+--
+.25.3

-New patch
+[PULL 03/15] block: Add flags to BlockDriver.bdrv_co_truncate()
+This adds a new BdrvRequestFlags parameter to the .bdrv_co_truncate()
 driver callbacks, and a supported_truncate_flags field in
 BlockDriverState that allows drivers to advertise support for request
 flags in the context of truncate.
 For now, we always pass 0 and no drivers declare support for any flag.
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Reviewed-by: Alberto Garcia <berto@igalia.com>
 Reviewed-by: Max Reitz <mreitz@redhat.com>
 Message-Id: <20200424125448.63318-2-kwolf@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
  include/block/block_int.h   | 10 +++++++++-
  block/crypto.c              |  3 ++-
  block/file-posix.c          |  2 +-
  block/file-win32.c          |  2 +-
  block/gluster.c             |  1 +
  block/io.c                  |  8 +++++++-
  block/iscsi.c               |  2 +-
  block/nfs.c                 |  3 ++-
  block/qcow2.c               |  2 +-
  block/qed.c                 |  1 +
  block/raw-format.c          |  2 +-
  block/rbd.c                 |  1 +
  block/sheepdog.c            |  4 ++--
  block/ssh.c                 |  2 +-
  tests/test-block-iothread.c |  3 ++-
 files changed, 33 insertions(+), 13 deletions(-)
 diff --git a/include/block/block_int.h b/include/block/block_int.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/block/block_int.h
 +++ b/include/block/block_int.h
@@ -XXX,XX +XXX,XX @@ struct BlockDriver {
       */
      int coroutine_fn (*bdrv_co_truncate)(BlockDriverState *bs, int64_t offset,
                                           bool exact, PreallocMode prealloc,
 -                                         Error **errp);
 +                                         BdrvRequestFlags flags, Error **errp);
      int64_t (*bdrv_getlength)(BlockDriverState *bs);
      bool has_variable_length;
@@ -XXX,XX +XXX,XX @@ struct BlockDriverState {
      /* Flags honored during pwrite_zeroes (so far: BDRV_REQ_FUA,
       * BDRV_REQ_MAY_UNMAP, BDRV_REQ_WRITE_UNCHANGED) */
      unsigned int supported_zero_flags;
 +    /*
 +     * Flags honoured during truncate (so far: BDRV_REQ_ZERO_WRITE).
 +     *
 +     * If BDRV_REQ_ZERO_WRITE is given, the truncate operation must make sure
 +     * that any added space reads as all zeros. If this can't be guaranteed,
 +     * the operation must fail.
 +     */
 +    unsigned int supported_truncate_flags;
      /* the following member gives a name to every node on the bs graph. */
      char node_name[32];
 diff --git a/block/crypto.c b/block/crypto.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/crypto.c
 +++ b/block/crypto.c
@@ -XXX,XX +XXX,XX @@ static int block_crypto_co_create_generic(BlockDriverState *bs,
  static int coroutine_fn
  block_crypto_co_truncate(BlockDriverState *bs, int64_t offset, bool exact,
 -                         PreallocMode prealloc, Error **errp)
 +                         PreallocMode prealloc, BdrvRequestFlags flags,
 +                         Error **errp)
  {
      BlockCrypto *crypto = bs->opaque;
      uint64_t payload_offset =
 diff --git a/block/file-posix.c b/block/file-posix.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/file-posix.c
 +++ b/block/file-posix.c
@@ -XXX,XX +XXX,XX @@ raw_regular_truncate(BlockDriverState *bs, int fd, int64_t offset,
  static int coroutine_fn raw_co_truncate(BlockDriverState *bs, int64_t offset,
                                          bool exact, PreallocMode prealloc,
 -                                        Error **errp)
 +                                        BdrvRequestFlags flags, Error **errp)
  {
      BDRVRawState *s = bs->opaque;
      struct stat st;
 diff --git a/block/file-win32.c b/block/file-win32.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/file-win32.c
 +++ b/block/file-win32.c
@@ -XXX,XX +XXX,XX @@ static void raw_close(BlockDriverState *bs)
  static int coroutine_fn raw_co_truncate(BlockDriverState *bs, int64_t offset,
                                          bool exact, PreallocMode prealloc,
 -                                        Error **errp)
 +                                        BdrvRequestFlags flags, Error **errp)
  {
      BDRVRawState *s = bs->opaque;
      LONG low, high;
 diff --git a/block/gluster.c b/block/gluster.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/gluster.c
 +++ b/block/gluster.c
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int qemu_gluster_co_truncate(BlockDriverState *bs,
                                                   int64_t offset,
                                                   bool exact,
                                                   PreallocMode prealloc,
 +                                                 BdrvRequestFlags flags,
                                                   Error **errp)
  {
      BDRVGlusterState *s = bs->opaque;
 diff --git a/block/io.c b/block/io.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/io.c
 +++ b/block/io.c
@@ -XXX,XX +XXX,XX @@ int coroutine_fn bdrv_co_truncate(BdrvChild *child, int64_t offset, bool exact,
      BlockDriverState *bs = child->bs;
      BlockDriver *drv = bs->drv;
      BdrvTrackedRequest req;
 +    BdrvRequestFlags flags = 0;
      int64_t old_size, new_bytes;
      int ret;
@@ -XXX,XX +XXX,XX @@ int coroutine_fn bdrv_co_truncate(BdrvChild *child, int64_t offset, bool exact,
      }
      if (drv->bdrv_co_truncate) {
 -        ret = drv->bdrv_co_truncate(bs, offset, exact, prealloc, errp);
 +        if (flags & ~bs->supported_truncate_flags) {
 +            error_setg(errp, "Block driver does not support requested flags");
 +            ret = -ENOTSUP;
 +            goto out;
 +        }
 +        ret = drv->bdrv_co_truncate(bs, offset, exact, prealloc, flags, errp);
      } else if (bs->file && drv->is_filter) {
          ret = bdrv_co_truncate(bs->file, offset, exact, prealloc, errp);
      } else {
 diff --git a/block/iscsi.c b/block/iscsi.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/iscsi.c
 +++ b/block/iscsi.c
@@ -XXX,XX +XXX,XX @@ static void iscsi_reopen_commit(BDRVReopenState *reopen_state)
  static int coroutine_fn iscsi_co_truncate(BlockDriverState *bs, int64_t offset,
                                            bool exact, PreallocMode prealloc,
 -                                          Error **errp)
 +                                          BdrvRequestFlags flags, Error **errp)
  {
      IscsiLun *iscsilun = bs->opaque;
      int64_t cur_length;
 diff --git a/block/nfs.c b/block/nfs.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/nfs.c
 +++ b/block/nfs.c
@@ -XXX,XX +XXX,XX @@ static int64_t nfs_get_allocated_file_size(BlockDriverState *bs)
  static int coroutine_fn
  nfs_file_co_truncate(BlockDriverState *bs, int64_t offset, bool exact,
 -                     PreallocMode prealloc, Error **errp)
 +                     PreallocMode prealloc, BdrvRequestFlags flags,
 +                     Error **errp)
  {
      NFSClient *client = bs->opaque;
      int ret;
 diff --git a/block/qcow2.c b/block/qcow2.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/qcow2.c
 +++ b/block/qcow2.c
@@ -XXX,XX +XXX,XX @@ fail:
  static int coroutine_fn qcow2_co_truncate(BlockDriverState *bs, int64_t offset,
                                            bool exact, PreallocMode prealloc,
 -                                          Error **errp)
 +                                          BdrvRequestFlags flags, Error **errp)
  {
      BDRVQcow2State *s = bs->opaque;
      uint64_t old_length;
 diff --git a/block/qed.c b/block/qed.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/qed.c
 +++ b/block/qed.c
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_qed_co_truncate(BlockDriverState *bs,
                                               int64_t offset,
                                               bool exact,
                                               PreallocMode prealloc,
 +                                             BdrvRequestFlags flags,
                                               Error **errp)
  {
      BDRVQEDState *s = bs->opaque;
 diff --git a/block/raw-format.c b/block/raw-format.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/raw-format.c
 +++ b/block/raw-format.c
@@ -XXX,XX +XXX,XX @@ static void raw_refresh_limits(BlockDriverState *bs, Error **errp)
  static int coroutine_fn raw_co_truncate(BlockDriverState *bs, int64_t offset,
                                          bool exact, PreallocMode prealloc,
 -                                        Error **errp)
 +                                        BdrvRequestFlags flags, Error **errp)
  {
      BDRVRawState *s = bs->opaque;
 diff --git a/block/rbd.c b/block/rbd.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/rbd.c
 +++ b/block/rbd.c
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn qemu_rbd_co_truncate(BlockDriverState *bs,
                                               int64_t offset,
                                               bool exact,
                                               PreallocMode prealloc,
 +                                             BdrvRequestFlags flags,
                                               Error **errp)
  {
      int r;
 diff --git a/block/sheepdog.c b/block/sheepdog.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/sheepdog.c
 +++ b/block/sheepdog.c
@@ -XXX,XX +XXX,XX @@ static int64_t sd_getlength(BlockDriverState *bs)
  static int coroutine_fn sd_co_truncate(BlockDriverState *bs, int64_t offset,
                                         bool exact, PreallocMode prealloc,
 -                                       Error **errp)
 +                                       BdrvRequestFlags flags, Error **errp)
  {
      BDRVSheepdogState *s = bs->opaque;
      int ret, fd;
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int sd_co_writev(BlockDriverState *bs, int64_t sector_num,
      assert(!flags);
      if (offset > s->inode.vdi_size) {
 -        ret = sd_co_truncate(bs, offset, false, PREALLOC_MODE_OFF, NULL);
 +        ret = sd_co_truncate(bs, offset, false, PREALLOC_MODE_OFF, 0, NULL);
          if (ret < 0) {
              return ret;
          }
 diff --git a/block/ssh.c b/block/ssh.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/ssh.c
 +++ b/block/ssh.c
@@ -XXX,XX +XXX,XX @@ static int64_t ssh_getlength(BlockDriverState *bs)
  static int coroutine_fn ssh_co_truncate(BlockDriverState *bs, int64_t offset,
                                          bool exact, PreallocMode prealloc,
 -                                        Error **errp)
 +                                        BdrvRequestFlags flags, Error **errp)
  {
      BDRVSSHState *s = bs->opaque;
 diff --git a/tests/test-block-iothread.c b/tests/test-block-iothread.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/test-block-iothread.c
 +++ b/tests/test-block-iothread.c
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_test_co_pdiscard(BlockDriverState *bs,
  static int coroutine_fn
  bdrv_test_co_truncate(BlockDriverState *bs, int64_t offset, bool exact,
 -                      PreallocMode prealloc, Error **errp)
 +                      PreallocMode prealloc, BdrvRequestFlags flags,
 +                      Error **errp)
  {
      return 0;
  }
 --
 .25.3

-[Qemu-devel] [PULL 7/8] block/qcow.c: Fix memory leak in qcow_create()
+[PULL 04/15] block: Add flags to bdrv(_co)_truncate()
-From: Peter Maydell <peter.maydell@linaro.org>
+Now that block drivers can support flags for .bdrv_co_truncate, expose
 the parameter in the node level interfaces bdrv_co_truncate() and
 bdrv_truncate().
-Coverity points out that the code path in qcow_create() for
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-the magic "fat:" backing file name leaks the memory used to
+Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-store the filename (CID 1307771). Free the memory before
+Reviewed-by: Alberto Garcia <berto@igalia.com>
-we overwrite the pointer.
+Reviewed-by: Max Reitz <mreitz@redhat.com>
+Message-Id: <20200424125448.63318-3-kwolf@redhat.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Eric Blake <eblake@redhat.com>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
- block/qcow.c | 1 +
+ include/block/block.h       |  5 +++--
-file changed, 1 insertion(+)
+ block/block-backend.c       |  2 +-
  block/crypto.c              |  2 +-
  block/io.c                  | 12 +++++++-----
  block/parallels.c           |  6 +++---
  block/qcow.c                |  4 ++--
  block/qcow2-refcount.c      |  2 +-
  block/qcow2.c               | 15 +++++++++------
  block/raw-format.c          |  2 +-
  block/vhdx-log.c            |  2 +-
  block/vhdx.c                |  2 +-
  block/vmdk.c                |  2 +-
  tests/test-block-iothread.c |  6 +++---
 files changed, 34 insertions(+), 28 deletions(-)
+diff --git a/include/block/block.h b/include/block/block.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/block/block.h
++++ b/include/block/block.h
+@@ -XXX,XX +XXX,XX @@ BlockDriverState *bdrv_find_backing_image(BlockDriverState *bs,
+ void bdrv_refresh_filename(BlockDriverState *bs);
+ int coroutine_fn bdrv_co_truncate(BdrvChild *child, int64_t offset, bool exact,
+-                                  PreallocMode prealloc, Error **errp);
++                                  PreallocMode prealloc, BdrvRequestFlags flags,
++                                  Error **errp);
+ int bdrv_truncate(BdrvChild *child, int64_t offset, bool exact,
+-                  PreallocMode prealloc, Error **errp);
++                  PreallocMode prealloc, BdrvRequestFlags flags, Error **errp);
+ int64_t bdrv_nb_sectors(BlockDriverState *bs);
+ int64_t bdrv_getlength(BlockDriverState *bs);
+diff --git a/block/block-backend.c b/block/block-backend.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/block-backend.c
++++ b/block/block-backend.c
+@@ -XXX,XX +XXX,XX @@ int blk_truncate(BlockBackend *blk, int64_t offset, bool exact,
+         return -ENOMEDIUM;
+     }
+-    return bdrv_truncate(blk->root, offset, exact, prealloc, errp);
++    return bdrv_truncate(blk->root, offset, exact, prealloc, 0, errp);
+ }
+ int blk_save_vmstate(BlockBackend *blk, const uint8_t *buf,
+diff --git a/block/crypto.c b/block/crypto.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/crypto.c
++++ b/block/crypto.c
+@@ -XXX,XX +XXX,XX @@ block_crypto_co_truncate(BlockDriverState *bs, int64_t offset, bool exact,
+     offset += payload_offset;
+-    return bdrv_co_truncate(bs->file, offset, exact, prealloc, errp);
++    return bdrv_co_truncate(bs->file, offset, exact, prealloc, 0, errp);
+ }
+ static void block_crypto_close(BlockDriverState *bs)
+diff --git a/block/io.c b/block/io.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/io.c
++++ b/block/io.c
+@@ -XXX,XX +XXX,XX @@ static void bdrv_parent_cb_resize(BlockDriverState *bs)
+  * 'offset' bytes in length.
+  */
+ int coroutine_fn bdrv_co_truncate(BdrvChild *child, int64_t offset, bool exact,
+-                                  PreallocMode prealloc, Error **errp)
++                                  PreallocMode prealloc, BdrvRequestFlags flags,
++                                  Error **errp)
+ {
+     BlockDriverState *bs = child->bs;
+     BlockDriver *drv = bs->drv;
+     BdrvTrackedRequest req;
+-    BdrvRequestFlags flags = 0;
+     int64_t old_size, new_bytes;
+     int ret;
+@@ -XXX,XX +XXX,XX @@ int coroutine_fn bdrv_co_truncate(BdrvChild *child, int64_t offset, bool exact,
+         }
+         ret = drv->bdrv_co_truncate(bs, offset, exact, prealloc, flags, errp);
+     } else if (bs->file && drv->is_filter) {
+-        ret = bdrv_co_truncate(bs->file, offset, exact, prealloc, errp);
++        ret = bdrv_co_truncate(bs->file, offset, exact, prealloc, flags, errp);
+     } else {
+         error_setg(errp, "Image format driver does not support resize");
+         ret = -ENOTSUP;
+@@ -XXX,XX +XXX,XX @@ typedef struct TruncateCo {
+     int64_t offset;
+     bool exact;
+     PreallocMode prealloc;
++    BdrvRequestFlags flags;
+     Error **errp;
+     int ret;
+ } TruncateCo;
+@@ -XXX,XX +XXX,XX @@ static void coroutine_fn bdrv_truncate_co_entry(void *opaque)
+ {
+     TruncateCo *tco = opaque;
+     tco->ret = bdrv_co_truncate(tco->child, tco->offset, tco->exact,
+-                                tco->prealloc, tco->errp);
++                                tco->prealloc, tco->flags, tco->errp);
+     aio_wait_kick();
+ }
+ int bdrv_truncate(BdrvChild *child, int64_t offset, bool exact,
+-                  PreallocMode prealloc, Error **errp)
++                  PreallocMode prealloc, BdrvRequestFlags flags, Error **errp)
+ {
+     Coroutine *co;
+     TruncateCo tco = {
+@@ -XXX,XX +XXX,XX @@ int bdrv_truncate(BdrvChild *child, int64_t offset, bool exact,
+         .offset     = offset,
+         .exact      = exact,
+         .prealloc   = prealloc,
++        .flags      = flags,
+         .errp       = errp,
+         .ret        = NOT_DONE,
+     };
+diff --git a/block/parallels.c b/block/parallels.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/parallels.c
++++ b/block/parallels.c
+@@ -XXX,XX +XXX,XX @@ static int64_t allocate_clusters(BlockDriverState *bs, int64_t sector_num,
+         } else {
+             ret = bdrv_truncate(bs->file,
+                                 (s->data_end + space) << BDRV_SECTOR_BITS,
+-                                false, PREALLOC_MODE_OFF, NULL);
++                                false, PREALLOC_MODE_OFF, 0, NULL);
+         }
+         if (ret < 0) {
+             return ret;
+@@ -XXX,XX +XXX,XX @@ static int coroutine_fn parallels_co_check(BlockDriverState *bs,
+              * That means we have to pass exact=true.
+              */
+             ret = bdrv_truncate(bs->file, res->image_end_offset, true,
+-                                PREALLOC_MODE_OFF, &local_err);
++                                PREALLOC_MODE_OFF, 0, &local_err);
+             if (ret < 0) {
+                 error_report_err(local_err);
+                 res->check_errors++;
+@@ -XXX,XX +XXX,XX @@ static void parallels_close(BlockDriverState *bs)
+         /* errors are ignored, so we might as well pass exact=true */
+         bdrv_truncate(bs->file, s->data_end << BDRV_SECTOR_BITS, true,
+-                      PREALLOC_MODE_OFF, NULL);
++                      PREALLOC_MODE_OFF, 0, NULL);
+     }
+     g_free(s->bat_dirty_bmap);
 diff --git a/block/qcow.c b/block/qcow.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/qcow.c
 +++ b/block/qcow.c
-@@ -XXX,XX +XXX,XX @@ static int qcow_create(const char *filename, QemuOpts *opts, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static int get_cluster_offset(BlockDriverState *bs,
-             header_size += backing_filename_len;
+                     return -E2BIG;
-         } else {
+                 }
-             /* special backing file for vvfat */
+                 ret = bdrv_truncate(bs->file, cluster_offset + s->cluster_size,
-+            g_free(backing_file);
+-                                    false, PREALLOC_MODE_OFF, NULL);
-             backing_file = NULL;
++                                    false, PREALLOC_MODE_OFF, 0, NULL);
-         }
+                 if (ret < 0) {
-         header.cluster_bits = 9; /* 512 byte cluster to avoid copying
+                     return ret;
                  }
@@ -XXX,XX +XXX,XX @@ static int qcow_make_empty(BlockDriverState *bs)
              l1_length) < 0)
          return -1;
      ret = bdrv_truncate(bs->file, s->l1_table_offset + l1_length, false,
 -                        PREALLOC_MODE_OFF, NULL);
 +                        PREALLOC_MODE_OFF, 0, NULL);
      if (ret < 0)
          return ret;
 diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/qcow2-refcount.c
 +++ b/block/qcow2-refcount.c
@@ -XXX,XX +XXX,XX @@ static int check_refblocks(BlockDriverState *bs, BdrvCheckResult *res,
                  }
                  ret = bdrv_truncate(bs->file, offset + s->cluster_size, false,
 -                                    PREALLOC_MODE_OFF, &local_err);
 +                                    PREALLOC_MODE_OFF, 0, &local_err);
                  if (ret < 0) {
                      error_report_err(local_err);
                      goto resize_fail;
 diff --git a/block/qcow2.c b/block/qcow2.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/qcow2.c
 +++ b/block/qcow2.c
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn preallocate_co(BlockDriverState *bs, uint64_t offset,
              mode = PREALLOC_MODE_OFF;
          }
          ret = bdrv_co_truncate(s->data_file, host_offset + cur_bytes, false,
 -                               mode, errp);
 +                               mode, 0, errp);
          if (ret < 0) {
              return ret;
          }
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn qcow2_co_truncate(BlockDriverState *bs, int64_t offset,
               * always fulfilled, so there is no need to pass it on.)
               */
              bdrv_co_truncate(bs->file, (last_cluster + 1) * s->cluster_size,
 -                             false, PREALLOC_MODE_OFF, &local_err);
 +                             false, PREALLOC_MODE_OFF, 0, &local_err);
              if (local_err) {
                  warn_reportf_err(local_err,
                                   "Failed to truncate the tail of the image: ");
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn qcow2_co_truncate(BlockDriverState *bs, int64_t offset,
               * file should be resized to the exact target size, too,
               * so we pass @exact here.
               */
 -            ret = bdrv_co_truncate(s->data_file, offset, exact, prealloc, errp);
 +            ret = bdrv_co_truncate(s->data_file, offset, exact, prealloc, 0,
 +                                   errp);
              if (ret < 0) {
                  goto fail;
              }
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn qcow2_co_truncate(BlockDriverState *bs, int64_t offset,
          new_file_size = allocation_start +
                          nb_new_data_clusters * s->cluster_size;
          /* Image file grows, so @exact does not matter */
 -        ret = bdrv_co_truncate(bs->file, new_file_size, false, prealloc, errp);
 +        ret = bdrv_co_truncate(bs->file, new_file_size, false, prealloc, 0,
 +                               errp);
          if (ret < 0) {
              error_prepend(errp, "Failed to resize underlying file: ");
              qcow2_free_clusters(bs, allocation_start,
@@ -XXX,XX +XXX,XX @@ qcow2_co_pwritev_compressed_part(BlockDriverState *bs,
          if (len < 0) {
              return len;
          }
 -        return bdrv_co_truncate(bs->file, len, false, PREALLOC_MODE_OFF, NULL);
 +        return bdrv_co_truncate(bs->file, len, false, PREALLOC_MODE_OFF, 0,
 +                                NULL);
      }
      if (offset_into_cluster(s, offset)) {
@@ -XXX,XX +XXX,XX @@ static int make_completely_empty(BlockDriverState *bs)
      }
      ret = bdrv_truncate(bs->file, (3 + l1_clusters) * s->cluster_size, false,
 -                        PREALLOC_MODE_OFF, &local_err);
 +                        PREALLOC_MODE_OFF, 0, &local_err);
      if (ret < 0) {
          error_report_err(local_err);
          goto fail;
 diff --git a/block/raw-format.c b/block/raw-format.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/raw-format.c
 +++ b/block/raw-format.c
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn raw_co_truncate(BlockDriverState *bs, int64_t offset,
      s->size = offset;
      offset += s->offset;
 -    return bdrv_co_truncate(bs->file, offset, exact, prealloc, errp);
 +    return bdrv_co_truncate(bs->file, offset, exact, prealloc, 0, errp);
  }
  static void raw_eject(BlockDriverState *bs, bool eject_flag)
 diff --git a/block/vhdx-log.c b/block/vhdx-log.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/vhdx-log.c
 +++ b/block/vhdx-log.c
@@ -XXX,XX +XXX,XX @@ static int vhdx_log_flush(BlockDriverState *bs, BDRVVHDXState *s,
                      goto exit;
                  }
                  ret = bdrv_truncate(bs->file, new_file_size, false,
 -                                    PREALLOC_MODE_OFF, NULL);
 +                                    PREALLOC_MODE_OFF, 0, NULL);
                  if (ret < 0) {
                      goto exit;
                  }
 diff --git a/block/vhdx.c b/block/vhdx.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/vhdx.c
 +++ b/block/vhdx.c
@@ -XXX,XX +XXX,XX @@ static int vhdx_allocate_block(BlockDriverState *bs, BDRVVHDXState *s,
      }
      return bdrv_truncate(bs->file, *new_offset + s->block_size, false,
 -                         PREALLOC_MODE_OFF, NULL);
 +                         PREALLOC_MODE_OFF, 0, NULL);
  }
  /*
 diff --git a/block/vmdk.c b/block/vmdk.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/vmdk.c
 +++ b/block/vmdk.c
@@ -XXX,XX +XXX,XX @@ vmdk_co_pwritev_compressed(BlockDriverState *bs, uint64_t offset,
              }
              length = QEMU_ALIGN_UP(length, BDRV_SECTOR_SIZE);
              ret = bdrv_truncate(s->extents[i].file, length, false,
 -                                PREALLOC_MODE_OFF, NULL);
 +                                PREALLOC_MODE_OFF, 0, NULL);
              if (ret < 0) {
                  return ret;
              }
 diff --git a/tests/test-block-iothread.c b/tests/test-block-iothread.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/test-block-iothread.c
 +++ b/tests/test-block-iothread.c
@@ -XXX,XX +XXX,XX @@ static void test_sync_op_truncate(BdrvChild *c)
      int ret;
      /* Normal success path */
 -    ret = bdrv_truncate(c, 65536, false, PREALLOC_MODE_OFF, NULL);
 +    ret = bdrv_truncate(c, 65536, false, PREALLOC_MODE_OFF, 0, NULL);
      g_assert_cmpint(ret, ==, 0);
      /* Early error: Negative offset */
 -    ret = bdrv_truncate(c, -2, false, PREALLOC_MODE_OFF, NULL);
 +    ret = bdrv_truncate(c, -2, false, PREALLOC_MODE_OFF, 0, NULL);
      g_assert_cmpint(ret, ==, -EINVAL);
      /* Error: Read-only image */
      c->bs->read_only = true;
      c->bs->open_flags &= ~BDRV_O_RDWR;
 -    ret = bdrv_truncate(c, 65536, false, PREALLOC_MODE_OFF, NULL);
 +    ret = bdrv_truncate(c, 65536, false, PREALLOC_MODE_OFF, 0, NULL);
      g_assert_cmpint(ret, ==, -EACCES);
      c->bs->read_only = false;
 --
-.8.3.1
+.25.3

