Series comparison

-[Qemu-devel] [PULL v2 00/24] Block patches
+[Qemu-devel] [PULL v2 0/8] Block patches
-The following changes since commit 56f9e46b841c7be478ca038d8d4085d776ab4b0d:
+The following changes since commit 474f3938d79ab36b9231c9ad3b5a9314c2aeacde:
-  Merge remote-tracking branch 'remotes/armbru/tags/pull-qapi-2017-02-20' into staging (2017-02-20 17:42:47 +0000)
+  Merge remote-tracking branch 'remotes/amarkovic/tags/mips-queue-jun-21-2019' into staging (2019-06-21 15:40:50 +0100)
-are available in the git repository at:
+are available in the Git repository at:
-  git://github.com/stefanha/qemu.git tags/block-pull-request
+  https://github.com/XanClic/qemu.git tags/pull-block-2019-06-24
-for you to fetch changes up to a7b91d35bab97a2d3e779d0c64c9b837b52a6cf7:
+for you to fetch changes up to ab5d4a30f7f3803ca5106b370969c1b7b54136f8:
-  coroutine-lock: make CoRwlock thread-safe and fair (2017-02-21 11:39:40 +0000)
+  iotests: Fix 205 for concurrent runs (2019-06-24 16:01:40 +0200)
 ----------------------------------------------------------------
-Pull request
+Block patches:
 - The SSH block driver now uses libssh instead of libssh2
 - The VMDK block driver gets read-only support for the seSparse
   subformat
 - Various fixes
 ---
 v2:
- * Rebased to resolve scsi conflicts
+- Squashed Pino's fix for pre-0.8 libssh into the libssh patch
 ----------------------------------------------------------------
+Anton Nefedov (1):
+  iotest 134: test cluster-misaligned encrypted write
-Paolo Bonzini (24):
+Klaus Birkelund Jensen (1):
-  block: move AioContext, QEMUTimer, main-loop to libqemuutil
+  nvme: do not advertise support for unsupported arbitration mechanism
   aio: introduce aio_co_schedule and aio_co_wake
   block-backend: allow blk_prw from coroutine context
   test-thread-pool: use generic AioContext infrastructure
   io: add methods to set I/O handlers on AioContext
   io: make qio_channel_yield aware of AioContexts
   nbd: convert to use qio_channel_yield
   coroutine-lock: reschedule coroutine on the AioContext it was running
     on
   blkdebug: reschedule coroutine on the AioContext it is running on
   qed: introduce qed_aio_start_io and qed_aio_next_io_cb
   aio: push aio_context_acquire/release down to dispatching
   block: explicitly acquire aiocontext in timers that need it
   block: explicitly acquire aiocontext in callbacks that need it
   block: explicitly acquire aiocontext in bottom halves that need it
   block: explicitly acquire aiocontext in aio callbacks that need it
   aio-posix: partially inline aio_dispatch into aio_poll
   async: remove unnecessary inc/dec pairs
   block: document fields protected by AioContext lock
   coroutine-lock: make CoMutex thread-safe
   coroutine-lock: add limited spinning to CoMutex
   test-aio-multithread: add performance comparison with thread-based
     mutexes
   coroutine-lock: place CoMutex before CoQueue in header
   coroutine-lock: add mutex argument to CoQueue APIs
   coroutine-lock: make CoRwlock thread-safe and fair
- Makefile.objs                       |   4 -
+Max Reitz (1):
- stubs/Makefile.objs                 |   1 +
+  iotests: Fix 205 for concurrent runs
- tests/Makefile.include              |  19 +-
- util/Makefile.objs                  |   6 +-
+Pino Toscano (1):
- block/nbd-client.h                  |   2 +-
+  ssh: switch from libssh2 to libssh
- block/qed.h                         |   3 +
- include/block/aio.h                 |  38 ++-
+Sam Eiderman (3):
- include/block/block_int.h           |  64 +++--
+  vmdk: Fix comment regarding max l1_size coverage
- include/io/channel.h                |  72 +++++-
+  vmdk: Reduce the max bound for L1 table size
- include/qemu/coroutine.h            |  84 ++++---
+  vmdk: Add read-only support for seSparse snapshots
- include/qemu/coroutine_int.h        |  11 +-
- include/sysemu/block-backend.h      |  14 +-
+Vladimir Sementsov-Ogievskiy (1):
- tests/iothread.h                    |  25 ++
+  blockdev: enable non-root nodes for transaction drive-backup source
- block/backup.c                      |   2 +-
- block/blkdebug.c                    |   9 +-
+ configure                                     |  65 +-
- block/blkreplay.c                   |   2 +-
+ block/Makefile.objs                           |   6 +-
- block/block-backend.c               |  13 +-
+ block/ssh.c                                   | 652 ++++++++++--------
- block/curl.c                        |  44 +++-
+ block/vmdk.c                                  | 372 +++++++++-
- block/gluster.c                     |   9 +-
+ blockdev.c                                    |   2 +-
- block/io.c                          |  42 +---
+ hw/block/nvme.c                               |   1 -
- block/iscsi.c                       |  15 +-
+ .travis.yml                                   |   4 +-
- block/linux-aio.c                   |  10 +-
+ block/trace-events                            |  14 +-
- block/mirror.c                      |  12 +-
+ docs/qemu-block-drivers.texi                  |   2 +-
- block/nbd-client.c                  | 119 +++++----
+ .../dockerfiles/debian-win32-cross.docker     |   1 -
- block/nfs.c                         |   9 +-
+ .../dockerfiles/debian-win64-cross.docker     |   1 -
- block/qcow2-cluster.c               |   4 +-
+ tests/docker/dockerfiles/fedora.docker        |   4 +-
- block/qed-cluster.c                 |   2 +
+ tests/docker/dockerfiles/ubuntu.docker        |   2 +-
- block/qed-table.c                   |  12 +-
+ tests/docker/dockerfiles/ubuntu1804.docker    |   2 +-
- block/qed.c                         |  58 +++--
+ tests/qemu-iotests/059.out                    |   2 +-
- block/sheepdog.c                    |  31 +--
+ tests/qemu-iotests/134                        |   9 +
- block/ssh.c                         |  29 +--
+ tests/qemu-iotests/134.out                    |  10 +
- block/throttle-groups.c             |   4 +-
+ tests/qemu-iotests/205                        |   2 +-
- block/win32-aio.c                   |   9 +-
+ tests/qemu-iotests/207                        |  54 +-
- dma-helpers.c                       |   2 +
+ tests/qemu-iotests/207.out                    |   2 +-
- hw/9pfs/9p.c                        |   2 +-
+files changed, 823 insertions(+), 384 deletions(-)
  hw/block/virtio-blk.c               |  19 +-
  hw/scsi/scsi-bus.c                  |   2 +
  hw/scsi/scsi-disk.c                 |  15 ++
  hw/scsi/scsi-generic.c              |  20 +-
  hw/scsi/virtio-scsi.c               |   7 +
  io/channel-command.c                |  13 +
  io/channel-file.c                   |  11 +
  io/channel-socket.c                 |  16 +-
  io/channel-tls.c                    |  12 +
  io/channel-watch.c                  |   6 +
  io/channel.c                        |  97 ++++++--
  nbd/client.c                        |   2 +-
  nbd/common.c                        |   9 +-
  nbd/server.c                        |  94 +++-----
  stubs/linux-aio.c                   |  32 +++
  stubs/set-fd-handler.c              |  11 -
  tests/iothread.c                    |  91 +++++++
  tests/test-aio-multithread.c        | 463 ++++++++++++++++++++++++++++++++++++
  tests/test-thread-pool.c            |  12 +-
  aio-posix.c => util/aio-posix.c     |  62 ++---
  aio-win32.c => util/aio-win32.c     |  30 +--
  util/aiocb.c                        |  55 +++++
  async.c => util/async.c             |  84 ++++++-
  iohandler.c => util/iohandler.c     |   0
  main-loop.c => util/main-loop.c     |   0
  util/qemu-coroutine-lock.c          | 254 ++++++++++++++++++--
  util/qemu-coroutine-sleep.c         |   2 +-
  util/qemu-coroutine.c               |   8 +
  qemu-timer.c => util/qemu-timer.c   |   0
  thread-pool.c => util/thread-pool.c |   8 +-
  trace-events                        |  11 -
  util/trace-events                   |  17 +-
 files changed, 1712 insertions(+), 533 deletions(-)
  create mode 100644 tests/iothread.h
  create mode 100644 stubs/linux-aio.c
  create mode 100644 tests/iothread.c
  create mode 100644 tests/test-aio-multithread.c
  rename aio-posix.c => util/aio-posix.c (94%)
  rename aio-win32.c => util/aio-win32.c (95%)
  create mode 100644 util/aiocb.c
  rename async.c => util/async.c (82%)
  rename iohandler.c => util/iohandler.c (100%)
  rename main-loop.c => util/main-loop.c (100%)
  rename qemu-timer.c => util/qemu-timer.c (100%)
  rename thread-pool.c => util/thread-pool.c (97%)
 --
-.9.3
+.21.0

-[Qemu-devel] [PULL v2 01/24] block: move AioContext, QEMUTimer, main-loop to libqemuutil
+Deleted patch
-From: Paolo Bonzini <pbonzini@redhat.com>
-AioContext is fairly self contained, the only dependency is QEMUTimer but
-that in turn doesn't need anything else.  So move them out of block-obj-y
-to avoid introducing a dependency from io/ to block-obj-y.
-main-loop and its dependency iohandler also need to be moved, because
-later in this series io/ will call iohandler_get_aio_context.
-[Changed copyright "the QEMU team" to "other QEMU contributors" as
-suggested by Daniel Berrange and agreed by Paolo.
---Stefan]
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Reviewed-by: Fam Zheng <famz@redhat.com>
-Message-id: 20170213135235.12274-2-pbonzini@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- Makefile.objs                       |  4 ---
- stubs/Makefile.objs                 |  1 +
- tests/Makefile.include              | 11 ++++----
- util/Makefile.objs                  |  6 +++-
- block/io.c                          | 29 -------------------
- stubs/linux-aio.c                   | 32 +++++++++++++++++++++
- stubs/set-fd-handler.c              | 11 --------
- aio-posix.c => util/aio-posix.c     |  2 +-
- aio-win32.c => util/aio-win32.c     |  0
- util/aiocb.c                        | 55 +++++++++++++++++++++++++++++++++++++
- async.c => util/async.c             |  3 +-
- iohandler.c => util/iohandler.c     |  0
- main-loop.c => util/main-loop.c     |  0
- qemu-timer.c => util/qemu-timer.c   |  0
- thread-pool.c => util/thread-pool.c |  2 +-
- trace-events                        | 11 --------
- util/trace-events                   | 11 ++++++++
-files changed, 114 insertions(+), 64 deletions(-)
- create mode 100644 stubs/linux-aio.c
- rename aio-posix.c => util/aio-posix.c (99%)
- rename aio-win32.c => util/aio-win32.c (100%)
- create mode 100644 util/aiocb.c
- rename async.c => util/async.c (99%)
- rename iohandler.c => util/iohandler.c (100%)
- rename main-loop.c => util/main-loop.c (100%)
- rename qemu-timer.c => util/qemu-timer.c (100%)
- rename thread-pool.c => util/thread-pool.c (99%)
-diff --git a/Makefile.objs b/Makefile.objs
-index XXXXXXX..XXXXXXX 100644
---- a/Makefile.objs
-+++ b/Makefile.objs
-@@ -XXX,XX +XXX,XX @@ chardev-obj-y = chardev/
- #######################################################################
- # block-obj-y is code used by both qemu system emulation and qemu-img
--block-obj-y = async.o thread-pool.o
- block-obj-y += nbd/
- block-obj-y += block.o blockjob.o
--block-obj-y += main-loop.o iohandler.o qemu-timer.o
--block-obj-$(CONFIG_POSIX) += aio-posix.o
--block-obj-$(CONFIG_WIN32) += aio-win32.o
- block-obj-y += block/
- block-obj-y += qemu-io-cmds.o
- block-obj-$(CONFIG_REPLICATION) += replication.o
-diff --git a/stubs/Makefile.objs b/stubs/Makefile.objs
-index XXXXXXX..XXXXXXX 100644
---- a/stubs/Makefile.objs
-+++ b/stubs/Makefile.objs
-@@ -XXX,XX +XXX,XX @@ stub-obj-y += get-vm-name.o
- stub-obj-y += iothread.o
- stub-obj-y += iothread-lock.o
- stub-obj-y += is-daemonized.o
-+stub-obj-$(CONFIG_LINUX_AIO) += linux-aio.o
- stub-obj-y += machine-init-done.o
- stub-obj-y += migr-blocker.o
- stub-obj-y += monitor.o
-diff --git a/tests/Makefile.include b/tests/Makefile.include
-index XXXXXXX..XXXXXXX 100644
---- a/tests/Makefile.include
-+++ b/tests/Makefile.include
-@@ -XXX,XX +XXX,XX @@ check-unit-y += tests/test-visitor-serialization$(EXESUF)
- check-unit-y += tests/test-iov$(EXESUF)
- gcov-files-test-iov-y = util/iov.c
- check-unit-y += tests/test-aio$(EXESUF)
-+gcov-files-test-aio-y = util/async.c util/qemu-timer.o
-+gcov-files-test-aio-$(CONFIG_WIN32) += util/aio-win32.c
-+gcov-files-test-aio-$(CONFIG_POSIX) += util/aio-posix.c
- check-unit-y += tests/test-throttle$(EXESUF)
- gcov-files-test-aio-$(CONFIG_WIN32) = aio-win32.c
- gcov-files-test-aio-$(CONFIG_POSIX) = aio-posix.c
-@@ -XXX,XX +XXX,XX @@ tests/check-qjson$(EXESUF): tests/check-qjson.o $(test-util-obj-y)
- tests/check-qom-interface$(EXESUF): tests/check-qom-interface.o $(test-qom-obj-y)
- tests/check-qom-proplist$(EXESUF): tests/check-qom-proplist.o $(test-qom-obj-y)
--tests/test-char$(EXESUF): tests/test-char.o qemu-timer.o \
--    $(test-util-obj-y) $(qtest-obj-y) $(test-block-obj-y) $(chardev-obj-y)
-+tests/test-char$(EXESUF): tests/test-char.o $(test-util-obj-y) $(qtest-obj-y) $(test-io-obj-y) $(chardev-obj-y)
- tests/test-coroutine$(EXESUF): tests/test-coroutine.o $(test-block-obj-y)
- tests/test-aio$(EXESUF): tests/test-aio.o $(test-block-obj-y)
- tests/test-throttle$(EXESUF): tests/test-throttle.o $(test-block-obj-y)
-@@ -XXX,XX +XXX,XX @@ tests/test-vmstate$(EXESUF): tests/test-vmstate.o \
-     migration/vmstate.o migration/qemu-file.o \
-         migration/qemu-file-channel.o migration/qjson.o \
-     $(test-io-obj-y)
--tests/test-timed-average$(EXESUF): tests/test-timed-average.o qemu-timer.o \
--    $(test-util-obj-y)
-+tests/test-timed-average$(EXESUF): tests/test-timed-average.o $(test-util-obj-y)
- tests/test-base64$(EXESUF): tests/test-base64.o \
-     libqemuutil.a libqemustub.a
- tests/ptimer-test$(EXESUF): tests/ptimer-test.o tests/ptimer-test-stubs.o hw/core/ptimer.o libqemustub.a
-@@ -XXX,XX +XXX,XX @@ tests/usb-hcd-ehci-test$(EXESUF): tests/usb-hcd-ehci-test.o $(libqos-usb-obj-y)
- tests/usb-hcd-xhci-test$(EXESUF): tests/usb-hcd-xhci-test.o $(libqos-usb-obj-y)
- tests/pc-cpu-test$(EXESUF): tests/pc-cpu-test.o
- tests/postcopy-test$(EXESUF): tests/postcopy-test.o
--tests/vhost-user-test$(EXESUF): tests/vhost-user-test.o qemu-timer.o \
-+tests/vhost-user-test$(EXESUF): tests/vhost-user-test.o $(test-util-obj-y) \
-     $(qtest-obj-y) $(test-io-obj-y) $(libqos-virtio-obj-y) $(libqos-pc-obj-y) \
-     $(chardev-obj-y)
- tests/qemu-iotests/socket_scm_helper$(EXESUF): tests/qemu-iotests/socket_scm_helper.o
-diff --git a/util/Makefile.objs b/util/Makefile.objs
-index XXXXXXX..XXXXXXX 100644
---- a/util/Makefile.objs
-+++ b/util/Makefile.objs
-@@ -XXX,XX +XXX,XX @@
- util-obj-y = osdep.o cutils.o unicode.o qemu-timer-common.o
- util-obj-y += bufferiszero.o
- util-obj-y += lockcnt.o
-+util-obj-y += aiocb.o async.o thread-pool.o qemu-timer.o
-+util-obj-y += main-loop.o iohandler.o
-+util-obj-$(CONFIG_POSIX) += aio-posix.o
- util-obj-$(CONFIG_POSIX) += compatfd.o
- util-obj-$(CONFIG_POSIX) += event_notifier-posix.o
- util-obj-$(CONFIG_POSIX) += mmap-alloc.o
- util-obj-$(CONFIG_POSIX) += oslib-posix.o
- util-obj-$(CONFIG_POSIX) += qemu-openpty.o
- util-obj-$(CONFIG_POSIX) += qemu-thread-posix.o
--util-obj-$(CONFIG_WIN32) += event_notifier-win32.o
- util-obj-$(CONFIG_POSIX) += memfd.o
-+util-obj-$(CONFIG_WIN32) += aio-win32.o
-+util-obj-$(CONFIG_WIN32) += event_notifier-win32.o
- util-obj-$(CONFIG_WIN32) += oslib-win32.o
- util-obj-$(CONFIG_WIN32) += qemu-thread-win32.o
- util-obj-y += envlist.o path.o module.o
-diff --git a/block/io.c b/block/io.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/io.c
-+++ b/block/io.c
-@@ -XXX,XX +XXX,XX @@ BlockAIOCB *bdrv_aio_flush(BlockDriverState *bs,
-     return &acb->common;
- }
--void *qemu_aio_get(const AIOCBInfo *aiocb_info, BlockDriverState *bs,
--                   BlockCompletionFunc *cb, void *opaque)
--{
--    BlockAIOCB *acb;
--
--    acb = g_malloc(aiocb_info->aiocb_size);
--    acb->aiocb_info = aiocb_info;
--    acb->bs = bs;
--    acb->cb = cb;
--    acb->opaque = opaque;
--    acb->refcnt = 1;
--    return acb;
--}
--
--void qemu_aio_ref(void *p)
--{
--    BlockAIOCB *acb = p;
--    acb->refcnt++;
--}
--
--void qemu_aio_unref(void *p)
--{
--    BlockAIOCB *acb = p;
--    assert(acb->refcnt > 0);
--    if (--acb->refcnt == 0) {
--        g_free(acb);
--    }
--}
--
- /**************************************************************/
- /* Coroutine block device emulation */
-diff --git a/stubs/linux-aio.c b/stubs/linux-aio.c
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/stubs/linux-aio.c
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * Linux native AIO support.
-+ *
-+ * Copyright (C) 2009 IBM, Corp.
-+ * Copyright (C) 2009 Red Hat, Inc.
-+ *
-+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
-+ * See the COPYING file in the top-level directory.
-+ */
-+#include "qemu/osdep.h"
-+#include "block/aio.h"
-+#include "block/raw-aio.h"
-+
-+void laio_detach_aio_context(LinuxAioState *s, AioContext *old_context)
-+{
-+    abort();
-+}
-+
-+void laio_attach_aio_context(LinuxAioState *s, AioContext *new_context)
-+{
-+    abort();
-+}
-+
-+LinuxAioState *laio_init(void)
-+{
-+    abort();
-+}
-+
-+void laio_cleanup(LinuxAioState *s)
-+{
-+    abort();
-+}
-diff --git a/stubs/set-fd-handler.c b/stubs/set-fd-handler.c
-index XXXXXXX..XXXXXXX 100644
---- a/stubs/set-fd-handler.c
-+++ b/stubs/set-fd-handler.c
-@@ -XXX,XX +XXX,XX @@ void qemu_set_fd_handler(int fd,
- {
-     abort();
- }
--
--void aio_set_fd_handler(AioContext *ctx,
--                        int fd,
--                        bool is_external,
--                        IOHandler *io_read,
--                        IOHandler *io_write,
--                        AioPollFn *io_poll,
--                        void *opaque)
--{
--    abort();
--}
-diff --git a/aio-posix.c b/util/aio-posix.c
-similarity index 99%
-rename from aio-posix.c
-rename to util/aio-posix.c
-index XXXXXXX..XXXXXXX 100644
---- a/aio-posix.c
-+++ b/util/aio-posix.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/rcu_queue.h"
- #include "qemu/sockets.h"
- #include "qemu/cutils.h"
--#include "trace-root.h"
-+#include "trace.h"
- #ifdef CONFIG_EPOLL_CREATE1
- #include <sys/epoll.h>
- #endif
-diff --git a/aio-win32.c b/util/aio-win32.c
-similarity index 100%
-rename from aio-win32.c
-rename to util/aio-win32.c
-diff --git a/util/aiocb.c b/util/aiocb.c
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/util/aiocb.c
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * BlockAIOCB allocation
-+ *
-+ * Copyright (c) 2003-2017 Fabrice Bellard and other QEMU contributors
-+ *
-+ * Permission is hereby granted, free of charge, to any person obtaining a copy
-+ * of this software and associated documentation files (the "Software"), to deal
-+ * in the Software without restriction, including without limitation the rights
-+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-+ * copies of the Software, and to permit persons to whom the Software is
-+ * furnished to do so, subject to the following conditions:
-+ *
-+ * The above copyright notice and this permission notice shall be included in
-+ * all copies or substantial portions of the Software.
-+ *
-+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
-+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-+ * THE SOFTWARE.
-+ */
-+
-+#include "qemu/osdep.h"
-+#include "block/aio.h"
-+
-+void *qemu_aio_get(const AIOCBInfo *aiocb_info, BlockDriverState *bs,
-+                   BlockCompletionFunc *cb, void *opaque)
-+{
-+    BlockAIOCB *acb;
-+
-+    acb = g_malloc(aiocb_info->aiocb_size);
-+    acb->aiocb_info = aiocb_info;
-+    acb->bs = bs;
-+    acb->cb = cb;
-+    acb->opaque = opaque;
-+    acb->refcnt = 1;
-+    return acb;
-+}
-+
-+void qemu_aio_ref(void *p)
-+{
-+    BlockAIOCB *acb = p;
-+    acb->refcnt++;
-+}
-+
-+void qemu_aio_unref(void *p)
-+{
-+    BlockAIOCB *acb = p;
-+    assert(acb->refcnt > 0);
-+    if (--acb->refcnt == 0) {
-+        g_free(acb);
-+    }
-+}
-diff --git a/async.c b/util/async.c
-similarity index 99%
-rename from async.c
-rename to util/async.c
-index XXXXXXX..XXXXXXX 100644
---- a/async.c
-+++ b/util/async.c
-@@ -XXX,XX +XXX,XX @@
- /*
-- * QEMU System Emulator
-+ * Data plane event loop
-  *
-  * Copyright (c) 2003-2008 Fabrice Bellard
-+ * Copyright (c) 2009-2017 QEMU contributors
-  *
-  * Permission is hereby granted, free of charge, to any person obtaining a copy
-  * of this software and associated documentation files (the "Software"), to deal
-diff --git a/iohandler.c b/util/iohandler.c
-similarity index 100%
-rename from iohandler.c
-rename to util/iohandler.c
-diff --git a/main-loop.c b/util/main-loop.c
-similarity index 100%
-rename from main-loop.c
-rename to util/main-loop.c
-diff --git a/qemu-timer.c b/util/qemu-timer.c
-similarity index 100%
-rename from qemu-timer.c
-rename to util/qemu-timer.c
-diff --git a/thread-pool.c b/util/thread-pool.c
-similarity index 99%
-rename from thread-pool.c
-rename to util/thread-pool.c
-index XXXXXXX..XXXXXXX 100644
---- a/thread-pool.c
-+++ b/util/thread-pool.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/queue.h"
- #include "qemu/thread.h"
- #include "qemu/coroutine.h"
--#include "trace-root.h"
-+#include "trace.h"
- #include "block/thread-pool.h"
- #include "qemu/main-loop.h"
-diff --git a/trace-events b/trace-events
-index XXXXXXX..XXXXXXX 100644
---- a/trace-events
-+++ b/trace-events
-@@ -XXX,XX +XXX,XX @@
- #
- # The <format-string> should be a sprintf()-compatible format string.
--# aio-posix.c
--run_poll_handlers_begin(void *ctx, int64_t max_ns) "ctx %p max_ns %"PRId64
--run_poll_handlers_end(void *ctx, bool progress) "ctx %p progress %d"
--poll_shrink(void *ctx, int64_t old, int64_t new) "ctx %p old %"PRId64" new %"PRId64
--poll_grow(void *ctx, int64_t old, int64_t new) "ctx %p old %"PRId64" new %"PRId64
--
--# thread-pool.c
--thread_pool_submit(void *pool, void *req, void *opaque) "pool %p req %p opaque %p"
--thread_pool_complete(void *pool, void *req, void *opaque, int ret) "pool %p req %p opaque %p ret %d"
--thread_pool_cancel(void *req, void *opaque) "req %p opaque %p"
--
- # ioport.c
- cpu_in(unsigned int addr, char size, unsigned int val) "addr %#x(%c) value %u"
- cpu_out(unsigned int addr, char size, unsigned int val) "addr %#x(%c) value %u"
-diff --git a/util/trace-events b/util/trace-events
-index XXXXXXX..XXXXXXX 100644
---- a/util/trace-events
-+++ b/util/trace-events
-@@ -XXX,XX +XXX,XX @@
- # See docs/tracing.txt for syntax documentation.
-+# util/aio-posix.c
-+run_poll_handlers_begin(void *ctx, int64_t max_ns) "ctx %p max_ns %"PRId64
-+run_poll_handlers_end(void *ctx, bool progress) "ctx %p progress %d"
-+poll_shrink(void *ctx, int64_t old, int64_t new) "ctx %p old %"PRId64" new %"PRId64
-+poll_grow(void *ctx, int64_t old, int64_t new) "ctx %p old %"PRId64" new %"PRId64
-+
-+# util/thread-pool.c
-+thread_pool_submit(void *pool, void *req, void *opaque) "pool %p req %p opaque %p"
-+thread_pool_complete(void *pool, void *req, void *opaque, int ret) "pool %p req %p opaque %p ret %d"
-+thread_pool_cancel(void *req, void *opaque) "req %p opaque %p"
-+
- # util/buffer.c
- buffer_resize(const char *buf, size_t olen, size_t len) "%s: old %zd, new %zd"
- buffer_move_empty(const char *buf, size_t len, const char *from) "%s: %zd bytes from %s"
---
-.9.3

-[Qemu-devel] [PULL v2 02/24] aio: introduce aio_co_schedule and aio_co_wake
+Deleted patch
-From: Paolo Bonzini <pbonzini@redhat.com>
-aio_co_wake provides the infrastructure to start a coroutine on a "home"
-AioContext.  It will be used by CoMutex and CoQueue, so that coroutines
-don't jump from one context to another when they go to sleep on a
-mutex or waitqueue.  However, it can also be used as a more efficient
-alternative to one-shot bottom halves, and saves the effort of tracking
-which AioContext a coroutine is running on.
-aio_co_schedule is the part of aio_co_wake that starts a coroutine
-on a remove AioContext, but it is also useful to implement e.g.
-bdrv_set_aio_context callbacks.
-The implementation of aio_co_schedule is based on a lock-free
-multiple-producer, single-consumer queue.  The multiple producers use
-cmpxchg to add to a LIFO stack.  The consumer (a per-AioContext bottom
-half) grabs all items added so far, inverts the list to make it FIFO,
-and goes through it one item at a time until it's empty.  The data
-structure was inspired by OSv, which uses it in the very code we'll
-"port" to QEMU for the thread-safe CoMutex.
-Most of the new code is really tests.
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Reviewed-by: Fam Zheng <famz@redhat.com>
-Message-id: 20170213135235.12274-3-pbonzini@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- tests/Makefile.include       |   8 +-
- include/block/aio.h          |  32 +++++++
- include/qemu/coroutine_int.h |  11 ++-
- tests/iothread.h             |  25 +++++
- tests/iothread.c             |  91 ++++++++++++++++++
- tests/test-aio-multithread.c | 213 +++++++++++++++++++++++++++++++++++++++++++
- util/async.c                 |  65 +++++++++++++
- util/qemu-coroutine.c        |   8 ++
- util/trace-events            |   4 +
-files changed, 453 insertions(+), 4 deletions(-)
- create mode 100644 tests/iothread.h
- create mode 100644 tests/iothread.c
- create mode 100644 tests/test-aio-multithread.c
-diff --git a/tests/Makefile.include b/tests/Makefile.include
-index XXXXXXX..XXXXXXX 100644
---- a/tests/Makefile.include
-+++ b/tests/Makefile.include
-@@ -XXX,XX +XXX,XX @@ check-unit-y += tests/test-aio$(EXESUF)
- gcov-files-test-aio-y = util/async.c util/qemu-timer.o
- gcov-files-test-aio-$(CONFIG_WIN32) += util/aio-win32.c
- gcov-files-test-aio-$(CONFIG_POSIX) += util/aio-posix.c
-+check-unit-y += tests/test-aio-multithread$(EXESUF)
-+gcov-files-test-aio-multithread-y = $(gcov-files-test-aio-y)
-+gcov-files-test-aio-multithread-y += util/qemu-coroutine.c tests/iothread.c
- check-unit-y += tests/test-throttle$(EXESUF)
--gcov-files-test-aio-$(CONFIG_WIN32) = aio-win32.c
--gcov-files-test-aio-$(CONFIG_POSIX) = aio-posix.c
- check-unit-y += tests/test-thread-pool$(EXESUF)
- gcov-files-test-thread-pool-y = thread-pool.c
- gcov-files-test-hbitmap-y = util/hbitmap.c
-@@ -XXX,XX +XXX,XX @@ test-qapi-obj-y = tests/test-qapi-visit.o tests/test-qapi-types.o \
-     $(test-qom-obj-y)
- test-crypto-obj-y = $(crypto-obj-y) $(test-qom-obj-y)
- test-io-obj-y = $(io-obj-y) $(test-crypto-obj-y)
--test-block-obj-y = $(block-obj-y) $(test-io-obj-y)
-+test-block-obj-y = $(block-obj-y) $(test-io-obj-y) tests/iothread.o
- tests/check-qint$(EXESUF): tests/check-qint.o $(test-util-obj-y)
- tests/check-qstring$(EXESUF): tests/check-qstring.o $(test-util-obj-y)
-@@ -XXX,XX +XXX,XX @@ tests/check-qom-proplist$(EXESUF): tests/check-qom-proplist.o $(test-qom-obj-y)
- tests/test-char$(EXESUF): tests/test-char.o $(test-util-obj-y) $(qtest-obj-y) $(test-io-obj-y) $(chardev-obj-y)
- tests/test-coroutine$(EXESUF): tests/test-coroutine.o $(test-block-obj-y)
- tests/test-aio$(EXESUF): tests/test-aio.o $(test-block-obj-y)
-+tests/test-aio-multithread$(EXESUF): tests/test-aio-multithread.o $(test-block-obj-y)
- tests/test-throttle$(EXESUF): tests/test-throttle.o $(test-block-obj-y)
- tests/test-blockjob$(EXESUF): tests/test-blockjob.o $(test-block-obj-y) $(test-util-obj-y)
- tests/test-blockjob-txn$(EXESUF): tests/test-blockjob-txn.o $(test-block-obj-y) $(test-util-obj-y)
-diff --git a/include/block/aio.h b/include/block/aio.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/block/aio.h
-+++ b/include/block/aio.h
-@@ -XXX,XX +XXX,XX @@ typedef void QEMUBHFunc(void *opaque);
- typedef bool AioPollFn(void *opaque);
- typedef void IOHandler(void *opaque);
-+struct Coroutine;
- struct ThreadPool;
- struct LinuxAioState;
-@@ -XXX,XX +XXX,XX @@ struct AioContext {
-     bool notified;
-     EventNotifier notifier;
-+    QSLIST_HEAD(, Coroutine) scheduled_coroutines;
-+    QEMUBH *co_schedule_bh;
-+
-     /* Thread pool for performing work and receiving completion callbacks.
-      * Has its own locking.
-      */
-@@ -XXX,XX +XXX,XX @@ static inline bool aio_node_check(AioContext *ctx, bool is_external)
- }
- /**
-+ * aio_co_schedule:
-+ * @ctx: the aio context
-+ * @co: the coroutine
-+ *
-+ * Start a coroutine on a remote AioContext.
-+ *
-+ * The coroutine must not be entered by anyone else while aio_co_schedule()
-+ * is active.  In addition the coroutine must have yielded unless ctx
-+ * is the context in which the coroutine is running (i.e. the value of
-+ * qemu_get_current_aio_context() from the coroutine itself).
-+ */
-+void aio_co_schedule(AioContext *ctx, struct Coroutine *co);
-+
-+/**
-+ * aio_co_wake:
-+ * @co: the coroutine
-+ *
-+ * Restart a coroutine on the AioContext where it was running last, thus
-+ * preventing coroutines from jumping from one context to another when they
-+ * go to sleep.
-+ *
-+ * aio_co_wake may be executed either in coroutine or non-coroutine
-+ * context.  The coroutine must not be entered by anyone else while
-+ * aio_co_wake() is active.
-+ */
-+void aio_co_wake(struct Coroutine *co);
-+
-+/**
-  * Return the AioContext whose event loop runs in the current thread.
-  *
-  * If called from an IOThread this will be the IOThread's AioContext.  If
-diff --git a/include/qemu/coroutine_int.h b/include/qemu/coroutine_int.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/qemu/coroutine_int.h
-+++ b/include/qemu/coroutine_int.h
-@@ -XXX,XX +XXX,XX @@ struct Coroutine {
-     CoroutineEntry *entry;
-     void *entry_arg;
-     Coroutine *caller;
-+
-+    /* Only used when the coroutine has terminated.  */
-     QSLIST_ENTRY(Coroutine) pool_next;
-+
-     size_t locks_held;
--    /* Coroutines that should be woken up when we yield or terminate */
-+    /* Coroutines that should be woken up when we yield or terminate.
-+     * Only used when the coroutine is running.
-+     */
-     QSIMPLEQ_HEAD(, Coroutine) co_queue_wakeup;
-+
-+    /* Only used when the coroutine has yielded.  */
-+    AioContext *ctx;
-     QSIMPLEQ_ENTRY(Coroutine) co_queue_next;
-+    QSLIST_ENTRY(Coroutine) co_scheduled_next;
- };
- Coroutine *qemu_coroutine_new(void);
-diff --git a/tests/iothread.h b/tests/iothread.h
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/tests/iothread.h
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * Event loop thread implementation for unit tests
-+ *
-+ * Copyright Red Hat Inc., 2013, 2016
-+ *
-+ * Authors:
-+ *  Stefan Hajnoczi   <stefanha@redhat.com>
-+ *  Paolo Bonzini     <pbonzini@redhat.com>
-+ *
-+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
-+ * See the COPYING file in the top-level directory.
-+ */
-+#ifndef TEST_IOTHREAD_H
-+#define TEST_IOTHREAD_H
-+
-+#include "block/aio.h"
-+#include "qemu/thread.h"
-+
-+typedef struct IOThread IOThread;
-+
-+IOThread *iothread_new(void);
-+void iothread_join(IOThread *iothread);
-+AioContext *iothread_get_aio_context(IOThread *iothread);
-+
-+#endif
-diff --git a/tests/iothread.c b/tests/iothread.c
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/tests/iothread.c
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * Event loop thread implementation for unit tests
-+ *
-+ * Copyright Red Hat Inc., 2013, 2016
-+ *
-+ * Authors:
-+ *  Stefan Hajnoczi   <stefanha@redhat.com>
-+ *  Paolo Bonzini     <pbonzini@redhat.com>
-+ *
-+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
-+ * See the COPYING file in the top-level directory.
-+ *
-+ */
-+
-+#include "qemu/osdep.h"
-+#include "qapi/error.h"
-+#include "block/aio.h"
-+#include "qemu/main-loop.h"
-+#include "qemu/rcu.h"
-+#include "iothread.h"
-+
-+struct IOThread {
-+    AioContext *ctx;
-+
-+    QemuThread thread;
-+    QemuMutex init_done_lock;
-+    QemuCond init_done_cond;    /* is thread initialization done? */
-+    bool stopping;
-+};
-+
-+static __thread IOThread *my_iothread;
-+
-+AioContext *qemu_get_current_aio_context(void)
-+{
-+    return my_iothread ? my_iothread->ctx : qemu_get_aio_context();
-+}
-+
-+static void *iothread_run(void *opaque)
-+{
-+    IOThread *iothread = opaque;
-+
-+    rcu_register_thread();
-+
-+    my_iothread = iothread;
-+    qemu_mutex_lock(&iothread->init_done_lock);
-+    iothread->ctx = aio_context_new(&error_abort);
-+    qemu_cond_signal(&iothread->init_done_cond);
-+    qemu_mutex_unlock(&iothread->init_done_lock);
-+
-+    while (!atomic_read(&iothread->stopping)) {
-+        aio_poll(iothread->ctx, true);
-+    }
-+
-+    rcu_unregister_thread();
-+    return NULL;
-+}
-+
-+void iothread_join(IOThread *iothread)
-+{
-+    iothread->stopping = true;
-+    aio_notify(iothread->ctx);
-+    qemu_thread_join(&iothread->thread);
-+    qemu_cond_destroy(&iothread->init_done_cond);
-+    qemu_mutex_destroy(&iothread->init_done_lock);
-+    aio_context_unref(iothread->ctx);
-+    g_free(iothread);
-+}
-+
-+IOThread *iothread_new(void)
-+{
-+    IOThread *iothread = g_new0(IOThread, 1);
-+
-+    qemu_mutex_init(&iothread->init_done_lock);
-+    qemu_cond_init(&iothread->init_done_cond);
-+    qemu_thread_create(&iothread->thread, NULL, iothread_run,
-+                       iothread, QEMU_THREAD_JOINABLE);
-+
-+    /* Wait for initialization to complete */
-+    qemu_mutex_lock(&iothread->init_done_lock);
-+    while (iothread->ctx == NULL) {
-+        qemu_cond_wait(&iothread->init_done_cond,
-+                       &iothread->init_done_lock);
-+    }
-+    qemu_mutex_unlock(&iothread->init_done_lock);
-+    return iothread;
-+}
-+
-+AioContext *iothread_get_aio_context(IOThread *iothread)
-+{
-+    return iothread->ctx;
-+}
-diff --git a/tests/test-aio-multithread.c b/tests/test-aio-multithread.c
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/tests/test-aio-multithread.c
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * AioContext multithreading tests
-+ *
-+ * Copyright Red Hat, Inc. 2016
-+ *
-+ * Authors:
-+ *  Paolo Bonzini    <pbonzini@redhat.com>
-+ *
-+ * This work is licensed under the terms of the GNU LGPL, version 2 or later.
-+ * See the COPYING.LIB file in the top-level directory.
-+ */
-+
-+#include "qemu/osdep.h"
-+#include <glib.h>
-+#include "block/aio.h"
-+#include "qapi/error.h"
-+#include "qemu/coroutine.h"
-+#include "qemu/thread.h"
-+#include "qemu/error-report.h"
-+#include "iothread.h"
-+
-+/* AioContext management */
-+
-+#define NUM_CONTEXTS 5
-+
-+static IOThread *threads[NUM_CONTEXTS];
-+static AioContext *ctx[NUM_CONTEXTS];
-+static __thread int id = -1;
-+
-+static QemuEvent done_event;
-+
-+/* Run a function synchronously on a remote iothread. */
-+
-+typedef struct CtxRunData {
-+    QEMUBHFunc *cb;
-+    void *arg;
-+} CtxRunData;
-+
-+static void ctx_run_bh_cb(void *opaque)
-+{
-+    CtxRunData *data = opaque;
-+
-+    data->cb(data->arg);
-+    qemu_event_set(&done_event);
-+}
-+
-+static void ctx_run(int i, QEMUBHFunc *cb, void *opaque)
-+{
-+    CtxRunData data = {
-+        .cb = cb,
-+        .arg = opaque
-+    };
-+
-+    qemu_event_reset(&done_event);
-+    aio_bh_schedule_oneshot(ctx[i], ctx_run_bh_cb, &data);
-+    qemu_event_wait(&done_event);
-+}
-+
-+/* Starting the iothreads. */
-+
-+static void set_id_cb(void *opaque)
-+{
-+    int *i = opaque;
-+
-+    id = *i;
-+}
-+
-+static void create_aio_contexts(void)
-+{
-+    int i;
-+
-+    for (i = 0; i < NUM_CONTEXTS; i++) {
-+        threads[i] = iothread_new();
-+        ctx[i] = iothread_get_aio_context(threads[i]);
-+    }
-+
-+    qemu_event_init(&done_event, false);
-+    for (i = 0; i < NUM_CONTEXTS; i++) {
-+        ctx_run(i, set_id_cb, &i);
-+    }
-+}
-+
-+/* Stopping the iothreads. */
-+
-+static void join_aio_contexts(void)
-+{
-+    int i;
-+
-+    for (i = 0; i < NUM_CONTEXTS; i++) {
-+        aio_context_ref(ctx[i]);
-+    }
-+    for (i = 0; i < NUM_CONTEXTS; i++) {
-+        iothread_join(threads[i]);
-+    }
-+    for (i = 0; i < NUM_CONTEXTS; i++) {
-+        aio_context_unref(ctx[i]);
-+    }
-+    qemu_event_destroy(&done_event);
-+}
-+
-+/* Basic test for the stuff above. */
-+
-+static void test_lifecycle(void)
-+{
-+    create_aio_contexts();
-+    join_aio_contexts();
-+}
-+
-+/* aio_co_schedule test.  */
-+
-+static Coroutine *to_schedule[NUM_CONTEXTS];
-+
-+static bool now_stopping;
-+
-+static int count_retry;
-+static int count_here;
-+static int count_other;
-+
-+static bool schedule_next(int n)
-+{
-+    Coroutine *co;
-+
-+    co = atomic_xchg(&to_schedule[n], NULL);
-+    if (!co) {
-+        atomic_inc(&count_retry);
-+        return false;
-+    }
-+
-+    if (n == id) {
-+        atomic_inc(&count_here);
-+    } else {
-+        atomic_inc(&count_other);
-+    }
-+
-+    aio_co_schedule(ctx[n], co);
-+    return true;
-+}
-+
-+static void finish_cb(void *opaque)
-+{
-+    schedule_next(id);
-+}
-+
-+static coroutine_fn void test_multi_co_schedule_entry(void *opaque)
-+{
-+    g_assert(to_schedule[id] == NULL);
-+    atomic_mb_set(&to_schedule[id], qemu_coroutine_self());
-+
-+    while (!atomic_mb_read(&now_stopping)) {
-+        int n;
-+
-+        n = g_test_rand_int_range(0, NUM_CONTEXTS);
-+        schedule_next(n);
-+        qemu_coroutine_yield();
-+
-+        g_assert(to_schedule[id] == NULL);
-+        atomic_mb_set(&to_schedule[id], qemu_coroutine_self());
-+    }
-+}
-+
-+
-+static void test_multi_co_schedule(int seconds)
-+{
-+    int i;
-+
-+    count_here = count_other = count_retry = 0;
-+    now_stopping = false;
-+
-+    create_aio_contexts();
-+    for (i = 0; i < NUM_CONTEXTS; i++) {
-+        Coroutine *co1 = qemu_coroutine_create(test_multi_co_schedule_entry, NULL);
-+        aio_co_schedule(ctx[i], co1);
-+    }
-+
-+    g_usleep(seconds * 1000000);
-+
-+    atomic_mb_set(&now_stopping, true);
-+    for (i = 0; i < NUM_CONTEXTS; i++) {
-+        ctx_run(i, finish_cb, NULL);
-+        to_schedule[i] = NULL;
-+    }
-+
-+    join_aio_contexts();
-+    g_test_message("scheduled %d, queued %d, retry %d, total %d\n",
-+                  count_other, count_here, count_retry,
-+                  count_here + count_other + count_retry);
-+}
-+
-+static void test_multi_co_schedule_1(void)
-+{
-+    test_multi_co_schedule(1);
-+}
-+
-+static void test_multi_co_schedule_10(void)
-+{
-+    test_multi_co_schedule(10);
-+}
-+
-+/* End of tests.  */
-+
-+int main(int argc, char **argv)
-+{
-+    init_clocks();
-+
-+    g_test_init(&argc, &argv, NULL);
-+    g_test_add_func("/aio/multi/lifecycle", test_lifecycle);
-+    if (g_test_quick()) {
-+        g_test_add_func("/aio/multi/schedule", test_multi_co_schedule_1);
-+    } else {
-+        g_test_add_func("/aio/multi/schedule", test_multi_co_schedule_10);
-+    }
-+    return g_test_run();
-+}
-diff --git a/util/async.c b/util/async.c
-index XXXXXXX..XXXXXXX 100644
---- a/util/async.c
-+++ b/util/async.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/main-loop.h"
- #include "qemu/atomic.h"
- #include "block/raw-aio.h"
-+#include "qemu/coroutine_int.h"
-+#include "trace.h"
- /***********************************************************/
- /* bottom halves (can be seen as timers which expire ASAP) */
-@@ -XXX,XX +XXX,XX @@ aio_ctx_finalize(GSource     *source)
-     }
- #endif
-+    assert(QSLIST_EMPTY(&ctx->scheduled_coroutines));
-+    qemu_bh_delete(ctx->co_schedule_bh);
-+
-     qemu_lockcnt_lock(&ctx->list_lock);
-     assert(!qemu_lockcnt_count(&ctx->list_lock));
-     while (ctx->first_bh) {
-@@ -XXX,XX +XXX,XX @@ static bool event_notifier_poll(void *opaque)
-     return atomic_read(&ctx->notified);
- }
-+static void co_schedule_bh_cb(void *opaque)
-+{
-+    AioContext *ctx = opaque;
-+    QSLIST_HEAD(, Coroutine) straight, reversed;
-+
-+    QSLIST_MOVE_ATOMIC(&reversed, &ctx->scheduled_coroutines);
-+    QSLIST_INIT(&straight);
-+
-+    while (!QSLIST_EMPTY(&reversed)) {
-+        Coroutine *co = QSLIST_FIRST(&reversed);
-+        QSLIST_REMOVE_HEAD(&reversed, co_scheduled_next);
-+        QSLIST_INSERT_HEAD(&straight, co, co_scheduled_next);
-+    }
-+
-+    while (!QSLIST_EMPTY(&straight)) {
-+        Coroutine *co = QSLIST_FIRST(&straight);
-+        QSLIST_REMOVE_HEAD(&straight, co_scheduled_next);
-+        trace_aio_co_schedule_bh_cb(ctx, co);
-+        qemu_coroutine_enter(co);
-+    }
-+}
-+
- AioContext *aio_context_new(Error **errp)
- {
-     int ret;
-@@ -XXX,XX +XXX,XX @@ AioContext *aio_context_new(Error **errp)
-     }
-     g_source_set_can_recurse(&ctx->source, true);
-     qemu_lockcnt_init(&ctx->list_lock);
-+
-+    ctx->co_schedule_bh = aio_bh_new(ctx, co_schedule_bh_cb, ctx);
-+    QSLIST_INIT(&ctx->scheduled_coroutines);
-+
-     aio_set_event_notifier(ctx, &ctx->notifier,
-                            false,
-                            (EventNotifierHandler *)
-@@ -XXX,XX +XXX,XX @@ fail:
-     return NULL;
- }
-+void aio_co_schedule(AioContext *ctx, Coroutine *co)
-+{
-+    trace_aio_co_schedule(ctx, co);
-+    QSLIST_INSERT_HEAD_ATOMIC(&ctx->scheduled_coroutines,
-+                              co, co_scheduled_next);
-+    qemu_bh_schedule(ctx->co_schedule_bh);
-+}
-+
-+void aio_co_wake(struct Coroutine *co)
-+{
-+    AioContext *ctx;
-+
-+    /* Read coroutine before co->ctx.  Matches smp_wmb in
-+     * qemu_coroutine_enter.
-+     */
-+    smp_read_barrier_depends();
-+    ctx = atomic_read(&co->ctx);
-+
-+    if (ctx != qemu_get_current_aio_context()) {
-+        aio_co_schedule(ctx, co);
-+        return;
-+    }
-+
-+    if (qemu_in_coroutine()) {
-+        Coroutine *self = qemu_coroutine_self();
-+        assert(self != co);
-+        QSIMPLEQ_INSERT_TAIL(&self->co_queue_wakeup, co, co_queue_next);
-+    } else {
-+        aio_context_acquire(ctx);
-+        qemu_coroutine_enter(co);
-+        aio_context_release(ctx);
-+    }
-+}
-+
- void aio_context_ref(AioContext *ctx)
- {
-     g_source_ref(&ctx->source);
-diff --git a/util/qemu-coroutine.c b/util/qemu-coroutine.c
-index XXXXXXX..XXXXXXX 100644
---- a/util/qemu-coroutine.c
-+++ b/util/qemu-coroutine.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/atomic.h"
- #include "qemu/coroutine.h"
- #include "qemu/coroutine_int.h"
-+#include "block/aio.h"
- enum {
-     POOL_BATCH_SIZE = 64,
-@@ -XXX,XX +XXX,XX @@ void qemu_coroutine_enter(Coroutine *co)
-     }
-     co->caller = self;
-+    co->ctx = qemu_get_current_aio_context();
-+
-+    /* Store co->ctx before anything that stores co.  Matches
-+     * barrier in aio_co_wake.
-+     */
-+    smp_wmb();
-+
-     ret = qemu_coroutine_switch(self, co, COROUTINE_ENTER);
-     qemu_co_queue_run_restart(co);
-diff --git a/util/trace-events b/util/trace-events
-index XXXXXXX..XXXXXXX 100644
---- a/util/trace-events
-+++ b/util/trace-events
-@@ -XXX,XX +XXX,XX @@ run_poll_handlers_end(void *ctx, bool progress) "ctx %p progress %d"
- poll_shrink(void *ctx, int64_t old, int64_t new) "ctx %p old %"PRId64" new %"PRId64
- poll_grow(void *ctx, int64_t old, int64_t new) "ctx %p old %"PRId64" new %"PRId64
-+# util/async.c
-+aio_co_schedule(void *ctx, void *co) "ctx %p co %p"
-+aio_co_schedule_bh_cb(void *ctx, void *co) "ctx %p co %p"
-+
- # util/thread-pool.c
- thread_pool_submit(void *pool, void *req, void *opaque) "pool %p req %p opaque %p"
- thread_pool_complete(void *pool, void *req, void *opaque, int ret) "pool %p req %p opaque %p ret %d"
---
-.9.3

-[Qemu-devel] [PULL v2 03/24] block-backend: allow blk_prw from coroutine context
+Deleted patch
-From: Paolo Bonzini <pbonzini@redhat.com>
-qcow2_create2 calls this.  Do not run a nested event loop, as that
-breaks when aio_co_wake tries to queue the coroutine on the co_queue_wakeup
-list of the currently running one.
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Reviewed-by: Fam Zheng <famz@redhat.com>
-Message-id: 20170213135235.12274-4-pbonzini@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- block/block-backend.c | 12 ++++++++----
-file changed, 8 insertions(+), 4 deletions(-)
-diff --git a/block/block-backend.c b/block/block-backend.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/block-backend.c
-+++ b/block/block-backend.c
-@@ -XXX,XX +XXX,XX @@ static int blk_prw(BlockBackend *blk, int64_t offset, uint8_t *buf,
- {
-     QEMUIOVector qiov;
-     struct iovec iov;
--    Coroutine *co;
-     BlkRwCo rwco;
-     iov = (struct iovec) {
-@@ -XXX,XX +XXX,XX @@ static int blk_prw(BlockBackend *blk, int64_t offset, uint8_t *buf,
-         .ret    = NOT_DONE,
-     };
--    co = qemu_coroutine_create(co_entry, &rwco);
--    qemu_coroutine_enter(co);
--    BDRV_POLL_WHILE(blk_bs(blk), rwco.ret == NOT_DONE);
-+    if (qemu_in_coroutine()) {
-+        /* Fast-path if already in coroutine context */
-+        co_entry(&rwco);
-+    } else {
-+        Coroutine *co = qemu_coroutine_create(co_entry, &rwco);
-+        qemu_coroutine_enter(co);
-+        BDRV_POLL_WHILE(blk_bs(blk), rwco.ret == NOT_DONE);
-+    }
-     return rwco.ret;
- }
---
-.9.3

-[Qemu-devel] [PULL v2 04/24] test-thread-pool: use generic AioContext infrastructure
+Deleted patch
-From: Paolo Bonzini <pbonzini@redhat.com>
-Once the thread pool starts using aio_co_wake, it will also need
-qemu_get_current_aio_context().  Make test-thread-pool create
-an AioContext with qemu_init_main_loop, so that stubs/iothread.c
-and tests/iothread.c can provide the rest.
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Reviewed-by: Fam Zheng <famz@redhat.com>
-Message-id: 20170213135235.12274-5-pbonzini@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- tests/test-thread-pool.c | 12 +++---------
-file changed, 3 insertions(+), 9 deletions(-)
-diff --git a/tests/test-thread-pool.c b/tests/test-thread-pool.c
-index XXXXXXX..XXXXXXX 100644
---- a/tests/test-thread-pool.c
-+++ b/tests/test-thread-pool.c
-@@ -XXX,XX +XXX,XX @@
- #include "qapi/error.h"
- #include "qemu/timer.h"
- #include "qemu/error-report.h"
-+#include "qemu/main-loop.h"
- static AioContext *ctx;
- static ThreadPool *pool;
-@@ -XXX,XX +XXX,XX @@ static void test_cancel_async(void)
- int main(int argc, char **argv)
- {
-     int ret;
--    Error *local_error = NULL;
--    init_clocks();
--
--    ctx = aio_context_new(&local_error);
--    if (!ctx) {
--        error_reportf_err(local_error, "Failed to create AIO Context: ");
--        exit(1);
--    }
-+    qemu_init_main_loop(&error_abort);
-+    ctx = qemu_get_current_aio_context();
-     pool = aio_get_thread_pool(ctx);
-     g_test_init(&argc, &argv, NULL);
-@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
-     ret = g_test_run();
--    aio_context_unref(ctx);
-     return ret;
- }
---
-.9.3

-[Qemu-devel] [PULL v2 24/24] coroutine-lock: make CoRwlock thread-safe and fair
+[Qemu-devel] [PULL v2 1/8] nvme: do not advertise support for unsupported arbitration mechanism
-From: Paolo Bonzini <pbonzini@redhat.com>
+From: Klaus Birkelund Jensen <klaus@birkelund.eu>
-This adds a CoMutex around the existing CoQueue.  Because the write-side
+The device mistakenly reports that the Weighted Round Robin with Urgent
-can just take CoMutex, the old "writer" field is not necessary anymore.
+Priority Class arbitration mechanism is supported.
 Instead of removing it altogether, count the number of pending writers
 during a read-side critical section and forbid further readers from
 entering.
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+It is not.
-Reviewed-by: Fam Zheng <famz@redhat.com>
-Message-id: 20170213181244.16297-7-pbonzini@redhat.com
+Signed-off-by: Klaus Birkelund Jensen <klaus.jensen@cnexlabs.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Message-id: 20190606092530.14206-1-klaus@birkelund.eu
 Acked-by: Maxim Levitsky <mlevitsk@redhat.com>
 Signed-off-by: Max Reitz <mreitz@redhat.com>
 ---
- include/qemu/coroutine.h   |  3 ++-
+ hw/block/nvme.c | 1 -
- util/qemu-coroutine-lock.c | 35 ++++++++++++++++++++++++-----------
+file changed, 1 deletion(-)
 files changed, 26 insertions(+), 12 deletions(-)
-diff --git a/include/qemu/coroutine.h b/include/qemu/coroutine.h
+diff --git a/hw/block/nvme.c b/hw/block/nvme.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/qemu/coroutine.h
+--- a/hw/block/nvme.c
-+++ b/include/qemu/coroutine.h
++++ b/hw/block/nvme.c
-@@ -XXX,XX +XXX,XX @@ bool qemu_co_queue_empty(CoQueue *queue);
+@@ -XXX,XX +XXX,XX @@ static void nvme_realize(PCIDevice *pci_dev, Error **errp)
+     n->bar.cap = 0;
+     NVME_CAP_SET_MQES(n->bar.cap, 0x7ff);
- typedef struct CoRwlock {
+     NVME_CAP_SET_CQR(n->bar.cap, 1);
--    bool writer;
+-    NVME_CAP_SET_AMS(n->bar.cap, 1);
-+    int pending_writer;
+     NVME_CAP_SET_TO(n->bar.cap, 0xf);
-     int reader;
+     NVME_CAP_SET_CSS(n->bar.cap, 1);
-+    CoMutex mutex;
+     NVME_CAP_SET_MPSMAX(n->bar.cap, 4);
      CoQueue queue;
  } CoRwlock;
 diff --git a/util/qemu-coroutine-lock.c b/util/qemu-coroutine-lock.c
 index XXXXXXX..XXXXXXX 100644
 --- a/util/qemu-coroutine-lock.c
 +++ b/util/qemu-coroutine-lock.c
@@ -XXX,XX +XXX,XX @@ void qemu_co_rwlock_init(CoRwlock *lock)
  {
      memset(lock, 0, sizeof(*lock));
      qemu_co_queue_init(&lock->queue);
 +    qemu_co_mutex_init(&lock->mutex);
  }
  void qemu_co_rwlock_rdlock(CoRwlock *lock)
  {
      Coroutine *self = qemu_coroutine_self();
 -    while (lock->writer) {
 -        qemu_co_queue_wait(&lock->queue, NULL);
 +    qemu_co_mutex_lock(&lock->mutex);
 +    /* For fairness, wait if a writer is in line.  */
 +    while (lock->pending_writer) {
 +        qemu_co_queue_wait(&lock->queue, &lock->mutex);
      }
      lock->reader++;
 +    qemu_co_mutex_unlock(&lock->mutex);
 +
 +    /* The rest of the read-side critical section is run without the mutex.  */
      self->locks_held++;
  }
@@ -XXX,XX +XXX,XX @@ void qemu_co_rwlock_unlock(CoRwlock *lock)
      Coroutine *self = qemu_coroutine_self();
      assert(qemu_in_coroutine());
 -    if (lock->writer) {
 -        lock->writer = false;
 +    if (!lock->reader) {
 +        /* The critical section started in qemu_co_rwlock_wrlock.  */
          qemu_co_queue_restart_all(&lock->queue);
      } else {
 +        self->locks_held--;
 +
 +        qemu_co_mutex_lock(&lock->mutex);
          lock->reader--;
          assert(lock->reader >= 0);
          /* Wakeup only one waiting writer */
@@ -XXX,XX +XXX,XX @@ void qemu_co_rwlock_unlock(CoRwlock *lock)
              qemu_co_queue_next(&lock->queue);
          }
      }
 -    self->locks_held--;
 +    qemu_co_mutex_unlock(&lock->mutex);
  }
  void qemu_co_rwlock_wrlock(CoRwlock *lock)
  {
 -    Coroutine *self = qemu_coroutine_self();
 -
 -    while (lock->writer || lock->reader) {
 -        qemu_co_queue_wait(&lock->queue, NULL);
 +    qemu_co_mutex_lock(&lock->mutex);
 +    lock->pending_writer++;
 +    while (lock->reader) {
 +        qemu_co_queue_wait(&lock->queue, &lock->mutex);
      }
 -    lock->writer = true;
 -    self->locks_held++;
 +    lock->pending_writer--;
 +
 +    /* The rest of the write-side critical section is run with
 +     * the mutex taken, so that lock->reader remains zero.
 +     * There is no need to update self->locks_held.
 +     */
  }
 --
-.9.3
+.21.0