-[Qemu-devel] [PULL 5/8] commit: Fix use after free in completion
+[PULL 05/15] block-backend: Add flags to blk_truncate()
-The final bdrv_set_backing_hd() could be working on already freed nodes
+Now that node level interface bdrv_truncate() supports passing request
-because the commit job drops its references (through BlockBackends) to
+flags to the block driver, expose this on the BlockBackend level, too.
 both overlay_bs and top already a bit earlier.
 One way to trigger the bug is hot unplugging a disk for which
 blockdev_mark_auto_del() cancels the block job.
 Fix this by taking BDS-level references while we're still using the
 nodes.
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Reviewed-by: John Snow <jsnow@redhat.com>
+Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Reviewed-by: Alberto Garcia <berto@igalia.com>
 Reviewed-by: Max Reitz <mreitz@redhat.com>
 Message-Id: <20200424125448.63318-4-kwolf@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
- block/commit.c | 7 +++++++
+ include/sysemu/block-backend.h | 2 +-
-file changed, 7 insertions(+)
+ block.c                        | 3 ++-
+ block/block-backend.c          | 4 ++--
  block/commit.c                 | 4 ++--
  block/crypto.c                 | 2 +-
  block/mirror.c                 | 2 +-
  block/qcow2.c                  | 4 ++--
  block/qed.c                    | 2 +-
  block/vdi.c                    | 2 +-
  block/vhdx.c                   | 4 ++--
  block/vmdk.c                   | 6 +++---
  block/vpc.c                    | 2 +-
  blockdev.c                     | 2 +-
  qemu-img.c                     | 2 +-
  qemu-io-cmds.c                 | 2 +-
 files changed, 22 insertions(+), 21 deletions(-)
 diff --git a/include/sysemu/block-backend.h b/include/sysemu/block-backend.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/sysemu/block-backend.h
 +++ b/include/sysemu/block-backend.h
@@ -XXX,XX +XXX,XX @@ int coroutine_fn blk_co_pwrite_zeroes(BlockBackend *blk, int64_t offset,
  int blk_pwrite_compressed(BlockBackend *blk, int64_t offset, const void *buf,
                            int bytes);
  int blk_truncate(BlockBackend *blk, int64_t offset, bool exact,
 -                 PreallocMode prealloc, Error **errp);
 +                 PreallocMode prealloc, BdrvRequestFlags flags, Error **errp);
  int blk_pdiscard(BlockBackend *blk, int64_t offset, int bytes);
  int blk_save_vmstate(BlockBackend *blk, const uint8_t *buf,
                       int64_t pos, int size);
 diff --git a/block.c b/block.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block.c
 +++ b/block.c
@@ -XXX,XX +XXX,XX @@ static int64_t create_file_fallback_truncate(BlockBackend *blk,
      int64_t size;
      int ret;
 -    ret = blk_truncate(blk, minimum_size, false, PREALLOC_MODE_OFF, &local_err);
 +    ret = blk_truncate(blk, minimum_size, false, PREALLOC_MODE_OFF, 0,
 +                       &local_err);
      if (ret < 0 && ret != -ENOTSUP) {
          error_propagate(errp, local_err);
          return ret;
 diff --git a/block/block-backend.c b/block/block-backend.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/block-backend.c
 +++ b/block/block-backend.c
@@ -XXX,XX +XXX,XX @@ int blk_pwrite_compressed(BlockBackend *blk, int64_t offset, const void *buf,
  }
  int blk_truncate(BlockBackend *blk, int64_t offset, bool exact,
 -                 PreallocMode prealloc, Error **errp)
 +                 PreallocMode prealloc, BdrvRequestFlags flags, Error **errp)
  {
      if (!blk_is_available(blk)) {
          error_setg(errp, "No medium inserted");
          return -ENOMEDIUM;
      }
 -    return bdrv_truncate(blk->root, offset, exact, prealloc, 0, errp);
 +    return bdrv_truncate(blk->root, offset, exact, prealloc, flags, errp);
  }
  int blk_save_vmstate(BlockBackend *blk, const uint8_t *buf,
 diff --git a/block/commit.c b/block/commit.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/commit.c
 +++ b/block/commit.c
-@@ -XXX,XX +XXX,XX @@ static void commit_complete(BlockJob *job, void *opaque)
+@@ -XXX,XX +XXX,XX @@ static int coroutine_fn commit_run(Job *job, Error **errp)
-     int ret = data->ret;
+     }
-     bool remove_commit_top_bs = false;
+     if (base_len < len) {
-+    /* Make sure overlay_bs and top stay around until bdrv_set_backing_hd() */
+-        ret = blk_truncate(s->base, len, false, PREALLOC_MODE_OFF, NULL);
-+    bdrv_ref(top);
++        ret = blk_truncate(s->base, len, false, PREALLOC_MODE_OFF, 0, NULL);
-+    bdrv_ref(overlay_bs);
+         if (ret) {
-+
+             goto out;
-     /* Remove base node parent that still uses BLK_PERM_WRITE/RESIZE before
+         }
-      * the normal backing chain can be restored. */
+@@ -XXX,XX +XXX,XX @@ int bdrv_commit(BlockDriverState *bs)
-     blk_unref(s->base);
+      * grow the backing file image if possible.  If not possible,
-@@ -XXX,XX +XXX,XX @@ static void commit_complete(BlockJob *job, void *opaque)
+      * we must return an error */
-     if (remove_commit_top_bs) {
+     if (length > backing_length) {
-         bdrv_set_backing_hd(overlay_bs, top, &error_abort);
+-        ret = blk_truncate(backing, length, false, PREALLOC_MODE_OFF,
-     }
++        ret = blk_truncate(backing, length, false, PREALLOC_MODE_OFF, 0,
-+
+                            &local_err);
-+    bdrv_unref(overlay_bs);
+         if (ret < 0) {
-+    bdrv_unref(top);
+             error_report_err(local_err);
 diff --git a/block/crypto.c b/block/crypto.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/crypto.c
 +++ b/block/crypto.c
@@ -XXX,XX +XXX,XX @@ static ssize_t block_crypto_init_func(QCryptoBlock *block,
       * which will be used by the crypto header
       */
      return blk_truncate(data->blk, data->size + headerlen, false,
 -                        data->prealloc, errp);
 +                        data->prealloc, 0, errp);
  }
- static void coroutine_fn commit_run(void *opaque)
 diff --git a/block/mirror.c b/block/mirror.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/mirror.c
 +++ b/block/mirror.c
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn mirror_run(Job *job, Error **errp)
          if (s->bdev_length > base_length) {
              ret = blk_truncate(s->target, s->bdev_length, false,
 -                               PREALLOC_MODE_OFF, NULL);
 +                               PREALLOC_MODE_OFF, 0, NULL);
              if (ret < 0) {
                  goto immediate_exit;
              }
 diff --git a/block/qcow2.c b/block/qcow2.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/qcow2.c
 +++ b/block/qcow2.c
@@ -XXX,XX +XXX,XX @@ qcow2_co_create(BlockdevCreateOptions *create_options, Error **errp)
      /* Okay, now that we have a valid image, let's give it the right size */
      ret = blk_truncate(blk, qcow2_opts->size, false, qcow2_opts->preallocation,
 -                       errp);
 +                       0, errp);
      if (ret < 0) {
          error_prepend(errp, "Could not resize image: ");
          goto out;
@@ -XXX,XX +XXX,XX @@ static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts,
           * Amending image options should ensure that the image has
           * exactly the given new values, so pass exact=true here.
           */
 -        ret = blk_truncate(blk, new_size, true, PREALLOC_MODE_OFF, errp);
 +        ret = blk_truncate(blk, new_size, true, PREALLOC_MODE_OFF, 0, errp);
          blk_unref(blk);
          if (ret < 0) {
              return ret;
 diff --git a/block/qed.c b/block/qed.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/qed.c
 +++ b/block/qed.c
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_qed_co_create(BlockdevCreateOptions *opts,
       * The QED format associates file length with allocation status,
       * so a new file (which is empty) must have a length of 0.
       */
 -    ret = blk_truncate(blk, 0, true, PREALLOC_MODE_OFF, errp);
 +    ret = blk_truncate(blk, 0, true, PREALLOC_MODE_OFF, 0, errp);
      if (ret < 0) {
          goto out;
      }
 diff --git a/block/vdi.c b/block/vdi.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/vdi.c
 +++ b/block/vdi.c
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn vdi_co_do_create(BlockdevCreateOptions *create_options,
      if (image_type == VDI_TYPE_STATIC) {
          ret = blk_truncate(blk, offset + blocks * block_size, false,
 -                           PREALLOC_MODE_OFF, errp);
 +                           PREALLOC_MODE_OFF, 0, errp);
          if (ret < 0) {
              error_prepend(errp, "Failed to statically allocate file");
              goto exit;
 diff --git a/block/vhdx.c b/block/vhdx.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/vhdx.c
 +++ b/block/vhdx.c
@@ -XXX,XX +XXX,XX @@ static int vhdx_create_bat(BlockBackend *blk, BDRVVHDXState *s,
          /* All zeroes, so we can just extend the file - the end of the BAT
           * is the furthest thing we have written yet */
          ret = blk_truncate(blk, data_file_offset, false, PREALLOC_MODE_OFF,
 -                           errp);
 +                           0, errp);
          if (ret < 0) {
              goto exit;
          }
      } else if (type == VHDX_TYPE_FIXED) {
          ret = blk_truncate(blk, data_file_offset + image_size, false,
 -                           PREALLOC_MODE_OFF, errp);
 +                           PREALLOC_MODE_OFF, 0, errp);
          if (ret < 0) {
              goto exit;
          }
 diff --git a/block/vmdk.c b/block/vmdk.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/vmdk.c
 +++ b/block/vmdk.c
@@ -XXX,XX +XXX,XX @@ static int vmdk_init_extent(BlockBackend *blk,
      int gd_buf_size;
      if (flat) {
 -        ret = blk_truncate(blk, filesize, false, PREALLOC_MODE_OFF, errp);
 +        ret = blk_truncate(blk, filesize, false, PREALLOC_MODE_OFF, 0, errp);
          goto exit;
      }
      magic = cpu_to_be32(VMDK4_MAGIC);
@@ -XXX,XX +XXX,XX @@ static int vmdk_init_extent(BlockBackend *blk,
      }
      ret = blk_truncate(blk, le64_to_cpu(header.grain_offset) << 9, false,
 -                       PREALLOC_MODE_OFF, errp);
 +                       PREALLOC_MODE_OFF, 0, errp);
      if (ret < 0) {
          goto exit;
      }
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn vmdk_co_do_create(int64_t size,
      /* bdrv_pwrite write padding zeros to align to sector, we don't need that
       * for description file */
      if (desc_offset == 0) {
 -        ret = blk_truncate(blk, desc_len, false, PREALLOC_MODE_OFF, errp);
 +        ret = blk_truncate(blk, desc_len, false, PREALLOC_MODE_OFF, 0, errp);
          if (ret < 0) {
              goto exit;
          }
 diff --git a/block/vpc.c b/block/vpc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/vpc.c
 +++ b/block/vpc.c
@@ -XXX,XX +XXX,XX @@ static int create_fixed_disk(BlockBackend *blk, uint8_t *buf,
      /* Add footer to total size */
      total_size += HEADER_SIZE;
 -    ret = blk_truncate(blk, total_size, false, PREALLOC_MODE_OFF, errp);
 +    ret = blk_truncate(blk, total_size, false, PREALLOC_MODE_OFF, 0, errp);
      if (ret < 0) {
          return ret;
      }
 diff --git a/blockdev.c b/blockdev.c
 index XXXXXXX..XXXXXXX 100644
 --- a/blockdev.c
 +++ b/blockdev.c
@@ -XXX,XX +XXX,XX @@ void qmp_block_resize(bool has_device, const char *device,
      }
      bdrv_drained_begin(bs);
 -    ret = blk_truncate(blk, size, false, PREALLOC_MODE_OFF, errp);
 +    ret = blk_truncate(blk, size, false, PREALLOC_MODE_OFF, 0, errp);
      bdrv_drained_end(bs);
  out:
 diff --git a/qemu-img.c b/qemu-img.c
 index XXXXXXX..XXXXXXX 100644
 --- a/qemu-img.c
 +++ b/qemu-img.c
@@ -XXX,XX +XXX,XX @@ static int img_resize(int argc, char **argv)
       * resizing, so pass @exact=true.  It is of no use to report
       * success when the image has not actually been resized.
       */
 -    ret = blk_truncate(blk, total_size, true, prealloc, &err);
 +    ret = blk_truncate(blk, total_size, true, prealloc, 0, &err);
      if (!ret) {
          qprintf(quiet, "Image resized.\n");
      } else {
 diff --git a/qemu-io-cmds.c b/qemu-io-cmds.c
 index XXXXXXX..XXXXXXX 100644
 --- a/qemu-io-cmds.c
 +++ b/qemu-io-cmds.c
@@ -XXX,XX +XXX,XX @@ static int truncate_f(BlockBackend *blk, int argc, char **argv)
       * exact=true.  It is better to err on the "emit more errors" side
       * than to be overly permissive.
       */
 -    ret = blk_truncate(blk, offset, true, PREALLOC_MODE_OFF, &local_err);
 +    ret = blk_truncate(blk, offset, true, PREALLOC_MODE_OFF, 0, &local_err);
      if (ret < 0) {
          error_report_err(local_err);
          return ret;
 --
-.8.3.1
+.25.3

-New patch
+[PULL 06/15] qcow2: Support BDRV_REQ_ZERO_WRITE for truncate
+If BDRV_REQ_ZERO_WRITE is set and we're extending the image, calling
+qcow2_cluster_zeroize() with flags=0 does the right thing: It doesn't
+undo any previous preallocation, but just adds the zero flag to all
+relevant L2 entries. If an external data file is in use, a write_zeroes
+request to the data file is made instead.
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+Message-Id: <20200424125448.63318-5-kwolf@redhat.com>
+Reviewed-by: Eric Blake <eblake@redhat.com>
+Reviewed-by: Max Reitz <mreitz@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ block/qcow2-cluster.c |  2 +-
+ block/qcow2.c         | 34 ++++++++++++++++++++++++++++++++++
+files changed, 35 insertions(+), 1 deletion(-)
+diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/qcow2-cluster.c
++++ b/block/qcow2-cluster.c
+@@ -XXX,XX +XXX,XX @@ int qcow2_cluster_zeroize(BlockDriverState *bs, uint64_t offset,
+     /* Caller must pass aligned values, except at image end */
+     assert(QEMU_IS_ALIGNED(offset, s->cluster_size));
+     assert(QEMU_IS_ALIGNED(end_offset, s->cluster_size) ||
+-           end_offset == bs->total_sectors << BDRV_SECTOR_BITS);
++           end_offset >= bs->total_sectors << BDRV_SECTOR_BITS);
+     /* The zero flag is only supported by version 3 and newer */
+     if (s->qcow_version < 3) {
+diff --git a/block/qcow2.c b/block/qcow2.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/qcow2.c
++++ b/block/qcow2.c
+@@ -XXX,XX +XXX,XX @@ static int coroutine_fn qcow2_do_open(BlockDriverState *bs, QDict *options,
+     bs->supported_zero_flags = header.version >= 3 ?
+                                BDRV_REQ_MAY_UNMAP | BDRV_REQ_NO_FALLBACK : 0;
++    bs->supported_truncate_flags = BDRV_REQ_ZERO_WRITE;
+     /* Repair image if dirty */
+     if (!(flags & (BDRV_O_CHECK | BDRV_O_INACTIVE)) && !bs->read_only &&
+@@ -XXX,XX +XXX,XX @@ static int coroutine_fn qcow2_co_truncate(BlockDriverState *bs, int64_t offset,
+         g_assert_not_reached();
+     }
++    if ((flags & BDRV_REQ_ZERO_WRITE) && offset > old_length) {
++        uint64_t zero_start = QEMU_ALIGN_UP(old_length, s->cluster_size);
++
++        /*
++         * Use zero clusters as much as we can. qcow2_cluster_zeroize()
++         * requires a cluster-aligned start. The end may be unaligned if it is
++         * at the end of the image (which it is here).
++         */
++        ret = qcow2_cluster_zeroize(bs, zero_start, offset - zero_start, 0);
++        if (ret < 0) {
++            error_setg_errno(errp, -ret, "Failed to zero out new clusters");
++            goto fail;
++        }
++
++        /* Write explicit zeros for the unaligned head */
++        if (zero_start > old_length) {
++            uint64_t len = zero_start - old_length;
++            uint8_t *buf = qemu_blockalign0(bs, len);
++            QEMUIOVector qiov;
++            qemu_iovec_init_buf(&qiov, buf, len);
++
++            qemu_co_mutex_unlock(&s->lock);
++            ret = qcow2_co_pwritev_part(bs, old_length, len, &qiov, 0, 0);
++            qemu_co_mutex_lock(&s->lock);
++
++            qemu_vfree(buf);
++            if (ret < 0) {
++                error_setg_errno(errp, -ret, "Failed to zero out the new area");
++                goto fail;
++            }
++        }
++    }
++
+     if (prealloc != PREALLOC_MODE_OFF) {
+         /* Flush metadata before actually changing the image size */
+         ret = qcow2_write_caches(bs);
+--
+.25.3

-New patch
+[PULL 07/15] raw-format: Support BDRV_REQ_ZERO_WRITE for truncate
+The raw format driver can simply forward the flag and let its bs->file
+child take care of actually providing the zeros.
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+Reviewed-by: Max Reitz <mreitz@redhat.com>
+Reviewed-by: Eric Blake <eblake@redhat.com>
+Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Message-Id: <20200424125448.63318-6-kwolf@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ block/raw-format.c | 4 +++-
+file changed, 3 insertions(+), 1 deletion(-)
+diff --git a/block/raw-format.c b/block/raw-format.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/raw-format.c
++++ b/block/raw-format.c
+@@ -XXX,XX +XXX,XX @@ static int coroutine_fn raw_co_truncate(BlockDriverState *bs, int64_t offset,
+     s->size = offset;
+     offset += s->offset;
+-    return bdrv_co_truncate(bs->file, offset, exact, prealloc, 0, errp);
++    return bdrv_co_truncate(bs->file, offset, exact, prealloc, flags, errp);
+ }
+ static void raw_eject(BlockDriverState *bs, bool eject_flag)
+@@ -XXX,XX +XXX,XX @@ static int raw_open(BlockDriverState *bs, QDict *options, int flags,
+     bs->supported_zero_flags = BDRV_REQ_WRITE_UNCHANGED |
+         ((BDRV_REQ_FUA | BDRV_REQ_MAY_UNMAP | BDRV_REQ_NO_FALLBACK) &
+             bs->file->bs->supported_zero_flags);
++    bs->supported_truncate_flags = bs->file->bs->supported_truncate_flags &
++                                   BDRV_REQ_ZERO_WRITE;
+     if (bs->probed && !bdrv_is_read_only(bs)) {
+         bdrv_refresh_filename(bs->file->bs);
+--
+.25.3

-[Qemu-devel] [PULL 8/8] block: fix external snapshot abort permission error
+[PULL 08/15] file-posix: Support BDRV_REQ_ZERO_WRITE for truncate
-From: Jeff Cody <jcody@redhat.com>
+For regular files, we always get BDRV_REQ_ZERO_WRITE behaviour from the
 OS, so we can advertise the flag and just ignore it.
-In external_snapshot_abort(), we try to undo what was done in
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-external_snapshot_prepare() calling bdrv_replace_node() to swap the
+Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-nodes back.  However, we receive a permissions error as writers are
+Reviewed-by: Alberto Garcia <berto@igalia.com>
-blocked on the old node, which is now the new node backing file.
+Reviewed-by: Max Reitz <mreitz@redhat.com>
+Message-Id: <20200424125448.63318-7-kwolf@redhat.com>
 An easy fix (initially suggested by Kevin Wolf) is to call
 bdrv_set_backing_hd() on the new node, to set the backing node to NULL.
 Signed-off-by: Jeff Cody <jcody@redhat.com>
 Reviewed-by: Eric Blake <eblake@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
- blockdev.c | 4 ++++
+ block/file-posix.c | 4 ++++
 file changed, 4 insertions(+)
-diff --git a/blockdev.c b/blockdev.c
+diff --git a/block/file-posix.c b/block/file-posix.c
 index XXXXXXX..XXXXXXX 100644
---- a/blockdev.c
+--- a/block/file-posix.c
-+++ b/blockdev.c
++++ b/block/file-posix.c
-@@ -XXX,XX +XXX,XX @@ static void external_snapshot_abort(BlkActionState *common)
+@@ -XXX,XX +XXX,XX @@ static int raw_open_common(BlockDriverState *bs, QDict *options,
-                              DO_UPCAST(ExternalSnapshotState, common, common);
+ #endif
-     if (state->new_bs) {
-         if (state->overlay_appended) {
+     bs->supported_zero_flags = BDRV_REQ_MAY_UNMAP | BDRV_REQ_NO_FALLBACK;
-+            bdrv_ref(state->old_bs);   /* we can't let bdrv_set_backind_hd()
++    if (S_ISREG(st.st_mode)) {
-+                                          close state->old_bs; we need it */
++        /* When extending regular files, we get zeros from the OS */
-+            bdrv_set_backing_hd(state->new_bs, NULL, &error_abort);
++        bs->supported_truncate_flags = BDRV_REQ_ZERO_WRITE;
-             bdrv_replace_node(state->new_bs, state->old_bs, &error_abort);
++    }
-+            bdrv_unref(state->old_bs); /* bdrv_replace_node() ref'ed old_bs */
+     ret = 0;
-         }
+ fail:
-     }
+     if (filename && (bdrv_flags & BDRV_O_TEMPORARY)) {
  }
 --
-.8.3.1
+.25.3

-[Qemu-devel] [PULL 1/8] block: Fix anonymous BBs in blk_root_inactivate()
+[PULL 09/15] block: truncate: Don't make backing file data visible
-blk->name isn't an array, but a pointer that can be NULL. Checking for
+When extending the size of an image that has a backing file larger than
-an anonymous BB must involve a NULL check first, otherwise we get
+its old size, make sure that the backing file data doesn't become
-crashes.
+visible in the guest, but the added area is properly zeroed out.
 Consider the following scenario where the overlay is shorter than its
 backing file:
     base.qcow2:     AAAAAAAA
     overlay.qcow2:  BBBB
 When resizing (extending) overlay.qcow2, the new blocks should not stay
 unallocated and make the additional As from base.qcow2 visible like
 before this patch, but zeros should be read.
 A similar case happens with the various variants of a commit job when an
 intermediate file is short (- for unallocated):
     base.qcow2:     A-A-AAAA
     mid.qcow2:      BB-B
     top.qcow2:      C--C--C-
 After commit top.qcow2 to mid.qcow2, the following happens:
     mid.qcow2:      CB-C00C0 (correct result)
     mid.qcow2:      CB-C--C- (before this fix)
 Without the fix, blocks that previously read as zeros on top.qcow2
 suddenly turn into A.
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Reviewed-by: Fam Zheng <famz@redhat.com>
+Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Reviewed-by: Juan Quintela <quintela@redhat.com>
+Message-Id: <20200424125448.63318-8-kwolf@redhat.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
+Reviewed-by: Max Reitz <mreitz@redhat.com>
-Reviewed-by: Jeff Cody <jcody@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
- block/block-backend.c | 2 +-
+ block/io.c | 25 +++++++++++++++++++++++++
-file changed, 1 insertion(+), 1 deletion(-)
+file changed, 25 insertions(+)
-diff --git a/block/block-backend.c b/block/block-backend.c
+diff --git a/block/io.c b/block/io.c
 index XXXXXXX..XXXXXXX 100644
---- a/block/block-backend.c
+--- a/block/io.c
-+++ b/block/block-backend.c
++++ b/block/io.c
-@@ -XXX,XX +XXX,XX @@ static int blk_root_inactivate(BdrvChild *child)
+@@ -XXX,XX +XXX,XX @@ int coroutine_fn bdrv_co_truncate(BdrvChild *child, int64_t offset, bool exact,
-      * this point because the VM is stopped) and unattached monitor-owned
+         goto out;
       * BlockBackends. If there is still any other user like a block job, then
       * we simply can't inactivate the image. */
 -    if (!blk->dev && !blk->name[0]) {
 +    if (!blk->dev && !blk_name(blk)[0]) {
          return -EPERM;
      }
++    /*
++     * If the image has a backing file that is large enough that it would
++     * provide data for the new area, we cannot leave it unallocated because
++     * then the backing file content would become visible. Instead, zero-fill
++     * the new area.
++     *
++     * Note that if the image has a backing file, but was opened without the
++     * backing file, taking care of keeping things consistent with that backing
++     * file is the user's responsibility.
++     */
++    if (new_bytes && bs->backing) {
++        int64_t backing_len;
++
++        backing_len = bdrv_getlength(backing_bs(bs));
++        if (backing_len < 0) {
++            ret = backing_len;
++            error_setg_errno(errp, -ret, "Could not get backing file size");
++            goto out;
++        }
++
++        if (backing_len > old_size) {
++            flags |= BDRV_REQ_ZERO_WRITE;
++        }
++    }
++
+     if (drv->bdrv_co_truncate) {
+         if (flags & ~bs->supported_truncate_flags) {
+             error_setg(errp, "Block driver does not support requested flags");
 --
-.8.3.1
+.25.3

-New patch
+[PULL 10/15] iotests: Filter testfiles out in filter_img_info()
+We want to keep TEST_IMG for the full path of the main test image, but
+filter_testfiles() must be called for other test images before replacing
+other things like the image format because the test directory path could
+contain the format as a substring.
+Insert a filter_testfiles() call between both.
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+Reviewed-by: Max Reitz <mreitz@redhat.com>
+Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Message-Id: <20200424125448.63318-9-kwolf@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ tests/qemu-iotests/iotests.py | 5 +++--
+file changed, 3 insertions(+), 2 deletions(-)
+diff --git a/tests/qemu-iotests/iotests.py b/tests/qemu-iotests/iotests.py
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/qemu-iotests/iotests.py
++++ b/tests/qemu-iotests/iotests.py
+@@ -XXX,XX +XXX,XX @@ def filter_img_info(output, filename):
+     for line in output.split('\n'):
+         if 'disk size' in line or 'actual-size' in line:
+             continue
+-        line = line.replace(filename, 'TEST_IMG') \
+-                   .replace(imgfmt, 'IMGFMT')
++        line = line.replace(filename, 'TEST_IMG')
++        line = filter_testfiles(line)
++        line = line.replace(imgfmt, 'IMGFMT')
+         line = re.sub('iters: [0-9]+', 'iters: XXX', line)
+         line = re.sub('uuid: [-a-f0-9]+', 'uuid: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX', line)
+         line = re.sub('cid: [0-9]+', 'cid: XXXXXXXXXX', line)
+--
+.25.3

-[Qemu-devel] [PULL 4/8] qemu-iotests: Block migration test
+[PULL 11/15] iotests: Test committing to short backing file
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Reviewed-by: Jeff Cody <jcody@redhat.com>
+Message-Id: <20200424125448.63318-10-kwolf@redhat.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
+Reviewed-by: Max Reitz <mreitz@redhat.com>
 Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
- tests/qemu-iotests/183     | 140 +++++++++++++++++++++++++++++++++++++++++++++
+ tests/qemu-iotests/274     | 155 +++++++++++++++++++++
- tests/qemu-iotests/183.out |  46 +++++++++++++++
+ tests/qemu-iotests/274.out | 268 +++++++++++++++++++++++++++++++++++++
  tests/qemu-iotests/group   |   1 +
-files changed, 187 insertions(+)
+files changed, 424 insertions(+)
- create mode 100755 tests/qemu-iotests/183
+ create mode 100755 tests/qemu-iotests/274
- create mode 100644 tests/qemu-iotests/183.out
+ create mode 100644 tests/qemu-iotests/274.out
-diff --git a/tests/qemu-iotests/183 b/tests/qemu-iotests/183
+diff --git a/tests/qemu-iotests/274 b/tests/qemu-iotests/274
 new file mode 100755
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/tests/qemu-iotests/183
++++ b/tests/qemu-iotests/274
 @@ -XXX,XX +XXX,XX @@
-+#!/bin/bash
++#!/usr/bin/env python3
 +#
-+# Test old-style block migration (migrate -b)
++# Copyright (C) 2019 Red Hat, Inc.
 +#
 +# Copyright (C) 2017 Red Hat, Inc.
 +#
 +# This program is free software; you can redistribute it and/or modify
 +# it under the terms of the GNU General Public License as published by
 +# the Free Software Foundation; either version 2 of the License, or
 +# (at your option) any later version.
 ...
 +# GNU General Public License for more details.
 +#
 +# You should have received a copy of the GNU General Public License
 +# along with this program.  If not, see <http://www.gnu.org/licenses/>.
 +#
-+
++# Creator/Owner: Kevin Wolf <kwolf@redhat.com>
-+# creator
++#
-+owner=kwolf@redhat.com
++# Some tests for short backing files and short overlays
 +
-+seq=`basename $0`
++import iotests
-+echo "QA output created by $seq"
++
-+
++iotests.verify_image_format(supported_fmts=['qcow2'])
-+here=`pwd`
++iotests.verify_platform(['linux'])
-+status=1 # failure is the default!
++
-+
++size_short = 1 * 1024 * 1024
-+MIG_SOCKET="${TEST_DIR}/migrate"
++size_long = 2 * 1024 * 1024
-+
++size_diff = size_long - size_short
-+_cleanup()
++
-+{
++def create_chain() -> None:
-+    rm -f "${MIG_SOCKET}"
++    iotests.qemu_img_log('create', '-f', iotests.imgfmt, base,
-+    rm -f "${TEST_IMG}.dest"
++                         str(size_long))
-+    _cleanup_test_img
++    iotests.qemu_img_log('create', '-f', iotests.imgfmt, '-b', base, mid,
-+    _cleanup_qemu
++                         str(size_short))
-+}
++    iotests.qemu_img_log('create', '-f', iotests.imgfmt, '-b', mid, top,
-+trap "_cleanup; exit \$status" 0 1 2 3 15
++                         str(size_long))
 +
-+# get standard environment, filters and checks
++    iotests.qemu_io_log('-c', 'write -P 1 0 %d' % size_long, base)
-+. ./common.rc
++
-+. ./common.filter
++def create_vm() -> iotests.VM:
-+. ./common.qemu
++    vm = iotests.VM()
-+
++    vm.add_blockdev('file,filename=%s,node-name=base-file' % base)
-+_supported_fmt qcow2 raw qed dmg quorum
++    vm.add_blockdev('%s,file=base-file,node-name=base' % iotests.imgfmt)
-+_supported_proto file
++    vm.add_blockdev('file,filename=%s,node-name=mid-file' % mid)
-+_supported_os Linux
++    vm.add_blockdev('%s,file=mid-file,node-name=mid,backing=base'
-+
++                    % iotests.imgfmt)
-+size=64M
++    vm.add_drive(top, 'backing=mid,node-name=top')
-+_make_test_img $size
++    return vm
-+TEST_IMG="${TEST_IMG}.dest" _make_test_img $size
++
-+
++with iotests.FilePath('base') as base, \
-+echo
++     iotests.FilePath('mid') as mid, \
-+echo === Starting VMs ===
++     iotests.FilePath('top') as top:
-+echo
++
-+
++    iotests.log('== Commit tests ==')
-+qemu_comm_method="qmp"
++
-+
++    create_chain()
-+_launch_qemu \
++
-+    -drive file="${TEST_IMG}",cache=$CACHEMODE,driver=$IMGFMT,id=disk
++    iotests.log('=== Check visible data ===')
-+src=$QEMU_HANDLE
++
-+_send_qemu_cmd $src "{ 'execute': 'qmp_capabilities' }" 'return'
++    iotests.qemu_io_log('-c', 'read -P 1 0 %d' % size_short, top)
-+
++    iotests.qemu_io_log('-c', 'read -P 0 %d %d' % (size_short, size_diff), top)
-+_launch_qemu \
++
-+    -drive file="${TEST_IMG}.dest",cache=$CACHEMODE,driver=$IMGFMT,id=disk \
++    iotests.log('=== Checking allocation status ===')
-+    -incoming "unix:${MIG_SOCKET}"
++
-+dest=$QEMU_HANDLE
++    iotests.qemu_io_log('-c', 'alloc 0 %d' % size_short,
-+_send_qemu_cmd $dest "{ 'execute': 'qmp_capabilities' }" 'return'
++                        '-c', 'alloc %d %d' % (size_short, size_diff),
-+
++                        base)
-+echo
++
-+echo === Write something on the source ===
++    iotests.qemu_io_log('-c', 'alloc 0 %d' % size_short,
-+echo
++                        '-c', 'alloc %d %d' % (size_short, size_diff),
-+
++                        mid)
-+_send_qemu_cmd $src \
++
-+    "{ 'execute': 'human-monitor-command',
++    iotests.qemu_io_log('-c', 'alloc 0 %d' % size_short,
-+       'arguments': { 'command-line':
++                        '-c', 'alloc %d %d' % (size_short, size_diff),
-+                      'qemu-io disk \"write -P 0x55 0 64k\"' } }" \
++                        top)
-+    'return'
++
-+_send_qemu_cmd $src \
++    iotests.log('=== Checking map ===')
-+    "{ 'execute': 'human-monitor-command',
++
-+       'arguments': { 'command-line':
++    iotests.qemu_img_log('map', '--output=json', base)
-+                      'qemu-io disk \"read -P 0x55 0 64k\"' } }" \
++    iotests.qemu_img_log('map', '--output=human', base)
-+    'return'
++    iotests.qemu_img_log('map', '--output=json', mid)
-+
++    iotests.qemu_img_log('map', '--output=human', mid)
-+echo
++    iotests.qemu_img_log('map', '--output=json', top)
-+echo === Do block migration to destination ===
++    iotests.qemu_img_log('map', '--output=human', top)
-+echo
++
-+
++    iotests.log('=== Testing qemu-img commit (top -> mid) ===')
-+reply="$(_send_qemu_cmd $src \
++
-+    "{ 'execute': 'migrate',
++    iotests.qemu_img_log('commit', top)
-+       'arguments': { 'uri': 'unix:${MIG_SOCKET}', 'blk': true } }" \
++    iotests.img_info_log(mid)
-+    'return\|error')"
++    iotests.qemu_io_log('-c', 'read -P 1 0 %d' % size_short, mid)
-+echo "$reply"
++    iotests.qemu_io_log('-c', 'read -P 0 %d %d' % (size_short, size_diff), mid)
-+if echo "$reply" | grep "compiled without old-style" > /dev/null; then
++
-+    _notrun "migrate -b support not compiled in"
++    iotests.log('=== Testing HMP commit (top -> mid) ===')
-+fi
++
-+
++    create_chain()
-+QEMU_COMM_TIMEOUT=0.1 qemu_cmd_repeat=50 silent=yes \
++    with create_vm() as vm:
-+    _send_qemu_cmd $src "{ 'execute': 'query-migrate' }" '"status": "completed"'
++        vm.launch()
-+_send_qemu_cmd $src "{ 'execute': 'query-status' }" "return"
++        vm.qmp_log('human-monitor-command', command_line='commit drive0')
 +
-+echo
++    iotests.img_info_log(mid)
-+echo === Do some I/O on the destination ===
++    iotests.qemu_io_log('-c', 'read -P 1 0 %d' % size_short, mid)
-+echo
++    iotests.qemu_io_log('-c', 'read -P 0 %d %d' % (size_short, size_diff), mid)
 +
-+# It is important that we use the BlockBackend of the guest device here instead
++    iotests.log('=== Testing QMP active commit (top -> mid) ===')
-+# of the node name, which would create a new BlockBackend and not test whether
++
-+# the guest has the necessary permissions to access the image now
++    create_chain()
-+silent=yes _send_qemu_cmd $dest "" "100 %"
++    with create_vm() as vm:
-+_send_qemu_cmd $dest "{ 'execute': 'query-status' }" "return"
++        vm.launch()
-+_send_qemu_cmd $dest \
++        vm.qmp_log('block-commit', device='top', base_node='mid',
-+    "{ 'execute': 'human-monitor-command',
++                   job_id='job0', auto_dismiss=False)
-+       'arguments': { 'command-line':
++        vm.run_job('job0', wait=5)
-+                      'qemu-io disk \"read -P 0x55 0 64k\"' } }" \
++
-+    'return'
++    iotests.img_info_log(mid)
-+_send_qemu_cmd $dest \
++    iotests.qemu_io_log('-c', 'read -P 1 0 %d' % size_short, mid)
-+    "{ 'execute': 'human-monitor-command',
++    iotests.qemu_io_log('-c', 'read -P 0 %d %d' % (size_short, size_diff), mid)
-+       'arguments': { 'command-line':
++
-+                      'qemu-io disk \"write -P 0x66 1M 64k\"' } }" \
++
-+    'return'
++    iotests.log('== Resize tests ==')
 +
-+echo
++    # Use different sizes for different allocation modes:
-+echo === Shut down and check image ===
++    #
-+echo
++    # We want to have at least one test where 32 bit truncation in the size of
-+
++    # the overlapping area becomes visible. This is covered by the
-+_send_qemu_cmd $src '{"execute":"quit"}' 'return'
++    # prealloc='off' case (1G to 6G is an overlap of 5G).
-+_send_qemu_cmd $dest '{"execute":"quit"}' 'return'
++    #
-+wait=1 _cleanup_qemu
++    # However, we can only do this for modes that don't preallocate data
-+
++    # because otherwise we might run out of space on the test host.
-+_check_test_img
++    #
-+TEST_IMG="${TEST_IMG}.dest" _check_test_img
++    # We also want to test some unaligned combinations.
-+
++    for (prealloc, base_size, top_size_old, top_size_new, off) in [
-+$QEMU_IO -c 'write -P 0x66 1M 64k' "$TEST_IMG" | _filter_qemu_io
++            ('off',       '6G',    '1G',   '8G',   '5G'),
-+$QEMU_IMG compare "$TEST_IMG.dest" "$TEST_IMG"
++            ('metadata', '32G',   '30G',  '33G',  '31G'),
-+
++            ('falloc',   '10M',    '5M',  '15M',   '9M'),
-+# success, all done
++            ('full',     '16M',    '8M',  '12M',  '11M'),
-+echo "*** done"
++            ('off',      '384k', '253k', '512k', '253k'),
-+rm -f $seq.full
++            ('off',      '400k', '256k', '512k', '336k'),
-+status=0
++            ('off',      '512k', '256k', '500k', '436k')]:
-diff --git a/tests/qemu-iotests/183.out b/tests/qemu-iotests/183.out
++
 +        iotests.log('=== preallocation=%s ===' % prealloc)
 +        iotests.qemu_img_log('create', '-f', iotests.imgfmt, base, base_size)
 +        iotests.qemu_img_log('create', '-f', iotests.imgfmt, '-b', base, top,
 +                             top_size_old)
 +        iotests.qemu_io_log('-c', 'write -P 1 %s 64k' % off, base)
 +
 +        # After this, top_size_old to base_size should be allocated/zeroed.
 +        #
 +        # In theory, leaving base_size to top_size_new unallocated would be
 +        # correct, but in practice, if we zero out anything, we zero out
 +        # everything up to top_size_new.
 +        iotests.qemu_img_log('resize', '-f', iotests.imgfmt,
 +                             '--preallocation', prealloc, top, top_size_new)
 +        iotests.qemu_io_log('-c', 'read -P 0 %s 64k' % off, top)
 +        iotests.qemu_io_log('-c', 'map', top)
 +        iotests.qemu_img_log('map', '--output=json', top)
 diff --git a/tests/qemu-iotests/274.out b/tests/qemu-iotests/274.out
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/tests/qemu-iotests/183.out
++++ b/tests/qemu-iotests/274.out
 @@ -XXX,XX +XXX,XX @@
-+QA output created by 183
++== Commit tests ==
-+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
++Formatting 'TEST_DIR/PID-base', fmt=qcow2 size=2097152 cluster_size=65536 lazy_refcounts=off refcount_bits=16
-+Formatting 'TEST_DIR/t.IMGFMT.dest', fmt=IMGFMT size=67108864
++
-+
++Formatting 'TEST_DIR/PID-mid', fmt=qcow2 size=1048576 backing_file=TEST_DIR/PID-base cluster_size=65536 lazy_refcounts=off refcount_bits=16
-+=== Starting VMs ===
++
-+
++Formatting 'TEST_DIR/PID-top', fmt=qcow2 size=2097152 backing_file=TEST_DIR/PID-mid cluster_size=65536 lazy_refcounts=off refcount_bits=16
 +
 +wrote 2097152/2097152 bytes at offset 0
 +2 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 +
 +=== Check visible data ===
 +read 1048576/1048576 bytes at offset 0
 +1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 +
 +read 1048576/1048576 bytes at offset 1048576
 +1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 +
 +=== Checking allocation status ===
 +1048576/1048576 bytes allocated at offset 0 bytes
 +1048576/1048576 bytes allocated at offset 1 MiB
 +
 +0/1048576 bytes allocated at offset 0 bytes
 +0/0 bytes allocated at offset 1 MiB
 +
 +0/1048576 bytes allocated at offset 0 bytes
 +0/1048576 bytes allocated at offset 1 MiB
 +
 +=== Checking map ===
 +[{ "start": 0, "length": 2097152, "depth": 0, "zero": false, "data": true, "offset": 327680}]
 +
 +Offset          Length          Mapped to       File
 +0               0x200000        0x50000         TEST_DIR/PID-base
 +
 +[{ "start": 0, "length": 1048576, "depth": 1, "zero": false, "data": true, "offset": 327680}]
 +
 +Offset          Length          Mapped to       File
 +0               0x100000        0x50000         TEST_DIR/PID-base
 +
 +[{ "start": 0, "length": 1048576, "depth": 2, "zero": false, "data": true, "offset": 327680},
 +{ "start": 1048576, "length": 1048576, "depth": 0, "zero": true, "data": false}]
 +
 +Offset          Length          Mapped to       File
 +0               0x100000        0x50000         TEST_DIR/PID-base
 +
 +=== Testing qemu-img commit (top -> mid) ===
 +Image committed.
 +
 +image: TEST_IMG
 +file format: IMGFMT
 +virtual size: 2 MiB (2097152 bytes)
 +cluster_size: 65536
 +backing file: TEST_DIR/PID-base
 +Format specific information:
 +    compat: 1.1
 +    lazy refcounts: false
 +    refcount bits: 16
 +    corrupt: false
 +
 +read 1048576/1048576 bytes at offset 0
 +1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 +
 +read 1048576/1048576 bytes at offset 1048576
 +1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 +
 +=== Testing HMP commit (top -> mid) ===
 +Formatting 'TEST_DIR/PID-base', fmt=qcow2 size=2097152 cluster_size=65536 lazy_refcounts=off refcount_bits=16
 +
 +Formatting 'TEST_DIR/PID-mid', fmt=qcow2 size=1048576 backing_file=TEST_DIR/PID-base cluster_size=65536 lazy_refcounts=off refcount_bits=16
 +
 +Formatting 'TEST_DIR/PID-top', fmt=qcow2 size=2097152 backing_file=TEST_DIR/PID-mid cluster_size=65536 lazy_refcounts=off refcount_bits=16
 +
 +wrote 2097152/2097152 bytes at offset 0
 +2 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 +
 +{"execute": "human-monitor-command", "arguments": {"command-line": "commit drive0"}}
 +{"return": ""}
 +image: TEST_IMG
 +file format: IMGFMT
 +virtual size: 2 MiB (2097152 bytes)
 +cluster_size: 65536
 +backing file: TEST_DIR/PID-base
 +Format specific information:
 +    compat: 1.1
 +    lazy refcounts: false
 +    refcount bits: 16
 +    corrupt: false
 +
 +read 1048576/1048576 bytes at offset 0
 +1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 +
 +read 1048576/1048576 bytes at offset 1048576
 +1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 +
 +=== Testing QMP active commit (top -> mid) ===
 +Formatting 'TEST_DIR/PID-base', fmt=qcow2 size=2097152 cluster_size=65536 lazy_refcounts=off refcount_bits=16
 +
 +Formatting 'TEST_DIR/PID-mid', fmt=qcow2 size=1048576 backing_file=TEST_DIR/PID-base cluster_size=65536 lazy_refcounts=off refcount_bits=16
 +
 +Formatting 'TEST_DIR/PID-top', fmt=qcow2 size=2097152 backing_file=TEST_DIR/PID-mid cluster_size=65536 lazy_refcounts=off refcount_bits=16
 +
 +wrote 2097152/2097152 bytes at offset 0
 +2 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 +
 +{"execute": "block-commit", "arguments": {"auto-dismiss": false, "base-node": "mid", "device": "top", "job-id": "job0"}}
 +{"return": {}}
++{"execute": "job-complete", "arguments": {"id": "job0"}}
 +{"return": {}}
-+
++{"data": {"device": "job0", "len": 0, "offset": 0, "speed": 0, "type": "commit"}, "event": "BLOCK_JOB_READY", "timestamp": {"microseconds": "USECS", "seconds": "SECS"}}
-+=== Write something on the source ===
++{"data": {"device": "job0", "len": 0, "offset": 0, "speed": 0, "type": "commit"}, "event": "BLOCK_JOB_COMPLETED", "timestamp": {"microseconds": "USECS", "seconds": "SECS"}}
-+
++{"execute": "job-dismiss", "arguments": {"id": "job0"}}
 +wrote 65536/65536 bytes at offset 0
 +64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 +{"return": ""}
 +read 65536/65536 bytes at offset 0
 +64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 +{"return": ""}
 +
 +=== Do block migration to destination ===
 +
 +{"return": {}}
-+{"return": {"status": "postmigrate", "singlestep": false, "running": false}}
++image: TEST_IMG
-+
++file format: IMGFMT
-+=== Do some I/O on the destination ===
++virtual size: 2 MiB (2097152 bytes)
-+
++cluster_size: 65536
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "RESUME"}
++backing file: TEST_DIR/PID-base
-+{"return": {"status": "running", "singlestep": false, "running": true}}
++Format specific information:
-+read 65536/65536 bytes at offset 0
++    compat: 1.1
-+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
++    lazy refcounts: false
-+{"return": ""}
++    refcount bits: 16
-+wrote 65536/65536 bytes at offset 1048576
++    corrupt: false
-+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
++
-+{"return": ""}
++read 1048576/1048576 bytes at offset 0
-+
++1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-+=== Shut down and check image ===
++
-+
++read 1048576/1048576 bytes at offset 1048576
-+{"return": {}}
++1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-+{"return": {}}
++
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false}}
++== Resize tests ==
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false}}
++=== preallocation=off ===
-+No errors were found on the image.
++Formatting 'TEST_DIR/PID-base', fmt=qcow2 size=6442450944 cluster_size=65536 lazy_refcounts=off refcount_bits=16
-+No errors were found on the image.
++
-+wrote 65536/65536 bytes at offset 1048576
++Formatting 'TEST_DIR/PID-top', fmt=qcow2 size=1073741824 backing_file=TEST_DIR/PID-base cluster_size=65536 lazy_refcounts=off refcount_bits=16
-+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
++
-+Images are identical.
++wrote 65536/65536 bytes at offset 5368709120
-+*** done
++64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 +
 +Image resized.
 +
 +read 65536/65536 bytes at offset 5368709120
 +64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 +
 +1 GiB (0x40000000) bytes not allocated at offset 0 bytes (0x0)
 +7 GiB (0x1c0000000) bytes     allocated at offset 1 GiB (0x40000000)
 +
 +[{ "start": 0, "length": 1073741824, "depth": 1, "zero": true, "data": false},
 +{ "start": 1073741824, "length": 7516192768, "depth": 0, "zero": true, "data": false}]
 +
 +=== preallocation=metadata ===
 +Formatting 'TEST_DIR/PID-base', fmt=qcow2 size=34359738368 cluster_size=65536 lazy_refcounts=off refcount_bits=16
 +
 +Formatting 'TEST_DIR/PID-top', fmt=qcow2 size=32212254720 backing_file=TEST_DIR/PID-base cluster_size=65536 lazy_refcounts=off refcount_bits=16
 +
 +wrote 65536/65536 bytes at offset 33285996544
 +64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 +
 +Image resized.
 +
 +read 65536/65536 bytes at offset 33285996544
 +64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 +
 +30 GiB (0x780000000) bytes not allocated at offset 0 bytes (0x0)
 +3 GiB (0xc0000000) bytes     allocated at offset 30 GiB (0x780000000)
 +
 +[{ "start": 0, "length": 32212254720, "depth": 1, "zero": true, "data": false},
 +{ "start": 32212254720, "length": 536870912, "depth": 0, "zero": true, "data": false, "offset": 327680},
 +{ "start": 32749125632, "length": 536870912, "depth": 0, "zero": true, "data": false, "offset": 537264128},
 +{ "start": 33285996544, "length": 536870912, "depth": 0, "zero": true, "data": false, "offset": 1074200576},
 +{ "start": 33822867456, "length": 536870912, "depth": 0, "zero": true, "data": false, "offset": 1611137024},
 +{ "start": 34359738368, "length": 536870912, "depth": 0, "zero": true, "data": false, "offset": 2148139008},
 +{ "start": 34896609280, "length": 536870912, "depth": 0, "zero": true, "data": false, "offset": 2685075456}]
 +
 +=== preallocation=falloc ===
 +Formatting 'TEST_DIR/PID-base', fmt=qcow2 size=10485760 cluster_size=65536 lazy_refcounts=off refcount_bits=16
 +
 +Formatting 'TEST_DIR/PID-top', fmt=qcow2 size=5242880 backing_file=TEST_DIR/PID-base cluster_size=65536 lazy_refcounts=off refcount_bits=16
 +
 +wrote 65536/65536 bytes at offset 9437184
 +64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 +
 +Image resized.
 +
 +read 65536/65536 bytes at offset 9437184
 +64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 +
 +5 MiB (0x500000) bytes not allocated at offset 0 bytes (0x0)
 +10 MiB (0xa00000) bytes     allocated at offset 5 MiB (0x500000)
 +
 +[{ "start": 0, "length": 5242880, "depth": 1, "zero": true, "data": false},
 +{ "start": 5242880, "length": 10485760, "depth": 0, "zero": true, "data": false, "offset": 327680}]
 +
 +=== preallocation=full ===
 +Formatting 'TEST_DIR/PID-base', fmt=qcow2 size=16777216 cluster_size=65536 lazy_refcounts=off refcount_bits=16
 +
 +Formatting 'TEST_DIR/PID-top', fmt=qcow2 size=8388608 backing_file=TEST_DIR/PID-base cluster_size=65536 lazy_refcounts=off refcount_bits=16
 +
 +wrote 65536/65536 bytes at offset 11534336
 +64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 +
 +Image resized.
 +
 +read 65536/65536 bytes at offset 11534336
 +64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 +
 +8 MiB (0x800000) bytes not allocated at offset 0 bytes (0x0)
 +4 MiB (0x400000) bytes     allocated at offset 8 MiB (0x800000)
 +
 +[{ "start": 0, "length": 8388608, "depth": 1, "zero": true, "data": false},
 +{ "start": 8388608, "length": 4194304, "depth": 0, "zero": true, "data": false, "offset": 327680}]
 +
 +=== preallocation=off ===
 +Formatting 'TEST_DIR/PID-base', fmt=qcow2 size=393216 cluster_size=65536 lazy_refcounts=off refcount_bits=16
 +
 +Formatting 'TEST_DIR/PID-top', fmt=qcow2 size=259072 backing_file=TEST_DIR/PID-base cluster_size=65536 lazy_refcounts=off refcount_bits=16
 +
 +wrote 65536/65536 bytes at offset 259072
 +64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 +
 +Image resized.
 +
 +read 65536/65536 bytes at offset 259072
 +64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 +
 +192 KiB (0x30000) bytes not allocated at offset 0 bytes (0x0)
 +320 KiB (0x50000) bytes     allocated at offset 192 KiB (0x30000)
 +
 +[{ "start": 0, "length": 196608, "depth": 1, "zero": true, "data": false},
 +{ "start": 196608, "length": 65536, "depth": 0, "zero": false, "data": true, "offset": 327680},
 +{ "start": 262144, "length": 262144, "depth": 0, "zero": true, "data": false}]
 +
 +=== preallocation=off ===
 +Formatting 'TEST_DIR/PID-base', fmt=qcow2 size=409600 cluster_size=65536 lazy_refcounts=off refcount_bits=16
 +
 +Formatting 'TEST_DIR/PID-top', fmt=qcow2 size=262144 backing_file=TEST_DIR/PID-base cluster_size=65536 lazy_refcounts=off refcount_bits=16
 +
 +wrote 65536/65536 bytes at offset 344064
 +64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 +
 +Image resized.
 +
 +read 65536/65536 bytes at offset 344064
 +64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 +
 +256 KiB (0x40000) bytes not allocated at offset 0 bytes (0x0)
 +256 KiB (0x40000) bytes     allocated at offset 256 KiB (0x40000)
 +
 +[{ "start": 0, "length": 262144, "depth": 1, "zero": true, "data": false},
 +{ "start": 262144, "length": 262144, "depth": 0, "zero": true, "data": false}]
 +
 +=== preallocation=off ===
 +Formatting 'TEST_DIR/PID-base', fmt=qcow2 size=524288 cluster_size=65536 lazy_refcounts=off refcount_bits=16
 +
 +Formatting 'TEST_DIR/PID-top', fmt=qcow2 size=262144 backing_file=TEST_DIR/PID-base cluster_size=65536 lazy_refcounts=off refcount_bits=16
 +
 +wrote 65536/65536 bytes at offset 446464
 +64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 +
 +Image resized.
 +
 +read 65536/65536 bytes at offset 446464
 +64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 +
 +256 KiB (0x40000) bytes not allocated at offset 0 bytes (0x0)
 +244 KiB (0x3d000) bytes     allocated at offset 256 KiB (0x40000)
 +
 +[{ "start": 0, "length": 262144, "depth": 1, "zero": true, "data": false},
 +{ "start": 262144, "length": 249856, "depth": 0, "zero": true, "data": false}]
 +
 diff --git a/tests/qemu-iotests/group b/tests/qemu-iotests/group
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/qemu-iotests/group
 +++ b/tests/qemu-iotests/group
 @@ -XXX,XX +XXX,XX @@
-rw auto quick
+rw backing quick
-rw auto migration
+rw
-rw auto quick
+backing quick
-+183 rw auto migration
++274 rw backing
 rw quick
 rw backing quick
 rw migration quick
 --
-.8.3.1
+.25.3

-[Qemu-devel] [PULL 2/8] migration: Inactivate images after .save_live_complete_precopy()
+[PULL 12/15] qcow2: Forward ZERO_WRITE flag for full preallocation
-Block migration may still access the image during its
+The BDRV_REQ_ZERO_WRITE is currently implemented in a way that first the
-.save_live_complete_precopy() implementation, so we should only
+image is possibly preallocated and then the zero flag is added to all
-inactivate the image afterwards.
+clusters. This means that a copy-on-write operation may be needed when
 writing to these clusters, despite having used preallocation, negating
 one of the major benefits of preallocation.
-Another reason for the change is that inactivating an image fails when
+Instead, try to forward the BDRV_REQ_ZERO_WRITE to the protocol driver,
-there is still a non-device BlockBackend using it, which includes the
+and if the protocol driver can ensure that the new area reads as zeros,
-BBs used by block migration. We want to give block migration a chance to
+we can skip setting the zero flag in the qcow2 layer.
-release the BBs before trying to inactivate the image (this will be done
-in another patch).
+Unfortunately, the same approach doesn't work for metadata
 preallocation, so we'll still set the zero flag there.
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Reviewed-by: Fam Zheng <famz@redhat.com>
+Reviewed-by: Max Reitz <mreitz@redhat.com>
-Reviewed-by: Juan Quintela <quintela@redhat.com>
+Message-Id: <20200424142701.67053-1-kwolf@redhat.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
+Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Reviewed-by: Jeff Cody <jcody@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
- migration/migration.c | 12 +++++++-----
+ block/qcow2.c              | 22 +++++++++++++++++++---
-file changed, 7 insertions(+), 5 deletions(-)
+ tests/qemu-iotests/274.out |  4 ++--
 files changed, 21 insertions(+), 5 deletions(-)
-diff --git a/migration/migration.c b/migration/migration.c
+diff --git a/block/qcow2.c b/block/qcow2.c
 index XXXXXXX..XXXXXXX 100644
---- a/migration/migration.c
+--- a/block/qcow2.c
-+++ b/migration/migration.c
++++ b/block/qcow2.c
-@@ -XXX,XX +XXX,XX @@ static void migration_completion(MigrationState *s, int current_active_state,
+@@ -XXX,XX +XXX,XX @@ static int coroutine_fn qcow2_co_truncate(BlockDriverState *bs, int64_t offset,
+         /* Allocate the data area */
-         if (!ret) {
+         new_file_size = allocation_start +
-             ret = vm_stop_force_state(RUN_STATE_FINISH_MIGRATE);
+                         nb_new_data_clusters * s->cluster_size;
 -        /* Image file grows, so @exact does not matter */
 -        ret = bdrv_co_truncate(bs->file, new_file_size, false, prealloc, 0,
 -                               errp);
 +        /*
 +         * Image file grows, so @exact does not matter.
 +         *
 +         * If we need to zero out the new area, try first whether the protocol
 +         * driver can already take care of this.
 +         */
 +        if (flags & BDRV_REQ_ZERO_WRITE) {
 +            ret = bdrv_co_truncate(bs->file, new_file_size, false, prealloc,
 +                                   BDRV_REQ_ZERO_WRITE, NULL);
 +            if (ret >= 0) {
-+                qemu_file_set_rate_limit(s->to_dst_file, INT64_MAX);
++                flags &= ~BDRV_REQ_ZERO_WRITE;
 +                qemu_savevm_state_complete_precopy(s->to_dst_file, false);
 +            }
-             /*
++        } else {
-              * Don't mark the image with BDRV_O_INACTIVE flag if
++            ret = -1;
-              * we will go into COLO stage later.
++        }
-              */
++        if (ret < 0) {
-             if (ret >= 0 && !migrate_colo_enabled()) {
++            ret = bdrv_co_truncate(bs->file, new_file_size, false, prealloc, 0,
-                 ret = bdrv_inactivate_all();
++                                   errp);
--            }
++        }
--            if (ret >= 0) {
+         if (ret < 0) {
--                qemu_file_set_rate_limit(s->to_dst_file, INT64_MAX);
+             error_prepend(errp, "Failed to resize underlying file: ");
--                qemu_savevm_state_complete_precopy(s->to_dst_file, false);
+             qcow2_free_clusters(bs, allocation_start,
--                s->block_inactive = true;
+diff --git a/tests/qemu-iotests/274.out b/tests/qemu-iotests/274.out
-+                if (ret >= 0) {
+index XXXXXXX..XXXXXXX 100644
-+                    s->block_inactive = true;
+--- a/tests/qemu-iotests/274.out
-+                }
++++ b/tests/qemu-iotests/274.out
-             }
+@@ -XXX,XX +XXX,XX @@ read 65536/65536 bytes at offset 9437184
-         }
+MiB (0xa00000) bytes     allocated at offset 5 MiB (0x500000)
-         qemu_mutex_unlock_iothread();
  [{ "start": 0, "length": 5242880, "depth": 1, "zero": true, "data": false},
 -{ "start": 5242880, "length": 10485760, "depth": 0, "zero": true, "data": false, "offset": 327680}]
 +{ "start": 5242880, "length": 10485760, "depth": 0, "zero": false, "data": true, "offset": 327680}]
  === preallocation=full ===
  Formatting 'TEST_DIR/PID-base', fmt=qcow2 size=16777216 cluster_size=65536 lazy_refcounts=off refcount_bits=16
@@ -XXX,XX +XXX,XX @@ read 65536/65536 bytes at offset 11534336
 MiB (0x400000) bytes     allocated at offset 8 MiB (0x800000)
  [{ "start": 0, "length": 8388608, "depth": 1, "zero": true, "data": false},
 -{ "start": 8388608, "length": 4194304, "depth": 0, "zero": true, "data": false, "offset": 327680}]
 +{ "start": 8388608, "length": 4194304, "depth": 0, "zero": false, "data": true, "offset": 327680}]
  === preallocation=off ===
  Formatting 'TEST_DIR/PID-base', fmt=qcow2 size=393216 cluster_size=65536 lazy_refcounts=off refcount_bits=16
 --
-.8.3.1
+.25.3