-[Qemu-devel] [PULL v2 07/24] nbd: convert to use qio_channel_yield
+[Qemu-devel] [PULL v2 2/8] blockdev: enable non-root nodes for transaction drive-backup source
-From: Paolo Bonzini <pbonzini@redhat.com>
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-In the client, read the reply headers from a coroutine, switching the
+We forget to enable it for transaction .prepare, while it is already
-read side between the "read header" coroutine and the I/O coroutine that
+enabled in do_drive_backup since commit a2d665c1bc362
-reads the body of the reply.
+    "blockdev: loosen restrictions on drive-backup source node"
-In the server, if the server can read more requests it will create a new
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-"read request" coroutine as soon as a request has been read.  Otherwise,
+Message-id: 20190618140804.59214-1-vsementsov@virtuozzo.com
-the new coroutine is created in nbd_request_put.
+Reviewed-by: John Snow <jsnow@redhat.com>
 Signed-off-by: Max Reitz <mreitz@redhat.com>
 ---
  blockdev.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+diff --git a/blockdev.c b/blockdev.c
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 Reviewed-by: Fam Zheng <famz@redhat.com>
 Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
 Message-id: 20170213135235.12274-8-pbonzini@redhat.com
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
  block/nbd-client.h |   2 +-
  block/nbd-client.c | 117 ++++++++++++++++++++++++-----------------------------
  nbd/client.c       |   2 +-
  nbd/common.c       |   9 +----
  nbd/server.c       |  94 +++++++++++++-----------------------------
 files changed, 83 insertions(+), 141 deletions(-)
 diff --git a/block/nbd-client.h b/block/nbd-client.h
 index XXXXXXX..XXXXXXX 100644
---- a/block/nbd-client.h
+--- a/blockdev.c
-+++ b/block/nbd-client.h
++++ b/blockdev.c
-@@ -XXX,XX +XXX,XX @@ typedef struct NBDClientSession {
+@@ -XXX,XX +XXX,XX @@ static void drive_backup_prepare(BlkActionState *common, Error **errp)
+     assert(common->action->type == TRANSACTION_ACTION_KIND_DRIVE_BACKUP);
-     CoMutex send_mutex;
+     backup = common->action->u.drive_backup.data;
-     CoQueue free_sema;
--    Coroutine *send_coroutine;
+-    bs = qmp_get_root_bs(backup->device, errp);
-+    Coroutine *read_reply_co;
++    bs = bdrv_lookup_bs(backup->device, backup->device, errp);
-     int in_flight;
+     if (!bs) {
      Coroutine *recv_coroutine[MAX_NBD_REQUESTS];
 diff --git a/block/nbd-client.c b/block/nbd-client.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/nbd-client.c
 +++ b/block/nbd-client.c
@@ -XXX,XX +XXX,XX @@
  #define HANDLE_TO_INDEX(bs, handle) ((handle) ^ ((uint64_t)(intptr_t)bs))
  #define INDEX_TO_HANDLE(bs, index)  ((index)  ^ ((uint64_t)(intptr_t)bs))
 -static void nbd_recv_coroutines_enter_all(NBDClientSession *s)
 +static void nbd_recv_coroutines_enter_all(BlockDriverState *bs)
  {
 +    NBDClientSession *s = nbd_get_client_session(bs);
      int i;
      for (i = 0; i < MAX_NBD_REQUESTS; i++) {
@@ -XXX,XX +XXX,XX @@ static void nbd_recv_coroutines_enter_all(NBDClientSession *s)
              qemu_coroutine_enter(s->recv_coroutine[i]);
          }
      }
 +    BDRV_POLL_WHILE(bs, s->read_reply_co);
  }
  static void nbd_teardown_connection(BlockDriverState *bs)
@@ -XXX,XX +XXX,XX @@ static void nbd_teardown_connection(BlockDriverState *bs)
      qio_channel_shutdown(client->ioc,
                           QIO_CHANNEL_SHUTDOWN_BOTH,
                           NULL);
 -    nbd_recv_coroutines_enter_all(client);
 +    nbd_recv_coroutines_enter_all(bs);
      nbd_client_detach_aio_context(bs);
      object_unref(OBJECT(client->sioc));
@@ -XXX,XX +XXX,XX @@ static void nbd_teardown_connection(BlockDriverState *bs)
      client->ioc = NULL;
  }
 -static void nbd_reply_ready(void *opaque)
 +static coroutine_fn void nbd_read_reply_entry(void *opaque)
  {
 -    BlockDriverState *bs = opaque;
 -    NBDClientSession *s = nbd_get_client_session(bs);
 +    NBDClientSession *s = opaque;
      uint64_t i;
      int ret;
 -    if (!s->ioc) { /* Already closed */
 -        return;
 -    }
 -
 -    if (s->reply.handle == 0) {
 -        /* No reply already in flight.  Fetch a header.  It is possible
 -         * that another thread has done the same thing in parallel, so
 -         * the socket is not readable anymore.
 -         */
 +    for (;;) {
 +        assert(s->reply.handle == 0);
          ret = nbd_receive_reply(s->ioc, &s->reply);
 -        if (ret == -EAGAIN) {
 -            return;
 -        }
          if (ret < 0) {
 -            s->reply.handle = 0;
 -            goto fail;
 +            break;
          }
 -    }
 -    /* There's no need for a mutex on the receive side, because the
 -     * handler acts as a synchronization point and ensures that only
 -     * one coroutine is called until the reply finishes.  */
 -    i = HANDLE_TO_INDEX(s, s->reply.handle);
 -    if (i >= MAX_NBD_REQUESTS) {
 -        goto fail;
 -    }
 +        /* There's no need for a mutex on the receive side, because the
 +         * handler acts as a synchronization point and ensures that only
 +         * one coroutine is called until the reply finishes.
 +         */
 +        i = HANDLE_TO_INDEX(s, s->reply.handle);
 +        if (i >= MAX_NBD_REQUESTS || !s->recv_coroutine[i]) {
 +            break;
 +        }
 -    if (s->recv_coroutine[i]) {
 -        qemu_coroutine_enter(s->recv_coroutine[i]);
 -        return;
 +        /* We're woken up by the recv_coroutine itself.  Note that there
 +         * is no race between yielding and reentering read_reply_co.  This
 +         * is because:
 +         *
 +         * - if recv_coroutine[i] runs on the same AioContext, it is only
 +         *   entered after we yield
 +         *
 +         * - if recv_coroutine[i] runs on a different AioContext, reentering
 +         *   read_reply_co happens through a bottom half, which can only
 +         *   run after we yield.
 +         */
 +        aio_co_wake(s->recv_coroutine[i]);
 +        qemu_coroutine_yield();
      }
 -
 -fail:
 -    nbd_teardown_connection(bs);
 -}
 -
 -static void nbd_restart_write(void *opaque)
 -{
 -    BlockDriverState *bs = opaque;
 -
 -    qemu_coroutine_enter(nbd_get_client_session(bs)->send_coroutine);
 +    s->read_reply_co = NULL;
  }
  static int nbd_co_send_request(BlockDriverState *bs,
@@ -XXX,XX +XXX,XX @@ static int nbd_co_send_request(BlockDriverState *bs,
                                 QEMUIOVector *qiov)
  {
      NBDClientSession *s = nbd_get_client_session(bs);
 -    AioContext *aio_context;
      int rc, ret, i;
      qemu_co_mutex_lock(&s->send_mutex);
@@ -XXX,XX +XXX,XX @@ static int nbd_co_send_request(BlockDriverState *bs,
          return -EPIPE;
      }
 -    s->send_coroutine = qemu_coroutine_self();
 -    aio_context = bdrv_get_aio_context(bs);
 -
 -    aio_set_fd_handler(aio_context, s->sioc->fd, false,
 -                       nbd_reply_ready, nbd_restart_write, NULL, bs);
      if (qiov) {
          qio_channel_set_cork(s->ioc, true);
          rc = nbd_send_request(s->ioc, request);
@@ -XXX,XX +XXX,XX @@ static int nbd_co_send_request(BlockDriverState *bs,
      } else {
          rc = nbd_send_request(s->ioc, request);
      }
 -    aio_set_fd_handler(aio_context, s->sioc->fd, false,
 -                       nbd_reply_ready, NULL, NULL, bs);
 -    s->send_coroutine = NULL;
      qemu_co_mutex_unlock(&s->send_mutex);
      return rc;
  }
@@ -XXX,XX +XXX,XX @@ static void nbd_co_receive_reply(NBDClientSession *s,
  {
      int ret;
 -    /* Wait until we're woken up by the read handler.  TODO: perhaps
 -     * peek at the next reply and avoid yielding if it's ours?  */
 +    /* Wait until we're woken up by nbd_read_reply_entry.  */
      qemu_coroutine_yield();
      *reply = s->reply;
      if (reply->handle != request->handle ||
@@ -XXX,XX +XXX,XX @@ static void nbd_coroutine_start(NBDClientSession *s,
      /* s->recv_coroutine[i] is set as soon as we get the send_lock.  */
  }
 -static void nbd_coroutine_end(NBDClientSession *s,
 +static void nbd_coroutine_end(BlockDriverState *bs,
                                NBDRequest *request)
  {
 +    NBDClientSession *s = nbd_get_client_session(bs);
      int i = HANDLE_TO_INDEX(s, request->handle);
 +
      s->recv_coroutine[i] = NULL;
 -    if (s->in_flight-- == MAX_NBD_REQUESTS) {
 -        qemu_co_queue_next(&s->free_sema);
 +    s->in_flight--;
 +    qemu_co_queue_next(&s->free_sema);
 +
 +    /* Kick the read_reply_co to get the next reply.  */
 +    if (s->read_reply_co) {
 +        aio_co_wake(s->read_reply_co);
      }
  }
@@ -XXX,XX +XXX,XX @@ int nbd_client_co_preadv(BlockDriverState *bs, uint64_t offset,
      } else {
          nbd_co_receive_reply(client, &request, &reply, qiov);
      }
 -    nbd_coroutine_end(client, &request);
 +    nbd_coroutine_end(bs, &request);
      return -reply.error;
  }
@@ -XXX,XX +XXX,XX @@ int nbd_client_co_pwritev(BlockDriverState *bs, uint64_t offset,
      } else {
          nbd_co_receive_reply(client, &request, &reply, NULL);
      }
 -    nbd_coroutine_end(client, &request);
 +    nbd_coroutine_end(bs, &request);
      return -reply.error;
  }
@@ -XXX,XX +XXX,XX @@ int nbd_client_co_pwrite_zeroes(BlockDriverState *bs, int64_t offset,
      } else {
          nbd_co_receive_reply(client, &request, &reply, NULL);
      }
 -    nbd_coroutine_end(client, &request);
 +    nbd_coroutine_end(bs, &request);
      return -reply.error;
  }
@@ -XXX,XX +XXX,XX @@ int nbd_client_co_flush(BlockDriverState *bs)
      } else {
          nbd_co_receive_reply(client, &request, &reply, NULL);
      }
 -    nbd_coroutine_end(client, &request);
 +    nbd_coroutine_end(bs, &request);
      return -reply.error;
  }
@@ -XXX,XX +XXX,XX @@ int nbd_client_co_pdiscard(BlockDriverState *bs, int64_t offset, int count)
      } else {
          nbd_co_receive_reply(client, &request, &reply, NULL);
      }
 -    nbd_coroutine_end(client, &request);
 +    nbd_coroutine_end(bs, &request);
      return -reply.error;
  }
  void nbd_client_detach_aio_context(BlockDriverState *bs)
  {
 -    aio_set_fd_handler(bdrv_get_aio_context(bs),
 -                       nbd_get_client_session(bs)->sioc->fd,
 -                       false, NULL, NULL, NULL, NULL);
 +    NBDClientSession *client = nbd_get_client_session(bs);
 +    qio_channel_detach_aio_context(QIO_CHANNEL(client->sioc));
  }
  void nbd_client_attach_aio_context(BlockDriverState *bs,
                                     AioContext *new_context)
  {
 -    aio_set_fd_handler(new_context, nbd_get_client_session(bs)->sioc->fd,
 -                       false, nbd_reply_ready, NULL, NULL, bs);
 +    NBDClientSession *client = nbd_get_client_session(bs);
 +    qio_channel_attach_aio_context(QIO_CHANNEL(client->sioc), new_context);
 +    aio_co_schedule(new_context, client->read_reply_co);
  }
  void nbd_client_close(BlockDriverState *bs)
@@ -XXX,XX +XXX,XX @@ int nbd_client_init(BlockDriverState *bs,
      /* Now that we're connected, set the socket to be non-blocking and
       * kick the reply mechanism.  */
      qio_channel_set_blocking(QIO_CHANNEL(sioc), false, NULL);
 -
 +    client->read_reply_co = qemu_coroutine_create(nbd_read_reply_entry, client);
      nbd_client_attach_aio_context(bs, bdrv_get_aio_context(bs));
      logout("Established connection with NBD server\n");
 diff --git a/nbd/client.c b/nbd/client.c
 index XXXXXXX..XXXXXXX 100644
 --- a/nbd/client.c
 +++ b/nbd/client.c
@@ -XXX,XX +XXX,XX @@ ssize_t nbd_receive_reply(QIOChannel *ioc, NBDReply *reply)
      ssize_t ret;
      ret = read_sync(ioc, buf, sizeof(buf));
 -    if (ret < 0) {
 +    if (ret <= 0) {
          return ret;
      }
 diff --git a/nbd/common.c b/nbd/common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/nbd/common.c
 +++ b/nbd/common.c
@@ -XXX,XX +XXX,XX @@ ssize_t nbd_wr_syncv(QIOChannel *ioc,
          }
          if (len == QIO_CHANNEL_ERR_BLOCK) {
              if (qemu_in_coroutine()) {
 -                /* XXX figure out if we can create a variant on
 -                 * qio_channel_yield() that works with AIO contexts
 -                 * and consider using that in this branch */
 -                qemu_coroutine_yield();
 -            } else if (done) {
 -                /* XXX this is needed by nbd_reply_ready.  */
 -                qio_channel_wait(ioc,
 -                                 do_read ? G_IO_IN : G_IO_OUT);
 +                qio_channel_yield(ioc, do_read ? G_IO_IN : G_IO_OUT);
              } else {
                  return -EAGAIN;
              }
 diff --git a/nbd/server.c b/nbd/server.c
 index XXXXXXX..XXXXXXX 100644
 --- a/nbd/server.c
 +++ b/nbd/server.c
@@ -XXX,XX +XXX,XX @@ struct NBDClient {
      CoMutex send_lock;
      Coroutine *send_coroutine;
 -    bool can_read;
 -
      QTAILQ_ENTRY(NBDClient) next;
      int nb_requests;
      bool closing;
@@ -XXX,XX +XXX,XX @@ struct NBDClient {
  /* That's all folks */
 -static void nbd_set_handlers(NBDClient *client);
 -static void nbd_unset_handlers(NBDClient *client);
 -static void nbd_update_can_read(NBDClient *client);
 +static void nbd_client_receive_next_request(NBDClient *client);
  static gboolean nbd_negotiate_continue(QIOChannel *ioc,
                                         GIOCondition condition,
@@ -XXX,XX +XXX,XX @@ void nbd_client_put(NBDClient *client)
           */
          assert(client->closing);
 -        nbd_unset_handlers(client);
 +        qio_channel_detach_aio_context(client->ioc);
          object_unref(OBJECT(client->sioc));
          object_unref(OBJECT(client->ioc));
          if (client->tlscreds) {
@@ -XXX,XX +XXX,XX @@ static NBDRequestData *nbd_request_get(NBDClient *client)
      assert(client->nb_requests <= MAX_NBD_REQUESTS - 1);
      client->nb_requests++;
 -    nbd_update_can_read(client);
      req = g_new0(NBDRequestData, 1);
      nbd_client_get(client);
@@ -XXX,XX +XXX,XX @@ static void nbd_request_put(NBDRequestData *req)
      g_free(req);
      client->nb_requests--;
 -    nbd_update_can_read(client);
 +    nbd_client_receive_next_request(client);
 +
      nbd_client_put(client);
  }
@@ -XXX,XX +XXX,XX @@ static void blk_aio_attached(AioContext *ctx, void *opaque)
      exp->ctx = ctx;
      QTAILQ_FOREACH(client, &exp->clients, next) {
 -        nbd_set_handlers(client);
 +        qio_channel_attach_aio_context(client->ioc, ctx);
 +        if (client->recv_coroutine) {
 +            aio_co_schedule(ctx, client->recv_coroutine);
 +        }
 +        if (client->send_coroutine) {
 +            aio_co_schedule(ctx, client->send_coroutine);
 +        }
      }
  }
@@ -XXX,XX +XXX,XX @@ static void blk_aio_detach(void *opaque)
      TRACE("Export %s: Detaching clients from AIO context %p\n", exp->name, exp->ctx);
      QTAILQ_FOREACH(client, &exp->clients, next) {
 -        nbd_unset_handlers(client);
 +        qio_channel_detach_aio_context(client->ioc);
      }
      exp->ctx = NULL;
@@ -XXX,XX +XXX,XX @@ static ssize_t nbd_co_send_reply(NBDRequestData *req, NBDReply *reply,
      g_assert(qemu_in_coroutine());
      qemu_co_mutex_lock(&client->send_lock);
      client->send_coroutine = qemu_coroutine_self();
 -    nbd_set_handlers(client);
      if (!len) {
          rc = nbd_send_reply(client->ioc, reply);
@@ -XXX,XX +XXX,XX @@ static ssize_t nbd_co_send_reply(NBDRequestData *req, NBDReply *reply,
      }
      client->send_coroutine = NULL;
 -    nbd_set_handlers(client);
      qemu_co_mutex_unlock(&client->send_lock);
      return rc;
  }
@@ -XXX,XX +XXX,XX @@ static ssize_t nbd_co_receive_request(NBDRequestData *req,
      ssize_t rc;
      g_assert(qemu_in_coroutine());
 -    client->recv_coroutine = qemu_coroutine_self();
 -    nbd_update_can_read(client);
 -
 +    assert(client->recv_coroutine == qemu_coroutine_self());
      rc = nbd_receive_request(client->ioc, request);
      if (rc < 0) {
          if (rc != -EAGAIN) {
@@ -XXX,XX +XXX,XX @@ static ssize_t nbd_co_receive_request(NBDRequestData *req,
  out:
      client->recv_coroutine = NULL;
 -    nbd_update_can_read(client);
 +    nbd_client_receive_next_request(client);
      return rc;
  }
 -static void nbd_trip(void *opaque)
 +/* Owns a reference to the NBDClient passed as opaque.  */
 +static coroutine_fn void nbd_trip(void *opaque)
  {
      NBDClient *client = opaque;
      NBDExport *exp = client->exp;
      NBDRequestData *req;
 -    NBDRequest request;
 +    NBDRequest request = { 0 };    /* GCC thinks it can be used uninitialized */
      NBDReply reply;
      ssize_t ret;
      int flags;
      TRACE("Reading request.");
      if (client->closing) {
 +        nbd_client_put(client);
          return;
      }
-@@ -XXX,XX +XXX,XX @@ static void nbd_trip(void *opaque)
- done:
-     nbd_request_put(req);
-+    nbd_client_put(client);
-     return;
- out:
-     nbd_request_put(req);
-     client_close(client);
-+    nbd_client_put(client);
- }
--static void nbd_read(void *opaque)
-+static void nbd_client_receive_next_request(NBDClient *client)
- {
--    NBDClient *client = opaque;
--
--    if (client->recv_coroutine) {
--        qemu_coroutine_enter(client->recv_coroutine);
--    } else {
--        qemu_coroutine_enter(qemu_coroutine_create(nbd_trip, client));
--    }
--}
--
--static void nbd_restart_write(void *opaque)
--{
--    NBDClient *client = opaque;
--
--    qemu_coroutine_enter(client->send_coroutine);
--}
--
--static void nbd_set_handlers(NBDClient *client)
--{
--    if (client->exp && client->exp->ctx) {
--        aio_set_fd_handler(client->exp->ctx, client->sioc->fd, true,
--                           client->can_read ? nbd_read : NULL,
--                           client->send_coroutine ? nbd_restart_write : NULL,
--                           NULL, client);
--    }
--}
--
--static void nbd_unset_handlers(NBDClient *client)
--{
--    if (client->exp && client->exp->ctx) {
--        aio_set_fd_handler(client->exp->ctx, client->sioc->fd, true, NULL,
--                           NULL, NULL, NULL);
--    }
--}
--
--static void nbd_update_can_read(NBDClient *client)
--{
--    bool can_read = client->recv_coroutine ||
--                    client->nb_requests < MAX_NBD_REQUESTS;
--
--    if (can_read != client->can_read) {
--        client->can_read = can_read;
--        nbd_set_handlers(client);
--
--        /* There is no need to invoke aio_notify(), since aio_set_fd_handler()
--         * in nbd_set_handlers() will have taken care of that */
-+    if (!client->recv_coroutine && client->nb_requests < MAX_NBD_REQUESTS) {
-+        nbd_client_get(client);
-+        client->recv_coroutine = qemu_coroutine_create(nbd_trip, client);
-+        aio_co_schedule(client->exp->ctx, client->recv_coroutine);
-     }
- }
-@@ -XXX,XX +XXX,XX @@ static coroutine_fn void nbd_co_client_start(void *opaque)
-         goto out;
-     }
-     qemu_co_mutex_init(&client->send_lock);
--    nbd_set_handlers(client);
-     if (exp) {
-         QTAILQ_INSERT_TAIL(&exp->clients, client, next);
-     }
-+
-+    nbd_client_receive_next_request(client);
-+
- out:
-     g_free(data);
- }
-@@ -XXX,XX +XXX,XX @@ void nbd_client_new(NBDExport *exp,
-     object_ref(OBJECT(client->sioc));
-     client->ioc = QIO_CHANNEL(sioc);
-     object_ref(OBJECT(client->ioc));
--    client->can_read = true;
-     client->close = close_fn;
-     data->client = client;
 --
-.9.3
+.21.0

-[Qemu-devel] [PULL v2 23/24] coroutine-lock: add mutex argument to CoQueue APIs
+[Qemu-devel] [PULL v2 3/8] iotest 134: test cluster-misaligned encrypted write
-From: Paolo Bonzini <pbonzini@redhat.com>
+From: Anton Nefedov <anton.nefedov@virtuozzo.com>
-All that CoQueue needs in order to become thread-safe is help
+COW (even empty/zero) areas require encryption too
 from an external mutex.  Add this to the API.
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Anton Nefedov <anton.nefedov@virtuozzo.com>
-Reviewed-by: Fam Zheng <famz@redhat.com>
+Reviewed-by: Eric Blake <eblake@redhat.com>
-Message-id: 20170213181244.16297-6-pbonzini@redhat.com
+Reviewed-by: Max Reitz <mreitz@redhat.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Reviewed-by: Alberto Garcia <berto@igalia.com>
 Message-id: 20190516143028.81155-1-anton.nefedov@virtuozzo.com
 Signed-off-by: Max Reitz <mreitz@redhat.com>
 ---
- include/qemu/coroutine.h   |  8 +++++---
+ tests/qemu-iotests/134     |  9 +++++++++
- block/backup.c             |  2 +-
+ tests/qemu-iotests/134.out | 10 ++++++++++
- block/io.c                 |  4 ++--
+files changed, 19 insertions(+)
  block/nbd-client.c         |  2 +-
  block/qcow2-cluster.c      |  4 +---
  block/sheepdog.c           |  2 +-
  block/throttle-groups.c    |  2 +-
  hw/9pfs/9p.c               |  2 +-
  util/qemu-coroutine-lock.c | 24 +++++++++++++++++++++---
 files changed, 34 insertions(+), 16 deletions(-)
-diff --git a/include/qemu/coroutine.h b/include/qemu/coroutine.h
+diff --git a/tests/qemu-iotests/134 b/tests/qemu-iotests/134
 index XXXXXXX..XXXXXXX 100755
 --- a/tests/qemu-iotests/134
 +++ b/tests/qemu-iotests/134
@@ -XXX,XX +XXX,XX @@ echo
  echo "== reading whole image =="
  $QEMU_IO --object $SECRET -c "read 0 $size" --image-opts $IMGSPEC | _filter_qemu_io | _filter_testdir
 +echo
 +echo "== rewriting cluster part =="
 +$QEMU_IO --object $SECRET -c "write -P 0xb 512 512" --image-opts $IMGSPEC | _filter_qemu_io | _filter_testdir
 +
 +echo
 +echo "== verify pattern =="
 +$QEMU_IO --object $SECRET -c "read -P 0 0 512"  --image-opts $IMGSPEC | _filter_qemu_io | _filter_testdir
 +$QEMU_IO --object $SECRET -c "read -P 0xb 512 512"  --image-opts $IMGSPEC | _filter_qemu_io | _filter_testdir
 +
  echo
  echo "== rewriting whole image =="
  $QEMU_IO --object $SECRET -c "write -P 0xa 0 $size" --image-opts $IMGSPEC | _filter_qemu_io | _filter_testdir
 diff --git a/tests/qemu-iotests/134.out b/tests/qemu-iotests/134.out
 index XXXXXXX..XXXXXXX 100644
---- a/include/qemu/coroutine.h
+--- a/tests/qemu-iotests/134.out
-+++ b/include/qemu/coroutine.h
++++ b/tests/qemu-iotests/134.out
-@@ -XXX,XX +XXX,XX @@ void coroutine_fn qemu_co_mutex_unlock(CoMutex *mutex);
+@@ -XXX,XX +XXX,XX @@ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 encryption=on encrypt.
+ read 134217728/134217728 bytes at offset 0
- /**
+MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-  * CoQueues are a mechanism to queue coroutines in order to continue executing
-- * them later.
++== rewriting cluster part ==
-+ * them later.  They are similar to condition variables, but they need help
++wrote 512/512 bytes at offset 512
-+ * from an external mutex in order to maintain thread-safety.
++512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
   */
  typedef struct CoQueue {
      QSIMPLEQ_HEAD(, Coroutine) entries;
@@ -XXX,XX +XXX,XX @@ void qemu_co_queue_init(CoQueue *queue);
  /**
   * Adds the current coroutine to the CoQueue and transfers control to the
 - * caller of the coroutine.
 + * caller of the coroutine.  The mutex is unlocked during the wait and
 + * locked again afterwards.
   */
 -void coroutine_fn qemu_co_queue_wait(CoQueue *queue);
 +void coroutine_fn qemu_co_queue_wait(CoQueue *queue, CoMutex *mutex);
  /**
   * Restarts the next coroutine in the CoQueue and removes it from the queue.
 diff --git a/block/backup.c b/block/backup.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/backup.c
 +++ b/block/backup.c
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn wait_for_overlapping_requests(BackupBlockJob *job,
          retry = false;
          QLIST_FOREACH(req, &job->inflight_reqs, list) {
              if (end > req->start && start < req->end) {
 -                qemu_co_queue_wait(&req->wait_queue);
 +                qemu_co_queue_wait(&req->wait_queue, NULL);
                  retry = true;
                  break;
              }
 diff --git a/block/io.c b/block/io.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/io.c
 +++ b/block/io.c
@@ -XXX,XX +XXX,XX @@ static bool coroutine_fn wait_serialising_requests(BdrvTrackedRequest *self)
                   * (instead of producing a deadlock in the former case). */
                  if (!req->waiting_for) {
                      self->waiting_for = req;
 -                    qemu_co_queue_wait(&req->wait_queue);
 +                    qemu_co_queue_wait(&req->wait_queue, NULL);
                      self->waiting_for = NULL;
                      retry = true;
                      waited = true;
@@ -XXX,XX +XXX,XX @@ int coroutine_fn bdrv_co_flush(BlockDriverState *bs)
      /* Wait until any previous flushes are completed */
      while (bs->active_flush_req) {
 -        qemu_co_queue_wait(&bs->flush_queue);
 +        qemu_co_queue_wait(&bs->flush_queue, NULL);
      }
      bs->active_flush_req = true;
 diff --git a/block/nbd-client.c b/block/nbd-client.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/nbd-client.c
 +++ b/block/nbd-client.c
@@ -XXX,XX +XXX,XX @@ static void nbd_coroutine_start(NBDClientSession *s,
      /* Poor man semaphore.  The free_sema is locked when no other request
       * can be accepted, and unlocked after receiving one reply.  */
      if (s->in_flight == MAX_NBD_REQUESTS) {
 -        qemu_co_queue_wait(&s->free_sema);
 +        qemu_co_queue_wait(&s->free_sema, NULL);
          assert(s->in_flight < MAX_NBD_REQUESTS);
      }
      s->in_flight++;
 diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/qcow2-cluster.c
 +++ b/block/qcow2-cluster.c
@@ -XXX,XX +XXX,XX @@ static int handle_dependencies(BlockDriverState *bs, uint64_t guest_offset,
              if (bytes == 0) {
                  /* Wait for the dependency to complete. We need to recheck
                   * the free/allocated clusters when we continue. */
 -                qemu_co_mutex_unlock(&s->lock);
 -                qemu_co_queue_wait(&old_alloc->dependent_requests);
 -                qemu_co_mutex_lock(&s->lock);
 +                qemu_co_queue_wait(&old_alloc->dependent_requests, &s->lock);
                  return -EAGAIN;
              }
          }
 diff --git a/block/sheepdog.c b/block/sheepdog.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/sheepdog.c
 +++ b/block/sheepdog.c
@@ -XXX,XX +XXX,XX @@ static void wait_for_overlapping_aiocb(BDRVSheepdogState *s, SheepdogAIOCB *acb)
  retry:
      QLIST_FOREACH(cb, &s->inflight_aiocb_head, aiocb_siblings) {
          if (AIOCBOverlapping(acb, cb)) {
 -            qemu_co_queue_wait(&s->overlapping_queue);
 +            qemu_co_queue_wait(&s->overlapping_queue, NULL);
              goto retry;
          }
      }
 diff --git a/block/throttle-groups.c b/block/throttle-groups.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/throttle-groups.c
 +++ b/block/throttle-groups.c
@@ -XXX,XX +XXX,XX @@ void coroutine_fn throttle_group_co_io_limits_intercept(BlockBackend *blk,
      if (must_wait || blkp->pending_reqs[is_write]) {
          blkp->pending_reqs[is_write]++;
          qemu_mutex_unlock(&tg->lock);
 -        qemu_co_queue_wait(&blkp->throttled_reqs[is_write]);
 +        qemu_co_queue_wait(&blkp->throttled_reqs[is_write], NULL);
          qemu_mutex_lock(&tg->lock);
          blkp->pending_reqs[is_write]--;
      }
 diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/9pfs/9p.c
 +++ b/hw/9pfs/9p.c
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn v9fs_flush(void *opaque)
          /*
           * Wait for pdu to complete.
           */
 -        qemu_co_queue_wait(&cancel_pdu->complete);
 +        qemu_co_queue_wait(&cancel_pdu->complete, NULL);
          cancel_pdu->cancelled = 0;
          pdu_free(cancel_pdu);
      }
 diff --git a/util/qemu-coroutine-lock.c b/util/qemu-coroutine-lock.c
 index XXXXXXX..XXXXXXX 100644
 --- a/util/qemu-coroutine-lock.c
 +++ b/util/qemu-coroutine-lock.c
@@ -XXX,XX +XXX,XX @@ void qemu_co_queue_init(CoQueue *queue)
      QSIMPLEQ_INIT(&queue->entries);
  }
 -void coroutine_fn qemu_co_queue_wait(CoQueue *queue)
 +void coroutine_fn qemu_co_queue_wait(CoQueue *queue, CoMutex *mutex)
  {
      Coroutine *self = qemu_coroutine_self();
      QSIMPLEQ_INSERT_TAIL(&queue->entries, self, co_queue_next);
 +
-+    if (mutex) {
++== verify pattern ==
-+        qemu_co_mutex_unlock(mutex);
++read 512/512 bytes at offset 0
-+    }
++512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 +read 512/512 bytes at offset 512
 +512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 +
-+    /* There is no race condition here.  Other threads will call
+ == rewriting whole image ==
-+     * aio_co_schedule on our AioContext, which can reenter this
+ wrote 134217728/134217728 bytes at offset 0
-+     * coroutine but only after this yield and after the main loop
+MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 +     * has gone through the next iteration.
 +     */
      qemu_coroutine_yield();
      assert(qemu_in_coroutine());
 +
 +    /* TODO: OSv implements wait morphing here, where the wakeup
 +     * primitive automatically places the woken coroutine on the
 +     * mutex's queue.  This avoids the thundering herd effect.
 +     */
 +    if (mutex) {
 +        qemu_co_mutex_lock(mutex);
 +    }
  }
  /**
@@ -XXX,XX +XXX,XX @@ void qemu_co_rwlock_rdlock(CoRwlock *lock)
      Coroutine *self = qemu_coroutine_self();
      while (lock->writer) {
 -        qemu_co_queue_wait(&lock->queue);
 +        qemu_co_queue_wait(&lock->queue, NULL);
      }
      lock->reader++;
      self->locks_held++;
@@ -XXX,XX +XXX,XX @@ void qemu_co_rwlock_wrlock(CoRwlock *lock)
      Coroutine *self = qemu_coroutine_self();
      while (lock->writer || lock->reader) {
 -        qemu_co_queue_wait(&lock->queue);
 +        qemu_co_queue_wait(&lock->queue, NULL);
      }
      lock->writer = true;
      self->locks_held++;
 --
-.9.3
+.21.0

-[Qemu-devel] [PULL v2 22/24] coroutine-lock: place CoMutex before CoQueue in header
+[Qemu-devel] [PULL v2 4/8] vmdk: Fix comment regarding max l1_size coverage
-From: Paolo Bonzini <pbonzini@redhat.com>
+From: Sam Eiderman <shmuel.eiderman@oracle.com>
-This will avoid forward references in the next patch.  It is also
+Commit b0651b8c246d ("vmdk: Move l1_size check into vmdk_add_extent")
-more logical because CoQueue is not anymore the basic primitive.
+extended the l1_size check from VMDK4 to VMDK3 but did not update the
 default coverage in the moved comment.
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+The previous vmdk4 calculation:
-Reviewed-by: Fam Zheng <famz@redhat.com>
-Message-id: 20170213181244.16297-5-pbonzini@redhat.com
+    (512 * 1024 * 1024) * 512(l2 entries) * 65536(grain) = 16PB
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 The added vmdk3 calculation:
     (512 * 1024 * 1024) * 4096(l2 entries) * 512(grain) = 1PB
 Adding the calculation of vmdk3 to the comment.
 In any case, VMware does not offer virtual disks more than 2TB for
 vmdk4/vmdk3 or 64TB for the new undocumented seSparse format which is
 not implemented yet in qemu.
 Reviewed-by: Karl Heubaum <karl.heubaum@oracle.com>
 Reviewed-by: Eyal Moscovici <eyal.moscovici@oracle.com>
 Reviewed-by: Liran Alon <liran.alon@oracle.com>
 Reviewed-by: Arbel Moshe <arbel.moshe@oracle.com>
 Signed-off-by: Sam Eiderman <shmuel.eiderman@oracle.com>
 Message-id: 20190620091057.47441-2-shmuel.eiderman@oracle.com
 Reviewed-by: yuchenlin <yuchenlin@synology.com>
 Reviewed-by: Max Reitz <mreitz@redhat.com>
 Signed-off-by: Max Reitz <mreitz@redhat.com>
 ---
- include/qemu/coroutine.h | 89 ++++++++++++++++++++++++------------------------
+ block/vmdk.c | 11 ++++++++---
-file changed, 44 insertions(+), 45 deletions(-)
+file changed, 8 insertions(+), 3 deletions(-)
-diff --git a/include/qemu/coroutine.h b/include/qemu/coroutine.h
+diff --git a/block/vmdk.c b/block/vmdk.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/qemu/coroutine.h
+--- a/block/vmdk.c
-+++ b/include/qemu/coroutine.h
++++ b/block/vmdk.c
-@@ -XXX,XX +XXX,XX @@ bool qemu_in_coroutine(void);
+@@ -XXX,XX +XXX,XX @@ static int vmdk_add_extent(BlockDriverState *bs,
-  */
+         return -EFBIG;
- bool qemu_coroutine_entered(Coroutine *co);
+     }
+     if (l1_size > 512 * 1024 * 1024) {
--
+-        /* Although with big capacity and small l1_entry_sectors, we can get a
--/**
++        /*
-- * CoQueues are a mechanism to queue coroutines in order to continue executing
++         * Although with big capacity and small l1_entry_sectors, we can get a
-- * them later. They provide the fundamental primitives on which coroutine locks
+          * big l1_size, we don't want unbounded value to allocate the table.
-- * are built.
+-         * Limit it to 512M, which is 16PB for default cluster and L2 table
-- */
+-         * size */
--typedef struct CoQueue {
++         * Limit it to 512M, which is:
--    QSIMPLEQ_HEAD(, Coroutine) entries;
++         *     16PB - for default "Hosted Sparse Extent" (VMDK4)
--} CoQueue;
++         *            cluster size: 64KB, L2 table size: 512 entries
--
++         *     1PB  - for default "ESXi Host Sparse Extent" (VMDK3/vmfsSparse)
--/**
++         *            cluster size: 512B, L2 table size: 4096 entries
-- * Initialise a CoQueue. This must be called before any other operation is used
++         */
-- * on the CoQueue.
+         error_setg(errp, "L1 size too big");
-- */
+         return -EFBIG;
--void qemu_co_queue_init(CoQueue *queue);
+     }
 -
 -/**
 - * Adds the current coroutine to the CoQueue and transfers control to the
 - * caller of the coroutine.
 - */
 -void coroutine_fn qemu_co_queue_wait(CoQueue *queue);
 -
 -/**
 - * Restarts the next coroutine in the CoQueue and removes it from the queue.
 - *
 - * Returns true if a coroutine was restarted, false if the queue is empty.
 - */
 -bool coroutine_fn qemu_co_queue_next(CoQueue *queue);
 -
 -/**
 - * Restarts all coroutines in the CoQueue and leaves the queue empty.
 - */
 -void coroutine_fn qemu_co_queue_restart_all(CoQueue *queue);
 -
 -/**
 - * Enter the next coroutine in the queue
 - */
 -bool qemu_co_enter_next(CoQueue *queue);
 -
 -/**
 - * Checks if the CoQueue is empty.
 - */
 -bool qemu_co_queue_empty(CoQueue *queue);
 -
 -
  /**
   * Provides a mutex that can be used to synchronise coroutines
   */
@@ -XXX,XX +XXX,XX @@ void coroutine_fn qemu_co_mutex_lock(CoMutex *mutex);
   */
  void coroutine_fn qemu_co_mutex_unlock(CoMutex *mutex);
 +
 +/**
 + * CoQueues are a mechanism to queue coroutines in order to continue executing
 + * them later.
 + */
 +typedef struct CoQueue {
 +    QSIMPLEQ_HEAD(, Coroutine) entries;
 +} CoQueue;
 +
 +/**
 + * Initialise a CoQueue. This must be called before any other operation is used
 + * on the CoQueue.
 + */
 +void qemu_co_queue_init(CoQueue *queue);
 +
 +/**
 + * Adds the current coroutine to the CoQueue and transfers control to the
 + * caller of the coroutine.
 + */
 +void coroutine_fn qemu_co_queue_wait(CoQueue *queue);
 +
 +/**
 + * Restarts the next coroutine in the CoQueue and removes it from the queue.
 + *
 + * Returns true if a coroutine was restarted, false if the queue is empty.
 + */
 +bool coroutine_fn qemu_co_queue_next(CoQueue *queue);
 +
 +/**
 + * Restarts all coroutines in the CoQueue and leaves the queue empty.
 + */
 +void coroutine_fn qemu_co_queue_restart_all(CoQueue *queue);
 +
 +/**
 + * Enter the next coroutine in the queue
 + */
 +bool qemu_co_enter_next(CoQueue *queue);
 +
 +/**
 + * Checks if the CoQueue is empty.
 + */
 +bool qemu_co_queue_empty(CoQueue *queue);
 +
 +
  typedef struct CoRwlock {
      bool writer;
      int reader;
 --
-.9.3
+.21.0

-[Qemu-devel] [PULL v2 21/24] test-aio-multithread: add performance comparison with thread-based mutexes
+[Qemu-devel] [PULL v2 5/8] vmdk: Reduce the max bound for L1 table size
-From: Paolo Bonzini <pbonzini@redhat.com>
+From: Sam Eiderman <shmuel.eiderman@oracle.com>
-Add two implementations of the same benchmark as the previous patch,
+M of L1 entries is a very loose bound, only 32M are required to store
-but using pthreads.  One uses a normal QemuMutex, the other is Linux
+the maximal supported VMDK file size of 2TB.
 only and implements a fair mutex based on MCS locks and futexes.
 This shows that the slower performance of the 5-thread case is due to
 the fairness of CoMutex, rather than to coroutines.  If fairness does
 not matter, as is the case with two threads, CoMutex can actually be
 faster than pthreads.
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Fixed qemu-iotest 59# - now failure occures before on impossible L1
-Reviewed-by: Fam Zheng <famz@redhat.com>
+table size.
-Message-id: 20170213181244.16297-4-pbonzini@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Reviewed-by: Karl Heubaum <karl.heubaum@oracle.com>
 Reviewed-by: Eyal Moscovici <eyal.moscovici@oracle.com>
 Reviewed-by: Liran Alon <liran.alon@oracle.com>
 Reviewed-by: Arbel Moshe <arbel.moshe@oracle.com>
 Signed-off-by: Sam Eiderman <shmuel.eiderman@oracle.com>
 Message-id: 20190620091057.47441-3-shmuel.eiderman@oracle.com
 Reviewed-by: Max Reitz <mreitz@redhat.com>
 Signed-off-by: Max Reitz <mreitz@redhat.com>
 ---
- tests/test-aio-multithread.c | 164 +++++++++++++++++++++++++++++++++++++++++++
+ block/vmdk.c               | 13 +++++++------
-file changed, 164 insertions(+)
+ tests/qemu-iotests/059.out |  2 +-
 files changed, 8 insertions(+), 7 deletions(-)
-diff --git a/tests/test-aio-multithread.c b/tests/test-aio-multithread.c
+diff --git a/block/vmdk.c b/block/vmdk.c
 index XXXXXXX..XXXXXXX 100644
---- a/tests/test-aio-multithread.c
+--- a/block/vmdk.c
-+++ b/tests/test-aio-multithread.c
++++ b/block/vmdk.c
-@@ -XXX,XX +XXX,XX @@ static void test_multi_co_mutex_2_30(void)
+@@ -XXX,XX +XXX,XX @@ static int vmdk_add_extent(BlockDriverState *bs,
-     test_multi_co_mutex(2, 30);
+         error_setg(errp, "Invalid granularity, image may be corrupt");
- }
+         return -EFBIG;
 +/* Same test with fair mutexes, for performance comparison.  */
 +
 +#ifdef CONFIG_LINUX
 +#include "qemu/futex.h"
 +
 +/* The nodes for the mutex reside in this structure (on which we try to avoid
 + * false sharing).  The head of the mutex is in the "mutex_head" variable.
 + */
 +static struct {
 +    int next, locked;
 +    int padding[14];
 +} nodes[NUM_CONTEXTS] __attribute__((__aligned__(64)));
 +
 +static int mutex_head = -1;
 +
 +static void mcs_mutex_lock(void)
 +{
 +    int prev;
 +
 +    nodes[id].next = -1;
 +    nodes[id].locked = 1;
 +    prev = atomic_xchg(&mutex_head, id);
 +    if (prev != -1) {
 +        atomic_set(&nodes[prev].next, id);
 +        qemu_futex_wait(&nodes[id].locked, 1);
 +    }
 +}
 +
 +static void mcs_mutex_unlock(void)
 +{
 +    int next;
 +    if (nodes[id].next == -1) {
 +        if (atomic_read(&mutex_head) == id &&
 +            atomic_cmpxchg(&mutex_head, id, -1) == id) {
 +            /* Last item in the list, exit.  */
 +            return;
 +        }
 +        while (atomic_read(&nodes[id].next) == -1) {
 +            /* mcs_mutex_lock did the xchg, but has not updated
 +             * nodes[prev].next yet.
 +             */
 +        }
 +    }
 +
 +    /* Wake up the next in line.  */
 +    next = nodes[id].next;
 +    nodes[next].locked = 0;
 +    qemu_futex_wake(&nodes[next].locked, 1);
 +}
 +
 +static void test_multi_fair_mutex_entry(void *opaque)
 +{
 +    while (!atomic_mb_read(&now_stopping)) {
 +        mcs_mutex_lock();
 +        counter++;
 +        mcs_mutex_unlock();
 +        atomic_inc(&atomic_counter);
 +    }
 +    atomic_dec(&running);
 +}
 +
 +static void test_multi_fair_mutex(int threads, int seconds)
 +{
 +    int i;
 +
 +    assert(mutex_head == -1);
 +    counter = 0;
 +    atomic_counter = 0;
 +    now_stopping = false;
 +
 +    create_aio_contexts();
 +    assert(threads <= NUM_CONTEXTS);
 +    running = threads;
 +    for (i = 0; i < threads; i++) {
 +        Coroutine *co1 = qemu_coroutine_create(test_multi_fair_mutex_entry, NULL);
 +        aio_co_schedule(ctx[i], co1);
 +    }
 +
 +    g_usleep(seconds * 1000000);
 +
 +    atomic_mb_set(&now_stopping, true);
 +    while (running > 0) {
 +        g_usleep(100000);
 +    }
 +
 +    join_aio_contexts();
 +    g_test_message("%d iterations/second\n", counter / seconds);
 +    g_assert_cmpint(counter, ==, atomic_counter);
 +}
 +
 +static void test_multi_fair_mutex_1(void)
 +{
 +    test_multi_fair_mutex(NUM_CONTEXTS, 1);
 +}
 +
 +static void test_multi_fair_mutex_10(void)
 +{
 +    test_multi_fair_mutex(NUM_CONTEXTS, 10);
 +}
 +#endif
 +
 +/* Same test with pthread mutexes, for performance comparison and
 + * portability.  */
 +
 +static QemuMutex mutex;
 +
 +static void test_multi_mutex_entry(void *opaque)
 +{
 +    while (!atomic_mb_read(&now_stopping)) {
 +        qemu_mutex_lock(&mutex);
 +        counter++;
 +        qemu_mutex_unlock(&mutex);
 +        atomic_inc(&atomic_counter);
 +    }
 +    atomic_dec(&running);
 +}
 +
 +static void test_multi_mutex(int threads, int seconds)
 +{
 +    int i;
 +
 +    qemu_mutex_init(&mutex);
 +    counter = 0;
 +    atomic_counter = 0;
 +    now_stopping = false;
 +
 +    create_aio_contexts();
 +    assert(threads <= NUM_CONTEXTS);
 +    running = threads;
 +    for (i = 0; i < threads; i++) {
 +        Coroutine *co1 = qemu_coroutine_create(test_multi_mutex_entry, NULL);
 +        aio_co_schedule(ctx[i], co1);
 +    }
 +
 +    g_usleep(seconds * 1000000);
 +
 +    atomic_mb_set(&now_stopping, true);
 +    while (running > 0) {
 +        g_usleep(100000);
 +    }
 +
 +    join_aio_contexts();
 +    g_test_message("%d iterations/second\n", counter / seconds);
 +    g_assert_cmpint(counter, ==, atomic_counter);
 +}
 +
 +static void test_multi_mutex_1(void)
 +{
 +    test_multi_mutex(NUM_CONTEXTS, 1);
 +}
 +
 +static void test_multi_mutex_10(void)
 +{
 +    test_multi_mutex(NUM_CONTEXTS, 10);
 +}
 +
  /* End of tests.  */
  int main(int argc, char **argv)
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
          g_test_add_func("/aio/multi/schedule", test_multi_co_schedule_1);
          g_test_add_func("/aio/multi/mutex/contended", test_multi_co_mutex_1);
          g_test_add_func("/aio/multi/mutex/handoff", test_multi_co_mutex_2_3);
 +#ifdef CONFIG_LINUX
 +        g_test_add_func("/aio/multi/mutex/mcs", test_multi_fair_mutex_1);
 +#endif
 +        g_test_add_func("/aio/multi/mutex/pthread", test_multi_mutex_1);
      } else {
          g_test_add_func("/aio/multi/schedule", test_multi_co_schedule_10);
          g_test_add_func("/aio/multi/mutex/contended", test_multi_co_mutex_10);
          g_test_add_func("/aio/multi/mutex/handoff", test_multi_co_mutex_2_30);
 +#ifdef CONFIG_LINUX
 +        g_test_add_func("/aio/multi/mutex/mcs", test_multi_fair_mutex_10);
 +#endif
 +        g_test_add_func("/aio/multi/mutex/pthread", test_multi_mutex_10);
      }
-     return g_test_run();
+-    if (l1_size > 512 * 1024 * 1024) {
- }
++    if (l1_size > 32 * 1024 * 1024) {
          /*
           * Although with big capacity and small l1_entry_sectors, we can get a
           * big l1_size, we don't want unbounded value to allocate the table.
 -         * Limit it to 512M, which is:
 -         *     16PB - for default "Hosted Sparse Extent" (VMDK4)
 -         *            cluster size: 64KB, L2 table size: 512 entries
 -         *     1PB  - for default "ESXi Host Sparse Extent" (VMDK3/vmfsSparse)
 -         *            cluster size: 512B, L2 table size: 4096 entries
 +         * Limit it to 32M, which is enough to store:
 +         *     8TB  - for both VMDK3 & VMDK4 with
 +         *            minimal cluster size: 512B
 +         *            minimal L2 table size: 512 entries
 +         *            8 TB is still more than the maximal value supported for
 +         *            VMDK3 & VMDK4 which is 2TB.
           */
          error_setg(errp, "L1 size too big");
          return -EFBIG;
 diff --git a/tests/qemu-iotests/059.out b/tests/qemu-iotests/059.out
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/qemu-iotests/059.out
 +++ b/tests/qemu-iotests/059.out
@@ -XXX,XX +XXX,XX @@ Offset          Length          Mapped to       File
 x140000000     0x10000         0x50000         TEST_DIR/t-s003.vmdk
  === Testing afl image with a very large capacity ===
 -qemu-img: Can't get image size 'TEST_DIR/afl9.IMGFMT': File too large
 +qemu-img: Could not open 'TEST_DIR/afl9.IMGFMT': L1 size too big
  *** done
 --
-.9.3
+.21.0