-New patch
+[PULL 13/15] nvme: introduce PMR support from NVMe 1.4 spec
+From: Andrzej Jakowski <andrzej.jakowski@linux.intel.com>
+This patch introduces support for PMR that has been defined as part of NVMe 1.4
+spec. User can now specify a pmrdev option that should point to HostMemoryBackend.
+pmrdev memory region will subsequently be exposed as PCI BAR 2 in emulated NVMe
+device. Guest OS can perform mmio read and writes to the PMR region that will stay
+persistent across system reboot.
+Signed-off-by: Andrzej Jakowski <andrzej.jakowski@linux.intel.com>
+Reviewed-by: Klaus Jensen <k.jensen@samsung.com>
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Message-Id: <20200330164656.9348-1-andrzej.jakowski@linux.intel.com>
+Reviewed-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ hw/block/nvme.h        |   2 +
+ include/block/nvme.h   | 172 +++++++++++++++++++++++++++++++++++++++++
+ hw/block/nvme.c        | 109 ++++++++++++++++++++++++++
+ hw/block/Makefile.objs |   2 +-
+ hw/block/trace-events  |   4 +
+files changed, 288 insertions(+), 1 deletion(-)
+diff --git a/hw/block/nvme.h b/hw/block/nvme.h
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/block/nvme.h
++++ b/hw/block/nvme.h
+@@ -XXX,XX +XXX,XX @@ typedef struct NvmeCtrl {
+     uint64_t    timestamp_set_qemu_clock_ms;    /* QEMU clock time */
+     char            *serial;
++    HostMemoryBackend *pmrdev;
++
+     NvmeNamespace   *namespaces;
+     NvmeSQueue      **sq;
+     NvmeCQueue      **cq;
+diff --git a/include/block/nvme.h b/include/block/nvme.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/block/nvme.h
++++ b/include/block/nvme.h
+@@ -XXX,XX +XXX,XX @@ typedef struct NvmeBar {
+     uint64_t    acq;
+     uint32_t    cmbloc;
+     uint32_t    cmbsz;
++    uint8_t     padding[3520]; /* not used by QEMU */
++    uint32_t    pmrcap;
++    uint32_t    pmrctl;
++    uint32_t    pmrsts;
++    uint32_t    pmrebs;
++    uint32_t    pmrswtp;
++    uint32_t    pmrmsc;
+ } NvmeBar;
+ enum NvmeCapShift {
+@@ -XXX,XX +XXX,XX @@ enum NvmeCapShift {
+     CAP_CSS_SHIFT      = 37,
+     CAP_MPSMIN_SHIFT   = 48,
+     CAP_MPSMAX_SHIFT   = 52,
++    CAP_PMR_SHIFT      = 56,
+ };
+ enum NvmeCapMask {
+@@ -XXX,XX +XXX,XX @@ enum NvmeCapMask {
+     CAP_CSS_MASK       = 0xff,
+     CAP_MPSMIN_MASK    = 0xf,
+     CAP_MPSMAX_MASK    = 0xf,
++    CAP_PMR_MASK       = 0x1,
+ };
+ #define NVME_CAP_MQES(cap)  (((cap) >> CAP_MQES_SHIFT)   & CAP_MQES_MASK)
+@@ -XXX,XX +XXX,XX @@ enum NvmeCapMask {
+                                                            << CAP_MPSMIN_SHIFT)
+ #define NVME_CAP_SET_MPSMAX(cap, val) (cap |= (uint64_t)(val & CAP_MPSMAX_MASK)\
+                                                             << CAP_MPSMAX_SHIFT)
++#define NVME_CAP_SET_PMRS(cap, val) (cap |= (uint64_t)(val & CAP_PMR_MASK)\
++                                                            << CAP_PMR_SHIFT)
+ enum NvmeCcShift {
+     CC_EN_SHIFT     = 0,
+@@ -XXX,XX +XXX,XX @@ enum NvmeCmbszMask {
+ #define NVME_CMBSZ_GETSIZE(cmbsz) \
+     (NVME_CMBSZ_SZ(cmbsz) * (1 << (12 + 4 * NVME_CMBSZ_SZU(cmbsz))))
++enum NvmePmrcapShift {
++    PMRCAP_RDS_SHIFT      = 3,
++    PMRCAP_WDS_SHIFT      = 4,
++    PMRCAP_BIR_SHIFT      = 5,
++    PMRCAP_PMRTU_SHIFT    = 8,
++    PMRCAP_PMRWBM_SHIFT   = 10,
++    PMRCAP_PMRTO_SHIFT    = 16,
++    PMRCAP_CMSS_SHIFT     = 24,
++};
++
++enum NvmePmrcapMask {
++    PMRCAP_RDS_MASK      = 0x1,
++    PMRCAP_WDS_MASK      = 0x1,
++    PMRCAP_BIR_MASK      = 0x7,
++    PMRCAP_PMRTU_MASK    = 0x3,
++    PMRCAP_PMRWBM_MASK   = 0xf,
++    PMRCAP_PMRTO_MASK    = 0xff,
++    PMRCAP_CMSS_MASK     = 0x1,
++};
++
++#define NVME_PMRCAP_RDS(pmrcap)    \
++    ((pmrcap >> PMRCAP_RDS_SHIFT)   & PMRCAP_RDS_MASK)
++#define NVME_PMRCAP_WDS(pmrcap)    \
++    ((pmrcap >> PMRCAP_WDS_SHIFT)   & PMRCAP_WDS_MASK)
++#define NVME_PMRCAP_BIR(pmrcap)    \
++    ((pmrcap >> PMRCAP_BIR_SHIFT)   & PMRCAP_BIR_MASK)
++#define NVME_PMRCAP_PMRTU(pmrcap)    \
++    ((pmrcap >> PMRCAP_PMRTU_SHIFT)   & PMRCAP_PMRTU_MASK)
++#define NVME_PMRCAP_PMRWBM(pmrcap)    \
++    ((pmrcap >> PMRCAP_PMRWBM_SHIFT)   & PMRCAP_PMRWBM_MASK)
++#define NVME_PMRCAP_PMRTO(pmrcap)    \
++    ((pmrcap >> PMRCAP_PMRTO_SHIFT)   & PMRCAP_PMRTO_MASK)
++#define NVME_PMRCAP_CMSS(pmrcap)    \
++    ((pmrcap >> PMRCAP_CMSS_SHIFT)   & PMRCAP_CMSS_MASK)
++
++#define NVME_PMRCAP_SET_RDS(pmrcap, val)   \
++    (pmrcap |= (uint64_t)(val & PMRCAP_RDS_MASK) << PMRCAP_RDS_SHIFT)
++#define NVME_PMRCAP_SET_WDS(pmrcap, val)   \
++    (pmrcap |= (uint64_t)(val & PMRCAP_WDS_MASK) << PMRCAP_WDS_SHIFT)
++#define NVME_PMRCAP_SET_BIR(pmrcap, val)   \
++    (pmrcap |= (uint64_t)(val & PMRCAP_BIR_MASK) << PMRCAP_BIR_SHIFT)
++#define NVME_PMRCAP_SET_PMRTU(pmrcap, val)   \
++    (pmrcap |= (uint64_t)(val & PMRCAP_PMRTU_MASK) << PMRCAP_PMRTU_SHIFT)
++#define NVME_PMRCAP_SET_PMRWBM(pmrcap, val)   \
++    (pmrcap |= (uint64_t)(val & PMRCAP_PMRWBM_MASK) << PMRCAP_PMRWBM_SHIFT)
++#define NVME_PMRCAP_SET_PMRTO(pmrcap, val)   \
++    (pmrcap |= (uint64_t)(val & PMRCAP_PMRTO_MASK) << PMRCAP_PMRTO_SHIFT)
++#define NVME_PMRCAP_SET_CMSS(pmrcap, val)   \
++    (pmrcap |= (uint64_t)(val & PMRCAP_CMSS_MASK) << PMRCAP_CMSS_SHIFT)
++
++enum NvmePmrctlShift {
++    PMRCTL_EN_SHIFT   = 0,
++};
++
++enum NvmePmrctlMask {
++    PMRCTL_EN_MASK   = 0x1,
++};
++
++#define NVME_PMRCTL_EN(pmrctl)  ((pmrctl >> PMRCTL_EN_SHIFT)   & PMRCTL_EN_MASK)
++
++#define NVME_PMRCTL_SET_EN(pmrctl, val)   \
++    (pmrctl |= (uint64_t)(val & PMRCTL_EN_MASK) << PMRCTL_EN_SHIFT)
++
++enum NvmePmrstsShift {
++    PMRSTS_ERR_SHIFT    = 0,
++    PMRSTS_NRDY_SHIFT   = 8,
++    PMRSTS_HSTS_SHIFT   = 9,
++    PMRSTS_CBAI_SHIFT   = 12,
++};
++
++enum NvmePmrstsMask {
++    PMRSTS_ERR_MASK    = 0xff,
++    PMRSTS_NRDY_MASK   = 0x1,
++    PMRSTS_HSTS_MASK   = 0x7,
++    PMRSTS_CBAI_MASK   = 0x1,
++};
++
++#define NVME_PMRSTS_ERR(pmrsts)     \
++    ((pmrsts >> PMRSTS_ERR_SHIFT)   & PMRSTS_ERR_MASK)
++#define NVME_PMRSTS_NRDY(pmrsts)    \
++    ((pmrsts >> PMRSTS_NRDY_SHIFT)   & PMRSTS_NRDY_MASK)
++#define NVME_PMRSTS_HSTS(pmrsts)    \
++    ((pmrsts >> PMRSTS_HSTS_SHIFT)   & PMRSTS_HSTS_MASK)
++#define NVME_PMRSTS_CBAI(pmrsts)    \
++    ((pmrsts >> PMRSTS_CBAI_SHIFT)   & PMRSTS_CBAI_MASK)
++
++#define NVME_PMRSTS_SET_ERR(pmrsts, val)   \
++    (pmrsts |= (uint64_t)(val & PMRSTS_ERR_MASK) << PMRSTS_ERR_SHIFT)
++#define NVME_PMRSTS_SET_NRDY(pmrsts, val)   \
++    (pmrsts |= (uint64_t)(val & PMRSTS_NRDY_MASK) << PMRSTS_NRDY_SHIFT)
++#define NVME_PMRSTS_SET_HSTS(pmrsts, val)   \
++    (pmrsts |= (uint64_t)(val & PMRSTS_HSTS_MASK) << PMRSTS_HSTS_SHIFT)
++#define NVME_PMRSTS_SET_CBAI(pmrsts, val)   \
++    (pmrsts |= (uint64_t)(val & PMRSTS_CBAI_MASK) << PMRSTS_CBAI_SHIFT)
++
++enum NvmePmrebsShift {
++    PMREBS_PMRSZU_SHIFT   = 0,
++    PMREBS_RBB_SHIFT      = 4,
++    PMREBS_PMRWBZ_SHIFT   = 8,
++};
++
++enum NvmePmrebsMask {
++    PMREBS_PMRSZU_MASK   = 0xf,
++    PMREBS_RBB_MASK      = 0x1,
++    PMREBS_PMRWBZ_MASK   = 0xffffff,
++};
++
++#define NVME_PMREBS_PMRSZU(pmrebs)  \
++    ((pmrebs >> PMREBS_PMRSZU_SHIFT)   & PMREBS_PMRSZU_MASK)
++#define NVME_PMREBS_RBB(pmrebs)     \
++    ((pmrebs >> PMREBS_RBB_SHIFT)   & PMREBS_RBB_MASK)
++#define NVME_PMREBS_PMRWBZ(pmrebs)  \
++    ((pmrebs >> PMREBS_PMRWBZ_SHIFT)   & PMREBS_PMRWBZ_MASK)
++
++#define NVME_PMREBS_SET_PMRSZU(pmrebs, val)   \
++    (pmrebs |= (uint64_t)(val & PMREBS_PMRSZU_MASK) << PMREBS_PMRSZU_SHIFT)
++#define NVME_PMREBS_SET_RBB(pmrebs, val)   \
++    (pmrebs |= (uint64_t)(val & PMREBS_RBB_MASK) << PMREBS_RBB_SHIFT)
++#define NVME_PMREBS_SET_PMRWBZ(pmrebs, val)   \
++    (pmrebs |= (uint64_t)(val & PMREBS_PMRWBZ_MASK) << PMREBS_PMRWBZ_SHIFT)
++
++enum NvmePmrswtpShift {
++    PMRSWTP_PMRSWTU_SHIFT   = 0,
++    PMRSWTP_PMRSWTV_SHIFT   = 8,
++};
++
++enum NvmePmrswtpMask {
++    PMRSWTP_PMRSWTU_MASK   = 0xf,
++    PMRSWTP_PMRSWTV_MASK   = 0xffffff,
++};
++
++#define NVME_PMRSWTP_PMRSWTU(pmrswtp)   \
++    ((pmrswtp >> PMRSWTP_PMRSWTU_SHIFT)   & PMRSWTP_PMRSWTU_MASK)
++#define NVME_PMRSWTP_PMRSWTV(pmrswtp)   \
++    ((pmrswtp >> PMRSWTP_PMRSWTV_SHIFT)   & PMRSWTP_PMRSWTV_MASK)
++
++#define NVME_PMRSWTP_SET_PMRSWTU(pmrswtp, val)   \
++    (pmrswtp |= (uint64_t)(val & PMRSWTP_PMRSWTU_MASK) << PMRSWTP_PMRSWTU_SHIFT)
++#define NVME_PMRSWTP_SET_PMRSWTV(pmrswtp, val)   \
++    (pmrswtp |= (uint64_t)(val & PMRSWTP_PMRSWTV_MASK) << PMRSWTP_PMRSWTV_SHIFT)
++
++enum NvmePmrmscShift {
++    PMRMSC_CMSE_SHIFT   = 1,
++    PMRMSC_CBA_SHIFT    = 12,
++};
++
++enum NvmePmrmscMask {
++    PMRMSC_CMSE_MASK   = 0x1,
++    PMRMSC_CBA_MASK    = 0xfffffffffffff,
++};
++
++#define NVME_PMRMSC_CMSE(pmrmsc)    \
++    ((pmrmsc >> PMRMSC_CMSE_SHIFT)   & PMRMSC_CMSE_MASK)
++#define NVME_PMRMSC_CBA(pmrmsc)     \
++    ((pmrmsc >> PMRMSC_CBA_SHIFT)   & PMRMSC_CBA_MASK)
++
++#define NVME_PMRMSC_SET_CMSE(pmrmsc, val)   \
++    (pmrmsc |= (uint64_t)(val & PMRMSC_CMSE_MASK) << PMRMSC_CMSE_SHIFT)
++#define NVME_PMRMSC_SET_CBA(pmrmsc, val)   \
++    (pmrmsc |= (uint64_t)(val & PMRMSC_CBA_MASK) << PMRMSC_CBA_SHIFT)
++
+ typedef struct NvmeCmd {
+     uint8_t     opcode;
+     uint8_t     fuse;
+diff --git a/hw/block/nvme.c b/hw/block/nvme.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/block/nvme.c
++++ b/hw/block/nvme.c
+@@ -XXX,XX +XXX,XX @@
+  *      -drive file=<file>,if=none,id=<drive_id>
+  *      -device nvme,drive=<drive_id>,serial=<serial>,id=<id[optional]>, \
+  *              cmb_size_mb=<cmb_size_mb[optional]>, \
++ *              [pmrdev=<mem_backend_file_id>,] \
+  *              num_queues=<N[optional]>
+  *
+  * Note cmb_size_mb denotes size of CMB in MB. CMB is assumed to be at
+  * offset 0 in BAR2 and supports only WDS, RDS and SQS for now.
++ *
++ * cmb_size_mb= and pmrdev= options are mutually exclusive due to limitation
++ * in available BAR's. cmb_size_mb= will take precedence over pmrdev= when
++ * both provided.
++ * Enabling pmr emulation can be achieved by pointing to memory-backend-file.
++ * For example:
++ * -object memory-backend-file,id=<mem_id>,share=on,mem-path=<file_path>, \
++ *  size=<size> .... -device nvme,...,pmrdev=<mem_id>
+  */
+ #include "qemu/osdep.h"
+@@ -XXX,XX +XXX,XX @@
+ #include "sysemu/sysemu.h"
+ #include "qapi/error.h"
+ #include "qapi/visitor.h"
++#include "sysemu/hostmem.h"
+ #include "sysemu/block-backend.h"
++#include "exec/ram_addr.h"
+ #include "qemu/log.h"
+ #include "qemu/module.h"
+@@ -XXX,XX +XXX,XX @@ static void nvme_write_bar(NvmeCtrl *n, hwaddr offset, uint64_t data,
+         NVME_GUEST_ERR(nvme_ub_mmiowr_cmbsz_readonly,
+                        "invalid write to read only CMBSZ, ignored");
+         return;
++    case 0xE00: /* PMRCAP */
++        NVME_GUEST_ERR(nvme_ub_mmiowr_pmrcap_readonly,
++                       "invalid write to PMRCAP register, ignored");
++        return;
++    case 0xE04: /* TODO PMRCTL */
++        break;
++    case 0xE08: /* PMRSTS */
++        NVME_GUEST_ERR(nvme_ub_mmiowr_pmrsts_readonly,
++                       "invalid write to PMRSTS register, ignored");
++        return;
++    case 0xE0C: /* PMREBS */
++        NVME_GUEST_ERR(nvme_ub_mmiowr_pmrebs_readonly,
++                       "invalid write to PMREBS register, ignored");
++        return;
++    case 0xE10: /* PMRSWTP */
++        NVME_GUEST_ERR(nvme_ub_mmiowr_pmrswtp_readonly,
++                       "invalid write to PMRSWTP register, ignored");
++        return;
++    case 0xE14: /* TODO PMRMSC */
++         break;
+     default:
+         NVME_GUEST_ERR(nvme_ub_mmiowr_invalid,
+                        "invalid MMIO write,"
+@@ -XXX,XX +XXX,XX @@ static uint64_t nvme_mmio_read(void *opaque, hwaddr addr, unsigned size)
+     }
+     if (addr < sizeof(n->bar)) {
++        /*
++         * When PMRWBM bit 1 is set then read from
++         * from PMRSTS should ensure prior writes
++         * made it to persistent media
++         */
++        if (addr == 0xE08 &&
++            (NVME_PMRCAP_PMRWBM(n->bar.pmrcap) & 0x02)) {
++            qemu_ram_writeback(n->pmrdev->mr.ram_block,
++                               0, n->pmrdev->size);
++        }
+         memcpy(&val, ptr + addr, size);
+     } else {
+         NVME_GUEST_ERR(nvme_ub_mmiord_invalid_ofs,
+@@ -XXX,XX +XXX,XX @@ static void nvme_realize(PCIDevice *pci_dev, Error **errp)
+         error_setg(errp, "serial property not set");
+         return;
+     }
++
++    if (!n->cmb_size_mb && n->pmrdev) {
++        if (host_memory_backend_is_mapped(n->pmrdev)) {
++            char *path = object_get_canonical_path_component(OBJECT(n->pmrdev));
++            error_setg(errp, "can't use already busy memdev: %s", path);
++            g_free(path);
++            return;
++        }
++
++        if (!is_power_of_2(n->pmrdev->size)) {
++            error_setg(errp, "pmr backend size needs to be power of 2 in size");
++            return;
++        }
++
++        host_memory_backend_set_mapped(n->pmrdev, true);
++    }
++
+     blkconf_blocksizes(&n->conf);
+     if (!blkconf_apply_backend_options(&n->conf, blk_is_read_only(n->conf.blk),
+                                        false, errp)) {
+@@ -XXX,XX +XXX,XX @@ static void nvme_realize(PCIDevice *pci_dev, Error **errp)
+             PCI_BASE_ADDRESS_SPACE_MEMORY | PCI_BASE_ADDRESS_MEM_TYPE_64 |
+             PCI_BASE_ADDRESS_MEM_PREFETCH, &n->ctrl_mem);
++    } else if (n->pmrdev) {
++        /* Controller Capabilities register */
++        NVME_CAP_SET_PMRS(n->bar.cap, 1);
++
++        /* PMR Capabities register */
++        n->bar.pmrcap = 0;
++        NVME_PMRCAP_SET_RDS(n->bar.pmrcap, 0);
++        NVME_PMRCAP_SET_WDS(n->bar.pmrcap, 0);
++        NVME_PMRCAP_SET_BIR(n->bar.pmrcap, 2);
++        NVME_PMRCAP_SET_PMRTU(n->bar.pmrcap, 0);
++        /* Turn on bit 1 support */
++        NVME_PMRCAP_SET_PMRWBM(n->bar.pmrcap, 0x02);
++        NVME_PMRCAP_SET_PMRTO(n->bar.pmrcap, 0);
++        NVME_PMRCAP_SET_CMSS(n->bar.pmrcap, 0);
++
++        /* PMR Control register */
++        n->bar.pmrctl = 0;
++        NVME_PMRCTL_SET_EN(n->bar.pmrctl, 0);
++
++        /* PMR Status register */
++        n->bar.pmrsts = 0;
++        NVME_PMRSTS_SET_ERR(n->bar.pmrsts, 0);
++        NVME_PMRSTS_SET_NRDY(n->bar.pmrsts, 0);
++        NVME_PMRSTS_SET_HSTS(n->bar.pmrsts, 0);
++        NVME_PMRSTS_SET_CBAI(n->bar.pmrsts, 0);
++
++        /* PMR Elasticity Buffer Size register */
++        n->bar.pmrebs = 0;
++        NVME_PMREBS_SET_PMRSZU(n->bar.pmrebs, 0);
++        NVME_PMREBS_SET_RBB(n->bar.pmrebs, 0);
++        NVME_PMREBS_SET_PMRWBZ(n->bar.pmrebs, 0);
++
++        /* PMR Sustained Write Throughput register */
++        n->bar.pmrswtp = 0;
++        NVME_PMRSWTP_SET_PMRSWTU(n->bar.pmrswtp, 0);
++        NVME_PMRSWTP_SET_PMRSWTV(n->bar.pmrswtp, 0);
++
++        /* PMR Memory Space Control register */
++        n->bar.pmrmsc = 0;
++        NVME_PMRMSC_SET_CMSE(n->bar.pmrmsc, 0);
++        NVME_PMRMSC_SET_CBA(n->bar.pmrmsc, 0);
++
++        pci_register_bar(pci_dev, NVME_PMRCAP_BIR(n->bar.pmrcap),
++            PCI_BASE_ADDRESS_SPACE_MEMORY | PCI_BASE_ADDRESS_MEM_TYPE_64 |
++            PCI_BASE_ADDRESS_MEM_PREFETCH, &n->pmrdev->mr);
+     }
+     for (i = 0; i < n->num_namespaces; i++) {
+@@ -XXX,XX +XXX,XX @@ static void nvme_exit(PCIDevice *pci_dev)
+     if (n->cmb_size_mb) {
+         g_free(n->cmbuf);
+     }
++
++    if (n->pmrdev) {
++        host_memory_backend_set_mapped(n->pmrdev, false);
++    }
+     msix_uninit_exclusive_bar(pci_dev);
+ }
+ static Property nvme_props[] = {
+     DEFINE_BLOCK_PROPERTIES(NvmeCtrl, conf),
++    DEFINE_PROP_LINK("pmrdev", NvmeCtrl, pmrdev, TYPE_MEMORY_BACKEND,
++                     HostMemoryBackend *),
+     DEFINE_PROP_STRING("serial", NvmeCtrl, serial),
+     DEFINE_PROP_UINT32("cmb_size_mb", NvmeCtrl, cmb_size_mb, 0),
+     DEFINE_PROP_UINT32("num_queues", NvmeCtrl, num_queues, 64),
+diff --git a/hw/block/Makefile.objs b/hw/block/Makefile.objs
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/block/Makefile.objs
++++ b/hw/block/Makefile.objs
+@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_PFLASH_CFI02) += pflash_cfi02.o
+ common-obj-$(CONFIG_XEN) += xen-block.o
+ common-obj-$(CONFIG_ECC) += ecc.o
+ common-obj-$(CONFIG_ONENAND) += onenand.o
+-common-obj-$(CONFIG_NVME_PCI) += nvme.o
+ common-obj-$(CONFIG_SWIM) += swim.o
+ common-obj-$(CONFIG_SH4) += tc58128.o
+ obj-$(CONFIG_VIRTIO_BLK) += virtio-blk.o
+ obj-$(CONFIG_VHOST_USER_BLK) += vhost-user-blk.o
++obj-$(CONFIG_NVME_PCI) += nvme.o
+ obj-y += dataplane/
+diff --git a/hw/block/trace-events b/hw/block/trace-events
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/block/trace-events
++++ b/hw/block/trace-events
+@@ -XXX,XX +XXX,XX @@ nvme_ub_mmiowr_ssreset_w1c_unsupported(void) "attempted to W1C CSTS.NSSRO but CA
+ nvme_ub_mmiowr_ssreset_unsupported(void) "attempted NVM subsystem reset but CAP.NSSRS is zero (not supported)"
+ nvme_ub_mmiowr_cmbloc_reserved(void) "invalid write to reserved CMBLOC when CMBSZ is zero, ignored"
+ nvme_ub_mmiowr_cmbsz_readonly(void) "invalid write to read only CMBSZ, ignored"
++nvme_ub_mmiowr_pmrcap_readonly(void) "invalid write to read only PMRCAP, ignored"
++nvme_ub_mmiowr_pmrsts_readonly(void) "invalid write to read only PMRSTS, ignored"
++nvme_ub_mmiowr_pmrebs_readonly(void) "invalid write to read only PMREBS, ignored"
++nvme_ub_mmiowr_pmrswtp_readonly(void) "invalid write to read only PMRSWTP, ignored"
+ nvme_ub_mmiowr_invalid(uint64_t offset, uint64_t data) "invalid MMIO write, offset=0x%"PRIx64", data=0x%"PRIx64""
+ nvme_ub_mmiord_misaligned32(uint64_t offset) "MMIO read not 32-bit aligned, offset=0x%"PRIx64""
+ nvme_ub_mmiord_toosmall(uint64_t offset) "MMIO read smaller than 32-bits, offset=0x%"PRIx64""
+--
+.25.3

-[Qemu-devel] [PULL 3/8] migration/block: Clean up BBs in block_save_complete()
+[PULL 14/15] qom: Factor out user_creatable_add_dict()
-We need to release any block migrations BlockBackends on the source
+The QMP handler qmp_object_add() and the implementation of --object in
-before successfully completing the migration because otherwise
+qemu-storage-daemon can share most of the code. Currently,
-inactivating the images will fail (inactivation only tolerates device
+qemu-storage-daemon calls qmp_object_add(), but this is not correct
-BBs).
+because different visitors need to be used.
 As a first step towards a fix, make qmp_object_add() a wrapper around a
 new function user_creatable_add_dict() that can get an additional
 parameter. The handling of "props" is only required for compatibility
 and not required for the qemu-storage-daemon command line, so it stays
 in qmp_object_add().
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Reviewed-by: Fam Zheng <famz@redhat.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Jeff Cody <jcody@redhat.com>
 ---
- migration/block.c | 22 +++++++++++++++++-----
+ include/qom/object_interfaces.h | 12 ++++++++++++
-file changed, 17 insertions(+), 5 deletions(-)
+ qom/object_interfaces.c         | 27 +++++++++++++++++++++++++++
  qom/qom-qmp-cmds.c              | 24 +-----------------------
 files changed, 40 insertions(+), 23 deletions(-)
-diff --git a/migration/block.c b/migration/block.c
+diff --git a/include/qom/object_interfaces.h b/include/qom/object_interfaces.h
 index XXXXXXX..XXXXXXX 100644
---- a/migration/block.c
+--- a/include/qom/object_interfaces.h
-+++ b/migration/block.c
++++ b/include/qom/object_interfaces.h
-@@ -XXX,XX +XXX,XX @@ static int64_t get_remaining_dirty(void)
+@@ -XXX,XX +XXX,XX @@ Object *user_creatable_add_type(const char *type, const char *id,
-     return dirty << BDRV_SECTOR_BITS;
+                                 const QDict *qdict,
                                  Visitor *v, Error **errp);
 +/**
 + * user_creatable_add_dict:
 + * @qdict: the object definition
 + * @errp: if an error occurs, a pointer to an area to store the error
 + *
 + * Create an instance of the user creatable object that is defined by
 + * @qdict.  The object type is taken from the QDict key 'qom-type', its
 + * ID from the key 'id'. The remaining entries in @qdict are used to
 + * initialize the object properties.
 + */
 +void user_creatable_add_dict(QDict *qdict, Error **errp);
 +
  /**
   * user_creatable_add_opts:
   * @opts: the object definition
 diff --git a/qom/object_interfaces.c b/qom/object_interfaces.c
 index XXXXXXX..XXXXXXX 100644
 --- a/qom/object_interfaces.c
 +++ b/qom/object_interfaces.c
@@ -XXX,XX +XXX,XX @@
  #include "qapi/qmp/qerror.h"
  #include "qapi/qmp/qjson.h"
  #include "qapi/qmp/qstring.h"
 +#include "qapi/qobject-input-visitor.h"
  #include "qom/object_interfaces.h"
  #include "qemu/help_option.h"
  #include "qemu/module.h"
@@ -XXX,XX +XXX,XX @@ out:
      return obj;
  }
--/* Called with iothread lock taken.  */
++void user_creatable_add_dict(QDict *qdict, Error **errp)
++{
--static void block_migration_cleanup(void *opaque)
++    Visitor *v;
 +    Object *obj;
 +    g_autofree char *type = NULL;
 +    g_autofree char *id = NULL;
 +
-+/* Called with iothread lock taken.  */
++    type = g_strdup(qdict_get_try_str(qdict, "qom-type"));
-+static void block_migration_cleanup_bmds(void)
++    if (!type) {
 +        error_setg(errp, QERR_MISSING_PARAMETER, "qom-type");
 +        return;
 +    }
 +    qdict_del(qdict, "qom-type");
 +
 +    id = g_strdup(qdict_get_try_str(qdict, "id"));
 +    if (!id) {
 +        error_setg(errp, QERR_MISSING_PARAMETER, "id");
 +        return;
 +    }
 +    qdict_del(qdict, "id");
 +
 +    v = qobject_input_visitor_new(QOBJECT(qdict));
 +    obj = user_creatable_add_type(type, id, qdict, v, errp);
 +    visit_free(v);
 +    object_unref(obj);
 +}
  Object *user_creatable_add_opts(QemuOpts *opts, Error **errp)
  {
-     BlkMigDevState *bmds;
+diff --git a/qom/qom-qmp-cmds.c b/qom/qom-qmp-cmds.c
--    BlkMigBlock *blk;
+index XXXXXXX..XXXXXXX 100644
-     AioContext *ctx;
+--- a/qom/qom-qmp-cmds.c
++++ b/qom/qom-qmp-cmds.c
--    bdrv_drain_all();
+@@ -XXX,XX +XXX,XX @@
  #include "qapi/qapi-commands-qom.h"
  #include "qapi/qmp/qdict.h"
  #include "qapi/qmp/qerror.h"
 -#include "qapi/qobject-input-visitor.h"
  #include "qemu/cutils.h"
  #include "qom/object_interfaces.h"
  #include "qom/qom-qobject.h"
@@ -XXX,XX +XXX,XX @@ void qmp_object_add(QDict *qdict, QObject **ret_data, Error **errp)
  {
      QObject *props;
      QDict *pdict;
 -    Visitor *v;
 -    Object *obj;
 -    g_autofree char *type = NULL;
 -    g_autofree char *id = NULL;
 -
-     unset_dirty_tracking();
+-    type = g_strdup(qdict_get_try_str(qdict, "qom-type"));
+-    if (!type) {
-     while ((bmds = QSIMPLEQ_FIRST(&block_mig_state.bmds_list)) != NULL) {
+-        error_setg(errp, QERR_MISSING_PARAMETER, "qom-type");
-@@ -XXX,XX +XXX,XX @@ static void block_migration_cleanup(void *opaque)
+-        return;
-         g_free(bmds->aio_bitmap);
+-    }
-         g_free(bmds);
+-    qdict_del(qdict, "qom-type");
 -
 -    id = g_strdup(qdict_get_try_str(qdict, "id"));
 -    if (!id) {
 -        error_setg(errp, QERR_MISSING_PARAMETER, "id");
 -        return;
 -    }
 -    qdict_del(qdict, "id");
      props = qdict_get(qdict, "props");
      if (props) {
@@ -XXX,XX +XXX,XX @@ void qmp_object_add(QDict *qdict, QObject **ret_data, Error **errp)
          qobject_unref(pdict);
      }
-+}
-+
+-    v = qobject_input_visitor_new(QOBJECT(qdict));
-+/* Called with iothread lock taken.  */
+-    obj = user_creatable_add_type(type, id, qdict, v, errp);
-+static void block_migration_cleanup(void *opaque)
+-    visit_free(v);
-+{
+-    object_unref(obj);
-+    BlkMigBlock *blk;
++    user_creatable_add_dict(qdict, errp);
 +
 +    bdrv_drain_all();
 +
 +    block_migration_cleanup_bmds();
      blk_mig_lock();
      while ((blk = QSIMPLEQ_FIRST(&block_mig_state.blk_list)) != NULL) {
@@ -XXX,XX +XXX,XX @@ static int block_save_complete(QEMUFile *f, void *opaque)
      qemu_put_be64(f, BLK_MIG_FLAG_EOS);
 +    /* Make sure that our BlockBackends are gone, so that the block driver
 +     * nodes can be inactivated. */
 +    block_migration_cleanup_bmds();
 +
      return 0;
  }
+ void qmp_object_del(const char *id, Error **errp)
 --
-.8.3.1
+.25.3

-[Qemu-devel] [PULL 6/8] qemu-iotests: Test automatic commit job cancel on hot unplug
+[PULL 15/15] qemu-storage-daemon: Fix non-string --object properties
+After processing the option string with the keyval parser, we get a
+QDict that contains only strings. This QDict must be fed to a keyval
+visitor which converts the strings into the right data types.
+qmp_object_add(), however, uses the normal QObject input visitor, which
+expects a QDict where all properties already have the QType that matches
+the data type required by the QOM object type.
+Change the --object implementation in qemu-storage-daemon so that it
+doesn't call qmp_object_add(), but calls user_creatable_add_dict()
+directly instead and pass it a new keyval boolean that decides which
+visitor must be used.
+Reported-by: Coiby Xu <coiby.xu@gmail.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Reviewed-by: John Snow <jsnow@redhat.com>
 ---
- tests/qemu-iotests/040     | 35 +++++++++++++++++++++++++++++++++--
+ include/qom/object_interfaces.h | 6 +++++-
- tests/qemu-iotests/040.out |  4 ++--
+ qemu-storage-daemon.c           | 4 +---
-files changed, 35 insertions(+), 4 deletions(-)
+ qom/object_interfaces.c         | 8 ++++++--
  qom/qom-qmp-cmds.c              | 2 +-
 files changed, 13 insertions(+), 7 deletions(-)
-diff --git a/tests/qemu-iotests/040 b/tests/qemu-iotests/040
+diff --git a/include/qom/object_interfaces.h b/include/qom/object_interfaces.h
 index XXXXXXX..XXXXXXX 100755
 --- a/tests/qemu-iotests/040
 +++ b/tests/qemu-iotests/040
@@ -XXX,XX +XXX,XX @@ class ImageCommitTestCase(iotests.QMPTestCase):
          self.wait_for_complete()
  class TestSingleDrive(ImageCommitTestCase):
 -    image_len = 1 * 1024 * 1024
 +    # Need some space after the copied data so that throttling is effective in
 +    # tests that use it rather than just completing the job immediately
 +    image_len = 2 * 1024 * 1024
      test_len = 1 * 1024 * 256
      def setUp(self):
@@ -XXX,XX +XXX,XX @@ class TestSingleDrive(ImageCommitTestCase):
          qemu_img('create', '-f', iotests.imgfmt, '-o', 'backing_file=%s' % mid_img, test_img)
          qemu_io('-f', 'raw', '-c', 'write -P 0xab 0 524288', backing_img)
          qemu_io('-f', iotests.imgfmt, '-c', 'write -P 0xef 524288 524288', mid_img)
 -        self.vm = iotests.VM().add_drive(test_img)
 +        self.vm = iotests.VM().add_drive(test_img, interface="none")
 +        self.vm.add_device("virtio-scsi-pci")
 +        self.vm.add_device("scsi-hd,id=scsi0,drive=drive0")
          self.vm.launch()
      def tearDown(self):
@@ -XXX,XX +XXX,XX @@ class TestSingleDrive(ImageCommitTestCase):
          self.assert_qmp(result, 'error/class', 'GenericError')
          self.assert_qmp(result, 'error/desc', 'Base \'%s\' not found' % mid_img)
 +    # When the job is running on a BB that is automatically deleted on hot
 +    # unplug, the job is cancelled when the device disappears
 +    def test_hot_unplug(self):
 +        if self.image_len == 0:
 +            return
 +
 +        self.assert_no_active_block_jobs()
 +        result = self.vm.qmp('block-commit', device='drive0', top=mid_img,
 +                             base=backing_img, speed=(self.image_len / 4))
 +        self.assert_qmp(result, 'return', {})
 +        result = self.vm.qmp('device_del', id='scsi0')
 +        self.assert_qmp(result, 'return', {})
 +
 +        cancelled = False
 +        deleted = False
 +        while not cancelled or not deleted:
 +            for event in self.vm.get_qmp_events(wait=True):
 +                if event['event'] == 'DEVICE_DELETED':
 +                    self.assert_qmp(event, 'data/device', 'scsi0')
 +                    deleted = True
 +                elif event['event'] == 'BLOCK_JOB_CANCELLED':
 +                    self.assert_qmp(event, 'data/device', 'drive0')
 +                    cancelled = True
 +                else:
 +                    self.fail("Unexpected event %s" % (event['event']))
 +
 +        self.assert_no_active_block_jobs()
  class TestRelativePaths(ImageCommitTestCase):
      image_len = 1 * 1024 * 1024
 diff --git a/tests/qemu-iotests/040.out b/tests/qemu-iotests/040.out
 index XXXXXXX..XXXXXXX 100644
---- a/tests/qemu-iotests/040.out
+--- a/include/qom/object_interfaces.h
-+++ b/tests/qemu-iotests/040.out
++++ b/include/qom/object_interfaces.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ Object *user_creatable_add_type(const char *type, const char *id,
--.........................
+ /**
-+...........................
+  * user_creatable_add_dict:
- ----------------------------------------------------------------------
+  * @qdict: the object definition
--Ran 25 tests
++ * @keyval: if true, use a keyval visitor for processing @qdict (i.e.
-+Ran 27 tests
++ *          assume that all @qdict values are strings); otherwise, use
++ *          the normal QObject visitor (i.e. assume all @qdict values
- OK
++ *          have the QType expected by the QOM object type)
   * @errp: if an error occurs, a pointer to an area to store the error
   *
   * Create an instance of the user creatable object that is defined by
@@ -XXX,XX +XXX,XX @@ Object *user_creatable_add_type(const char *type, const char *id,
   * ID from the key 'id'. The remaining entries in @qdict are used to
   * initialize the object properties.
   */
 -void user_creatable_add_dict(QDict *qdict, Error **errp);
 +void user_creatable_add_dict(QDict *qdict, bool keyval, Error **errp);
  /**
   * user_creatable_add_opts:
 diff --git a/qemu-storage-daemon.c b/qemu-storage-daemon.c
 index XXXXXXX..XXXXXXX 100644
 --- a/qemu-storage-daemon.c
 +++ b/qemu-storage-daemon.c
@@ -XXX,XX +XXX,XX @@ static void process_options(int argc, char *argv[])
                  QemuOpts *opts;
                  const char *type;
                  QDict *args;
 -                QObject *ret_data = NULL;
                  /* FIXME The keyval parser rejects 'help' arguments, so we must
                   * unconditionall try QemuOpts first. */
@@ -XXX,XX +XXX,XX @@ static void process_options(int argc, char *argv[])
                  qemu_opts_del(opts);
                  args = keyval_parse(optarg, "qom-type", &error_fatal);
 -                qmp_object_add(args, &ret_data, &error_fatal);
 +                user_creatable_add_dict(args, true, &error_fatal);
                  qobject_unref(args);
 -                qobject_unref(ret_data);
                  break;
              }
          default:
 diff --git a/qom/object_interfaces.c b/qom/object_interfaces.c
 index XXXXXXX..XXXXXXX 100644
 --- a/qom/object_interfaces.c
 +++ b/qom/object_interfaces.c
@@ -XXX,XX +XXX,XX @@ out:
      return obj;
  }
 -void user_creatable_add_dict(QDict *qdict, Error **errp)
 +void user_creatable_add_dict(QDict *qdict, bool keyval, Error **errp)
  {
      Visitor *v;
      Object *obj;
@@ -XXX,XX +XXX,XX @@ void user_creatable_add_dict(QDict *qdict, Error **errp)
      }
      qdict_del(qdict, "id");
 -    v = qobject_input_visitor_new(QOBJECT(qdict));
 +    if (keyval) {
 +        v = qobject_input_visitor_new_keyval(QOBJECT(qdict));
 +    } else {
 +        v = qobject_input_visitor_new(QOBJECT(qdict));
 +    }
      obj = user_creatable_add_type(type, id, qdict, v, errp);
      visit_free(v);
      object_unref(obj);
 diff --git a/qom/qom-qmp-cmds.c b/qom/qom-qmp-cmds.c
 index XXXXXXX..XXXXXXX 100644
 --- a/qom/qom-qmp-cmds.c
 +++ b/qom/qom-qmp-cmds.c
@@ -XXX,XX +XXX,XX @@ void qmp_object_add(QDict *qdict, QObject **ret_data, Error **errp)
          qobject_unref(pdict);
      }
 -    user_creatable_add_dict(qdict, errp);
 +    user_creatable_add_dict(qdict, false, errp);
  }
  void qmp_object_del(const char *id, Error **errp)
 --
-.8.3.1
+.25.3

The following changes since commit b55a69fe5f0a504dac6359bb7e99a72b130c3661:

Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20170607' into staging (2017-06-07 15:06:42 +0100)

are available in the git repository at:

git://repo.or.cz/qemu/kevin.git tags/for-upstream

for you to fetch changes up to 2cb8f869e43406ce829ebe3b16fecc78d367dc7f:

block: fix external snapshot abort permission error (2017-06-07 18:51:51 +0200)

----------------------------------------------------------------
Block layer patches

----------------------------------------------------------------
Jeff Cody (1):
      block: fix external snapshot abort permission error

Kevin Wolf (6):
      block: Fix anonymous BBs in blk_root_inactivate()
      migration: Inactivate images after .save_live_complete_precopy()
      migration/block: Clean up BBs in block_save_complete()
      qemu-iotests: Block migration test
      commit: Fix use after free in completion
      qemu-iotests: Test automatic commit job cancel on hot unplug

Peter Maydell (1):
      block/qcow.c: Fix memory leak in qcow_create()

block/block-backend.c      |   2 +-
 block/commit.c             |   7 +++
 block/qcow.c               |   1 +
 blockdev.c                 |   4 ++
 migration/block.c          |  22 +++++--
 migration/migration.c      |  12 ++--
 tests/qemu-iotests/040     |  35 +++++++++++-
 tests/qemu-iotests/040.out |   4 +-
 tests/qemu-iotests/183     | 140 +++++++++++++++++++++++++++++++++++++++++++++
 tests/qemu-iotests/183.out |  46 +++++++++++++++
 tests/qemu-iotests/group   |   1 +
 11 files changed, 259 insertions(+), 15 deletions(-)
 create mode 100755 tests/qemu-iotests/183
 create mode 100644 tests/qemu-iotests/183.out

Block migration may still access the image during its
.save_live_complete_precopy() implementation, so we should only
inactivate the image afterwards.