-[Qemu-devel] [PULL v2 19/24] coroutine-lock: make CoMutex thread-safe
+[Qemu-devel] [PULL v2 6/8] vmdk: Add read-only support for seSparse snapshots
-From: Paolo Bonzini <pbonzini@redhat.com>
+From: Sam Eiderman <shmuel.eiderman@oracle.com>
-This uses the lock-free mutex described in the paper '"Blocking without
+Until ESXi 6.5 VMware used the vmfsSparse format for snapshots (VMDK3 in
-Locking", or LFTHREADS: A lock-free thread library' by Gidenstam and
+QEMU).
-Papatriantafilou.  The same technique is used in OSv, and in fact
-the code is essentially a conversion to C of OSv's code.
+This format was lacking in the following:
-[Added missing coroutine_fn in tests/test-aio-multithread.c.
+    * Grain directory (L1) and grain table (L2) entries were 32-bit,
---Stefan]
+      allowing access to only 2TB (slightly less) of data.
+    * The grain size (default) was 512 bytes - leading to data
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+      fragmentation and many grain tables.
-Reviewed-by: Fam Zheng <famz@redhat.com>
+    * For space reclamation purposes, it was necessary to find all the
-Message-id: 20170213181244.16297-2-pbonzini@redhat.com
+      grains which are not pointed to by any grain table - so a reverse
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+      mapping of "offset of grain in vmdk" to "grain table" must be
       constructed - which takes large amounts of CPU/RAM.
 The format specification can be found in VMware's documentation:
 https://www.vmware.com/support/developer/vddk/vmdk_50_technote.pdf
 In ESXi 6.5, to support snapshot files larger than 2TB, a new format was
 introduced: SESparse (Space Efficient).
 This format fixes the above issues:
     * All entries are now 64-bit.
     * The grain size (default) is 4KB.
     * Grain directory and grain tables are now located at the beginning
       of the file.
       + seSparse format reserves space for all grain tables.
       + Grain tables can be addressed using an index.
       + Grains are located in the end of the file and can also be
         addressed with an index.
       - seSparse vmdks of large disks (64TB) have huge preallocated
         headers - mainly due to L2 tables, even for empty snapshots.
     * The header contains a reverse mapping ("backmap") of "offset of
       grain in vmdk" to "grain table" and a bitmap ("free bitmap") which
       specifies for each grain - whether it is allocated or not.
       Using these data structures we can implement space reclamation
       efficiently.
     * Due to the fact that the header now maintains two mappings:
         * The regular one (grain directory & grain tables)
         * A reverse one (backmap and free bitmap)
       These data structures can lose consistency upon crash and result
       in a corrupted VMDK.
       Therefore, a journal is also added to the VMDK and is replayed
       when the VMware reopens the file after a crash.
 Since ESXi 6.7 - SESparse is the only snapshot format available.
 Unfortunately, VMware does not provide documentation regarding the new
 seSparse format.
 This commit is based on black-box research of the seSparse format.
 Various in-guest block operations and their effect on the snapshot file
 were tested.
 The only VMware provided source of information (regarding the underlying
 implementation) was a log file on the ESXi:
     /var/log/hostd.log
 Whenever an seSparse snapshot is created - the log is being populated
 with seSparse records.
 Relevant log records are of the form:
 [...] Const Header:
 [...]  constMagic     = 0xcafebabe
 [...]  version        = 2.1
 [...]  capacity       = 204800
 [...]  grainSize      = 8
 [...]  grainTableSize = 64
 [...]  flags          = 0
 [...] Extents:
 [...]  Header         : <1 : 1>
 [...]  JournalHdr     : <2 : 2>
 [...]  Journal        : <2048 : 2048>
 [...]  GrainDirectory : <4096 : 2048>
 [...]  GrainTables    : <6144 : 2048>
 [...]  FreeBitmap     : <8192 : 2048>
 [...]  BackMap        : <10240 : 2048>
 [...]  Grain          : <12288 : 204800>
 [...] Volatile Header:
 [...] volatileMagic     = 0xcafecafe
 [...] FreeGTNumber      = 0
 [...] nextTxnSeqNumber  = 0
 [...] replayJournal     = 0
 The sizes that are seen in the log file are in sectors.
 Extents are of the following format: <offset : size>
 This commit is a strict implementation which enforces:
     * magics
     * version number 2.1
     * grain size of 8 sectors  (4KB)
     * grain table size of 64 sectors
     * zero flags
     * extent locations
 Additionally, this commit proivdes only a subset of the functionality
 offered by seSparse's format:
     * Read-only
     * No journal replay
     * No space reclamation
     * No unmap support
 Hence, journal header, journal, free bitmap and backmap extents are
 unused, only the "classic" (L1 -> L2 -> data) grain access is
 implemented.
 However there are several differences in the grain access itself.
 Grain directory (L1):
     * Grain directory entries are indexes (not offsets) to grain
       tables.
     * Valid grain directory entries have their highest nibble set to
 x1.
     * Since grain tables are always located in the beginning of the
       file - the index can fit into 32 bits - so we can use its low
       part if it's valid.
 Grain table (L2):
     * Grain table entries are indexes (not offsets) to grains.
     * If the highest nibble of the entry is:
 x0:
             The grain in not allocated.
             The rest of the bytes are 0.
 x1:
             The grain is unmapped - guest sees a zero grain.
             The rest of the bits point to the previously mapped grain,
             see 0x3 case.
 x2:
             The grain is zero.
 x3:
             The grain is allocated - to get the index calculate:
             ((entry & 0x0fff000000000000) >> 48) |
             ((entry & 0x0000ffffffffffff) << 12)
     * The difference between 0x1 and 0x2 is that 0x1 is an unallocated
       grain which results from the guest using sg_unmap to unmap the
       grain - but the grain itself still exists in the grain extent - a
       space reclamation procedure should delete it.
       Unmapping a zero grain has no effect (0x2 will not change to 0x1)
       but unmapping an unallocated grain will (0x0 to 0x1) - naturally.
 In order to implement seSparse some fields had to be changed to support
 both 32-bit and 64-bit entry sizes.
 Reviewed-by: Karl Heubaum <karl.heubaum@oracle.com>
 Reviewed-by: Eyal Moscovici <eyal.moscovici@oracle.com>
 Reviewed-by: Arbel Moshe <arbel.moshe@oracle.com>
 Signed-off-by: Sam Eiderman <shmuel.eiderman@oracle.com>
 Message-id: 20190620091057.47441-4-shmuel.eiderman@oracle.com
 Signed-off-by: Max Reitz <mreitz@redhat.com>
 ---
- include/qemu/coroutine.h     |  17 ++++-
+ block/vmdk.c | 358 ++++++++++++++++++++++++++++++++++++++++++++++++---
- tests/test-aio-multithread.c |  86 ++++++++++++++++++++++++
+file changed, 342 insertions(+), 16 deletions(-)
- util/qemu-coroutine-lock.c   | 155 ++++++++++++++++++++++++++++++++++++++++---
- util/trace-events            |   1 +
+diff --git a/block/vmdk.c b/block/vmdk.c
 files changed, 246 insertions(+), 13 deletions(-)
 diff --git a/include/qemu/coroutine.h b/include/qemu/coroutine.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/qemu/coroutine.h
+--- a/block/vmdk.c
-+++ b/include/qemu/coroutine.h
++++ b/block/vmdk.c
-@@ -XXX,XX +XXX,XX @@ bool qemu_co_queue_empty(CoQueue *queue);
+@@ -XXX,XX +XXX,XX @@ typedef struct {
- /**
+     uint16_t compressAlgorithm;
-  * Provides a mutex that can be used to synchronise coroutines
+ } QEMU_PACKED VMDK4Header;
-  */
-+struct CoWaitRecord;
++typedef struct VMDKSESparseConstHeader {
- typedef struct CoMutex {
++    uint64_t magic;
--    bool locked;
++    uint64_t version;
-+    /* Count of pending lockers; 0 for a free mutex, 1 for an
++    uint64_t capacity;
-+     * uncontended mutex.
++    uint64_t grain_size;
-+     */
++    uint64_t grain_table_size;
-+    unsigned locked;
++    uint64_t flags;
-+
++    uint64_t reserved1;
-+    /* A queue of waiters.  Elements are added atomically in front of
++    uint64_t reserved2;
-+     * from_push.  to_pop is only populated, and popped from, by whoever
++    uint64_t reserved3;
-+     * is in charge of the next wakeup.  This can be an unlocker or,
++    uint64_t reserved4;
-+     * through the handoff protocol, a locker that is about to go to sleep.
++    uint64_t volatile_header_offset;
-+     */
++    uint64_t volatile_header_size;
-+    QSLIST_HEAD(, CoWaitRecord) from_push, to_pop;
++    uint64_t journal_header_offset;
-+
++    uint64_t journal_header_size;
-+    unsigned handoff, sequence;
++    uint64_t journal_offset;
-+
++    uint64_t journal_size;
-     Coroutine *holder;
++    uint64_t grain_dir_offset;
--    CoQueue queue;
++    uint64_t grain_dir_size;
- } CoMutex;
++    uint64_t grain_tables_offset;
++    uint64_t grain_tables_size;
- /**
++    uint64_t free_bitmap_offset;
-diff --git a/tests/test-aio-multithread.c b/tests/test-aio-multithread.c
++    uint64_t free_bitmap_size;
-index XXXXXXX..XXXXXXX 100644
++    uint64_t backmap_offset;
---- a/tests/test-aio-multithread.c
++    uint64_t backmap_size;
-+++ b/tests/test-aio-multithread.c
++    uint64_t grains_offset;
-@@ -XXX,XX +XXX,XX @@ static void test_multi_co_schedule_10(void)
++    uint64_t grains_size;
-     test_multi_co_schedule(10);
++    uint8_t pad[304];
 +} QEMU_PACKED VMDKSESparseConstHeader;
 +
 +typedef struct VMDKSESparseVolatileHeader {
 +    uint64_t magic;
 +    uint64_t free_gt_number;
 +    uint64_t next_txn_seq_number;
 +    uint64_t replay_journal;
 +    uint8_t pad[480];
 +} QEMU_PACKED VMDKSESparseVolatileHeader;
 +
  #define L2_CACHE_SIZE 16
  typedef struct VmdkExtent {
@@ -XXX,XX +XXX,XX @@ typedef struct VmdkExtent {
      bool compressed;
      bool has_marker;
      bool has_zero_grain;
 +    bool sesparse;
 +    uint64_t sesparse_l2_tables_offset;
 +    uint64_t sesparse_clusters_offset;
 +    int32_t entry_size;
      int version;
      int64_t sectors;
      int64_t end_sector;
      int64_t flat_start_offset;
      int64_t l1_table_offset;
      int64_t l1_backup_table_offset;
 -    uint32_t *l1_table;
 +    void *l1_table;
      uint32_t *l1_backup_table;
      unsigned int l1_size;
      uint32_t l1_entry_sectors;
      unsigned int l2_size;
 -    uint32_t *l2_cache;
 +    void *l2_cache;
      uint32_t l2_cache_offsets[L2_CACHE_SIZE];
      uint32_t l2_cache_counts[L2_CACHE_SIZE];
@@ -XXX,XX +XXX,XX @@ static int vmdk_add_extent(BlockDriverState *bs,
           *            minimal L2 table size: 512 entries
           *            8 TB is still more than the maximal value supported for
           *            VMDK3 & VMDK4 which is 2TB.
 +         *     64TB - for "ESXi seSparse Extent"
 +         *            minimal cluster size: 512B (default is 4KB)
 +         *            L2 table size: 4096 entries (const).
 +         *            64TB is more than the maximal value supported for
 +         *            seSparse VMDKs (which is slightly less than 64TB)
           */
          error_setg(errp, "L1 size too big");
          return -EFBIG;
@@ -XXX,XX +XXX,XX @@ static int vmdk_add_extent(BlockDriverState *bs,
      extent->l2_size = l2_size;
      extent->cluster_sectors = flat ? sectors : cluster_sectors;
      extent->next_cluster_sector = ROUND_UP(nb_sectors, cluster_sectors);
 +    extent->entry_size = sizeof(uint32_t);
      if (s->num_extents > 1) {
          extent->end_sector = (*(extent - 1)).end_sector + extent->sectors;
@@ -XXX,XX +XXX,XX @@ static int vmdk_init_tables(BlockDriverState *bs, VmdkExtent *extent,
      int i;
      /* read the L1 table */
 -    l1_size = extent->l1_size * sizeof(uint32_t);
 +    l1_size = extent->l1_size * extent->entry_size;
      extent->l1_table = g_try_malloc(l1_size);
      if (l1_size && extent->l1_table == NULL) {
          return -ENOMEM;
@@ -XXX,XX +XXX,XX @@ static int vmdk_init_tables(BlockDriverState *bs, VmdkExtent *extent,
          goto fail_l1;
      }
      for (i = 0; i < extent->l1_size; i++) {
 -        le32_to_cpus(&extent->l1_table[i]);
 +        if (extent->entry_size == sizeof(uint64_t)) {
 +            le64_to_cpus((uint64_t *)extent->l1_table + i);
 +        } else {
 +            assert(extent->entry_size == sizeof(uint32_t));
 +            le32_to_cpus((uint32_t *)extent->l1_table + i);
 +        }
      }
      if (extent->l1_backup_table_offset) {
 +        assert(!extent->sesparse);
          extent->l1_backup_table = g_try_malloc(l1_size);
          if (l1_size && extent->l1_backup_table == NULL) {
              ret = -ENOMEM;
@@ -XXX,XX +XXX,XX @@ static int vmdk_init_tables(BlockDriverState *bs, VmdkExtent *extent,
      }
      extent->l2_cache =
 -        g_new(uint32_t, extent->l2_size * L2_CACHE_SIZE);
 +        g_malloc(extent->entry_size * extent->l2_size * L2_CACHE_SIZE);
      return 0;
   fail_l1b:
      g_free(extent->l1_backup_table);
@@ -XXX,XX +XXX,XX @@ static int vmdk_open_vmfs_sparse(BlockDriverState *bs,
      return ret;
  }
-+/* CoMutex thread-safety.  */
++#define SESPARSE_CONST_HEADER_MAGIC UINT64_C(0x00000000cafebabe)
-+
++#define SESPARSE_VOLATILE_HEADER_MAGIC UINT64_C(0x00000000cafecafe)
-+static uint32_t atomic_counter;
++
-+static uint32_t running;
++/* Strict checks - format not officially documented */
-+static uint32_t counter;
++static int check_se_sparse_const_header(VMDKSESparseConstHeader *header,
-+static CoMutex comutex;
++                                        Error **errp)
 +
 +static void coroutine_fn test_multi_co_mutex_entry(void *opaque)
 +{
-+    while (!atomic_mb_read(&now_stopping)) {
++    header->magic = le64_to_cpu(header->magic);
-+        qemu_co_mutex_lock(&comutex);
++    header->version = le64_to_cpu(header->version);
-+        counter++;
++    header->grain_size = le64_to_cpu(header->grain_size);
-+        qemu_co_mutex_unlock(&comutex);
++    header->grain_table_size = le64_to_cpu(header->grain_table_size);
-+
++    header->flags = le64_to_cpu(header->flags);
-+        /* Increase atomic_counter *after* releasing the mutex.  Otherwise
++    header->reserved1 = le64_to_cpu(header->reserved1);
-+         * there is a chance (it happens about 1 in 3 runs) that the iothread
++    header->reserved2 = le64_to_cpu(header->reserved2);
-+         * exits before the coroutine is woken up, causing a spurious
++    header->reserved3 = le64_to_cpu(header->reserved3);
-+         * assertion failure.
++    header->reserved4 = le64_to_cpu(header->reserved4);
-+         */
++
-+        atomic_inc(&atomic_counter);
++    header->volatile_header_offset =
-+    }
++        le64_to_cpu(header->volatile_header_offset);
-+    atomic_dec(&running);
++    header->volatile_header_size = le64_to_cpu(header->volatile_header_size);
 +
 +    header->journal_header_offset = le64_to_cpu(header->journal_header_offset);
 +    header->journal_header_size = le64_to_cpu(header->journal_header_size);
 +
 +    header->journal_offset = le64_to_cpu(header->journal_offset);
 +    header->journal_size = le64_to_cpu(header->journal_size);
 +
 +    header->grain_dir_offset = le64_to_cpu(header->grain_dir_offset);
 +    header->grain_dir_size = le64_to_cpu(header->grain_dir_size);
 +
 +    header->grain_tables_offset = le64_to_cpu(header->grain_tables_offset);
 +    header->grain_tables_size = le64_to_cpu(header->grain_tables_size);
 +
 +    header->free_bitmap_offset = le64_to_cpu(header->free_bitmap_offset);
 +    header->free_bitmap_size = le64_to_cpu(header->free_bitmap_size);
 +
 +    header->backmap_offset = le64_to_cpu(header->backmap_offset);
 +    header->backmap_size = le64_to_cpu(header->backmap_size);
 +
 +    header->grains_offset = le64_to_cpu(header->grains_offset);
 +    header->grains_size = le64_to_cpu(header->grains_size);
 +
 +    if (header->magic != SESPARSE_CONST_HEADER_MAGIC) {
 +        error_setg(errp, "Bad const header magic: 0x%016" PRIx64,
 +                   header->magic);
 +        return -EINVAL;
 +    }
 +
 +    if (header->version != 0x0000000200000001) {
 +        error_setg(errp, "Unsupported version: 0x%016" PRIx64,
 +                   header->version);
 +        return -ENOTSUP;
 +    }
 +
 +    if (header->grain_size != 8) {
 +        error_setg(errp, "Unsupported grain size: %" PRIu64,
 +                   header->grain_size);
 +        return -ENOTSUP;
 +    }
 +
 +    if (header->grain_table_size != 64) {
 +        error_setg(errp, "Unsupported grain table size: %" PRIu64,
 +                   header->grain_table_size);
 +        return -ENOTSUP;
 +    }
 +
 +    if (header->flags != 0) {
 +        error_setg(errp, "Unsupported flags: 0x%016" PRIx64,
 +                   header->flags);
 +        return -ENOTSUP;
 +    }
 +
 +    if (header->reserved1 != 0 || header->reserved2 != 0 ||
 +        header->reserved3 != 0 || header->reserved4 != 0) {
 +        error_setg(errp, "Unsupported reserved bits:"
 +                   " 0x%016" PRIx64 " 0x%016" PRIx64
 +                   " 0x%016" PRIx64 " 0x%016" PRIx64,
 +                   header->reserved1, header->reserved2,
 +                   header->reserved3, header->reserved4);
 +        return -ENOTSUP;
 +    }
 +
 +    /* check that padding is 0 */
 +    if (!buffer_is_zero(header->pad, sizeof(header->pad))) {
 +        error_setg(errp, "Unsupported non-zero const header padding");
 +        return -ENOTSUP;
 +    }
 +
 +    return 0;
 +}
 +
-+static void test_multi_co_mutex(int threads, int seconds)
++static int check_se_sparse_volatile_header(VMDKSESparseVolatileHeader *header,
 +                                           Error **errp)
 +{
-+    int i;
++    header->magic = le64_to_cpu(header->magic);
-+
++    header->free_gt_number = le64_to_cpu(header->free_gt_number);
-+    qemu_co_mutex_init(&comutex);
++    header->next_txn_seq_number = le64_to_cpu(header->next_txn_seq_number);
-+    counter = 0;
++    header->replay_journal = le64_to_cpu(header->replay_journal);
-+    atomic_counter = 0;
++
-+    now_stopping = false;
++    if (header->magic != SESPARSE_VOLATILE_HEADER_MAGIC) {
-+
++        error_setg(errp, "Bad volatile header magic: 0x%016" PRIx64,
-+    create_aio_contexts();
++                   header->magic);
-+    assert(threads <= NUM_CONTEXTS);
++        return -EINVAL;
-+    running = threads;
++    }
-+    for (i = 0; i < threads; i++) {
++
-+        Coroutine *co1 = qemu_coroutine_create(test_multi_co_mutex_entry, NULL);
++    if (header->replay_journal) {
-+        aio_co_schedule(ctx[i], co1);
++        error_setg(errp, "Image is dirty, Replaying journal not supported");
-+    }
++        return -ENOTSUP;
-+
++    }
-+    g_usleep(seconds * 1000000);
++
-+
++    /* check that padding is 0 */
-+    atomic_mb_set(&now_stopping, true);
++    if (!buffer_is_zero(header->pad, sizeof(header->pad))) {
-+    while (running > 0) {
++        error_setg(errp, "Unsupported non-zero volatile header padding");
-+        g_usleep(100000);
++        return -ENOTSUP;
 +    }
 +
-+    join_aio_contexts();
++    return 0;
 +    g_test_message("%d iterations/second\n", counter / seconds);
 +    g_assert_cmpint(counter, ==, atomic_counter);
 +}
 +
-+/* Testing with NUM_CONTEXTS threads focuses on the queue.  The mutex however
++static int vmdk_open_se_sparse(BlockDriverState *bs,
-+ * is too contended (and the threads spend too much time in aio_poll)
++                               BdrvChild *file,
-+ * to actually stress the handoff protocol.
++                               int flags, Error **errp)
 + */
 +static void test_multi_co_mutex_1(void)
 +{
-+    test_multi_co_mutex(NUM_CONTEXTS, 1);
++    int ret;
 +    VMDKSESparseConstHeader const_header;
 +    VMDKSESparseVolatileHeader volatile_header;
 +    VmdkExtent *extent;
 +
 +    ret = bdrv_apply_auto_read_only(bs,
 +            "No write support for seSparse images available", errp);
 +    if (ret < 0) {
 +        return ret;
 +    }
 +
 +    assert(sizeof(const_header) == SECTOR_SIZE);
 +
 +    ret = bdrv_pread(file, 0, &const_header, sizeof(const_header));
 +    if (ret < 0) {
 +        bdrv_refresh_filename(file->bs);
 +        error_setg_errno(errp, -ret,
 +                         "Could not read const header from file '%s'",
 +                         file->bs->filename);
 +        return ret;
 +    }
 +
 +    /* check const header */
 +    ret = check_se_sparse_const_header(&const_header, errp);
 +    if (ret < 0) {
 +        return ret;
 +    }
 +
 +    assert(sizeof(volatile_header) == SECTOR_SIZE);
 +
 +    ret = bdrv_pread(file,
 +                     const_header.volatile_header_offset * SECTOR_SIZE,
 +                     &volatile_header, sizeof(volatile_header));
 +    if (ret < 0) {
 +        bdrv_refresh_filename(file->bs);
 +        error_setg_errno(errp, -ret,
 +                         "Could not read volatile header from file '%s'",
 +                         file->bs->filename);
 +        return ret;
 +    }
 +
 +    /* check volatile header */
 +    ret = check_se_sparse_volatile_header(&volatile_header, errp);
 +    if (ret < 0) {
 +        return ret;
 +    }
 +
 +    ret = vmdk_add_extent(bs, file, false,
 +                          const_header.capacity,
 +                          const_header.grain_dir_offset * SECTOR_SIZE,
 +                          0,
 +                          const_header.grain_dir_size *
 +                          SECTOR_SIZE / sizeof(uint64_t),
 +                          const_header.grain_table_size *
 +                          SECTOR_SIZE / sizeof(uint64_t),
 +                          const_header.grain_size,
 +                          &extent,
 +                          errp);
 +    if (ret < 0) {
 +        return ret;
 +    }
 +
 +    extent->sesparse = true;
 +    extent->sesparse_l2_tables_offset = const_header.grain_tables_offset;
 +    extent->sesparse_clusters_offset = const_header.grains_offset;
 +    extent->entry_size = sizeof(uint64_t);
 +
 +    ret = vmdk_init_tables(bs, extent, errp);
 +    if (ret) {
 +        /* free extent allocated by vmdk_add_extent */
 +        vmdk_free_last_extent(bs);
 +    }
 +
 +    return ret;
 +}
 +
-+static void test_multi_co_mutex_10(void)
+ static int vmdk_open_desc_file(BlockDriverState *bs, int flags, char *buf,
-+{
+                                QDict *options, Error **errp);
-+    test_multi_co_mutex(NUM_CONTEXTS, 10);
-+}
+@@ -XXX,XX +XXX,XX @@ static int vmdk_parse_extents(const char *desc, BlockDriverState *bs,
-+
+          * RW [size in sectors] SPARSE "file-name.vmdk"
-+/* Testing with fewer threads stresses the handoff protocol too.  Still, the
+          * RW [size in sectors] VMFS "file-name.vmdk"
-+ * case where the locker _can_ pick up a handoff is very rare, happening
+          * RW [size in sectors] VMFSSPARSE "file-name.vmdk"
-+ * about 10 times in 1 million, so increase the runtime a bit compared to
++         * RW [size in sectors] SESPARSE "file-name.vmdk"
-+ * other "quick" testcases that only run for 1 second.
+          */
-+ */
+         flat_offset = -1;
-+static void test_multi_co_mutex_2_3(void)
+         matches = sscanf(p, "%10s %" SCNd64 " %10s \"%511[^\n\r\"]\" %" SCNd64,
-+{
+@@ -XXX,XX +XXX,XX @@ static int vmdk_parse_extents(const char *desc, BlockDriverState *bs,
-+    test_multi_co_mutex(2, 3);
-+}
+         if (sectors <= 0 ||
-+
+             (strcmp(type, "FLAT") && strcmp(type, "SPARSE") &&
-+static void test_multi_co_mutex_2_30(void)
+-             strcmp(type, "VMFS") && strcmp(type, "VMFSSPARSE")) ||
-+{
++             strcmp(type, "VMFS") && strcmp(type, "VMFSSPARSE") &&
-+    test_multi_co_mutex(2, 30);
++             strcmp(type, "SESPARSE")) ||
-+}
+             (strcmp(access, "RW"))) {
-+
+             continue;
- /* End of tests.  */
+         }
+@@ -XXX,XX +XXX,XX @@ static int vmdk_parse_extents(const char *desc, BlockDriverState *bs,
- int main(int argc, char **argv)
+                 return ret;
-@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
+             }
-     g_test_add_func("/aio/multi/lifecycle", test_lifecycle);
+             extent = &s->extents[s->num_extents - 1];
-     if (g_test_quick()) {
++        } else if (!strcmp(type, "SESPARSE")) {
-         g_test_add_func("/aio/multi/schedule", test_multi_co_schedule_1);
++            ret = vmdk_open_se_sparse(bs, extent_file, bs->open_flags, errp);
-+        g_test_add_func("/aio/multi/mutex/contended", test_multi_co_mutex_1);
++            if (ret) {
-+        g_test_add_func("/aio/multi/mutex/handoff", test_multi_co_mutex_2_3);
++                bdrv_unref_child(bs, extent_file);
-     } else {
++                return ret;
-         g_test_add_func("/aio/multi/schedule", test_multi_co_schedule_10);
++            }
-+        g_test_add_func("/aio/multi/mutex/contended", test_multi_co_mutex_10);
++            extent = &s->extents[s->num_extents - 1];
-+        g_test_add_func("/aio/multi/mutex/handoff", test_multi_co_mutex_2_30);
+         } else {
-     }
+             error_setg(errp, "Unsupported extent type '%s'", type);
-     return g_test_run();
+             bdrv_unref_child(bs, extent_file);
- }
+@@ -XXX,XX +XXX,XX @@ static int vmdk_open_desc_file(BlockDriverState *bs, int flags, char *buf,
-diff --git a/util/qemu-coroutine-lock.c b/util/qemu-coroutine-lock.c
+     if (strcmp(ct, "monolithicFlat") &&
-index XXXXXXX..XXXXXXX 100644
+         strcmp(ct, "vmfs") &&
---- a/util/qemu-coroutine-lock.c
+         strcmp(ct, "vmfsSparse") &&
-+++ b/util/qemu-coroutine-lock.c
++        strcmp(ct, "seSparse") &&
-@@ -XXX,XX +XXX,XX @@
+         strcmp(ct, "twoGbMaxExtentSparse") &&
-  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+         strcmp(ct, "twoGbMaxExtentFlat")) {
-  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+         error_setg(errp, "Unsupported image type '%s'", ct);
-  * THE SOFTWARE.
+@@ -XXX,XX +XXX,XX @@ static int get_cluster_offset(BlockDriverState *bs,
-+ *
+ {
-+ * The lock-free mutex implementation is based on OSv
+     unsigned int l1_index, l2_offset, l2_index;
-+ * (core/lfmutex.cc, include/lockfree/mutex.hh).
+     int min_index, i, j;
-+ * Copyright (C) 2013 Cloudius Systems, Ltd.
+-    uint32_t min_count, *l2_table;
-  */
++    uint32_t min_count;
++    void *l2_table;
- #include "qemu/osdep.h"
+     bool zeroed = false;
-@@ -XXX,XX +XXX,XX @@ bool qemu_co_queue_empty(CoQueue *queue)
+     int64_t ret;
-     return QSIMPLEQ_FIRST(&queue->entries) == NULL;
+     int64_t cluster_sector;
- }
++    unsigned int l2_size_bytes = extent->l2_size * extent->entry_size;
-+/* The wait records are handled with a multiple-producer, single-consumer
+     if (m_data) {
-+ * lock-free queue.  There cannot be two concurrent pop_waiter() calls
+         m_data->valid = 0;
-+ * because pop_waiter() can only be called while mutex->handoff is zero.
+@@ -XXX,XX +XXX,XX @@ static int get_cluster_offset(BlockDriverState *bs,
-+ * This can happen in three cases:
+     if (l1_index >= extent->l1_size) {
-+ * - in qemu_co_mutex_unlock, before the hand-off protocol has started.
+         return VMDK_ERROR;
-+ *   In this case, qemu_co_mutex_lock will see mutex->handoff == 0 and
+     }
-+ *   not take part in the handoff.
+-    l2_offset = extent->l1_table[l1_index];
-+ * - in qemu_co_mutex_lock, if it steals the hand-off responsibility from
++    if (extent->sesparse) {
-+ *   qemu_co_mutex_unlock.  In this case, qemu_co_mutex_unlock will fail
++        uint64_t l2_offset_u64;
-+ *   the cmpxchg (it will see either 0 or the next sequence value) and
++
-+ *   exit.  The next hand-off cannot begin until qemu_co_mutex_lock has
++        assert(extent->entry_size == sizeof(uint64_t));
-+ *   woken up someone.
++
-+ * - in qemu_co_mutex_unlock, if it takes the hand-off token itself.
++        l2_offset_u64 = ((uint64_t *)extent->l1_table)[l1_index];
-+ *   In this case another iteration starts with mutex->handoff == 0;
++        if (l2_offset_u64 == 0) {
-+ *   a concurrent qemu_co_mutex_lock will fail the cmpxchg, and
++            l2_offset = 0;
-+ *   qemu_co_mutex_unlock will go back to case (1).
++        } else if ((l2_offset_u64 & 0xffffffff00000000) != 0x1000000000000000) {
-+ *
++            /*
-+ * The following functions manage this queue.
++             * Top most nibble is 0x1 if grain table is allocated.
-+ */
++             * strict check - top most 4 bytes must be 0x10000000 since max
-+typedef struct CoWaitRecord {
++             * supported size is 64TB for disk - so no more than 64TB / 16MB
-+    Coroutine *co;
++             * grain directories which is smaller than uint32,
-+    QSLIST_ENTRY(CoWaitRecord) next;
++             * where 16MB is the only supported default grain table coverage.
-+} CoWaitRecord;
++             */
-+
++            return VMDK_ERROR;
-+static void push_waiter(CoMutex *mutex, CoWaitRecord *w)
++        } else {
-+{
++            l2_offset_u64 = l2_offset_u64 & 0x00000000ffffffff;
-+    w->co = qemu_coroutine_self();
++            l2_offset_u64 = extent->sesparse_l2_tables_offset +
-+    QSLIST_INSERT_HEAD_ATOMIC(&mutex->from_push, w, next);
++                l2_offset_u64 * l2_size_bytes / SECTOR_SIZE;
-+}
++            if (l2_offset_u64 > 0x00000000ffffffff) {
-+
++                return VMDK_ERROR;
-+static void move_waiters(CoMutex *mutex)
++            }
-+{
++            l2_offset = (unsigned int)(l2_offset_u64);
 +    QSLIST_HEAD(, CoWaitRecord) reversed;
 +    QSLIST_MOVE_ATOMIC(&reversed, &mutex->from_push);
 +    while (!QSLIST_EMPTY(&reversed)) {
 +        CoWaitRecord *w = QSLIST_FIRST(&reversed);
 +        QSLIST_REMOVE_HEAD(&reversed, next);
 +        QSLIST_INSERT_HEAD(&mutex->to_pop, w, next);
 +    }
 +}
 +
 +static CoWaitRecord *pop_waiter(CoMutex *mutex)
 +{
 +    CoWaitRecord *w;
 +
 +    if (QSLIST_EMPTY(&mutex->to_pop)) {
 +        move_waiters(mutex);
 +        if (QSLIST_EMPTY(&mutex->to_pop)) {
 +            return NULL;
 +        }
-+    }
++    } else {
-+    w = QSLIST_FIRST(&mutex->to_pop);
++        assert(extent->entry_size == sizeof(uint32_t));
-+    QSLIST_REMOVE_HEAD(&mutex->to_pop, next);
++        l2_offset = ((uint32_t *)extent->l1_table)[l1_index];
-+    return w;
++    }
-+}
+     if (!l2_offset) {
-+
+         return VMDK_UNALLOC;
-+static bool has_waiters(CoMutex *mutex)
+     }
-+{
+@@ -XXX,XX +XXX,XX @@ static int get_cluster_offset(BlockDriverState *bs,
-+    return QSLIST_EMPTY(&mutex->to_pop) || QSLIST_EMPTY(&mutex->from_push);
+                     extent->l2_cache_counts[j] >>= 1;
-+}
+                 }
-+
+             }
- void qemu_co_mutex_init(CoMutex *mutex)
+-            l2_table = extent->l2_cache + (i * extent->l2_size);
- {
++            l2_table = (char *)extent->l2_cache + (i * l2_size_bytes);
-     memset(mutex, 0, sizeof(*mutex));
+             goto found;
--    qemu_co_queue_init(&mutex->queue);
+         }
- }
+     }
+@@ -XXX,XX +XXX,XX @@ static int get_cluster_offset(BlockDriverState *bs,
--void coroutine_fn qemu_co_mutex_lock(CoMutex *mutex)
+             min_index = i;
-+static void coroutine_fn qemu_co_mutex_lock_slowpath(CoMutex *mutex)
+         }
- {
+     }
-     Coroutine *self = qemu_coroutine_self();
+-    l2_table = extent->l2_cache + (min_index * extent->l2_size);
-+    CoWaitRecord w;
++    l2_table = (char *)extent->l2_cache + (min_index * l2_size_bytes);
-+    unsigned old_handoff;
+     BLKDBG_EVENT(extent->file, BLKDBG_L2_LOAD);
+     if (bdrv_pread(extent->file,
-     trace_qemu_co_mutex_lock_entry(mutex, self);
+                 (int64_t)l2_offset * 512,
-+    w.co = self;
+                 l2_table,
-+    push_waiter(mutex, &w);
+-                extent->l2_size * sizeof(uint32_t)
+-            ) != extent->l2_size * sizeof(uint32_t)) {
--    while (mutex->locked) {
++                l2_size_bytes
--        qemu_co_queue_wait(&mutex->queue);
++            ) != l2_size_bytes) {
-+    /* This is the "Responsibility Hand-Off" protocol; a lock() picks from
+         return VMDK_ERROR;
-+     * a concurrent unlock() the responsibility of waking somebody up.
+     }
-+     */
-+    old_handoff = atomic_mb_read(&mutex->handoff);
+@@ -XXX,XX +XXX,XX @@ static int get_cluster_offset(BlockDriverState *bs,
-+    if (old_handoff &&
+     extent->l2_cache_counts[min_index] = 1;
-+        has_waiters(mutex) &&
+  found:
-+        atomic_cmpxchg(&mutex->handoff, old_handoff, 0) == old_handoff) {
+     l2_index = ((offset >> 9) / extent->cluster_sectors) % extent->l2_size;
-+        /* There can be no concurrent pops, because there can be only
+-    cluster_sector = le32_to_cpu(l2_table[l2_index]);
-+         * one active handoff at a time.
-+         */
+-    if (extent->has_zero_grain && cluster_sector == VMDK_GTE_ZEROED) {
-+        CoWaitRecord *to_wake = pop_waiter(mutex);
+-        zeroed = true;
-+        Coroutine *co = to_wake->co;
++    if (extent->sesparse) {
-+        if (co == self) {
++        cluster_sector = le64_to_cpu(((uint64_t *)l2_table)[l2_index]);
-+            /* We got the lock ourselves!  */
++        switch (cluster_sector & 0xf000000000000000) {
-+            assert(to_wake == &w);
++        case 0x0000000000000000:
-+            return;
++            /* unallocated grain */
 +            if (cluster_sector != 0) {
 +                return VMDK_ERROR;
 +            }
 +            break;
 +        case 0x1000000000000000:
 +            /* scsi-unmapped grain - fallthrough */
 +        case 0x2000000000000000:
 +            /* zero grain */
 +            zeroed = true;
 +            break;
 +        case 0x3000000000000000:
 +            /* allocated grain */
 +            cluster_sector = (((cluster_sector & 0x0fff000000000000) >> 48) |
 +                              ((cluster_sector & 0x0000ffffffffffff) << 12));
 +            cluster_sector = extent->sesparse_clusters_offset +
 +                cluster_sector * extent->cluster_sectors;
 +            break;
 +        default:
 +            return VMDK_ERROR;
 +        }
-+
-+        aio_co_wake(co);
-     }
--    mutex->locked = true;
--    mutex->holder = self;
--    self->locks_held++;
--
-+    qemu_coroutine_yield();
-     trace_qemu_co_mutex_lock_return(mutex, self);
- }
-+void coroutine_fn qemu_co_mutex_lock(CoMutex *mutex)
-+{
-+    Coroutine *self = qemu_coroutine_self();
-+
-+    if (atomic_fetch_inc(&mutex->locked) == 0) {
-+        /* Uncontended.  */
-+        trace_qemu_co_mutex_lock_uncontended(mutex, self);
 +    } else {
-+        qemu_co_mutex_lock_slowpath(mutex);
++        cluster_sector = le32_to_cpu(((uint32_t *)l2_table)[l2_index]);
-+    }
++
-+    mutex->holder = self;
++        if (extent->has_zero_grain && cluster_sector == VMDK_GTE_ZEROED) {
-+    self->locks_held++;
++            zeroed = true;
 +}
 +
  void coroutine_fn qemu_co_mutex_unlock(CoMutex *mutex)
  {
      Coroutine *self = qemu_coroutine_self();
      trace_qemu_co_mutex_unlock_entry(mutex, self);
 -    assert(mutex->locked == true);
 +    assert(mutex->locked);
      assert(mutex->holder == self);
      assert(qemu_in_coroutine());
 -    mutex->locked = false;
      mutex->holder = NULL;
      self->locks_held--;
 -    qemu_co_queue_next(&mutex->queue);
 +    if (atomic_fetch_dec(&mutex->locked) == 1) {
 +        /* No waiting qemu_co_mutex_lock().  Pfew, that was easy!  */
 +        return;
 +    }
 +
 +    for (;;) {
 +        CoWaitRecord *to_wake = pop_waiter(mutex);
 +        unsigned our_handoff;
 +
 +        if (to_wake) {
 +            Coroutine *co = to_wake->co;
 +            aio_co_wake(co);
 +            break;
 +        }
-+
+     }
-+        /* Some concurrent lock() is in progress (we know this because
-+         * mutex->locked was >1) but it hasn't yet put itself on the wait
+     if (!cluster_sector || zeroed) {
-+         * queue.  Pick a sequence number for the handoff protocol (not 0).
+         if (!allocate) {
-+         */
+             return zeroed ? VMDK_ZEROED : VMDK_UNALLOC;
-+        if (++mutex->sequence == 0) {
+         }
-+            mutex->sequence = 1;
++        assert(!extent->sesparse);
          if (extent->next_cluster_sector >= VMDK_EXTENT_MAX_SECTORS) {
              return VMDK_ERROR;
@@ -XXX,XX +XXX,XX @@ static int get_cluster_offset(BlockDriverState *bs,
              m_data->l1_index = l1_index;
              m_data->l2_index = l2_index;
              m_data->l2_offset = l2_offset;
 -            m_data->l2_cache_entry = &l2_table[l2_index];
 +            m_data->l2_cache_entry = ((uint32_t *)l2_table) + l2_index;
          }
      }
      *cluster_offset = cluster_sector << BDRV_SECTOR_BITS;
@@ -XXX,XX +XXX,XX @@ static int vmdk_pwritev(BlockDriverState *bs, uint64_t offset,
          if (!extent) {
              return -EIO;
          }
 +        if (extent->sesparse) {
 +            return -ENOTSUP;
 +        }
-+
+         offset_in_cluster = vmdk_find_offset_in_cluster(extent, offset);
-+        our_handoff = mutex->sequence;
+         n_bytes = MIN(bytes, extent->cluster_sectors * BDRV_SECTOR_SIZE
-+        atomic_mb_set(&mutex->handoff, our_handoff);
+                              - offset_in_cluster);
 +        if (!has_waiters(mutex)) {
 +            /* The concurrent lock has not added itself yet, so it
 +             * will be able to pick our handoff.
 +             */
 +            break;
 +        }
 +
 +        /* Try to do the handoff protocol ourselves; if somebody else has
 +         * already taken it, however, we're done and they're responsible.
 +         */
 +        if (atomic_cmpxchg(&mutex->handoff, our_handoff, 0) != our_handoff) {
 +            break;
 +        }
 +    }
      trace_qemu_co_mutex_unlock_return(mutex, self);
  }
 diff --git a/util/trace-events b/util/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/util/trace-events
 +++ b/util/trace-events
@@ -XXX,XX +XXX,XX @@ qemu_coroutine_terminate(void *co) "self %p"
  # util/qemu-coroutine-lock.c
  qemu_co_queue_run_restart(void *co) "co %p"
 +qemu_co_mutex_lock_uncontended(void *mutex, void *self) "mutex %p self %p"
  qemu_co_mutex_lock_entry(void *mutex, void *self) "mutex %p self %p"
  qemu_co_mutex_lock_return(void *mutex, void *self) "mutex %p self %p"
  qemu_co_mutex_unlock_entry(void *mutex, void *self) "mutex %p self %p"
 --
-.9.3
+.21.0