Another reason for the change is that inactivating an image fails when
there is still a non-device BlockBackend using it, which includes the
BBs used by block migration. We want to give block migration a chance to
release the BBs before trying to inactivate the image (this will be done
in another patch).

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Jeff Cody <jcody@redhat.com>
---
 migration/migration.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/migration/migration.c b/migration/migration.c
index XXXXXXX..XXXXXXX 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -XXX,XX +XXX,XX @@ static void migration_completion(MigrationState *s, int current_active_state,
 
         if (!ret) {
             ret = vm_stop_force_state(RUN_STATE_FINISH_MIGRATE);
+            if (ret >= 0) {
+                qemu_file_set_rate_limit(s->to_dst_file, INT64_MAX);
+                qemu_savevm_state_complete_precopy(s->to_dst_file, false);
+            }
             /*
              * Don't mark the image with BDRV_O_INACTIVE flag if
              * we will go into COLO stage later.
              */
             if (ret >= 0 && !migrate_colo_enabled()) {
                 ret = bdrv_inactivate_all();
-            }
-            if (ret >= 0) {
-                qemu_file_set_rate_limit(s->to_dst_file, INT64_MAX);
-                qemu_savevm_state_complete_precopy(s->to_dst_file, false);
-                s->block_inactive = true;
+                if (ret >= 0) {
+                    s->block_inactive = true;
+                }
             }
         }
         qemu_mutex_unlock_iothread();
-- 
1.8.3.1

We need to release any block migrations BlockBackends on the source
before successfully completing the migration because otherwise
inactivating the images will fail (inactivation only tolerates device
BBs).

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Jeff Cody <jcody@redhat.com>
---
 migration/block.c | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/migration/block.c b/migration/block.c
index XXXXXXX..XXXXXXX 100644
--- a/migration/block.c
+++ b/migration/block.c
@@ -XXX,XX +XXX,XX @@ static int64_t get_remaining_dirty(void)
     return dirty << BDRV_SECTOR_BITS;
 }
 
-/* Called with iothread lock taken.  */
 
-static void block_migration_cleanup(void *opaque)
+
+/* Called with iothread lock taken.  */
+static void block_migration_cleanup_bmds(void)
 {
     BlkMigDevState *bmds;
-    BlkMigBlock *blk;
     AioContext *ctx;
 
-    bdrv_drain_all();
-
     unset_dirty_tracking();
 
     while ((bmds = QSIMPLEQ_FIRST(&block_mig_state.bmds_list)) != NULL) {
@@ -XXX,XX +XXX,XX @@ static void block_migration_cleanup(void *opaque)
         g_free(bmds->aio_bitmap);
         g_free(bmds);
     }
+}
+
+/* Called with iothread lock taken.  */
+static void block_migration_cleanup(void *opaque)
+{
+    BlkMigBlock *blk;
+
+    bdrv_drain_all();
+
+    block_migration_cleanup_bmds();
 
     blk_mig_lock();
     while ((blk = QSIMPLEQ_FIRST(&block_mig_state.blk_list)) != NULL) {
@@ -XXX,XX +XXX,XX @@ static int block_save_complete(QEMUFile *f, void *opaque)
 
     qemu_put_be64(f, BLK_MIG_FLAG_EOS);
 
+    /* Make sure that our BlockBackends are gone, so that the block driver
+     * nodes can be inactivated. */
+    block_migration_cleanup_bmds();
+
     return 0;
 }
 
-- 
1.8.3.1

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Jeff Cody <jcody@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
---
 tests/qemu-iotests/183     | 140 +++++++++++++++++++++++++++++++++++++++++++++
 tests/qemu-iotests/183.out |  46 +++++++++++++++
 tests/qemu-iotests/group   |   1 +
 3 files changed, 187 insertions(+)
 create mode 100755 tests/qemu-iotests/183
 create mode 100644 tests/qemu-iotests/183.out

diff --git a/tests/qemu-iotests/183 b/tests/qemu-iotests/183
new file mode 100755
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/qemu-iotests/183
@@ -XXX,XX +XXX,XX @@
+#!/bin/bash
+#
+# Test old-style block migration (migrate -b)
+#
+# Copyright (C) 2017 Red Hat, Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+# creator
+owner=kwolf@redhat.com
+
+seq=`basename $0`
+echo "QA output created by $seq"
+
+here=`pwd`
+status=1 # failure is the default!
+
+MIG_SOCKET="${TEST_DIR}/migrate"
+
+_cleanup()
+{
+    rm -f "${MIG_SOCKET}"
+    rm -f "${TEST_IMG}.dest"
+    _cleanup_test_img
+    _cleanup_qemu
+}
+trap "_cleanup; exit \$status" 0 1 2 3 15
+
+# get standard environment, filters and checks
+. ./common.rc
+. ./common.filter
+. ./common.qemu
+
+_supported_fmt qcow2 raw qed dmg quorum
+_supported_proto file
+_supported_os Linux
+
+size=64M
+_make_test_img $size
+TEST_IMG="${TEST_IMG}.dest" _make_test_img $size
+
+echo
+echo === Starting VMs ===
+echo
+
+qemu_comm_method="qmp"
+
+_launch_qemu \
+    -drive file="${TEST_IMG}",cache=$CACHEMODE,driver=$IMGFMT,id=disk
+src=$QEMU_HANDLE
+_send_qemu_cmd $src "{ 'execute': 'qmp_capabilities' }" 'return'
+
+_launch_qemu \
+    -drive file="${TEST_IMG}.dest",cache=$CACHEMODE,driver=$IMGFMT,id=disk \
+    -incoming "unix:${MIG_SOCKET}"
+dest=$QEMU_HANDLE
+_send_qemu_cmd $dest "{ 'execute': 'qmp_capabilities' }" 'return'
+
+echo
+echo === Write something on the source ===
+echo
+
+_send_qemu_cmd $src \
+    "{ 'execute': 'human-monitor-command',
+       'arguments': { 'command-line':
+                      'qemu-io disk \"write -P 0x55 0 64k\"' } }" \
+    'return'
+_send_qemu_cmd $src \
+    "{ 'execute': 'human-monitor-command',
+       'arguments': { 'command-line':
+                      'qemu-io disk \"read -P 0x55 0 64k\"' } }" \
+    'return'
+
+echo
+echo === Do block migration to destination ===
+echo
+
+reply="$(_send_qemu_cmd $src \
+    "{ 'execute': 'migrate',
+       'arguments': { 'uri': 'unix:${MIG_SOCKET}', 'blk': true } }" \
+    'return\|error')"
+echo "$reply"
+if echo "$reply" | grep "compiled without old-style" > /dev/null; then
+    _notrun "migrate -b support not compiled in"
+fi
+
+QEMU_COMM_TIMEOUT=0.1 qemu_cmd_repeat=50 silent=yes \
+    _send_qemu_cmd $src "{ 'execute': 'query-migrate' }" '"status": "completed"'
+_send_qemu_cmd $src "{ 'execute': 'query-status' }" "return"
+
+echo
+echo === Do some I/O on the destination ===
+echo
+
+# It is important that we use the BlockBackend of the guest device here instead
+# of the node name, which would create a new BlockBackend and not test whether
+# the guest has the necessary permissions to access the image now
+silent=yes _send_qemu_cmd $dest "" "100 %"
+_send_qemu_cmd $dest "{ 'execute': 'query-status' }" "return"
+_send_qemu_cmd $dest \
+    "{ 'execute': 'human-monitor-command',
+       'arguments': { 'command-line':
+                      'qemu-io disk \"read -P 0x55 0 64k\"' } }" \
+    'return'
+_send_qemu_cmd $dest \
+    "{ 'execute': 'human-monitor-command',
+       'arguments': { 'command-line':
+                      'qemu-io disk \"write -P 0x66 1M 64k\"' } }" \
+    'return'
+
+echo
+echo === Shut down and check image ===
+echo
+
+_send_qemu_cmd $src '{"execute":"quit"}' 'return'
+_send_qemu_cmd $dest '{"execute":"quit"}' 'return'
+wait=1 _cleanup_qemu
+
+_check_test_img
+TEST_IMG="${TEST_IMG}.dest" _check_test_img
+
+$QEMU_IO -c 'write -P 0x66 1M 64k' "$TEST_IMG" | _filter_qemu_io
+$QEMU_IMG compare "$TEST_IMG.dest" "$TEST_IMG"
+
+# success, all done
+echo "*** done"
+rm -f $seq.full
+status=0
diff --git a/tests/qemu-iotests/183.out b/tests/qemu-iotests/183.out
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/qemu-iotests/183.out
@@ -XXX,XX +XXX,XX @@
+QA output created by 183
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
+Formatting 'TEST_DIR/t.IMGFMT.dest', fmt=IMGFMT size=67108864
+
+=== Starting VMs ===
+
+{"return": {}}
+{"return": {}}
+
+=== Write something on the source ===
+
+wrote 65536/65536 bytes at offset 0
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+{"return": ""}
+read 65536/65536 bytes at offset 0
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+{"return": ""}
+
+=== Do block migration to destination ===
+
+{"return": {}}
+{"return": {"status": "postmigrate", "singlestep": false, "running": false}}
+
+=== Do some I/O on the destination ===
+
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "RESUME"}
+{"return": {"status": "running", "singlestep": false, "running": true}}
+read 65536/65536 bytes at offset 0
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+{"return": ""}
+wrote 65536/65536 bytes at offset 1048576
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+{"return": ""}
+
+=== Shut down and check image ===
+
+{"return": {}}
+{"return": {}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false}}
+No errors were found on the image.
+No errors were found on the image.
+wrote 65536/65536 bytes at offset 1048576
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+Images are identical.
+*** done
diff --git a/tests/qemu-iotests/group b/tests/qemu-iotests/group
index XXXXXXX..XXXXXXX 100644
--- a/tests/qemu-iotests/group
+++ b/tests/qemu-iotests/group
@@ -XXX,XX +XXX,XX @@
 179 rw auto quick
 181 rw auto migration
 182 rw auto quick
+183 rw auto migration
-- 
1.8.3.1

The final bdrv_set_backing_hd() could be working on already freed nodes
because the commit job drops its references (through BlockBackends) to
both overlay_bs and top already a bit earlier.

One way to trigger the bug is hot unplugging a disk for which
blockdev_mark_auto_del() cancels the block job.

Fix this by taking BDS-level references while we're still using the
nodes.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
---
 block/commit.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/block/commit.c b/block/commit.c
index XXXXXXX..XXXXXXX 100644
--- a/block/commit.c
+++ b/block/commit.c
@@ -XXX,XX +XXX,XX @@ static void commit_complete(BlockJob *job, void *opaque)
     int ret = data->ret;
     bool remove_commit_top_bs = false;
 
+    /* Make sure overlay_bs and top stay around until bdrv_set_backing_hd() */
+    bdrv_ref(top);
+    bdrv_ref(overlay_bs);
+
     /* Remove base node parent that still uses BLK_PERM_WRITE/RESIZE before
      * the normal backing chain can be restored. */
     blk_unref(s->base);
@@ -XXX,XX +XXX,XX @@ static void commit_complete(BlockJob *job, void *opaque)
     if (remove_commit_top_bs) {
         bdrv_set_backing_hd(overlay_bs, top, &error_abort);
     }
+
+    bdrv_unref(overlay_bs);
+    bdrv_unref(top);
 }
 
 static void coroutine_fn commit_run(void *opaque)
-- 
1.8.3.1

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
---
 tests/qemu-iotests/040     | 35 +++++++++++++++++++++++++++++++++--
 tests/qemu-iotests/040.out |  4 ++--
 2 files changed, 35 insertions(+), 4 deletions(-)

diff --git a/tests/qemu-iotests/040 b/tests/qemu-iotests/040
index XXXXXXX..XXXXXXX 100755
--- a/tests/qemu-iotests/040
+++ b/tests/qemu-iotests/040
@@ -XXX,XX +XXX,XX @@ class ImageCommitTestCase(iotests.QMPTestCase):
         self.wait_for_complete()
 
 class TestSingleDrive(ImageCommitTestCase):
-    image_len = 1 * 1024 * 1024
+    # Need some space after the copied data so that throttling is effective in
+    # tests that use it rather than just completing the job immediately
+    image_len = 2 * 1024 * 1024
     test_len = 1 * 1024 * 256
 
     def setUp(self):
@@ -XXX,XX +XXX,XX @@ class TestSingleDrive(ImageCommitTestCase):
         qemu_img('create', '-f', iotests.imgfmt, '-o', 'backing_file=%s' % mid_img, test_img)
         qemu_io('-f', 'raw', '-c', 'write -P 0xab 0 524288', backing_img)
         qemu_io('-f', iotests.imgfmt, '-c', 'write -P 0xef 524288 524288', mid_img)
-        self.vm = iotests.VM().add_drive(test_img)
+        self.vm = iotests.VM().add_drive(test_img, interface="none")
+        self.vm.add_device("virtio-scsi-pci")
+        self.vm.add_device("scsi-hd,id=scsi0,drive=drive0")
         self.vm.launch()
 
     def tearDown(self):
@@ -XXX,XX +XXX,XX @@ class TestSingleDrive(ImageCommitTestCase):
         self.assert_qmp(result, 'error/class', 'GenericError')
         self.assert_qmp(result, 'error/desc', 'Base \'%s\' not found' % mid_img)
 
+    # When the job is running on a BB that is automatically deleted on hot
+    # unplug, the job is cancelled when the device disappears
+    def test_hot_unplug(self):
+        if self.image_len == 0:
+            return
+
+        self.assert_no_active_block_jobs()
+        result = self.vm.qmp('block-commit', device='drive0', top=mid_img,
+                             base=backing_img, speed=(self.image_len / 4))
+        self.assert_qmp(result, 'return', {})
+        result = self.vm.qmp('device_del', id='scsi0')
+        self.assert_qmp(result, 'return', {})
+
+        cancelled = False
+        deleted = False
+        while not cancelled or not deleted:
+            for event in self.vm.get_qmp_events(wait=True):
+                if event['event'] == 'DEVICE_DELETED':
+                    self.assert_qmp(event, 'data/device', 'scsi0')
+                    deleted = True
+                elif event['event'] == 'BLOCK_JOB_CANCELLED':
+                    self.assert_qmp(event, 'data/device', 'drive0')
+                    cancelled = True
+                else:
+                    self.fail("Unexpected event %s" % (event['event']))
+
+        self.assert_no_active_block_jobs()
 
 class TestRelativePaths(ImageCommitTestCase):
     image_len = 1 * 1024 * 1024
diff --git a/tests/qemu-iotests/040.out b/tests/qemu-iotests/040.out
index XXXXXXX..XXXXXXX 100644
--- a/tests/qemu-iotests/040.out
+++ b/tests/qemu-iotests/040.out
@@ -XXX,XX +XXX,XX @@
-.........................
+...........................
 ----------------------------------------------------------------------
-Ran 25 tests
+Ran 27 tests
 
 OK
-- 
1.8.3.1

From: Jeff Cody <jcody@redhat.com>

In external_snapshot_abort(), we try to undo what was done in
external_snapshot_prepare() calling bdrv_replace_node() to swap the
nodes back.  However, we receive a permissions error as writers are
blocked on the old node, which is now the new node backing file.

An easy fix (initially suggested by Kevin Wolf) is to call
bdrv_set_backing_hd() on the new node, to set the backing node to NULL.

Signed-off-by: Jeff Cody <jcody@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 blockdev.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/blockdev.c b/blockdev.c
index XXXXXXX..XXXXXXX 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -XXX,XX +XXX,XX @@ static void external_snapshot_abort(BlkActionState *common)
                              DO_UPCAST(ExternalSnapshotState, common, common);
     if (state->new_bs) {
         if (state->overlay_appended) {
+            bdrv_ref(state->old_bs);   /* we can't let bdrv_set_backind_hd()
+                                          close state->old_bs; we need it */
+            bdrv_set_backing_hd(state->new_bs, NULL, &error_abort);
             bdrv_replace_node(state->new_bs, state->old_bs, &error_abort);
+            bdrv_unref(state->old_bs); /* bdrv_replace_node() ref'ed old_bs */
         }
     }
 }
-- 
1.8.3.1

The following changes since commit 16aaacb307ed607b9780c12702c44f0fe52edc7e:

Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20200430' into staging (2020-04-30 14:00:36 +0100)

are available in the Git repository at:

git://repo.or.cz/qemu/kevin.git tags/for-upstream

for you to fetch changes up to eaae29ef89d498d0eac553c77b554f310a47f809:

qemu-storage-daemon: Fix non-string --object properties (2020-04-30 17:51:07 +0200)

----------------------------------------------------------------
Block layer patches:

- Fix resize (extending) of short overlays
- nvme: introduce PMR support from NVMe 1.4 spec
- qemu-storage-daemon: Fix non-string --object properties

----------------------------------------------------------------
Alberto Garcia (1):
      qcow2: Add incompatibility note between backing files and raw external data files

Andrzej Jakowski (1):
      nvme: introduce PMR support from NVMe 1.4 spec

Kevin Wolf (12):
      block: Add flags to BlockDriver.bdrv_co_truncate()
      block: Add flags to bdrv(_co)_truncate()
      block-backend: Add flags to blk_truncate()
      qcow2: Support BDRV_REQ_ZERO_WRITE for truncate
      raw-format: Support BDRV_REQ_ZERO_WRITE for truncate
      file-posix: Support BDRV_REQ_ZERO_WRITE for truncate
      block: truncate: Don't make backing file data visible
      iotests: Filter testfiles out in filter_img_info()
      iotests: Test committing to short backing file
      qcow2: Forward ZERO_WRITE flag for full preallocation
      qom: Factor out user_creatable_add_dict()
      qemu-storage-daemon: Fix non-string --object properties

Paolo Bonzini (1):
      qemu-iotests: allow qcow2 external discarded clusters to contain stale data

From: Alberto Garcia <berto@igalia.com>

Backing files and raw external data files are mutually exclusive.
The documentation of the raw external data bit (in autoclear_features)
already indicates that, but we should also mention it on the other
side.

Suggested-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Alberto Garcia <berto@igalia.com>
Message-Id: <20200410121816.8334-1-berto@igalia.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 docs/interop/qcow2.txt | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/docs/interop/qcow2.txt b/docs/interop/qcow2.txt
index XXXXXXX..XXXXXXX 100644
--- a/docs/interop/qcow2.txt
+++ b/docs/interop/qcow2.txt
@@ -XXX,XX +XXX,XX @@ The first cluster of a qcow2 image contains the file header:
                     is stored (NB: The string is not null terminated). 0 if the
                     image doesn't have a backing file.
 
+                    Note: backing files are incompatible with raw external data
+                    files (auto-clear feature bit 1).
+
          16 - 19:   backing_file_size
                     Length of the backing file name in bytes. Must not be
                     longer than 1023 bytes. Undefined if the image doesn't have
-- 
2.25.3

From: Paolo Bonzini <pbonzini@redhat.com>

Test 244 checks the expected behavior of qcow2 external data files
with respect to zero and discarded clusters.  Filesystems however
are free to ignore discard requests, and this seems to be the
case for overlayfs.  Relax the tests to skip checks on the
external data file for discarded areas, which implies not using
qemu-img compare in the data_file_raw=on case.

This fixes docker tests on RHEL8.

Cc: Kevin Wolf <kwolf@redhat.com>
Cc: qemu-block@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <20200409191006.24429-1-pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 tests/qemu-iotests/244     | 10 ++++++++--
 tests/qemu-iotests/244.out |  9 ++++++---
 2 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/tests/qemu-iotests/244 b/tests/qemu-iotests/244
index XXXXXXX..XXXXXXX 100755
--- a/tests/qemu-iotests/244
+++ b/tests/qemu-iotests/244
@@ -XXX,XX +XXX,XX @@ $QEMU_IO -c 'read -P 0 0 1M' \
 echo
 $QEMU_IO -c 'read -P 0 0 1M' \
          -c 'read -P 0x11 1M 1M' \
-         -c 'read -P 0 2M 2M' \
          -c 'read -P 0x11 4M 1M' \
          -c 'read -P 0 5M 1M' \
          -f raw "$TEST_IMG.data" |
@@ -XXX,XX +XXX,XX @@ $QEMU_IO -c 'read -P 0 0 1M' \
          -f $IMGFMT "$TEST_IMG" |
          _filter_qemu_io
 
+# Discarded clusters are only marked as such in the qcow2 metadata, but
+# they can contain stale data in the external data file.  Instead, zero
+# clusters must be zeroed in the external data file too.
 echo
-$QEMU_IMG compare "$TEST_IMG" "$TEST_IMG.data"
+$QEMU_IO -c 'read -P 0 0 1M' \
+         -c 'read -P 0x11 1M 1M' \
+         -c 'read -P 0 3M 3M' \
+         -f raw "$TEST_IMG".data |
+         _filter_qemu_io
 
 echo -n "qcow2 file size after I/O: "
 du -b $TEST_IMG | cut -f1
diff --git a/tests/qemu-iotests/244.out b/tests/qemu-iotests/244.out
index XXXXXXX..XXXXXXX 100644
--- a/tests/qemu-iotests/244.out
+++ b/tests/qemu-iotests/244.out
@@ -XXX,XX +XXX,XX @@ read 1048576/1048576 bytes at offset 0
 1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 read 1048576/1048576 bytes at offset 1048576
 1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-read 2097152/2097152 bytes at offset 2097152
-2 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 read 1048576/1048576 bytes at offset 4194304
 1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 read 1048576/1048576 bytes at offset 5242880
@@ -XXX,XX +XXX,XX @@ read 1048576/1048576 bytes at offset 1048576
 read 4194304/4194304 bytes at offset 2097152
 4 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 
-Images are identical.
+read 1048576/1048576 bytes at offset 0
+1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+read 1048576/1048576 bytes at offset 1048576
+1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+read 3145728/3145728 bytes at offset 3145728
+3 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 qcow2 file size after I/O: 327680
 
 === bdrv_co_block_status test for file and offset=0 ===
-- 
2.25.3

This adds a new BdrvRequestFlags parameter to the .bdrv_co_truncate()
driver callbacks, and a supported_truncate_flags field in
BlockDriverState that allows drivers to advertise support for request
flags in the context of truncate.

For now, we always pass 0 and no drivers declare support for any flag.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Message-Id: <20200424125448.63318-2-kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/block/block_int.h   | 10 +++++++++-
 block/crypto.c              |  3 ++-
 block/file-posix.c          |  2 +-
 block/file-win32.c          |  2 +-
 block/gluster.c             |  1 +
 block/io.c                  |  8 +++++++-
 block/iscsi.c               |  2 +-
 block/nfs.c                 |  3 ++-
 block/qcow2.c               |  2 +-
 block/qed.c                 |  1 +
 block/raw-format.c          |  2 +-
 block/rbd.c                 |  1 +
 block/sheepdog.c            |  4 ++--
 block/ssh.c                 |  2 +-
 tests/test-block-iothread.c |  3 ++-
 15 files changed, 33 insertions(+), 13 deletions(-)

diff --git a/include/block/block_int.h b/include/block/block_int.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/block_int.h
+++ b/include/block/block_int.h
@@ -XXX,XX +XXX,XX @@ struct BlockDriver {
      */
     int coroutine_fn (*bdrv_co_truncate)(BlockDriverState *bs, int64_t offset,
                                          bool exact, PreallocMode prealloc,
-                                         Error **errp);
+                                         BdrvRequestFlags flags, Error **errp);
 
     int64_t (*bdrv_getlength)(BlockDriverState *bs);
     bool has_variable_length;
@@ -XXX,XX +XXX,XX @@ struct BlockDriverState {
     /* Flags honored during pwrite_zeroes (so far: BDRV_REQ_FUA,
      * BDRV_REQ_MAY_UNMAP, BDRV_REQ_WRITE_UNCHANGED) */
     unsigned int supported_zero_flags;
+    /*
+     * Flags honoured during truncate (so far: BDRV_REQ_ZERO_WRITE).
+     *
+     * If BDRV_REQ_ZERO_WRITE is given, the truncate operation must make sure
+     * that any added space reads as all zeros. If this can't be guaranteed,
+     * the operation must fail.
+     */
+    unsigned int supported_truncate_flags;
 
     /* the following member gives a name to every node on the bs graph. */
     char node_name[32];
diff --git a/block/crypto.c b/block/crypto.c
index XXXXXXX..XXXXXXX 100644
--- a/block/crypto.c
+++ b/block/crypto.c
@@ -XXX,XX +XXX,XX @@ static int block_crypto_co_create_generic(BlockDriverState *bs,
 
 static int coroutine_fn
 block_crypto_co_truncate(BlockDriverState *bs, int64_t offset, bool exact,
-                         PreallocMode prealloc, Error **errp)
+                         PreallocMode prealloc, BdrvRequestFlags flags,
+                         Error **errp)
 {
     BlockCrypto *crypto = bs->opaque;
     uint64_t payload_offset =
diff --git a/block/file-posix.c b/block/file-posix.c
index XXXXXXX..XXXXXXX 100644
--- a/block/file-posix.c
+++ b/block/file-posix.c
@@ -XXX,XX +XXX,XX @@ raw_regular_truncate(BlockDriverState *bs, int fd, int64_t offset,
 
 static int coroutine_fn raw_co_truncate(BlockDriverState *bs, int64_t offset,
                                         bool exact, PreallocMode prealloc,
-                                        Error **errp)
+                                        BdrvRequestFlags flags, Error **errp)
 {
     BDRVRawState *s = bs->opaque;
     struct stat st;
diff --git a/block/file-win32.c b/block/file-win32.c
index XXXXXXX..XXXXXXX 100644
--- a/block/file-win32.c
+++ b/block/file-win32.c
@@ -XXX,XX +XXX,XX @@ static void raw_close(BlockDriverState *bs)
 
 static int coroutine_fn raw_co_truncate(BlockDriverState *bs, int64_t offset,
                                         bool exact, PreallocMode prealloc,
-                                        Error **errp)
+                                        BdrvRequestFlags flags, Error **errp)
 {
     BDRVRawState *s = bs->opaque;
     LONG low, high;
diff --git a/block/gluster.c b/block/gluster.c
index XXXXXXX..XXXXXXX 100644
--- a/block/gluster.c
+++ b/block/gluster.c
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int qemu_gluster_co_truncate(BlockDriverState *bs,
                                                  int64_t offset,
                                                  bool exact,
                                                  PreallocMode prealloc,
+                                                 BdrvRequestFlags flags,
                                                  Error **errp)
 {
     BDRVGlusterState *s = bs->opaque;
diff --git a/block/io.c b/block/io.c
index XXXXXXX..XXXXXXX 100644
--- a/block/io.c
+++ b/block/io.c
@@ -XXX,XX +XXX,XX @@ int coroutine_fn bdrv_co_truncate(BdrvChild *child, int64_t offset, bool exact,
     BlockDriverState *bs = child->bs;
     BlockDriver *drv = bs->drv;
     BdrvTrackedRequest req;
+    BdrvRequestFlags flags = 0;
     int64_t old_size, new_bytes;
     int ret;
 
@@ -XXX,XX +XXX,XX @@ int coroutine_fn bdrv_co_truncate(BdrvChild *child, int64_t offset, bool exact,
     }
 
     if (drv->bdrv_co_truncate) {
-        ret = drv->bdrv_co_truncate(bs, offset, exact, prealloc, errp);
+        if (flags & ~bs->supported_truncate_flags) {
+            error_setg(errp, "Block driver does not support requested flags");
+            ret = -ENOTSUP;
+            goto out;
+        }
+        ret = drv->bdrv_co_truncate(bs, offset, exact, prealloc, flags, errp);
     } else if (bs->file && drv->is_filter) {
         ret = bdrv_co_truncate(bs->file, offset, exact, prealloc, errp);
     } else {
diff --git a/block/iscsi.c b/block/iscsi.c
index XXXXXXX..XXXXXXX 100644
--- a/block/iscsi.c
+++ b/block/iscsi.c
@@ -XXX,XX +XXX,XX @@ static void iscsi_reopen_commit(BDRVReopenState *reopen_state)
 
 static int coroutine_fn iscsi_co_truncate(BlockDriverState *bs, int64_t offset,
                                           bool exact, PreallocMode prealloc,
-                                          Error **errp)
+                                          BdrvRequestFlags flags, Error **errp)
 {
     IscsiLun *iscsilun = bs->opaque;
     int64_t cur_length;
diff --git a/block/nfs.c b/block/nfs.c
index XXXXXXX..XXXXXXX 100644
--- a/block/nfs.c
+++ b/block/nfs.c
@@ -XXX,XX +XXX,XX @@ static int64_t nfs_get_allocated_file_size(BlockDriverState *bs)
 
 static int coroutine_fn
 nfs_file_co_truncate(BlockDriverState *bs, int64_t offset, bool exact,
-                     PreallocMode prealloc, Error **errp)
+                     PreallocMode prealloc, BdrvRequestFlags flags,
+                     Error **errp)
 {
     NFSClient *client = bs->opaque;
     int ret;
diff --git a/block/qcow2.c b/block/qcow2.c
index XXXXXXX..XXXXXXX 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -XXX,XX +XXX,XX @@ fail:
 
 static int coroutine_fn qcow2_co_truncate(BlockDriverState *bs, int64_t offset,
                                           bool exact, PreallocMode prealloc,
-                                          Error **errp)
+                                          BdrvRequestFlags flags, Error **errp)
 {
     BDRVQcow2State *s = bs->opaque;
     uint64_t old_length;
diff --git a/block/qed.c b/block/qed.c
index XXXXXXX..XXXXXXX 100644
--- a/block/qed.c
+++ b/block/qed.c
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_qed_co_truncate(BlockDriverState *bs,
                                              int64_t offset,
                                              bool exact,
                                              PreallocMode prealloc,
+                                             BdrvRequestFlags flags,
                                              Error **errp)
 {
     BDRVQEDState *s = bs->opaque;
diff --git a/block/raw-format.c b/block/raw-format.c
index XXXXXXX..XXXXXXX 100644
--- a/block/raw-format.c
+++ b/block/raw-format.c
@@ -XXX,XX +XXX,XX @@ static void raw_refresh_limits(BlockDriverState *bs, Error **errp)
 
 static int coroutine_fn raw_co_truncate(BlockDriverState *bs, int64_t offset,
                                         bool exact, PreallocMode prealloc,
-                                        Error **errp)
+                                        BdrvRequestFlags flags, Error **errp)
 {
     BDRVRawState *s = bs->opaque;
 
diff --git a/block/rbd.c b/block/rbd.c
index XXXXXXX..XXXXXXX 100644
--- a/block/rbd.c
+++ b/block/rbd.c
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn qemu_rbd_co_truncate(BlockDriverState *bs,
                                              int64_t offset,
                                              bool exact,
                                              PreallocMode prealloc,
+                                             BdrvRequestFlags flags,
                                              Error **errp)
 {
     int r;
diff --git a/block/sheepdog.c b/block/sheepdog.c
index XXXXXXX..XXXXXXX 100644
--- a/block/sheepdog.c
+++ b/block/sheepdog.c
@@ -XXX,XX +XXX,XX @@ static int64_t sd_getlength(BlockDriverState *bs)
 
 static int coroutine_fn sd_co_truncate(BlockDriverState *bs, int64_t offset,
                                        bool exact, PreallocMode prealloc,
-                                       Error **errp)
+                                       BdrvRequestFlags flags, Error **errp)
 {
     BDRVSheepdogState *s = bs->opaque;
     int ret, fd;
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int sd_co_writev(BlockDriverState *bs, int64_t sector_num,
 
     assert(!flags);
     if (offset > s->inode.vdi_size) {
-        ret = sd_co_truncate(bs, offset, false, PREALLOC_MODE_OFF, NULL);
+        ret = sd_co_truncate(bs, offset, false, PREALLOC_MODE_OFF, 0, NULL);
         if (ret < 0) {
             return ret;
         }
diff --git a/block/ssh.c b/block/ssh.c
index XXXXXXX..XXXXXXX 100644
--- a/block/ssh.c
+++ b/block/ssh.c
@@ -XXX,XX +XXX,XX @@ static int64_t ssh_getlength(BlockDriverState *bs)
 
 static int coroutine_fn ssh_co_truncate(BlockDriverState *bs, int64_t offset,
                                         bool exact, PreallocMode prealloc,
-                                        Error **errp)
+                                        BdrvRequestFlags flags, Error **errp)
 {
     BDRVSSHState *s = bs->opaque;
 
diff --git a/tests/test-block-iothread.c b/tests/test-block-iothread.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/test-block-iothread.c
+++ b/tests/test-block-iothread.c
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_test_co_pdiscard(BlockDriverState *bs,
 
 static int coroutine_fn
 bdrv_test_co_truncate(BlockDriverState *bs, int64_t offset, bool exact,
-                      PreallocMode prealloc, Error **errp)
+                      PreallocMode prealloc, BdrvRequestFlags flags,
+                      Error **errp)
 {
     return 0;
 }
-- 
2.25.3

Now that block drivers can support flags for .bdrv_co_truncate, expose
the parameter in the node level interfaces bdrv_co_truncate() and
bdrv_truncate().