-[Qemu-devel] [PULL v2 05/24] io: add methods to set I/O handlers on AioContext
+[Qemu-devel] [PULL v2 7/8] ssh: switch from libssh2 to libssh
-From: Paolo Bonzini <pbonzini@redhat.com>
+From: Pino Toscano <ptoscano@redhat.com>
-This is in preparation for making qio_channel_yield work on
+Rewrite the implementation of the ssh block driver to use libssh instead
-AioContexts other than the main one.
+of libssh2.  The libssh library has various advantages over libssh2:
 - easier API for authentication (for example for using ssh-agent)
 - easier API for known_hosts handling
 - supports newer types of keys in known_hosts
-Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
+Use APIs/features available in libssh 0.8 conditionally, to support
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+older versions (which are not recommended though).
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Reviewed-by: Fam Zheng <famz@redhat.com>
+Adjust the iotest 207 according to the different error message, and to
-Message-id: 20170213135235.12274-6-pbonzini@redhat.com
+find the default key type for localhost (to properly compare the
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+fingerprint with).
 Contributed-by: Max Reitz <mreitz@redhat.com>
 Adjust the various Docker/Travis scripts to use libssh when available
 instead of libssh2. The mingw/mxe testing is dropped for now, as there
 are no packages for it.
 Signed-off-by: Pino Toscano <ptoscano@redhat.com>
 Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Acked-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20190620200840.17655-1-ptoscano@redhat.com
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 5873173.t2JhDm7DL7@lindworm.usersys.redhat.com
 Signed-off-by: Max Reitz <mreitz@redhat.com>
 ---
- include/io/channel.h | 25 +++++++++++++++++++++++++
+ configure                                     |  65 +-
- io/channel-command.c | 13 +++++++++++++
+ block/Makefile.objs                           |   6 +-
- io/channel-file.c    | 11 +++++++++++
+ block/ssh.c                                   | 652 ++++++++++--------
- io/channel-socket.c  | 16 +++++++++++-----
+ .travis.yml                                   |   4 +-
- io/channel-tls.c     | 12 ++++++++++++
+ block/trace-events                            |  14 +-
- io/channel-watch.c   |  6 ++++++
+ docs/qemu-block-drivers.texi                  |   2 +-
- io/channel.c         | 11 +++++++++++
+ .../dockerfiles/debian-win32-cross.docker     |   1 -
-files changed, 89 insertions(+), 5 deletions(-)
+ .../dockerfiles/debian-win64-cross.docker     |   1 -
  tests/docker/dockerfiles/fedora.docker        |   4 +-
  tests/docker/dockerfiles/ubuntu.docker        |   2 +-
  tests/docker/dockerfiles/ubuntu1804.docker    |   2 +-
  tests/qemu-iotests/207                        |  54 +-
  tests/qemu-iotests/207.out                    |   2 +-
 files changed, 449 insertions(+), 360 deletions(-)
-diff --git a/include/io/channel.h b/include/io/channel.h
+diff --git a/configure b/configure
 index XXXXXXX..XXXXXXX 100755
 --- a/configure
 +++ b/configure
@@ -XXX,XX +XXX,XX @@ auth_pam=""
  vte=""
  virglrenderer=""
  tpm=""
 -libssh2=""
 +libssh=""
  live_block_migration="yes"
  numa=""
  tcmalloc="no"
@@ -XXX,XX +XXX,XX @@ for opt do
    ;;
    --enable-tpm) tpm="yes"
    ;;
 -  --disable-libssh2) libssh2="no"
 +  --disable-libssh) libssh="no"
    ;;
 -  --enable-libssh2) libssh2="yes"
 +  --enable-libssh) libssh="yes"
    ;;
    --disable-live-block-migration) live_block_migration="no"
    ;;
@@ -XXX,XX +XXX,XX @@ disabled with --disable-FEATURE, default is enabled if available:
    coroutine-pool  coroutine freelist (better performance)
    glusterfs       GlusterFS backend
    tpm             TPM support
 -  libssh2         ssh block device support
 +  libssh          ssh block device support
    numa            libnuma support
    libxml2         for Parallels image format
    tcmalloc        tcmalloc support
@@ -XXX,XX +XXX,XX @@ EOF
  fi
  ##########################################
 -# libssh2 probe
 -min_libssh2_version=1.2.8
 -if test "$libssh2" != "no" ; then
 -  if $pkg_config --atleast-version=$min_libssh2_version libssh2; then
 -    libssh2_cflags=$($pkg_config libssh2 --cflags)
 -    libssh2_libs=$($pkg_config libssh2 --libs)
 -    libssh2=yes
 +# libssh probe
 +if test "$libssh" != "no" ; then
 +  if $pkg_config --exists libssh; then
 +    libssh_cflags=$($pkg_config libssh --cflags)
 +    libssh_libs=$($pkg_config libssh --libs)
 +    libssh=yes
    else
 -    if test "$libssh2" = "yes" ; then
 -      error_exit "libssh2 >= $min_libssh2_version required for --enable-libssh2"
 +    if test "$libssh" = "yes" ; then
 +      error_exit "libssh required for --enable-libssh"
      fi
 -    libssh2=no
 +    libssh=no
    fi
  fi
  ##########################################
 -# libssh2_sftp_fsync probe
 +# Check for libssh 0.8
 +# This is done like this instead of using the LIBSSH_VERSION_* and
 +# SSH_VERSION_* macros because some distributions in the past shipped
 +# snapshots of the future 0.8 from Git, and those snapshots did not
 +# have updated version numbers (still referring to 0.7.0).
 -if test "$libssh2" = "yes"; then
 +if test "$libssh" = "yes"; then
    cat > $TMPC <<EOF
 -#include <stdio.h>
 -#include <libssh2.h>
 -#include <libssh2_sftp.h>
 -int main(void) {
 -    LIBSSH2_SESSION *session;
 -    LIBSSH2_SFTP *sftp;
 -    LIBSSH2_SFTP_HANDLE *sftp_handle;
 -    session = libssh2_session_init ();
 -    sftp = libssh2_sftp_init (session);
 -    sftp_handle = libssh2_sftp_open (sftp, "/", 0, 0);
 -    libssh2_sftp_fsync (sftp_handle);
 -    return 0;
 -}
 +#include <libssh/libssh.h>
 +int main(void) { return ssh_get_server_publickey(NULL, NULL); }
  EOF
 -  # libssh2_cflags/libssh2_libs defined in previous test.
 -  if compile_prog "$libssh2_cflags" "$libssh2_libs" ; then
 -    QEMU_CFLAGS="-DHAS_LIBSSH2_SFTP_FSYNC $QEMU_CFLAGS"
 +  if compile_prog "$libssh_cflags" "$libssh_libs"; then
 +    libssh_cflags="-DHAVE_LIBSSH_0_8 $libssh_cflags"
    fi
  fi
@@ -XXX,XX +XXX,XX @@ echo "GlusterFS support $glusterfs"
  echo "gcov              $gcov_tool"
  echo "gcov enabled      $gcov"
  echo "TPM support       $tpm"
 -echo "libssh2 support   $libssh2"
 +echo "libssh support    $libssh"
  echo "QOM debugging     $qom_cast_debug"
  echo "Live block migration $live_block_migration"
  echo "lzo support       $lzo"
@@ -XXX,XX +XXX,XX @@ if test "$glusterfs_iocb_has_stat" = "yes" ; then
    echo "CONFIG_GLUSTERFS_IOCB_HAS_STAT=y" >> $config_host_mak
  fi
 -if test "$libssh2" = "yes" ; then
 -  echo "CONFIG_LIBSSH2=m" >> $config_host_mak
 -  echo "LIBSSH2_CFLAGS=$libssh2_cflags" >> $config_host_mak
 -  echo "LIBSSH2_LIBS=$libssh2_libs" >> $config_host_mak
 +if test "$libssh" = "yes" ; then
 +  echo "CONFIG_LIBSSH=m" >> $config_host_mak
 +  echo "LIBSSH_CFLAGS=$libssh_cflags" >> $config_host_mak
 +  echo "LIBSSH_LIBS=$libssh_libs" >> $config_host_mak
  fi
  if test "$live_block_migration" = "yes" ; then
 diff --git a/block/Makefile.objs b/block/Makefile.objs
 index XXXXXXX..XXXXXXX 100644
---- a/include/io/channel.h
+--- a/block/Makefile.objs
-+++ b/include/io/channel.h
++++ b/block/Makefile.objs
@@ -XXX,XX +XXX,XX @@ block-obj-$(CONFIG_CURL) += curl.o
  block-obj-$(CONFIG_RBD) += rbd.o
  block-obj-$(CONFIG_GLUSTERFS) += gluster.o
  block-obj-$(CONFIG_VXHS) += vxhs.o
 -block-obj-$(CONFIG_LIBSSH2) += ssh.o
 +block-obj-$(CONFIG_LIBSSH) += ssh.o
  block-obj-y += accounting.o dirty-bitmap.o
  block-obj-y += write-threshold.o
  block-obj-y += backup.o
@@ -XXX,XX +XXX,XX @@ rbd.o-libs         := $(RBD_LIBS)
  gluster.o-cflags   := $(GLUSTERFS_CFLAGS)
  gluster.o-libs     := $(GLUSTERFS_LIBS)
  vxhs.o-libs        := $(VXHS_LIBS)
 -ssh.o-cflags       := $(LIBSSH2_CFLAGS)
 -ssh.o-libs         := $(LIBSSH2_LIBS)
 +ssh.o-cflags       := $(LIBSSH_CFLAGS)
 +ssh.o-libs         := $(LIBSSH_LIBS)
  block-obj-dmg-bz2-$(CONFIG_BZIP2) += dmg-bz2.o
  block-obj-$(if $(CONFIG_DMG),m,n) += $(block-obj-dmg-bz2-y)
  dmg-bz2.o-libs     := $(BZIP2_LIBS)
 diff --git a/block/ssh.c b/block/ssh.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/ssh.c
 +++ b/block/ssh.c
 @@ -XXX,XX +XXX,XX @@
- #include "qemu-common.h"
+ #include "qemu/osdep.h"
- #include "qom/object.h"
-+#include "block/aio.h"
+-#include <libssh2.h>
+-#include <libssh2_sftp.h>
- #define TYPE_QIO_CHANNEL "qio-channel"
++#include <libssh/libssh.h>
- #define QIO_CHANNEL(obj)                                    \
++#include <libssh/sftp.h>
-@@ -XXX,XX +XXX,XX @@ struct QIOChannelClass {
-                      off_t offset,
+ #include "block/block_int.h"
-                      int whence,
+ #include "block/qdict.h"
-                      Error **errp);
+@@ -XXX,XX +XXX,XX @@
-+    void (*io_set_aio_fd_handler)(QIOChannel *ioc,
+ #include "trace.h"
-+                                  AioContext *ctx,
-+                                  IOHandler *io_read,
+ /*
-+                                  IOHandler *io_write,
+- * TRACE_LIBSSH2=<bitmask> enables tracing in libssh2 itself.  Note
-+                                  void *opaque);
+- * that this requires that libssh2 was specially compiled with the
- };
+- * `./configure --enable-debug' option, so most likely you will have
+- * to compile it yourself.  The meaning of <bitmask> is described
- /* General I/O handling functions */
+- * here: http://www.libssh2.org/libssh2_trace.html
-@@ -XXX,XX +XXX,XX @@ void qio_channel_yield(QIOChannel *ioc,
++ * TRACE_LIBSSH=<level> enables tracing in libssh itself.
- void qio_channel_wait(QIOChannel *ioc,
++ * The meaning of <level> is described here:
-                       GIOCondition condition);
++ * http://api.libssh.org/master/group__libssh__log.html
+  */
-+/**
+-#define TRACE_LIBSSH2 0 /* or try: LIBSSH2_TRACE_SFTP */
-+ * qio_channel_set_aio_fd_handler:
++#define TRACE_LIBSSH  0 /* see: SSH_LOG_* */
-+ * @ioc: the channel object
-+ * @ctx: the AioContext to set the handlers on
+ typedef struct BDRVSSHState {
-+ * @io_read: the read handler
+     /* Coroutine. */
-+ * @io_write: the write handler
+@@ -XXX,XX +XXX,XX @@ typedef struct BDRVSSHState {
-+ * @opaque: the opaque value passed to the handler
-+ *
+     /* SSH connection. */
-+ * This is used internally by qio_channel_yield().  It can
+     int sock;                         /* socket */
-+ * be used by channel implementations to forward the handlers
+-    LIBSSH2_SESSION *session;         /* ssh session */
-+ * to another channel (e.g. from #QIOChannelTLS to the
+-    LIBSSH2_SFTP *sftp;               /* sftp session */
-+ * underlying socket).
+-    LIBSSH2_SFTP_HANDLE *sftp_handle; /* sftp remote file handle */
-+ */
++    ssh_session session;              /* ssh session */
-+void qio_channel_set_aio_fd_handler(QIOChannel *ioc,
++    sftp_session sftp;                /* sftp session */
-+                                    AioContext *ctx,
++    sftp_file sftp_handle;            /* sftp remote file handle */
-+                                    IOHandler *io_read,
-+                                    IOHandler *io_write,
+-    /* See ssh_seek() function below. */
-+                                    void *opaque);
+-    int64_t offset;
-+
+-    bool offset_op_read;
- #endif /* QIO_CHANNEL_H */
+-
-diff --git a/io/channel-command.c b/io/channel-command.c
+-    /* File attributes at open.  We try to keep the .filesize field
-index XXXXXXX..XXXXXXX 100644
++    /*
---- a/io/channel-command.c
++     * File attributes at open.  We try to keep the .size field
-+++ b/io/channel-command.c
+      * updated if it changes (eg by writing at the end of the file).
-@@ -XXX,XX +XXX,XX @@ static int qio_channel_command_close(QIOChannel *ioc,
+      */
 -    LIBSSH2_SFTP_ATTRIBUTES attrs;
 +    sftp_attributes attrs;
      InetSocketAddress *inet;
@@ -XXX,XX +XXX,XX @@ static void ssh_state_init(BDRVSSHState *s)
  {
      memset(s, 0, sizeof *s);
      s->sock = -1;
 -    s->offset = -1;
      qemu_co_mutex_init(&s->lock);
  }
+@@ -XXX,XX +XXX,XX @@ static void ssh_state_free(BDRVSSHState *s)
 +static void qio_channel_command_set_aio_fd_handler(QIOChannel *ioc,
 +                                                   AioContext *ctx,
 +                                                   IOHandler *io_read,
 +                                                   IOHandler *io_write,
 +                                                   void *opaque)
 +{
 +    QIOChannelCommand *cioc = QIO_CHANNEL_COMMAND(ioc);
 +    aio_set_fd_handler(ctx, cioc->readfd, false, io_read, NULL, NULL, opaque);
 +    aio_set_fd_handler(ctx, cioc->writefd, false, NULL, io_write, NULL, opaque);
 +}
 +
 +
  static GSource *qio_channel_command_create_watch(QIOChannel *ioc,
                                                   GIOCondition condition)
  {
-@@ -XXX,XX +XXX,XX @@ static void qio_channel_command_class_init(ObjectClass *klass,
+     g_free(s->user);
-     ioc_klass->io_set_blocking = qio_channel_command_set_blocking;
-     ioc_klass->io_close = qio_channel_command_close;
++    if (s->attrs) {
-     ioc_klass->io_create_watch = qio_channel_command_create_watch;
++        sftp_attributes_free(s->attrs);
-+    ioc_klass->io_set_aio_fd_handler = qio_channel_command_set_aio_fd_handler;
++    }
      if (s->sftp_handle) {
 -        libssh2_sftp_close(s->sftp_handle);
 +        sftp_close(s->sftp_handle);
      }
      if (s->sftp) {
 -        libssh2_sftp_shutdown(s->sftp);
 +        sftp_free(s->sftp);
      }
      if (s->session) {
 -        libssh2_session_disconnect(s->session,
 -                                   "from qemu ssh client: "
 -                                   "user closed the connection");
 -        libssh2_session_free(s->session);
 -    }
 -    if (s->sock >= 0) {
 -        close(s->sock);
 +        ssh_disconnect(s->session);
 +        ssh_free(s->session); /* This frees s->sock */
      }
  }
- static const TypeInfo qio_channel_command_info = {
+@@ -XXX,XX +XXX,XX @@ session_error_setg(Error **errp, BDRVSSHState *s, const char *fs, ...)
-diff --git a/io/channel-file.c b/io/channel-file.c
+     va_end(args);
-index XXXXXXX..XXXXXXX 100644
---- a/io/channel-file.c
+     if (s->session) {
-+++ b/io/channel-file.c
+-        char *ssh_err;
-@@ -XXX,XX +XXX,XX @@ static int qio_channel_file_close(QIOChannel *ioc,
++        const char *ssh_err;
          int ssh_err_code;
 -        /* This is not an errno.  See <libssh2.h>. */
 -        ssh_err_code = libssh2_session_last_error(s->session,
 -                                                  &ssh_err, NULL, 0);
 -        error_setg(errp, "%s: %s (libssh2 error code: %d)",
 +        /* This is not an errno.  See <libssh/libssh.h>. */
 +        ssh_err = ssh_get_error(s->session);
 +        ssh_err_code = ssh_get_error_code(s->session);
 +        error_setg(errp, "%s: %s (libssh error code: %d)",
                     msg, ssh_err, ssh_err_code);
      } else {
          error_setg(errp, "%s", msg);
@@ -XXX,XX +XXX,XX @@ sftp_error_setg(Error **errp, BDRVSSHState *s, const char *fs, ...)
      va_end(args);
      if (s->sftp) {
 -        char *ssh_err;
 +        const char *ssh_err;
          int ssh_err_code;
 -        unsigned long sftp_err_code;
 +        int sftp_err_code;
 -        /* This is not an errno.  See <libssh2.h>. */
 -        ssh_err_code = libssh2_session_last_error(s->session,
 -                                                  &ssh_err, NULL, 0);
 -        /* See <libssh2_sftp.h>. */
 -        sftp_err_code = libssh2_sftp_last_error((s)->sftp);
 +        /* This is not an errno.  See <libssh/libssh.h>. */
 +        ssh_err = ssh_get_error(s->session);
 +        ssh_err_code = ssh_get_error_code(s->session);
 +        /* See <libssh/sftp.h>. */
 +        sftp_err_code = sftp_get_error(s->sftp);
          error_setg(errp,
 -                   "%s: %s (libssh2 error code: %d, sftp error code: %lu)",
 +                   "%s: %s (libssh error code: %d, sftp error code: %d)",
                     msg, ssh_err, ssh_err_code, sftp_err_code);
      } else {
          error_setg(errp, "%s", msg);
@@ -XXX,XX +XXX,XX @@ sftp_error_setg(Error **errp, BDRVSSHState *s, const char *fs, ...)
  static void sftp_error_trace(BDRVSSHState *s, const char *op)
  {
 -    char *ssh_err;
 +    const char *ssh_err;
      int ssh_err_code;
 -    unsigned long sftp_err_code;
 +    int sftp_err_code;
 -    /* This is not an errno.  See <libssh2.h>. */
 -    ssh_err_code = libssh2_session_last_error(s->session,
 -                                              &ssh_err, NULL, 0);
 -    /* See <libssh2_sftp.h>. */
 -    sftp_err_code = libssh2_sftp_last_error((s)->sftp);
 +    /* This is not an errno.  See <libssh/libssh.h>. */
 +    ssh_err = ssh_get_error(s->session);
 +    ssh_err_code = ssh_get_error_code(s->session);
 +    /* See <libssh/sftp.h>. */
 +    sftp_err_code = sftp_get_error(s->sftp);
      trace_sftp_error(op, ssh_err, ssh_err_code, sftp_err_code);
  }
+@@ -XXX,XX +XXX,XX @@ static void ssh_parse_filename(const char *filename, QDict *options,
+     parse_uri(filename, options, errp);
-+static void qio_channel_file_set_aio_fd_handler(QIOChannel *ioc,
+ }
-+                                                AioContext *ctx,
-+                                                IOHandler *io_read,
+-static int check_host_key_knownhosts(BDRVSSHState *s,
-+                                                IOHandler *io_write,
+-                                     const char *host, int port, Error **errp)
-+                                                void *opaque)
++static int check_host_key_knownhosts(BDRVSSHState *s, Error **errp)
 +{
 +    QIOChannelFile *fioc = QIO_CHANNEL_FILE(ioc);
 +    aio_set_fd_handler(ctx, fioc->fd, false, io_read, io_write, NULL, opaque);
 +}
 +
  static GSource *qio_channel_file_create_watch(QIOChannel *ioc,
                                                GIOCondition condition)
  {
-@@ -XXX,XX +XXX,XX @@ static void qio_channel_file_class_init(ObjectClass *klass,
+-    const char *home;
-     ioc_klass->io_seek = qio_channel_file_seek;
+-    char *knh_file = NULL;
-     ioc_klass->io_close = qio_channel_file_close;
+-    LIBSSH2_KNOWNHOSTS *knh = NULL;
-     ioc_klass->io_create_watch = qio_channel_file_create_watch;
+-    struct libssh2_knownhost *found;
-+    ioc_klass->io_set_aio_fd_handler = qio_channel_file_set_aio_fd_handler;
+-    int ret, r;
 -    const char *hostkey;
 -    size_t len;
 -    int type;
 -
 -    hostkey = libssh2_session_hostkey(s->session, &len, &type);
 -    if (!hostkey) {
 +    int ret;
 +#ifdef HAVE_LIBSSH_0_8
 +    enum ssh_known_hosts_e state;
 +    int r;
 +    ssh_key pubkey;
 +    enum ssh_keytypes_e pubkey_type;
 +    unsigned char *server_hash = NULL;
 +    size_t server_hash_len;
 +    char *fingerprint = NULL;
 +
 +    state = ssh_session_is_known_server(s->session);
 +    trace_ssh_server_status(state);
 +
 +    switch (state) {
 +    case SSH_KNOWN_HOSTS_OK:
 +        /* OK */
 +        trace_ssh_check_host_key_knownhosts();
 +        break;
 +    case SSH_KNOWN_HOSTS_CHANGED:
          ret = -EINVAL;
 -        session_error_setg(errp, s, "failed to read remote host key");
 +        r = ssh_get_server_publickey(s->session, &pubkey);
 +        if (r == 0) {
 +            r = ssh_get_publickey_hash(pubkey, SSH_PUBLICKEY_HASH_SHA256,
 +                                       &server_hash, &server_hash_len);
 +            pubkey_type = ssh_key_type(pubkey);
 +            ssh_key_free(pubkey);
 +        }
 +        if (r == 0) {
 +            fingerprint = ssh_get_fingerprint_hash(SSH_PUBLICKEY_HASH_SHA256,
 +                                                   server_hash,
 +                                                   server_hash_len);
 +            ssh_clean_pubkey_hash(&server_hash);
 +        }
 +        if (fingerprint) {
 +            error_setg(errp,
 +                       "host key (%s key with fingerprint %s) does not match "
 +                       "the one in known_hosts; this may be a possible attack",
 +                       ssh_key_type_to_char(pubkey_type), fingerprint);
 +            ssh_string_free_char(fingerprint);
 +        } else  {
 +            error_setg(errp,
 +                       "host key does not match the one in known_hosts; this "
 +                       "may be a possible attack");
 +        }
          goto out;
 -    }
 -
 -    knh = libssh2_knownhost_init(s->session);
 -    if (!knh) {
 +    case SSH_KNOWN_HOSTS_OTHER:
          ret = -EINVAL;
 -        session_error_setg(errp, s,
 -                           "failed to initialize known hosts support");
 +        error_setg(errp,
 +                   "host key for this server not found, another type exists");
 +        goto out;
 +    case SSH_KNOWN_HOSTS_UNKNOWN:
 +        ret = -EINVAL;
 +        error_setg(errp, "no host key was found in known_hosts");
 +        goto out;
 +    case SSH_KNOWN_HOSTS_NOT_FOUND:
 +        ret = -ENOENT;
 +        error_setg(errp, "known_hosts file not found");
 +        goto out;
 +    case SSH_KNOWN_HOSTS_ERROR:
 +        ret = -EINVAL;
 +        error_setg(errp, "error while checking the host");
 +        goto out;
 +    default:
 +        ret = -EINVAL;
 +        error_setg(errp, "error while checking for known server (%d)", state);
          goto out;
      }
 +#else /* !HAVE_LIBSSH_0_8 */
 +    int state;
 -    home = getenv("HOME");
 -    if (home) {
 -        knh_file = g_strdup_printf("%s/.ssh/known_hosts", home);
 -    } else {
 -        knh_file = g_strdup_printf("/root/.ssh/known_hosts");
 -    }
 -
 -    /* Read all known hosts from OpenSSH-style known_hosts file. */
 -    libssh2_knownhost_readfile(knh, knh_file, LIBSSH2_KNOWNHOST_FILE_OPENSSH);
 +    state = ssh_is_server_known(s->session);
 +    trace_ssh_server_status(state);
 -    r = libssh2_knownhost_checkp(knh, host, port, hostkey, len,
 -                                 LIBSSH2_KNOWNHOST_TYPE_PLAIN|
 -                                 LIBSSH2_KNOWNHOST_KEYENC_RAW,
 -                                 &found);
 -    switch (r) {
 -    case LIBSSH2_KNOWNHOST_CHECK_MATCH:
 +    switch (state) {
 +    case SSH_SERVER_KNOWN_OK:
          /* OK */
 -        trace_ssh_check_host_key_knownhosts(found->key);
 +        trace_ssh_check_host_key_knownhosts();
          break;
 -    case LIBSSH2_KNOWNHOST_CHECK_MISMATCH:
 +    case SSH_SERVER_KNOWN_CHANGED:
          ret = -EINVAL;
 -        session_error_setg(errp, s,
 -                      "host key does not match the one in known_hosts"
 -                      " (found key %s)", found->key);
 +        error_setg(errp,
 +                   "host key does not match the one in known_hosts; this "
 +                   "may be a possible attack");
          goto out;
 -    case LIBSSH2_KNOWNHOST_CHECK_NOTFOUND:
 +    case SSH_SERVER_FOUND_OTHER:
          ret = -EINVAL;
 -        session_error_setg(errp, s, "no host key was found in known_hosts");
 +        error_setg(errp,
 +                   "host key for this server not found, another type exists");
 +        goto out;
 +    case SSH_SERVER_FILE_NOT_FOUND:
 +        ret = -ENOENT;
 +        error_setg(errp, "known_hosts file not found");
          goto out;
 -    case LIBSSH2_KNOWNHOST_CHECK_FAILURE:
 +    case SSH_SERVER_NOT_KNOWN:
          ret = -EINVAL;
 -        session_error_setg(errp, s,
 -                      "failure matching the host key with known_hosts");
 +        error_setg(errp, "no host key was found in known_hosts");
 +        goto out;
 +    case SSH_SERVER_ERROR:
 +        ret = -EINVAL;
 +        error_setg(errp, "server error");
          goto out;
      default:
          ret = -EINVAL;
 -        session_error_setg(errp, s, "unknown error matching the host key"
 -                      " with known_hosts (%d)", r);
 +        error_setg(errp, "error while checking for known server (%d)", state);
          goto out;
      }
 +#endif /* !HAVE_LIBSSH_0_8 */
      /* known_hosts checking successful. */
      ret = 0;
   out:
 -    if (knh != NULL) {
 -        libssh2_knownhost_free(knh);
 -    }
 -    g_free(knh_file);
      return ret;
  }
- static const TypeInfo qio_channel_file_info = {
+@@ -XXX,XX +XXX,XX @@ static int compare_fingerprint(const unsigned char *fingerprint, size_t len,
-diff --git a/io/channel-socket.c b/io/channel-socket.c
-index XXXXXXX..XXXXXXX 100644
+ static int
---- a/io/channel-socket.c
+ check_host_key_hash(BDRVSSHState *s, const char *hash,
-+++ b/io/channel-socket.c
+-                    int hash_type, size_t fingerprint_len, Error **errp)
-@@ -XXX,XX +XXX,XX @@ qio_channel_socket_set_blocking(QIOChannel *ioc,
++                    enum ssh_publickey_hash_type type, Error **errp)
-         qemu_set_block(sioc->fd);
+ {
-     } else {
+-    const char *fingerprint;
-         qemu_set_nonblock(sioc->fd);
+-
--#ifdef WIN32
+-    fingerprint = libssh2_hostkey_hash(s->session, hash_type);
--        WSAEventSelect(sioc->fd, ioc->event,
+-    if (!fingerprint) {
--                       FD_READ | FD_ACCEPT | FD_CLOSE |
++    int r;
--                       FD_CONNECT | FD_WRITE | FD_OOB);
++    ssh_key pubkey;
--#endif
++    unsigned char *server_hash;
-     }
++    size_t server_hash_len;
 +
 +#ifdef HAVE_LIBSSH_0_8
 +    r = ssh_get_server_publickey(s->session, &pubkey);
 +#else
 +    r = ssh_get_publickey(s->session, &pubkey);
 +#endif
 +    if (r != SSH_OK) {
          session_error_setg(errp, s, "failed to read remote host key");
          return -EINVAL;
      }
 -    if(compare_fingerprint((unsigned char *) fingerprint, fingerprint_len,
 -                           hash) != 0) {
 +    r = ssh_get_publickey_hash(pubkey, type, &server_hash, &server_hash_len);
 +    ssh_key_free(pubkey);
 +    if (r != 0) {
 +        session_error_setg(errp, s,
 +                           "failed reading the hash of the server SSH key");
 +        return -EINVAL;
 +    }
 +
 +    r = compare_fingerprint(server_hash, server_hash_len, hash);
 +    ssh_clean_pubkey_hash(&server_hash);
 +    if (r != 0) {
          error_setg(errp, "remote host key does not match host_key_check '%s'",
                     hash);
          return -EPERM;
@@ -XXX,XX +XXX,XX @@ check_host_key_hash(BDRVSSHState *s, const char *hash,
      return 0;
  }
-@@ -XXX,XX +XXX,XX @@ qio_channel_socket_shutdown(QIOChannel *ioc,
 -static int check_host_key(BDRVSSHState *s, const char *host, int port,
 -                          SshHostKeyCheck *hkc, Error **errp)
 +static int check_host_key(BDRVSSHState *s, SshHostKeyCheck *hkc, Error **errp)
  {
      SshHostKeyCheckMode mode;
@@ -XXX,XX +XXX,XX @@ static int check_host_key(BDRVSSHState *s, const char *host, int port,
      case SSH_HOST_KEY_CHECK_MODE_HASH:
          if (hkc->u.hash.type == SSH_HOST_KEY_CHECK_HASH_TYPE_MD5) {
              return check_host_key_hash(s, hkc->u.hash.hash,
 -                                       LIBSSH2_HOSTKEY_HASH_MD5, 16, errp);
 +                                       SSH_PUBLICKEY_HASH_MD5, errp);
          } else if (hkc->u.hash.type == SSH_HOST_KEY_CHECK_HASH_TYPE_SHA1) {
              return check_host_key_hash(s, hkc->u.hash.hash,
 -                                       LIBSSH2_HOSTKEY_HASH_SHA1, 20, errp);
 +                                       SSH_PUBLICKEY_HASH_SHA1, errp);
          }
          g_assert_not_reached();
          break;
      case SSH_HOST_KEY_CHECK_MODE_KNOWN_HOSTS:
 -        return check_host_key_knownhosts(s, host, port, errp);
 +        return check_host_key_knownhosts(s, errp);
      default:
          g_assert_not_reached();
      }
@@ -XXX,XX +XXX,XX @@ static int check_host_key(BDRVSSHState *s, const char *host, int port,
      return -EINVAL;
  }
 -static int authenticate(BDRVSSHState *s, const char *user, Error **errp)
 +static int authenticate(BDRVSSHState *s, Error **errp)
  {
      int r, ret;
 -    const char *userauthlist;
 -    LIBSSH2_AGENT *agent = NULL;
 -    struct libssh2_agent_publickey *identity;
 -    struct libssh2_agent_publickey *prev_identity = NULL;
 +    int method;
 -    userauthlist = libssh2_userauth_list(s->session, user, strlen(user));
 -    if (strstr(userauthlist, "publickey") == NULL) {
 +    /* Try to authenticate with the "none" method. */
 +    r = ssh_userauth_none(s->session, NULL);
 +    if (r == SSH_AUTH_ERROR) {
          ret = -EPERM;
 -        error_setg(errp,
 -                "remote server does not support \"publickey\" authentication");
 +        session_error_setg(errp, s, "failed to authenticate using none "
 +                                    "authentication");
          goto out;
 -    }
 -
 -    /* Connect to ssh-agent and try each identity in turn. */
 -    agent = libssh2_agent_init(s->session);
 -    if (!agent) {
 -        ret = -EINVAL;
 -        session_error_setg(errp, s, "failed to initialize ssh-agent support");
 -        goto out;
 -    }
 -    if (libssh2_agent_connect(agent)) {
 -        ret = -ECONNREFUSED;
 -        session_error_setg(errp, s, "failed to connect to ssh-agent");
 -        goto out;
 -    }
 -    if (libssh2_agent_list_identities(agent)) {
 -        ret = -EINVAL;
 -        session_error_setg(errp, s,
 -                           "failed requesting identities from ssh-agent");
 +    } else if (r == SSH_AUTH_SUCCESS) {
 +        /* Authenticated! */
 +        ret = 0;
          goto out;
      }
 -    for(;;) {
 -        r = libssh2_agent_get_identity(agent, &identity, prev_identity);
 -        if (r == 1) {           /* end of list */
 -            break;
 -        }
 -        if (r < 0) {
 +    method = ssh_userauth_list(s->session, NULL);
 +    trace_ssh_auth_methods(method);
 +
 +    /*
 +     * Try to authenticate with publickey, using the ssh-agent
 +     * if available.
 +     */
 +    if (method & SSH_AUTH_METHOD_PUBLICKEY) {
 +        r = ssh_userauth_publickey_auto(s->session, NULL, NULL);
 +        if (r == SSH_AUTH_ERROR) {
              ret = -EINVAL;
 -            session_error_setg(errp, s,
 -                               "failed to obtain identity from ssh-agent");
 +            session_error_setg(errp, s, "failed to authenticate using "
 +                                        "publickey authentication");
              goto out;
 -        }
 -        r = libssh2_agent_userauth(agent, user, identity);
 -        if (r == 0) {
 +        } else if (r == SSH_AUTH_SUCCESS) {
              /* Authenticated! */
              ret = 0;
              goto out;
          }
 -        /* Failed to authenticate with this identity, try the next one. */
 -        prev_identity = identity;
      }
      ret = -EPERM;
@@ -XXX,XX +XXX,XX @@ static int authenticate(BDRVSSHState *s, const char *user, Error **errp)
                 "and the identities held by your ssh-agent");
   out:
 -    if (agent != NULL) {
 -        /* Note: libssh2 implementation implicitly calls
 -         * libssh2_agent_disconnect if necessary.
 -         */
 -        libssh2_agent_free(agent);
 -    }
 -
      return ret;
  }
@@ -XXX,XX +XXX,XX @@ static int connect_to_ssh(BDRVSSHState *s, BlockdevOptionsSsh *opts,
                            int ssh_flags, int creat_mode, Error **errp)
  {
      int r, ret;
 -    long port = 0;
 +    unsigned int port = 0;
 +    int new_sock = -1;
      if (opts->has_user) {
          s->user = g_strdup(opts->user);
@@ -XXX,XX +XXX,XX @@ static int connect_to_ssh(BDRVSSHState *s, BlockdevOptionsSsh *opts,
      s->inet = opts->server;
      opts->server = NULL;
 -    if (qemu_strtol(s->inet->port, NULL, 10, &port) < 0) {
 +    if (qemu_strtoui(s->inet->port, NULL, 10, &port) < 0) {
          error_setg(errp, "Use only numeric port value");
          ret = -EINVAL;
          goto err;
      }
      /* Open the socket and connect. */
 -    s->sock = inet_connect_saddr(s->inet, errp);
 -    if (s->sock < 0) {
 +    new_sock = inet_connect_saddr(s->inet, errp);
 +    if (new_sock < 0) {
          ret = -EIO;
          goto err;
      }
 +    /*
 +     * Try to disable the Nagle algorithm on TCP sockets to reduce latency,
 +     * but do not fail if it cannot be disabled.
 +     */
 +    r = socket_set_nodelay(new_sock);
 +    if (r < 0) {
 +        warn_report("can't set TCP_NODELAY for the ssh server %s: %s",
 +                    s->inet->host, strerror(errno));
 +    }
 +
      /* Create SSH session. */
 -    s->session = libssh2_session_init();
 +    s->session = ssh_new();
      if (!s->session) {
          ret = -EINVAL;
 -        session_error_setg(errp, s, "failed to initialize libssh2 session");
 +        session_error_setg(errp, s, "failed to initialize libssh session");
          goto err;
      }
 -#if TRACE_LIBSSH2 != 0
 -    libssh2_trace(s->session, TRACE_LIBSSH2);
 -#endif
 +    /*
 +     * Make sure we are in blocking mode during the connection and
 +     * authentication phases.
 +     */
 +    ssh_set_blocking(s->session, 1);
 -    r = libssh2_session_handshake(s->session, s->sock);
 -    if (r != 0) {
 +    r = ssh_options_set(s->session, SSH_OPTIONS_USER, s->user);
 +    if (r < 0) {
 +        ret = -EINVAL;
 +        session_error_setg(errp, s,
 +                           "failed to set the user in the libssh session");
 +        goto err;
 +    }
 +
 +    r = ssh_options_set(s->session, SSH_OPTIONS_HOST, s->inet->host);
 +    if (r < 0) {
 +        ret = -EINVAL;
 +        session_error_setg(errp, s,
 +                           "failed to set the host in the libssh session");
 +        goto err;
 +    }
 +
 +    if (port > 0) {
 +        r = ssh_options_set(s->session, SSH_OPTIONS_PORT, &port);
 +        if (r < 0) {
 +            ret = -EINVAL;
 +            session_error_setg(errp, s,
 +                               "failed to set the port in the libssh session");
 +            goto err;
 +        }
 +    }
 +
 +    r = ssh_options_set(s->session, SSH_OPTIONS_COMPRESSION, "none");
 +    if (r < 0) {
 +        ret = -EINVAL;
 +        session_error_setg(errp, s,
 +                           "failed to disable the compression in the libssh "
 +                           "session");
 +        goto err;
 +    }
 +
 +    /* Read ~/.ssh/config. */
 +    r = ssh_options_parse_config(s->session, NULL);
 +    if (r < 0) {
 +        ret = -EINVAL;
 +        session_error_setg(errp, s, "failed to parse ~/.ssh/config");
 +        goto err;
 +    }
 +
 +    r = ssh_options_set(s->session, SSH_OPTIONS_FD, &new_sock);
 +    if (r < 0) {
 +        ret = -EINVAL;
 +        session_error_setg(errp, s,
 +                           "failed to set the socket in the libssh session");
 +        goto err;
 +    }
 +    /* libssh took ownership of the socket. */
 +    s->sock = new_sock;
 +    new_sock = -1;
 +
 +    /* Connect. */
 +    r = ssh_connect(s->session);
 +    if (r != SSH_OK) {
          ret = -EINVAL;
          session_error_setg(errp, s, "failed to establish SSH session");
          goto err;
      }
      /* Check the remote host's key against known_hosts. */
 -    ret = check_host_key(s, s->inet->host, port, opts->host_key_check, errp);
 +    ret = check_host_key(s, opts->host_key_check, errp);
      if (ret < 0) {
          goto err;
      }
      /* Authenticate. */
 -    ret = authenticate(s, s->user, errp);
 +    ret = authenticate(s, errp);
      if (ret < 0) {
          goto err;
      }
      /* Start SFTP. */
 -    s->sftp = libssh2_sftp_init(s->session);
 +    s->sftp = sftp_new(s->session);
      if (!s->sftp) {
 -        session_error_setg(errp, s, "failed to initialize sftp handle");
 +        session_error_setg(errp, s, "failed to create sftp handle");
 +        ret = -EINVAL;
 +        goto err;
 +    }
 +
 +    r = sftp_init(s->sftp);
 +    if (r < 0) {
 +        sftp_error_setg(errp, s, "failed to initialize sftp handle");
          ret = -EINVAL;
          goto err;
      }
      /* Open the remote file. */
      trace_ssh_connect_to_ssh(opts->path, ssh_flags, creat_mode);
 -    s->sftp_handle = libssh2_sftp_open(s->sftp, opts->path, ssh_flags,
 -                                       creat_mode);
 +    s->sftp_handle = sftp_open(s->sftp, opts->path, ssh_flags, creat_mode);
      if (!s->sftp_handle) {
 -        session_error_setg(errp, s, "failed to open remote file '%s'",
 -                           opts->path);
 +        sftp_error_setg(errp, s, "failed to open remote file '%s'",
 +                        opts->path);
          ret = -EINVAL;
          goto err;
      }
 -    r = libssh2_sftp_fstat(s->sftp_handle, &s->attrs);
 -    if (r < 0) {
 +    /* Make sure the SFTP file is handled in blocking mode. */
 +    sftp_file_set_blocking(s->sftp_handle);
 +
 +    s->attrs = sftp_fstat(s->sftp_handle);
 +    if (!s->attrs) {
          sftp_error_setg(errp, s, "failed to read file attributes");
          return -EINVAL;
      }
@@ -XXX,XX +XXX,XX @@ static int connect_to_ssh(BDRVSSHState *s, BlockdevOptionsSsh *opts,
      return 0;
   err:
 +    if (s->attrs) {
 +        sftp_attributes_free(s->attrs);
 +    }
 +    s->attrs = NULL;
      if (s->sftp_handle) {
 -        libssh2_sftp_close(s->sftp_handle);
 +        sftp_close(s->sftp_handle);
      }
      s->sftp_handle = NULL;
      if (s->sftp) {
 -        libssh2_sftp_shutdown(s->sftp);
 +        sftp_free(s->sftp);
      }
      s->sftp = NULL;
      if (s->session) {
 -        libssh2_session_disconnect(s->session,
 -                                   "from qemu ssh client: "
 -                                   "error opening connection");
 -        libssh2_session_free(s->session);
 +        ssh_disconnect(s->session);
 +        ssh_free(s->session);
      }
      s->session = NULL;
 +    s->sock = -1;
 +    if (new_sock >= 0) {
 +        close(new_sock);
 +    }
      return ret;
  }
@@ -XXX,XX +XXX,XX @@ static int ssh_file_open(BlockDriverState *bs, QDict *options, int bdrv_flags,
      ssh_state_init(s);
 -    ssh_flags = LIBSSH2_FXF_READ;
 +    ssh_flags = 0;
      if (bdrv_flags & BDRV_O_RDWR) {
 -        ssh_flags |= LIBSSH2_FXF_WRITE;
 +        ssh_flags |= O_RDWR;
 +    } else {
 +        ssh_flags |= O_RDONLY;
      }
      opts = ssh_parse_options(options, errp);
@@ -XXX,XX +XXX,XX @@ static int ssh_file_open(BlockDriverState *bs, QDict *options, int bdrv_flags,
      }
      /* Go non-blocking. */
 -    libssh2_session_set_blocking(s->session, 0);
 +    ssh_set_blocking(s->session, 0);
      qapi_free_BlockdevOptionsSsh(opts);
      return 0;
   err:
 -    if (s->sock >= 0) {
 -        close(s->sock);
 -    }
 -    s->sock = -1;
 -
      qapi_free_BlockdevOptionsSsh(opts);
      return ret;
@@ -XXX,XX +XXX,XX @@ static int ssh_grow_file(BDRVSSHState *s, int64_t offset, Error **errp)
  {
      ssize_t ret;
      char c[1] = { '\0' };
 -    int was_blocking = libssh2_session_get_blocking(s->session);
 +    int was_blocking = ssh_is_blocking(s->session);
      /* offset must be strictly greater than the current size so we do
       * not overwrite anything */
 -    assert(offset > 0 && offset > s->attrs.filesize);
 +    assert(offset > 0 && offset > s->attrs->size);
 -    libssh2_session_set_blocking(s->session, 1);
 +    ssh_set_blocking(s->session, 1);
 -    libssh2_sftp_seek64(s->sftp_handle, offset - 1);
 -    ret = libssh2_sftp_write(s->sftp_handle, c, 1);
 +    sftp_seek64(s->sftp_handle, offset - 1);
 +    ret = sftp_write(s->sftp_handle, c, 1);
 -    libssh2_session_set_blocking(s->session, was_blocking);
 +    ssh_set_blocking(s->session, was_blocking);
      if (ret < 0) {
          sftp_error_setg(errp, s, "Failed to grow file");
          return -EIO;
      }
 -    s->attrs.filesize = offset;
 +    s->attrs->size = offset;
      return 0;
  }
-+static void qio_channel_socket_set_aio_fd_handler(QIOChannel *ioc,
+@@ -XXX,XX +XXX,XX @@ static int ssh_co_create(BlockdevCreateOptions *options, Error **errp)
-+                                                  AioContext *ctx,
+     ssh_state_init(&s);
-+                                                  IOHandler *io_read,
-+                                                  IOHandler *io_write,
+     ret = connect_to_ssh(&s, opts->location,
-+                                                  void *opaque)
+-                         LIBSSH2_FXF_READ|LIBSSH2_FXF_WRITE|
-+{
+-                         LIBSSH2_FXF_CREAT|LIBSSH2_FXF_TRUNC,
-+    QIOChannelSocket *sioc = QIO_CHANNEL_SOCKET(ioc);
++                         O_RDWR | O_CREAT | O_TRUNC,
-+    aio_set_fd_handler(ctx, sioc->fd, false, io_read, io_write, NULL, opaque);
+, errp);
-+}
+     if (ret < 0) {
-+
+         goto fail;
- static GSource *qio_channel_socket_create_watch(QIOChannel *ioc,
+@@ -XXX,XX +XXX,XX @@ static int ssh_has_zero_init(BlockDriverState *bs)
-                                                 GIOCondition condition)
+     /* Assume false, unless we can positively prove it's true. */
      int has_zero_init = 0;
 -    if (s->attrs.flags & LIBSSH2_SFTP_ATTR_PERMISSIONS) {
 -        if (s->attrs.permissions & LIBSSH2_SFTP_S_IFREG) {
 -            has_zero_init = 1;
 -        }
 +    if (s->attrs->type == SSH_FILEXFER_TYPE_REGULAR) {
 +        has_zero_init = 1;
      }
      return has_zero_init;
@@ -XXX,XX +XXX,XX @@ static coroutine_fn void co_yield(BDRVSSHState *s, BlockDriverState *bs)
          .co = qemu_coroutine_self()
      };
 -    r = libssh2_session_block_directions(s->session);
 +    r = ssh_get_poll_flags(s->session);
 -    if (r & LIBSSH2_SESSION_BLOCK_INBOUND) {
 +    if (r & SSH_READ_PENDING) {
          rd_handler = restart_coroutine;
      }
 -    if (r & LIBSSH2_SESSION_BLOCK_OUTBOUND) {
 +    if (r & SSH_WRITE_PENDING) {
          wr_handler = restart_coroutine;
      }
@@ -XXX,XX +XXX,XX @@ static coroutine_fn void co_yield(BDRVSSHState *s, BlockDriverState *bs)
      trace_ssh_co_yield_back(s->sock);
  }
 -/* SFTP has a function `libssh2_sftp_seek64' which seeks to a position
 - * in the remote file.  Notice that it just updates a field in the
 - * sftp_handle structure, so there is no network traffic and it cannot
 - * fail.
 - *
 - * However, `libssh2_sftp_seek64' does have a catastrophic effect on
 - * performance since it causes the handle to throw away all in-flight
 - * reads and buffered readahead data.  Therefore this function tries
 - * to be intelligent about when to call the underlying libssh2 function.
 - */
 -#define SSH_SEEK_WRITE 0
 -#define SSH_SEEK_READ  1
 -#define SSH_SEEK_FORCE 2
 -
 -static void ssh_seek(BDRVSSHState *s, int64_t offset, int flags)
 -{
 -    bool op_read = (flags & SSH_SEEK_READ) != 0;
 -    bool force = (flags & SSH_SEEK_FORCE) != 0;
 -
 -    if (force || op_read != s->offset_op_read || offset != s->offset) {
 -        trace_ssh_seek(offset);
 -        libssh2_sftp_seek64(s->sftp_handle, offset);
 -        s->offset = offset;
 -        s->offset_op_read = op_read;
 -    }
 -}
 -
  static coroutine_fn int ssh_read(BDRVSSHState *s, BlockDriverState *bs,
                                   int64_t offset, size_t size,
                                   QEMUIOVector *qiov)
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int ssh_read(BDRVSSHState *s, BlockDriverState *bs,
      trace_ssh_read(offset, size);
 -    ssh_seek(s, offset, SSH_SEEK_READ);
 +    trace_ssh_seek(offset);
 +    sftp_seek64(s->sftp_handle, offset);
      /* This keeps track of the current iovec element ('i'), where we
       * will write to next ('buf'), and the end of the current iovec
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int ssh_read(BDRVSSHState *s, BlockDriverState *bs,
      buf = i->iov_base;
      end_of_vec = i->iov_base + i->iov_len;
 -    /* libssh2 has a hard-coded limit of 2000 bytes per request,
 -     * although it will also do readahead behind our backs.  Therefore
 -     * we may have to do repeated reads here until we have read 'size'
 -     * bytes.
 -     */
      for (got = 0; got < size; ) {
 +        size_t request_read_size;
      again:
 -        trace_ssh_read_buf(buf, end_of_vec - buf);
 -        r = libssh2_sftp_read(s->sftp_handle, buf, end_of_vec - buf);
 -        trace_ssh_read_return(r);
 +        /*
 +         * The size of SFTP packets is limited to 32K bytes, so limit
 +         * the amount of data requested to 16K, as libssh currently
 +         * does not handle multiple requests on its own.
 +         */
 +        request_read_size = MIN(end_of_vec - buf, 16384);
 +        trace_ssh_read_buf(buf, end_of_vec - buf, request_read_size);
 +        r = sftp_read(s->sftp_handle, buf, request_read_size);
 +        trace_ssh_read_return(r, sftp_get_error(s->sftp));
 -        if (r == LIBSSH2_ERROR_EAGAIN || r == LIBSSH2_ERROR_TIMEOUT) {
 +        if (r == SSH_AGAIN) {
              co_yield(s, bs);
              goto again;
          }
 -        if (r < 0) {
 -            sftp_error_trace(s, "read");
 -            s->offset = -1;
 -            return -EIO;
 -        }
 -        if (r == 0) {
 +        if (r == SSH_EOF || (r == 0 && sftp_get_error(s->sftp) == SSH_FX_EOF)) {
              /* EOF: Short read so pad the buffer with zeroes and return it. */
              qemu_iovec_memset(qiov, got, 0, size - got);
              return 0;
          }
 +        if (r <= 0) {
 +            sftp_error_trace(s, "read");
 +            return -EIO;
 +        }
          got += r;
          buf += r;
 -        s->offset += r;
          if (buf >= end_of_vec && got < size) {
              i++;
              buf = i->iov_base;
@@ -XXX,XX +XXX,XX @@ static int ssh_write(BDRVSSHState *s, BlockDriverState *bs,
      trace_ssh_write(offset, size);
 -    ssh_seek(s, offset, SSH_SEEK_WRITE);
 +    trace_ssh_seek(offset);
 +    sftp_seek64(s->sftp_handle, offset);
      /* This keeps track of the current iovec element ('i'), where we
       * will read from next ('buf'), and the end of the current iovec
@@ -XXX,XX +XXX,XX @@ static int ssh_write(BDRVSSHState *s, BlockDriverState *bs,
      end_of_vec = i->iov_base + i->iov_len;
      for (written = 0; written < size; ) {
 +        size_t request_write_size;
      again:
 -        trace_ssh_write_buf(buf, end_of_vec - buf);
 -        r = libssh2_sftp_write(s->sftp_handle, buf, end_of_vec - buf);
 -        trace_ssh_write_return(r);
 +        /*
 +         * Avoid too large data packets, as libssh currently does not
 +         * handle multiple requests on its own.
 +         */
 +        request_write_size = MIN(end_of_vec - buf, 131072);
 +        trace_ssh_write_buf(buf, end_of_vec - buf, request_write_size);
 +        r = sftp_write(s->sftp_handle, buf, request_write_size);
 +        trace_ssh_write_return(r, sftp_get_error(s->sftp));
 -        if (r == LIBSSH2_ERROR_EAGAIN || r == LIBSSH2_ERROR_TIMEOUT) {
 +        if (r == SSH_AGAIN) {
              co_yield(s, bs);
              goto again;
          }
          if (r < 0) {
              sftp_error_trace(s, "write");
 -            s->offset = -1;
              return -EIO;
          }
 -        /* The libssh2 API is very unclear about this.  A comment in
 -         * the code says "nothing was acked, and no EAGAIN was
 -         * received!" which apparently means that no data got sent
 -         * out, and the underlying channel didn't return any EAGAIN
 -         * indication.  I think this is a bug in either libssh2 or
 -         * OpenSSH (server-side).  In any case, forcing a seek (to
 -         * discard libssh2 internal buffers), and then trying again
 -         * works for me.
 -         */
 -        if (r == 0) {
 -            ssh_seek(s, offset + written, SSH_SEEK_WRITE|SSH_SEEK_FORCE);
 -            co_yield(s, bs);
 -            goto again;
 -        }
          written += r;
          buf += r;
 -        s->offset += r;
          if (buf >= end_of_vec && written < size) {
              i++;
              buf = i->iov_base;
              end_of_vec = i->iov_base + i->iov_len;
          }
 -        if (offset + written > s->attrs.filesize)
 -            s->attrs.filesize = offset + written;
 +        if (offset + written > s->attrs->size) {
 +            s->attrs->size = offset + written;
 +        }
      }
      return 0;
@@ -XXX,XX +XXX,XX @@ static void unsafe_flush_warning(BDRVSSHState *s, const char *what)
      }
  }
 -#ifdef HAS_LIBSSH2_SFTP_FSYNC
 +#ifdef HAVE_LIBSSH_0_8
  static coroutine_fn int ssh_flush(BDRVSSHState *s, BlockDriverState *bs)
  {
-@@ -XXX,XX +XXX,XX @@ static void qio_channel_socket_class_init(ObjectClass *klass,
+     int r;
-     ioc_klass->io_set_cork = qio_channel_socket_set_cork;
-     ioc_klass->io_set_delay = qio_channel_socket_set_delay;
+     trace_ssh_flush();
-     ioc_klass->io_create_watch = qio_channel_socket_create_watch;
++
-+    ioc_klass->io_set_aio_fd_handler = qio_channel_socket_set_aio_fd_handler;
++    if (!sftp_extension_supported(s->sftp, "fsync@openssh.com", "1")) {
 +        unsafe_flush_warning(s, "OpenSSH >= 6.3");
 +        return 0;
 +    }
   again:
 -    r = libssh2_sftp_fsync(s->sftp_handle);
 -    if (r == LIBSSH2_ERROR_EAGAIN || r == LIBSSH2_ERROR_TIMEOUT) {
 +    r = sftp_fsync(s->sftp_handle);
 +    if (r == SSH_AGAIN) {
          co_yield(s, bs);
          goto again;
      }
 -    if (r == LIBSSH2_ERROR_SFTP_PROTOCOL &&
 -        libssh2_sftp_last_error(s->sftp) == LIBSSH2_FX_OP_UNSUPPORTED) {
 -        unsafe_flush_warning(s, "OpenSSH >= 6.3");
 -        return 0;
 -    }
      if (r < 0) {
          sftp_error_trace(s, "fsync");
          return -EIO;
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int ssh_co_flush(BlockDriverState *bs)
      return ret;
  }
- static const TypeInfo qio_channel_socket_info = {
+-#else /* !HAS_LIBSSH2_SFTP_FSYNC */
-diff --git a/io/channel-tls.c b/io/channel-tls.c
++#else /* !HAVE_LIBSSH_0_8 */
  static coroutine_fn int ssh_co_flush(BlockDriverState *bs)
  {
      BDRVSSHState *s = bs->opaque;
 -    unsafe_flush_warning(s, "libssh2 >= 1.4.4");
 +    unsafe_flush_warning(s, "libssh >= 0.8.0");
      return 0;
  }
 -#endif /* !HAS_LIBSSH2_SFTP_FSYNC */
 +#endif /* !HAVE_LIBSSH_0_8 */
  static int64_t ssh_getlength(BlockDriverState *bs)
  {
      BDRVSSHState *s = bs->opaque;
      int64_t length;
 -    /* Note we cannot make a libssh2 call here. */
 -    length = (int64_t) s->attrs.filesize;
 +    /* Note we cannot make a libssh call here. */
 +    length = (int64_t) s->attrs->size;
      trace_ssh_getlength(length);
      return length;
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn ssh_co_truncate(BlockDriverState *bs, int64_t offset,
          return -ENOTSUP;
      }
 -    if (offset < s->attrs.filesize) {
 +    if (offset < s->attrs->size) {
          error_setg(errp, "ssh driver does not support shrinking files");
          return -ENOTSUP;
      }
 -    if (offset == s->attrs.filesize) {
 +    if (offset == s->attrs->size) {
          return 0;
      }
@@ -XXX,XX +XXX,XX @@ static void bdrv_ssh_init(void)
  {
      int r;
 -    r = libssh2_init(0);
 +    r = ssh_init();
      if (r != 0) {
 -        fprintf(stderr, "libssh2 initialization failed, %d\n", r);
 +        fprintf(stderr, "libssh initialization failed, %d\n", r);
          exit(EXIT_FAILURE);
      }
 +#if TRACE_LIBSSH != 0
 +    ssh_set_log_level(TRACE_LIBSSH);
 +#endif
 +
      bdrv_register(&bdrv_ssh);
  }
 diff --git a/.travis.yml b/.travis.yml
 index XXXXXXX..XXXXXXX 100644
---- a/io/channel-tls.c
+--- a/.travis.yml
-+++ b/io/channel-tls.c
++++ b/.travis.yml
-@@ -XXX,XX +XXX,XX @@ static int qio_channel_tls_close(QIOChannel *ioc,
+@@ -XXX,XX +XXX,XX @@ addons:
-     return qio_channel_close(tioc->master, errp);
+       - libseccomp-dev
- }
+       - libspice-protocol-dev
+       - libspice-server-dev
-+static void qio_channel_tls_set_aio_fd_handler(QIOChannel *ioc,
+-      - libssh2-1-dev
-+                                               AioContext *ctx,
++      - libssh-dev
-+                                               IOHandler *io_read,
+       - liburcu-dev
-+                                               IOHandler *io_write,
+       - libusb-1.0-0-dev
-+                                               void *opaque)
+       - libvte-2.91-dev
-+{
+@@ -XXX,XX +XXX,XX @@ matrix:
-+    QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
+             - libseccomp-dev
-+
+             - libspice-protocol-dev
-+    qio_channel_set_aio_fd_handler(tioc->master, ctx, io_read, io_write, opaque);
+             - libspice-server-dev
-+}
+-            - libssh2-1-dev
-+
++            - libssh-dev
- static GSource *qio_channel_tls_create_watch(QIOChannel *ioc,
+             - liburcu-dev
-                                              GIOCondition condition)
+             - libusb-1.0-0-dev
- {
+             - libvte-2.91-dev
-@@ -XXX,XX +XXX,XX @@ static void qio_channel_tls_class_init(ObjectClass *klass,
+diff --git a/block/trace-events b/block/trace-events
      ioc_klass->io_close = qio_channel_tls_close;
      ioc_klass->io_shutdown = qio_channel_tls_shutdown;
      ioc_klass->io_create_watch = qio_channel_tls_create_watch;
 +    ioc_klass->io_set_aio_fd_handler = qio_channel_tls_set_aio_fd_handler;
  }
  static const TypeInfo qio_channel_tls_info = {
 diff --git a/io/channel-watch.c b/io/channel-watch.c
 index XXXXXXX..XXXXXXX 100644
---- a/io/channel-watch.c
+--- a/block/trace-events
-+++ b/io/channel-watch.c
++++ b/block/trace-events
-@@ -XXX,XX +XXX,XX @@ GSource *qio_channel_create_socket_watch(QIOChannel *ioc,
+@@ -XXX,XX +XXX,XX @@ nbd_client_connect_success(const char *export_name) "export '%s'"
-     GSource *source;
+ # ssh.c
-     QIOChannelSocketSource *ssource;
+ ssh_restart_coroutine(void *co) "co=%p"
+ ssh_flush(void) "fsync"
-+#ifdef WIN32
+-ssh_check_host_key_knownhosts(const char *key) "host key OK: %s"
-+    WSAEventSelect(socket, ioc->event,
++ssh_check_host_key_knownhosts(void) "host key OK"
-+                   FD_READ | FD_ACCEPT | FD_CLOSE |
+ ssh_connect_to_ssh(char *path, int flags, int mode) "opening file %s flags=0x%x creat_mode=0%o"
-+                   FD_CONNECT | FD_WRITE | FD_OOB);
+ ssh_co_yield(int sock, void *rd_handler, void *wr_handler) "s->sock=%d rd_handler=%p wr_handler=%p"
-+#endif
+ ssh_co_yield_back(int sock) "s->sock=%d - back"
-+
+ ssh_getlength(int64_t length) "length=%" PRIi64
-     source = g_source_new(&qio_channel_socket_source_funcs,
+ ssh_co_create_opts(uint64_t size) "total_size=%" PRIu64
-                           sizeof(QIOChannelSocketSource));
+ ssh_read(int64_t offset, size_t size) "offset=%" PRIi64 " size=%zu"
-     ssource = (QIOChannelSocketSource *)source;
+-ssh_read_buf(void *buf, size_t size) "sftp_read buf=%p size=%zu"
-diff --git a/io/channel.c b/io/channel.c
+-ssh_read_return(ssize_t ret) "sftp_read returned %zd"
 +ssh_read_buf(void *buf, size_t size, size_t actual_size) "sftp_read buf=%p size=%zu (actual size=%zu)"
 +ssh_read_return(ssize_t ret, int sftp_err) "sftp_read returned %zd (sftp error=%d)"
  ssh_write(int64_t offset, size_t size) "offset=%" PRIi64 " size=%zu"
 -ssh_write_buf(void *buf, size_t size) "sftp_write buf=%p size=%zu"
 -ssh_write_return(ssize_t ret) "sftp_write returned %zd"
 +ssh_write_buf(void *buf, size_t size, size_t actual_size) "sftp_write buf=%p size=%zu (actual size=%zu)"
 +ssh_write_return(ssize_t ret, int sftp_err) "sftp_write returned %zd (sftp error=%d)"
  ssh_seek(int64_t offset) "seeking to offset=%" PRIi64
 +ssh_auth_methods(int methods) "auth methods=0x%x"
 +ssh_server_status(int status) "server status=%d"
  # curl.c
  curl_timer_cb(long timeout_ms) "timer callback timeout_ms %ld"
@@ -XXX,XX +XXX,XX @@ sheepdog_snapshot_create(const char *sn_name, const char *id) "%s %s"
  sheepdog_snapshot_create_inode(const char *name, uint32_t snap, uint32_t vdi) "s->inode: name %s snap_id 0x%" PRIx32 " vdi 0x%" PRIx32
  # ssh.c
 -sftp_error(const char *op, const char *ssh_err, int ssh_err_code, unsigned long sftp_err_code) "%s failed: %s (libssh2 error code: %d, sftp error code: %lu)"
 +sftp_error(const char *op, const char *ssh_err, int ssh_err_code, int sftp_err_code) "%s failed: %s (libssh error code: %d, sftp error code: %d)"
 diff --git a/docs/qemu-block-drivers.texi b/docs/qemu-block-drivers.texi
 index XXXXXXX..XXXXXXX 100644
---- a/io/channel.c
+--- a/docs/qemu-block-drivers.texi
-+++ b/io/channel.c
++++ b/docs/qemu-block-drivers.texi
-@@ -XXX,XX +XXX,XX @@ GSource *qio_channel_create_watch(QIOChannel *ioc,
+@@ -XXX,XX +XXX,XX @@ print a warning when @code{fsync} is not supported:
- }
+ warning: ssh server @code{ssh.example.com:22} does not support fsync
-+void qio_channel_set_aio_fd_handler(QIOChannel *ioc,
+-With sufficiently new versions of libssh2 and OpenSSH, @code{fsync} is
-+                                    AioContext *ctx,
++With sufficiently new versions of libssh and OpenSSH, @code{fsync} is
-+                                    IOHandler *io_read,
+ supported.
-+                                    IOHandler *io_write,
-+                                    void *opaque)
+ @node disk_images_nvme
-+{
+diff --git a/tests/docker/dockerfiles/debian-win32-cross.docker b/tests/docker/dockerfiles/debian-win32-cross.docker
-+    QIOChannelClass *klass = QIO_CHANNEL_GET_CLASS(ioc);
+index XXXXXXX..XXXXXXX 100644
-+
+--- a/tests/docker/dockerfiles/debian-win32-cross.docker
-+    klass->io_set_aio_fd_handler(ioc, ctx, io_read, io_write, opaque);
++++ b/tests/docker/dockerfiles/debian-win32-cross.docker
-+}
+@@ -XXX,XX +XXX,XX @@ RUN DEBIAN_FRONTEND=noninteractive eatmydata \
-+
+         mxe-$TARGET-w64-mingw32.shared-curl \
- guint qio_channel_add_watch(QIOChannel *ioc,
+         mxe-$TARGET-w64-mingw32.shared-glib \
-                             GIOCondition condition,
+         mxe-$TARGET-w64-mingw32.shared-libgcrypt \
-                             QIOChannelFunc func,
+-        mxe-$TARGET-w64-mingw32.shared-libssh2 \
          mxe-$TARGET-w64-mingw32.shared-libusb1 \
          mxe-$TARGET-w64-mingw32.shared-lzo \
          mxe-$TARGET-w64-mingw32.shared-nettle \
 diff --git a/tests/docker/dockerfiles/debian-win64-cross.docker b/tests/docker/dockerfiles/debian-win64-cross.docker
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/docker/dockerfiles/debian-win64-cross.docker
 +++ b/tests/docker/dockerfiles/debian-win64-cross.docker
@@ -XXX,XX +XXX,XX @@ RUN DEBIAN_FRONTEND=noninteractive eatmydata \
          mxe-$TARGET-w64-mingw32.shared-curl \
          mxe-$TARGET-w64-mingw32.shared-glib \
          mxe-$TARGET-w64-mingw32.shared-libgcrypt \
 -        mxe-$TARGET-w64-mingw32.shared-libssh2 \
          mxe-$TARGET-w64-mingw32.shared-libusb1 \
          mxe-$TARGET-w64-mingw32.shared-lzo \
          mxe-$TARGET-w64-mingw32.shared-nettle \
 diff --git a/tests/docker/dockerfiles/fedora.docker b/tests/docker/dockerfiles/fedora.docker
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/docker/dockerfiles/fedora.docker
 +++ b/tests/docker/dockerfiles/fedora.docker
@@ -XXX,XX +XXX,XX @@ ENV PACKAGES \
      libpng-devel \
      librbd-devel \
      libseccomp-devel \
 -    libssh2-devel \
 +    libssh-devel \
      libubsan \
      libusbx-devel \
      libxml2-devel \
@@ -XXX,XX +XXX,XX @@ ENV PACKAGES \
      mingw32-gtk3 \
      mingw32-libjpeg-turbo \
      mingw32-libpng \
 -    mingw32-libssh2 \
      mingw32-libtasn1 \
      mingw32-nettle \
      mingw32-pixman \
@@ -XXX,XX +XXX,XX @@ ENV PACKAGES \
      mingw64-gtk3 \
      mingw64-libjpeg-turbo \
      mingw64-libpng \
 -    mingw64-libssh2 \
      mingw64-libtasn1 \
      mingw64-nettle \
      mingw64-pixman \
 diff --git a/tests/docker/dockerfiles/ubuntu.docker b/tests/docker/dockerfiles/ubuntu.docker
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/docker/dockerfiles/ubuntu.docker
 +++ b/tests/docker/dockerfiles/ubuntu.docker
@@ -XXX,XX +XXX,XX @@ ENV PACKAGES flex bison \
      libsnappy-dev \
      libspice-protocol-dev \
      libspice-server-dev \
 -    libssh2-1-dev \
 +    libssh-dev \
      libusb-1.0-0-dev \
      libusbredirhost-dev \
      libvdeplug-dev \
 diff --git a/tests/docker/dockerfiles/ubuntu1804.docker b/tests/docker/dockerfiles/ubuntu1804.docker
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/docker/dockerfiles/ubuntu1804.docker
 +++ b/tests/docker/dockerfiles/ubuntu1804.docker
@@ -XXX,XX +XXX,XX @@ ENV PACKAGES flex bison \
      libsnappy-dev \
      libspice-protocol-dev \
      libspice-server-dev \
 -    libssh2-1-dev \
 +    libssh-dev \
      libusb-1.0-0-dev \
      libusbredirhost-dev \
      libvdeplug-dev \
 diff --git a/tests/qemu-iotests/207 b/tests/qemu-iotests/207
 index XXXXXXX..XXXXXXX 100755
 --- a/tests/qemu-iotests/207
 +++ b/tests/qemu-iotests/207
@@ -XXX,XX +XXX,XX @@ with iotests.FilePath('t.img') as disk_path, \
      iotests.img_info_log(remote_path)
 -    md5_key = subprocess.check_output(
 -        'ssh-keyscan -t rsa 127.0.0.1 2>/dev/null | grep -v "\\^#" | ' +
 -        'cut -d" " -f3 | base64 -d | md5sum -b | cut -d" " -f1',
 -        shell=True).rstrip().decode('ascii')
 +    keys = subprocess.check_output(
 +        'ssh-keyscan 127.0.0.1 2>/dev/null | grep -v "\\^#" | ' +
 +        'cut -d" " -f3',
 +        shell=True).rstrip().decode('ascii').split('\n')
 +
 +    # Mappings of base64 representations to digests
 +    md5_keys = {}
 +    sha1_keys = {}
 +
 +    for key in keys:
 +        md5_keys[key] = subprocess.check_output(
 +            'echo %s | base64 -d | md5sum -b | cut -d" " -f1' % key,
 +            shell=True).rstrip().decode('ascii')
 +
 +        sha1_keys[key] = subprocess.check_output(
 +            'echo %s | base64 -d | sha1sum -b | cut -d" " -f1' % key,
 +            shell=True).rstrip().decode('ascii')
      vm.launch()
 +
 +    # Find correct key first
 +    matching_key = None
 +    for key in keys:
 +        result = vm.qmp('blockdev-add',
 +                        driver='ssh', node_name='node0', path=disk_path,
 +                        server={
 +                             'host': '127.0.0.1',
 +                             'port': '22',
 +                        }, host_key_check={
 +                             'mode': 'hash',
 +                             'type': 'md5',
 +                             'hash': md5_keys[key],
 +                        })
 +
 +        if 'error' not in result:
 +            vm.qmp('blockdev-del', node_name='node0')
 +            matching_key = key
 +            break
 +
 +    if matching_key is None:
 +        vm.shutdown()
 +        iotests.notrun('Did not find a key that fits 127.0.0.1')
 +
      blockdev_create(vm, { 'driver': 'ssh',
                            'location': {
                                'path': disk_path,
@@ -XXX,XX +XXX,XX @@ with iotests.FilePath('t.img') as disk_path, \
                                'host-key-check': {
                                    'mode': 'hash',
                                    'type': 'md5',
 -                                  'hash': md5_key,
 +                                  'hash': md5_keys[matching_key],
                                }
                            },
                            'size': 8388608 })
@@ -XXX,XX +XXX,XX @@ with iotests.FilePath('t.img') as disk_path, \
      iotests.img_info_log(remote_path)
 -    sha1_key = subprocess.check_output(
 -        'ssh-keyscan -t rsa 127.0.0.1 2>/dev/null | grep -v "\\^#" | ' +
 -        'cut -d" " -f3 | base64 -d | sha1sum -b | cut -d" " -f1',
 -        shell=True).rstrip().decode('ascii')
 -
      vm.launch()
      blockdev_create(vm, { 'driver': 'ssh',
                            'location': {
@@ -XXX,XX +XXX,XX @@ with iotests.FilePath('t.img') as disk_path, \
                                'host-key-check': {
                                    'mode': 'hash',
                                    'type': 'sha1',
 -                                  'hash': sha1_key,
 +                                  'hash': sha1_keys[matching_key],
                                }
                            },
                            'size': 4194304 })
 diff --git a/tests/qemu-iotests/207.out b/tests/qemu-iotests/207.out
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/qemu-iotests/207.out
 +++ b/tests/qemu-iotests/207.out
@@ -XXX,XX +XXX,XX @@ virtual size: 4 MiB (4194304 bytes)
  {"execute": "blockdev-create", "arguments": {"job-id": "job0", "options": {"driver": "ssh", "location": {"host-key-check": {"mode": "none"}, "path": "/this/is/not/an/existing/path", "server": {"host": "127.0.0.1", "port": "22"}}, "size": 4194304}}}
  {"return": {}}
 -Job failed: failed to open remote file '/this/is/not/an/existing/path': Failed opening remote file (libssh2 error code: -31)
 +Job failed: failed to open remote file '/this/is/not/an/existing/path': SFTP server: No such file (libssh error code: 1, sftp error code: 2)
  {"execute": "job-dismiss", "arguments": {"id": "job0"}}
  {"return": {}}
 --
-.9.3
+.21.0

-[Qemu-devel] [PULL v2 06/24] io: make qio_channel_yield aware of AioContexts
+Deleted patch
-From: Paolo Bonzini <pbonzini@redhat.com>
-Support separate coroutines for reading and writing, and place the
-read/write handlers on the AioContext that the QIOChannel is registered
-with.
-Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Reviewed-by: Fam Zheng <famz@redhat.com>
-Message-id: 20170213135235.12274-7-pbonzini@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- include/io/channel.h | 47 ++++++++++++++++++++++++++--
- io/channel.c         | 86 +++++++++++++++++++++++++++++++++++++++-------------
-files changed, 109 insertions(+), 24 deletions(-)
-diff --git a/include/io/channel.h b/include/io/channel.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/io/channel.h
-+++ b/include/io/channel.h
-@@ -XXX,XX +XXX,XX @@
- #include "qemu-common.h"
- #include "qom/object.h"
-+#include "qemu/coroutine.h"
- #include "block/aio.h"
- #define TYPE_QIO_CHANNEL "qio-channel"
-@@ -XXX,XX +XXX,XX @@ struct QIOChannel {
-     Object parent;
-     unsigned int features; /* bitmask of QIOChannelFeatures */
-     char *name;
-+    AioContext *ctx;
-+    Coroutine *read_coroutine;
-+    Coroutine *write_coroutine;
- #ifdef _WIN32
-     HANDLE event; /* For use with GSource on Win32 */
- #endif
-@@ -XXX,XX +XXX,XX @@ guint qio_channel_add_watch(QIOChannel *ioc,
- /**
-+ * qio_channel_attach_aio_context:
-+ * @ioc: the channel object
-+ * @ctx: the #AioContext to set the handlers on
-+ *
-+ * Request that qio_channel_yield() sets I/O handlers on
-+ * the given #AioContext.  If @ctx is %NULL, qio_channel_yield()
-+ * uses QEMU's main thread event loop.
-+ *
-+ * You can move a #QIOChannel from one #AioContext to another even if
-+ * I/O handlers are set for a coroutine.  However, #QIOChannel provides
-+ * no synchronization between the calls to qio_channel_yield() and
-+ * qio_channel_attach_aio_context().
-+ *
-+ * Therefore you should first call qio_channel_detach_aio_context()
-+ * to ensure that the coroutine is not entered concurrently.  Then,
-+ * while the coroutine has yielded, call qio_channel_attach_aio_context(),
-+ * and then aio_co_schedule() to place the coroutine on the new
-+ * #AioContext.  The calls to qio_channel_detach_aio_context()
-+ * and qio_channel_attach_aio_context() should be protected with
-+ * aio_context_acquire() and aio_context_release().
-+ */
-+void qio_channel_attach_aio_context(QIOChannel *ioc,
-+                                    AioContext *ctx);
-+
-+/**
-+ * qio_channel_detach_aio_context:
-+ * @ioc: the channel object
-+ *
-+ * Disable any I/O handlers set by qio_channel_yield().  With the
-+ * help of aio_co_schedule(), this allows moving a coroutine that was
-+ * paused by qio_channel_yield() to another context.
-+ */
-+void qio_channel_detach_aio_context(QIOChannel *ioc);
-+
-+/**
-  * qio_channel_yield:
-  * @ioc: the channel object
-  * @condition: the I/O condition to wait for
-  *
-- * Yields execution from the current coroutine until
-- * the condition indicated by @condition becomes
-- * available.
-+ * Yields execution from the current coroutine until the condition
-+ * indicated by @condition becomes available.  @condition must
-+ * be either %G_IO_IN or %G_IO_OUT; it cannot contain both.  In
-+ * addition, no two coroutine can be waiting on the same condition
-+ * and channel at the same time.
-  *
-  * This must only be called from coroutine context
-  */
-diff --git a/io/channel.c b/io/channel.c
-index XXXXXXX..XXXXXXX 100644
---- a/io/channel.c
-+++ b/io/channel.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/osdep.h"
- #include "io/channel.h"
- #include "qapi/error.h"
--#include "qemu/coroutine.h"
-+#include "qemu/main-loop.h"
- bool qio_channel_has_feature(QIOChannel *ioc,
-                              QIOChannelFeature feature)
-@@ -XXX,XX +XXX,XX @@ off_t qio_channel_io_seek(QIOChannel *ioc,
- }
--typedef struct QIOChannelYieldData QIOChannelYieldData;
--struct QIOChannelYieldData {
--    QIOChannel *ioc;
--    Coroutine *co;
--};
-+static void qio_channel_set_aio_fd_handlers(QIOChannel *ioc);
-+static void qio_channel_restart_read(void *opaque)
-+{
-+    QIOChannel *ioc = opaque;
-+    Coroutine *co = ioc->read_coroutine;
-+
-+    ioc->read_coroutine = NULL;
-+    qio_channel_set_aio_fd_handlers(ioc);
-+    aio_co_wake(co);
-+}
--static gboolean qio_channel_yield_enter(QIOChannel *ioc,
--                                        GIOCondition condition,
--                                        gpointer opaque)
-+static void qio_channel_restart_write(void *opaque)
- {
--    QIOChannelYieldData *data = opaque;
--    qemu_coroutine_enter(data->co);
--    return FALSE;
-+    QIOChannel *ioc = opaque;
-+    Coroutine *co = ioc->write_coroutine;
-+
-+    ioc->write_coroutine = NULL;
-+    qio_channel_set_aio_fd_handlers(ioc);
-+    aio_co_wake(co);
- }
-+static void qio_channel_set_aio_fd_handlers(QIOChannel *ioc)
-+{
-+    IOHandler *rd_handler = NULL, *wr_handler = NULL;
-+    AioContext *ctx;
-+
-+    if (ioc->read_coroutine) {
-+        rd_handler = qio_channel_restart_read;
-+    }
-+    if (ioc->write_coroutine) {
-+        wr_handler = qio_channel_restart_write;
-+    }
-+
-+    ctx = ioc->ctx ? ioc->ctx : iohandler_get_aio_context();
-+    qio_channel_set_aio_fd_handler(ioc, ctx, rd_handler, wr_handler, ioc);
-+}
-+
-+void qio_channel_attach_aio_context(QIOChannel *ioc,
-+                                    AioContext *ctx)
-+{
-+    AioContext *old_ctx;
-+    if (ioc->ctx == ctx) {
-+        return;
-+    }
-+
-+    old_ctx = ioc->ctx ? ioc->ctx : iohandler_get_aio_context();
-+    qio_channel_set_aio_fd_handler(ioc, old_ctx, NULL, NULL, NULL);
-+    ioc->ctx = ctx;
-+    qio_channel_set_aio_fd_handlers(ioc);
-+}
-+
-+void qio_channel_detach_aio_context(QIOChannel *ioc)
-+{
-+    ioc->read_coroutine = NULL;
-+    ioc->write_coroutine = NULL;
-+    qio_channel_set_aio_fd_handlers(ioc);
-+    ioc->ctx = NULL;
-+}
- void coroutine_fn qio_channel_yield(QIOChannel *ioc,
-                                     GIOCondition condition)
- {
--    QIOChannelYieldData data;
--
-     assert(qemu_in_coroutine());
--    data.ioc = ioc;
--    data.co = qemu_coroutine_self();
--    qio_channel_add_watch(ioc,
--                          condition,
--                          qio_channel_yield_enter,
--                          &data,
--                          NULL);
-+    if (condition == G_IO_IN) {
-+        assert(!ioc->read_coroutine);
-+        ioc->read_coroutine = qemu_coroutine_self();
-+    } else if (condition == G_IO_OUT) {
-+        assert(!ioc->write_coroutine);
-+        ioc->write_coroutine = qemu_coroutine_self();
-+    } else {
-+        abort();
-+    }
-+    qio_channel_set_aio_fd_handlers(ioc);
-     qemu_coroutine_yield();
- }
---
-.9.3

-[Qemu-devel] [PULL v2 08/24] coroutine-lock: reschedule coroutine on the AioContext it was running on
+Deleted patch
-From: Paolo Bonzini <pbonzini@redhat.com>
-As a small step towards the introduction of multiqueue, we want
-coroutines to remain on the same AioContext that started them,
-unless they are moved explicitly with e.g. aio_co_schedule.  This patch
-avoids that coroutines switch AioContext when they use a CoMutex.
-For now it does not make much of a difference, because the CoMutex
-is not thread-safe and the AioContext itself is used to protect the
-CoMutex from concurrent access.  However, this is going to change.
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Reviewed-by: Fam Zheng <famz@redhat.com>
-Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
-Message-id: 20170213135235.12274-9-pbonzini@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- util/qemu-coroutine-lock.c | 5 ++---
- util/trace-events          | 1 -
-files changed, 2 insertions(+), 4 deletions(-)
-diff --git a/util/qemu-coroutine-lock.c b/util/qemu-coroutine-lock.c
-index XXXXXXX..XXXXXXX 100644
---- a/util/qemu-coroutine-lock.c
-+++ b/util/qemu-coroutine-lock.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/coroutine.h"
- #include "qemu/coroutine_int.h"
- #include "qemu/queue.h"
-+#include "block/aio.h"
- #include "trace.h"
- void qemu_co_queue_init(CoQueue *queue)
-@@ -XXX,XX +XXX,XX @@ void qemu_co_queue_run_restart(Coroutine *co)
- static bool qemu_co_queue_do_restart(CoQueue *queue, bool single)
- {
--    Coroutine *self = qemu_coroutine_self();
-     Coroutine *next;
-     if (QSIMPLEQ_EMPTY(&queue->entries)) {
-@@ -XXX,XX +XXX,XX @@ static bool qemu_co_queue_do_restart(CoQueue *queue, bool single)
-     while ((next = QSIMPLEQ_FIRST(&queue->entries)) != NULL) {
-         QSIMPLEQ_REMOVE_HEAD(&queue->entries, co_queue_next);
--        QSIMPLEQ_INSERT_TAIL(&self->co_queue_wakeup, next, co_queue_next);
--        trace_qemu_co_queue_next(next);
-+        aio_co_wake(next);
-         if (single) {
-             break;
-         }
-diff --git a/util/trace-events b/util/trace-events
-index XXXXXXX..XXXXXXX 100644
---- a/util/trace-events
-+++ b/util/trace-events
-@@ -XXX,XX +XXX,XX @@ qemu_coroutine_terminate(void *co) "self %p"
- # util/qemu-coroutine-lock.c
- qemu_co_queue_run_restart(void *co) "co %p"
--qemu_co_queue_next(void *nxt) "next %p"
- qemu_co_mutex_lock_entry(void *mutex, void *self) "mutex %p self %p"
- qemu_co_mutex_lock_return(void *mutex, void *self) "mutex %p self %p"
- qemu_co_mutex_unlock_entry(void *mutex, void *self) "mutex %p self %p"
---
-.9.3

-[Qemu-devel] [PULL v2 09/24] blkdebug: reschedule coroutine on the AioContext it is running on
+Deleted patch
-From: Paolo Bonzini <pbonzini@redhat.com>
-Keep the coroutine on the same AioContext.  Without this change,
-there would be a race between yielding the coroutine and reentering it.
-While the race cannot happen now, because the code only runs from a single
-AioContext, this will change with multiqueue support in the block layer.
-While doing the change, replace custom bottom half with aio_co_schedule.
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Reviewed-by: Fam Zheng <famz@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
-Message-id: 20170213135235.12274-10-pbonzini@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- block/blkdebug.c | 9 +--------
-file changed, 1 insertion(+), 8 deletions(-)
-diff --git a/block/blkdebug.c b/block/blkdebug.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/blkdebug.c
-+++ b/block/blkdebug.c
-@@ -XXX,XX +XXX,XX @@ out:
-     return ret;
- }
--static void error_callback_bh(void *opaque)
--{
--    Coroutine *co = opaque;
--    qemu_coroutine_enter(co);
--}
--
- static int inject_error(BlockDriverState *bs, BlkdebugRule *rule)
- {
-     BDRVBlkdebugState *s = bs->opaque;
-@@ -XXX,XX +XXX,XX @@ static int inject_error(BlockDriverState *bs, BlkdebugRule *rule)
-     }
-     if (!immediately) {
--        aio_bh_schedule_oneshot(bdrv_get_aio_context(bs), error_callback_bh,
--                                qemu_coroutine_self());
-+        aio_co_schedule(qemu_get_current_aio_context(), qemu_coroutine_self());
-         qemu_coroutine_yield();
-     }
---
-.9.3

-[Qemu-devel] [PULL v2 10/24] qed: introduce qed_aio_start_io and qed_aio_next_io_cb
+Deleted patch
-From: Paolo Bonzini <pbonzini@redhat.com>
-qed_aio_start_io and qed_aio_next_io will not have to acquire/release
-the AioContext, while qed_aio_next_io_cb will.  Split the functionality
-and gain a little type-safety in the process.
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Reviewed-by: Fam Zheng <famz@redhat.com>
-Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
-Message-id: 20170213135235.12274-11-pbonzini@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- block/qed.c | 39 +++++++++++++++++++++++++--------------
-file changed, 25 insertions(+), 14 deletions(-)
-diff --git a/block/qed.c b/block/qed.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/qed.c
-+++ b/block/qed.c
-@@ -XXX,XX +XXX,XX @@ static CachedL2Table *qed_new_l2_table(BDRVQEDState *s)
-     return l2_table;
- }
--static void qed_aio_next_io(void *opaque, int ret);
-+static void qed_aio_next_io(QEDAIOCB *acb, int ret);
-+
-+static void qed_aio_start_io(QEDAIOCB *acb)
-+{
-+    qed_aio_next_io(acb, 0);
-+}
-+
-+static void qed_aio_next_io_cb(void *opaque, int ret)
-+{
-+    QEDAIOCB *acb = opaque;
-+
-+    qed_aio_next_io(acb, ret);
-+}
- static void qed_plug_allocating_write_reqs(BDRVQEDState *s)
- {
-@@ -XXX,XX +XXX,XX @@ static void qed_unplug_allocating_write_reqs(BDRVQEDState *s)
-     acb = QSIMPLEQ_FIRST(&s->allocating_write_reqs);
-     if (acb) {
--        qed_aio_next_io(acb, 0);
-+        qed_aio_start_io(acb);
-     }
- }
-@@ -XXX,XX +XXX,XX @@ static void qed_aio_complete(QEDAIOCB *acb, int ret)
-         QSIMPLEQ_REMOVE_HEAD(&s->allocating_write_reqs, next);
-         acb = QSIMPLEQ_FIRST(&s->allocating_write_reqs);
-         if (acb) {
--            qed_aio_next_io(acb, 0);
-+            qed_aio_start_io(acb);
-         } else if (s->header.features & QED_F_NEED_CHECK) {
-             qed_start_need_check_timer(s);
-         }
-@@ -XXX,XX +XXX,XX @@ static void qed_commit_l2_update(void *opaque, int ret)
-     acb->request.l2_table = qed_find_l2_cache_entry(&s->l2_cache, l2_offset);
-     assert(acb->request.l2_table != NULL);
--    qed_aio_next_io(opaque, ret);
-+    qed_aio_next_io(acb, ret);
- }
- /**
-@@ -XXX,XX +XXX,XX @@ static void qed_aio_write_l2_update(QEDAIOCB *acb, int ret, uint64_t offset)
-     if (need_alloc) {
-         /* Write out the whole new L2 table */
-         qed_write_l2_table(s, &acb->request, 0, s->table_nelems, true,
--                            qed_aio_write_l1_update, acb);
-+                           qed_aio_write_l1_update, acb);
-     } else {
-         /* Write out only the updated part of the L2 table */
-         qed_write_l2_table(s, &acb->request, index, acb->cur_nclusters, false,
--                            qed_aio_next_io, acb);
-+                           qed_aio_next_io_cb, acb);
-     }
-     return;
-@@ -XXX,XX +XXX,XX @@ static void qed_aio_write_main(void *opaque, int ret)
-     }
-     if (acb->find_cluster_ret == QED_CLUSTER_FOUND) {
--        next_fn = qed_aio_next_io;
-+        next_fn = qed_aio_next_io_cb;
-     } else {
-         if (s->bs->backing) {
-             next_fn = qed_aio_write_flush_before_l2_update;
-@@ -XXX,XX +XXX,XX @@ static void qed_aio_write_alloc(QEDAIOCB *acb, size_t len)
-     if (acb->flags & QED_AIOCB_ZERO) {
-         /* Skip ahead if the clusters are already zero */
-         if (acb->find_cluster_ret == QED_CLUSTER_ZERO) {
--            qed_aio_next_io(acb, 0);
-+            qed_aio_start_io(acb);
-             return;
-         }
-@@ -XXX,XX +XXX,XX @@ static void qed_aio_read_data(void *opaque, int ret,
-     /* Handle zero cluster and backing file reads */
-     if (ret == QED_CLUSTER_ZERO) {
-         qemu_iovec_memset(&acb->cur_qiov, 0, 0, acb->cur_qiov.size);
--        qed_aio_next_io(acb, 0);
-+        qed_aio_start_io(acb);
-         return;
-     } else if (ret != QED_CLUSTER_FOUND) {
-         qed_read_backing_file(s, acb->cur_pos, &acb->cur_qiov,
--                              &acb->backing_qiov, qed_aio_next_io, acb);
-+                              &acb->backing_qiov, qed_aio_next_io_cb, acb);
-         return;
-     }
-     BLKDBG_EVENT(bs->file, BLKDBG_READ_AIO);
-     bdrv_aio_readv(bs->file, offset / BDRV_SECTOR_SIZE,
-                    &acb->cur_qiov, acb->cur_qiov.size / BDRV_SECTOR_SIZE,
--                   qed_aio_next_io, acb);
-+                   qed_aio_next_io_cb, acb);
-     return;
- err:
-@@ -XXX,XX +XXX,XX @@ err:
- /**
-  * Begin next I/O or complete the request
-  */
--static void qed_aio_next_io(void *opaque, int ret)
-+static void qed_aio_next_io(QEDAIOCB *acb, int ret)
- {
--    QEDAIOCB *acb = opaque;
-     BDRVQEDState *s = acb_to_s(acb);
-     QEDFindClusterFunc *io_fn = (acb->flags & QED_AIOCB_WRITE) ?
-                                 qed_aio_write_data : qed_aio_read_data;
-@@ -XXX,XX +XXX,XX @@ static BlockAIOCB *qed_aio_setup(BlockDriverState *bs,
-     qemu_iovec_init(&acb->cur_qiov, qiov->niov);
-     /* Start request */
--    qed_aio_next_io(acb, 0);
-+    qed_aio_start_io(acb);
-     return &acb->common;
- }
---
-.9.3

-[Qemu-devel] [PULL v2 11/24] aio: push aio_context_acquire/release down to dispatching
+Deleted patch
-From: Paolo Bonzini <pbonzini@redhat.com>
-The AioContext data structures are now protected by list_lock and/or
-they are walked with FOREACH_RCU primitives.  There is no need anymore
-to acquire the AioContext for the entire duration of aio_dispatch.
-Instead, just acquire it before and after invoking the callbacks.
-The next step is then to push it further down.
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Reviewed-by: Fam Zheng <famz@redhat.com>
-Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
-Message-id: 20170213135235.12274-12-pbonzini@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- util/aio-posix.c | 25 +++++++++++--------------
- util/aio-win32.c | 15 +++++++--------
- util/async.c     |  2 ++
-files changed, 20 insertions(+), 22 deletions(-)
-diff --git a/util/aio-posix.c b/util/aio-posix.c
-index XXXXXXX..XXXXXXX 100644
---- a/util/aio-posix.c
-+++ b/util/aio-posix.c
-@@ -XXX,XX +XXX,XX @@ static bool aio_dispatch_handlers(AioContext *ctx)
-             (revents & (G_IO_IN | G_IO_HUP | G_IO_ERR)) &&
-             aio_node_check(ctx, node->is_external) &&
-             node->io_read) {
-+            aio_context_acquire(ctx);
-             node->io_read(node->opaque);
-+            aio_context_release(ctx);
-             /* aio_notify() does not count as progress */
-             if (node->opaque != &ctx->notifier) {
-@@ -XXX,XX +XXX,XX @@ static bool aio_dispatch_handlers(AioContext *ctx)
-             (revents & (G_IO_OUT | G_IO_ERR)) &&
-             aio_node_check(ctx, node->is_external) &&
-             node->io_write) {
-+            aio_context_acquire(ctx);
-             node->io_write(node->opaque);
-+            aio_context_release(ctx);
-             progress = true;
-         }
-@@ -XXX,XX +XXX,XX @@ bool aio_dispatch(AioContext *ctx, bool dispatch_fds)
-     }
-     /* Run our timers */
-+    aio_context_acquire(ctx);
-     progress |= timerlistgroup_run_timers(&ctx->tlg);
-+    aio_context_release(ctx);
-     return progress;
- }
-@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
-     int64_t timeout;
-     int64_t start = 0;
--    aio_context_acquire(ctx);
--    progress = false;
--
-     /* aio_notify can avoid the expensive event_notifier_set if
-      * everything (file descriptors, bottom halves, timers) will
-      * be re-evaluated before the next blocking poll().  This is
-@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
-         start = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);
-     }
--    if (try_poll_mode(ctx, blocking)) {
--        progress = true;
--    } else {
-+    aio_context_acquire(ctx);
-+    progress = try_poll_mode(ctx, blocking);
-+    aio_context_release(ctx);
-+
-+    if (!progress) {
-         assert(npfd == 0);
-         /* fill pollfds */
-@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
-         timeout = blocking ? aio_compute_timeout(ctx) : 0;
-         /* wait until next event */
--        if (timeout) {
--            aio_context_release(ctx);
--        }
-         if (aio_epoll_check_poll(ctx, pollfds, npfd, timeout)) {
-             AioHandler epoll_handler;
-@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
-         } else  {
-             ret = qemu_poll_ns(pollfds, npfd, timeout);
-         }
--        if (timeout) {
--            aio_context_acquire(ctx);
--        }
-     }
-     if (blocking) {
-@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
-         progress = true;
-     }
--    aio_context_release(ctx);
--
-     return progress;
- }
-diff --git a/util/aio-win32.c b/util/aio-win32.c
-index XXXXXXX..XXXXXXX 100644
---- a/util/aio-win32.c
-+++ b/util/aio-win32.c
-@@ -XXX,XX +XXX,XX @@ static bool aio_dispatch_handlers(AioContext *ctx, HANDLE event)
-             (revents || event_notifier_get_handle(node->e) == event) &&
-             node->io_notify) {
-             node->pfd.revents = 0;
-+            aio_context_acquire(ctx);
-             node->io_notify(node->e);
-+            aio_context_release(ctx);
-             /* aio_notify() does not count as progress */
-             if (node->e != &ctx->notifier) {
-@@ -XXX,XX +XXX,XX @@ static bool aio_dispatch_handlers(AioContext *ctx, HANDLE event)
-             (node->io_read || node->io_write)) {
-             node->pfd.revents = 0;
-             if ((revents & G_IO_IN) && node->io_read) {
-+                aio_context_acquire(ctx);
-                 node->io_read(node->opaque);
-+                aio_context_release(ctx);
-                 progress = true;
-             }
-             if ((revents & G_IO_OUT) && node->io_write) {
-+                aio_context_acquire(ctx);
-                 node->io_write(node->opaque);
-+                aio_context_release(ctx);
-                 progress = true;
-             }
-@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
-     int count;
-     int timeout;
--    aio_context_acquire(ctx);
-     progress = false;
-     /* aio_notify can avoid the expensive event_notifier_set if
-@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
-         timeout = blocking && !have_select_revents
-             ? qemu_timeout_ns_to_ms(aio_compute_timeout(ctx)) : 0;
--        if (timeout) {
--            aio_context_release(ctx);
--        }
-         ret = WaitForMultipleObjects(count, events, FALSE, timeout);
-         if (blocking) {
-             assert(first);
-             atomic_sub(&ctx->notify_me, 2);
-         }
--        if (timeout) {
--            aio_context_acquire(ctx);
--        }
-         if (first) {
-             aio_notify_accept(ctx);
-@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
-         progress |= aio_dispatch_handlers(ctx, event);
-     } while (count > 0);
-+    aio_context_acquire(ctx);
-     progress |= timerlistgroup_run_timers(&ctx->tlg);
--
-     aio_context_release(ctx);
-     return progress;
- }
-diff --git a/util/async.c b/util/async.c
-index XXXXXXX..XXXXXXX 100644
---- a/util/async.c
-+++ b/util/async.c
-@@ -XXX,XX +XXX,XX @@ int aio_bh_poll(AioContext *ctx)
-                 ret = 1;
-             }
-             bh->idle = 0;
-+            aio_context_acquire(ctx);
-             aio_bh_call(bh);
-+            aio_context_release(ctx);
-         }
-         if (bh->deleted) {
-             deleted = true;
---
-.9.3

-[Qemu-devel] [PULL v2 12/24] block: explicitly acquire aiocontext in timers that need it
+Deleted patch
-From: Paolo Bonzini <pbonzini@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Reviewed-by: Fam Zheng <famz@redhat.com>
-Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
-Message-id: 20170213135235.12274-13-pbonzini@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- block/qed.h                 |  3 +++
- block/curl.c                |  2 ++
- block/io.c                  |  5 +++++
- block/iscsi.c               |  8 ++++++--
- block/null.c                |  4 ++++
- block/qed.c                 | 12 ++++++++++++
- block/throttle-groups.c     |  2 ++
- util/aio-posix.c            |  2 --
- util/aio-win32.c            |  2 --
- util/qemu-coroutine-sleep.c |  2 +-
-files changed, 35 insertions(+), 7 deletions(-)
-diff --git a/block/qed.h b/block/qed.h
-index XXXXXXX..XXXXXXX 100644
---- a/block/qed.h
-+++ b/block/qed.h
-@@ -XXX,XX +XXX,XX @@ enum {
-  */
- typedef void QEDFindClusterFunc(void *opaque, int ret, uint64_t offset, size_t len);
-+void qed_acquire(BDRVQEDState *s);
-+void qed_release(BDRVQEDState *s);
-+
- /**
-  * Generic callback for chaining async callbacks
-  */
-diff --git a/block/curl.c b/block/curl.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/curl.c
-+++ b/block/curl.c
-@@ -XXX,XX +XXX,XX @@ static void curl_multi_timeout_do(void *arg)
-         return;
-     }
-+    aio_context_acquire(s->aio_context);
-     curl_multi_socket_action(s->multi, CURL_SOCKET_TIMEOUT, 0, &running);
-     curl_multi_check_completion(s);
-+    aio_context_release(s->aio_context);
- #else
-     abort();
- #endif
-diff --git a/block/io.c b/block/io.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/io.c
-+++ b/block/io.c
-@@ -XXX,XX +XXX,XX @@ void bdrv_aio_cancel(BlockAIOCB *acb)
-         if (acb->aiocb_info->get_aio_context) {
-             aio_poll(acb->aiocb_info->get_aio_context(acb), true);
-         } else if (acb->bs) {
-+            /* qemu_aio_ref and qemu_aio_unref are not thread-safe, so
-+             * assert that we're not using an I/O thread.  Thread-safe
-+             * code should use bdrv_aio_cancel_async exclusively.
-+             */
-+            assert(bdrv_get_aio_context(acb->bs) == qemu_get_aio_context());
-             aio_poll(bdrv_get_aio_context(acb->bs), true);
-         } else {
-             abort();
-diff --git a/block/iscsi.c b/block/iscsi.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/iscsi.c
-+++ b/block/iscsi.c
-@@ -XXX,XX +XXX,XX @@ static void iscsi_retry_timer_expired(void *opaque)
-     struct IscsiTask *iTask = opaque;
-     iTask->complete = 1;
-     if (iTask->co) {
--        qemu_coroutine_enter(iTask->co);
-+        aio_co_wake(iTask->co);
-     }
- }
-@@ -XXX,XX +XXX,XX @@ static void iscsi_nop_timed_event(void *opaque)
- {
-     IscsiLun *iscsilun = opaque;
-+    aio_context_acquire(iscsilun->aio_context);
-     if (iscsi_get_nops_in_flight(iscsilun->iscsi) >= MAX_NOP_FAILURES) {
-         error_report("iSCSI: NOP timeout. Reconnecting...");
-         iscsilun->request_timed_out = true;
-     } else if (iscsi_nop_out_async(iscsilun->iscsi, NULL, NULL, 0, NULL) != 0) {
-         error_report("iSCSI: failed to sent NOP-Out. Disabling NOP messages.");
--        return;
-+        goto out;
-     }
-     timer_mod(iscsilun->nop_timer, qemu_clock_get_ms(QEMU_CLOCK_REALTIME) + NOP_INTERVAL);
-     iscsi_set_events(iscsilun);
-+
-+out:
-+    aio_context_release(iscsilun->aio_context);
- }
- static void iscsi_readcapacity_sync(IscsiLun *iscsilun, Error **errp)
-diff --git a/block/null.c b/block/null.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/null.c
-+++ b/block/null.c
-@@ -XXX,XX +XXX,XX @@ static void null_bh_cb(void *opaque)
- static void null_timer_cb(void *opaque)
- {
-     NullAIOCB *acb = opaque;
-+    AioContext *ctx = bdrv_get_aio_context(acb->common.bs);
-+
-+    aio_context_acquire(ctx);
-     acb->common.cb(acb->common.opaque, 0);
-+    aio_context_release(ctx);
-     timer_deinit(&acb->timer);
-     qemu_aio_unref(acb);
- }
-diff --git a/block/qed.c b/block/qed.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/qed.c
-+++ b/block/qed.c
-@@ -XXX,XX +XXX,XX @@ static void qed_need_check_timer_cb(void *opaque)
-     trace_qed_need_check_timer_cb(s);
-+    qed_acquire(s);
-     qed_plug_allocating_write_reqs(s);
-     /* Ensure writes are on disk before clearing flag */
-     bdrv_aio_flush(s->bs->file->bs, qed_clear_need_check, s);
-+    qed_release(s);
-+}
-+
-+void qed_acquire(BDRVQEDState *s)
-+{
-+    aio_context_acquire(bdrv_get_aio_context(s->bs));
-+}
-+
-+void qed_release(BDRVQEDState *s)
-+{
-+    aio_context_release(bdrv_get_aio_context(s->bs));
- }
- static void qed_start_need_check_timer(BDRVQEDState *s)
-diff --git a/block/throttle-groups.c b/block/throttle-groups.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/throttle-groups.c
-+++ b/block/throttle-groups.c
-@@ -XXX,XX +XXX,XX @@ static void timer_cb(BlockBackend *blk, bool is_write)
-     qemu_mutex_unlock(&tg->lock);
-     /* Run the request that was waiting for this timer */
-+    aio_context_acquire(blk_get_aio_context(blk));
-     empty_queue = !qemu_co_enter_next(&blkp->throttled_reqs[is_write]);
-+    aio_context_release(blk_get_aio_context(blk));
-     /* If the request queue was empty then we have to take care of
-      * scheduling the next one */
-diff --git a/util/aio-posix.c b/util/aio-posix.c
-index XXXXXXX..XXXXXXX 100644
---- a/util/aio-posix.c
-+++ b/util/aio-posix.c
-@@ -XXX,XX +XXX,XX @@ bool aio_dispatch(AioContext *ctx, bool dispatch_fds)
-     }
-     /* Run our timers */
--    aio_context_acquire(ctx);
-     progress |= timerlistgroup_run_timers(&ctx->tlg);
--    aio_context_release(ctx);
-     return progress;
- }
-diff --git a/util/aio-win32.c b/util/aio-win32.c
-index XXXXXXX..XXXXXXX 100644
---- a/util/aio-win32.c
-+++ b/util/aio-win32.c
-@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
-         progress |= aio_dispatch_handlers(ctx, event);
-     } while (count > 0);
--    aio_context_acquire(ctx);
-     progress |= timerlistgroup_run_timers(&ctx->tlg);
--    aio_context_release(ctx);
-     return progress;
- }
-diff --git a/util/qemu-coroutine-sleep.c b/util/qemu-coroutine-sleep.c
-index XXXXXXX..XXXXXXX 100644
---- a/util/qemu-coroutine-sleep.c
-+++ b/util/qemu-coroutine-sleep.c
-@@ -XXX,XX +XXX,XX @@ static void co_sleep_cb(void *opaque)
- {
-     CoSleepCB *sleep_cb = opaque;
--    qemu_coroutine_enter(sleep_cb->co);
-+    aio_co_wake(sleep_cb->co);
- }
- void coroutine_fn co_aio_sleep_ns(AioContext *ctx, QEMUClockType type,
---
-.9.3

-[Qemu-devel] [PULL v2 13/24] block: explicitly acquire aiocontext in callbacks that need it
+Deleted patch
-From: Paolo Bonzini <pbonzini@redhat.com>
-This covers both file descriptor callbacks and polling callbacks,
-since they execute related code.
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Reviewed-by: Fam Zheng <famz@redhat.com>
-Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
-Message-id: 20170213135235.12274-14-pbonzini@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- block/curl.c          | 16 +++++++++++++---
- block/iscsi.c         |  4 ++++
- block/linux-aio.c     |  4 ++++
- block/nfs.c           |  6 ++++++
- block/sheepdog.c      | 29 +++++++++++++++--------------
- block/ssh.c           | 29 +++++++++--------------------
- block/win32-aio.c     | 10 ++++++----
- hw/block/virtio-blk.c |  5 ++++-
- hw/scsi/virtio-scsi.c |  7 +++++++
- util/aio-posix.c      |  7 -------
- util/aio-win32.c      |  6 ------
-files changed, 68 insertions(+), 55 deletions(-)
-diff --git a/block/curl.c b/block/curl.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/curl.c
-+++ b/block/curl.c
-@@ -XXX,XX +XXX,XX @@ static void curl_multi_check_completion(BDRVCURLState *s)
-     }
- }
--static void curl_multi_do(void *arg)
-+static void curl_multi_do_locked(CURLState *s)
- {
--    CURLState *s = (CURLState *)arg;
-     CURLSocket *socket, *next_socket;
-     int running;
-     int r;
-@@ -XXX,XX +XXX,XX @@ static void curl_multi_do(void *arg)
-     }
- }
-+static void curl_multi_do(void *arg)
-+{
-+    CURLState *s = (CURLState *)arg;
-+
-+    aio_context_acquire(s->s->aio_context);
-+    curl_multi_do_locked(s);
-+    aio_context_release(s->s->aio_context);
-+}
-+
- static void curl_multi_read(void *arg)
- {
-     CURLState *s = (CURLState *)arg;
--    curl_multi_do(arg);
-+    aio_context_acquire(s->s->aio_context);
-+    curl_multi_do_locked(s);
-     curl_multi_check_completion(s->s);
-+    aio_context_release(s->s->aio_context);
- }
- static void curl_multi_timeout_do(void *arg)
-diff --git a/block/iscsi.c b/block/iscsi.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/iscsi.c
-+++ b/block/iscsi.c
-@@ -XXX,XX +XXX,XX @@ iscsi_process_read(void *arg)
-     IscsiLun *iscsilun = arg;
-     struct iscsi_context *iscsi = iscsilun->iscsi;
-+    aio_context_acquire(iscsilun->aio_context);
-     iscsi_service(iscsi, POLLIN);
-     iscsi_set_events(iscsilun);
-+    aio_context_release(iscsilun->aio_context);
- }
- static void
-@@ -XXX,XX +XXX,XX @@ iscsi_process_write(void *arg)
-     IscsiLun *iscsilun = arg;
-     struct iscsi_context *iscsi = iscsilun->iscsi;
-+    aio_context_acquire(iscsilun->aio_context);
-     iscsi_service(iscsi, POLLOUT);
-     iscsi_set_events(iscsilun);
-+    aio_context_release(iscsilun->aio_context);
- }
- static int64_t sector_lun2qemu(int64_t sector, IscsiLun *iscsilun)
-diff --git a/block/linux-aio.c b/block/linux-aio.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/linux-aio.c
-+++ b/block/linux-aio.c
-@@ -XXX,XX +XXX,XX @@ static void qemu_laio_completion_cb(EventNotifier *e)
-     LinuxAioState *s = container_of(e, LinuxAioState, e);
-     if (event_notifier_test_and_clear(&s->e)) {
-+        aio_context_acquire(s->aio_context);
-         qemu_laio_process_completions_and_submit(s);
-+        aio_context_release(s->aio_context);
-     }
- }
-@@ -XXX,XX +XXX,XX @@ static bool qemu_laio_poll_cb(void *opaque)
-         return false;
-     }
-+    aio_context_acquire(s->aio_context);
-     qemu_laio_process_completions_and_submit(s);
-+    aio_context_release(s->aio_context);
-     return true;
- }
-diff --git a/block/nfs.c b/block/nfs.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/nfs.c
-+++ b/block/nfs.c
-@@ -XXX,XX +XXX,XX @@ static void nfs_set_events(NFSClient *client)
- static void nfs_process_read(void *arg)
- {
-     NFSClient *client = arg;
-+
-+    aio_context_acquire(client->aio_context);
-     nfs_service(client->context, POLLIN);
-     nfs_set_events(client);
-+    aio_context_release(client->aio_context);
- }
- static void nfs_process_write(void *arg)
- {
-     NFSClient *client = arg;
-+
-+    aio_context_acquire(client->aio_context);
-     nfs_service(client->context, POLLOUT);
-     nfs_set_events(client);
-+    aio_context_release(client->aio_context);
- }
- static void nfs_co_init_task(BlockDriverState *bs, NFSRPC *task)
-diff --git a/block/sheepdog.c b/block/sheepdog.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/sheepdog.c
-+++ b/block/sheepdog.c
-@@ -XXX,XX +XXX,XX @@ static coroutine_fn int send_co_req(int sockfd, SheepdogReq *hdr, void *data,
-     return ret;
- }
--static void restart_co_req(void *opaque)
--{
--    Coroutine *co = opaque;
--
--    qemu_coroutine_enter(co);
--}
--
- typedef struct SheepdogReqCo {
-     int sockfd;
-     BlockDriverState *bs;
-@@ -XXX,XX +XXX,XX @@ typedef struct SheepdogReqCo {
-     unsigned int *rlen;
-     int ret;
-     bool finished;
-+    Coroutine *co;
- } SheepdogReqCo;
-+static void restart_co_req(void *opaque)
-+{
-+    SheepdogReqCo *srco = opaque;
-+
-+    aio_co_wake(srco->co);
-+}
-+
- static coroutine_fn void do_co_req(void *opaque)
- {
-     int ret;
--    Coroutine *co;
-     SheepdogReqCo *srco = opaque;
-     int sockfd = srco->sockfd;
-     SheepdogReq *hdr = srco->hdr;
-@@ -XXX,XX +XXX,XX @@ static coroutine_fn void do_co_req(void *opaque)
-     unsigned int *wlen = srco->wlen;
-     unsigned int *rlen = srco->rlen;
--    co = qemu_coroutine_self();
-+    srco->co = qemu_coroutine_self();
-     aio_set_fd_handler(srco->aio_context, sockfd, false,
--                       NULL, restart_co_req, NULL, co);
-+                       NULL, restart_co_req, NULL, srco);
-     ret = send_co_req(sockfd, hdr, data, wlen);
-     if (ret < 0) {
-@@ -XXX,XX +XXX,XX @@ static coroutine_fn void do_co_req(void *opaque)
-     }
-     aio_set_fd_handler(srco->aio_context, sockfd, false,
--                       restart_co_req, NULL, NULL, co);
-+                       restart_co_req, NULL, NULL, srco);
-     ret = qemu_co_recv(sockfd, hdr, sizeof(*hdr));
-     if (ret != sizeof(*hdr)) {
-@@ -XXX,XX +XXX,XX @@ out:
-     aio_set_fd_handler(srco->aio_context, sockfd, false,
-                        NULL, NULL, NULL, NULL);
-+    srco->co = NULL;
-     srco->ret = ret;
-     srco->finished = true;
-     if (srco->bs) {
-@@ -XXX,XX +XXX,XX @@ static void coroutine_fn aio_read_response(void *opaque)
-          * We've finished all requests which belong to the AIOCB, so
-          * we can switch back to sd_co_readv/writev now.
-          */
--        qemu_coroutine_enter(acb->coroutine);
-+        aio_co_wake(acb->coroutine);
-     }
-     return;
-@@ -XXX,XX +XXX,XX @@ static void co_read_response(void *opaque)
-         s->co_recv = qemu_coroutine_create(aio_read_response, opaque);
-     }
--    qemu_coroutine_enter(s->co_recv);
-+    aio_co_wake(s->co_recv);
- }
- static void co_write_request(void *opaque)
- {
-     BDRVSheepdogState *s = opaque;
--    qemu_coroutine_enter(s->co_send);
-+    aio_co_wake(s->co_send);
- }
- /*
-diff --git a/block/ssh.c b/block/ssh.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/ssh.c
-+++ b/block/ssh.c
-@@ -XXX,XX +XXX,XX @@ static void restart_coroutine(void *opaque)
-     DPRINTF("co=%p", co);
--    qemu_coroutine_enter(co);
-+    aio_co_wake(co);
- }
--static coroutine_fn void set_fd_handler(BDRVSSHState *s, BlockDriverState *bs)
-+/* A non-blocking call returned EAGAIN, so yield, ensuring the
-+ * handlers are set up so that we'll be rescheduled when there is an
-+ * interesting event on the socket.
-+ */
-+static coroutine_fn void co_yield(BDRVSSHState *s, BlockDriverState *bs)
- {
-     int r;
-     IOHandler *rd_handler = NULL, *wr_handler = NULL;
-@@ -XXX,XX +XXX,XX @@ static coroutine_fn void set_fd_handler(BDRVSSHState *s, BlockDriverState *bs)
-     aio_set_fd_handler(bdrv_get_aio_context(bs), s->sock,
-                        false, rd_handler, wr_handler, NULL, co);
--}
--
--static coroutine_fn void clear_fd_handler(BDRVSSHState *s,
--                                          BlockDriverState *bs)
--{
--    DPRINTF("s->sock=%d", s->sock);
--    aio_set_fd_handler(bdrv_get_aio_context(bs), s->sock,
--                       false, NULL, NULL, NULL, NULL);
--}
--
--/* A non-blocking call returned EAGAIN, so yield, ensuring the
-- * handlers are set up so that we'll be rescheduled when there is an
-- * interesting event on the socket.
-- */
--static coroutine_fn void co_yield(BDRVSSHState *s, BlockDriverState *bs)
--{
--    set_fd_handler(s, bs);
-     qemu_coroutine_yield();
--    clear_fd_handler(s, bs);
-+    DPRINTF("s->sock=%d - back", s->sock);
-+    aio_set_fd_handler(bdrv_get_aio_context(bs), s->sock, false,
-+                       NULL, NULL, NULL, NULL);
- }
- /* SFTP has a function `libssh2_sftp_seek64' which seeks to a position
-diff --git a/block/win32-aio.c b/block/win32-aio.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/win32-aio.c
-+++ b/block/win32-aio.c
-@@ -XXX,XX +XXX,XX @@ struct QEMUWin32AIOState {
-     HANDLE hIOCP;
-     EventNotifier e;
-     int count;
--    bool is_aio_context_attached;
-+    AioContext *aio_ctx;
- };
- typedef struct QEMUWin32AIOCB {
-@@ -XXX,XX +XXX,XX @@ static void win32_aio_process_completion(QEMUWin32AIOState *s,
-     }
-+    aio_context_acquire(s->aio_ctx);
-     waiocb->common.cb(waiocb->common.opaque, ret);
-+    aio_context_release(s->aio_ctx);
-     qemu_aio_unref(waiocb);
- }
-@@ -XXX,XX +XXX,XX @@ void win32_aio_detach_aio_context(QEMUWin32AIOState *aio,
-                                   AioContext *old_context)
- {
-     aio_set_event_notifier(old_context, &aio->e, false, NULL, NULL);
--    aio->is_aio_context_attached = false;
-+    aio->aio_ctx = NULL;
- }
- void win32_aio_attach_aio_context(QEMUWin32AIOState *aio,
-                                   AioContext *new_context)
- {
--    aio->is_aio_context_attached = true;
-+    aio->aio_ctx = new_context;
-     aio_set_event_notifier(new_context, &aio->e, false,
-                            win32_aio_completion_cb, NULL);
- }
-@@ -XXX,XX +XXX,XX @@ out_free_state:
- void win32_aio_cleanup(QEMUWin32AIOState *aio)
- {
--    assert(!aio->is_aio_context_attached);
-+    assert(!aio->aio_ctx);
-     CloseHandle(aio->hIOCP);
-     event_notifier_cleanup(&aio->e);
-     g_free(aio);
-diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/block/virtio-blk.c
-+++ b/hw/block/virtio-blk.c
-@@ -XXX,XX +XXX,XX @@ static void virtio_blk_ioctl_complete(void *opaque, int status)
- {
-     VirtIOBlockIoctlReq *ioctl_req = opaque;
-     VirtIOBlockReq *req = ioctl_req->req;
--    VirtIODevice *vdev = VIRTIO_DEVICE(req->dev);
-+    VirtIOBlock *s = req->dev;
-+    VirtIODevice *vdev = VIRTIO_DEVICE(s);
-     struct virtio_scsi_inhdr *scsi;
-     struct sg_io_hdr *hdr;
-@@ -XXX,XX +XXX,XX @@ bool virtio_blk_handle_vq(VirtIOBlock *s, VirtQueue *vq)
-     MultiReqBuffer mrb = {};
-     bool progress = false;
-+    aio_context_acquire(blk_get_aio_context(s->blk));
-     blk_io_plug(s->blk);
-     do {
-@@ -XXX,XX +XXX,XX @@ bool virtio_blk_handle_vq(VirtIOBlock *s, VirtQueue *vq)
-     }
-     blk_io_unplug(s->blk);
-+    aio_context_release(blk_get_aio_context(s->blk));
-     return progress;
- }
-diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/scsi/virtio-scsi.c
-+++ b/hw/scsi/virtio-scsi.c
-@@ -XXX,XX +XXX,XX @@ bool virtio_scsi_handle_ctrl_vq(VirtIOSCSI *s, VirtQueue *vq)
-     VirtIOSCSIReq *req;
-     bool progress = false;
-+    virtio_scsi_acquire(s);
-     while ((req = virtio_scsi_pop_req(s, vq))) {
-         progress = true;
-         virtio_scsi_handle_ctrl_req(s, req);
-     }
-+    virtio_scsi_release(s);
-     return progress;
- }
-@@ -XXX,XX +XXX,XX @@ bool virtio_scsi_handle_cmd_vq(VirtIOSCSI *s, VirtQueue *vq)
-     QTAILQ_HEAD(, VirtIOSCSIReq) reqs = QTAILQ_HEAD_INITIALIZER(reqs);
-+    virtio_scsi_acquire(s);
-     do {
-         virtio_queue_set_notification(vq, 0);
-@@ -XXX,XX +XXX,XX @@ bool virtio_scsi_handle_cmd_vq(VirtIOSCSI *s, VirtQueue *vq)
-     QTAILQ_FOREACH_SAFE(req, &reqs, next, next) {
-         virtio_scsi_handle_cmd_req_submit(s, req);
-     }
-+    virtio_scsi_release(s);
-     return progress;
- }
-@@ -XXX,XX +XXX,XX @@ out:
- bool virtio_scsi_handle_event_vq(VirtIOSCSI *s, VirtQueue *vq)
- {
-+    virtio_scsi_acquire(s);
-     if (s->events_dropped) {
-         virtio_scsi_push_event(s, NULL, VIRTIO_SCSI_T_NO_EVENT, 0);
-+        virtio_scsi_release(s);
-         return true;
-     }
-+    virtio_scsi_release(s);
-     return false;
- }
-diff --git a/util/aio-posix.c b/util/aio-posix.c
-index XXXXXXX..XXXXXXX 100644
---- a/util/aio-posix.c
-+++ b/util/aio-posix.c
-@@ -XXX,XX +XXX,XX @@ static bool aio_dispatch_handlers(AioContext *ctx)
-             (revents & (G_IO_IN | G_IO_HUP | G_IO_ERR)) &&
-             aio_node_check(ctx, node->is_external) &&
-             node->io_read) {
--            aio_context_acquire(ctx);
-             node->io_read(node->opaque);
--            aio_context_release(ctx);
-             /* aio_notify() does not count as progress */
-             if (node->opaque != &ctx->notifier) {
-@@ -XXX,XX +XXX,XX @@ static bool aio_dispatch_handlers(AioContext *ctx)
-             (revents & (G_IO_OUT | G_IO_ERR)) &&
-             aio_node_check(ctx, node->is_external) &&
-             node->io_write) {
--            aio_context_acquire(ctx);
-             node->io_write(node->opaque);
--            aio_context_release(ctx);
-             progress = true;
-         }
-@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
-         start = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);
-     }
--    aio_context_acquire(ctx);
-     progress = try_poll_mode(ctx, blocking);
--    aio_context_release(ctx);
--
-     if (!progress) {
-         assert(npfd == 0);
-diff --git a/util/aio-win32.c b/util/aio-win32.c
-index XXXXXXX..XXXXXXX 100644
---- a/util/aio-win32.c
-+++ b/util/aio-win32.c
-@@ -XXX,XX +XXX,XX @@ static bool aio_dispatch_handlers(AioContext *ctx, HANDLE event)
-             (revents || event_notifier_get_handle(node->e) == event) &&
-             node->io_notify) {
-             node->pfd.revents = 0;
--            aio_context_acquire(ctx);
-             node->io_notify(node->e);
--            aio_context_release(ctx);
-             /* aio_notify() does not count as progress */
-             if (node->e != &ctx->notifier) {
-@@ -XXX,XX +XXX,XX @@ static bool aio_dispatch_handlers(AioContext *ctx, HANDLE event)
-             (node->io_read || node->io_write)) {
-             node->pfd.revents = 0;
-             if ((revents & G_IO_IN) && node->io_read) {
--                aio_context_acquire(ctx);
-                 node->io_read(node->opaque);
--                aio_context_release(ctx);
-                 progress = true;
-             }
-             if ((revents & G_IO_OUT) && node->io_write) {
--                aio_context_acquire(ctx);
-                 node->io_write(node->opaque);
--                aio_context_release(ctx);
-                 progress = true;
-             }
---
-.9.3

-[Qemu-devel] [PULL v2 14/24] block: explicitly acquire aiocontext in bottom halves that need it
+Deleted patch
-From: Paolo Bonzini <pbonzini@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Reviewed-by: Fam Zheng <famz@redhat.com>
-Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
-Message-id: 20170213135235.12274-15-pbonzini@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- block/archipelago.c   |  3 +++
- block/blkreplay.c     |  2 +-
- block/block-backend.c |  6 ++++++
- block/curl.c          | 26 ++++++++++++++++++--------
- block/gluster.c       |  9 +--------
- block/io.c            |  6 +++++-
- block/iscsi.c         |  6 +++++-
- block/linux-aio.c     | 15 +++++++++------
- block/nfs.c           |  3 ++-
- block/null.c          |  4 ++++
- block/qed.c           |  3 +++
- block/rbd.c           |  4 ++++
- dma-helpers.c         |  2 ++
- hw/block/virtio-blk.c |  2 ++
- hw/scsi/scsi-bus.c    |  2 ++
- util/async.c          |  4 ++--
- util/thread-pool.c    |  2 ++
-files changed, 71 insertions(+), 28 deletions(-)
-diff --git a/block/archipelago.c b/block/archipelago.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/archipelago.c
-+++ b/block/archipelago.c
-@@ -XXX,XX +XXX,XX @@ static void qemu_archipelago_complete_aio(void *opaque)
- {
-     AIORequestData *reqdata = (AIORequestData *) opaque;
-     ArchipelagoAIOCB *aio_cb = (ArchipelagoAIOCB *) reqdata->aio_cb;
-+    AioContext *ctx = bdrv_get_aio_context(aio_cb->common.bs);
-+    aio_context_acquire(ctx);
-     aio_cb->common.cb(aio_cb->common.opaque, aio_cb->ret);
-+    aio_context_release(ctx);
-     aio_cb->status = 0;
-     qemu_aio_unref(aio_cb);
-diff --git a/block/blkreplay.c b/block/blkreplay.c
-index XXXXXXX..XXXXXXX 100755
---- a/block/blkreplay.c
-+++ b/block/blkreplay.c
-@@ -XXX,XX +XXX,XX @@ static int64_t blkreplay_getlength(BlockDriverState *bs)
- static void blkreplay_bh_cb(void *opaque)
- {
-     Request *req = opaque;
--    qemu_coroutine_enter(req->co);
-+    aio_co_wake(req->co);
-     qemu_bh_delete(req->bh);
-     g_free(req);
- }
-diff --git a/block/block-backend.c b/block/block-backend.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/block-backend.c
-+++ b/block/block-backend.c
-@@ -XXX,XX +XXX,XX @@ int blk_make_zero(BlockBackend *blk, BdrvRequestFlags flags)
- static void error_callback_bh(void *opaque)
- {
-     struct BlockBackendAIOCB *acb = opaque;
-+    AioContext *ctx = bdrv_get_aio_context(acb->common.bs);
-     bdrv_dec_in_flight(acb->common.bs);
-+    aio_context_acquire(ctx);
-     acb->common.cb(acb->common.opaque, acb->ret);
-+    aio_context_release(ctx);
-     qemu_aio_unref(acb);
- }
-@@ -XXX,XX +XXX,XX @@ static void blk_aio_complete(BlkAioEmAIOCB *acb)
- static void blk_aio_complete_bh(void *opaque)
- {
-     BlkAioEmAIOCB *acb = opaque;
-+    AioContext *ctx = bdrv_get_aio_context(acb->common.bs);
-     assert(acb->has_returned);
-+    aio_context_acquire(ctx);
-     blk_aio_complete(acb);
-+    aio_context_release(ctx);
- }
- static BlockAIOCB *blk_aio_prwv(BlockBackend *blk, int64_t offset, int bytes,
-diff --git a/block/curl.c b/block/curl.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/curl.c
-+++ b/block/curl.c
-@@ -XXX,XX +XXX,XX @@ static void curl_readv_bh_cb(void *p)
- {
-     CURLState *state;
-     int running;
-+    int ret = -EINPROGRESS;
-     CURLAIOCB *acb = p;
--    BDRVCURLState *s = acb->common.bs->opaque;
-+    BlockDriverState *bs = acb->common.bs;
-+    BDRVCURLState *s = bs->opaque;
-+    AioContext *ctx = bdrv_get_aio_context(bs);
-     size_t start = acb->sector_num * BDRV_SECTOR_SIZE;
-     size_t end;
-+    aio_context_acquire(ctx);
-+
-     // In case we have the requested data already (e.g. read-ahead),
-     // we can just call the callback and be done.
-     switch (curl_find_buf(s, start, acb->nb_sectors * BDRV_SECTOR_SIZE, acb)) {
-@@ -XXX,XX +XXX,XX @@ static void curl_readv_bh_cb(void *p)
-             qemu_aio_unref(acb);
-             // fall through
-         case FIND_RET_WAIT:
--            return;
-+            goto out;
-         default:
-             break;
-     }
-@@ -XXX,XX +XXX,XX @@ static void curl_readv_bh_cb(void *p)
-     // No cache found, so let's start a new request
-     state = curl_init_state(acb->common.bs, s);
-     if (!state) {
--        acb->common.cb(acb->common.opaque, -EIO);
--        qemu_aio_unref(acb);
--        return;
-+        ret = -EIO;
-+        goto out;
-     }
-     acb->start = 0;
-@@ -XXX,XX +XXX,XX @@ static void curl_readv_bh_cb(void *p)
-     state->orig_buf = g_try_malloc(state->buf_len);
-     if (state->buf_len && state->orig_buf == NULL) {
-         curl_clean_state(state);
--        acb->common.cb(acb->common.opaque, -ENOMEM);
--        qemu_aio_unref(acb);
--        return;
-+        ret = -ENOMEM;
-+        goto out;
-     }
-     state->acb[0] = acb;
-@@ -XXX,XX +XXX,XX @@ static void curl_readv_bh_cb(void *p)
-     /* Tell curl it needs to kick things off */
-     curl_multi_socket_action(s->multi, CURL_SOCKET_TIMEOUT, 0, &running);
-+
-+out:
-+    if (ret != -EINPROGRESS) {
-+        acb->common.cb(acb->common.opaque, ret);
-+        qemu_aio_unref(acb);
-+    }
-+    aio_context_release(ctx);
- }
- static BlockAIOCB *curl_aio_readv(BlockDriverState *bs,
-diff --git a/block/gluster.c b/block/gluster.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/gluster.c
-+++ b/block/gluster.c
-@@ -XXX,XX +XXX,XX @@ static struct glfs *qemu_gluster_init(BlockdevOptionsGluster *gconf,
-     return qemu_gluster_glfs_init(gconf, errp);
- }
--static void qemu_gluster_complete_aio(void *opaque)
--{
--    GlusterAIOCB *acb = (GlusterAIOCB *)opaque;
--
--    qemu_coroutine_enter(acb->coroutine);
--}
--
- /*
-  * AIO callback routine called from GlusterFS thread.
-  */
-@@ -XXX,XX +XXX,XX @@ static void gluster_finish_aiocb(struct glfs_fd *fd, ssize_t ret, void *arg)
-         acb->ret = -EIO; /* Partial read/write - fail it */
-     }
--    aio_bh_schedule_oneshot(acb->aio_context, qemu_gluster_complete_aio, acb);
-+    aio_co_schedule(acb->aio_context, acb->coroutine);
- }
- static void qemu_gluster_parse_flags(int bdrv_flags, int *open_flags)
-diff --git a/block/io.c b/block/io.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/io.c
-+++ b/block/io.c
-@@ -XXX,XX +XXX,XX @@ static void bdrv_co_drain_bh_cb(void *opaque)
-     bdrv_dec_in_flight(bs);
-     bdrv_drained_begin(bs);
-     data->done = true;
--    qemu_coroutine_enter(co);
-+    aio_co_wake(co);
- }
- static void coroutine_fn bdrv_co_yield_to_drain(BlockDriverState *bs)
-@@ -XXX,XX +XXX,XX @@ static void bdrv_co_complete(BlockAIOCBCoroutine *acb)
- static void bdrv_co_em_bh(void *opaque)
- {
-     BlockAIOCBCoroutine *acb = opaque;
-+    BlockDriverState *bs = acb->common.bs;
-+    AioContext *ctx = bdrv_get_aio_context(bs);
-     assert(!acb->need_bh);
-+    aio_context_acquire(ctx);
-     bdrv_co_complete(acb);
-+    aio_context_release(ctx);
- }
- static void bdrv_co_maybe_schedule_bh(BlockAIOCBCoroutine *acb)
-diff --git a/block/iscsi.c b/block/iscsi.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/iscsi.c
-+++ b/block/iscsi.c
-@@ -XXX,XX +XXX,XX @@ static void
- iscsi_bh_cb(void *p)
- {
-     IscsiAIOCB *acb = p;
-+    AioContext *ctx = bdrv_get_aio_context(acb->common.bs);
-     qemu_bh_delete(acb->bh);
-     g_free(acb->buf);
-     acb->buf = NULL;
-+    aio_context_acquire(ctx);
-     acb->common.cb(acb->common.opaque, acb->status);
-+    aio_context_release(ctx);
-     if (acb->task != NULL) {
-         scsi_free_scsi_task(acb->task);
-@@ -XXX,XX +XXX,XX @@ iscsi_schedule_bh(IscsiAIOCB *acb)
- static void iscsi_co_generic_bh_cb(void *opaque)
- {
-     struct IscsiTask *iTask = opaque;
-+
-     iTask->complete = 1;
--    qemu_coroutine_enter(iTask->co);
-+    aio_co_wake(iTask->co);
- }
- static void iscsi_retry_timer_expired(void *opaque)
-diff --git a/block/linux-aio.c b/block/linux-aio.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/linux-aio.c
-+++ b/block/linux-aio.c
-@@ -XXX,XX +XXX,XX @@ struct LinuxAioState {
-     io_context_t ctx;
-     EventNotifier e;
--    /* io queue for submit at batch */
-+    /* io queue for submit at batch.  Protected by AioContext lock. */
-     LaioQueue io_q;
--    /* I/O completion processing */
-+    /* I/O completion processing.  Only runs in I/O thread.  */
-     QEMUBH *completion_bh;
-     int event_idx;
-     int event_max;
-@@ -XXX,XX +XXX,XX @@ static inline ssize_t io_event_ret(struct io_event *ev)
-  */
- static void qemu_laio_process_completion(struct qemu_laiocb *laiocb)
- {
-+    LinuxAioState *s = laiocb->ctx;
-     int ret;
-     ret = laiocb->ret;
-@@ -XXX,XX +XXX,XX @@ static void qemu_laio_process_completion(struct qemu_laiocb *laiocb)
-     }
-     laiocb->ret = ret;
-+    aio_context_acquire(s->aio_context);
-     if (laiocb->co) {
-         /* If the coroutine is already entered it must be in ioq_submit() and
-          * will notice laio->ret has been filled in when it eventually runs
-@@ -XXX,XX +XXX,XX @@ static void qemu_laio_process_completion(struct qemu_laiocb *laiocb)
-         laiocb->common.cb(laiocb->common.opaque, ret);
-         qemu_aio_unref(laiocb);
-     }
-+    aio_context_release(s->aio_context);
- }
- /**
-@@ -XXX,XX +XXX,XX @@ static void qemu_laio_process_completions(LinuxAioState *s)
- static void qemu_laio_process_completions_and_submit(LinuxAioState *s)
- {
-     qemu_laio_process_completions(s);
-+
-+    aio_context_acquire(s->aio_context);
-     if (!s->io_q.plugged && !QSIMPLEQ_EMPTY(&s->io_q.pending)) {
-         ioq_submit(s);
-     }
-+    aio_context_release(s->aio_context);
- }
- static void qemu_laio_completion_bh(void *opaque)
-@@ -XXX,XX +XXX,XX @@ static void qemu_laio_completion_cb(EventNotifier *e)
-     LinuxAioState *s = container_of(e, LinuxAioState, e);
-     if (event_notifier_test_and_clear(&s->e)) {
--        aio_context_acquire(s->aio_context);
-         qemu_laio_process_completions_and_submit(s);
--        aio_context_release(s->aio_context);
-     }
- }
-@@ -XXX,XX +XXX,XX @@ static bool qemu_laio_poll_cb(void *opaque)
-         return false;
-     }
--    aio_context_acquire(s->aio_context);
-     qemu_laio_process_completions_and_submit(s);
--    aio_context_release(s->aio_context);
-     return true;
- }
-@@ -XXX,XX +XXX,XX @@ void laio_detach_aio_context(LinuxAioState *s, AioContext *old_context)
- {
-     aio_set_event_notifier(old_context, &s->e, false, NULL, NULL);
-     qemu_bh_delete(s->completion_bh);
-+    s->aio_context = NULL;
- }
- void laio_attach_aio_context(LinuxAioState *s, AioContext *new_context)
-diff --git a/block/nfs.c b/block/nfs.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/nfs.c
-+++ b/block/nfs.c
-@@ -XXX,XX +XXX,XX @@ static void nfs_co_init_task(BlockDriverState *bs, NFSRPC *task)
- static void nfs_co_generic_bh_cb(void *opaque)
- {
-     NFSRPC *task = opaque;
-+
-     task->complete = 1;
--    qemu_coroutine_enter(task->co);
-+    aio_co_wake(task->co);
- }
- static void
-diff --git a/block/null.c b/block/null.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/null.c
-+++ b/block/null.c
-@@ -XXX,XX +XXX,XX @@ static const AIOCBInfo null_aiocb_info = {
- static void null_bh_cb(void *opaque)
- {
-     NullAIOCB *acb = opaque;
-+    AioContext *ctx = bdrv_get_aio_context(acb->common.bs);
-+
-+    aio_context_acquire(ctx);
-     acb->common.cb(acb->common.opaque, 0);
-+    aio_context_release(ctx);
-     qemu_aio_unref(acb);
- }
-diff --git a/block/qed.c b/block/qed.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/qed.c
-+++ b/block/qed.c
-@@ -XXX,XX +XXX,XX @@ static void qed_update_l2_table(BDRVQEDState *s, QEDTable *table, int index,
- static void qed_aio_complete_bh(void *opaque)
- {
-     QEDAIOCB *acb = opaque;
-+    BDRVQEDState *s = acb_to_s(acb);
-     BlockCompletionFunc *cb = acb->common.cb;
-     void *user_opaque = acb->common.opaque;
-     int ret = acb->bh_ret;
-@@ -XXX,XX +XXX,XX @@ static void qed_aio_complete_bh(void *opaque)
-     qemu_aio_unref(acb);
-     /* Invoke callback */
-+    qed_acquire(s);
-     cb(user_opaque, ret);
-+    qed_release(s);
- }
- static void qed_aio_complete(QEDAIOCB *acb, int ret)
-diff --git a/block/rbd.c b/block/rbd.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/rbd.c
-+++ b/block/rbd.c
-@@ -XXX,XX +XXX,XX @@ shutdown:
- static void qemu_rbd_complete_aio(RADOSCB *rcb)
- {
-     RBDAIOCB *acb = rcb->acb;
-+    AioContext *ctx = bdrv_get_aio_context(acb->common.bs);
-     int64_t r;
-     r = rcb->ret;
-@@ -XXX,XX +XXX,XX @@ static void qemu_rbd_complete_aio(RADOSCB *rcb)
-         qemu_iovec_from_buf(acb->qiov, 0, acb->bounce, acb->qiov->size);
-     }
-     qemu_vfree(acb->bounce);
-+
-+    aio_context_acquire(ctx);
-     acb->common.cb(acb->common.opaque, (acb->ret > 0 ? 0 : acb->ret));
-+    aio_context_release(ctx);
-     qemu_aio_unref(acb);
- }
-diff --git a/dma-helpers.c b/dma-helpers.c
-index XXXXXXX..XXXXXXX 100644
---- a/dma-helpers.c
-+++ b/dma-helpers.c
-@@ -XXX,XX +XXX,XX @@ static void dma_blk_cb(void *opaque, int ret)
-                                 QEMU_ALIGN_DOWN(dbs->iov.size, dbs->align));
-     }
-+    aio_context_acquire(dbs->ctx);
-     dbs->acb = dbs->io_func(dbs->offset, &dbs->iov,
-                             dma_blk_cb, dbs, dbs->io_func_opaque);
-+    aio_context_release(dbs->ctx);
-     assert(dbs->acb);
- }
-diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/block/virtio-blk.c
-+++ b/hw/block/virtio-blk.c
-@@ -XXX,XX +XXX,XX @@ static void virtio_blk_dma_restart_bh(void *opaque)
-     s->rq = NULL;
-+    aio_context_acquire(blk_get_aio_context(s->conf.conf.blk));
-     while (req) {
-         VirtIOBlockReq *next = req->next;
-         if (virtio_blk_handle_request(req, &mrb)) {
-@@ -XXX,XX +XXX,XX @@ static void virtio_blk_dma_restart_bh(void *opaque)
-     if (mrb.num_reqs) {
-         virtio_blk_submit_multireq(s->blk, &mrb);
-     }
-+    aio_context_release(blk_get_aio_context(s->conf.conf.blk));
- }
- static void virtio_blk_dma_restart_cb(void *opaque, int running,
-diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/scsi/scsi-bus.c
-+++ b/hw/scsi/scsi-bus.c
-@@ -XXX,XX +XXX,XX @@ static void scsi_dma_restart_bh(void *opaque)
-     qemu_bh_delete(s->bh);
-     s->bh = NULL;
-+    aio_context_acquire(blk_get_aio_context(s->conf.blk));
-     QTAILQ_FOREACH_SAFE(req, &s->requests, next, next) {
-         scsi_req_ref(req);
-         if (req->retry) {
-@@ -XXX,XX +XXX,XX @@ static void scsi_dma_restart_bh(void *opaque)
-         }
-         scsi_req_unref(req);
-     }
-+    aio_context_release(blk_get_aio_context(s->conf.blk));
- }
- void scsi_req_retry(SCSIRequest *req)
-diff --git a/util/async.c b/util/async.c
-index XXXXXXX..XXXXXXX 100644
---- a/util/async.c
-+++ b/util/async.c
-@@ -XXX,XX +XXX,XX @@ int aio_bh_poll(AioContext *ctx)
-                 ret = 1;
-             }
-             bh->idle = 0;
--            aio_context_acquire(ctx);
-             aio_bh_call(bh);
--            aio_context_release(ctx);
-         }
-         if (bh->deleted) {
-             deleted = true;
-@@ -XXX,XX +XXX,XX @@ static void co_schedule_bh_cb(void *opaque)
-         Coroutine *co = QSLIST_FIRST(&straight);
-         QSLIST_REMOVE_HEAD(&straight, co_scheduled_next);
-         trace_aio_co_schedule_bh_cb(ctx, co);
-+        aio_context_acquire(ctx);
-         qemu_coroutine_enter(co);
-+        aio_context_release(ctx);
-     }
- }
-diff --git a/util/thread-pool.c b/util/thread-pool.c
-index XXXXXXX..XXXXXXX 100644
---- a/util/thread-pool.c
-+++ b/util/thread-pool.c
-@@ -XXX,XX +XXX,XX @@ static void thread_pool_completion_bh(void *opaque)
-     ThreadPool *pool = opaque;
-     ThreadPoolElement *elem, *next;
-+    aio_context_acquire(pool->ctx);
- restart:
-     QLIST_FOREACH_SAFE(elem, &pool->head, all, next) {
-         if (elem->state != THREAD_DONE) {
-@@ -XXX,XX +XXX,XX @@ restart:
-             qemu_aio_unref(elem);
-         }
-     }
-+    aio_context_release(pool->ctx);
- }
- static void thread_pool_cancel(BlockAIOCB *acb)
---
-.9.3

-[Qemu-devel] [PULL v2 15/24] block: explicitly acquire aiocontext in aio callbacks that need it
+Deleted patch
-From: Paolo Bonzini <pbonzini@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Reviewed-by: Fam Zheng <famz@redhat.com>
-Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
-Message-id: 20170213135235.12274-16-pbonzini@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- block/archipelago.c    |  3 ---
- block/block-backend.c  |  7 -------
- block/curl.c           |  2 +-
- block/io.c             |  6 +-----
- block/iscsi.c          |  3 ---
- block/linux-aio.c      |  5 +----
- block/mirror.c         | 12 +++++++++---
- block/null.c           |  8 --------
- block/qed-cluster.c    |  2 ++
- block/qed-table.c      | 12 ++++++++++--
- block/qed.c            |  4 ++--
- block/rbd.c            |  4 ----
- block/win32-aio.c      |  3 ---
- hw/block/virtio-blk.c  | 12 +++++++++++-
- hw/scsi/scsi-disk.c    | 15 +++++++++++++++
- hw/scsi/scsi-generic.c | 20 +++++++++++++++++---
- util/thread-pool.c     |  4 +++-
-files changed, 72 insertions(+), 50 deletions(-)
-diff --git a/block/archipelago.c b/block/archipelago.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/archipelago.c
-+++ b/block/archipelago.c
-@@ -XXX,XX +XXX,XX @@ static void qemu_archipelago_complete_aio(void *opaque)
- {
-     AIORequestData *reqdata = (AIORequestData *) opaque;
-     ArchipelagoAIOCB *aio_cb = (ArchipelagoAIOCB *) reqdata->aio_cb;
--    AioContext *ctx = bdrv_get_aio_context(aio_cb->common.bs);
--    aio_context_acquire(ctx);
-     aio_cb->common.cb(aio_cb->common.opaque, aio_cb->ret);
--    aio_context_release(ctx);
-     aio_cb->status = 0;
-     qemu_aio_unref(aio_cb);
-diff --git a/block/block-backend.c b/block/block-backend.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/block-backend.c
-+++ b/block/block-backend.c
-@@ -XXX,XX +XXX,XX @@ int blk_make_zero(BlockBackend *blk, BdrvRequestFlags flags)
- static void error_callback_bh(void *opaque)
- {
-     struct BlockBackendAIOCB *acb = opaque;
--    AioContext *ctx = bdrv_get_aio_context(acb->common.bs);
-     bdrv_dec_in_flight(acb->common.bs);
--    aio_context_acquire(ctx);
-     acb->common.cb(acb->common.opaque, acb->ret);
--    aio_context_release(ctx);
-     qemu_aio_unref(acb);
- }
-@@ -XXX,XX +XXX,XX @@ static void blk_aio_complete(BlkAioEmAIOCB *acb)
- static void blk_aio_complete_bh(void *opaque)
- {
-     BlkAioEmAIOCB *acb = opaque;
--    AioContext *ctx = bdrv_get_aio_context(acb->common.bs);
--
-     assert(acb->has_returned);
--    aio_context_acquire(ctx);
-     blk_aio_complete(acb);
--    aio_context_release(ctx);
- }
- static BlockAIOCB *blk_aio_prwv(BlockBackend *blk, int64_t offset, int bytes,
-diff --git a/block/curl.c b/block/curl.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/curl.c
-+++ b/block/curl.c
-@@ -XXX,XX +XXX,XX @@ static void curl_readv_bh_cb(void *p)
-     curl_multi_socket_action(s->multi, CURL_SOCKET_TIMEOUT, 0, &running);
- out:
-+    aio_context_release(ctx);
-     if (ret != -EINPROGRESS) {
-         acb->common.cb(acb->common.opaque, ret);
-         qemu_aio_unref(acb);
-     }
--    aio_context_release(ctx);
- }
- static BlockAIOCB *curl_aio_readv(BlockDriverState *bs,
-diff --git a/block/io.c b/block/io.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/io.c
-+++ b/block/io.c
-@@ -XXX,XX +XXX,XX @@ static void bdrv_co_io_em_complete(void *opaque, int ret)
-     CoroutineIOCompletion *co = opaque;
-     co->ret = ret;
--    qemu_coroutine_enter(co->coroutine);
-+    aio_co_wake(co->coroutine);
- }
- static int coroutine_fn bdrv_driver_preadv(BlockDriverState *bs,
-@@ -XXX,XX +XXX,XX @@ static void bdrv_co_complete(BlockAIOCBCoroutine *acb)
- static void bdrv_co_em_bh(void *opaque)
- {
-     BlockAIOCBCoroutine *acb = opaque;
--    BlockDriverState *bs = acb->common.bs;
--    AioContext *ctx = bdrv_get_aio_context(bs);
-     assert(!acb->need_bh);
--    aio_context_acquire(ctx);
-     bdrv_co_complete(acb);
--    aio_context_release(ctx);
- }
- static void bdrv_co_maybe_schedule_bh(BlockAIOCBCoroutine *acb)
-diff --git a/block/iscsi.c b/block/iscsi.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/iscsi.c
-+++ b/block/iscsi.c
-@@ -XXX,XX +XXX,XX @@ static void
- iscsi_bh_cb(void *p)
- {
-     IscsiAIOCB *acb = p;
--    AioContext *ctx = bdrv_get_aio_context(acb->common.bs);
-     qemu_bh_delete(acb->bh);
-     g_free(acb->buf);
-     acb->buf = NULL;
--    aio_context_acquire(ctx);
-     acb->common.cb(acb->common.opaque, acb->status);
--    aio_context_release(ctx);
-     if (acb->task != NULL) {
-         scsi_free_scsi_task(acb->task);
-diff --git a/block/linux-aio.c b/block/linux-aio.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/linux-aio.c
-+++ b/block/linux-aio.c
-@@ -XXX,XX +XXX,XX @@ static inline ssize_t io_event_ret(struct io_event *ev)
-  */
- static void qemu_laio_process_completion(struct qemu_laiocb *laiocb)
- {
--    LinuxAioState *s = laiocb->ctx;
-     int ret;
-     ret = laiocb->ret;
-@@ -XXX,XX +XXX,XX @@ static void qemu_laio_process_completion(struct qemu_laiocb *laiocb)
-     }
-     laiocb->ret = ret;
--    aio_context_acquire(s->aio_context);
-     if (laiocb->co) {
-         /* If the coroutine is already entered it must be in ioq_submit() and
-          * will notice laio->ret has been filled in when it eventually runs
-@@ -XXX,XX +XXX,XX @@ static void qemu_laio_process_completion(struct qemu_laiocb *laiocb)
-          * that!
-          */
-         if (!qemu_coroutine_entered(laiocb->co)) {
--            qemu_coroutine_enter(laiocb->co);
-+            aio_co_wake(laiocb->co);
-         }
-     } else {
-         laiocb->common.cb(laiocb->common.opaque, ret);
-         qemu_aio_unref(laiocb);
-     }
--    aio_context_release(s->aio_context);
- }
- /**
-diff --git a/block/mirror.c b/block/mirror.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/mirror.c
-+++ b/block/mirror.c
-@@ -XXX,XX +XXX,XX @@ static void mirror_write_complete(void *opaque, int ret)
- {
-     MirrorOp *op = opaque;
-     MirrorBlockJob *s = op->s;
-+
-+    aio_context_acquire(blk_get_aio_context(s->common.blk));
-     if (ret < 0) {
-         BlockErrorAction action;
-@@ -XXX,XX +XXX,XX @@ static void mirror_write_complete(void *opaque, int ret)
-         }
-     }
-     mirror_iteration_done(op, ret);
-+    aio_context_release(blk_get_aio_context(s->common.blk));
- }
- static void mirror_read_complete(void *opaque, int ret)
- {
-     MirrorOp *op = opaque;
-     MirrorBlockJob *s = op->s;
-+
-+    aio_context_acquire(blk_get_aio_context(s->common.blk));
-     if (ret < 0) {
-         BlockErrorAction action;
-@@ -XXX,XX +XXX,XX @@ static void mirror_read_complete(void *opaque, int ret)
-         }
-         mirror_iteration_done(op, ret);
--        return;
-+    } else {
-+        blk_aio_pwritev(s->target, op->sector_num * BDRV_SECTOR_SIZE, &op->qiov,
-+                        0, mirror_write_complete, op);
-     }
--    blk_aio_pwritev(s->target, op->sector_num * BDRV_SECTOR_SIZE, &op->qiov,
--                    0, mirror_write_complete, op);
-+    aio_context_release(blk_get_aio_context(s->common.blk));
- }
- static inline void mirror_clip_sectors(MirrorBlockJob *s,
-diff --git a/block/null.c b/block/null.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/null.c
-+++ b/block/null.c
-@@ -XXX,XX +XXX,XX @@ static const AIOCBInfo null_aiocb_info = {
- static void null_bh_cb(void *opaque)
- {
-     NullAIOCB *acb = opaque;
--    AioContext *ctx = bdrv_get_aio_context(acb->common.bs);
--
--    aio_context_acquire(ctx);
-     acb->common.cb(acb->common.opaque, 0);
--    aio_context_release(ctx);
-     qemu_aio_unref(acb);
- }
- static void null_timer_cb(void *opaque)
- {
-     NullAIOCB *acb = opaque;
--    AioContext *ctx = bdrv_get_aio_context(acb->common.bs);
--
--    aio_context_acquire(ctx);
-     acb->common.cb(acb->common.opaque, 0);
--    aio_context_release(ctx);
-     timer_deinit(&acb->timer);
-     qemu_aio_unref(acb);
- }
-diff --git a/block/qed-cluster.c b/block/qed-cluster.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/qed-cluster.c
-+++ b/block/qed-cluster.c
-@@ -XXX,XX +XXX,XX @@ static void qed_find_cluster_cb(void *opaque, int ret)
-     unsigned int index;
-     unsigned int n;
-+    qed_acquire(s);
-     if (ret) {
-         goto out;
-     }
-@@ -XXX,XX +XXX,XX @@ static void qed_find_cluster_cb(void *opaque, int ret)
- out:
-     find_cluster_cb->cb(find_cluster_cb->opaque, ret, offset, len);
-+    qed_release(s);
-     g_free(find_cluster_cb);
- }
-diff --git a/block/qed-table.c b/block/qed-table.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/qed-table.c
-+++ b/block/qed-table.c
-@@ -XXX,XX +XXX,XX @@ static void qed_read_table_cb(void *opaque, int ret)
- {
-     QEDReadTableCB *read_table_cb = opaque;
-     QEDTable *table = read_table_cb->table;
-+    BDRVQEDState *s = read_table_cb->s;
-     int noffsets = read_table_cb->qiov.size / sizeof(uint64_t);
-     int i;
-@@ -XXX,XX +XXX,XX @@ static void qed_read_table_cb(void *opaque, int ret)
-     }
-     /* Byteswap offsets */
-+    qed_acquire(s);
-     for (i = 0; i < noffsets; i++) {
-         table->offsets[i] = le64_to_cpu(table->offsets[i]);
-     }
-+    qed_release(s);
- out:
-     /* Completion */
--    trace_qed_read_table_cb(read_table_cb->s, read_table_cb->table, ret);
-+    trace_qed_read_table_cb(s, read_table_cb->table, ret);
-     gencb_complete(&read_table_cb->gencb, ret);
- }
-@@ -XXX,XX +XXX,XX @@ typedef struct {
- static void qed_write_table_cb(void *opaque, int ret)
- {
-     QEDWriteTableCB *write_table_cb = opaque;
-+    BDRVQEDState *s = write_table_cb->s;
--    trace_qed_write_table_cb(write_table_cb->s,
-+    trace_qed_write_table_cb(s,
-                              write_table_cb->orig_table,
-                              write_table_cb->flush,
-                              ret);
-@@ -XXX,XX +XXX,XX @@ static void qed_write_table_cb(void *opaque, int ret)
-     if (write_table_cb->flush) {
-         /* We still need to flush first */
-         write_table_cb->flush = false;
-+        qed_acquire(s);
-         bdrv_aio_flush(write_table_cb->s->bs, qed_write_table_cb,
-                        write_table_cb);
-+        qed_release(s);
-         return;
-     }
-@@ -XXX,XX +XXX,XX @@ static void qed_read_l2_table_cb(void *opaque, int ret)
-     CachedL2Table *l2_table = request->l2_table;
-     uint64_t l2_offset = read_l2_table_cb->l2_offset;
-+    qed_acquire(s);
-     if (ret) {
-         /* can't trust loaded L2 table anymore */
-         qed_unref_l2_cache_entry(l2_table);
-@@ -XXX,XX +XXX,XX @@ static void qed_read_l2_table_cb(void *opaque, int ret)
-         request->l2_table = qed_find_l2_cache_entry(&s->l2_cache, l2_offset);
-         assert(request->l2_table != NULL);
-     }
-+    qed_release(s);
-     gencb_complete(&read_l2_table_cb->gencb, ret);
- }
-diff --git a/block/qed.c b/block/qed.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/qed.c
-+++ b/block/qed.c
-@@ -XXX,XX +XXX,XX @@ static void qed_is_allocated_cb(void *opaque, int ret, uint64_t offset, size_t l
-     }
-     if (cb->co) {
--        qemu_coroutine_enter(cb->co);
-+        aio_co_wake(cb->co);
-     }
- }
-@@ -XXX,XX +XXX,XX @@ static void coroutine_fn qed_co_pwrite_zeroes_cb(void *opaque, int ret)
-     cb->done = true;
-     cb->ret = ret;
-     if (cb->co) {
--        qemu_coroutine_enter(cb->co);
-+        aio_co_wake(cb->co);
-     }
- }
-diff --git a/block/rbd.c b/block/rbd.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/rbd.c
-+++ b/block/rbd.c
-@@ -XXX,XX +XXX,XX @@ shutdown:
- static void qemu_rbd_complete_aio(RADOSCB *rcb)
- {
-     RBDAIOCB *acb = rcb->acb;
--    AioContext *ctx = bdrv_get_aio_context(acb->common.bs);
-     int64_t r;
-     r = rcb->ret;
-@@ -XXX,XX +XXX,XX @@ static void qemu_rbd_complete_aio(RADOSCB *rcb)
-         qemu_iovec_from_buf(acb->qiov, 0, acb->bounce, acb->qiov->size);
-     }
-     qemu_vfree(acb->bounce);
--
--    aio_context_acquire(ctx);
-     acb->common.cb(acb->common.opaque, (acb->ret > 0 ? 0 : acb->ret));
--    aio_context_release(ctx);
-     qemu_aio_unref(acb);
- }
-diff --git a/block/win32-aio.c b/block/win32-aio.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/win32-aio.c
-+++ b/block/win32-aio.c
-@@ -XXX,XX +XXX,XX @@ static void win32_aio_process_completion(QEMUWin32AIOState *s,
-         qemu_vfree(waiocb->buf);
-     }
--
--    aio_context_acquire(s->aio_ctx);
-     waiocb->common.cb(waiocb->common.opaque, ret);
--    aio_context_release(s->aio_ctx);
-     qemu_aio_unref(waiocb);
- }
-diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/block/virtio-blk.c
-+++ b/hw/block/virtio-blk.c
-@@ -XXX,XX +XXX,XX @@ static int virtio_blk_handle_rw_error(VirtIOBlockReq *req, int error,
- static void virtio_blk_rw_complete(void *opaque, int ret)
- {
-     VirtIOBlockReq *next = opaque;
-+    VirtIOBlock *s = next->dev;
-+    aio_context_acquire(blk_get_aio_context(s->conf.conf.blk));
-     while (next) {
-         VirtIOBlockReq *req = next;
-         next = req->mr_next;
-@@ -XXX,XX +XXX,XX @@ static void virtio_blk_rw_complete(void *opaque, int ret)
-         block_acct_done(blk_get_stats(req->dev->blk), &req->acct);
-         virtio_blk_free_request(req);
-     }
-+    aio_context_release(blk_get_aio_context(s->conf.conf.blk));
- }
- static void virtio_blk_flush_complete(void *opaque, int ret)
- {
-     VirtIOBlockReq *req = opaque;
-+    VirtIOBlock *s = req->dev;
-+    aio_context_acquire(blk_get_aio_context(s->conf.conf.blk));
-     if (ret) {
-         if (virtio_blk_handle_rw_error(req, -ret, 0)) {
--            return;
-+            goto out;
-         }
-     }
-     virtio_blk_req_complete(req, VIRTIO_BLK_S_OK);
-     block_acct_done(blk_get_stats(req->dev->blk), &req->acct);
-     virtio_blk_free_request(req);
-+
-+out:
-+    aio_context_release(blk_get_aio_context(s->conf.conf.blk));
- }
- #ifdef __linux__
-@@ -XXX,XX +XXX,XX @@ static void virtio_blk_ioctl_complete(void *opaque, int status)
-     virtio_stl_p(vdev, &scsi->data_len, hdr->dxfer_len);
- out:
-+    aio_context_acquire(blk_get_aio_context(s->conf.conf.blk));
-     virtio_blk_req_complete(req, status);
-     virtio_blk_free_request(req);
-+    aio_context_release(blk_get_aio_context(s->conf.conf.blk));
-     g_free(ioctl_req);
- }
-diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/scsi/scsi-disk.c
-+++ b/hw/scsi/scsi-disk.c
-@@ -XXX,XX +XXX,XX @@ static void scsi_aio_complete(void *opaque, int ret)
-     assert(r->req.aiocb != NULL);
-     r->req.aiocb = NULL;
-+    aio_context_acquire(blk_get_aio_context(s->qdev.conf.blk));
-     if (scsi_disk_req_check_error(r, ret, true)) {
-         goto done;
-     }
-@@ -XXX,XX +XXX,XX @@ static void scsi_aio_complete(void *opaque, int ret)
-     scsi_req_complete(&r->req, GOOD);
- done:
-+    aio_context_release(blk_get_aio_context(s->qdev.conf.blk));
-     scsi_req_unref(&r->req);
- }
-@@ -XXX,XX +XXX,XX @@ static void scsi_dma_complete(void *opaque, int ret)
-     assert(r->req.aiocb != NULL);
-     r->req.aiocb = NULL;
-+    aio_context_acquire(blk_get_aio_context(s->qdev.conf.blk));
-     if (ret < 0) {
-         block_acct_failed(blk_get_stats(s->qdev.conf.blk), &r->acct);
-     } else {
-         block_acct_done(blk_get_stats(s->qdev.conf.blk), &r->acct);
-     }
-     scsi_dma_complete_noio(r, ret);
-+    aio_context_release(blk_get_aio_context(s->qdev.conf.blk));
- }
- static void scsi_read_complete(void * opaque, int ret)
-@@ -XXX,XX +XXX,XX @@ static void scsi_read_complete(void * opaque, int ret)
-     assert(r->req.aiocb != NULL);
-     r->req.aiocb = NULL;
-+    aio_context_acquire(blk_get_aio_context(s->qdev.conf.blk));
-     if (scsi_disk_req_check_error(r, ret, true)) {
-         goto done;
-     }
-@@ -XXX,XX +XXX,XX @@ static void scsi_read_complete(void * opaque, int ret)
- done:
-     scsi_req_unref(&r->req);
-+    aio_context_release(blk_get_aio_context(s->qdev.conf.blk));
- }
- /* Actually issue a read to the block device.  */
-@@ -XXX,XX +XXX,XX @@ static void scsi_do_read_cb(void *opaque, int ret)
-     assert (r->req.aiocb != NULL);
-     r->req.aiocb = NULL;
-+    aio_context_acquire(blk_get_aio_context(s->qdev.conf.blk));
-     if (ret < 0) {
-         block_acct_failed(blk_get_stats(s->qdev.conf.blk), &r->acct);
-     } else {
-         block_acct_done(blk_get_stats(s->qdev.conf.blk), &r->acct);
-     }
-     scsi_do_read(opaque, ret);
-+    aio_context_release(blk_get_aio_context(s->qdev.conf.blk));
- }
- /* Read more data from scsi device into buffer.  */
-@@ -XXX,XX +XXX,XX @@ static void scsi_write_complete(void * opaque, int ret)
-     assert (r->req.aiocb != NULL);
-     r->req.aiocb = NULL;
-+    aio_context_acquire(blk_get_aio_context(s->qdev.conf.blk));
-     if (ret < 0) {
-         block_acct_failed(blk_get_stats(s->qdev.conf.blk), &r->acct);
-     } else {
-         block_acct_done(blk_get_stats(s->qdev.conf.blk), &r->acct);
-     }
-     scsi_write_complete_noio(r, ret);
-+    aio_context_release(blk_get_aio_context(s->qdev.conf.blk));
- }
- static void scsi_write_data(SCSIRequest *req)
-@@ -XXX,XX +XXX,XX @@ static void scsi_unmap_complete(void *opaque, int ret)
- {
-     UnmapCBData *data = opaque;
-     SCSIDiskReq *r = data->r;
-+    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
-     assert(r->req.aiocb != NULL);
-     r->req.aiocb = NULL;
-+    aio_context_acquire(blk_get_aio_context(s->qdev.conf.blk));
-     scsi_unmap_complete_noio(data, ret);
-+    aio_context_release(blk_get_aio_context(s->qdev.conf.blk));
- }
- static void scsi_disk_emulate_unmap(SCSIDiskReq *r, uint8_t *inbuf)
-@@ -XXX,XX +XXX,XX @@ static void scsi_write_same_complete(void *opaque, int ret)
-     assert(r->req.aiocb != NULL);
-     r->req.aiocb = NULL;
-+    aio_context_acquire(blk_get_aio_context(s->qdev.conf.blk));
-     if (scsi_disk_req_check_error(r, ret, true)) {
-         goto done;
-     }
-@@ -XXX,XX +XXX,XX @@ done:
-     scsi_req_unref(&r->req);
-     qemu_vfree(data->iov.iov_base);
-     g_free(data);
-+    aio_context_release(blk_get_aio_context(s->qdev.conf.blk));
- }
- static void scsi_disk_emulate_write_same(SCSIDiskReq *r, uint8_t *inbuf)
-diff --git a/hw/scsi/scsi-generic.c b/hw/scsi/scsi-generic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/scsi/scsi-generic.c
-+++ b/hw/scsi/scsi-generic.c
-@@ -XXX,XX +XXX,XX @@ done:
- static void scsi_command_complete(void *opaque, int ret)
- {
-     SCSIGenericReq *r = (SCSIGenericReq *)opaque;
-+    SCSIDevice *s = r->req.dev;
-     assert(r->req.aiocb != NULL);
-     r->req.aiocb = NULL;
-+
-+    aio_context_acquire(blk_get_aio_context(s->conf.blk));
-     scsi_command_complete_noio(r, ret);
-+    aio_context_release(blk_get_aio_context(s->conf.blk));
- }
- static int execute_command(BlockBackend *blk,
-@@ -XXX,XX +XXX,XX @@ static void scsi_read_complete(void * opaque, int ret)
-     assert(r->req.aiocb != NULL);
-     r->req.aiocb = NULL;
-+    aio_context_acquire(blk_get_aio_context(s->conf.blk));
-+
-     if (ret || r->req.io_canceled) {
-         scsi_command_complete_noio(r, ret);
--        return;
-+        goto done;
-     }
-     len = r->io_header.dxfer_len - r->io_header.resid;
-@@ -XXX,XX +XXX,XX @@ static void scsi_read_complete(void * opaque, int ret)
-     r->len = -1;
-     if (len == 0) {
-         scsi_command_complete_noio(r, 0);
--        return;
-+        goto done;
-     }
-     /* Snoop READ CAPACITY output to set the blocksize.  */
-@@ -XXX,XX +XXX,XX @@ static void scsi_read_complete(void * opaque, int ret)
-     }
-     scsi_req_data(&r->req, len);
-     scsi_req_unref(&r->req);
-+
-+done:
-+    aio_context_release(blk_get_aio_context(s->conf.blk));
- }
- /* Read more data from scsi device into buffer.  */
-@@ -XXX,XX +XXX,XX @@ static void scsi_write_complete(void * opaque, int ret)
-     assert(r->req.aiocb != NULL);
-     r->req.aiocb = NULL;
-+    aio_context_acquire(blk_get_aio_context(s->conf.blk));
-+
-     if (ret || r->req.io_canceled) {
-         scsi_command_complete_noio(r, ret);
--        return;
-+        goto done;
-     }
-     if (r->req.cmd.buf[0] == MODE_SELECT && r->req.cmd.buf[4] == 12 &&
-@@ -XXX,XX +XXX,XX @@ static void scsi_write_complete(void * opaque, int ret)
-     }
-     scsi_command_complete_noio(r, ret);
-+
-+done:
-+    aio_context_release(blk_get_aio_context(s->conf.blk));
- }
- /* Write data to a scsi device.  Returns nonzero on failure.
-diff --git a/util/thread-pool.c b/util/thread-pool.c
-index XXXXXXX..XXXXXXX 100644
---- a/util/thread-pool.c
-+++ b/util/thread-pool.c
-@@ -XXX,XX +XXX,XX @@ restart:
-              */
-             qemu_bh_schedule(pool->completion_bh);
-+            aio_context_release(pool->ctx);
-             elem->common.cb(elem->common.opaque, elem->ret);
-+            aio_context_acquire(pool->ctx);
-             qemu_aio_unref(elem);
-             goto restart;
-         } else {
-@@ -XXX,XX +XXX,XX @@ static void thread_pool_co_cb(void *opaque, int ret)
-     ThreadPoolCo *co = opaque;
-     co->ret = ret;
--    qemu_coroutine_enter(co->co);
-+    aio_co_wake(co->co);
- }
- int coroutine_fn thread_pool_submit_co(ThreadPool *pool, ThreadPoolFunc *func,
---
-.9.3