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Message-Id: <20200424125448.63318-3-kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/block/block.h       |  5 +++--
 block/block-backend.c       |  2 +-
 block/crypto.c              |  2 +-
 block/io.c                  | 12 +++++++-----
 block/parallels.c           |  6 +++---
 block/qcow.c                |  4 ++--
 block/qcow2-refcount.c      |  2 +-
 block/qcow2.c               | 15 +++++++++------
 block/raw-format.c          |  2 +-
 block/vhdx-log.c            |  2 +-
 block/vhdx.c                |  2 +-
 block/vmdk.c                |  2 +-
 tests/test-block-iothread.c |  6 +++---
 13 files changed, 34 insertions(+), 28 deletions(-)

diff --git a/include/block/block.h b/include/block/block.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/block.h
+++ b/include/block/block.h
@@ -XXX,XX +XXX,XX @@ BlockDriverState *bdrv_find_backing_image(BlockDriverState *bs,
 void bdrv_refresh_filename(BlockDriverState *bs);
 
 int coroutine_fn bdrv_co_truncate(BdrvChild *child, int64_t offset, bool exact,
-                                  PreallocMode prealloc, Error **errp);
+                                  PreallocMode prealloc, BdrvRequestFlags flags,
+                                  Error **errp);
 int bdrv_truncate(BdrvChild *child, int64_t offset, bool exact,
-                  PreallocMode prealloc, Error **errp);
+                  PreallocMode prealloc, BdrvRequestFlags flags, Error **errp);
 
 int64_t bdrv_nb_sectors(BlockDriverState *bs);
 int64_t bdrv_getlength(BlockDriverState *bs);
diff --git a/block/block-backend.c b/block/block-backend.c
index XXXXXXX..XXXXXXX 100644
--- a/block/block-backend.c
+++ b/block/block-backend.c
@@ -XXX,XX +XXX,XX @@ int blk_truncate(BlockBackend *blk, int64_t offset, bool exact,
         return -ENOMEDIUM;
     }
 
-    return bdrv_truncate(blk->root, offset, exact, prealloc, errp);
+    return bdrv_truncate(blk->root, offset, exact, prealloc, 0, errp);
 }
 
 int blk_save_vmstate(BlockBackend *blk, const uint8_t *buf,
diff --git a/block/crypto.c b/block/crypto.c
index XXXXXXX..XXXXXXX 100644
--- a/block/crypto.c
+++ b/block/crypto.c
@@ -XXX,XX +XXX,XX @@ block_crypto_co_truncate(BlockDriverState *bs, int64_t offset, bool exact,
 
     offset += payload_offset;
 
-    return bdrv_co_truncate(bs->file, offset, exact, prealloc, errp);
+    return bdrv_co_truncate(bs->file, offset, exact, prealloc, 0, errp);
 }
 
 static void block_crypto_close(BlockDriverState *bs)
diff --git a/block/io.c b/block/io.c
index XXXXXXX..XXXXXXX 100644
--- a/block/io.c
+++ b/block/io.c
@@ -XXX,XX +XXX,XX @@ static void bdrv_parent_cb_resize(BlockDriverState *bs)
  * 'offset' bytes in length.
  */
 int coroutine_fn bdrv_co_truncate(BdrvChild *child, int64_t offset, bool exact,
-                                  PreallocMode prealloc, Error **errp)
+                                  PreallocMode prealloc, BdrvRequestFlags flags,
+                                  Error **errp)
 {
     BlockDriverState *bs = child->bs;
     BlockDriver *drv = bs->drv;
     BdrvTrackedRequest req;
-    BdrvRequestFlags flags = 0;
     int64_t old_size, new_bytes;
     int ret;
 
@@ -XXX,XX +XXX,XX @@ int coroutine_fn bdrv_co_truncate(BdrvChild *child, int64_t offset, bool exact,
         }
         ret = drv->bdrv_co_truncate(bs, offset, exact, prealloc, flags, errp);
     } else if (bs->file && drv->is_filter) {
-        ret = bdrv_co_truncate(bs->file, offset, exact, prealloc, errp);
+        ret = bdrv_co_truncate(bs->file, offset, exact, prealloc, flags, errp);
     } else {
         error_setg(errp, "Image format driver does not support resize");
         ret = -ENOTSUP;
@@ -XXX,XX +XXX,XX @@ typedef struct TruncateCo {
     int64_t offset;
     bool exact;
     PreallocMode prealloc;
+    BdrvRequestFlags flags;
     Error **errp;
     int ret;
 } TruncateCo;
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn bdrv_truncate_co_entry(void *opaque)
 {
     TruncateCo *tco = opaque;
     tco->ret = bdrv_co_truncate(tco->child, tco->offset, tco->exact,
-                                tco->prealloc, tco->errp);
+                                tco->prealloc, tco->flags, tco->errp);
     aio_wait_kick();
 }
 
 int bdrv_truncate(BdrvChild *child, int64_t offset, bool exact,
-                  PreallocMode prealloc, Error **errp)
+                  PreallocMode prealloc, BdrvRequestFlags flags, Error **errp)
 {
     Coroutine *co;
     TruncateCo tco = {
@@ -XXX,XX +XXX,XX @@ int bdrv_truncate(BdrvChild *child, int64_t offset, bool exact,
         .offset     = offset,
         .exact      = exact,
         .prealloc   = prealloc,
+        .flags      = flags,
         .errp       = errp,
         .ret        = NOT_DONE,
     };
diff --git a/block/parallels.c b/block/parallels.c
index XXXXXXX..XXXXXXX 100644
--- a/block/parallels.c
+++ b/block/parallels.c
@@ -XXX,XX +XXX,XX @@ static int64_t allocate_clusters(BlockDriverState *bs, int64_t sector_num,
         } else {
             ret = bdrv_truncate(bs->file,
                                 (s->data_end + space) << BDRV_SECTOR_BITS,
-                                false, PREALLOC_MODE_OFF, NULL);
+                                false, PREALLOC_MODE_OFF, 0, NULL);
         }
         if (ret < 0) {
             return ret;
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn parallels_co_check(BlockDriverState *bs,
              * That means we have to pass exact=true.
              */
             ret = bdrv_truncate(bs->file, res->image_end_offset, true,
-                                PREALLOC_MODE_OFF, &local_err);
+                                PREALLOC_MODE_OFF, 0, &local_err);
             if (ret < 0) {
                 error_report_err(local_err);
                 res->check_errors++;
@@ -XXX,XX +XXX,XX @@ static void parallels_close(BlockDriverState *bs)
 
         /* errors are ignored, so we might as well pass exact=true */
         bdrv_truncate(bs->file, s->data_end << BDRV_SECTOR_BITS, true,
-                      PREALLOC_MODE_OFF, NULL);
+                      PREALLOC_MODE_OFF, 0, NULL);
     }
 
     g_free(s->bat_dirty_bmap);
diff --git a/block/qcow.c b/block/qcow.c
index XXXXXXX..XXXXXXX 100644
--- a/block/qcow.c
+++ b/block/qcow.c
@@ -XXX,XX +XXX,XX @@ static int get_cluster_offset(BlockDriverState *bs,
                     return -E2BIG;
                 }
                 ret = bdrv_truncate(bs->file, cluster_offset + s->cluster_size,
-                                    false, PREALLOC_MODE_OFF, NULL);
+                                    false, PREALLOC_MODE_OFF, 0, NULL);
                 if (ret < 0) {
                     return ret;
                 }
@@ -XXX,XX +XXX,XX @@ static int qcow_make_empty(BlockDriverState *bs)
             l1_length) < 0)
         return -1;
     ret = bdrv_truncate(bs->file, s->l1_table_offset + l1_length, false,
-                        PREALLOC_MODE_OFF, NULL);
+                        PREALLOC_MODE_OFF, 0, NULL);
     if (ret < 0)
         return ret;
 
diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c
index XXXXXXX..XXXXXXX 100644
--- a/block/qcow2-refcount.c
+++ b/block/qcow2-refcount.c
@@ -XXX,XX +XXX,XX @@ static int check_refblocks(BlockDriverState *bs, BdrvCheckResult *res,
                 }
 
                 ret = bdrv_truncate(bs->file, offset + s->cluster_size, false,
-                                    PREALLOC_MODE_OFF, &local_err);
+                                    PREALLOC_MODE_OFF, 0, &local_err);
                 if (ret < 0) {
                     error_report_err(local_err);
                     goto resize_fail;
diff --git a/block/qcow2.c b/block/qcow2.c
index XXXXXXX..XXXXXXX 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn preallocate_co(BlockDriverState *bs, uint64_t offset,
             mode = PREALLOC_MODE_OFF;
         }
         ret = bdrv_co_truncate(s->data_file, host_offset + cur_bytes, false,
-                               mode, errp);
+                               mode, 0, errp);
         if (ret < 0) {
             return ret;
         }
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn qcow2_co_truncate(BlockDriverState *bs, int64_t offset,
              * always fulfilled, so there is no need to pass it on.)
              */
             bdrv_co_truncate(bs->file, (last_cluster + 1) * s->cluster_size,
-                             false, PREALLOC_MODE_OFF, &local_err);
+                             false, PREALLOC_MODE_OFF, 0, &local_err);
             if (local_err) {
                 warn_reportf_err(local_err,
                                  "Failed to truncate the tail of the image: ");
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn qcow2_co_truncate(BlockDriverState *bs, int64_t offset,
              * file should be resized to the exact target size, too,
              * so we pass @exact here.
              */
-            ret = bdrv_co_truncate(s->data_file, offset, exact, prealloc, errp);
+            ret = bdrv_co_truncate(s->data_file, offset, exact, prealloc, 0,
+                                   errp);
             if (ret < 0) {
                 goto fail;
             }
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn qcow2_co_truncate(BlockDriverState *bs, int64_t offset,
         new_file_size = allocation_start +
                         nb_new_data_clusters * s->cluster_size;
         /* Image file grows, so @exact does not matter */
-        ret = bdrv_co_truncate(bs->file, new_file_size, false, prealloc, errp);
+        ret = bdrv_co_truncate(bs->file, new_file_size, false, prealloc, 0,
+                               errp);
         if (ret < 0) {
             error_prepend(errp, "Failed to resize underlying file: ");
             qcow2_free_clusters(bs, allocation_start,
@@ -XXX,XX +XXX,XX @@ qcow2_co_pwritev_compressed_part(BlockDriverState *bs,
         if (len < 0) {
             return len;
         }
-        return bdrv_co_truncate(bs->file, len, false, PREALLOC_MODE_OFF, NULL);
+        return bdrv_co_truncate(bs->file, len, false, PREALLOC_MODE_OFF, 0,
+                                NULL);
     }
 
     if (offset_into_cluster(s, offset)) {
@@ -XXX,XX +XXX,XX @@ static int make_completely_empty(BlockDriverState *bs)
     }
 
     ret = bdrv_truncate(bs->file, (3 + l1_clusters) * s->cluster_size, false,
-                        PREALLOC_MODE_OFF, &local_err);
+                        PREALLOC_MODE_OFF, 0, &local_err);
     if (ret < 0) {
         error_report_err(local_err);
         goto fail;
diff --git a/block/raw-format.c b/block/raw-format.c
index XXXXXXX..XXXXXXX 100644
--- a/block/raw-format.c
+++ b/block/raw-format.c
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn raw_co_truncate(BlockDriverState *bs, int64_t offset,
 
     s->size = offset;
     offset += s->offset;
-    return bdrv_co_truncate(bs->file, offset, exact, prealloc, errp);
+    return bdrv_co_truncate(bs->file, offset, exact, prealloc, 0, errp);
 }
 
 static void raw_eject(BlockDriverState *bs, bool eject_flag)
diff --git a/block/vhdx-log.c b/block/vhdx-log.c
index XXXXXXX..XXXXXXX 100644
--- a/block/vhdx-log.c
+++ b/block/vhdx-log.c
@@ -XXX,XX +XXX,XX @@ static int vhdx_log_flush(BlockDriverState *bs, BDRVVHDXState *s,
                     goto exit;
                 }
                 ret = bdrv_truncate(bs->file, new_file_size, false,
-                                    PREALLOC_MODE_OFF, NULL);
+                                    PREALLOC_MODE_OFF, 0, NULL);
                 if (ret < 0) {
                     goto exit;
                 }
diff --git a/block/vhdx.c b/block/vhdx.c
index XXXXXXX..XXXXXXX 100644
--- a/block/vhdx.c
+++ b/block/vhdx.c
@@ -XXX,XX +XXX,XX @@ static int vhdx_allocate_block(BlockDriverState *bs, BDRVVHDXState *s,
     }
 
     return bdrv_truncate(bs->file, *new_offset + s->block_size, false,
-                         PREALLOC_MODE_OFF, NULL);
+                         PREALLOC_MODE_OFF, 0, NULL);
 }
 
 /*
diff --git a/block/vmdk.c b/block/vmdk.c
index XXXXXXX..XXXXXXX 100644
--- a/block/vmdk.c
+++ b/block/vmdk.c
@@ -XXX,XX +XXX,XX @@ vmdk_co_pwritev_compressed(BlockDriverState *bs, uint64_t offset,
             }
             length = QEMU_ALIGN_UP(length, BDRV_SECTOR_SIZE);
             ret = bdrv_truncate(s->extents[i].file, length, false,
-                                PREALLOC_MODE_OFF, NULL);
+                                PREALLOC_MODE_OFF, 0, NULL);
             if (ret < 0) {
                 return ret;
             }
diff --git a/tests/test-block-iothread.c b/tests/test-block-iothread.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/test-block-iothread.c
+++ b/tests/test-block-iothread.c
@@ -XXX,XX +XXX,XX @@ static void test_sync_op_truncate(BdrvChild *c)
     int ret;
 
     /* Normal success path */
-    ret = bdrv_truncate(c, 65536, false, PREALLOC_MODE_OFF, NULL);
+    ret = bdrv_truncate(c, 65536, false, PREALLOC_MODE_OFF, 0, NULL);
     g_assert_cmpint(ret, ==, 0);
 
     /* Early error: Negative offset */
-    ret = bdrv_truncate(c, -2, false, PREALLOC_MODE_OFF, NULL);
+    ret = bdrv_truncate(c, -2, false, PREALLOC_MODE_OFF, 0, NULL);
     g_assert_cmpint(ret, ==, -EINVAL);
 
     /* Error: Read-only image */
     c->bs->read_only = true;
     c->bs->open_flags &= ~BDRV_O_RDWR;
 
-    ret = bdrv_truncate(c, 65536, false, PREALLOC_MODE_OFF, NULL);
+    ret = bdrv_truncate(c, 65536, false, PREALLOC_MODE_OFF, 0, NULL);
     g_assert_cmpint(ret, ==, -EACCES);
 
     c->bs->read_only = false;
-- 
2.25.3

Now that node level interface bdrv_truncate() supports passing request
flags to the block driver, expose this on the BlockBackend level, too.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Message-Id: <20200424125448.63318-4-kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/sysemu/block-backend.h | 2 +-
 block.c                        | 3 ++-
 block/block-backend.c          | 4 ++--
 block/commit.c                 | 4 ++--
 block/crypto.c                 | 2 +-
 block/mirror.c                 | 2 +-
 block/qcow2.c                  | 4 ++--
 block/qed.c                    | 2 +-
 block/vdi.c                    | 2 +-
 block/vhdx.c                   | 4 ++--
 block/vmdk.c                   | 6 +++---
 block/vpc.c                    | 2 +-
 blockdev.c                     | 2 +-
 qemu-img.c                     | 2 +-
 qemu-io-cmds.c                 | 2 +-
 15 files changed, 22 insertions(+), 21 deletions(-)

diff --git a/include/sysemu/block-backend.h b/include/sysemu/block-backend.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/block-backend.h
+++ b/include/sysemu/block-backend.h
@@ -XXX,XX +XXX,XX @@ int coroutine_fn blk_co_pwrite_zeroes(BlockBackend *blk, int64_t offset,
 int blk_pwrite_compressed(BlockBackend *blk, int64_t offset, const void *buf,
                           int bytes);
 int blk_truncate(BlockBackend *blk, int64_t offset, bool exact,
-                 PreallocMode prealloc, Error **errp);
+                 PreallocMode prealloc, BdrvRequestFlags flags, Error **errp);
 int blk_pdiscard(BlockBackend *blk, int64_t offset, int bytes);
 int blk_save_vmstate(BlockBackend *blk, const uint8_t *buf,
                      int64_t pos, int size);
diff --git a/block.c b/block.c
index XXXXXXX..XXXXXXX 100644
--- a/block.c
+++ b/block.c
@@ -XXX,XX +XXX,XX @@ static int64_t create_file_fallback_truncate(BlockBackend *blk,
     int64_t size;
     int ret;
 
-    ret = blk_truncate(blk, minimum_size, false, PREALLOC_MODE_OFF, &local_err);
+    ret = blk_truncate(blk, minimum_size, false, PREALLOC_MODE_OFF, 0,
+                       &local_err);
     if (ret < 0 && ret != -ENOTSUP) {
         error_propagate(errp, local_err);
         return ret;
diff --git a/block/block-backend.c b/block/block-backend.c
index XXXXXXX..XXXXXXX 100644
--- a/block/block-backend.c
+++ b/block/block-backend.c
@@ -XXX,XX +XXX,XX @@ int blk_pwrite_compressed(BlockBackend *blk, int64_t offset, const void *buf,
 }
 
 int blk_truncate(BlockBackend *blk, int64_t offset, bool exact,
-                 PreallocMode prealloc, Error **errp)
+                 PreallocMode prealloc, BdrvRequestFlags flags, Error **errp)
 {
     if (!blk_is_available(blk)) {
         error_setg(errp, "No medium inserted");
         return -ENOMEDIUM;
     }
 
-    return bdrv_truncate(blk->root, offset, exact, prealloc, 0, errp);
+    return bdrv_truncate(blk->root, offset, exact, prealloc, flags, errp);
 }
 
 int blk_save_vmstate(BlockBackend *blk, const uint8_t *buf,
diff --git a/block/commit.c b/block/commit.c
index XXXXXXX..XXXXXXX 100644
--- a/block/commit.c
+++ b/block/commit.c
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn commit_run(Job *job, Error **errp)
     }
 
     if (base_len < len) {
-        ret = blk_truncate(s->base, len, false, PREALLOC_MODE_OFF, NULL);
+        ret = blk_truncate(s->base, len, false, PREALLOC_MODE_OFF, 0, NULL);
         if (ret) {
             goto out;
         }
@@ -XXX,XX +XXX,XX @@ int bdrv_commit(BlockDriverState *bs)
      * grow the backing file image if possible.  If not possible,
      * we must return an error */
     if (length > backing_length) {
-        ret = blk_truncate(backing, length, false, PREALLOC_MODE_OFF,
+        ret = blk_truncate(backing, length, false, PREALLOC_MODE_OFF, 0,
                            &local_err);
         if (ret < 0) {
             error_report_err(local_err);
diff --git a/block/crypto.c b/block/crypto.c
index XXXXXXX..XXXXXXX 100644
--- a/block/crypto.c
+++ b/block/crypto.c
@@ -XXX,XX +XXX,XX @@ static ssize_t block_crypto_init_func(QCryptoBlock *block,
      * which will be used by the crypto header
      */
     return blk_truncate(data->blk, data->size + headerlen, false,
-                        data->prealloc, errp);
+                        data->prealloc, 0, errp);
 }
 
 
diff --git a/block/mirror.c b/block/mirror.c
index XXXXXXX..XXXXXXX 100644
--- a/block/mirror.c
+++ b/block/mirror.c
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn mirror_run(Job *job, Error **errp)
 
         if (s->bdev_length > base_length) {
             ret = blk_truncate(s->target, s->bdev_length, false,
-                               PREALLOC_MODE_OFF, NULL);
+                               PREALLOC_MODE_OFF, 0, NULL);
             if (ret < 0) {
                 goto immediate_exit;
             }
diff --git a/block/qcow2.c b/block/qcow2.c
index XXXXXXX..XXXXXXX 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -XXX,XX +XXX,XX @@ qcow2_co_create(BlockdevCreateOptions *create_options, Error **errp)
 
     /* Okay, now that we have a valid image, let's give it the right size */
     ret = blk_truncate(blk, qcow2_opts->size, false, qcow2_opts->preallocation,
-                       errp);
+                       0, errp);
     if (ret < 0) {
         error_prepend(errp, "Could not resize image: ");
         goto out;
@@ -XXX,XX +XXX,XX @@ static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts,
          * Amending image options should ensure that the image has
          * exactly the given new values, so pass exact=true here.
          */
-        ret = blk_truncate(blk, new_size, true, PREALLOC_MODE_OFF, errp);
+        ret = blk_truncate(blk, new_size, true, PREALLOC_MODE_OFF, 0, errp);
         blk_unref(blk);
         if (ret < 0) {
             return ret;
diff --git a/block/qed.c b/block/qed.c
index XXXXXXX..XXXXXXX 100644
--- a/block/qed.c
+++ b/block/qed.c
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_qed_co_create(BlockdevCreateOptions *opts,
      * The QED format associates file length with allocation status,
      * so a new file (which is empty) must have a length of 0.
      */
-    ret = blk_truncate(blk, 0, true, PREALLOC_MODE_OFF, errp);
+    ret = blk_truncate(blk, 0, true, PREALLOC_MODE_OFF, 0, errp);
     if (ret < 0) {
         goto out;
     }
diff --git a/block/vdi.c b/block/vdi.c
index XXXXXXX..XXXXXXX 100644
--- a/block/vdi.c
+++ b/block/vdi.c
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn vdi_co_do_create(BlockdevCreateOptions *create_options,
 
     if (image_type == VDI_TYPE_STATIC) {
         ret = blk_truncate(blk, offset + blocks * block_size, false,
-                           PREALLOC_MODE_OFF, errp);
+                           PREALLOC_MODE_OFF, 0, errp);
         if (ret < 0) {
             error_prepend(errp, "Failed to statically allocate file");
             goto exit;
diff --git a/block/vhdx.c b/block/vhdx.c
index XXXXXXX..XXXXXXX 100644
--- a/block/vhdx.c
+++ b/block/vhdx.c
@@ -XXX,XX +XXX,XX @@ static int vhdx_create_bat(BlockBackend *blk, BDRVVHDXState *s,
         /* All zeroes, so we can just extend the file - the end of the BAT
          * is the furthest thing we have written yet */
         ret = blk_truncate(blk, data_file_offset, false, PREALLOC_MODE_OFF,
-                           errp);
+                           0, errp);
         if (ret < 0) {
             goto exit;
         }
     } else if (type == VHDX_TYPE_FIXED) {
         ret = blk_truncate(blk, data_file_offset + image_size, false,
-                           PREALLOC_MODE_OFF, errp);
+                           PREALLOC_MODE_OFF, 0, errp);
         if (ret < 0) {
             goto exit;
         }
diff --git a/block/vmdk.c b/block/vmdk.c
index XXXXXXX..XXXXXXX 100644
--- a/block/vmdk.c
+++ b/block/vmdk.c
@@ -XXX,XX +XXX,XX @@ static int vmdk_init_extent(BlockBackend *blk,
     int gd_buf_size;
 
     if (flat) {
-        ret = blk_truncate(blk, filesize, false, PREALLOC_MODE_OFF, errp);
+        ret = blk_truncate(blk, filesize, false, PREALLOC_MODE_OFF, 0, errp);
         goto exit;
     }
     magic = cpu_to_be32(VMDK4_MAGIC);
@@ -XXX,XX +XXX,XX @@ static int vmdk_init_extent(BlockBackend *blk,
     }
 
     ret = blk_truncate(blk, le64_to_cpu(header.grain_offset) << 9, false,
-                       PREALLOC_MODE_OFF, errp);
+                       PREALLOC_MODE_OFF, 0, errp);
     if (ret < 0) {
         goto exit;
     }
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn vmdk_co_do_create(int64_t size,
     /* bdrv_pwrite write padding zeros to align to sector, we don't need that
      * for description file */
     if (desc_offset == 0) {
-        ret = blk_truncate(blk, desc_len, false, PREALLOC_MODE_OFF, errp);
+        ret = blk_truncate(blk, desc_len, false, PREALLOC_MODE_OFF, 0, errp);
         if (ret < 0) {
             goto exit;
         }
diff --git a/block/vpc.c b/block/vpc.c
index XXXXXXX..XXXXXXX 100644
--- a/block/vpc.c
+++ b/block/vpc.c
@@ -XXX,XX +XXX,XX @@ static int create_fixed_disk(BlockBackend *blk, uint8_t *buf,
     /* Add footer to total size */
     total_size += HEADER_SIZE;
 
-    ret = blk_truncate(blk, total_size, false, PREALLOC_MODE_OFF, errp);
+    ret = blk_truncate(blk, total_size, false, PREALLOC_MODE_OFF, 0, errp);
     if (ret < 0) {
         return ret;
     }
diff --git a/blockdev.c b/blockdev.c
index XXXXXXX..XXXXXXX 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -XXX,XX +XXX,XX @@ void qmp_block_resize(bool has_device, const char *device,
     }
 
     bdrv_drained_begin(bs);
-    ret = blk_truncate(blk, size, false, PREALLOC_MODE_OFF, errp);
+    ret = blk_truncate(blk, size, false, PREALLOC_MODE_OFF, 0, errp);
     bdrv_drained_end(bs);
 
 out:
diff --git a/qemu-img.c b/qemu-img.c
index XXXXXXX..XXXXXXX 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -XXX,XX +XXX,XX @@ static int img_resize(int argc, char **argv)
      * resizing, so pass @exact=true.  It is of no use to report
      * success when the image has not actually been resized.
      */
-    ret = blk_truncate(blk, total_size, true, prealloc, &err);
+    ret = blk_truncate(blk, total_size, true, prealloc, 0, &err);
     if (!ret) {
         qprintf(quiet, "Image resized.\n");
     } else {
diff --git a/qemu-io-cmds.c b/qemu-io-cmds.c
index XXXXXXX..XXXXXXX 100644
--- a/qemu-io-cmds.c
+++ b/qemu-io-cmds.c
@@ -XXX,XX +XXX,XX @@ static int truncate_f(BlockBackend *blk, int argc, char **argv)
      * exact=true.  It is better to err on the "emit more errors" side
      * than to be overly permissive.
      */
-    ret = blk_truncate(blk, offset, true, PREALLOC_MODE_OFF, &local_err);
+    ret = blk_truncate(blk, offset, true, PREALLOC_MODE_OFF, 0, &local_err);
     if (ret < 0) {
         error_report_err(local_err);
         return ret;
-- 
2.25.3

If BDRV_REQ_ZERO_WRITE is set and we're extending the image, calling
qcow2_cluster_zeroize() with flags=0 does the right thing: It doesn't
undo any previous preallocation, but just adds the zero flag to all
relevant L2 entries. If an external data file is in use, a write_zeroes
request to the data file is made instead.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20200424125448.63318-5-kwolf@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/qcow2-cluster.c |  2 +-
 block/qcow2.c         | 34 ++++++++++++++++++++++++++++++++++
 2 files changed, 35 insertions(+), 1 deletion(-)

diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
index XXXXXXX..XXXXXXX 100644
--- a/block/qcow2-cluster.c
+++ b/block/qcow2-cluster.c
@@ -XXX,XX +XXX,XX @@ int qcow2_cluster_zeroize(BlockDriverState *bs, uint64_t offset,
     /* Caller must pass aligned values, except at image end */
     assert(QEMU_IS_ALIGNED(offset, s->cluster_size));
     assert(QEMU_IS_ALIGNED(end_offset, s->cluster_size) ||
-           end_offset == bs->total_sectors << BDRV_SECTOR_BITS);
+           end_offset >= bs->total_sectors << BDRV_SECTOR_BITS);
 
     /* The zero flag is only supported by version 3 and newer */
     if (s->qcow_version < 3) {
diff --git a/block/qcow2.c b/block/qcow2.c
index XXXXXXX..XXXXXXX 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn qcow2_do_open(BlockDriverState *bs, QDict *options,
 
     bs->supported_zero_flags = header.version >= 3 ?
                                BDRV_REQ_MAY_UNMAP | BDRV_REQ_NO_FALLBACK : 0;
+    bs->supported_truncate_flags = BDRV_REQ_ZERO_WRITE;
 
     /* Repair image if dirty */
     if (!(flags & (BDRV_O_CHECK | BDRV_O_INACTIVE)) && !bs->read_only &&
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn qcow2_co_truncate(BlockDriverState *bs, int64_t offset,
         g_assert_not_reached();
     }
 
+    if ((flags & BDRV_REQ_ZERO_WRITE) && offset > old_length) {
+        uint64_t zero_start = QEMU_ALIGN_UP(old_length, s->cluster_size);
+
+        /*
+         * Use zero clusters as much as we can. qcow2_cluster_zeroize()
+         * requires a cluster-aligned start. The end may be unaligned if it is
+         * at the end of the image (which it is here).
+         */
+        ret = qcow2_cluster_zeroize(bs, zero_start, offset - zero_start, 0);
+        if (ret < 0) {
+            error_setg_errno(errp, -ret, "Failed to zero out new clusters");
+            goto fail;
+        }
+
+        /* Write explicit zeros for the unaligned head */
+        if (zero_start > old_length) {
+            uint64_t len = zero_start - old_length;
+            uint8_t *buf = qemu_blockalign0(bs, len);
+            QEMUIOVector qiov;
+            qemu_iovec_init_buf(&qiov, buf, len);
+
+            qemu_co_mutex_unlock(&s->lock);
+            ret = qcow2_co_pwritev_part(bs, old_length, len, &qiov, 0, 0);
+            qemu_co_mutex_lock(&s->lock);
+
+            qemu_vfree(buf);
+            if (ret < 0) {
+                error_setg_errno(errp, -ret, "Failed to zero out the new area");
+                goto fail;
+            }
+        }
+    }
+
     if (prealloc != PREALLOC_MODE_OFF) {
         /* Flush metadata before actually changing the image size */
         ret = qcow2_write_caches(bs);
-- 
2.25.3

The raw format driver can simply forward the flag and let its bs->file
child take care of actually providing the zeros.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20200424125448.63318-6-kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/raw-format.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/block/raw-format.c b/block/raw-format.c
index XXXXXXX..XXXXXXX 100644
--- a/block/raw-format.c
+++ b/block/raw-format.c
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn raw_co_truncate(BlockDriverState *bs, int64_t offset,
 
     s->size = offset;
     offset += s->offset;
-    return bdrv_co_truncate(bs->file, offset, exact, prealloc, 0, errp);
+    return bdrv_co_truncate(bs->file, offset, exact, prealloc, flags, errp);
 }
 
 static void raw_eject(BlockDriverState *bs, bool eject_flag)
@@ -XXX,XX +XXX,XX @@ static int raw_open(BlockDriverState *bs, QDict *options, int flags,
     bs->supported_zero_flags = BDRV_REQ_WRITE_UNCHANGED |
         ((BDRV_REQ_FUA | BDRV_REQ_MAY_UNMAP | BDRV_REQ_NO_FALLBACK) &
             bs->file->bs->supported_zero_flags);
+    bs->supported_truncate_flags = bs->file->bs->supported_truncate_flags &
+                                   BDRV_REQ_ZERO_WRITE;
 
     if (bs->probed && !bdrv_is_read_only(bs)) {
         bdrv_refresh_filename(bs->file->bs);
-- 
2.25.3

For regular files, we always get BDRV_REQ_ZERO_WRITE behaviour from the
OS, so we can advertise the flag and just ignore it.

diff --git a/block/file-posix.c b/block/file-posix.c
index XXXXXXX..XXXXXXX 100644
--- a/block/file-posix.c
+++ b/block/file-posix.c
@@ -XXX,XX +XXX,XX @@ static int raw_open_common(BlockDriverState *bs, QDict *options,
 #endif
 
     bs->supported_zero_flags = BDRV_REQ_MAY_UNMAP | BDRV_REQ_NO_FALLBACK;
+    if (S_ISREG(st.st_mode)) {
+        /* When extending regular files, we get zeros from the OS */
+        bs->supported_truncate_flags = BDRV_REQ_ZERO_WRITE;
+    }
     ret = 0;
 fail:
     if (filename && (bdrv_flags & BDRV_O_TEMPORARY)) {
-- 
2.25.3

When extending the size of an image that has a backing file larger than
its old size, make sure that the backing file data doesn't become
visible in the guest, but the added area is properly zeroed out.