-[Qemu-devel] [PULL v2 16/24] aio-posix: partially inline aio_dispatch into aio_poll
+Deleted patch
-From: Paolo Bonzini <pbonzini@redhat.com>
-This patch prepares for the removal of unnecessary lockcnt inc/dec pairs.
-Extract the dispatching loop for file descriptor handlers into a new
-function aio_dispatch_handlers, and then inline aio_dispatch into
-aio_poll.
-aio_dispatch can now become void.
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Reviewed-by: Fam Zheng <famz@redhat.com>
-Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
-Message-id: 20170213135235.12274-17-pbonzini@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- include/block/aio.h |  6 +-----
- util/aio-posix.c    | 44 ++++++++++++++------------------------------
- util/aio-win32.c    | 13 ++++---------
- util/async.c        |  2 +-
-files changed, 20 insertions(+), 45 deletions(-)
-diff --git a/include/block/aio.h b/include/block/aio.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/block/aio.h
-+++ b/include/block/aio.h
-@@ -XXX,XX +XXX,XX @@ bool aio_pending(AioContext *ctx);
- /* Dispatch any pending callbacks from the GSource attached to the AioContext.
-  *
-  * This is used internally in the implementation of the GSource.
-- *
-- * @dispatch_fds: true to process fds, false to skip them
-- *                (can be used as an optimization by callers that know there
-- *                are no fds ready)
-  */
--bool aio_dispatch(AioContext *ctx, bool dispatch_fds);
-+void aio_dispatch(AioContext *ctx);
- /* Progress in completing AIO work to occur.  This can issue new pending
-  * aio as a result of executing I/O completion or bh callbacks.
-diff --git a/util/aio-posix.c b/util/aio-posix.c
-index XXXXXXX..XXXXXXX 100644
---- a/util/aio-posix.c
-+++ b/util/aio-posix.c
-@@ -XXX,XX +XXX,XX @@ static bool aio_dispatch_handlers(AioContext *ctx)
-     AioHandler *node, *tmp;
-     bool progress = false;
--    /*
--     * We have to walk very carefully in case aio_set_fd_handler is
--     * called while we're walking.
--     */
--    qemu_lockcnt_inc(&ctx->list_lock);
--
-     QLIST_FOREACH_SAFE_RCU(node, &ctx->aio_handlers, node, tmp) {
-         int revents;
-@@ -XXX,XX +XXX,XX @@ static bool aio_dispatch_handlers(AioContext *ctx)
-         }
-     }
--    qemu_lockcnt_dec(&ctx->list_lock);
-     return progress;
- }
--/*
-- * Note that dispatch_fds == false has the side-effect of post-poning the
-- * freeing of deleted handlers.
-- */
--bool aio_dispatch(AioContext *ctx, bool dispatch_fds)
-+void aio_dispatch(AioContext *ctx)
- {
--    bool progress;
-+    aio_bh_poll(ctx);
--    /*
--     * If there are callbacks left that have been queued, we need to call them.
--     * Do not call select in this case, because it is possible that the caller
--     * does not need a complete flush (as is the case for aio_poll loops).
--     */
--    progress = aio_bh_poll(ctx);
-+    qemu_lockcnt_inc(&ctx->list_lock);
-+    aio_dispatch_handlers(ctx);
-+    qemu_lockcnt_dec(&ctx->list_lock);
--    if (dispatch_fds) {
--        progress |= aio_dispatch_handlers(ctx);
--    }
--
--    /* Run our timers */
--    progress |= timerlistgroup_run_timers(&ctx->tlg);
--
--    return progress;
-+    timerlistgroup_run_timers(&ctx->tlg);
- }
- /* These thread-local variables are used only in a small part of aio_poll
-@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
-     npfd = 0;
-     qemu_lockcnt_dec(&ctx->list_lock);
--    /* Run dispatch even if there were no readable fds to run timers */
--    if (aio_dispatch(ctx, ret > 0)) {
--        progress = true;
-+    progress |= aio_bh_poll(ctx);
-+
-+    if (ret > 0) {
-+        qemu_lockcnt_inc(&ctx->list_lock);
-+        progress |= aio_dispatch_handlers(ctx);
-+        qemu_lockcnt_dec(&ctx->list_lock);
-     }
-+    progress |= timerlistgroup_run_timers(&ctx->tlg);
-+
-     return progress;
- }
-diff --git a/util/aio-win32.c b/util/aio-win32.c
-index XXXXXXX..XXXXXXX 100644
---- a/util/aio-win32.c
-+++ b/util/aio-win32.c
-@@ -XXX,XX +XXX,XX @@ static bool aio_dispatch_handlers(AioContext *ctx, HANDLE event)
-     return progress;
- }
--bool aio_dispatch(AioContext *ctx, bool dispatch_fds)
-+void aio_dispatch(AioContext *ctx)
- {
--    bool progress;
--
--    progress = aio_bh_poll(ctx);
--    if (dispatch_fds) {
--        progress |= aio_dispatch_handlers(ctx, INVALID_HANDLE_VALUE);
--    }
--    progress |= timerlistgroup_run_timers(&ctx->tlg);
--    return progress;
-+    aio_bh_poll(ctx);
-+    aio_dispatch_handlers(ctx, INVALID_HANDLE_VALUE);
-+    timerlistgroup_run_timers(&ctx->tlg);
- }
- bool aio_poll(AioContext *ctx, bool blocking)
-diff --git a/util/async.c b/util/async.c
-index XXXXXXX..XXXXXXX 100644
---- a/util/async.c
-+++ b/util/async.c
-@@ -XXX,XX +XXX,XX @@ aio_ctx_dispatch(GSource     *source,
-     AioContext *ctx = (AioContext *) source;
-     assert(callback == NULL);
--    aio_dispatch(ctx, true);
-+    aio_dispatch(ctx);
-     return true;
- }
---
-.9.3

-[Qemu-devel] [PULL v2 17/24] async: remove unnecessary inc/dec pairs
+Deleted patch
-From: Paolo Bonzini <pbonzini@redhat.com>
-Pull the increment/decrement pair out of aio_bh_poll and into the
-callers.
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Reviewed-by: Fam Zheng <famz@redhat.com>
-Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
-Message-id: 20170213135235.12274-18-pbonzini@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- util/aio-posix.c |  8 +++-----
- util/aio-win32.c |  8 ++++----
- util/async.c     | 12 ++++++------
-files changed, 13 insertions(+), 15 deletions(-)
-diff --git a/util/aio-posix.c b/util/aio-posix.c
-index XXXXXXX..XXXXXXX 100644
---- a/util/aio-posix.c
-+++ b/util/aio-posix.c
-@@ -XXX,XX +XXX,XX @@ static bool aio_dispatch_handlers(AioContext *ctx)
- void aio_dispatch(AioContext *ctx)
- {
-+    qemu_lockcnt_inc(&ctx->list_lock);
-     aio_bh_poll(ctx);
--
--    qemu_lockcnt_inc(&ctx->list_lock);
-     aio_dispatch_handlers(ctx);
-     qemu_lockcnt_dec(&ctx->list_lock);
-@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
-     }
-     npfd = 0;
--    qemu_lockcnt_dec(&ctx->list_lock);
-     progress |= aio_bh_poll(ctx);
-     if (ret > 0) {
--        qemu_lockcnt_inc(&ctx->list_lock);
-         progress |= aio_dispatch_handlers(ctx);
--        qemu_lockcnt_dec(&ctx->list_lock);
-     }
-+    qemu_lockcnt_dec(&ctx->list_lock);
-+
-     progress |= timerlistgroup_run_timers(&ctx->tlg);
-     return progress;
-diff --git a/util/aio-win32.c b/util/aio-win32.c
-index XXXXXXX..XXXXXXX 100644
---- a/util/aio-win32.c
-+++ b/util/aio-win32.c
-@@ -XXX,XX +XXX,XX @@ static bool aio_dispatch_handlers(AioContext *ctx, HANDLE event)
-     bool progress = false;
-     AioHandler *tmp;
--    qemu_lockcnt_inc(&ctx->list_lock);
--
-     /*
-      * We have to walk very carefully in case aio_set_fd_handler is
-      * called while we're walking.
-@@ -XXX,XX +XXX,XX @@ static bool aio_dispatch_handlers(AioContext *ctx, HANDLE event)
-         }
-     }
--    qemu_lockcnt_dec(&ctx->list_lock);
-     return progress;
- }
- void aio_dispatch(AioContext *ctx)
- {
-+    qemu_lockcnt_inc(&ctx->list_lock);
-     aio_bh_poll(ctx);
-     aio_dispatch_handlers(ctx, INVALID_HANDLE_VALUE);
-+    qemu_lockcnt_dec(&ctx->list_lock);
-     timerlistgroup_run_timers(&ctx->tlg);
- }
-@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
-         }
-     }
--    qemu_lockcnt_dec(&ctx->list_lock);
-     first = true;
-     /* ctx->notifier is always registered.  */
-@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
-         progress |= aio_dispatch_handlers(ctx, event);
-     } while (count > 0);
-+    qemu_lockcnt_dec(&ctx->list_lock);
-+
-     progress |= timerlistgroup_run_timers(&ctx->tlg);
-     return progress;
- }
-diff --git a/util/async.c b/util/async.c
-index XXXXXXX..XXXXXXX 100644
---- a/util/async.c
-+++ b/util/async.c
-@@ -XXX,XX +XXX,XX @@ void aio_bh_call(QEMUBH *bh)
-     bh->cb(bh->opaque);
- }
--/* Multiple occurrences of aio_bh_poll cannot be called concurrently */
-+/* Multiple occurrences of aio_bh_poll cannot be called concurrently.
-+ * The count in ctx->list_lock is incremented before the call, and is
-+ * not affected by the call.
-+ */
- int aio_bh_poll(AioContext *ctx)
- {
-     QEMUBH *bh, **bhp, *next;
-     int ret;
-     bool deleted = false;
--    qemu_lockcnt_inc(&ctx->list_lock);
--
-     ret = 0;
-     for (bh = atomic_rcu_read(&ctx->first_bh); bh; bh = next) {
-         next = atomic_rcu_read(&bh->next);
-@@ -XXX,XX +XXX,XX @@ int aio_bh_poll(AioContext *ctx)
-     /* remove deleted bhs */
-     if (!deleted) {
--        qemu_lockcnt_dec(&ctx->list_lock);
-         return ret;
-     }
--    if (qemu_lockcnt_dec_and_lock(&ctx->list_lock)) {
-+    if (qemu_lockcnt_dec_if_lock(&ctx->list_lock)) {
-         bhp = &ctx->first_bh;
-         while (*bhp) {
-             bh = *bhp;
-@@ -XXX,XX +XXX,XX @@ int aio_bh_poll(AioContext *ctx)
-                 bhp = &bh->next;
-             }
-         }
--        qemu_lockcnt_unlock(&ctx->list_lock);
-+        qemu_lockcnt_inc_and_unlock(&ctx->list_lock);
-     }
-     return ret;
- }
---
-.9.3

-[Qemu-devel] [PULL v2 18/24] block: document fields protected by AioContext lock
+Deleted patch
-From: Paolo Bonzini <pbonzini@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Reviewed-by: Fam Zheng <famz@redhat.com>
-Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
-Message-id: 20170213135235.12274-19-pbonzini@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- include/block/block_int.h      | 64 +++++++++++++++++++++++++-----------------
- include/sysemu/block-backend.h | 14 ++++++---
-files changed, 49 insertions(+), 29 deletions(-)
-diff --git a/include/block/block_int.h b/include/block/block_int.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/block/block_int.h
-+++ b/include/block/block_int.h
-@@ -XXX,XX +XXX,XX @@ struct BdrvChild {
-  * copied as well.
-  */
- struct BlockDriverState {
--    int64_t total_sectors; /* if we are reading a disk image, give its
--                              size in sectors */
-+    /* Protected by big QEMU lock or read-only after opening.  No special
-+     * locking needed during I/O...
-+     */
-     int open_flags; /* flags used to open the file, re-used for re-open */
-     bool read_only; /* if true, the media is read only */
-     bool encrypted; /* if true, the media is encrypted */
-@@ -XXX,XX +XXX,XX @@ struct BlockDriverState {
-     bool sg;        /* if true, the device is a /dev/sg* */
-     bool probed;    /* if true, format was probed rather than specified */
--    int copy_on_read; /* if nonzero, copy read backing sectors into image.
--                         note this is a reference count */
--
--    CoQueue flush_queue;            /* Serializing flush queue */
--    bool active_flush_req;          /* Flush request in flight? */
--    unsigned int write_gen;         /* Current data generation */
--    unsigned int flushed_gen;       /* Flushed write generation */
--
-     BlockDriver *drv; /* NULL means no media */
-     void *opaque;
-@@ -XXX,XX +XXX,XX @@ struct BlockDriverState {
-     BdrvChild *backing;
-     BdrvChild *file;
--    /* Callback before write request is processed */
--    NotifierWithReturnList before_write_notifiers;
--
--    /* number of in-flight requests; overall and serialising */
--    unsigned int in_flight;
--    unsigned int serialising_in_flight;
--
--    bool wakeup;
--
--    /* Offset after the highest byte written to */
--    uint64_t wr_highest_offset;
--
-     /* I/O Limits */
-     BlockLimits bl;
-@@ -XXX,XX +XXX,XX @@ struct BlockDriverState {
-     QTAILQ_ENTRY(BlockDriverState) bs_list;
-     /* element of the list of monitor-owned BDS */
-     QTAILQ_ENTRY(BlockDriverState) monitor_list;
--    QLIST_HEAD(, BdrvDirtyBitmap) dirty_bitmaps;
-     int refcnt;
--    QLIST_HEAD(, BdrvTrackedRequest) tracked_requests;
--
-     /* operation blockers */
-     QLIST_HEAD(, BdrvOpBlocker) op_blockers[BLOCK_OP_TYPE_MAX];
-@@ -XXX,XX +XXX,XX @@ struct BlockDriverState {
-     /* The error object in use for blocking operations on backing_hd */
-     Error *backing_blocker;
-+    /* Protected by AioContext lock */
-+
-+    /* If true, copy read backing sectors into image.  Can be >1 if more
-+     * than one client has requested copy-on-read.
-+     */
-+    int copy_on_read;
-+
-+    /* If we are reading a disk image, give its size in sectors.
-+     * Generally read-only; it is written to by load_vmstate and save_vmstate,
-+     * but the block layer is quiescent during those.
-+     */
-+    int64_t total_sectors;
-+
-+    /* Callback before write request is processed */
-+    NotifierWithReturnList before_write_notifiers;
-+
-+    /* number of in-flight requests; overall and serialising */
-+    unsigned int in_flight;
-+    unsigned int serialising_in_flight;
-+
-+    bool wakeup;
-+
-+    /* Offset after the highest byte written to */
-+    uint64_t wr_highest_offset;
-+
-     /* threshold limit for writes, in bytes. "High water mark". */
-     uint64_t write_threshold_offset;
-     NotifierWithReturn write_threshold_notifier;
-@@ -XXX,XX +XXX,XX @@ struct BlockDriverState {
-     /* counter for nested bdrv_io_plug */
-     unsigned io_plugged;
-+    QLIST_HEAD(, BdrvTrackedRequest) tracked_requests;
-+    CoQueue flush_queue;                  /* Serializing flush queue */
-+    bool active_flush_req;                /* Flush request in flight? */
-+    unsigned int write_gen;               /* Current data generation */
-+    unsigned int flushed_gen;             /* Flushed write generation */
-+
-+    QLIST_HEAD(, BdrvDirtyBitmap) dirty_bitmaps;
-+
-+    /* do we need to tell the quest if we have a volatile write cache? */
-+    int enable_write_cache;
-+
-     int quiesce_counter;
- };
-diff --git a/include/sysemu/block-backend.h b/include/sysemu/block-backend.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/sysemu/block-backend.h
-+++ b/include/sysemu/block-backend.h
-@@ -XXX,XX +XXX,XX @@ typedef struct BlockDevOps {
-  * fields that must be public. This is in particular for QLIST_ENTRY() and
-  * friends so that BlockBackends can be kept in lists outside block-backend.c */
- typedef struct BlockBackendPublic {
--    /* I/O throttling.
--     * throttle_state tells us if this BlockBackend has I/O limits configured.
--     * io_limits_disabled tells us if they are currently being enforced */
-+    /* I/O throttling has its own locking, but also some fields are
-+     * protected by the AioContext lock.
-+     */
-+
-+    /* Protected by AioContext lock.  */
-     CoQueue      throttled_reqs[2];
-+
-+    /* Nonzero if the I/O limits are currently being ignored; generally
-+     * it is zero.  */
-     unsigned int io_limits_disabled;
-     /* The following fields are protected by the ThrottleGroup lock.
--     * See the ThrottleGroup documentation for details. */
-+     * See the ThrottleGroup documentation for details.
-+     * throttle_state tells us if I/O limits are configured. */
-     ThrottleState *throttle_state;
-     ThrottleTimers throttle_timers;
-     unsigned       pending_reqs[2];
---
-.9.3

-[Qemu-devel] [PULL v2 20/24] coroutine-lock: add limited spinning to CoMutex
+[Qemu-devel] [PULL v2 8/8] iotests: Fix 205 for concurrent runs
-From: Paolo Bonzini <pbonzini@redhat.com>
+Tests should place their files into the test directory.  This includes
 Unix sockets.  205 currently fails to do so, which prevents it from
 being run concurrently.
-Running a very small critical section on pthread_mutex_t and CoMutex
+Signed-off-by: Max Reitz <mreitz@redhat.com>
-shows that pthread_mutex_t is much faster because it doesn't actually
+Message-id: 20190618210238.9524-1-mreitz@redhat.com
-go to sleep.  What happens is that the critical section is shorter
+Reviewed-by: Eric Blake <eblake@redhat.com>
-than the latency of entering the kernel and thus FUTEX_WAIT always
+Signed-off-by: Max Reitz <mreitz@redhat.com>
-fails.  With CoMutex there is no such latency but you still want to
+---
-avoid wait and wakeup.  So introduce it artificially.
+ tests/qemu-iotests/205 | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-This only works with one waiters; because CoMutex is fair, it will
+diff --git a/tests/qemu-iotests/205 b/tests/qemu-iotests/205
-always have more waits and wakeups than a pthread_mutex_t.
+index XXXXXXX..XXXXXXX 100755
+--- a/tests/qemu-iotests/205
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
++++ b/tests/qemu-iotests/205
-Reviewed-by: Fam Zheng <famz@redhat.com>
+@@ -XXX,XX +XXX,XX @@ import iotests
-Message-id: 20170213181244.16297-3-pbonzini@redhat.com
+ import time
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+ from iotests import qemu_img_create, qemu_io, filter_qemu_io, QemuIoInteractive
----
- include/qemu/coroutine.h   |  5 +++++
+-nbd_sock = 'nbd_sock'
- util/qemu-coroutine-lock.c | 51 ++++++++++++++++++++++++++++++++++++++++------
++nbd_sock = os.path.join(iotests.test_dir, 'nbd_sock')
- util/qemu-coroutine.c      |  2 +-
+ nbd_uri = 'nbd+unix:///exp?socket=' + nbd_sock
-files changed, 51 insertions(+), 7 deletions(-)
+ disk = os.path.join(iotests.test_dir, 'disk')
 diff --git a/include/qemu/coroutine.h b/include/qemu/coroutine.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/qemu/coroutine.h
 +++ b/include/qemu/coroutine.h
@@ -XXX,XX +XXX,XX @@ typedef struct CoMutex {
       */
      unsigned locked;
 +    /* Context that is holding the lock.  Useful to avoid spinning
 +     * when two coroutines on the same AioContext try to get the lock. :)
 +     */
 +    AioContext *ctx;
 +
      /* A queue of waiters.  Elements are added atomically in front of
       * from_push.  to_pop is only populated, and popped from, by whoever
       * is in charge of the next wakeup.  This can be an unlocker or,
 diff --git a/util/qemu-coroutine-lock.c b/util/qemu-coroutine-lock.c
 index XXXXXXX..XXXXXXX 100644
 --- a/util/qemu-coroutine-lock.c
 +++ b/util/qemu-coroutine-lock.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu-common.h"
  #include "qemu/coroutine.h"
  #include "qemu/coroutine_int.h"
 +#include "qemu/processor.h"
  #include "qemu/queue.h"
  #include "block/aio.h"
  #include "trace.h"
@@ -XXX,XX +XXX,XX @@ void qemu_co_mutex_init(CoMutex *mutex)
      memset(mutex, 0, sizeof(*mutex));
  }
 -static void coroutine_fn qemu_co_mutex_lock_slowpath(CoMutex *mutex)
 +static void coroutine_fn qemu_co_mutex_wake(CoMutex *mutex, Coroutine *co)
 +{
 +    /* Read co before co->ctx; pairs with smp_wmb() in
 +     * qemu_coroutine_enter().
 +     */
 +    smp_read_barrier_depends();
 +    mutex->ctx = co->ctx;
 +    aio_co_wake(co);
 +}
 +
 +static void coroutine_fn qemu_co_mutex_lock_slowpath(AioContext *ctx,
 +                                                     CoMutex *mutex)
  {
      Coroutine *self = qemu_coroutine_self();
      CoWaitRecord w;
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn qemu_co_mutex_lock_slowpath(CoMutex *mutex)
          if (co == self) {
              /* We got the lock ourselves!  */
              assert(to_wake == &w);
 +            mutex->ctx = ctx;
              return;
          }
 -        aio_co_wake(co);
 +        qemu_co_mutex_wake(mutex, co);
      }
      qemu_coroutine_yield();
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn qemu_co_mutex_lock_slowpath(CoMutex *mutex)
  void coroutine_fn qemu_co_mutex_lock(CoMutex *mutex)
  {
 +    AioContext *ctx = qemu_get_current_aio_context();
      Coroutine *self = qemu_coroutine_self();
 +    int waiters, i;
 -    if (atomic_fetch_inc(&mutex->locked) == 0) {
 +    /* Running a very small critical section on pthread_mutex_t and CoMutex
 +     * shows that pthread_mutex_t is much faster because it doesn't actually
 +     * go to sleep.  What happens is that the critical section is shorter
 +     * than the latency of entering the kernel and thus FUTEX_WAIT always
 +     * fails.  With CoMutex there is no such latency but you still want to
 +     * avoid wait and wakeup.  So introduce it artificially.
 +     */
 +    i = 0;
 +retry_fast_path:
 +    waiters = atomic_cmpxchg(&mutex->locked, 0, 1);
 +    if (waiters != 0) {
 +        while (waiters == 1 && ++i < 1000) {
 +            if (atomic_read(&mutex->ctx) == ctx) {
 +                break;
 +            }
 +            if (atomic_read(&mutex->locked) == 0) {
 +                goto retry_fast_path;
 +            }
 +            cpu_relax();
 +        }
 +        waiters = atomic_fetch_inc(&mutex->locked);
 +    }
 +
 +    if (waiters == 0) {
          /* Uncontended.  */
          trace_qemu_co_mutex_lock_uncontended(mutex, self);
 +        mutex->ctx = ctx;
      } else {
 -        qemu_co_mutex_lock_slowpath(mutex);
 +        qemu_co_mutex_lock_slowpath(ctx, mutex);
      }
      mutex->holder = self;
      self->locks_held++;
@@ -XXX,XX +XXX,XX @@ void coroutine_fn qemu_co_mutex_unlock(CoMutex *mutex)
      assert(mutex->holder == self);
      assert(qemu_in_coroutine());
 +    mutex->ctx = NULL;
      mutex->holder = NULL;
      self->locks_held--;
      if (atomic_fetch_dec(&mutex->locked) == 1) {
@@ -XXX,XX +XXX,XX @@ void coroutine_fn qemu_co_mutex_unlock(CoMutex *mutex)
          unsigned our_handoff;
          if (to_wake) {
 -            Coroutine *co = to_wake->co;
 -            aio_co_wake(co);
 +            qemu_co_mutex_wake(mutex, to_wake->co);
              break;
          }
 diff --git a/util/qemu-coroutine.c b/util/qemu-coroutine.c
 index XXXXXXX..XXXXXXX 100644
 --- a/util/qemu-coroutine.c
 +++ b/util/qemu-coroutine.c
@@ -XXX,XX +XXX,XX @@ void qemu_coroutine_enter(Coroutine *co)
      co->ctx = qemu_get_current_aio_context();
      /* Store co->ctx before anything that stores co.  Matches
 -     * barrier in aio_co_wake.
 +     * barrier in aio_co_wake and qemu_co_mutex_wake.
       */
      smp_wmb();
 --
-.9.3
+.21.0

The following changes since commit 56f9e46b841c7be478ca038d8d4085d776ab4b0d:

Merge remote-tracking branch 'remotes/armbru/tags/pull-qapi-2017-02-20' into staging (2017-02-20 17:42:47 +0000)

are available in the git repository at:

git://github.com/stefanha/qemu.git tags/block-pull-request

for you to fetch changes up to a7b91d35bab97a2d3e779d0c64c9b837b52a6cf7:

coroutine-lock: make CoRwlock thread-safe and fair (2017-02-21 11:39:40 +0000)

----------------------------------------------------------------
Pull request

v2:
 * Rebased to resolve scsi conflicts

----------------------------------------------------------------

Paolo Bonzini (24):
  block: move AioContext, QEMUTimer, main-loop to libqemuutil
  aio: introduce aio_co_schedule and aio_co_wake
  block-backend: allow blk_prw from coroutine context
  test-thread-pool: use generic AioContext infrastructure
  io: add methods to set I/O handlers on AioContext
  io: make qio_channel_yield aware of AioContexts
  nbd: convert to use qio_channel_yield
  coroutine-lock: reschedule coroutine on the AioContext it was running
    on
  blkdebug: reschedule coroutine on the AioContext it is running on
  qed: introduce qed_aio_start_io and qed_aio_next_io_cb
  aio: push aio_context_acquire/release down to dispatching
  block: explicitly acquire aiocontext in timers that need it
  block: explicitly acquire aiocontext in callbacks that need it
  block: explicitly acquire aiocontext in bottom halves that need it
  block: explicitly acquire aiocontext in aio callbacks that need it
  aio-posix: partially inline aio_dispatch into aio_poll
  async: remove unnecessary inc/dec pairs
  block: document fields protected by AioContext lock
  coroutine-lock: make CoMutex thread-safe
  coroutine-lock: add limited spinning to CoMutex
  test-aio-multithread: add performance comparison with thread-based
    mutexes
  coroutine-lock: place CoMutex before CoQueue in header
  coroutine-lock: add mutex argument to CoQueue APIs
  coroutine-lock: make CoRwlock thread-safe and fair

-- 
2.9.3

From: Paolo Bonzini <pbonzini@redhat.com>

AioContext is fairly self contained, the only dependency is QEMUTimer but
that in turn doesn't need anything else.  So move them out of block-obj-y
to avoid introducing a dependency from io/ to block-obj-y.

main-loop and its dependency iohandler also need to be moved, because
later in this series io/ will call iohandler_get_aio_context.

[Changed copyright "the QEMU team" to "other QEMU contributors" as
suggested by Daniel Berrange and agreed by Paolo.
--Stefan]

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Message-id: 20170213135235.12274-2-pbonzini@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 Makefile.objs                       |  4 ---
 stubs/Makefile.objs                 |  1 +
 tests/Makefile.include              | 11 ++++----
 util/Makefile.objs                  |  6 +++-
 block/io.c                          | 29 -------------------
 stubs/linux-aio.c                   | 32 +++++++++++++++++++++
 stubs/set-fd-handler.c              | 11 --------
 aio-posix.c => util/aio-posix.c     |  2 +-
 aio-win32.c => util/aio-win32.c     |  0
 util/aiocb.c                        | 55 +++++++++++++++++++++++++++++++++++++
 async.c => util/async.c             |  3 +-
 iohandler.c => util/iohandler.c     |  0
 main-loop.c => util/main-loop.c     |  0
 qemu-timer.c => util/qemu-timer.c   |  0
 thread-pool.c => util/thread-pool.c |  2 +-
 trace-events                        | 11 --------
 util/trace-events                   | 11 ++++++++
 17 files changed, 114 insertions(+), 64 deletions(-)
 create mode 100644 stubs/linux-aio.c
 rename aio-posix.c => util/aio-posix.c (99%)
 rename aio-win32.c => util/aio-win32.c (100%)
 create mode 100644 util/aiocb.c
 rename async.c => util/async.c (99%)
 rename iohandler.c => util/iohandler.c (100%)
 rename main-loop.c => util/main-loop.c (100%)
 rename qemu-timer.c => util/qemu-timer.c (100%)
 rename thread-pool.c => util/thread-pool.c (99%)

diff --git a/Makefile.objs b/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/Makefile.objs
+++ b/Makefile.objs
@@ -XXX,XX +XXX,XX @@ chardev-obj-y = chardev/
 #######################################################################
 # block-obj-y is code used by both qemu system emulation and qemu-img
 
-block-obj-y = async.o thread-pool.o
 block-obj-y += nbd/
 block-obj-y += block.o blockjob.o
-block-obj-y += main-loop.o iohandler.o qemu-timer.o
-block-obj-$(CONFIG_POSIX) += aio-posix.o
-block-obj-$(CONFIG_WIN32) += aio-win32.o
 block-obj-y += block/
 block-obj-y += qemu-io-cmds.o
 block-obj-$(CONFIG_REPLICATION) += replication.o
diff --git a/stubs/Makefile.objs b/stubs/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/stubs/Makefile.objs
+++ b/stubs/Makefile.objs
@@ -XXX,XX +XXX,XX @@ stub-obj-y += get-vm-name.o
 stub-obj-y += iothread.o
 stub-obj-y += iothread-lock.o
 stub-obj-y += is-daemonized.o
+stub-obj-$(CONFIG_LINUX_AIO) += linux-aio.o
 stub-obj-y += machine-init-done.o
 stub-obj-y += migr-blocker.o
 stub-obj-y += monitor.o
diff --git a/tests/Makefile.include b/tests/Makefile.include
index XXXXXXX..XXXXXXX 100644
--- a/tests/Makefile.include
+++ b/tests/Makefile.include
@@ -XXX,XX +XXX,XX @@ check-unit-y += tests/test-visitor-serialization$(EXESUF)
 check-unit-y += tests/test-iov$(EXESUF)
 gcov-files-test-iov-y = util/iov.c
 check-unit-y += tests/test-aio$(EXESUF)
+gcov-files-test-aio-y = util/async.c util/qemu-timer.o
+gcov-files-test-aio-$(CONFIG_WIN32) += util/aio-win32.c
+gcov-files-test-aio-$(CONFIG_POSIX) += util/aio-posix.c
 check-unit-y += tests/test-throttle$(EXESUF)
 gcov-files-test-aio-$(CONFIG_WIN32) = aio-win32.c
 gcov-files-test-aio-$(CONFIG_POSIX) = aio-posix.c
@@ -XXX,XX +XXX,XX @@ tests/check-qjson$(EXESUF): tests/check-qjson.o $(test-util-obj-y)
 tests/check-qom-interface$(EXESUF): tests/check-qom-interface.o $(test-qom-obj-y)
 tests/check-qom-proplist$(EXESUF): tests/check-qom-proplist.o $(test-qom-obj-y)
 
-tests/test-char$(EXESUF): tests/test-char.o qemu-timer.o \
-	$(test-util-obj-y) $(qtest-obj-y) $(test-block-obj-y) $(chardev-obj-y)
+tests/test-char$(EXESUF): tests/test-char.o $(test-util-obj-y) $(qtest-obj-y) $(test-io-obj-y) $(chardev-obj-y)
 tests/test-coroutine$(EXESUF): tests/test-coroutine.o $(test-block-obj-y)
 tests/test-aio$(EXESUF): tests/test-aio.o $(test-block-obj-y)
 tests/test-throttle$(EXESUF): tests/test-throttle.o $(test-block-obj-y)
@@ -XXX,XX +XXX,XX @@ tests/test-vmstate$(EXESUF): tests/test-vmstate.o \
 	migration/vmstate.o migration/qemu-file.o \
         migration/qemu-file-channel.o migration/qjson.o \
 	$(test-io-obj-y)
-tests/test-timed-average$(EXESUF): tests/test-timed-average.o qemu-timer.o \
-	$(test-util-obj-y)
+tests/test-timed-average$(EXESUF): tests/test-timed-average.o $(test-util-obj-y)
 tests/test-base64$(EXESUF): tests/test-base64.o \
 	libqemuutil.a libqemustub.a
 tests/ptimer-test$(EXESUF): tests/ptimer-test.o tests/ptimer-test-stubs.o hw/core/ptimer.o libqemustub.a
@@ -XXX,XX +XXX,XX @@ tests/usb-hcd-ehci-test$(EXESUF): tests/usb-hcd-ehci-test.o $(libqos-usb-obj-y)
 tests/usb-hcd-xhci-test$(EXESUF): tests/usb-hcd-xhci-test.o $(libqos-usb-obj-y)
 tests/pc-cpu-test$(EXESUF): tests/pc-cpu-test.o
 tests/postcopy-test$(EXESUF): tests/postcopy-test.o
-tests/vhost-user-test$(EXESUF): tests/vhost-user-test.o qemu-timer.o \
+tests/vhost-user-test$(EXESUF): tests/vhost-user-test.o $(test-util-obj-y) \
 	$(qtest-obj-y) $(test-io-obj-y) $(libqos-virtio-obj-y) $(libqos-pc-obj-y) \
 	$(chardev-obj-y)
 tests/qemu-iotests/socket_scm_helper$(EXESUF): tests/qemu-iotests/socket_scm_helper.o
diff --git a/util/Makefile.objs b/util/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/util/Makefile.objs
+++ b/util/Makefile.objs
@@ -XXX,XX +XXX,XX @@
 util-obj-y = osdep.o cutils.o unicode.o qemu-timer-common.o
 util-obj-y += bufferiszero.o
 util-obj-y += lockcnt.o
+util-obj-y += aiocb.o async.o thread-pool.o qemu-timer.o
+util-obj-y += main-loop.o iohandler.o
+util-obj-$(CONFIG_POSIX) += aio-posix.o
 util-obj-$(CONFIG_POSIX) += compatfd.o
 util-obj-$(CONFIG_POSIX) += event_notifier-posix.o
 util-obj-$(CONFIG_POSIX) += mmap-alloc.o
 util-obj-$(CONFIG_POSIX) += oslib-posix.o
 util-obj-$(CONFIG_POSIX) += qemu-openpty.o
 util-obj-$(CONFIG_POSIX) += qemu-thread-posix.o
-util-obj-$(CONFIG_WIN32) += event_notifier-win32.o
 util-obj-$(CONFIG_POSIX) += memfd.o
+util-obj-$(CONFIG_WIN32) += aio-win32.o
+util-obj-$(CONFIG_WIN32) += event_notifier-win32.o
 util-obj-$(CONFIG_WIN32) += oslib-win32.o
 util-obj-$(CONFIG_WIN32) += qemu-thread-win32.o
 util-obj-y += envlist.o path.o module.o
diff --git a/block/io.c b/block/io.c
index XXXXXXX..XXXXXXX 100644
--- a/block/io.c
+++ b/block/io.c
@@ -XXX,XX +XXX,XX @@ BlockAIOCB *bdrv_aio_flush(BlockDriverState *bs,
     return &acb->common;
 }
 
-void *qemu_aio_get(const AIOCBInfo *aiocb_info, BlockDriverState *bs,
-                   BlockCompletionFunc *cb, void *opaque)
-{
-    BlockAIOCB *acb;
-
-    acb = g_malloc(aiocb_info->aiocb_size);
-    acb->aiocb_info = aiocb_info;
-    acb->bs = bs;
-    acb->cb = cb;
-    acb->opaque = opaque;
-    acb->refcnt = 1;
-    return acb;
-}
-
-void qemu_aio_ref(void *p)
-{
-    BlockAIOCB *acb = p;
-    acb->refcnt++;
-}
-
-void qemu_aio_unref(void *p)
-{
-    BlockAIOCB *acb = p;
-    assert(acb->refcnt > 0);
-    if (--acb->refcnt == 0) {
-        g_free(acb);
-    }
-}
-
 /**************************************************************/
 /* Coroutine block device emulation */
 
diff --git a/stubs/linux-aio.c b/stubs/linux-aio.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/stubs/linux-aio.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Linux native AIO support.
+ *
+ * Copyright (C) 2009 IBM, Corp.
+ * Copyright (C) 2009 Red Hat, Inc.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+#include "qemu/osdep.h"
+#include "block/aio.h"
+#include "block/raw-aio.h"
+
+void laio_detach_aio_context(LinuxAioState *s, AioContext *old_context)
+{
+    abort();
+}
+
+void laio_attach_aio_context(LinuxAioState *s, AioContext *new_context)
+{
+    abort();
+}
+
+LinuxAioState *laio_init(void)
+{
+    abort();
+}
+
+void laio_cleanup(LinuxAioState *s)
+{
+    abort();
+}
diff --git a/stubs/set-fd-handler.c b/stubs/set-fd-handler.c
index XXXXXXX..XXXXXXX 100644
--- a/stubs/set-fd-handler.c
+++ b/stubs/set-fd-handler.c
@@ -XXX,XX +XXX,XX @@ void qemu_set_fd_handler(int fd,
 {
     abort();
 }
-
-void aio_set_fd_handler(AioContext *ctx,
-                        int fd,
-                        bool is_external,
-                        IOHandler *io_read,
-                        IOHandler *io_write,
-                        AioPollFn *io_poll,
-                        void *opaque)
-{
-    abort();
-}
diff --git a/aio-posix.c b/util/aio-posix.c
similarity index 99%
rename from aio-posix.c
rename to util/aio-posix.c
index XXXXXXX..XXXXXXX 100644
--- a/aio-posix.c
+++ b/util/aio-posix.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/rcu_queue.h"
 #include "qemu/sockets.h"
 #include "qemu/cutils.h"
-#include "trace-root.h"
+#include "trace.h"
 #ifdef CONFIG_EPOLL_CREATE1
 #include <sys/epoll.h>
 #endif
diff --git a/aio-win32.c b/util/aio-win32.c
similarity index 100%
rename from aio-win32.c
rename to util/aio-win32.c
diff --git a/util/aiocb.c b/util/aiocb.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/util/aiocb.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * BlockAIOCB allocation
+ *
+ * Copyright (c) 2003-2017 Fabrice Bellard and other QEMU contributors
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+#include "block/aio.h"
+
+void *qemu_aio_get(const AIOCBInfo *aiocb_info, BlockDriverState *bs,
+                   BlockCompletionFunc *cb, void *opaque)
+{
+    BlockAIOCB *acb;
+
+    acb = g_malloc(aiocb_info->aiocb_size);
+    acb->aiocb_info = aiocb_info;
+    acb->bs = bs;
+    acb->cb = cb;
+    acb->opaque = opaque;
+    acb->refcnt = 1;
+    return acb;
+}
+
+void qemu_aio_ref(void *p)
+{
+    BlockAIOCB *acb = p;
+    acb->refcnt++;
+}
+
+void qemu_aio_unref(void *p)
+{
+    BlockAIOCB *acb = p;
+    assert(acb->refcnt > 0);
+    if (--acb->refcnt == 0) {
+        g_free(acb);
+    }
+}
diff --git a/async.c b/util/async.c
similarity index 99%
rename from async.c
rename to util/async.c
index XXXXXXX..XXXXXXX 100644
--- a/async.c
+++ b/util/async.c
@@ -XXX,XX +XXX,XX @@
 /*
- * QEMU System Emulator
+ * Data plane event loop
  *
  * Copyright (c) 2003-2008 Fabrice Bellard
+ * Copyright (c) 2009-2017 QEMU contributors
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
diff --git a/iohandler.c b/util/iohandler.c
similarity index 100%
rename from iohandler.c
rename to util/iohandler.c
diff --git a/main-loop.c b/util/main-loop.c
similarity index 100%
rename from main-loop.c
rename to util/main-loop.c
diff --git a/qemu-timer.c b/util/qemu-timer.c
similarity index 100%
rename from qemu-timer.c
rename to util/qemu-timer.c
diff --git a/thread-pool.c b/util/thread-pool.c
similarity index 99%
rename from thread-pool.c
rename to util/thread-pool.c
index XXXXXXX..XXXXXXX 100644
--- a/thread-pool.c
+++ b/util/thread-pool.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/queue.h"
 #include "qemu/thread.h"
 #include "qemu/coroutine.h"
-#include "trace-root.h"
+#include "trace.h"
 #include "block/thread-pool.h"
 #include "qemu/main-loop.h"
 
diff --git a/trace-events b/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/trace-events
+++ b/trace-events
@@ -XXX,XX +XXX,XX @@
 #
 # The <format-string> should be a sprintf()-compatible format string.
 
-# aio-posix.c
-run_poll_handlers_begin(void *ctx, int64_t max_ns) "ctx %p max_ns %"PRId64
-run_poll_handlers_end(void *ctx, bool progress) "ctx %p progress %d"
-poll_shrink(void *ctx, int64_t old, int64_t new) "ctx %p old %"PRId64" new %"PRId64
-poll_grow(void *ctx, int64_t old, int64_t new) "ctx %p old %"PRId64" new %"PRId64
-
-# thread-pool.c
-thread_pool_submit(void *pool, void *req, void *opaque) "pool %p req %p opaque %p"
-thread_pool_complete(void *pool, void *req, void *opaque, int ret) "pool %p req %p opaque %p ret %d"
-thread_pool_cancel(void *req, void *opaque) "req %p opaque %p"
-
 # ioport.c
 cpu_in(unsigned int addr, char size, unsigned int val) "addr %#x(%c) value %u"
 cpu_out(unsigned int addr, char size, unsigned int val) "addr %#x(%c) value %u"
diff --git a/util/trace-events b/util/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/util/trace-events
+++ b/util/trace-events
@@ -XXX,XX +XXX,XX @@
 # See docs/tracing.txt for syntax documentation.
 
+# util/aio-posix.c
+run_poll_handlers_begin(void *ctx, int64_t max_ns) "ctx %p max_ns %"PRId64
+run_poll_handlers_end(void *ctx, bool progress) "ctx %p progress %d"
+poll_shrink(void *ctx, int64_t old, int64_t new) "ctx %p old %"PRId64" new %"PRId64
+poll_grow(void *ctx, int64_t old, int64_t new) "ctx %p old %"PRId64" new %"PRId64
+
+# util/thread-pool.c
+thread_pool_submit(void *pool, void *req, void *opaque) "pool %p req %p opaque %p"
+thread_pool_complete(void *pool, void *req, void *opaque, int ret) "pool %p req %p opaque %p ret %d"
+thread_pool_cancel(void *req, void *opaque) "req %p opaque %p"
+
 # util/buffer.c
 buffer_resize(const char *buf, size_t olen, size_t len) "%s: old %zd, new %zd"
 buffer_move_empty(const char *buf, size_t len, const char *from) "%s: %zd bytes from %s"
-- 
2.9.3

From: Paolo Bonzini <pbonzini@redhat.com>

aio_co_wake provides the infrastructure to start a coroutine on a "home"
AioContext.  It will be used by CoMutex and CoQueue, so that coroutines
don't jump from one context to another when they go to sleep on a
mutex or waitqueue.  However, it can also be used as a more efficient
alternative to one-shot bottom halves, and saves the effort of tracking
which AioContext a coroutine is running on.

aio_co_schedule is the part of aio_co_wake that starts a coroutine
on a remove AioContext, but it is also useful to implement e.g.
bdrv_set_aio_context callbacks.

The implementation of aio_co_schedule is based on a lock-free
multiple-producer, single-consumer queue.  The multiple producers use
cmpxchg to add to a LIFO stack.  The consumer (a per-AioContext bottom
half) grabs all items added so far, inverts the list to make it FIFO,
and goes through it one item at a time until it's empty.  The data
structure was inspired by OSv, which uses it in the very code we'll
"port" to QEMU for the thread-safe CoMutex.