Consider the following scenario where the overlay is shorter than its
backing file:

base.qcow2:     AAAAAAAA
    overlay.qcow2:  BBBB

When resizing (extending) overlay.qcow2, the new blocks should not stay
unallocated and make the additional As from base.qcow2 visible like
before this patch, but zeros should be read.

A similar case happens with the various variants of a commit job when an
intermediate file is short (- for unallocated):

base.qcow2:     A-A-AAAA
    mid.qcow2:      BB-B
    top.qcow2:      C--C--C-

After commit top.qcow2 to mid.qcow2, the following happens:

mid.qcow2:      CB-C00C0 (correct result)
    mid.qcow2:      CB-C--C- (before this fix)

Without the fix, blocks that previously read as zeros on top.qcow2
suddenly turn into A.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20200424125448.63318-8-kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/io.c | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/block/io.c b/block/io.c
index XXXXXXX..XXXXXXX 100644
--- a/block/io.c
+++ b/block/io.c
@@ -XXX,XX +XXX,XX @@ int coroutine_fn bdrv_co_truncate(BdrvChild *child, int64_t offset, bool exact,
         goto out;
     }
 
+    /*
+     * If the image has a backing file that is large enough that it would
+     * provide data for the new area, we cannot leave it unallocated because
+     * then the backing file content would become visible. Instead, zero-fill
+     * the new area.
+     *
+     * Note that if the image has a backing file, but was opened without the
+     * backing file, taking care of keeping things consistent with that backing
+     * file is the user's responsibility.
+     */
+    if (new_bytes && bs->backing) {
+        int64_t backing_len;
+
+        backing_len = bdrv_getlength(backing_bs(bs));
+        if (backing_len < 0) {
+            ret = backing_len;
+            error_setg_errno(errp, -ret, "Could not get backing file size");
+            goto out;
+        }
+
+        if (backing_len > old_size) {
+            flags |= BDRV_REQ_ZERO_WRITE;
+        }
+    }
+
     if (drv->bdrv_co_truncate) {
         if (flags & ~bs->supported_truncate_flags) {
             error_setg(errp, "Block driver does not support requested flags");
-- 
2.25.3

We want to keep TEST_IMG for the full path of the main test image, but
filter_testfiles() must be called for other test images before replacing
other things like the image format because the test directory path could
contain the format as a substring.

Insert a filter_testfiles() call between both.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20200424125448.63318-9-kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 tests/qemu-iotests/iotests.py | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/tests/qemu-iotests/iotests.py b/tests/qemu-iotests/iotests.py
index XXXXXXX..XXXXXXX 100644
--- a/tests/qemu-iotests/iotests.py
+++ b/tests/qemu-iotests/iotests.py
@@ -XXX,XX +XXX,XX @@ def filter_img_info(output, filename):
     for line in output.split('\n'):
         if 'disk size' in line or 'actual-size' in line:
             continue
-        line = line.replace(filename, 'TEST_IMG') \
-                   .replace(imgfmt, 'IMGFMT')
+        line = line.replace(filename, 'TEST_IMG')
+        line = filter_testfiles(line)
+        line = line.replace(imgfmt, 'IMGFMT')
         line = re.sub('iters: [0-9]+', 'iters: XXX', line)
         line = re.sub('uuid: [-a-f0-9]+', 'uuid: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX', line)
         line = re.sub('cid: [0-9]+', 'cid: XXXXXXXXXX', line)
-- 
2.25.3

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20200424125448.63318-10-kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 tests/qemu-iotests/274     | 155 +++++++++++++++++++++
 tests/qemu-iotests/274.out | 268 +++++++++++++++++++++++++++++++++++++
 tests/qemu-iotests/group   |   1 +
 3 files changed, 424 insertions(+)
 create mode 100755 tests/qemu-iotests/274
 create mode 100644 tests/qemu-iotests/274.out

diff --git a/tests/qemu-iotests/274 b/tests/qemu-iotests/274
new file mode 100755
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/qemu-iotests/274
@@ -XXX,XX +XXX,XX @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2019 Red Hat, Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+# Creator/Owner: Kevin Wolf <kwolf@redhat.com>
+#
+# Some tests for short backing files and short overlays
+
+import iotests
+
+iotests.verify_image_format(supported_fmts=['qcow2'])
+iotests.verify_platform(['linux'])
+
+size_short = 1 * 1024 * 1024
+size_long = 2 * 1024 * 1024
+size_diff = size_long - size_short
+
+def create_chain() -> None:
+    iotests.qemu_img_log('create', '-f', iotests.imgfmt, base,
+                         str(size_long))
+    iotests.qemu_img_log('create', '-f', iotests.imgfmt, '-b', base, mid,
+                         str(size_short))
+    iotests.qemu_img_log('create', '-f', iotests.imgfmt, '-b', mid, top,
+                         str(size_long))
+
+    iotests.qemu_io_log('-c', 'write -P 1 0 %d' % size_long, base)
+
+def create_vm() -> iotests.VM:
+    vm = iotests.VM()
+    vm.add_blockdev('file,filename=%s,node-name=base-file' % base)
+    vm.add_blockdev('%s,file=base-file,node-name=base' % iotests.imgfmt)
+    vm.add_blockdev('file,filename=%s,node-name=mid-file' % mid)
+    vm.add_blockdev('%s,file=mid-file,node-name=mid,backing=base'
+                    % iotests.imgfmt)
+    vm.add_drive(top, 'backing=mid,node-name=top')
+    return vm
+
+with iotests.FilePath('base') as base, \
+     iotests.FilePath('mid') as mid, \
+     iotests.FilePath('top') as top:
+
+    iotests.log('== Commit tests ==')
+
+    create_chain()
+
+    iotests.log('=== Check visible data ===')
+
+    iotests.qemu_io_log('-c', 'read -P 1 0 %d' % size_short, top)
+    iotests.qemu_io_log('-c', 'read -P 0 %d %d' % (size_short, size_diff), top)
+
+    iotests.log('=== Checking allocation status ===')
+
+    iotests.qemu_io_log('-c', 'alloc 0 %d' % size_short,
+                        '-c', 'alloc %d %d' % (size_short, size_diff),
+                        base)
+
+    iotests.qemu_io_log('-c', 'alloc 0 %d' % size_short,
+                        '-c', 'alloc %d %d' % (size_short, size_diff),
+                        mid)
+
+    iotests.qemu_io_log('-c', 'alloc 0 %d' % size_short,
+                        '-c', 'alloc %d %d' % (size_short, size_diff),
+                        top)
+
+    iotests.log('=== Checking map ===')
+
+    iotests.qemu_img_log('map', '--output=json', base)
+    iotests.qemu_img_log('map', '--output=human', base)
+    iotests.qemu_img_log('map', '--output=json', mid)
+    iotests.qemu_img_log('map', '--output=human', mid)
+    iotests.qemu_img_log('map', '--output=json', top)
+    iotests.qemu_img_log('map', '--output=human', top)
+
+    iotests.log('=== Testing qemu-img commit (top -> mid) ===')
+
+    iotests.qemu_img_log('commit', top)
+    iotests.img_info_log(mid)
+    iotests.qemu_io_log('-c', 'read -P 1 0 %d' % size_short, mid)
+    iotests.qemu_io_log('-c', 'read -P 0 %d %d' % (size_short, size_diff), mid)
+
+    iotests.log('=== Testing HMP commit (top -> mid) ===')
+
+    create_chain()
+    with create_vm() as vm:
+        vm.launch()
+        vm.qmp_log('human-monitor-command', command_line='commit drive0')
+
+    iotests.img_info_log(mid)
+    iotests.qemu_io_log('-c', 'read -P 1 0 %d' % size_short, mid)
+    iotests.qemu_io_log('-c', 'read -P 0 %d %d' % (size_short, size_diff), mid)
+
+    iotests.log('=== Testing QMP active commit (top -> mid) ===')
+
+    create_chain()
+    with create_vm() as vm:
+        vm.launch()
+        vm.qmp_log('block-commit', device='top', base_node='mid',
+                   job_id='job0', auto_dismiss=False)
+        vm.run_job('job0', wait=5)
+
+    iotests.img_info_log(mid)
+    iotests.qemu_io_log('-c', 'read -P 1 0 %d' % size_short, mid)
+    iotests.qemu_io_log('-c', 'read -P 0 %d %d' % (size_short, size_diff), mid)
+
+
+    iotests.log('== Resize tests ==')
+
+    # Use different sizes for different allocation modes:
+    #
+    # We want to have at least one test where 32 bit truncation in the size of
+    # the overlapping area becomes visible. This is covered by the
+    # prealloc='off' case (1G to 6G is an overlap of 5G).
+    #
+    # However, we can only do this for modes that don't preallocate data
+    # because otherwise we might run out of space on the test host.
+    #
+    # We also want to test some unaligned combinations.
+    for (prealloc, base_size, top_size_old, top_size_new, off) in [
+            ('off',       '6G',    '1G',   '8G',   '5G'),
+            ('metadata', '32G',   '30G',  '33G',  '31G'),
+            ('falloc',   '10M',    '5M',  '15M',   '9M'),
+            ('full',     '16M',    '8M',  '12M',  '11M'),
+            ('off',      '384k', '253k', '512k', '253k'),
+            ('off',      '400k', '256k', '512k', '336k'),
+            ('off',      '512k', '256k', '500k', '436k')]:
+
+        iotests.log('=== preallocation=%s ===' % prealloc)
+        iotests.qemu_img_log('create', '-f', iotests.imgfmt, base, base_size)
+        iotests.qemu_img_log('create', '-f', iotests.imgfmt, '-b', base, top,
+                             top_size_old)
+        iotests.qemu_io_log('-c', 'write -P 1 %s 64k' % off, base)
+
+        # After this, top_size_old to base_size should be allocated/zeroed.
+        #
+        # In theory, leaving base_size to top_size_new unallocated would be
+        # correct, but in practice, if we zero out anything, we zero out
+        # everything up to top_size_new.
+        iotests.qemu_img_log('resize', '-f', iotests.imgfmt,
+                             '--preallocation', prealloc, top, top_size_new)
+        iotests.qemu_io_log('-c', 'read -P 0 %s 64k' % off, top)
+        iotests.qemu_io_log('-c', 'map', top)
+        iotests.qemu_img_log('map', '--output=json', top)
diff --git a/tests/qemu-iotests/274.out b/tests/qemu-iotests/274.out
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/qemu-iotests/274.out
@@ -XXX,XX +XXX,XX @@
+== Commit tests ==
+Formatting 'TEST_DIR/PID-base', fmt=qcow2 size=2097152 cluster_size=65536 lazy_refcounts=off refcount_bits=16
+
+Formatting 'TEST_DIR/PID-mid', fmt=qcow2 size=1048576 backing_file=TEST_DIR/PID-base cluster_size=65536 lazy_refcounts=off refcount_bits=16
+
+Formatting 'TEST_DIR/PID-top', fmt=qcow2 size=2097152 backing_file=TEST_DIR/PID-mid cluster_size=65536 lazy_refcounts=off refcount_bits=16
+
+wrote 2097152/2097152 bytes at offset 0
+2 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+=== Check visible data ===
+read 1048576/1048576 bytes at offset 0
+1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+read 1048576/1048576 bytes at offset 1048576
+1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+=== Checking allocation status ===
+1048576/1048576 bytes allocated at offset 0 bytes
+1048576/1048576 bytes allocated at offset 1 MiB
+
+0/1048576 bytes allocated at offset 0 bytes
+0/0 bytes allocated at offset 1 MiB
+
+0/1048576 bytes allocated at offset 0 bytes
+0/1048576 bytes allocated at offset 1 MiB
+
+=== Checking map ===
+[{ "start": 0, "length": 2097152, "depth": 0, "zero": false, "data": true, "offset": 327680}]
+
+Offset          Length          Mapped to       File
+0               0x200000        0x50000         TEST_DIR/PID-base
+
+[{ "start": 0, "length": 1048576, "depth": 1, "zero": false, "data": true, "offset": 327680}]
+
+Offset          Length          Mapped to       File
+0               0x100000        0x50000         TEST_DIR/PID-base
+
+[{ "start": 0, "length": 1048576, "depth": 2, "zero": false, "data": true, "offset": 327680},
+{ "start": 1048576, "length": 1048576, "depth": 0, "zero": true, "data": false}]
+
+Offset          Length          Mapped to       File
+0               0x100000        0x50000         TEST_DIR/PID-base
+
+=== Testing qemu-img commit (top -> mid) ===
+Image committed.
+
+image: TEST_IMG
+file format: IMGFMT
+virtual size: 2 MiB (2097152 bytes)
+cluster_size: 65536
+backing file: TEST_DIR/PID-base
+Format specific information:
+    compat: 1.1
+    lazy refcounts: false
+    refcount bits: 16
+    corrupt: false
+
+read 1048576/1048576 bytes at offset 0
+1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+read 1048576/1048576 bytes at offset 1048576
+1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+=== Testing HMP commit (top -> mid) ===
+Formatting 'TEST_DIR/PID-base', fmt=qcow2 size=2097152 cluster_size=65536 lazy_refcounts=off refcount_bits=16
+
+Formatting 'TEST_DIR/PID-mid', fmt=qcow2 size=1048576 backing_file=TEST_DIR/PID-base cluster_size=65536 lazy_refcounts=off refcount_bits=16
+
+Formatting 'TEST_DIR/PID-top', fmt=qcow2 size=2097152 backing_file=TEST_DIR/PID-mid cluster_size=65536 lazy_refcounts=off refcount_bits=16
+
+wrote 2097152/2097152 bytes at offset 0
+2 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+{"execute": "human-monitor-command", "arguments": {"command-line": "commit drive0"}}
+{"return": ""}
+image: TEST_IMG
+file format: IMGFMT
+virtual size: 2 MiB (2097152 bytes)
+cluster_size: 65536
+backing file: TEST_DIR/PID-base
+Format specific information:
+    compat: 1.1
+    lazy refcounts: false
+    refcount bits: 16
+    corrupt: false
+
+read 1048576/1048576 bytes at offset 0
+1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+read 1048576/1048576 bytes at offset 1048576
+1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+=== Testing QMP active commit (top -> mid) ===
+Formatting 'TEST_DIR/PID-base', fmt=qcow2 size=2097152 cluster_size=65536 lazy_refcounts=off refcount_bits=16
+
+Formatting 'TEST_DIR/PID-mid', fmt=qcow2 size=1048576 backing_file=TEST_DIR/PID-base cluster_size=65536 lazy_refcounts=off refcount_bits=16
+
+Formatting 'TEST_DIR/PID-top', fmt=qcow2 size=2097152 backing_file=TEST_DIR/PID-mid cluster_size=65536 lazy_refcounts=off refcount_bits=16
+
+wrote 2097152/2097152 bytes at offset 0
+2 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+{"execute": "block-commit", "arguments": {"auto-dismiss": false, "base-node": "mid", "device": "top", "job-id": "job0"}}
+{"return": {}}
+{"execute": "job-complete", "arguments": {"id": "job0"}}
+{"return": {}}
+{"data": {"device": "job0", "len": 0, "offset": 0, "speed": 0, "type": "commit"}, "event": "BLOCK_JOB_READY", "timestamp": {"microseconds": "USECS", "seconds": "SECS"}}
+{"data": {"device": "job0", "len": 0, "offset": 0, "speed": 0, "type": "commit"}, "event": "BLOCK_JOB_COMPLETED", "timestamp": {"microseconds": "USECS", "seconds": "SECS"}}
+{"execute": "job-dismiss", "arguments": {"id": "job0"}}
+{"return": {}}
+image: TEST_IMG
+file format: IMGFMT
+virtual size: 2 MiB (2097152 bytes)
+cluster_size: 65536
+backing file: TEST_DIR/PID-base
+Format specific information:
+    compat: 1.1
+    lazy refcounts: false
+    refcount bits: 16
+    corrupt: false
+
+read 1048576/1048576 bytes at offset 0
+1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+read 1048576/1048576 bytes at offset 1048576
+1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+== Resize tests ==
+=== preallocation=off ===
+Formatting 'TEST_DIR/PID-base', fmt=qcow2 size=6442450944 cluster_size=65536 lazy_refcounts=off refcount_bits=16
+
+Formatting 'TEST_DIR/PID-top', fmt=qcow2 size=1073741824 backing_file=TEST_DIR/PID-base cluster_size=65536 lazy_refcounts=off refcount_bits=16
+
+wrote 65536/65536 bytes at offset 5368709120
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+Image resized.
+
+read 65536/65536 bytes at offset 5368709120
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+1 GiB (0x40000000) bytes not allocated at offset 0 bytes (0x0)
+7 GiB (0x1c0000000) bytes     allocated at offset 1 GiB (0x40000000)
+
+[{ "start": 0, "length": 1073741824, "depth": 1, "zero": true, "data": false},
+{ "start": 1073741824, "length": 7516192768, "depth": 0, "zero": true, "data": false}]
+
+=== preallocation=metadata ===
+Formatting 'TEST_DIR/PID-base', fmt=qcow2 size=34359738368 cluster_size=65536 lazy_refcounts=off refcount_bits=16
+
+Formatting 'TEST_DIR/PID-top', fmt=qcow2 size=32212254720 backing_file=TEST_DIR/PID-base cluster_size=65536 lazy_refcounts=off refcount_bits=16
+
+wrote 65536/65536 bytes at offset 33285996544
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+Image resized.
+
+read 65536/65536 bytes at offset 33285996544
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+30 GiB (0x780000000) bytes not allocated at offset 0 bytes (0x0)
+3 GiB (0xc0000000) bytes     allocated at offset 30 GiB (0x780000000)
+
+[{ "start": 0, "length": 32212254720, "depth": 1, "zero": true, "data": false},
+{ "start": 32212254720, "length": 536870912, "depth": 0, "zero": true, "data": false, "offset": 327680},
+{ "start": 32749125632, "length": 536870912, "depth": 0, "zero": true, "data": false, "offset": 537264128},
+{ "start": 33285996544, "length": 536870912, "depth": 0, "zero": true, "data": false, "offset": 1074200576},
+{ "start": 33822867456, "length": 536870912, "depth": 0, "zero": true, "data": false, "offset": 1611137024},
+{ "start": 34359738368, "length": 536870912, "depth": 0, "zero": true, "data": false, "offset": 2148139008},
+{ "start": 34896609280, "length": 536870912, "depth": 0, "zero": true, "data": false, "offset": 2685075456}]
+
+=== preallocation=falloc ===
+Formatting 'TEST_DIR/PID-base', fmt=qcow2 size=10485760 cluster_size=65536 lazy_refcounts=off refcount_bits=16
+
+Formatting 'TEST_DIR/PID-top', fmt=qcow2 size=5242880 backing_file=TEST_DIR/PID-base cluster_size=65536 lazy_refcounts=off refcount_bits=16
+
+wrote 65536/65536 bytes at offset 9437184
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+Image resized.
+
+read 65536/65536 bytes at offset 9437184
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+5 MiB (0x500000) bytes not allocated at offset 0 bytes (0x0)
+10 MiB (0xa00000) bytes     allocated at offset 5 MiB (0x500000)
+
+[{ "start": 0, "length": 5242880, "depth": 1, "zero": true, "data": false},
+{ "start": 5242880, "length": 10485760, "depth": 0, "zero": true, "data": false, "offset": 327680}]
+
+=== preallocation=full ===
+Formatting 'TEST_DIR/PID-base', fmt=qcow2 size=16777216 cluster_size=65536 lazy_refcounts=off refcount_bits=16
+
+Formatting 'TEST_DIR/PID-top', fmt=qcow2 size=8388608 backing_file=TEST_DIR/PID-base cluster_size=65536 lazy_refcounts=off refcount_bits=16
+
+wrote 65536/65536 bytes at offset 11534336
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+Image resized.
+
+read 65536/65536 bytes at offset 11534336
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+8 MiB (0x800000) bytes not allocated at offset 0 bytes (0x0)
+4 MiB (0x400000) bytes     allocated at offset 8 MiB (0x800000)
+
+[{ "start": 0, "length": 8388608, "depth": 1, "zero": true, "data": false},
+{ "start": 8388608, "length": 4194304, "depth": 0, "zero": true, "data": false, "offset": 327680}]
+
+=== preallocation=off ===
+Formatting 'TEST_DIR/PID-base', fmt=qcow2 size=393216 cluster_size=65536 lazy_refcounts=off refcount_bits=16
+
+Formatting 'TEST_DIR/PID-top', fmt=qcow2 size=259072 backing_file=TEST_DIR/PID-base cluster_size=65536 lazy_refcounts=off refcount_bits=16
+
+wrote 65536/65536 bytes at offset 259072
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+Image resized.
+
+read 65536/65536 bytes at offset 259072
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+192 KiB (0x30000) bytes not allocated at offset 0 bytes (0x0)
+320 KiB (0x50000) bytes     allocated at offset 192 KiB (0x30000)
+
+[{ "start": 0, "length": 196608, "depth": 1, "zero": true, "data": false},
+{ "start": 196608, "length": 65536, "depth": 0, "zero": false, "data": true, "offset": 327680},
+{ "start": 262144, "length": 262144, "depth": 0, "zero": true, "data": false}]
+
+=== preallocation=off ===
+Formatting 'TEST_DIR/PID-base', fmt=qcow2 size=409600 cluster_size=65536 lazy_refcounts=off refcount_bits=16
+
+Formatting 'TEST_DIR/PID-top', fmt=qcow2 size=262144 backing_file=TEST_DIR/PID-base cluster_size=65536 lazy_refcounts=off refcount_bits=16
+
+wrote 65536/65536 bytes at offset 344064
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+Image resized.
+
+read 65536/65536 bytes at offset 344064
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+256 KiB (0x40000) bytes not allocated at offset 0 bytes (0x0)
+256 KiB (0x40000) bytes     allocated at offset 256 KiB (0x40000)
+
+[{ "start": 0, "length": 262144, "depth": 1, "zero": true, "data": false},
+{ "start": 262144, "length": 262144, "depth": 0, "zero": true, "data": false}]
+
+=== preallocation=off ===
+Formatting 'TEST_DIR/PID-base', fmt=qcow2 size=524288 cluster_size=65536 lazy_refcounts=off refcount_bits=16
+
+Formatting 'TEST_DIR/PID-top', fmt=qcow2 size=262144 backing_file=TEST_DIR/PID-base cluster_size=65536 lazy_refcounts=off refcount_bits=16
+
+wrote 65536/65536 bytes at offset 446464
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+Image resized.
+
+read 65536/65536 bytes at offset 446464
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+256 KiB (0x40000) bytes not allocated at offset 0 bytes (0x0)
+244 KiB (0x3d000) bytes     allocated at offset 256 KiB (0x40000)
+
+[{ "start": 0, "length": 262144, "depth": 1, "zero": true, "data": false},
+{ "start": 262144, "length": 249856, "depth": 0, "zero": true, "data": false}]
+
diff --git a/tests/qemu-iotests/group b/tests/qemu-iotests/group
index XXXXXXX..XXXXXXX 100644
--- a/tests/qemu-iotests/group
+++ b/tests/qemu-iotests/group
@@ -XXX,XX +XXX,XX @@
 270 rw backing quick
 272 rw
 273 backing quick
+274 rw backing
 277 rw quick
 279 rw backing quick
 280 rw migration quick
-- 
2.25.3

The BDRV_REQ_ZERO_WRITE is currently implemented in a way that first the
image is possibly preallocated and then the zero flag is added to all
clusters. This means that a copy-on-write operation may be needed when
writing to these clusters, despite having used preallocation, negating
one of the major benefits of preallocation.

Instead, try to forward the BDRV_REQ_ZERO_WRITE to the protocol driver,
and if the protocol driver can ensure that the new area reads as zeros,
we can skip setting the zero flag in the qcow2 layer.

Unfortunately, the same approach doesn't work for metadata
preallocation, so we'll still set the zero flag there.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Message-Id: <20200424142701.67053-1-kwolf@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/qcow2.c              | 22 +++++++++++++++++++---
 tests/qemu-iotests/274.out |  4 ++--
 2 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/block/qcow2.c b/block/qcow2.c
index XXXXXXX..XXXXXXX 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn qcow2_co_truncate(BlockDriverState *bs, int64_t offset,
         /* Allocate the data area */
         new_file_size = allocation_start +
                         nb_new_data_clusters * s->cluster_size;
-        /* Image file grows, so @exact does not matter */
-        ret = bdrv_co_truncate(bs->file, new_file_size, false, prealloc, 0,
-                               errp);
+        /*
+         * Image file grows, so @exact does not matter.
+         *
+         * If we need to zero out the new area, try first whether the protocol
+         * driver can already take care of this.
+         */
+        if (flags & BDRV_REQ_ZERO_WRITE) {
+            ret = bdrv_co_truncate(bs->file, new_file_size, false, prealloc,
+                                   BDRV_REQ_ZERO_WRITE, NULL);
+            if (ret >= 0) {
+                flags &= ~BDRV_REQ_ZERO_WRITE;
+            }
+        } else {
+            ret = -1;
+        }
+        if (ret < 0) {
+            ret = bdrv_co_truncate(bs->file, new_file_size, false, prealloc, 0,
+                                   errp);
+        }
         if (ret < 0) {
             error_prepend(errp, "Failed to resize underlying file: ");
             qcow2_free_clusters(bs, allocation_start,
diff --git a/tests/qemu-iotests/274.out b/tests/qemu-iotests/274.out
index XXXXXXX..XXXXXXX 100644
--- a/tests/qemu-iotests/274.out
+++ b/tests/qemu-iotests/274.out
@@ -XXX,XX +XXX,XX @@ read 65536/65536 bytes at offset 9437184
 10 MiB (0xa00000) bytes     allocated at offset 5 MiB (0x500000)
 
 [{ "start": 0, "length": 5242880, "depth": 1, "zero": true, "data": false},
-{ "start": 5242880, "length": 10485760, "depth": 0, "zero": true, "data": false, "offset": 327680}]
+{ "start": 5242880, "length": 10485760, "depth": 0, "zero": false, "data": true, "offset": 327680}]
 
 === preallocation=full ===
 Formatting 'TEST_DIR/PID-base', fmt=qcow2 size=16777216 cluster_size=65536 lazy_refcounts=off refcount_bits=16
@@ -XXX,XX +XXX,XX @@ read 65536/65536 bytes at offset 11534336
 4 MiB (0x400000) bytes     allocated at offset 8 MiB (0x800000)
 
 [{ "start": 0, "length": 8388608, "depth": 1, "zero": true, "data": false},
-{ "start": 8388608, "length": 4194304, "depth": 0, "zero": true, "data": false, "offset": 327680}]
+{ "start": 8388608, "length": 4194304, "depth": 0, "zero": false, "data": true, "offset": 327680}]
 
 === preallocation=off ===
 Formatting 'TEST_DIR/PID-base', fmt=qcow2 size=393216 cluster_size=65536 lazy_refcounts=off refcount_bits=16
-- 
2.25.3

From: Andrzej Jakowski <andrzej.jakowski@linux.intel.com>

This patch introduces support for PMR that has been defined as part of NVMe 1.4
spec. User can now specify a pmrdev option that should point to HostMemoryBackend.
pmrdev memory region will subsequently be exposed as PCI BAR 2 in emulated NVMe
device. Guest OS can perform mmio read and writes to the PMR region that will stay
persistent across system reboot.