Most of the new code is really tests.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Message-id: 20170213135235.12274-3-pbonzini@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 tests/Makefile.include       |   8 +-
 include/block/aio.h          |  32 +++++++
 include/qemu/coroutine_int.h |  11 ++-
 tests/iothread.h             |  25 +++++
 tests/iothread.c             |  91 ++++++++++++++++++
 tests/test-aio-multithread.c | 213 +++++++++++++++++++++++++++++++++++++++++++
 util/async.c                 |  65 +++++++++++++
 util/qemu-coroutine.c        |   8 ++
 util/trace-events            |   4 +
 9 files changed, 453 insertions(+), 4 deletions(-)
 create mode 100644 tests/iothread.h
 create mode 100644 tests/iothread.c
 create mode 100644 tests/test-aio-multithread.c

diff --git a/tests/Makefile.include b/tests/Makefile.include
index XXXXXXX..XXXXXXX 100644
--- a/tests/Makefile.include
+++ b/tests/Makefile.include
@@ -XXX,XX +XXX,XX @@ check-unit-y += tests/test-aio$(EXESUF)
 gcov-files-test-aio-y = util/async.c util/qemu-timer.o
 gcov-files-test-aio-$(CONFIG_WIN32) += util/aio-win32.c
 gcov-files-test-aio-$(CONFIG_POSIX) += util/aio-posix.c
+check-unit-y += tests/test-aio-multithread$(EXESUF)
+gcov-files-test-aio-multithread-y = $(gcov-files-test-aio-y)
+gcov-files-test-aio-multithread-y += util/qemu-coroutine.c tests/iothread.c
 check-unit-y += tests/test-throttle$(EXESUF)
-gcov-files-test-aio-$(CONFIG_WIN32) = aio-win32.c
-gcov-files-test-aio-$(CONFIG_POSIX) = aio-posix.c
 check-unit-y += tests/test-thread-pool$(EXESUF)
 gcov-files-test-thread-pool-y = thread-pool.c
 gcov-files-test-hbitmap-y = util/hbitmap.c
@@ -XXX,XX +XXX,XX @@ test-qapi-obj-y = tests/test-qapi-visit.o tests/test-qapi-types.o \
 	$(test-qom-obj-y)
 test-crypto-obj-y = $(crypto-obj-y) $(test-qom-obj-y)
 test-io-obj-y = $(io-obj-y) $(test-crypto-obj-y)
-test-block-obj-y = $(block-obj-y) $(test-io-obj-y)
+test-block-obj-y = $(block-obj-y) $(test-io-obj-y) tests/iothread.o
 
 tests/check-qint$(EXESUF): tests/check-qint.o $(test-util-obj-y)
 tests/check-qstring$(EXESUF): tests/check-qstring.o $(test-util-obj-y)
@@ -XXX,XX +XXX,XX @@ tests/check-qom-proplist$(EXESUF): tests/check-qom-proplist.o $(test-qom-obj-y)
 tests/test-char$(EXESUF): tests/test-char.o $(test-util-obj-y) $(qtest-obj-y) $(test-io-obj-y) $(chardev-obj-y)
 tests/test-coroutine$(EXESUF): tests/test-coroutine.o $(test-block-obj-y)
 tests/test-aio$(EXESUF): tests/test-aio.o $(test-block-obj-y)
+tests/test-aio-multithread$(EXESUF): tests/test-aio-multithread.o $(test-block-obj-y)
 tests/test-throttle$(EXESUF): tests/test-throttle.o $(test-block-obj-y)
 tests/test-blockjob$(EXESUF): tests/test-blockjob.o $(test-block-obj-y) $(test-util-obj-y)
 tests/test-blockjob-txn$(EXESUF): tests/test-blockjob-txn.o $(test-block-obj-y) $(test-util-obj-y)
diff --git a/include/block/aio.h b/include/block/aio.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/aio.h
+++ b/include/block/aio.h
@@ -XXX,XX +XXX,XX @@ typedef void QEMUBHFunc(void *opaque);
 typedef bool AioPollFn(void *opaque);
 typedef void IOHandler(void *opaque);
 
+struct Coroutine;
 struct ThreadPool;
 struct LinuxAioState;
 
@@ -XXX,XX +XXX,XX @@ struct AioContext {
     bool notified;
     EventNotifier notifier;
 
+    QSLIST_HEAD(, Coroutine) scheduled_coroutines;
+    QEMUBH *co_schedule_bh;
+
     /* Thread pool for performing work and receiving completion callbacks.
      * Has its own locking.
      */
@@ -XXX,XX +XXX,XX @@ static inline bool aio_node_check(AioContext *ctx, bool is_external)
 }
 
 /**
+ * aio_co_schedule:
+ * @ctx: the aio context
+ * @co: the coroutine
+ *
+ * Start a coroutine on a remote AioContext.
+ *
+ * The coroutine must not be entered by anyone else while aio_co_schedule()
+ * is active.  In addition the coroutine must have yielded unless ctx
+ * is the context in which the coroutine is running (i.e. the value of
+ * qemu_get_current_aio_context() from the coroutine itself).
+ */
+void aio_co_schedule(AioContext *ctx, struct Coroutine *co);
+
+/**
+ * aio_co_wake:
+ * @co: the coroutine
+ *
+ * Restart a coroutine on the AioContext where it was running last, thus
+ * preventing coroutines from jumping from one context to another when they
+ * go to sleep.
+ *
+ * aio_co_wake may be executed either in coroutine or non-coroutine
+ * context.  The coroutine must not be entered by anyone else while
+ * aio_co_wake() is active.
+ */
+void aio_co_wake(struct Coroutine *co);
+
+/**
  * Return the AioContext whose event loop runs in the current thread.
  *
  * If called from an IOThread this will be the IOThread's AioContext.  If
diff --git a/include/qemu/coroutine_int.h b/include/qemu/coroutine_int.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/coroutine_int.h
+++ b/include/qemu/coroutine_int.h
@@ -XXX,XX +XXX,XX @@ struct Coroutine {
     CoroutineEntry *entry;
     void *entry_arg;
     Coroutine *caller;
+
+    /* Only used when the coroutine has terminated.  */
     QSLIST_ENTRY(Coroutine) pool_next;
+
     size_t locks_held;
 
-    /* Coroutines that should be woken up when we yield or terminate */
+    /* Coroutines that should be woken up when we yield or terminate.
+     * Only used when the coroutine is running.
+     */
     QSIMPLEQ_HEAD(, Coroutine) co_queue_wakeup;
+
+    /* Only used when the coroutine has yielded.  */
+    AioContext *ctx;
     QSIMPLEQ_ENTRY(Coroutine) co_queue_next;
+    QSLIST_ENTRY(Coroutine) co_scheduled_next;
 };
 
 Coroutine *qemu_coroutine_new(void);
diff --git a/tests/iothread.h b/tests/iothread.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/iothread.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Event loop thread implementation for unit tests
+ *
+ * Copyright Red Hat Inc., 2013, 2016
+ *
+ * Authors:
+ *  Stefan Hajnoczi   <stefanha@redhat.com>
+ *  Paolo Bonzini     <pbonzini@redhat.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+#ifndef TEST_IOTHREAD_H
+#define TEST_IOTHREAD_H
+
+#include "block/aio.h"
+#include "qemu/thread.h"
+
+typedef struct IOThread IOThread;
+
+IOThread *iothread_new(void);
+void iothread_join(IOThread *iothread);
+AioContext *iothread_get_aio_context(IOThread *iothread);
+
+#endif
diff --git a/tests/iothread.c b/tests/iothread.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/iothread.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Event loop thread implementation for unit tests
+ *
+ * Copyright Red Hat Inc., 2013, 2016
+ *
+ * Authors:
+ *  Stefan Hajnoczi   <stefanha@redhat.com>
+ *  Paolo Bonzini     <pbonzini@redhat.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ *
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "block/aio.h"
+#include "qemu/main-loop.h"
+#include "qemu/rcu.h"
+#include "iothread.h"
+
+struct IOThread {
+    AioContext *ctx;
+
+    QemuThread thread;
+    QemuMutex init_done_lock;
+    QemuCond init_done_cond;    /* is thread initialization done? */
+    bool stopping;
+};
+
+static __thread IOThread *my_iothread;
+
+AioContext *qemu_get_current_aio_context(void)
+{
+    return my_iothread ? my_iothread->ctx : qemu_get_aio_context();
+}
+
+static void *iothread_run(void *opaque)
+{
+    IOThread *iothread = opaque;
+
+    rcu_register_thread();
+
+    my_iothread = iothread;
+    qemu_mutex_lock(&iothread->init_done_lock);
+    iothread->ctx = aio_context_new(&error_abort);
+    qemu_cond_signal(&iothread->init_done_cond);
+    qemu_mutex_unlock(&iothread->init_done_lock);
+
+    while (!atomic_read(&iothread->stopping)) {
+        aio_poll(iothread->ctx, true);
+    }
+
+    rcu_unregister_thread();
+    return NULL;
+}
+
+void iothread_join(IOThread *iothread)
+{
+    iothread->stopping = true;
+    aio_notify(iothread->ctx);
+    qemu_thread_join(&iothread->thread);
+    qemu_cond_destroy(&iothread->init_done_cond);
+    qemu_mutex_destroy(&iothread->init_done_lock);
+    aio_context_unref(iothread->ctx);
+    g_free(iothread);
+}
+
+IOThread *iothread_new(void)
+{
+    IOThread *iothread = g_new0(IOThread, 1);
+
+    qemu_mutex_init(&iothread->init_done_lock);
+    qemu_cond_init(&iothread->init_done_cond);
+    qemu_thread_create(&iothread->thread, NULL, iothread_run,
+                       iothread, QEMU_THREAD_JOINABLE);
+
+    /* Wait for initialization to complete */
+    qemu_mutex_lock(&iothread->init_done_lock);
+    while (iothread->ctx == NULL) {
+        qemu_cond_wait(&iothread->init_done_cond,
+                       &iothread->init_done_lock);
+    }
+    qemu_mutex_unlock(&iothread->init_done_lock);
+    return iothread;
+}
+
+AioContext *iothread_get_aio_context(IOThread *iothread)
+{
+    return iothread->ctx;
+}
diff --git a/tests/test-aio-multithread.c b/tests/test-aio-multithread.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/test-aio-multithread.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * AioContext multithreading tests
+ *
+ * Copyright Red Hat, Inc. 2016
+ *
+ * Authors:
+ *  Paolo Bonzini    <pbonzini@redhat.com>
+ *
+ * This work is licensed under the terms of the GNU LGPL, version 2 or later.
+ * See the COPYING.LIB file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include <glib.h>
+#include "block/aio.h"
+#include "qapi/error.h"
+#include "qemu/coroutine.h"
+#include "qemu/thread.h"
+#include "qemu/error-report.h"
+#include "iothread.h"
+
+/* AioContext management */
+
+#define NUM_CONTEXTS 5
+
+static IOThread *threads[NUM_CONTEXTS];
+static AioContext *ctx[NUM_CONTEXTS];
+static __thread int id = -1;
+
+static QemuEvent done_event;
+
+/* Run a function synchronously on a remote iothread. */
+
+typedef struct CtxRunData {
+    QEMUBHFunc *cb;
+    void *arg;
+} CtxRunData;
+
+static void ctx_run_bh_cb(void *opaque)
+{
+    CtxRunData *data = opaque;
+
+    data->cb(data->arg);
+    qemu_event_set(&done_event);
+}
+
+static void ctx_run(int i, QEMUBHFunc *cb, void *opaque)
+{
+    CtxRunData data = {
+        .cb = cb,
+        .arg = opaque
+    };
+
+    qemu_event_reset(&done_event);
+    aio_bh_schedule_oneshot(ctx[i], ctx_run_bh_cb, &data);
+    qemu_event_wait(&done_event);
+}
+
+/* Starting the iothreads. */
+
+static void set_id_cb(void *opaque)
+{
+    int *i = opaque;
+
+    id = *i;
+}
+
+static void create_aio_contexts(void)
+{
+    int i;
+
+    for (i = 0; i < NUM_CONTEXTS; i++) {
+        threads[i] = iothread_new();
+        ctx[i] = iothread_get_aio_context(threads[i]);
+    }
+
+    qemu_event_init(&done_event, false);
+    for (i = 0; i < NUM_CONTEXTS; i++) {
+        ctx_run(i, set_id_cb, &i);
+    }
+}
+
+/* Stopping the iothreads. */
+
+static void join_aio_contexts(void)
+{
+    int i;
+
+    for (i = 0; i < NUM_CONTEXTS; i++) {
+        aio_context_ref(ctx[i]);
+    }
+    for (i = 0; i < NUM_CONTEXTS; i++) {
+        iothread_join(threads[i]);
+    }
+    for (i = 0; i < NUM_CONTEXTS; i++) {
+        aio_context_unref(ctx[i]);
+    }
+    qemu_event_destroy(&done_event);
+}
+
+/* Basic test for the stuff above. */
+
+static void test_lifecycle(void)
+{
+    create_aio_contexts();
+    join_aio_contexts();
+}
+
+/* aio_co_schedule test.  */
+
+static Coroutine *to_schedule[NUM_CONTEXTS];
+
+static bool now_stopping;
+
+static int count_retry;
+static int count_here;
+static int count_other;
+
+static bool schedule_next(int n)
+{
+    Coroutine *co;
+
+    co = atomic_xchg(&to_schedule[n], NULL);
+    if (!co) {
+        atomic_inc(&count_retry);
+        return false;
+    }
+
+    if (n == id) {
+        atomic_inc(&count_here);
+    } else {
+        atomic_inc(&count_other);
+    }
+
+    aio_co_schedule(ctx[n], co);
+    return true;
+}
+
+static void finish_cb(void *opaque)
+{
+    schedule_next(id);
+}
+
+static coroutine_fn void test_multi_co_schedule_entry(void *opaque)
+{
+    g_assert(to_schedule[id] == NULL);
+    atomic_mb_set(&to_schedule[id], qemu_coroutine_self());
+
+    while (!atomic_mb_read(&now_stopping)) {
+        int n;
+
+        n = g_test_rand_int_range(0, NUM_CONTEXTS);
+        schedule_next(n);
+        qemu_coroutine_yield();
+
+        g_assert(to_schedule[id] == NULL);
+        atomic_mb_set(&to_schedule[id], qemu_coroutine_self());
+    }
+}
+
+
+static void test_multi_co_schedule(int seconds)
+{
+    int i;
+
+    count_here = count_other = count_retry = 0;
+    now_stopping = false;
+
+    create_aio_contexts();
+    for (i = 0; i < NUM_CONTEXTS; i++) {
+        Coroutine *co1 = qemu_coroutine_create(test_multi_co_schedule_entry, NULL);
+        aio_co_schedule(ctx[i], co1);
+    }
+
+    g_usleep(seconds * 1000000);
+
+    atomic_mb_set(&now_stopping, true);
+    for (i = 0; i < NUM_CONTEXTS; i++) {
+        ctx_run(i, finish_cb, NULL);
+        to_schedule[i] = NULL;
+    }
+
+    join_aio_contexts();
+    g_test_message("scheduled %d, queued %d, retry %d, total %d\n",
+                  count_other, count_here, count_retry,
+                  count_here + count_other + count_retry);
+}
+
+static void test_multi_co_schedule_1(void)
+{
+    test_multi_co_schedule(1);
+}
+
+static void test_multi_co_schedule_10(void)
+{
+    test_multi_co_schedule(10);
+}
+
+/* End of tests.  */
+
+int main(int argc, char **argv)
+{
+    init_clocks();
+
+    g_test_init(&argc, &argv, NULL);
+    g_test_add_func("/aio/multi/lifecycle", test_lifecycle);
+    if (g_test_quick()) {
+        g_test_add_func("/aio/multi/schedule", test_multi_co_schedule_1);
+    } else {
+        g_test_add_func("/aio/multi/schedule", test_multi_co_schedule_10);
+    }
+    return g_test_run();
+}
diff --git a/util/async.c b/util/async.c
index XXXXXXX..XXXXXXX 100644
--- a/util/async.c
+++ b/util/async.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/main-loop.h"
 #include "qemu/atomic.h"
 #include "block/raw-aio.h"
+#include "qemu/coroutine_int.h"
+#include "trace.h"
 
 /***********************************************************/
 /* bottom halves (can be seen as timers which expire ASAP) */
@@ -XXX,XX +XXX,XX @@ aio_ctx_finalize(GSource     *source)
     }
 #endif
 
+    assert(QSLIST_EMPTY(&ctx->scheduled_coroutines));
+    qemu_bh_delete(ctx->co_schedule_bh);
+
     qemu_lockcnt_lock(&ctx->list_lock);
     assert(!qemu_lockcnt_count(&ctx->list_lock));
     while (ctx->first_bh) {
@@ -XXX,XX +XXX,XX @@ static bool event_notifier_poll(void *opaque)
     return atomic_read(&ctx->notified);
 }
 
+static void co_schedule_bh_cb(void *opaque)
+{
+    AioContext *ctx = opaque;
+    QSLIST_HEAD(, Coroutine) straight, reversed;
+
+    QSLIST_MOVE_ATOMIC(&reversed, &ctx->scheduled_coroutines);
+    QSLIST_INIT(&straight);
+
+    while (!QSLIST_EMPTY(&reversed)) {
+        Coroutine *co = QSLIST_FIRST(&reversed);
+        QSLIST_REMOVE_HEAD(&reversed, co_scheduled_next);
+        QSLIST_INSERT_HEAD(&straight, co, co_scheduled_next);
+    }
+
+    while (!QSLIST_EMPTY(&straight)) {
+        Coroutine *co = QSLIST_FIRST(&straight);
+        QSLIST_REMOVE_HEAD(&straight, co_scheduled_next);
+        trace_aio_co_schedule_bh_cb(ctx, co);
+        qemu_coroutine_enter(co);
+    }
+}
+
 AioContext *aio_context_new(Error **errp)
 {
     int ret;
@@ -XXX,XX +XXX,XX @@ AioContext *aio_context_new(Error **errp)
     }
     g_source_set_can_recurse(&ctx->source, true);
     qemu_lockcnt_init(&ctx->list_lock);
+
+    ctx->co_schedule_bh = aio_bh_new(ctx, co_schedule_bh_cb, ctx);
+    QSLIST_INIT(&ctx->scheduled_coroutines);
+
     aio_set_event_notifier(ctx, &ctx->notifier,
                            false,
                            (EventNotifierHandler *)
@@ -XXX,XX +XXX,XX @@ fail:
     return NULL;
 }
 
+void aio_co_schedule(AioContext *ctx, Coroutine *co)
+{
+    trace_aio_co_schedule(ctx, co);
+    QSLIST_INSERT_HEAD_ATOMIC(&ctx->scheduled_coroutines,
+                              co, co_scheduled_next);
+    qemu_bh_schedule(ctx->co_schedule_bh);
+}
+
+void aio_co_wake(struct Coroutine *co)
+{
+    AioContext *ctx;
+
+    /* Read coroutine before co->ctx.  Matches smp_wmb in
+     * qemu_coroutine_enter.
+     */
+    smp_read_barrier_depends();
+    ctx = atomic_read(&co->ctx);
+
+    if (ctx != qemu_get_current_aio_context()) {
+        aio_co_schedule(ctx, co);
+        return;
+    }
+
+    if (qemu_in_coroutine()) {
+        Coroutine *self = qemu_coroutine_self();
+        assert(self != co);
+        QSIMPLEQ_INSERT_TAIL(&self->co_queue_wakeup, co, co_queue_next);
+    } else {
+        aio_context_acquire(ctx);
+        qemu_coroutine_enter(co);
+        aio_context_release(ctx);
+    }
+}
+
 void aio_context_ref(AioContext *ctx)
 {
     g_source_ref(&ctx->source);
diff --git a/util/qemu-coroutine.c b/util/qemu-coroutine.c
index XXXXXXX..XXXXXXX 100644
--- a/util/qemu-coroutine.c
+++ b/util/qemu-coroutine.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/atomic.h"
 #include "qemu/coroutine.h"
 #include "qemu/coroutine_int.h"
+#include "block/aio.h"
 
 enum {
     POOL_BATCH_SIZE = 64,
@@ -XXX,XX +XXX,XX @@ void qemu_coroutine_enter(Coroutine *co)
     }
 
     co->caller = self;
+    co->ctx = qemu_get_current_aio_context();
+
+    /* Store co->ctx before anything that stores co.  Matches
+     * barrier in aio_co_wake.
+     */
+    smp_wmb();
+
     ret = qemu_coroutine_switch(self, co, COROUTINE_ENTER);
 
     qemu_co_queue_run_restart(co);
diff --git a/util/trace-events b/util/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/util/trace-events
+++ b/util/trace-events
@@ -XXX,XX +XXX,XX @@ run_poll_handlers_end(void *ctx, bool progress) "ctx %p progress %d"
 poll_shrink(void *ctx, int64_t old, int64_t new) "ctx %p old %"PRId64" new %"PRId64
 poll_grow(void *ctx, int64_t old, int64_t new) "ctx %p old %"PRId64" new %"PRId64
 
+# util/async.c
+aio_co_schedule(void *ctx, void *co) "ctx %p co %p"
+aio_co_schedule_bh_cb(void *ctx, void *co) "ctx %p co %p"
+
 # util/thread-pool.c
 thread_pool_submit(void *pool, void *req, void *opaque) "pool %p req %p opaque %p"
 thread_pool_complete(void *pool, void *req, void *opaque, int ret) "pool %p req %p opaque %p ret %d"
-- 
2.9.3

From: Paolo Bonzini <pbonzini@redhat.com>

qcow2_create2 calls this.  Do not run a nested event loop, as that
breaks when aio_co_wake tries to queue the coroutine on the co_queue_wakeup
list of the currently running one.

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Message-id: 20170213135235.12274-4-pbonzini@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/block-backend.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/block/block-backend.c b/block/block-backend.c
index XXXXXXX..XXXXXXX 100644
--- a/block/block-backend.c
+++ b/block/block-backend.c
@@ -XXX,XX +XXX,XX @@ static int blk_prw(BlockBackend *blk, int64_t offset, uint8_t *buf,
 {
     QEMUIOVector qiov;
     struct iovec iov;
-    Coroutine *co;
     BlkRwCo rwco;
 
     iov = (struct iovec) {
@@ -XXX,XX +XXX,XX @@ static int blk_prw(BlockBackend *blk, int64_t offset, uint8_t *buf,
         .ret    = NOT_DONE,
     };
 
-    co = qemu_coroutine_create(co_entry, &rwco);
-    qemu_coroutine_enter(co);
-    BDRV_POLL_WHILE(blk_bs(blk), rwco.ret == NOT_DONE);
+    if (qemu_in_coroutine()) {
+        /* Fast-path if already in coroutine context */
+        co_entry(&rwco);
+    } else {
+        Coroutine *co = qemu_coroutine_create(co_entry, &rwco);
+        qemu_coroutine_enter(co);
+        BDRV_POLL_WHILE(blk_bs(blk), rwco.ret == NOT_DONE);
+    }
 
     return rwco.ret;
 }
-- 
2.9.3

From: Paolo Bonzini <pbonzini@redhat.com>

Once the thread pool starts using aio_co_wake, it will also need
qemu_get_current_aio_context().  Make test-thread-pool create
an AioContext with qemu_init_main_loop, so that stubs/iothread.c
and tests/iothread.c can provide the rest.

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Message-id: 20170213135235.12274-5-pbonzini@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 tests/test-thread-pool.c | 12 +++---------
 1 file changed, 3 insertions(+), 9 deletions(-)

diff --git a/tests/test-thread-pool.c b/tests/test-thread-pool.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/test-thread-pool.c
+++ b/tests/test-thread-pool.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "qemu/timer.h"
 #include "qemu/error-report.h"
+#include "qemu/main-loop.h"
 
 static AioContext *ctx;
 static ThreadPool *pool;
@@ -XXX,XX +XXX,XX @@ static void test_cancel_async(void)
 int main(int argc, char **argv)
 {
     int ret;
-    Error *local_error = NULL;
 
-    init_clocks();
-
-    ctx = aio_context_new(&local_error);
-    if (!ctx) {
-        error_reportf_err(local_error, "Failed to create AIO Context: ");
-        exit(1);
-    }
+    qemu_init_main_loop(&error_abort);
+    ctx = qemu_get_current_aio_context();
     pool = aio_get_thread_pool(ctx);
 
     g_test_init(&argc, &argv, NULL);
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
 
     ret = g_test_run();
 
-    aio_context_unref(ctx);
     return ret;
 }
-- 
2.9.3

From: Paolo Bonzini <pbonzini@redhat.com>

This is in preparation for making qio_channel_yield work on
AioContexts other than the main one.

Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Message-id: 20170213135235.12274-6-pbonzini@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 include/io/channel.h | 25 +++++++++++++++++++++++++
 io/channel-command.c | 13 +++++++++++++
 io/channel-file.c    | 11 +++++++++++
 io/channel-socket.c  | 16 +++++++++++-----
 io/channel-tls.c     | 12 ++++++++++++
 io/channel-watch.c   |  6 ++++++
 io/channel.c         | 11 +++++++++++
 7 files changed, 89 insertions(+), 5 deletions(-)

diff --git a/include/io/channel.h b/include/io/channel.h
index XXXXXXX..XXXXXXX 100644
--- a/include/io/channel.h
+++ b/include/io/channel.h
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu-common.h"
 #include "qom/object.h"
+#include "block/aio.h"
 
 #define TYPE_QIO_CHANNEL "qio-channel"
 #define QIO_CHANNEL(obj)                                    \
@@ -XXX,XX +XXX,XX @@ struct QIOChannelClass {
                      off_t offset,
                      int whence,
                      Error **errp);
+    void (*io_set_aio_fd_handler)(QIOChannel *ioc,
+                                  AioContext *ctx,
+                                  IOHandler *io_read,
+                                  IOHandler *io_write,
+                                  void *opaque);
 };
 
 /* General I/O handling functions */
@@ -XXX,XX +XXX,XX @@ void qio_channel_yield(QIOChannel *ioc,
 void qio_channel_wait(QIOChannel *ioc,
                       GIOCondition condition);
 
+/**
+ * qio_channel_set_aio_fd_handler:
+ * @ioc: the channel object
+ * @ctx: the AioContext to set the handlers on
+ * @io_read: the read handler
+ * @io_write: the write handler
+ * @opaque: the opaque value passed to the handler
+ *
+ * This is used internally by qio_channel_yield().  It can
+ * be used by channel implementations to forward the handlers
+ * to another channel (e.g. from #QIOChannelTLS to the
+ * underlying socket).
+ */
+void qio_channel_set_aio_fd_handler(QIOChannel *ioc,
+                                    AioContext *ctx,
+                                    IOHandler *io_read,
+                                    IOHandler *io_write,
+                                    void *opaque);
+
 #endif /* QIO_CHANNEL_H */
diff --git a/io/channel-command.c b/io/channel-command.c
index XXXXXXX..XXXXXXX 100644
--- a/io/channel-command.c
+++ b/io/channel-command.c
@@ -XXX,XX +XXX,XX @@ static int qio_channel_command_close(QIOChannel *ioc,
 }
 
 
+static void qio_channel_command_set_aio_fd_handler(QIOChannel *ioc,
+                                                   AioContext *ctx,
+                                                   IOHandler *io_read,
+                                                   IOHandler *io_write,
+                                                   void *opaque)
+{
+    QIOChannelCommand *cioc = QIO_CHANNEL_COMMAND(ioc);
+    aio_set_fd_handler(ctx, cioc->readfd, false, io_read, NULL, NULL, opaque);
+    aio_set_fd_handler(ctx, cioc->writefd, false, NULL, io_write, NULL, opaque);
+}
+
+
 static GSource *qio_channel_command_create_watch(QIOChannel *ioc,
                                                  GIOCondition condition)
 {
@@ -XXX,XX +XXX,XX @@ static void qio_channel_command_class_init(ObjectClass *klass,
     ioc_klass->io_set_blocking = qio_channel_command_set_blocking;
     ioc_klass->io_close = qio_channel_command_close;
     ioc_klass->io_create_watch = qio_channel_command_create_watch;
+    ioc_klass->io_set_aio_fd_handler = qio_channel_command_set_aio_fd_handler;
 }
 
 static const TypeInfo qio_channel_command_info = {
diff --git a/io/channel-file.c b/io/channel-file.c
index XXXXXXX..XXXXXXX 100644
--- a/io/channel-file.c
+++ b/io/channel-file.c
@@ -XXX,XX +XXX,XX @@ static int qio_channel_file_close(QIOChannel *ioc,
 }
 
 
+static void qio_channel_file_set_aio_fd_handler(QIOChannel *ioc,
+                                                AioContext *ctx,
+                                                IOHandler *io_read,
+                                                IOHandler *io_write,
+                                                void *opaque)
+{
+    QIOChannelFile *fioc = QIO_CHANNEL_FILE(ioc);
+    aio_set_fd_handler(ctx, fioc->fd, false, io_read, io_write, NULL, opaque);
+}
+
 static GSource *qio_channel_file_create_watch(QIOChannel *ioc,
                                               GIOCondition condition)
 {
@@ -XXX,XX +XXX,XX @@ static void qio_channel_file_class_init(ObjectClass *klass,
     ioc_klass->io_seek = qio_channel_file_seek;
     ioc_klass->io_close = qio_channel_file_close;
     ioc_klass->io_create_watch = qio_channel_file_create_watch;
+    ioc_klass->io_set_aio_fd_handler = qio_channel_file_set_aio_fd_handler;
 }
 
 static const TypeInfo qio_channel_file_info = {
diff --git a/io/channel-socket.c b/io/channel-socket.c
index XXXXXXX..XXXXXXX 100644
--- a/io/channel-socket.c
+++ b/io/channel-socket.c
@@ -XXX,XX +XXX,XX @@ qio_channel_socket_set_blocking(QIOChannel *ioc,
         qemu_set_block(sioc->fd);
     } else {
         qemu_set_nonblock(sioc->fd);
-#ifdef WIN32
-        WSAEventSelect(sioc->fd, ioc->event,
-                       FD_READ | FD_ACCEPT | FD_CLOSE |
-                       FD_CONNECT | FD_WRITE | FD_OOB);
-#endif
     }
     return 0;
 }
@@ -XXX,XX +XXX,XX @@ qio_channel_socket_shutdown(QIOChannel *ioc,
     return 0;
 }
 
+static void qio_channel_socket_set_aio_fd_handler(QIOChannel *ioc,
+                                                  AioContext *ctx,
+                                                  IOHandler *io_read,
+                                                  IOHandler *io_write,
+                                                  void *opaque)
+{
+    QIOChannelSocket *sioc = QIO_CHANNEL_SOCKET(ioc);
+    aio_set_fd_handler(ctx, sioc->fd, false, io_read, io_write, NULL, opaque);
+}
+
 static GSource *qio_channel_socket_create_watch(QIOChannel *ioc,
                                                 GIOCondition condition)
 {
@@ -XXX,XX +XXX,XX @@ static void qio_channel_socket_class_init(ObjectClass *klass,
     ioc_klass->io_set_cork = qio_channel_socket_set_cork;
     ioc_klass->io_set_delay = qio_channel_socket_set_delay;
     ioc_klass->io_create_watch = qio_channel_socket_create_watch;
+    ioc_klass->io_set_aio_fd_handler = qio_channel_socket_set_aio_fd_handler;
 }
 
 static const TypeInfo qio_channel_socket_info = {
diff --git a/io/channel-tls.c b/io/channel-tls.c
index XXXXXXX..XXXXXXX 100644
--- a/io/channel-tls.c
+++ b/io/channel-tls.c
@@ -XXX,XX +XXX,XX @@ static int qio_channel_tls_close(QIOChannel *ioc,
     return qio_channel_close(tioc->master, errp);
 }
 
+static void qio_channel_tls_set_aio_fd_handler(QIOChannel *ioc,
+                                               AioContext *ctx,
+                                               IOHandler *io_read,
+                                               IOHandler *io_write,
+                                               void *opaque)
+{
+    QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
+
+    qio_channel_set_aio_fd_handler(tioc->master, ctx, io_read, io_write, opaque);
+}
+
 static GSource *qio_channel_tls_create_watch(QIOChannel *ioc,
                                              GIOCondition condition)
 {
@@ -XXX,XX +XXX,XX @@ static void qio_channel_tls_class_init(ObjectClass *klass,
     ioc_klass->io_close = qio_channel_tls_close;
     ioc_klass->io_shutdown = qio_channel_tls_shutdown;
     ioc_klass->io_create_watch = qio_channel_tls_create_watch;
+    ioc_klass->io_set_aio_fd_handler = qio_channel_tls_set_aio_fd_handler;
 }
 
 static const TypeInfo qio_channel_tls_info = {
diff --git a/io/channel-watch.c b/io/channel-watch.c
index XXXXXXX..XXXXXXX 100644
--- a/io/channel-watch.c
+++ b/io/channel-watch.c
@@ -XXX,XX +XXX,XX @@ GSource *qio_channel_create_socket_watch(QIOChannel *ioc,
     GSource *source;
     QIOChannelSocketSource *ssource;
 
+#ifdef WIN32
+    WSAEventSelect(socket, ioc->event,
+                   FD_READ | FD_ACCEPT | FD_CLOSE |
+                   FD_CONNECT | FD_WRITE | FD_OOB);
+#endif
+
     source = g_source_new(&qio_channel_socket_source_funcs,
                           sizeof(QIOChannelSocketSource));
     ssource = (QIOChannelSocketSource *)source;
diff --git a/io/channel.c b/io/channel.c
index XXXXXXX..XXXXXXX 100644
--- a/io/channel.c
+++ b/io/channel.c
@@ -XXX,XX +XXX,XX @@ GSource *qio_channel_create_watch(QIOChannel *ioc,
 }
 
 
+void qio_channel_set_aio_fd_handler(QIOChannel *ioc,
+                                    AioContext *ctx,
+                                    IOHandler *io_read,
+                                    IOHandler *io_write,
+                                    void *opaque)
+{
+    QIOChannelClass *klass = QIO_CHANNEL_GET_CLASS(ioc);
+
+    klass->io_set_aio_fd_handler(ioc, ctx, io_read, io_write, opaque);
+}
+
 guint qio_channel_add_watch(QIOChannel *ioc,
                             GIOCondition condition,
                             QIOChannelFunc func,
-- 
2.9.3

From: Paolo Bonzini <pbonzini@redhat.com>

Support separate coroutines for reading and writing, and place the
read/write handlers on the AioContext that the QIOChannel is registered
with.

Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Message-id: 20170213135235.12274-7-pbonzini@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 include/io/channel.h | 47 ++++++++++++++++++++++++++--
 io/channel.c         | 86 +++++++++++++++++++++++++++++++++++++++-------------
 2 files changed, 109 insertions(+), 24 deletions(-)

diff --git a/include/io/channel.h b/include/io/channel.h
index XXXXXXX..XXXXXXX 100644
--- a/include/io/channel.h
+++ b/include/io/channel.h
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu-common.h"
 #include "qom/object.h"
+#include "qemu/coroutine.h"
 #include "block/aio.h"
 
 #define TYPE_QIO_CHANNEL "qio-channel"
@@ -XXX,XX +XXX,XX @@ struct QIOChannel {
     Object parent;
     unsigned int features; /* bitmask of QIOChannelFeatures */
     char *name;
+    AioContext *ctx;
+    Coroutine *read_coroutine;
+    Coroutine *write_coroutine;
 #ifdef _WIN32
     HANDLE event; /* For use with GSource on Win32 */
 #endif
@@ -XXX,XX +XXX,XX @@ guint qio_channel_add_watch(QIOChannel *ioc,
 
 
 /**
+ * qio_channel_attach_aio_context:
+ * @ioc: the channel object
+ * @ctx: the #AioContext to set the handlers on
+ *
+ * Request that qio_channel_yield() sets I/O handlers on
+ * the given #AioContext.  If @ctx is %NULL, qio_channel_yield()
+ * uses QEMU's main thread event loop.
+ *
+ * You can move a #QIOChannel from one #AioContext to another even if
+ * I/O handlers are set for a coroutine.  However, #QIOChannel provides
+ * no synchronization between the calls to qio_channel_yield() and
+ * qio_channel_attach_aio_context().
+ *
+ * Therefore you should first call qio_channel_detach_aio_context()
+ * to ensure that the coroutine is not entered concurrently.  Then,
+ * while the coroutine has yielded, call qio_channel_attach_aio_context(),
+ * and then aio_co_schedule() to place the coroutine on the new
+ * #AioContext.  The calls to qio_channel_detach_aio_context()
+ * and qio_channel_attach_aio_context() should be protected with
+ * aio_context_acquire() and aio_context_release().
+ */
+void qio_channel_attach_aio_context(QIOChannel *ioc,
+                                    AioContext *ctx);
+
+/**
+ * qio_channel_detach_aio_context:
+ * @ioc: the channel object
+ *
+ * Disable any I/O handlers set by qio_channel_yield().  With the
+ * help of aio_co_schedule(), this allows moving a coroutine that was
+ * paused by qio_channel_yield() to another context.
+ */
+void qio_channel_detach_aio_context(QIOChannel *ioc);
+
+/**
  * qio_channel_yield:
  * @ioc: the channel object
  * @condition: the I/O condition to wait for
  *
- * Yields execution from the current coroutine until
- * the condition indicated by @condition becomes
- * available.
+ * Yields execution from the current coroutine until the condition
+ * indicated by @condition becomes available.  @condition must
+ * be either %G_IO_IN or %G_IO_OUT; it cannot contain both.  In
+ * addition, no two coroutine can be waiting on the same condition
+ * and channel at the same time.
  *
  * This must only be called from coroutine context
  */
diff --git a/io/channel.c b/io/channel.c
index XXXXXXX..XXXXXXX 100644
--- a/io/channel.c
+++ b/io/channel.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "io/channel.h"
 #include "qapi/error.h"
-#include "qemu/coroutine.h"
+#include "qemu/main-loop.h"
 
 bool qio_channel_has_feature(QIOChannel *ioc,
                              QIOChannelFeature feature)
@@ -XXX,XX +XXX,XX @@ off_t qio_channel_io_seek(QIOChannel *ioc,
 }
 
 
-typedef struct QIOChannelYieldData QIOChannelYieldData;
-struct QIOChannelYieldData {
-    QIOChannel *ioc;
-    Coroutine *co;
-};
+static void qio_channel_set_aio_fd_handlers(QIOChannel *ioc);
 
+static void qio_channel_restart_read(void *opaque)
+{
+    QIOChannel *ioc = opaque;
+    Coroutine *co = ioc->read_coroutine;
+
+    ioc->read_coroutine = NULL;
+    qio_channel_set_aio_fd_handlers(ioc);
+    aio_co_wake(co);
+}
 
-static gboolean qio_channel_yield_enter(QIOChannel *ioc,
-                                        GIOCondition condition,
-                                        gpointer opaque)
+static void qio_channel_restart_write(void *opaque)
 {
-    QIOChannelYieldData *data = opaque;
-    qemu_coroutine_enter(data->co);
-    return FALSE;
+    QIOChannel *ioc = opaque;
+    Coroutine *co = ioc->write_coroutine;
+
+    ioc->write_coroutine = NULL;
+    qio_channel_set_aio_fd_handlers(ioc);
+    aio_co_wake(co);
 }
 
+static void qio_channel_set_aio_fd_handlers(QIOChannel *ioc)
+{
+    IOHandler *rd_handler = NULL, *wr_handler = NULL;
+    AioContext *ctx;
+
+    if (ioc->read_coroutine) {
+        rd_handler = qio_channel_restart_read;
+    }
+    if (ioc->write_coroutine) {
+        wr_handler = qio_channel_restart_write;
+    }
+
+    ctx = ioc->ctx ? ioc->ctx : iohandler_get_aio_context();
+    qio_channel_set_aio_fd_handler(ioc, ctx, rd_handler, wr_handler, ioc);
+}
+
+void qio_channel_attach_aio_context(QIOChannel *ioc,
+                                    AioContext *ctx)
+{
+    AioContext *old_ctx;
+    if (ioc->ctx == ctx) {
+        return;
+    }
+
+    old_ctx = ioc->ctx ? ioc->ctx : iohandler_get_aio_context();
+    qio_channel_set_aio_fd_handler(ioc, old_ctx, NULL, NULL, NULL);
+    ioc->ctx = ctx;
+    qio_channel_set_aio_fd_handlers(ioc);
+}
+
+void qio_channel_detach_aio_context(QIOChannel *ioc)
+{
+    ioc->read_coroutine = NULL;
+    ioc->write_coroutine = NULL;
+    qio_channel_set_aio_fd_handlers(ioc);
+    ioc->ctx = NULL;
+}
 
 void coroutine_fn qio_channel_yield(QIOChannel *ioc,
                                     GIOCondition condition)
 {
-    QIOChannelYieldData data;
-
     assert(qemu_in_coroutine());
-    data.ioc = ioc;
-    data.co = qemu_coroutine_self();
-    qio_channel_add_watch(ioc,
-                          condition,
-                          qio_channel_yield_enter,
-                          &data,
-                          NULL);
+    if (condition == G_IO_IN) {
+        assert(!ioc->read_coroutine);
+        ioc->read_coroutine = qemu_coroutine_self();
+    } else if (condition == G_IO_OUT) {
+        assert(!ioc->write_coroutine);
+        ioc->write_coroutine = qemu_coroutine_self();
+    } else {
+        abort();
+    }
+    qio_channel_set_aio_fd_handlers(ioc);
     qemu_coroutine_yield();
 }
 
-- 
2.9.3

From: Paolo Bonzini <pbonzini@redhat.com>

In the client, read the reply headers from a coroutine, switching the
read side between the "read header" coroutine and the I/O coroutine that
reads the body of the reply.

In the server, if the server can read more requests it will create a new
"read request" coroutine as soon as a request has been read.  Otherwise,
the new coroutine is created in nbd_request_put.

diff --git a/block/nbd-client.h b/block/nbd-client.h
index XXXXXXX..XXXXXXX 100644
--- a/block/nbd-client.h
+++ b/block/nbd-client.h
@@ -XXX,XX +XXX,XX @@ typedef struct NBDClientSession {
 
     CoMutex send_mutex;
     CoQueue free_sema;
-    Coroutine *send_coroutine;
+    Coroutine *read_reply_co;
     int in_flight;
 
     Coroutine *recv_coroutine[MAX_NBD_REQUESTS];
diff --git a/block/nbd-client.c b/block/nbd-client.c
index XXXXXXX..XXXXXXX 100644
--- a/block/nbd-client.c
+++ b/block/nbd-client.c
@@ -XXX,XX +XXX,XX @@
 #define HANDLE_TO_INDEX(bs, handle) ((handle) ^ ((uint64_t)(intptr_t)bs))
 #define INDEX_TO_HANDLE(bs, index)  ((index)  ^ ((uint64_t)(intptr_t)bs))
 
-static void nbd_recv_coroutines_enter_all(NBDClientSession *s)
+static void nbd_recv_coroutines_enter_all(BlockDriverState *bs)
 {
+    NBDClientSession *s = nbd_get_client_session(bs);
     int i;
 
     for (i = 0; i < MAX_NBD_REQUESTS; i++) {
@@ -XXX,XX +XXX,XX @@ static void nbd_recv_coroutines_enter_all(NBDClientSession *s)
             qemu_coroutine_enter(s->recv_coroutine[i]);
         }
     }
+    BDRV_POLL_WHILE(bs, s->read_reply_co);
 }
 
 static void nbd_teardown_connection(BlockDriverState *bs)
@@ -XXX,XX +XXX,XX @@ static void nbd_teardown_connection(BlockDriverState *bs)
     qio_channel_shutdown(client->ioc,
                          QIO_CHANNEL_SHUTDOWN_BOTH,
                          NULL);
-    nbd_recv_coroutines_enter_all(client);
+    nbd_recv_coroutines_enter_all(bs);
 
     nbd_client_detach_aio_context(bs);
     object_unref(OBJECT(client->sioc));
@@ -XXX,XX +XXX,XX @@ static void nbd_teardown_connection(BlockDriverState *bs)
     client->ioc = NULL;
 }
 
-static void nbd_reply_ready(void *opaque)
+static coroutine_fn void nbd_read_reply_entry(void *opaque)
 {
-    BlockDriverState *bs = opaque;
-    NBDClientSession *s = nbd_get_client_session(bs);
+    NBDClientSession *s = opaque;
     uint64_t i;
     int ret;
 
-    if (!s->ioc) { /* Already closed */
-        return;
-    }
-
-    if (s->reply.handle == 0) {
-        /* No reply already in flight.  Fetch a header.  It is possible
-         * that another thread has done the same thing in parallel, so
-         * the socket is not readable anymore.
-         */
+    for (;;) {
+        assert(s->reply.handle == 0);
         ret = nbd_receive_reply(s->ioc, &s->reply);
-        if (ret == -EAGAIN) {
-            return;
-        }
         if (ret < 0) {
-            s->reply.handle = 0;
-            goto fail;
+            break;
         }
-    }
 
-    /* There's no need for a mutex on the receive side, because the
-     * handler acts as a synchronization point and ensures that only
-     * one coroutine is called until the reply finishes.  */
-    i = HANDLE_TO_INDEX(s, s->reply.handle);
-    if (i >= MAX_NBD_REQUESTS) {
-        goto fail;
-    }
+        /* There's no need for a mutex on the receive side, because the
+         * handler acts as a synchronization point and ensures that only
+         * one coroutine is called until the reply finishes.
+         */
+        i = HANDLE_TO_INDEX(s, s->reply.handle);
+        if (i >= MAX_NBD_REQUESTS || !s->recv_coroutine[i]) {
+            break;
+        }
 
-    if (s->recv_coroutine[i]) {
-        qemu_coroutine_enter(s->recv_coroutine[i]);
-        return;
+        /* We're woken up by the recv_coroutine itself.  Note that there
+         * is no race between yielding and reentering read_reply_co.  This
+         * is because:
+         *
+         * - if recv_coroutine[i] runs on the same AioContext, it is only
+         *   entered after we yield
+         *
+         * - if recv_coroutine[i] runs on a different AioContext, reentering
+         *   read_reply_co happens through a bottom half, which can only
+         *   run after we yield.
+         */
+        aio_co_wake(s->recv_coroutine[i]);
+        qemu_coroutine_yield();
     }
-
-fail:
-    nbd_teardown_connection(bs);
-}
-
-static void nbd_restart_write(void *opaque)
-{
-    BlockDriverState *bs = opaque;
-
-    qemu_coroutine_enter(nbd_get_client_session(bs)->send_coroutine);
+    s->read_reply_co = NULL;
 }
 
 static int nbd_co_send_request(BlockDriverState *bs,
@@ -XXX,XX +XXX,XX @@ static int nbd_co_send_request(BlockDriverState *bs,
                                QEMUIOVector *qiov)
 {
     NBDClientSession *s = nbd_get_client_session(bs);
-    AioContext *aio_context;
     int rc, ret, i;
 
     qemu_co_mutex_lock(&s->send_mutex);
@@ -XXX,XX +XXX,XX @@ static int nbd_co_send_request(BlockDriverState *bs,
         return -EPIPE;
     }
 
-    s->send_coroutine = qemu_coroutine_self();
-    aio_context = bdrv_get_aio_context(bs);
-
-    aio_set_fd_handler(aio_context, s->sioc->fd, false,
-                       nbd_reply_ready, nbd_restart_write, NULL, bs);
     if (qiov) {
         qio_channel_set_cork(s->ioc, true);
         rc = nbd_send_request(s->ioc, request);
@@ -XXX,XX +XXX,XX @@ static int nbd_co_send_request(BlockDriverState *bs,
     } else {
         rc = nbd_send_request(s->ioc, request);
     }
-    aio_set_fd_handler(aio_context, s->sioc->fd, false,
-                       nbd_reply_ready, NULL, NULL, bs);
-    s->send_coroutine = NULL;
     qemu_co_mutex_unlock(&s->send_mutex);
     return rc;
 }
@@ -XXX,XX +XXX,XX @@ static void nbd_co_receive_reply(NBDClientSession *s,
 {
     int ret;
 
-    /* Wait until we're woken up by the read handler.  TODO: perhaps
-     * peek at the next reply and avoid yielding if it's ours?  */
+    /* Wait until we're woken up by nbd_read_reply_entry.  */
     qemu_coroutine_yield();
     *reply = s->reply;
     if (reply->handle != request->handle ||
@@ -XXX,XX +XXX,XX @@ static void nbd_coroutine_start(NBDClientSession *s,
     /* s->recv_coroutine[i] is set as soon as we get the send_lock.  */
 }
 
-static void nbd_coroutine_end(NBDClientSession *s,
+static void nbd_coroutine_end(BlockDriverState *bs,
                               NBDRequest *request)
 {
+    NBDClientSession *s = nbd_get_client_session(bs);
     int i = HANDLE_TO_INDEX(s, request->handle);
+
     s->recv_coroutine[i] = NULL;
-    if (s->in_flight-- == MAX_NBD_REQUESTS) {
-        qemu_co_queue_next(&s->free_sema);
+    s->in_flight--;
+    qemu_co_queue_next(&s->free_sema);
+
+    /* Kick the read_reply_co to get the next reply.  */
+    if (s->read_reply_co) {
+        aio_co_wake(s->read_reply_co);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ int nbd_client_co_preadv(BlockDriverState *bs, uint64_t offset,
     } else {
         nbd_co_receive_reply(client, &request, &reply, qiov);
     }
-    nbd_coroutine_end(client, &request);
+    nbd_coroutine_end(bs, &request);
     return -reply.error;
 }
 
@@ -XXX,XX +XXX,XX @@ int nbd_client_co_pwritev(BlockDriverState *bs, uint64_t offset,
     } else {
         nbd_co_receive_reply(client, &request, &reply, NULL);
     }
-    nbd_coroutine_end(client, &request);
+    nbd_coroutine_end(bs, &request);
     return -reply.error;
 }
 
@@ -XXX,XX +XXX,XX @@ int nbd_client_co_pwrite_zeroes(BlockDriverState *bs, int64_t offset,
     } else {
         nbd_co_receive_reply(client, &request, &reply, NULL);
     }
-    nbd_coroutine_end(client, &request);
+    nbd_coroutine_end(bs, &request);
     return -reply.error;
 }
 
@@ -XXX,XX +XXX,XX @@ int nbd_client_co_flush(BlockDriverState *bs)
     } else {
         nbd_co_receive_reply(client, &request, &reply, NULL);
     }
-    nbd_coroutine_end(client, &request);
+    nbd_coroutine_end(bs, &request);
     return -reply.error;
 }
 
@@ -XXX,XX +XXX,XX @@ int nbd_client_co_pdiscard(BlockDriverState *bs, int64_t offset, int count)
     } else {
         nbd_co_receive_reply(client, &request, &reply, NULL);
     }
-    nbd_coroutine_end(client, &request);
+    nbd_coroutine_end(bs, &request);
     return -reply.error;
 
 }
 
 void nbd_client_detach_aio_context(BlockDriverState *bs)
 {
-    aio_set_fd_handler(bdrv_get_aio_context(bs),
-                       nbd_get_client_session(bs)->sioc->fd,
-                       false, NULL, NULL, NULL, NULL);
+    NBDClientSession *client = nbd_get_client_session(bs);
+    qio_channel_detach_aio_context(QIO_CHANNEL(client->sioc));
 }
 
 void nbd_client_attach_aio_context(BlockDriverState *bs,
                                    AioContext *new_context)
 {
-    aio_set_fd_handler(new_context, nbd_get_client_session(bs)->sioc->fd,
-                       false, nbd_reply_ready, NULL, NULL, bs);
+    NBDClientSession *client = nbd_get_client_session(bs);
+    qio_channel_attach_aio_context(QIO_CHANNEL(client->sioc), new_context);
+    aio_co_schedule(new_context, client->read_reply_co);
 }
 
 void nbd_client_close(BlockDriverState *bs)
@@ -XXX,XX +XXX,XX @@ int nbd_client_init(BlockDriverState *bs,
     /* Now that we're connected, set the socket to be non-blocking and
      * kick the reply mechanism.  */
     qio_channel_set_blocking(QIO_CHANNEL(sioc), false, NULL);
-
+    client->read_reply_co = qemu_coroutine_create(nbd_read_reply_entry, client);
     nbd_client_attach_aio_context(bs, bdrv_get_aio_context(bs));
 
     logout("Established connection with NBD server\n");
diff --git a/nbd/client.c b/nbd/client.c
index XXXXXXX..XXXXXXX 100644
--- a/nbd/client.c
+++ b/nbd/client.c
@@ -XXX,XX +XXX,XX @@ ssize_t nbd_receive_reply(QIOChannel *ioc, NBDReply *reply)
     ssize_t ret;
 
     ret = read_sync(ioc, buf, sizeof(buf));
-    if (ret < 0) {
+    if (ret <= 0) {
         return ret;
     }
 
diff --git a/nbd/common.c b/nbd/common.c
index XXXXXXX..XXXXXXX 100644
--- a/nbd/common.c
+++ b/nbd/common.c
@@ -XXX,XX +XXX,XX @@ ssize_t nbd_wr_syncv(QIOChannel *ioc,
         }
         if (len == QIO_CHANNEL_ERR_BLOCK) {
             if (qemu_in_coroutine()) {
-                /* XXX figure out if we can create a variant on
-                 * qio_channel_yield() that works with AIO contexts
-                 * and consider using that in this branch */
-                qemu_coroutine_yield();
-            } else if (done) {
-                /* XXX this is needed by nbd_reply_ready.  */
-                qio_channel_wait(ioc,
-                                 do_read ? G_IO_IN : G_IO_OUT);
+                qio_channel_yield(ioc, do_read ? G_IO_IN : G_IO_OUT);
             } else {
                 return -EAGAIN;
             }
diff --git a/nbd/server.c b/nbd/server.c
index XXXXXXX..XXXXXXX 100644
--- a/nbd/server.c
+++ b/nbd/server.c
@@ -XXX,XX +XXX,XX @@ struct NBDClient {
     CoMutex send_lock;
     Coroutine *send_coroutine;
 
-    bool can_read;
-
     QTAILQ_ENTRY(NBDClient) next;
     int nb_requests;
     bool closing;
@@ -XXX,XX +XXX,XX @@ struct NBDClient {
 
 /* That's all folks */
 
-static void nbd_set_handlers(NBDClient *client);
-static void nbd_unset_handlers(NBDClient *client);
-static void nbd_update_can_read(NBDClient *client);
+static void nbd_client_receive_next_request(NBDClient *client);
 
 static gboolean nbd_negotiate_continue(QIOChannel *ioc,
                                        GIOCondition condition,
@@ -XXX,XX +XXX,XX @@ void nbd_client_put(NBDClient *client)
          */
         assert(client->closing);
 
-        nbd_unset_handlers(client);
+        qio_channel_detach_aio_context(client->ioc);
         object_unref(OBJECT(client->sioc));
         object_unref(OBJECT(client->ioc));
         if (client->tlscreds) {
@@ -XXX,XX +XXX,XX @@ static NBDRequestData *nbd_request_get(NBDClient *client)
 
     assert(client->nb_requests <= MAX_NBD_REQUESTS - 1);
     client->nb_requests++;
-    nbd_update_can_read(client);
 
     req = g_new0(NBDRequestData, 1);
     nbd_client_get(client);
@@ -XXX,XX +XXX,XX @@ static void nbd_request_put(NBDRequestData *req)
     g_free(req);
 
     client->nb_requests--;
-    nbd_update_can_read(client);
+    nbd_client_receive_next_request(client);
+
     nbd_client_put(client);
 }
 
@@ -XXX,XX +XXX,XX @@ static void blk_aio_attached(AioContext *ctx, void *opaque)
     exp->ctx = ctx;
 
     QTAILQ_FOREACH(client, &exp->clients, next) {
-        nbd_set_handlers(client);
+        qio_channel_attach_aio_context(client->ioc, ctx);
+        if (client->recv_coroutine) {
+            aio_co_schedule(ctx, client->recv_coroutine);
+        }
+        if (client->send_coroutine) {
+            aio_co_schedule(ctx, client->send_coroutine);
+        }
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void blk_aio_detach(void *opaque)
     TRACE("Export %s: Detaching clients from AIO context %p\n", exp->name, exp->ctx);
 
     QTAILQ_FOREACH(client, &exp->clients, next) {
-        nbd_unset_handlers(client);
+        qio_channel_detach_aio_context(client->ioc);
     }
 
     exp->ctx = NULL;
@@ -XXX,XX +XXX,XX @@ static ssize_t nbd_co_send_reply(NBDRequestData *req, NBDReply *reply,
     g_assert(qemu_in_coroutine());
     qemu_co_mutex_lock(&client->send_lock);
     client->send_coroutine = qemu_coroutine_self();
-    nbd_set_handlers(client);
 
     if (!len) {
         rc = nbd_send_reply(client->ioc, reply);
@@ -XXX,XX +XXX,XX @@ static ssize_t nbd_co_send_reply(NBDRequestData *req, NBDReply *reply,
     }
 
     client->send_coroutine = NULL;
-    nbd_set_handlers(client);
     qemu_co_mutex_unlock(&client->send_lock);
     return rc;
 }
@@ -XXX,XX +XXX,XX @@ static ssize_t nbd_co_receive_request(NBDRequestData *req,
     ssize_t rc;
 
     g_assert(qemu_in_coroutine());
-    client->recv_coroutine = qemu_coroutine_self();
-    nbd_update_can_read(client);
-
+    assert(client->recv_coroutine == qemu_coroutine_self());
     rc = nbd_receive_request(client->ioc, request);
     if (rc < 0) {
         if (rc != -EAGAIN) {
@@ -XXX,XX +XXX,XX @@ static ssize_t nbd_co_receive_request(NBDRequestData *req,
 
 out:
     client->recv_coroutine = NULL;
-    nbd_update_can_read(client);
+    nbd_client_receive_next_request(client);
 
     return rc;
 }
 
-static void nbd_trip(void *opaque)
+/* Owns a reference to the NBDClient passed as opaque.  */
+static coroutine_fn void nbd_trip(void *opaque)
 {
     NBDClient *client = opaque;
     NBDExport *exp = client->exp;
     NBDRequestData *req;
-    NBDRequest request;
+    NBDRequest request = { 0 };    /* GCC thinks it can be used uninitialized */
     NBDReply reply;
     ssize_t ret;
     int flags;
 
     TRACE("Reading request.");
     if (client->closing) {
+        nbd_client_put(client);
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void nbd_trip(void *opaque)
 
 done:
     nbd_request_put(req);
+    nbd_client_put(client);
     return;
 
 out:
     nbd_request_put(req);
     client_close(client);
+    nbd_client_put(client);
 }
 
-static void nbd_read(void *opaque)
+static void nbd_client_receive_next_request(NBDClient *client)
 {
-    NBDClient *client = opaque;
-
-    if (client->recv_coroutine) {
-        qemu_coroutine_enter(client->recv_coroutine);
-    } else {
-        qemu_coroutine_enter(qemu_coroutine_create(nbd_trip, client));
-    }
-}
-
-static void nbd_restart_write(void *opaque)
-{
-    NBDClient *client = opaque;
-
-    qemu_coroutine_enter(client->send_coroutine);
-}
-
-static void nbd_set_handlers(NBDClient *client)
-{
-    if (client->exp && client->exp->ctx) {
-        aio_set_fd_handler(client->exp->ctx, client->sioc->fd, true,
-                           client->can_read ? nbd_read : NULL,
-                           client->send_coroutine ? nbd_restart_write : NULL,
-                           NULL, client);
-    }
-}
-
-static void nbd_unset_handlers(NBDClient *client)
-{
-    if (client->exp && client->exp->ctx) {
-        aio_set_fd_handler(client->exp->ctx, client->sioc->fd, true, NULL,
-                           NULL, NULL, NULL);
-    }
-}
-
-static void nbd_update_can_read(NBDClient *client)
-{
-    bool can_read = client->recv_coroutine ||
-                    client->nb_requests < MAX_NBD_REQUESTS;
-
-    if (can_read != client->can_read) {
-        client->can_read = can_read;
-        nbd_set_handlers(client);
-
-        /* There is no need to invoke aio_notify(), since aio_set_fd_handler()
-         * in nbd_set_handlers() will have taken care of that */
+    if (!client->recv_coroutine && client->nb_requests < MAX_NBD_REQUESTS) {
+        nbd_client_get(client);
+        client->recv_coroutine = qemu_coroutine_create(nbd_trip, client);
+        aio_co_schedule(client->exp->ctx, client->recv_coroutine);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static coroutine_fn void nbd_co_client_start(void *opaque)
         goto out;
     }
     qemu_co_mutex_init(&client->send_lock);
-    nbd_set_handlers(client);
 
     if (exp) {
         QTAILQ_INSERT_TAIL(&exp->clients, client, next);
     }
+
+    nbd_client_receive_next_request(client);
+
 out:
     g_free(data);
 }
@@ -XXX,XX +XXX,XX @@ void nbd_client_new(NBDExport *exp,
     object_ref(OBJECT(client->sioc));
     client->ioc = QIO_CHANNEL(sioc);
     object_ref(OBJECT(client->ioc));
-    client->can_read = true;
     client->close = close_fn;
 
     data->client = client;
-- 
2.9.3

From: Paolo Bonzini <pbonzini@redhat.com>

As a small step towards the introduction of multiqueue, we want
coroutines to remain on the same AioContext that started them,
unless they are moved explicitly with e.g. aio_co_schedule.  This patch
avoids that coroutines switch AioContext when they use a CoMutex.
For now it does not make much of a difference, because the CoMutex
is not thread-safe and the AioContext itself is used to protect the
CoMutex from concurrent access.  However, this is going to change.

diff --git a/util/qemu-coroutine-lock.c b/util/qemu-coroutine-lock.c
index XXXXXXX..XXXXXXX 100644
--- a/util/qemu-coroutine-lock.c
+++ b/util/qemu-coroutine-lock.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/coroutine.h"
 #include "qemu/coroutine_int.h"
 #include "qemu/queue.h"
+#include "block/aio.h"
 #include "trace.h"
 
 void qemu_co_queue_init(CoQueue *queue)
@@ -XXX,XX +XXX,XX @@ void qemu_co_queue_run_restart(Coroutine *co)
 
 static bool qemu_co_queue_do_restart(CoQueue *queue, bool single)
 {
-    Coroutine *self = qemu_coroutine_self();
     Coroutine *next;
 
     if (QSIMPLEQ_EMPTY(&queue->entries)) {
@@ -XXX,XX +XXX,XX @@ static bool qemu_co_queue_do_restart(CoQueue *queue, bool single)
 
     while ((next = QSIMPLEQ_FIRST(&queue->entries)) != NULL) {
         QSIMPLEQ_REMOVE_HEAD(&queue->entries, co_queue_next);
-        QSIMPLEQ_INSERT_TAIL(&self->co_queue_wakeup, next, co_queue_next);
-        trace_qemu_co_queue_next(next);
+        aio_co_wake(next);
         if (single) {
             break;
         }
diff --git a/util/trace-events b/util/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/util/trace-events
+++ b/util/trace-events
@@ -XXX,XX +XXX,XX @@ qemu_coroutine_terminate(void *co) "self %p"
 
 # util/qemu-coroutine-lock.c
 qemu_co_queue_run_restart(void *co) "co %p"
-qemu_co_queue_next(void *nxt) "next %p"
 qemu_co_mutex_lock_entry(void *mutex, void *self) "mutex %p self %p"
 qemu_co_mutex_lock_return(void *mutex, void *self) "mutex %p self %p"
 qemu_co_mutex_unlock_entry(void *mutex, void *self) "mutex %p self %p"
-- 
2.9.3

From: Paolo Bonzini <pbonzini@redhat.com>

Keep the coroutine on the same AioContext.  Without this change,
there would be a race between yielding the coroutine and reentering it.
While the race cannot happen now, because the code only runs from a single
AioContext, this will change with multiqueue support in the block layer.