Signed-off-by: Andrzej Jakowski <andrzej.jakowski@linux.intel.com>
Reviewed-by: Klaus Jensen <k.jensen@samsung.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20200330164656.9348-1-andrzej.jakowski@linux.intel.com>
Reviewed-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 hw/block/nvme.h        |   2 +
 include/block/nvme.h   | 172 +++++++++++++++++++++++++++++++++++++++++
 hw/block/nvme.c        | 109 ++++++++++++++++++++++++++
 hw/block/Makefile.objs |   2 +-
 hw/block/trace-events  |   4 +
 5 files changed, 288 insertions(+), 1 deletion(-)

diff --git a/hw/block/nvme.h b/hw/block/nvme.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/nvme.h
+++ b/hw/block/nvme.h
@@ -XXX,XX +XXX,XX @@ typedef struct NvmeCtrl {
     uint64_t    timestamp_set_qemu_clock_ms;    /* QEMU clock time */
 
     char            *serial;
+    HostMemoryBackend *pmrdev;
+
     NvmeNamespace   *namespaces;
     NvmeSQueue      **sq;
     NvmeCQueue      **cq;
diff --git a/include/block/nvme.h b/include/block/nvme.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/nvme.h
+++ b/include/block/nvme.h
@@ -XXX,XX +XXX,XX @@ typedef struct NvmeBar {
     uint64_t    acq;
     uint32_t    cmbloc;
     uint32_t    cmbsz;
+    uint8_t     padding[3520]; /* not used by QEMU */
+    uint32_t    pmrcap;
+    uint32_t    pmrctl;
+    uint32_t    pmrsts;
+    uint32_t    pmrebs;
+    uint32_t    pmrswtp;
+    uint32_t    pmrmsc;
 } NvmeBar;
 
 enum NvmeCapShift {
@@ -XXX,XX +XXX,XX @@ enum NvmeCapShift {
     CAP_CSS_SHIFT      = 37,
     CAP_MPSMIN_SHIFT   = 48,
     CAP_MPSMAX_SHIFT   = 52,
+    CAP_PMR_SHIFT      = 56,
 };
 
 enum NvmeCapMask {
@@ -XXX,XX +XXX,XX @@ enum NvmeCapMask {
     CAP_CSS_MASK       = 0xff,
     CAP_MPSMIN_MASK    = 0xf,
     CAP_MPSMAX_MASK    = 0xf,
+    CAP_PMR_MASK       = 0x1,
 };
 
 #define NVME_CAP_MQES(cap)  (((cap) >> CAP_MQES_SHIFT)   & CAP_MQES_MASK)
@@ -XXX,XX +XXX,XX @@ enum NvmeCapMask {
                                                            << CAP_MPSMIN_SHIFT)
 #define NVME_CAP_SET_MPSMAX(cap, val) (cap |= (uint64_t)(val & CAP_MPSMAX_MASK)\
                                                             << CAP_MPSMAX_SHIFT)
+#define NVME_CAP_SET_PMRS(cap, val) (cap |= (uint64_t)(val & CAP_PMR_MASK)\
+                                                            << CAP_PMR_SHIFT)
 
 enum NvmeCcShift {
     CC_EN_SHIFT     = 0,
@@ -XXX,XX +XXX,XX @@ enum NvmeCmbszMask {
 #define NVME_CMBSZ_GETSIZE(cmbsz) \
     (NVME_CMBSZ_SZ(cmbsz) * (1 << (12 + 4 * NVME_CMBSZ_SZU(cmbsz))))
 
+enum NvmePmrcapShift {
+    PMRCAP_RDS_SHIFT      = 3,
+    PMRCAP_WDS_SHIFT      = 4,
+    PMRCAP_BIR_SHIFT      = 5,
+    PMRCAP_PMRTU_SHIFT    = 8,
+    PMRCAP_PMRWBM_SHIFT   = 10,
+    PMRCAP_PMRTO_SHIFT    = 16,
+    PMRCAP_CMSS_SHIFT     = 24,
+};
+
+enum NvmePmrcapMask {
+    PMRCAP_RDS_MASK      = 0x1,
+    PMRCAP_WDS_MASK      = 0x1,
+    PMRCAP_BIR_MASK      = 0x7,
+    PMRCAP_PMRTU_MASK    = 0x3,
+    PMRCAP_PMRWBM_MASK   = 0xf,
+    PMRCAP_PMRTO_MASK    = 0xff,
+    PMRCAP_CMSS_MASK     = 0x1,
+};
+
+#define NVME_PMRCAP_RDS(pmrcap)    \
+    ((pmrcap >> PMRCAP_RDS_SHIFT)   & PMRCAP_RDS_MASK)
+#define NVME_PMRCAP_WDS(pmrcap)    \
+    ((pmrcap >> PMRCAP_WDS_SHIFT)   & PMRCAP_WDS_MASK)
+#define NVME_PMRCAP_BIR(pmrcap)    \
+    ((pmrcap >> PMRCAP_BIR_SHIFT)   & PMRCAP_BIR_MASK)
+#define NVME_PMRCAP_PMRTU(pmrcap)    \
+    ((pmrcap >> PMRCAP_PMRTU_SHIFT)   & PMRCAP_PMRTU_MASK)
+#define NVME_PMRCAP_PMRWBM(pmrcap)    \
+    ((pmrcap >> PMRCAP_PMRWBM_SHIFT)   & PMRCAP_PMRWBM_MASK)
+#define NVME_PMRCAP_PMRTO(pmrcap)    \
+    ((pmrcap >> PMRCAP_PMRTO_SHIFT)   & PMRCAP_PMRTO_MASK)
+#define NVME_PMRCAP_CMSS(pmrcap)    \
+    ((pmrcap >> PMRCAP_CMSS_SHIFT)   & PMRCAP_CMSS_MASK)
+
+#define NVME_PMRCAP_SET_RDS(pmrcap, val)   \
+    (pmrcap |= (uint64_t)(val & PMRCAP_RDS_MASK) << PMRCAP_RDS_SHIFT)
+#define NVME_PMRCAP_SET_WDS(pmrcap, val)   \
+    (pmrcap |= (uint64_t)(val & PMRCAP_WDS_MASK) << PMRCAP_WDS_SHIFT)
+#define NVME_PMRCAP_SET_BIR(pmrcap, val)   \
+    (pmrcap |= (uint64_t)(val & PMRCAP_BIR_MASK) << PMRCAP_BIR_SHIFT)
+#define NVME_PMRCAP_SET_PMRTU(pmrcap, val)   \
+    (pmrcap |= (uint64_t)(val & PMRCAP_PMRTU_MASK) << PMRCAP_PMRTU_SHIFT)
+#define NVME_PMRCAP_SET_PMRWBM(pmrcap, val)   \
+    (pmrcap |= (uint64_t)(val & PMRCAP_PMRWBM_MASK) << PMRCAP_PMRWBM_SHIFT)
+#define NVME_PMRCAP_SET_PMRTO(pmrcap, val)   \
+    (pmrcap |= (uint64_t)(val & PMRCAP_PMRTO_MASK) << PMRCAP_PMRTO_SHIFT)
+#define NVME_PMRCAP_SET_CMSS(pmrcap, val)   \
+    (pmrcap |= (uint64_t)(val & PMRCAP_CMSS_MASK) << PMRCAP_CMSS_SHIFT)
+
+enum NvmePmrctlShift {
+    PMRCTL_EN_SHIFT   = 0,
+};
+
+enum NvmePmrctlMask {
+    PMRCTL_EN_MASK   = 0x1,
+};
+
+#define NVME_PMRCTL_EN(pmrctl)  ((pmrctl >> PMRCTL_EN_SHIFT)   & PMRCTL_EN_MASK)
+
+#define NVME_PMRCTL_SET_EN(pmrctl, val)   \
+    (pmrctl |= (uint64_t)(val & PMRCTL_EN_MASK) << PMRCTL_EN_SHIFT)
+
+enum NvmePmrstsShift {
+    PMRSTS_ERR_SHIFT    = 0,
+    PMRSTS_NRDY_SHIFT   = 8,
+    PMRSTS_HSTS_SHIFT   = 9,
+    PMRSTS_CBAI_SHIFT   = 12,
+};
+
+enum NvmePmrstsMask {
+    PMRSTS_ERR_MASK    = 0xff,
+    PMRSTS_NRDY_MASK   = 0x1,
+    PMRSTS_HSTS_MASK   = 0x7,
+    PMRSTS_CBAI_MASK   = 0x1,
+};
+
+#define NVME_PMRSTS_ERR(pmrsts)     \
+    ((pmrsts >> PMRSTS_ERR_SHIFT)   & PMRSTS_ERR_MASK)
+#define NVME_PMRSTS_NRDY(pmrsts)    \
+    ((pmrsts >> PMRSTS_NRDY_SHIFT)   & PMRSTS_NRDY_MASK)
+#define NVME_PMRSTS_HSTS(pmrsts)    \
+    ((pmrsts >> PMRSTS_HSTS_SHIFT)   & PMRSTS_HSTS_MASK)
+#define NVME_PMRSTS_CBAI(pmrsts)    \
+    ((pmrsts >> PMRSTS_CBAI_SHIFT)   & PMRSTS_CBAI_MASK)
+
+#define NVME_PMRSTS_SET_ERR(pmrsts, val)   \
+    (pmrsts |= (uint64_t)(val & PMRSTS_ERR_MASK) << PMRSTS_ERR_SHIFT)
+#define NVME_PMRSTS_SET_NRDY(pmrsts, val)   \
+    (pmrsts |= (uint64_t)(val & PMRSTS_NRDY_MASK) << PMRSTS_NRDY_SHIFT)
+#define NVME_PMRSTS_SET_HSTS(pmrsts, val)   \
+    (pmrsts |= (uint64_t)(val & PMRSTS_HSTS_MASK) << PMRSTS_HSTS_SHIFT)
+#define NVME_PMRSTS_SET_CBAI(pmrsts, val)   \
+    (pmrsts |= (uint64_t)(val & PMRSTS_CBAI_MASK) << PMRSTS_CBAI_SHIFT)
+
+enum NvmePmrebsShift {
+    PMREBS_PMRSZU_SHIFT   = 0,
+    PMREBS_RBB_SHIFT      = 4,
+    PMREBS_PMRWBZ_SHIFT   = 8,
+};
+
+enum NvmePmrebsMask {
+    PMREBS_PMRSZU_MASK   = 0xf,
+    PMREBS_RBB_MASK      = 0x1,
+    PMREBS_PMRWBZ_MASK   = 0xffffff,
+};
+
+#define NVME_PMREBS_PMRSZU(pmrebs)  \
+    ((pmrebs >> PMREBS_PMRSZU_SHIFT)   & PMREBS_PMRSZU_MASK)
+#define NVME_PMREBS_RBB(pmrebs)     \
+    ((pmrebs >> PMREBS_RBB_SHIFT)   & PMREBS_RBB_MASK)
+#define NVME_PMREBS_PMRWBZ(pmrebs)  \
+    ((pmrebs >> PMREBS_PMRWBZ_SHIFT)   & PMREBS_PMRWBZ_MASK)
+
+#define NVME_PMREBS_SET_PMRSZU(pmrebs, val)   \
+    (pmrebs |= (uint64_t)(val & PMREBS_PMRSZU_MASK) << PMREBS_PMRSZU_SHIFT)
+#define NVME_PMREBS_SET_RBB(pmrebs, val)   \
+    (pmrebs |= (uint64_t)(val & PMREBS_RBB_MASK) << PMREBS_RBB_SHIFT)
+#define NVME_PMREBS_SET_PMRWBZ(pmrebs, val)   \
+    (pmrebs |= (uint64_t)(val & PMREBS_PMRWBZ_MASK) << PMREBS_PMRWBZ_SHIFT)
+
+enum NvmePmrswtpShift {
+    PMRSWTP_PMRSWTU_SHIFT   = 0,
+    PMRSWTP_PMRSWTV_SHIFT   = 8,
+};
+
+enum NvmePmrswtpMask {
+    PMRSWTP_PMRSWTU_MASK   = 0xf,
+    PMRSWTP_PMRSWTV_MASK   = 0xffffff,
+};
+
+#define NVME_PMRSWTP_PMRSWTU(pmrswtp)   \
+    ((pmrswtp >> PMRSWTP_PMRSWTU_SHIFT)   & PMRSWTP_PMRSWTU_MASK)
+#define NVME_PMRSWTP_PMRSWTV(pmrswtp)   \
+    ((pmrswtp >> PMRSWTP_PMRSWTV_SHIFT)   & PMRSWTP_PMRSWTV_MASK)
+
+#define NVME_PMRSWTP_SET_PMRSWTU(pmrswtp, val)   \
+    (pmrswtp |= (uint64_t)(val & PMRSWTP_PMRSWTU_MASK) << PMRSWTP_PMRSWTU_SHIFT)
+#define NVME_PMRSWTP_SET_PMRSWTV(pmrswtp, val)   \
+    (pmrswtp |= (uint64_t)(val & PMRSWTP_PMRSWTV_MASK) << PMRSWTP_PMRSWTV_SHIFT)
+
+enum NvmePmrmscShift {
+    PMRMSC_CMSE_SHIFT   = 1,
+    PMRMSC_CBA_SHIFT    = 12,
+};
+
+enum NvmePmrmscMask {
+    PMRMSC_CMSE_MASK   = 0x1,
+    PMRMSC_CBA_MASK    = 0xfffffffffffff,
+};
+
+#define NVME_PMRMSC_CMSE(pmrmsc)    \
+    ((pmrmsc >> PMRMSC_CMSE_SHIFT)   & PMRMSC_CMSE_MASK)
+#define NVME_PMRMSC_CBA(pmrmsc)     \
+    ((pmrmsc >> PMRMSC_CBA_SHIFT)   & PMRMSC_CBA_MASK)
+
+#define NVME_PMRMSC_SET_CMSE(pmrmsc, val)   \
+    (pmrmsc |= (uint64_t)(val & PMRMSC_CMSE_MASK) << PMRMSC_CMSE_SHIFT)
+#define NVME_PMRMSC_SET_CBA(pmrmsc, val)   \
+    (pmrmsc |= (uint64_t)(val & PMRMSC_CBA_MASK) << PMRMSC_CBA_SHIFT)
+
 typedef struct NvmeCmd {
     uint8_t     opcode;
     uint8_t     fuse;
diff --git a/hw/block/nvme.c b/hw/block/nvme.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/nvme.c
+++ b/hw/block/nvme.c
@@ -XXX,XX +XXX,XX @@
  *      -drive file=<file>,if=none,id=<drive_id>
  *      -device nvme,drive=<drive_id>,serial=<serial>,id=<id[optional]>, \
  *              cmb_size_mb=<cmb_size_mb[optional]>, \
+ *              [pmrdev=<mem_backend_file_id>,] \
  *              num_queues=<N[optional]>
  *
  * Note cmb_size_mb denotes size of CMB in MB. CMB is assumed to be at
  * offset 0 in BAR2 and supports only WDS, RDS and SQS for now.
+ *
+ * cmb_size_mb= and pmrdev= options are mutually exclusive due to limitation
+ * in available BAR's. cmb_size_mb= will take precedence over pmrdev= when
+ * both provided.
+ * Enabling pmr emulation can be achieved by pointing to memory-backend-file.
+ * For example:
+ * -object memory-backend-file,id=<mem_id>,share=on,mem-path=<file_path>, \
+ *  size=<size> .... -device nvme,...,pmrdev=<mem_id>
  */
 
 #include "qemu/osdep.h"
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/sysemu.h"
 #include "qapi/error.h"
 #include "qapi/visitor.h"
+#include "sysemu/hostmem.h"
 #include "sysemu/block-backend.h"
+#include "exec/ram_addr.h"
 
 #include "qemu/log.h"
 #include "qemu/module.h"
@@ -XXX,XX +XXX,XX @@ static void nvme_write_bar(NvmeCtrl *n, hwaddr offset, uint64_t data,
         NVME_GUEST_ERR(nvme_ub_mmiowr_cmbsz_readonly,
                        "invalid write to read only CMBSZ, ignored");
         return;
+    case 0xE00: /* PMRCAP */
+        NVME_GUEST_ERR(nvme_ub_mmiowr_pmrcap_readonly,
+                       "invalid write to PMRCAP register, ignored");
+        return;
+    case 0xE04: /* TODO PMRCTL */
+        break;
+    case 0xE08: /* PMRSTS */
+        NVME_GUEST_ERR(nvme_ub_mmiowr_pmrsts_readonly,
+                       "invalid write to PMRSTS register, ignored");
+        return;
+    case 0xE0C: /* PMREBS */
+        NVME_GUEST_ERR(nvme_ub_mmiowr_pmrebs_readonly,
+                       "invalid write to PMREBS register, ignored");
+        return;
+    case 0xE10: /* PMRSWTP */
+        NVME_GUEST_ERR(nvme_ub_mmiowr_pmrswtp_readonly,
+                       "invalid write to PMRSWTP register, ignored");
+        return;
+    case 0xE14: /* TODO PMRMSC */
+         break;
     default:
         NVME_GUEST_ERR(nvme_ub_mmiowr_invalid,
                        "invalid MMIO write,"
@@ -XXX,XX +XXX,XX @@ static uint64_t nvme_mmio_read(void *opaque, hwaddr addr, unsigned size)
     }
 
     if (addr < sizeof(n->bar)) {
+        /*
+         * When PMRWBM bit 1 is set then read from
+         * from PMRSTS should ensure prior writes
+         * made it to persistent media
+         */
+        if (addr == 0xE08 &&
+            (NVME_PMRCAP_PMRWBM(n->bar.pmrcap) & 0x02)) {
+            qemu_ram_writeback(n->pmrdev->mr.ram_block,
+                               0, n->pmrdev->size);
+        }
         memcpy(&val, ptr + addr, size);
     } else {
         NVME_GUEST_ERR(nvme_ub_mmiord_invalid_ofs,
@@ -XXX,XX +XXX,XX @@ static void nvme_realize(PCIDevice *pci_dev, Error **errp)
         error_setg(errp, "serial property not set");
         return;
     }
+
+    if (!n->cmb_size_mb && n->pmrdev) {
+        if (host_memory_backend_is_mapped(n->pmrdev)) {
+            char *path = object_get_canonical_path_component(OBJECT(n->pmrdev));
+            error_setg(errp, "can't use already busy memdev: %s", path);
+            g_free(path);
+            return;
+        }
+
+        if (!is_power_of_2(n->pmrdev->size)) {
+            error_setg(errp, "pmr backend size needs to be power of 2 in size");
+            return;
+        }
+
+        host_memory_backend_set_mapped(n->pmrdev, true);
+    }
+
     blkconf_blocksizes(&n->conf);
     if (!blkconf_apply_backend_options(&n->conf, blk_is_read_only(n->conf.blk),
                                        false, errp)) {
@@ -XXX,XX +XXX,XX @@ static void nvme_realize(PCIDevice *pci_dev, Error **errp)
             PCI_BASE_ADDRESS_SPACE_MEMORY | PCI_BASE_ADDRESS_MEM_TYPE_64 |
             PCI_BASE_ADDRESS_MEM_PREFETCH, &n->ctrl_mem);
 
+    } else if (n->pmrdev) {
+        /* Controller Capabilities register */
+        NVME_CAP_SET_PMRS(n->bar.cap, 1);
+
+        /* PMR Capabities register */
+        n->bar.pmrcap = 0;
+        NVME_PMRCAP_SET_RDS(n->bar.pmrcap, 0);
+        NVME_PMRCAP_SET_WDS(n->bar.pmrcap, 0);
+        NVME_PMRCAP_SET_BIR(n->bar.pmrcap, 2);
+        NVME_PMRCAP_SET_PMRTU(n->bar.pmrcap, 0);
+        /* Turn on bit 1 support */
+        NVME_PMRCAP_SET_PMRWBM(n->bar.pmrcap, 0x02);
+        NVME_PMRCAP_SET_PMRTO(n->bar.pmrcap, 0);
+        NVME_PMRCAP_SET_CMSS(n->bar.pmrcap, 0);
+
+        /* PMR Control register */
+        n->bar.pmrctl = 0;
+        NVME_PMRCTL_SET_EN(n->bar.pmrctl, 0);
+
+        /* PMR Status register */
+        n->bar.pmrsts = 0;
+        NVME_PMRSTS_SET_ERR(n->bar.pmrsts, 0);
+        NVME_PMRSTS_SET_NRDY(n->bar.pmrsts, 0);
+        NVME_PMRSTS_SET_HSTS(n->bar.pmrsts, 0);
+        NVME_PMRSTS_SET_CBAI(n->bar.pmrsts, 0);
+
+        /* PMR Elasticity Buffer Size register */
+        n->bar.pmrebs = 0;
+        NVME_PMREBS_SET_PMRSZU(n->bar.pmrebs, 0);
+        NVME_PMREBS_SET_RBB(n->bar.pmrebs, 0);
+        NVME_PMREBS_SET_PMRWBZ(n->bar.pmrebs, 0);
+
+        /* PMR Sustained Write Throughput register */
+        n->bar.pmrswtp = 0;
+        NVME_PMRSWTP_SET_PMRSWTU(n->bar.pmrswtp, 0);
+        NVME_PMRSWTP_SET_PMRSWTV(n->bar.pmrswtp, 0);
+
+        /* PMR Memory Space Control register */
+        n->bar.pmrmsc = 0;
+        NVME_PMRMSC_SET_CMSE(n->bar.pmrmsc, 0);
+        NVME_PMRMSC_SET_CBA(n->bar.pmrmsc, 0);
+
+        pci_register_bar(pci_dev, NVME_PMRCAP_BIR(n->bar.pmrcap),
+            PCI_BASE_ADDRESS_SPACE_MEMORY | PCI_BASE_ADDRESS_MEM_TYPE_64 |
+            PCI_BASE_ADDRESS_MEM_PREFETCH, &n->pmrdev->mr);
     }
 
     for (i = 0; i < n->num_namespaces; i++) {
@@ -XXX,XX +XXX,XX @@ static void nvme_exit(PCIDevice *pci_dev)
     if (n->cmb_size_mb) {
         g_free(n->cmbuf);
     }
+
+    if (n->pmrdev) {
+        host_memory_backend_set_mapped(n->pmrdev, false);
+    }
     msix_uninit_exclusive_bar(pci_dev);
 }
 
 static Property nvme_props[] = {
     DEFINE_BLOCK_PROPERTIES(NvmeCtrl, conf),
+    DEFINE_PROP_LINK("pmrdev", NvmeCtrl, pmrdev, TYPE_MEMORY_BACKEND,
+                     HostMemoryBackend *),
     DEFINE_PROP_STRING("serial", NvmeCtrl, serial),
     DEFINE_PROP_UINT32("cmb_size_mb", NvmeCtrl, cmb_size_mb, 0),
     DEFINE_PROP_UINT32("num_queues", NvmeCtrl, num_queues, 64),
diff --git a/hw/block/Makefile.objs b/hw/block/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/Makefile.objs
+++ b/hw/block/Makefile.objs
@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_PFLASH_CFI02) += pflash_cfi02.o
 common-obj-$(CONFIG_XEN) += xen-block.o
 common-obj-$(CONFIG_ECC) += ecc.o
 common-obj-$(CONFIG_ONENAND) += onenand.o
-common-obj-$(CONFIG_NVME_PCI) += nvme.o
 common-obj-$(CONFIG_SWIM) += swim.o
 
 common-obj-$(CONFIG_SH4) += tc58128.o
 
 obj-$(CONFIG_VIRTIO_BLK) += virtio-blk.o
 obj-$(CONFIG_VHOST_USER_BLK) += vhost-user-blk.o
+obj-$(CONFIG_NVME_PCI) += nvme.o
 
 obj-y += dataplane/
diff --git a/hw/block/trace-events b/hw/block/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/trace-events
+++ b/hw/block/trace-events
@@ -XXX,XX +XXX,XX @@ nvme_ub_mmiowr_ssreset_w1c_unsupported(void) "attempted to W1C CSTS.NSSRO but CA
 nvme_ub_mmiowr_ssreset_unsupported(void) "attempted NVM subsystem reset but CAP.NSSRS is zero (not supported)"
 nvme_ub_mmiowr_cmbloc_reserved(void) "invalid write to reserved CMBLOC when CMBSZ is zero, ignored"
 nvme_ub_mmiowr_cmbsz_readonly(void) "invalid write to read only CMBSZ, ignored"
+nvme_ub_mmiowr_pmrcap_readonly(void) "invalid write to read only PMRCAP, ignored"
+nvme_ub_mmiowr_pmrsts_readonly(void) "invalid write to read only PMRSTS, ignored"
+nvme_ub_mmiowr_pmrebs_readonly(void) "invalid write to read only PMREBS, ignored"
+nvme_ub_mmiowr_pmrswtp_readonly(void) "invalid write to read only PMRSWTP, ignored"
 nvme_ub_mmiowr_invalid(uint64_t offset, uint64_t data) "invalid MMIO write, offset=0x%"PRIx64", data=0x%"PRIx64""
 nvme_ub_mmiord_misaligned32(uint64_t offset) "MMIO read not 32-bit aligned, offset=0x%"PRIx64""
 nvme_ub_mmiord_toosmall(uint64_t offset) "MMIO read smaller than 32-bits, offset=0x%"PRIx64""
-- 
2.25.3

The QMP handler qmp_object_add() and the implementation of --object in
qemu-storage-daemon can share most of the code. Currently,
qemu-storage-daemon calls qmp_object_add(), but this is not correct
because different visitors need to be used.

As a first step towards a fix, make qmp_object_add() a wrapper around a
new function user_creatable_add_dict() that can get an additional
parameter. The handling of "props" is only required for compatibility
and not required for the qemu-storage-daemon command line, so it stays
in qmp_object_add().

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/qom/object_interfaces.h | 12 ++++++++++++
 qom/object_interfaces.c         | 27 +++++++++++++++++++++++++++
 qom/qom-qmp-cmds.c              | 24 +-----------------------
 3 files changed, 40 insertions(+), 23 deletions(-)

diff --git a/include/qom/object_interfaces.h b/include/qom/object_interfaces.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qom/object_interfaces.h
+++ b/include/qom/object_interfaces.h
@@ -XXX,XX +XXX,XX @@ Object *user_creatable_add_type(const char *type, const char *id,
                                 const QDict *qdict,
                                 Visitor *v, Error **errp);
 
+/**
+ * user_creatable_add_dict:
+ * @qdict: the object definition
+ * @errp: if an error occurs, a pointer to an area to store the error
+ *
+ * Create an instance of the user creatable object that is defined by
+ * @qdict.  The object type is taken from the QDict key 'qom-type', its
+ * ID from the key 'id'. The remaining entries in @qdict are used to
+ * initialize the object properties.
+ */
+void user_creatable_add_dict(QDict *qdict, Error **errp);
+
 /**
  * user_creatable_add_opts:
  * @opts: the object definition
diff --git a/qom/object_interfaces.c b/qom/object_interfaces.c
index XXXXXXX..XXXXXXX 100644
--- a/qom/object_interfaces.c
+++ b/qom/object_interfaces.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/qmp/qerror.h"
 #include "qapi/qmp/qjson.h"
 #include "qapi/qmp/qstring.h"
+#include "qapi/qobject-input-visitor.h"
 #include "qom/object_interfaces.h"
 #include "qemu/help_option.h"
 #include "qemu/module.h"
@@ -XXX,XX +XXX,XX @@ out:
     return obj;
 }
 
+void user_creatable_add_dict(QDict *qdict, Error **errp)
+{
+    Visitor *v;
+    Object *obj;
+    g_autofree char *type = NULL;
+    g_autofree char *id = NULL;
+
+    type = g_strdup(qdict_get_try_str(qdict, "qom-type"));
+    if (!type) {
+        error_setg(errp, QERR_MISSING_PARAMETER, "qom-type");
+        return;
+    }
+    qdict_del(qdict, "qom-type");
+
+    id = g_strdup(qdict_get_try_str(qdict, "id"));
+    if (!id) {
+        error_setg(errp, QERR_MISSING_PARAMETER, "id");
+        return;
+    }
+    qdict_del(qdict, "id");
+
+    v = qobject_input_visitor_new(QOBJECT(qdict));
+    obj = user_creatable_add_type(type, id, qdict, v, errp);
+    visit_free(v);
+    object_unref(obj);
+}
 
 Object *user_creatable_add_opts(QemuOpts *opts, Error **errp)
 {
diff --git a/qom/qom-qmp-cmds.c b/qom/qom-qmp-cmds.c
index XXXXXXX..XXXXXXX 100644
--- a/qom/qom-qmp-cmds.c
+++ b/qom/qom-qmp-cmds.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/qapi-commands-qom.h"
 #include "qapi/qmp/qdict.h"
 #include "qapi/qmp/qerror.h"
-#include "qapi/qobject-input-visitor.h"
 #include "qemu/cutils.h"
 #include "qom/object_interfaces.h"
 #include "qom/qom-qobject.h"
@@ -XXX,XX +XXX,XX @@ void qmp_object_add(QDict *qdict, QObject **ret_data, Error **errp)
 {
     QObject *props;
     QDict *pdict;
-    Visitor *v;
-    Object *obj;
-    g_autofree char *type = NULL;
-    g_autofree char *id = NULL;
-
-    type = g_strdup(qdict_get_try_str(qdict, "qom-type"));
-    if (!type) {
-        error_setg(errp, QERR_MISSING_PARAMETER, "qom-type");
-        return;
-    }
-    qdict_del(qdict, "qom-type");
-
-    id = g_strdup(qdict_get_try_str(qdict, "id"));
-    if (!id) {
-        error_setg(errp, QERR_MISSING_PARAMETER, "id");
-        return;
-    }
-    qdict_del(qdict, "id");
 
     props = qdict_get(qdict, "props");
     if (props) {
@@ -XXX,XX +XXX,XX @@ void qmp_object_add(QDict *qdict, QObject **ret_data, Error **errp)
         qobject_unref(pdict);
     }
 
-    v = qobject_input_visitor_new(QOBJECT(qdict));
-    obj = user_creatable_add_type(type, id, qdict, v, errp);
-    visit_free(v);
-    object_unref(obj);
+    user_creatable_add_dict(qdict, errp);
 }
 
 void qmp_object_del(const char *id, Error **errp)
-- 
2.25.3

After processing the option string with the keyval parser, we get a
QDict that contains only strings. This QDict must be fed to a keyval
visitor which converts the strings into the right data types.

qmp_object_add(), however, uses the normal QObject input visitor, which
expects a QDict where all properties already have the QType that matches
the data type required by the QOM object type.

Change the --object implementation in qemu-storage-daemon so that it
doesn't call qmp_object_add(), but calls user_creatable_add_dict()
directly instead and pass it a new keyval boolean that decides which
visitor must be used.

Reported-by: Coiby Xu <coiby.xu@gmail.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/qom/object_interfaces.h | 6 +++++-
 qemu-storage-daemon.c           | 4 +---
 qom/object_interfaces.c         | 8 ++++++--
 qom/qom-qmp-cmds.c              | 2 +-
 4 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/include/qom/object_interfaces.h b/include/qom/object_interfaces.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qom/object_interfaces.h
+++ b/include/qom/object_interfaces.h
@@ -XXX,XX +XXX,XX @@ Object *user_creatable_add_type(const char *type, const char *id,
 /**
  * user_creatable_add_dict:
  * @qdict: the object definition
+ * @keyval: if true, use a keyval visitor for processing @qdict (i.e.
+ *          assume that all @qdict values are strings); otherwise, use
+ *          the normal QObject visitor (i.e. assume all @qdict values
+ *          have the QType expected by the QOM object type)
  * @errp: if an error occurs, a pointer to an area to store the error
  *
  * Create an instance of the user creatable object that is defined by
@@ -XXX,XX +XXX,XX @@ Object *user_creatable_add_type(const char *type, const char *id,
  * ID from the key 'id'. The remaining entries in @qdict are used to
  * initialize the object properties.
  */
-void user_creatable_add_dict(QDict *qdict, Error **errp);
+void user_creatable_add_dict(QDict *qdict, bool keyval, Error **errp);
 
 /**
  * user_creatable_add_opts:
diff --git a/qemu-storage-daemon.c b/qemu-storage-daemon.c
index XXXXXXX..XXXXXXX 100644
--- a/qemu-storage-daemon.c
+++ b/qemu-storage-daemon.c
@@ -XXX,XX +XXX,XX @@ static void process_options(int argc, char *argv[])
                 QemuOpts *opts;
                 const char *type;
                 QDict *args;
-                QObject *ret_data = NULL;
 
                 /* FIXME The keyval parser rejects 'help' arguments, so we must
                  * unconditionall try QemuOpts first. */
@@ -XXX,XX +XXX,XX @@ static void process_options(int argc, char *argv[])
                 qemu_opts_del(opts);
 
                 args = keyval_parse(optarg, "qom-type", &error_fatal);
-                qmp_object_add(args, &ret_data, &error_fatal);
+                user_creatable_add_dict(args, true, &error_fatal);
                 qobject_unref(args);
-                qobject_unref(ret_data);
                 break;
             }
         default:
diff --git a/qom/object_interfaces.c b/qom/object_interfaces.c
index XXXXXXX..XXXXXXX 100644
--- a/qom/object_interfaces.c
+++ b/qom/object_interfaces.c
@@ -XXX,XX +XXX,XX @@ out:
     return obj;
 }
 
-void user_creatable_add_dict(QDict *qdict, Error **errp)
+void user_creatable_add_dict(QDict *qdict, bool keyval, Error **errp)
 {
     Visitor *v;
     Object *obj;
@@ -XXX,XX +XXX,XX @@ void user_creatable_add_dict(QDict *qdict, Error **errp)
     }
     qdict_del(qdict, "id");
 
-    v = qobject_input_visitor_new(QOBJECT(qdict));
+    if (keyval) {
+        v = qobject_input_visitor_new_keyval(QOBJECT(qdict));
+    } else {
+        v = qobject_input_visitor_new(QOBJECT(qdict));
+    }
     obj = user_creatable_add_type(type, id, qdict, v, errp);
     visit_free(v);
     object_unref(obj);
diff --git a/qom/qom-qmp-cmds.c b/qom/qom-qmp-cmds.c
index XXXXXXX..XXXXXXX 100644
--- a/qom/qom-qmp-cmds.c
+++ b/qom/qom-qmp-cmds.c
@@ -XXX,XX +XXX,XX @@ void qmp_object_add(QDict *qdict, QObject **ret_data, Error **errp)
         qobject_unref(pdict);
     }
 
-    user_creatable_add_dict(qdict, errp);
+    user_creatable_add_dict(qdict, false, errp);
 }
 
 void qmp_object_del(const char *id, Error **errp)
-- 
2.25.3