While doing the change, replace custom bottom half with aio_co_schedule.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 20170213135235.12274-10-pbonzini@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/blkdebug.c | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/block/blkdebug.c b/block/blkdebug.c
index XXXXXXX..XXXXXXX 100644
--- a/block/blkdebug.c
+++ b/block/blkdebug.c
@@ -XXX,XX +XXX,XX @@ out:
     return ret;
 }
 
-static void error_callback_bh(void *opaque)
-{
-    Coroutine *co = opaque;
-    qemu_coroutine_enter(co);
-}
-
 static int inject_error(BlockDriverState *bs, BlkdebugRule *rule)
 {
     BDRVBlkdebugState *s = bs->opaque;
@@ -XXX,XX +XXX,XX @@ static int inject_error(BlockDriverState *bs, BlkdebugRule *rule)
     }
 
     if (!immediately) {
-        aio_bh_schedule_oneshot(bdrv_get_aio_context(bs), error_callback_bh,
-                                qemu_coroutine_self());
+        aio_co_schedule(qemu_get_current_aio_context(), qemu_coroutine_self());
         qemu_coroutine_yield();
     }
 
-- 
2.9.3

From: Paolo Bonzini <pbonzini@redhat.com>

qed_aio_start_io and qed_aio_next_io will not have to acquire/release
the AioContext, while qed_aio_next_io_cb will.  Split the functionality
and gain a little type-safety in the process.

diff --git a/block/qed.c b/block/qed.c
index XXXXXXX..XXXXXXX 100644
--- a/block/qed.c
+++ b/block/qed.c
@@ -XXX,XX +XXX,XX @@ static CachedL2Table *qed_new_l2_table(BDRVQEDState *s)
     return l2_table;
 }
 
-static void qed_aio_next_io(void *opaque, int ret);
+static void qed_aio_next_io(QEDAIOCB *acb, int ret);
+
+static void qed_aio_start_io(QEDAIOCB *acb)
+{
+    qed_aio_next_io(acb, 0);
+}
+
+static void qed_aio_next_io_cb(void *opaque, int ret)
+{
+    QEDAIOCB *acb = opaque;
+
+    qed_aio_next_io(acb, ret);
+}
 
 static void qed_plug_allocating_write_reqs(BDRVQEDState *s)
 {
@@ -XXX,XX +XXX,XX @@ static void qed_unplug_allocating_write_reqs(BDRVQEDState *s)
 
     acb = QSIMPLEQ_FIRST(&s->allocating_write_reqs);
     if (acb) {
-        qed_aio_next_io(acb, 0);
+        qed_aio_start_io(acb);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void qed_aio_complete(QEDAIOCB *acb, int ret)
         QSIMPLEQ_REMOVE_HEAD(&s->allocating_write_reqs, next);
         acb = QSIMPLEQ_FIRST(&s->allocating_write_reqs);
         if (acb) {
-            qed_aio_next_io(acb, 0);
+            qed_aio_start_io(acb);
         } else if (s->header.features & QED_F_NEED_CHECK) {
             qed_start_need_check_timer(s);
         }
@@ -XXX,XX +XXX,XX @@ static void qed_commit_l2_update(void *opaque, int ret)
     acb->request.l2_table = qed_find_l2_cache_entry(&s->l2_cache, l2_offset);
     assert(acb->request.l2_table != NULL);
 
-    qed_aio_next_io(opaque, ret);
+    qed_aio_next_io(acb, ret);
 }
 
 /**
@@ -XXX,XX +XXX,XX @@ static void qed_aio_write_l2_update(QEDAIOCB *acb, int ret, uint64_t offset)
     if (need_alloc) {
         /* Write out the whole new L2 table */
         qed_write_l2_table(s, &acb->request, 0, s->table_nelems, true,
-                            qed_aio_write_l1_update, acb);
+                           qed_aio_write_l1_update, acb);
     } else {
         /* Write out only the updated part of the L2 table */
         qed_write_l2_table(s, &acb->request, index, acb->cur_nclusters, false,
-                            qed_aio_next_io, acb);
+                           qed_aio_next_io_cb, acb);
     }
     return;
 
@@ -XXX,XX +XXX,XX @@ static void qed_aio_write_main(void *opaque, int ret)
     }
 
     if (acb->find_cluster_ret == QED_CLUSTER_FOUND) {
-        next_fn = qed_aio_next_io;
+        next_fn = qed_aio_next_io_cb;
     } else {
         if (s->bs->backing) {
             next_fn = qed_aio_write_flush_before_l2_update;
@@ -XXX,XX +XXX,XX @@ static void qed_aio_write_alloc(QEDAIOCB *acb, size_t len)
     if (acb->flags & QED_AIOCB_ZERO) {
         /* Skip ahead if the clusters are already zero */
         if (acb->find_cluster_ret == QED_CLUSTER_ZERO) {
-            qed_aio_next_io(acb, 0);
+            qed_aio_start_io(acb);
             return;
         }
 
@@ -XXX,XX +XXX,XX @@ static void qed_aio_read_data(void *opaque, int ret,
     /* Handle zero cluster and backing file reads */
     if (ret == QED_CLUSTER_ZERO) {
         qemu_iovec_memset(&acb->cur_qiov, 0, 0, acb->cur_qiov.size);
-        qed_aio_next_io(acb, 0);
+        qed_aio_start_io(acb);
         return;
     } else if (ret != QED_CLUSTER_FOUND) {
         qed_read_backing_file(s, acb->cur_pos, &acb->cur_qiov,
-                              &acb->backing_qiov, qed_aio_next_io, acb);
+                              &acb->backing_qiov, qed_aio_next_io_cb, acb);
         return;
     }
 
     BLKDBG_EVENT(bs->file, BLKDBG_READ_AIO);
     bdrv_aio_readv(bs->file, offset / BDRV_SECTOR_SIZE,
                    &acb->cur_qiov, acb->cur_qiov.size / BDRV_SECTOR_SIZE,
-                   qed_aio_next_io, acb);
+                   qed_aio_next_io_cb, acb);
     return;
 
 err:
@@ -XXX,XX +XXX,XX @@ err:
 /**
  * Begin next I/O or complete the request
  */
-static void qed_aio_next_io(void *opaque, int ret)
+static void qed_aio_next_io(QEDAIOCB *acb, int ret)
 {
-    QEDAIOCB *acb = opaque;
     BDRVQEDState *s = acb_to_s(acb);
     QEDFindClusterFunc *io_fn = (acb->flags & QED_AIOCB_WRITE) ?
                                 qed_aio_write_data : qed_aio_read_data;
@@ -XXX,XX +XXX,XX @@ static BlockAIOCB *qed_aio_setup(BlockDriverState *bs,
     qemu_iovec_init(&acb->cur_qiov, qiov->niov);
 
     /* Start request */
-    qed_aio_next_io(acb, 0);
+    qed_aio_start_io(acb);
     return &acb->common;
 }
 
-- 
2.9.3

From: Paolo Bonzini <pbonzini@redhat.com>

The AioContext data structures are now protected by list_lock and/or
they are walked with FOREACH_RCU primitives.  There is no need anymore
to acquire the AioContext for the entire duration of aio_dispatch.
Instead, just acquire it before and after invoking the callbacks.
The next step is then to push it further down.

diff --git a/util/aio-posix.c b/util/aio-posix.c
index XXXXXXX..XXXXXXX 100644
--- a/util/aio-posix.c
+++ b/util/aio-posix.c
@@ -XXX,XX +XXX,XX @@ static bool aio_dispatch_handlers(AioContext *ctx)
             (revents & (G_IO_IN | G_IO_HUP | G_IO_ERR)) &&
             aio_node_check(ctx, node->is_external) &&
             node->io_read) {
+            aio_context_acquire(ctx);
             node->io_read(node->opaque);
+            aio_context_release(ctx);
 
             /* aio_notify() does not count as progress */
             if (node->opaque != &ctx->notifier) {
@@ -XXX,XX +XXX,XX @@ static bool aio_dispatch_handlers(AioContext *ctx)
             (revents & (G_IO_OUT | G_IO_ERR)) &&
             aio_node_check(ctx, node->is_external) &&
             node->io_write) {
+            aio_context_acquire(ctx);
             node->io_write(node->opaque);
+            aio_context_release(ctx);
             progress = true;
         }
 
@@ -XXX,XX +XXX,XX @@ bool aio_dispatch(AioContext *ctx, bool dispatch_fds)
     }
 
     /* Run our timers */
+    aio_context_acquire(ctx);
     progress |= timerlistgroup_run_timers(&ctx->tlg);
+    aio_context_release(ctx);
 
     return progress;
 }
@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
     int64_t timeout;
     int64_t start = 0;
 
-    aio_context_acquire(ctx);
-    progress = false;
-
     /* aio_notify can avoid the expensive event_notifier_set if
      * everything (file descriptors, bottom halves, timers) will
      * be re-evaluated before the next blocking poll().  This is
@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
         start = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);
     }
 
-    if (try_poll_mode(ctx, blocking)) {
-        progress = true;
-    } else {
+    aio_context_acquire(ctx);
+    progress = try_poll_mode(ctx, blocking);
+    aio_context_release(ctx);
+
+    if (!progress) {
         assert(npfd == 0);
 
         /* fill pollfds */
@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
         timeout = blocking ? aio_compute_timeout(ctx) : 0;
 
         /* wait until next event */
-        if (timeout) {
-            aio_context_release(ctx);
-        }
         if (aio_epoll_check_poll(ctx, pollfds, npfd, timeout)) {
             AioHandler epoll_handler;
 
@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
         } else  {
             ret = qemu_poll_ns(pollfds, npfd, timeout);
         }
-        if (timeout) {
-            aio_context_acquire(ctx);
-        }
     }
 
     if (blocking) {
@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
         progress = true;
     }
 
-    aio_context_release(ctx);
-
     return progress;
 }
 
diff --git a/util/aio-win32.c b/util/aio-win32.c
index XXXXXXX..XXXXXXX 100644
--- a/util/aio-win32.c
+++ b/util/aio-win32.c
@@ -XXX,XX +XXX,XX @@ static bool aio_dispatch_handlers(AioContext *ctx, HANDLE event)
             (revents || event_notifier_get_handle(node->e) == event) &&
             node->io_notify) {
             node->pfd.revents = 0;
+            aio_context_acquire(ctx);
             node->io_notify(node->e);
+            aio_context_release(ctx);
 
             /* aio_notify() does not count as progress */
             if (node->e != &ctx->notifier) {
@@ -XXX,XX +XXX,XX @@ static bool aio_dispatch_handlers(AioContext *ctx, HANDLE event)
             (node->io_read || node->io_write)) {
             node->pfd.revents = 0;
             if ((revents & G_IO_IN) && node->io_read) {
+                aio_context_acquire(ctx);
                 node->io_read(node->opaque);
+                aio_context_release(ctx);
                 progress = true;
             }
             if ((revents & G_IO_OUT) && node->io_write) {
+                aio_context_acquire(ctx);
                 node->io_write(node->opaque);
+                aio_context_release(ctx);
                 progress = true;
             }
 
@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
     int count;
     int timeout;
 
-    aio_context_acquire(ctx);
     progress = false;
 
     /* aio_notify can avoid the expensive event_notifier_set if
@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
 
         timeout = blocking && !have_select_revents
             ? qemu_timeout_ns_to_ms(aio_compute_timeout(ctx)) : 0;
-        if (timeout) {
-            aio_context_release(ctx);
-        }
         ret = WaitForMultipleObjects(count, events, FALSE, timeout);
         if (blocking) {
             assert(first);
             atomic_sub(&ctx->notify_me, 2);
         }
-        if (timeout) {
-            aio_context_acquire(ctx);
-        }
 
         if (first) {
             aio_notify_accept(ctx);
@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
         progress |= aio_dispatch_handlers(ctx, event);
     } while (count > 0);
 
+    aio_context_acquire(ctx);
     progress |= timerlistgroup_run_timers(&ctx->tlg);
-
     aio_context_release(ctx);
     return progress;
 }
diff --git a/util/async.c b/util/async.c
index XXXXXXX..XXXXXXX 100644
--- a/util/async.c
+++ b/util/async.c
@@ -XXX,XX +XXX,XX @@ int aio_bh_poll(AioContext *ctx)
                 ret = 1;
             }
             bh->idle = 0;
+            aio_context_acquire(ctx);
             aio_bh_call(bh);
+            aio_context_release(ctx);
         }
         if (bh->deleted) {
             deleted = true;
-- 
2.9.3

From: Paolo Bonzini <pbonzini@redhat.com>

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 20170213135235.12274-13-pbonzini@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/qed.h                 |  3 +++
 block/curl.c                |  2 ++
 block/io.c                  |  5 +++++
 block/iscsi.c               |  8 ++++++--
 block/null.c                |  4 ++++
 block/qed.c                 | 12 ++++++++++++
 block/throttle-groups.c     |  2 ++
 util/aio-posix.c            |  2 --
 util/aio-win32.c            |  2 --
 util/qemu-coroutine-sleep.c |  2 +-
 10 files changed, 35 insertions(+), 7 deletions(-)

diff --git a/block/qed.h b/block/qed.h
index XXXXXXX..XXXXXXX 100644
--- a/block/qed.h
+++ b/block/qed.h
@@ -XXX,XX +XXX,XX @@ enum {
  */
 typedef void QEDFindClusterFunc(void *opaque, int ret, uint64_t offset, size_t len);
 
+void qed_acquire(BDRVQEDState *s);
+void qed_release(BDRVQEDState *s);
+
 /**
  * Generic callback for chaining async callbacks
  */
diff --git a/block/curl.c b/block/curl.c
index XXXXXXX..XXXXXXX 100644
--- a/block/curl.c
+++ b/block/curl.c
@@ -XXX,XX +XXX,XX @@ static void curl_multi_timeout_do(void *arg)
         return;
     }
 
+    aio_context_acquire(s->aio_context);
     curl_multi_socket_action(s->multi, CURL_SOCKET_TIMEOUT, 0, &running);
 
     curl_multi_check_completion(s);
+    aio_context_release(s->aio_context);
 #else
     abort();
 #endif
diff --git a/block/io.c b/block/io.c
index XXXXXXX..XXXXXXX 100644
--- a/block/io.c
+++ b/block/io.c
@@ -XXX,XX +XXX,XX @@ void bdrv_aio_cancel(BlockAIOCB *acb)
         if (acb->aiocb_info->get_aio_context) {
             aio_poll(acb->aiocb_info->get_aio_context(acb), true);
         } else if (acb->bs) {
+            /* qemu_aio_ref and qemu_aio_unref are not thread-safe, so
+             * assert that we're not using an I/O thread.  Thread-safe
+             * code should use bdrv_aio_cancel_async exclusively.
+             */
+            assert(bdrv_get_aio_context(acb->bs) == qemu_get_aio_context());
             aio_poll(bdrv_get_aio_context(acb->bs), true);
         } else {
             abort();
diff --git a/block/iscsi.c b/block/iscsi.c
index XXXXXXX..XXXXXXX 100644
--- a/block/iscsi.c
+++ b/block/iscsi.c
@@ -XXX,XX +XXX,XX @@ static void iscsi_retry_timer_expired(void *opaque)
     struct IscsiTask *iTask = opaque;
     iTask->complete = 1;
     if (iTask->co) {
-        qemu_coroutine_enter(iTask->co);
+        aio_co_wake(iTask->co);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void iscsi_nop_timed_event(void *opaque)
 {
     IscsiLun *iscsilun = opaque;
 
+    aio_context_acquire(iscsilun->aio_context);
     if (iscsi_get_nops_in_flight(iscsilun->iscsi) >= MAX_NOP_FAILURES) {
         error_report("iSCSI: NOP timeout. Reconnecting...");
         iscsilun->request_timed_out = true;
     } else if (iscsi_nop_out_async(iscsilun->iscsi, NULL, NULL, 0, NULL) != 0) {
         error_report("iSCSI: failed to sent NOP-Out. Disabling NOP messages.");
-        return;
+        goto out;
     }
 
     timer_mod(iscsilun->nop_timer, qemu_clock_get_ms(QEMU_CLOCK_REALTIME) + NOP_INTERVAL);
     iscsi_set_events(iscsilun);
+
+out:
+    aio_context_release(iscsilun->aio_context);
 }
 
 static void iscsi_readcapacity_sync(IscsiLun *iscsilun, Error **errp)
diff --git a/block/null.c b/block/null.c
index XXXXXXX..XXXXXXX 100644
--- a/block/null.c
+++ b/block/null.c
@@ -XXX,XX +XXX,XX @@ static void null_bh_cb(void *opaque)
 static void null_timer_cb(void *opaque)
 {
     NullAIOCB *acb = opaque;
+    AioContext *ctx = bdrv_get_aio_context(acb->common.bs);
+
+    aio_context_acquire(ctx);
     acb->common.cb(acb->common.opaque, 0);
+    aio_context_release(ctx);
     timer_deinit(&acb->timer);
     qemu_aio_unref(acb);
 }
diff --git a/block/qed.c b/block/qed.c
index XXXXXXX..XXXXXXX 100644
--- a/block/qed.c
+++ b/block/qed.c
@@ -XXX,XX +XXX,XX @@ static void qed_need_check_timer_cb(void *opaque)
 
     trace_qed_need_check_timer_cb(s);
 
+    qed_acquire(s);
     qed_plug_allocating_write_reqs(s);
 
     /* Ensure writes are on disk before clearing flag */
     bdrv_aio_flush(s->bs->file->bs, qed_clear_need_check, s);
+    qed_release(s);
+}
+
+void qed_acquire(BDRVQEDState *s)
+{
+    aio_context_acquire(bdrv_get_aio_context(s->bs));
+}
+
+void qed_release(BDRVQEDState *s)
+{
+    aio_context_release(bdrv_get_aio_context(s->bs));
 }
 
 static void qed_start_need_check_timer(BDRVQEDState *s)
diff --git a/block/throttle-groups.c b/block/throttle-groups.c
index XXXXXXX..XXXXXXX 100644
--- a/block/throttle-groups.c
+++ b/block/throttle-groups.c
@@ -XXX,XX +XXX,XX @@ static void timer_cb(BlockBackend *blk, bool is_write)
     qemu_mutex_unlock(&tg->lock);
 
     /* Run the request that was waiting for this timer */
+    aio_context_acquire(blk_get_aio_context(blk));
     empty_queue = !qemu_co_enter_next(&blkp->throttled_reqs[is_write]);
+    aio_context_release(blk_get_aio_context(blk));
 
     /* If the request queue was empty then we have to take care of
      * scheduling the next one */
diff --git a/util/aio-posix.c b/util/aio-posix.c
index XXXXXXX..XXXXXXX 100644
--- a/util/aio-posix.c
+++ b/util/aio-posix.c
@@ -XXX,XX +XXX,XX @@ bool aio_dispatch(AioContext *ctx, bool dispatch_fds)
     }
 
     /* Run our timers */
-    aio_context_acquire(ctx);
     progress |= timerlistgroup_run_timers(&ctx->tlg);
-    aio_context_release(ctx);
 
     return progress;
 }
diff --git a/util/aio-win32.c b/util/aio-win32.c
index XXXXXXX..XXXXXXX 100644
--- a/util/aio-win32.c
+++ b/util/aio-win32.c
@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
         progress |= aio_dispatch_handlers(ctx, event);
     } while (count > 0);
 
-    aio_context_acquire(ctx);
     progress |= timerlistgroup_run_timers(&ctx->tlg);
-    aio_context_release(ctx);
     return progress;
 }
 
diff --git a/util/qemu-coroutine-sleep.c b/util/qemu-coroutine-sleep.c
index XXXXXXX..XXXXXXX 100644
--- a/util/qemu-coroutine-sleep.c
+++ b/util/qemu-coroutine-sleep.c
@@ -XXX,XX +XXX,XX @@ static void co_sleep_cb(void *opaque)
 {
     CoSleepCB *sleep_cb = opaque;
 
-    qemu_coroutine_enter(sleep_cb->co);
+    aio_co_wake(sleep_cb->co);
 }
 
 void coroutine_fn co_aio_sleep_ns(AioContext *ctx, QEMUClockType type,
-- 
2.9.3

From: Paolo Bonzini <pbonzini@redhat.com>

This covers both file descriptor callbacks and polling callbacks,
since they execute related code.

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 20170213135235.12274-14-pbonzini@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/curl.c          | 16 +++++++++++++---
 block/iscsi.c         |  4 ++++
 block/linux-aio.c     |  4 ++++
 block/nfs.c           |  6 ++++++
 block/sheepdog.c      | 29 +++++++++++++++--------------
 block/ssh.c           | 29 +++++++++--------------------
 block/win32-aio.c     | 10 ++++++----
 hw/block/virtio-blk.c |  5 ++++-
 hw/scsi/virtio-scsi.c |  7 +++++++
 util/aio-posix.c      |  7 -------
 util/aio-win32.c      |  6 ------
 11 files changed, 68 insertions(+), 55 deletions(-)

diff --git a/block/curl.c b/block/curl.c
index XXXXXXX..XXXXXXX 100644
--- a/block/curl.c
+++ b/block/curl.c
@@ -XXX,XX +XXX,XX @@ static void curl_multi_check_completion(BDRVCURLState *s)
     }
 }
 
-static void curl_multi_do(void *arg)
+static void curl_multi_do_locked(CURLState *s)
 {
-    CURLState *s = (CURLState *)arg;
     CURLSocket *socket, *next_socket;
     int running;
     int r;
@@ -XXX,XX +XXX,XX @@ static void curl_multi_do(void *arg)
     }
 }
 
+static void curl_multi_do(void *arg)
+{
+    CURLState *s = (CURLState *)arg;
+
+    aio_context_acquire(s->s->aio_context);
+    curl_multi_do_locked(s);
+    aio_context_release(s->s->aio_context);
+}
+
 static void curl_multi_read(void *arg)
 {
     CURLState *s = (CURLState *)arg;
 
-    curl_multi_do(arg);
+    aio_context_acquire(s->s->aio_context);
+    curl_multi_do_locked(s);
     curl_multi_check_completion(s->s);
+    aio_context_release(s->s->aio_context);
 }
 
 static void curl_multi_timeout_do(void *arg)
diff --git a/block/iscsi.c b/block/iscsi.c
index XXXXXXX..XXXXXXX 100644
--- a/block/iscsi.c
+++ b/block/iscsi.c
@@ -XXX,XX +XXX,XX @@ iscsi_process_read(void *arg)
     IscsiLun *iscsilun = arg;
     struct iscsi_context *iscsi = iscsilun->iscsi;
 
+    aio_context_acquire(iscsilun->aio_context);
     iscsi_service(iscsi, POLLIN);
     iscsi_set_events(iscsilun);
+    aio_context_release(iscsilun->aio_context);
 }
 
 static void
@@ -XXX,XX +XXX,XX @@ iscsi_process_write(void *arg)
     IscsiLun *iscsilun = arg;
     struct iscsi_context *iscsi = iscsilun->iscsi;
 
+    aio_context_acquire(iscsilun->aio_context);
     iscsi_service(iscsi, POLLOUT);
     iscsi_set_events(iscsilun);
+    aio_context_release(iscsilun->aio_context);
 }
 
 static int64_t sector_lun2qemu(int64_t sector, IscsiLun *iscsilun)
diff --git a/block/linux-aio.c b/block/linux-aio.c
index XXXXXXX..XXXXXXX 100644
--- a/block/linux-aio.c
+++ b/block/linux-aio.c
@@ -XXX,XX +XXX,XX @@ static void qemu_laio_completion_cb(EventNotifier *e)
     LinuxAioState *s = container_of(e, LinuxAioState, e);
 
     if (event_notifier_test_and_clear(&s->e)) {
+        aio_context_acquire(s->aio_context);
         qemu_laio_process_completions_and_submit(s);
+        aio_context_release(s->aio_context);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static bool qemu_laio_poll_cb(void *opaque)
         return false;
     }
 
+    aio_context_acquire(s->aio_context);
     qemu_laio_process_completions_and_submit(s);
+    aio_context_release(s->aio_context);
     return true;
 }
 
diff --git a/block/nfs.c b/block/nfs.c
index XXXXXXX..XXXXXXX 100644
--- a/block/nfs.c
+++ b/block/nfs.c
@@ -XXX,XX +XXX,XX @@ static void nfs_set_events(NFSClient *client)
 static void nfs_process_read(void *arg)
 {
     NFSClient *client = arg;
+
+    aio_context_acquire(client->aio_context);
     nfs_service(client->context, POLLIN);
     nfs_set_events(client);
+    aio_context_release(client->aio_context);
 }
 
 static void nfs_process_write(void *arg)
 {
     NFSClient *client = arg;
+
+    aio_context_acquire(client->aio_context);
     nfs_service(client->context, POLLOUT);
     nfs_set_events(client);
+    aio_context_release(client->aio_context);
 }
 
 static void nfs_co_init_task(BlockDriverState *bs, NFSRPC *task)
diff --git a/block/sheepdog.c b/block/sheepdog.c
index XXXXXXX..XXXXXXX 100644
--- a/block/sheepdog.c
+++ b/block/sheepdog.c
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int send_co_req(int sockfd, SheepdogReq *hdr, void *data,
     return ret;
 }
 
-static void restart_co_req(void *opaque)
-{
-    Coroutine *co = opaque;
-
-    qemu_coroutine_enter(co);
-}
-
 typedef struct SheepdogReqCo {
     int sockfd;
     BlockDriverState *bs;
@@ -XXX,XX +XXX,XX @@ typedef struct SheepdogReqCo {
     unsigned int *rlen;
     int ret;
     bool finished;
+    Coroutine *co;
 } SheepdogReqCo;
 
+static void restart_co_req(void *opaque)
+{
+    SheepdogReqCo *srco = opaque;
+
+    aio_co_wake(srco->co);
+}
+
 static coroutine_fn void do_co_req(void *opaque)
 {
     int ret;
-    Coroutine *co;
     SheepdogReqCo *srco = opaque;
     int sockfd = srco->sockfd;
     SheepdogReq *hdr = srco->hdr;
@@ -XXX,XX +XXX,XX @@ static coroutine_fn void do_co_req(void *opaque)
     unsigned int *wlen = srco->wlen;
     unsigned int *rlen = srco->rlen;
 
-    co = qemu_coroutine_self();
+    srco->co = qemu_coroutine_self();
     aio_set_fd_handler(srco->aio_context, sockfd, false,
-                       NULL, restart_co_req, NULL, co);
+                       NULL, restart_co_req, NULL, srco);
 
     ret = send_co_req(sockfd, hdr, data, wlen);
     if (ret < 0) {
@@ -XXX,XX +XXX,XX @@ static coroutine_fn void do_co_req(void *opaque)
     }
 
     aio_set_fd_handler(srco->aio_context, sockfd, false,
-                       restart_co_req, NULL, NULL, co);
+                       restart_co_req, NULL, NULL, srco);
 
     ret = qemu_co_recv(sockfd, hdr, sizeof(*hdr));
     if (ret != sizeof(*hdr)) {
@@ -XXX,XX +XXX,XX @@ out:
     aio_set_fd_handler(srco->aio_context, sockfd, false,
                        NULL, NULL, NULL, NULL);
 
+    srco->co = NULL;
     srco->ret = ret;
     srco->finished = true;
     if (srco->bs) {
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn aio_read_response(void *opaque)
          * We've finished all requests which belong to the AIOCB, so
          * we can switch back to sd_co_readv/writev now.
          */
-        qemu_coroutine_enter(acb->coroutine);
+        aio_co_wake(acb->coroutine);
     }
 
     return;
@@ -XXX,XX +XXX,XX @@ static void co_read_response(void *opaque)
         s->co_recv = qemu_coroutine_create(aio_read_response, opaque);
     }
 
-    qemu_coroutine_enter(s->co_recv);
+    aio_co_wake(s->co_recv);
 }
 
 static void co_write_request(void *opaque)
 {
     BDRVSheepdogState *s = opaque;
 
-    qemu_coroutine_enter(s->co_send);
+    aio_co_wake(s->co_send);
 }
 
 /*
diff --git a/block/ssh.c b/block/ssh.c
index XXXXXXX..XXXXXXX 100644
--- a/block/ssh.c
+++ b/block/ssh.c
@@ -XXX,XX +XXX,XX @@ static void restart_coroutine(void *opaque)
 
     DPRINTF("co=%p", co);
 
-    qemu_coroutine_enter(co);
+    aio_co_wake(co);
 }
 
-static coroutine_fn void set_fd_handler(BDRVSSHState *s, BlockDriverState *bs)
+/* A non-blocking call returned EAGAIN, so yield, ensuring the
+ * handlers are set up so that we'll be rescheduled when there is an
+ * interesting event on the socket.
+ */
+static coroutine_fn void co_yield(BDRVSSHState *s, BlockDriverState *bs)
 {
     int r;
     IOHandler *rd_handler = NULL, *wr_handler = NULL;
@@ -XXX,XX +XXX,XX @@ static coroutine_fn void set_fd_handler(BDRVSSHState *s, BlockDriverState *bs)
 
     aio_set_fd_handler(bdrv_get_aio_context(bs), s->sock,
                        false, rd_handler, wr_handler, NULL, co);
-}
-
-static coroutine_fn void clear_fd_handler(BDRVSSHState *s,
-                                          BlockDriverState *bs)
-{
-    DPRINTF("s->sock=%d", s->sock);
-    aio_set_fd_handler(bdrv_get_aio_context(bs), s->sock,
-                       false, NULL, NULL, NULL, NULL);
-}
-
-/* A non-blocking call returned EAGAIN, so yield, ensuring the
- * handlers are set up so that we'll be rescheduled when there is an
- * interesting event on the socket.
- */
-static coroutine_fn void co_yield(BDRVSSHState *s, BlockDriverState *bs)
-{
-    set_fd_handler(s, bs);
     qemu_coroutine_yield();
-    clear_fd_handler(s, bs);
+    DPRINTF("s->sock=%d - back", s->sock);
+    aio_set_fd_handler(bdrv_get_aio_context(bs), s->sock, false,
+                       NULL, NULL, NULL, NULL);
 }
 
 /* SFTP has a function `libssh2_sftp_seek64' which seeks to a position
diff --git a/block/win32-aio.c b/block/win32-aio.c
index XXXXXXX..XXXXXXX 100644
--- a/block/win32-aio.c
+++ b/block/win32-aio.c
@@ -XXX,XX +XXX,XX @@ struct QEMUWin32AIOState {
     HANDLE hIOCP;
     EventNotifier e;
     int count;
-    bool is_aio_context_attached;
+    AioContext *aio_ctx;
 };
 
 typedef struct QEMUWin32AIOCB {
@@ -XXX,XX +XXX,XX @@ static void win32_aio_process_completion(QEMUWin32AIOState *s,
     }
 
 
+    aio_context_acquire(s->aio_ctx);
     waiocb->common.cb(waiocb->common.opaque, ret);
+    aio_context_release(s->aio_ctx);
     qemu_aio_unref(waiocb);
 }
 
@@ -XXX,XX +XXX,XX @@ void win32_aio_detach_aio_context(QEMUWin32AIOState *aio,
                                   AioContext *old_context)
 {
     aio_set_event_notifier(old_context, &aio->e, false, NULL, NULL);
-    aio->is_aio_context_attached = false;
+    aio->aio_ctx = NULL;
 }
 
 void win32_aio_attach_aio_context(QEMUWin32AIOState *aio,
                                   AioContext *new_context)
 {
-    aio->is_aio_context_attached = true;
+    aio->aio_ctx = new_context;
     aio_set_event_notifier(new_context, &aio->e, false,
                            win32_aio_completion_cb, NULL);
 }
@@ -XXX,XX +XXX,XX @@ out_free_state:
 
 void win32_aio_cleanup(QEMUWin32AIOState *aio)
 {
-    assert(!aio->is_aio_context_attached);
+    assert(!aio->aio_ctx);
     CloseHandle(aio->hIOCP);
     event_notifier_cleanup(&aio->e);
     g_free(aio);
diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/virtio-blk.c
+++ b/hw/block/virtio-blk.c
@@ -XXX,XX +XXX,XX @@ static void virtio_blk_ioctl_complete(void *opaque, int status)
 {
     VirtIOBlockIoctlReq *ioctl_req = opaque;
     VirtIOBlockReq *req = ioctl_req->req;
-    VirtIODevice *vdev = VIRTIO_DEVICE(req->dev);
+    VirtIOBlock *s = req->dev;
+    VirtIODevice *vdev = VIRTIO_DEVICE(s);
     struct virtio_scsi_inhdr *scsi;
     struct sg_io_hdr *hdr;
 
@@ -XXX,XX +XXX,XX @@ bool virtio_blk_handle_vq(VirtIOBlock *s, VirtQueue *vq)
     MultiReqBuffer mrb = {};
     bool progress = false;
 
+    aio_context_acquire(blk_get_aio_context(s->blk));
     blk_io_plug(s->blk);
 
     do {
@@ -XXX,XX +XXX,XX @@ bool virtio_blk_handle_vq(VirtIOBlock *s, VirtQueue *vq)
     }
 
     blk_io_unplug(s->blk);
+    aio_context_release(blk_get_aio_context(s->blk));
     return progress;
 }
 
diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/scsi/virtio-scsi.c
+++ b/hw/scsi/virtio-scsi.c
@@ -XXX,XX +XXX,XX @@ bool virtio_scsi_handle_ctrl_vq(VirtIOSCSI *s, VirtQueue *vq)
     VirtIOSCSIReq *req;
     bool progress = false;
 
+    virtio_scsi_acquire(s);
     while ((req = virtio_scsi_pop_req(s, vq))) {
         progress = true;
         virtio_scsi_handle_ctrl_req(s, req);
     }
+    virtio_scsi_release(s);
     return progress;
 }
 
@@ -XXX,XX +XXX,XX @@ bool virtio_scsi_handle_cmd_vq(VirtIOSCSI *s, VirtQueue *vq)
 
     QTAILQ_HEAD(, VirtIOSCSIReq) reqs = QTAILQ_HEAD_INITIALIZER(reqs);
 
+    virtio_scsi_acquire(s);
     do {
         virtio_queue_set_notification(vq, 0);
 
@@ -XXX,XX +XXX,XX @@ bool virtio_scsi_handle_cmd_vq(VirtIOSCSI *s, VirtQueue *vq)
     QTAILQ_FOREACH_SAFE(req, &reqs, next, next) {
         virtio_scsi_handle_cmd_req_submit(s, req);
     }
+    virtio_scsi_release(s);
     return progress;
 }
 
@@ -XXX,XX +XXX,XX @@ out:
 
 bool virtio_scsi_handle_event_vq(VirtIOSCSI *s, VirtQueue *vq)
 {
+    virtio_scsi_acquire(s);
     if (s->events_dropped) {
         virtio_scsi_push_event(s, NULL, VIRTIO_SCSI_T_NO_EVENT, 0);
+        virtio_scsi_release(s);
         return true;
     }
+    virtio_scsi_release(s);
     return false;
 }
 
diff --git a/util/aio-posix.c b/util/aio-posix.c
index XXXXXXX..XXXXXXX 100644
--- a/util/aio-posix.c
+++ b/util/aio-posix.c
@@ -XXX,XX +XXX,XX @@ static bool aio_dispatch_handlers(AioContext *ctx)
             (revents & (G_IO_IN | G_IO_HUP | G_IO_ERR)) &&
             aio_node_check(ctx, node->is_external) &&
             node->io_read) {
-            aio_context_acquire(ctx);
             node->io_read(node->opaque);
-            aio_context_release(ctx);
 
             /* aio_notify() does not count as progress */
             if (node->opaque != &ctx->notifier) {
@@ -XXX,XX +XXX,XX @@ static bool aio_dispatch_handlers(AioContext *ctx)
             (revents & (G_IO_OUT | G_IO_ERR)) &&
             aio_node_check(ctx, node->is_external) &&
             node->io_write) {
-            aio_context_acquire(ctx);
             node->io_write(node->opaque);
-            aio_context_release(ctx);
             progress = true;
         }
 
@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
         start = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);
     }
 
-    aio_context_acquire(ctx);
     progress = try_poll_mode(ctx, blocking);
-    aio_context_release(ctx);
-
     if (!progress) {
         assert(npfd == 0);
 
diff --git a/util/aio-win32.c b/util/aio-win32.c
index XXXXXXX..XXXXXXX 100644
--- a/util/aio-win32.c
+++ b/util/aio-win32.c
@@ -XXX,XX +XXX,XX @@ static bool aio_dispatch_handlers(AioContext *ctx, HANDLE event)
             (revents || event_notifier_get_handle(node->e) == event) &&
             node->io_notify) {
             node->pfd.revents = 0;
-            aio_context_acquire(ctx);
             node->io_notify(node->e);
-            aio_context_release(ctx);
 
             /* aio_notify() does not count as progress */
             if (node->e != &ctx->notifier) {
@@ -XXX,XX +XXX,XX @@ static bool aio_dispatch_handlers(AioContext *ctx, HANDLE event)
             (node->io_read || node->io_write)) {
             node->pfd.revents = 0;
             if ((revents & G_IO_IN) && node->io_read) {
-                aio_context_acquire(ctx);
                 node->io_read(node->opaque);
-                aio_context_release(ctx);
                 progress = true;
             }
             if ((revents & G_IO_OUT) && node->io_write) {
-                aio_context_acquire(ctx);
                 node->io_write(node->opaque);
-                aio_context_release(ctx);
                 progress = true;
             }
 
-- 
2.9.3

From: Paolo Bonzini <pbonzini@redhat.com>

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 20170213135235.12274-15-pbonzini@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/archipelago.c   |  3 +++
 block/blkreplay.c     |  2 +-
 block/block-backend.c |  6 ++++++
 block/curl.c          | 26 ++++++++++++++++++--------
 block/gluster.c       |  9 +--------
 block/io.c            |  6 +++++-
 block/iscsi.c         |  6 +++++-
 block/linux-aio.c     | 15 +++++++++------
 block/nfs.c           |  3 ++-
 block/null.c          |  4 ++++
 block/qed.c           |  3 +++
 block/rbd.c           |  4 ++++
 dma-helpers.c         |  2 ++
 hw/block/virtio-blk.c |  2 ++
 hw/scsi/scsi-bus.c    |  2 ++
 util/async.c          |  4 ++--
 util/thread-pool.c    |  2 ++
 17 files changed, 71 insertions(+), 28 deletions(-)

diff --git a/block/archipelago.c b/block/archipelago.c
index XXXXXXX..XXXXXXX 100644
--- a/block/archipelago.c
+++ b/block/archipelago.c
@@ -XXX,XX +XXX,XX @@ static void qemu_archipelago_complete_aio(void *opaque)
 {
     AIORequestData *reqdata = (AIORequestData *) opaque;
     ArchipelagoAIOCB *aio_cb = (ArchipelagoAIOCB *) reqdata->aio_cb;
+    AioContext *ctx = bdrv_get_aio_context(aio_cb->common.bs);
 
+    aio_context_acquire(ctx);
     aio_cb->common.cb(aio_cb->common.opaque, aio_cb->ret);
+    aio_context_release(ctx);
     aio_cb->status = 0;
 
     qemu_aio_unref(aio_cb);
diff --git a/block/blkreplay.c b/block/blkreplay.c
index XXXXXXX..XXXXXXX 100755
--- a/block/blkreplay.c
+++ b/block/blkreplay.c
@@ -XXX,XX +XXX,XX @@ static int64_t blkreplay_getlength(BlockDriverState *bs)
 static void blkreplay_bh_cb(void *opaque)
 {
     Request *req = opaque;
-    qemu_coroutine_enter(req->co);
+    aio_co_wake(req->co);
     qemu_bh_delete(req->bh);
     g_free(req);
 }
diff --git a/block/block-backend.c b/block/block-backend.c
index XXXXXXX..XXXXXXX 100644
--- a/block/block-backend.c
+++ b/block/block-backend.c
@@ -XXX,XX +XXX,XX @@ int blk_make_zero(BlockBackend *blk, BdrvRequestFlags flags)
 static void error_callback_bh(void *opaque)
 {
     struct BlockBackendAIOCB *acb = opaque;
+    AioContext *ctx = bdrv_get_aio_context(acb->common.bs);
 
     bdrv_dec_in_flight(acb->common.bs);
+    aio_context_acquire(ctx);
     acb->common.cb(acb->common.opaque, acb->ret);
+    aio_context_release(ctx);
     qemu_aio_unref(acb);
 }
 
@@ -XXX,XX +XXX,XX @@ static void blk_aio_complete(BlkAioEmAIOCB *acb)
 static void blk_aio_complete_bh(void *opaque)
 {
     BlkAioEmAIOCB *acb = opaque;
+    AioContext *ctx = bdrv_get_aio_context(acb->common.bs);
 
     assert(acb->has_returned);
+    aio_context_acquire(ctx);
     blk_aio_complete(acb);
+    aio_context_release(ctx);
 }
 
 static BlockAIOCB *blk_aio_prwv(BlockBackend *blk, int64_t offset, int bytes,
diff --git a/block/curl.c b/block/curl.c
index XXXXXXX..XXXXXXX 100644
--- a/block/curl.c
+++ b/block/curl.c
@@ -XXX,XX +XXX,XX @@ static void curl_readv_bh_cb(void *p)
 {
     CURLState *state;
     int running;
+    int ret = -EINPROGRESS;
 
     CURLAIOCB *acb = p;
-    BDRVCURLState *s = acb->common.bs->opaque;
+    BlockDriverState *bs = acb->common.bs;
+    BDRVCURLState *s = bs->opaque;
+    AioContext *ctx = bdrv_get_aio_context(bs);
 
     size_t start = acb->sector_num * BDRV_SECTOR_SIZE;
     size_t end;
 
+    aio_context_acquire(ctx);
+
     // In case we have the requested data already (e.g. read-ahead),
     // we can just call the callback and be done.
     switch (curl_find_buf(s, start, acb->nb_sectors * BDRV_SECTOR_SIZE, acb)) {
@@ -XXX,XX +XXX,XX @@ static void curl_readv_bh_cb(void *p)
             qemu_aio_unref(acb);
             // fall through
         case FIND_RET_WAIT:
-            return;
+            goto out;
         default:
             break;
     }
@@ -XXX,XX +XXX,XX @@ static void curl_readv_bh_cb(void *p)
     // No cache found, so let's start a new request
     state = curl_init_state(acb->common.bs, s);
     if (!state) {
-        acb->common.cb(acb->common.opaque, -EIO);
-        qemu_aio_unref(acb);
-        return;
+        ret = -EIO;
+        goto out;
     }
 
     acb->start = 0;
@@ -XXX,XX +XXX,XX @@ static void curl_readv_bh_cb(void *p)
     state->orig_buf = g_try_malloc(state->buf_len);
     if (state->buf_len && state->orig_buf == NULL) {
         curl_clean_state(state);
-        acb->common.cb(acb->common.opaque, -ENOMEM);
-        qemu_aio_unref(acb);
-        return;
+        ret = -ENOMEM;
+        goto out;
     }
     state->acb[0] = acb;
 
@@ -XXX,XX +XXX,XX @@ static void curl_readv_bh_cb(void *p)
 
     /* Tell curl it needs to kick things off */
     curl_multi_socket_action(s->multi, CURL_SOCKET_TIMEOUT, 0, &running);
+
+out:
+    if (ret != -EINPROGRESS) {
+        acb->common.cb(acb->common.opaque, ret);
+        qemu_aio_unref(acb);
+    }
+    aio_context_release(ctx);
 }
 
 static BlockAIOCB *curl_aio_readv(BlockDriverState *bs,
diff --git a/block/gluster.c b/block/gluster.c
index XXXXXXX..XXXXXXX 100644
--- a/block/gluster.c
+++ b/block/gluster.c
@@ -XXX,XX +XXX,XX @@ static struct glfs *qemu_gluster_init(BlockdevOptionsGluster *gconf,
     return qemu_gluster_glfs_init(gconf, errp);
 }
 
-static void qemu_gluster_complete_aio(void *opaque)
-{
-    GlusterAIOCB *acb = (GlusterAIOCB *)opaque;
-
-    qemu_coroutine_enter(acb->coroutine);
-}
-
 /*
  * AIO callback routine called from GlusterFS thread.
  */
@@ -XXX,XX +XXX,XX @@ static void gluster_finish_aiocb(struct glfs_fd *fd, ssize_t ret, void *arg)
         acb->ret = -EIO; /* Partial read/write - fail it */
     }
 
-    aio_bh_schedule_oneshot(acb->aio_context, qemu_gluster_complete_aio, acb);
+    aio_co_schedule(acb->aio_context, acb->coroutine);
 }
 
 static void qemu_gluster_parse_flags(int bdrv_flags, int *open_flags)
diff --git a/block/io.c b/block/io.c
index XXXXXXX..XXXXXXX 100644
--- a/block/io.c
+++ b/block/io.c
@@ -XXX,XX +XXX,XX @@ static void bdrv_co_drain_bh_cb(void *opaque)
     bdrv_dec_in_flight(bs);
     bdrv_drained_begin(bs);
     data->done = true;
-    qemu_coroutine_enter(co);
+    aio_co_wake(co);
 }
 
 static void coroutine_fn bdrv_co_yield_to_drain(BlockDriverState *bs)
@@ -XXX,XX +XXX,XX @@ static void bdrv_co_complete(BlockAIOCBCoroutine *acb)
 static void bdrv_co_em_bh(void *opaque)
 {
     BlockAIOCBCoroutine *acb = opaque;
+    BlockDriverState *bs = acb->common.bs;
+    AioContext *ctx = bdrv_get_aio_context(bs);
 
     assert(!acb->need_bh);
+    aio_context_acquire(ctx);
     bdrv_co_complete(acb);
+    aio_context_release(ctx);
 }
 
 static void bdrv_co_maybe_schedule_bh(BlockAIOCBCoroutine *acb)
diff --git a/block/iscsi.c b/block/iscsi.c
index XXXXXXX..XXXXXXX 100644
--- a/block/iscsi.c
+++ b/block/iscsi.c
@@ -XXX,XX +XXX,XX @@ static void
 iscsi_bh_cb(void *p)
 {
     IscsiAIOCB *acb = p;
+    AioContext *ctx = bdrv_get_aio_context(acb->common.bs);
 
     qemu_bh_delete(acb->bh);
 
     g_free(acb->buf);
     acb->buf = NULL;
 
+    aio_context_acquire(ctx);
     acb->common.cb(acb->common.opaque, acb->status);
+    aio_context_release(ctx);
 
     if (acb->task != NULL) {
         scsi_free_scsi_task(acb->task);
@@ -XXX,XX +XXX,XX @@ iscsi_schedule_bh(IscsiAIOCB *acb)
 static void iscsi_co_generic_bh_cb(void *opaque)
 {
     struct IscsiTask *iTask = opaque;
+
     iTask->complete = 1;
-    qemu_coroutine_enter(iTask->co);
+    aio_co_wake(iTask->co);
 }
 
 static void iscsi_retry_timer_expired(void *opaque)
diff --git a/block/linux-aio.c b/block/linux-aio.c
index XXXXXXX..XXXXXXX 100644
--- a/block/linux-aio.c
+++ b/block/linux-aio.c
@@ -XXX,XX +XXX,XX @@ struct LinuxAioState {
     io_context_t ctx;
     EventNotifier e;
 
-    /* io queue for submit at batch */
+    /* io queue for submit at batch.  Protected by AioContext lock. */
     LaioQueue io_q;
 
-    /* I/O completion processing */
+    /* I/O completion processing.  Only runs in I/O thread.  */
     QEMUBH *completion_bh;
     int event_idx;
     int event_max;
@@ -XXX,XX +XXX,XX @@ static inline ssize_t io_event_ret(struct io_event *ev)
  */
 static void qemu_laio_process_completion(struct qemu_laiocb *laiocb)
 {
+    LinuxAioState *s = laiocb->ctx;
     int ret;
 
     ret = laiocb->ret;
@@ -XXX,XX +XXX,XX @@ static void qemu_laio_process_completion(struct qemu_laiocb *laiocb)
     }
 
     laiocb->ret = ret;
+    aio_context_acquire(s->aio_context);
     if (laiocb->co) {
         /* If the coroutine is already entered it must be in ioq_submit() and
          * will notice laio->ret has been filled in when it eventually runs
@@ -XXX,XX +XXX,XX @@ static void qemu_laio_process_completion(struct qemu_laiocb *laiocb)
         laiocb->common.cb(laiocb->common.opaque, ret);
         qemu_aio_unref(laiocb);
     }
+    aio_context_release(s->aio_context);
 }
 
 /**
@@ -XXX,XX +XXX,XX @@ static void qemu_laio_process_completions(LinuxAioState *s)
 static void qemu_laio_process_completions_and_submit(LinuxAioState *s)
 {
     qemu_laio_process_completions(s);
+
+    aio_context_acquire(s->aio_context);
     if (!s->io_q.plugged && !QSIMPLEQ_EMPTY(&s->io_q.pending)) {
         ioq_submit(s);
     }
+    aio_context_release(s->aio_context);
 }
 
 static void qemu_laio_completion_bh(void *opaque)
@@ -XXX,XX +XXX,XX @@ static void qemu_laio_completion_cb(EventNotifier *e)
     LinuxAioState *s = container_of(e, LinuxAioState, e);
 
     if (event_notifier_test_and_clear(&s->e)) {
-        aio_context_acquire(s->aio_context);
         qemu_laio_process_completions_and_submit(s);
-        aio_context_release(s->aio_context);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static bool qemu_laio_poll_cb(void *opaque)
         return false;
     }
 
-    aio_context_acquire(s->aio_context);
     qemu_laio_process_completions_and_submit(s);
-    aio_context_release(s->aio_context);
     return true;
 }
 
@@ -XXX,XX +XXX,XX @@ void laio_detach_aio_context(LinuxAioState *s, AioContext *old_context)
 {
     aio_set_event_notifier(old_context, &s->e, false, NULL, NULL);
     qemu_bh_delete(s->completion_bh);
+    s->aio_context = NULL;
 }
 
 void laio_attach_aio_context(LinuxAioState *s, AioContext *new_context)
diff --git a/block/nfs.c b/block/nfs.c
index XXXXXXX..XXXXXXX 100644
--- a/block/nfs.c
+++ b/block/nfs.c
@@ -XXX,XX +XXX,XX @@ static void nfs_co_init_task(BlockDriverState *bs, NFSRPC *task)
 static void nfs_co_generic_bh_cb(void *opaque)
 {
     NFSRPC *task = opaque;
+
     task->complete = 1;
-    qemu_coroutine_enter(task->co);
+    aio_co_wake(task->co);
 }
 
 static void
diff --git a/block/null.c b/block/null.c
index XXXXXXX..XXXXXXX 100644
--- a/block/null.c
+++ b/block/null.c
@@ -XXX,XX +XXX,XX @@ static const AIOCBInfo null_aiocb_info = {
 static void null_bh_cb(void *opaque)
 {
     NullAIOCB *acb = opaque;
+    AioContext *ctx = bdrv_get_aio_context(acb->common.bs);
+
+    aio_context_acquire(ctx);
     acb->common.cb(acb->common.opaque, 0);
+    aio_context_release(ctx);
     qemu_aio_unref(acb);
 }
 
diff --git a/block/qed.c b/block/qed.c
index XXXXXXX..XXXXXXX 100644
--- a/block/qed.c
+++ b/block/qed.c
@@ -XXX,XX +XXX,XX @@ static void qed_update_l2_table(BDRVQEDState *s, QEDTable *table, int index,
 static void qed_aio_complete_bh(void *opaque)
 {
     QEDAIOCB *acb = opaque;
+    BDRVQEDState *s = acb_to_s(acb);
     BlockCompletionFunc *cb = acb->common.cb;
     void *user_opaque = acb->common.opaque;
     int ret = acb->bh_ret;
@@ -XXX,XX +XXX,XX @@ static void qed_aio_complete_bh(void *opaque)
     qemu_aio_unref(acb);
 
     /* Invoke callback */
+    qed_acquire(s);
     cb(user_opaque, ret);
+    qed_release(s);
 }
 
 static void qed_aio_complete(QEDAIOCB *acb, int ret)
diff --git a/block/rbd.c b/block/rbd.c
index XXXXXXX..XXXXXXX 100644
--- a/block/rbd.c
+++ b/block/rbd.c
@@ -XXX,XX +XXX,XX @@ shutdown:
 static void qemu_rbd_complete_aio(RADOSCB *rcb)
 {
     RBDAIOCB *acb = rcb->acb;
+    AioContext *ctx = bdrv_get_aio_context(acb->common.bs);
     int64_t r;
 
     r = rcb->ret;
@@ -XXX,XX +XXX,XX @@ static void qemu_rbd_complete_aio(RADOSCB *rcb)
         qemu_iovec_from_buf(acb->qiov, 0, acb->bounce, acb->qiov->size);
     }
     qemu_vfree(acb->bounce);
+
+    aio_context_acquire(ctx);
     acb->common.cb(acb->common.opaque, (acb->ret > 0 ? 0 : acb->ret));
+    aio_context_release(ctx);
 
     qemu_aio_unref(acb);
 }
diff --git a/dma-helpers.c b/dma-helpers.c
index XXXXXXX..XXXXXXX 100644
--- a/dma-helpers.c
+++ b/dma-helpers.c
@@ -XXX,XX +XXX,XX @@ static void dma_blk_cb(void *opaque, int ret)
                                 QEMU_ALIGN_DOWN(dbs->iov.size, dbs->align));
     }
 
+    aio_context_acquire(dbs->ctx);
     dbs->acb = dbs->io_func(dbs->offset, &dbs->iov,
                             dma_blk_cb, dbs, dbs->io_func_opaque);
+    aio_context_release(dbs->ctx);
     assert(dbs->acb);
 }
 
diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/virtio-blk.c
+++ b/hw/block/virtio-blk.c
@@ -XXX,XX +XXX,XX @@ static void virtio_blk_dma_restart_bh(void *opaque)
 
     s->rq = NULL;
 
+    aio_context_acquire(blk_get_aio_context(s->conf.conf.blk));
     while (req) {
         VirtIOBlockReq *next = req->next;
         if (virtio_blk_handle_request(req, &mrb)) {
@@ -XXX,XX +XXX,XX @@ static void virtio_blk_dma_restart_bh(void *opaque)
     if (mrb.num_reqs) {
         virtio_blk_submit_multireq(s->blk, &mrb);
     }
+    aio_context_release(blk_get_aio_context(s->conf.conf.blk));
 }
 
 static void virtio_blk_dma_restart_cb(void *opaque, int running,
diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/scsi/scsi-bus.c
+++ b/hw/scsi/scsi-bus.c
@@ -XXX,XX +XXX,XX @@ static void scsi_dma_restart_bh(void *opaque)
     qemu_bh_delete(s->bh);
     s->bh = NULL;
 
+    aio_context_acquire(blk_get_aio_context(s->conf.blk));
     QTAILQ_FOREACH_SAFE(req, &s->requests, next, next) {
         scsi_req_ref(req);
         if (req->retry) {
@@ -XXX,XX +XXX,XX @@ static void scsi_dma_restart_bh(void *opaque)
         }
         scsi_req_unref(req);
     }
+    aio_context_release(blk_get_aio_context(s->conf.blk));
 }
 
 void scsi_req_retry(SCSIRequest *req)
diff --git a/util/async.c b/util/async.c
index XXXXXXX..XXXXXXX 100644
--- a/util/async.c
+++ b/util/async.c
@@ -XXX,XX +XXX,XX @@ int aio_bh_poll(AioContext *ctx)
                 ret = 1;
             }
             bh->idle = 0;
-            aio_context_acquire(ctx);
             aio_bh_call(bh);
-            aio_context_release(ctx);
         }
         if (bh->deleted) {
             deleted = true;
@@ -XXX,XX +XXX,XX @@ static void co_schedule_bh_cb(void *opaque)
         Coroutine *co = QSLIST_FIRST(&straight);
         QSLIST_REMOVE_HEAD(&straight, co_scheduled_next);
         trace_aio_co_schedule_bh_cb(ctx, co);
+        aio_context_acquire(ctx);
         qemu_coroutine_enter(co);
+        aio_context_release(ctx);
     }
 }
 
diff --git a/util/thread-pool.c b/util/thread-pool.c
index XXXXXXX..XXXXXXX 100644
--- a/util/thread-pool.c
+++ b/util/thread-pool.c
@@ -XXX,XX +XXX,XX @@ static void thread_pool_completion_bh(void *opaque)
     ThreadPool *pool = opaque;
     ThreadPoolElement *elem, *next;
 
+    aio_context_acquire(pool->ctx);
 restart:
     QLIST_FOREACH_SAFE(elem, &pool->head, all, next) {
         if (elem->state != THREAD_DONE) {
@@ -XXX,XX +XXX,XX @@ restart:
             qemu_aio_unref(elem);
         }
     }
+    aio_context_release(pool->ctx);
 }
 
 static void thread_pool_cancel(BlockAIOCB *acb)
-- 
2.9.3

From: Paolo Bonzini <pbonzini@redhat.com>

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 20170213135235.12274-16-pbonzini@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/archipelago.c    |  3 ---
 block/block-backend.c  |  7 -------
 block/curl.c           |  2 +-
 block/io.c             |  6 +-----
 block/iscsi.c          |  3 ---
 block/linux-aio.c      |  5 +----
 block/mirror.c         | 12 +++++++++---
 block/null.c           |  8 --------
 block/qed-cluster.c    |  2 ++
 block/qed-table.c      | 12 ++++++++++--
 block/qed.c            |  4 ++--
 block/rbd.c            |  4 ----
 block/win32-aio.c      |  3 ---
 hw/block/virtio-blk.c  | 12 +++++++++++-
 hw/scsi/scsi-disk.c    | 15 +++++++++++++++
 hw/scsi/scsi-generic.c | 20 +++++++++++++++++---
 util/thread-pool.c     |  4 +++-
 17 files changed, 72 insertions(+), 50 deletions(-)

diff --git a/block/archipelago.c b/block/archipelago.c
index XXXXXXX..XXXXXXX 100644
--- a/block/archipelago.c
+++ b/block/archipelago.c
@@ -XXX,XX +XXX,XX @@ static void qemu_archipelago_complete_aio(void *opaque)
 {
     AIORequestData *reqdata = (AIORequestData *) opaque;
     ArchipelagoAIOCB *aio_cb = (ArchipelagoAIOCB *) reqdata->aio_cb;
-    AioContext *ctx = bdrv_get_aio_context(aio_cb->common.bs);
 
-    aio_context_acquire(ctx);
     aio_cb->common.cb(aio_cb->common.opaque, aio_cb->ret);
-    aio_context_release(ctx);
     aio_cb->status = 0;
 
     qemu_aio_unref(aio_cb);
diff --git a/block/block-backend.c b/block/block-backend.c
index XXXXXXX..XXXXXXX 100644
--- a/block/block-backend.c
+++ b/block/block-backend.c
@@ -XXX,XX +XXX,XX @@ int blk_make_zero(BlockBackend *blk, BdrvRequestFlags flags)
 static void error_callback_bh(void *opaque)
 {
     struct BlockBackendAIOCB *acb = opaque;
-    AioContext *ctx = bdrv_get_aio_context(acb->common.bs);
 
     bdrv_dec_in_flight(acb->common.bs);
-    aio_context_acquire(ctx);
     acb->common.cb(acb->common.opaque, acb->ret);
-    aio_context_release(ctx);
     qemu_aio_unref(acb);
 }
 
@@ -XXX,XX +XXX,XX @@ static void blk_aio_complete(BlkAioEmAIOCB *acb)
 static void blk_aio_complete_bh(void *opaque)
 {
     BlkAioEmAIOCB *acb = opaque;
-    AioContext *ctx = bdrv_get_aio_context(acb->common.bs);
-
     assert(acb->has_returned);
-    aio_context_acquire(ctx);
     blk_aio_complete(acb);
-    aio_context_release(ctx);
 }
 
 static BlockAIOCB *blk_aio_prwv(BlockBackend *blk, int64_t offset, int bytes,
diff --git a/block/curl.c b/block/curl.c
index XXXXXXX..XXXXXXX 100644
--- a/block/curl.c
+++ b/block/curl.c
@@ -XXX,XX +XXX,XX @@ static void curl_readv_bh_cb(void *p)
     curl_multi_socket_action(s->multi, CURL_SOCKET_TIMEOUT, 0, &running);
 
 out:
+    aio_context_release(ctx);
     if (ret != -EINPROGRESS) {
         acb->common.cb(acb->common.opaque, ret);
         qemu_aio_unref(acb);
     }
-    aio_context_release(ctx);
 }
 
 static BlockAIOCB *curl_aio_readv(BlockDriverState *bs,
diff --git a/block/io.c b/block/io.c
index XXXXXXX..XXXXXXX 100644
--- a/block/io.c
+++ b/block/io.c
@@ -XXX,XX +XXX,XX @@ static void bdrv_co_io_em_complete(void *opaque, int ret)
     CoroutineIOCompletion *co = opaque;
 
     co->ret = ret;
-    qemu_coroutine_enter(co->coroutine);
+    aio_co_wake(co->coroutine);
 }
 
 static int coroutine_fn bdrv_driver_preadv(BlockDriverState *bs,
@@ -XXX,XX +XXX,XX @@ static void bdrv_co_complete(BlockAIOCBCoroutine *acb)
 static void bdrv_co_em_bh(void *opaque)
 {
     BlockAIOCBCoroutine *acb = opaque;
-    BlockDriverState *bs = acb->common.bs;
-    AioContext *ctx = bdrv_get_aio_context(bs);
 
     assert(!acb->need_bh);
-    aio_context_acquire(ctx);
     bdrv_co_complete(acb);
-    aio_context_release(ctx);
 }
 
 static void bdrv_co_maybe_schedule_bh(BlockAIOCBCoroutine *acb)
diff --git a/block/iscsi.c b/block/iscsi.c
index XXXXXXX..XXXXXXX 100644
--- a/block/iscsi.c
+++ b/block/iscsi.c
@@ -XXX,XX +XXX,XX @@ static void
 iscsi_bh_cb(void *p)
 {
     IscsiAIOCB *acb = p;
-    AioContext *ctx = bdrv_get_aio_context(acb->common.bs);
 
     qemu_bh_delete(acb->bh);
 
     g_free(acb->buf);
     acb->buf = NULL;
 
-    aio_context_acquire(ctx);
     acb->common.cb(acb->common.opaque, acb->status);
-    aio_context_release(ctx);
 
     if (acb->task != NULL) {
         scsi_free_scsi_task(acb->task);
diff --git a/block/linux-aio.c b/block/linux-aio.c
index XXXXXXX..XXXXXXX 100644
--- a/block/linux-aio.c
+++ b/block/linux-aio.c
@@ -XXX,XX +XXX,XX @@ static inline ssize_t io_event_ret(struct io_event *ev)
  */
 static void qemu_laio_process_completion(struct qemu_laiocb *laiocb)
 {
-    LinuxAioState *s = laiocb->ctx;
     int ret;
 
     ret = laiocb->ret;
@@ -XXX,XX +XXX,XX @@ static void qemu_laio_process_completion(struct qemu_laiocb *laiocb)
     }
 
     laiocb->ret = ret;
-    aio_context_acquire(s->aio_context);
     if (laiocb->co) {
         /* If the coroutine is already entered it must be in ioq_submit() and
          * will notice laio->ret has been filled in when it eventually runs
@@ -XXX,XX +XXX,XX @@ static void qemu_laio_process_completion(struct qemu_laiocb *laiocb)
          * that!
          */
         if (!qemu_coroutine_entered(laiocb->co)) {
-            qemu_coroutine_enter(laiocb->co);
+            aio_co_wake(laiocb->co);
         }
     } else {
         laiocb->common.cb(laiocb->common.opaque, ret);
         qemu_aio_unref(laiocb);
     }
-    aio_context_release(s->aio_context);
 }
 
 /**
diff --git a/block/mirror.c b/block/mirror.c
index XXXXXXX..XXXXXXX 100644
--- a/block/mirror.c
+++ b/block/mirror.c
@@ -XXX,XX +XXX,XX @@ static void mirror_write_complete(void *opaque, int ret)
 {
     MirrorOp *op = opaque;
     MirrorBlockJob *s = op->s;
+
+    aio_context_acquire(blk_get_aio_context(s->common.blk));
     if (ret < 0) {
         BlockErrorAction action;
 
@@ -XXX,XX +XXX,XX @@ static void mirror_write_complete(void *opaque, int ret)
         }
     }
     mirror_iteration_done(op, ret);
+    aio_context_release(blk_get_aio_context(s->common.blk));
 }
 
 static void mirror_read_complete(void *opaque, int ret)
 {
     MirrorOp *op = opaque;
     MirrorBlockJob *s = op->s;
+
+    aio_context_acquire(blk_get_aio_context(s->common.blk));
     if (ret < 0) {
         BlockErrorAction action;
 
@@ -XXX,XX +XXX,XX @@ static void mirror_read_complete(void *opaque, int ret)
         }
 
         mirror_iteration_done(op, ret);
-        return;
+    } else {
+        blk_aio_pwritev(s->target, op->sector_num * BDRV_SECTOR_SIZE, &op->qiov,
+                        0, mirror_write_complete, op);
     }
-    blk_aio_pwritev(s->target, op->sector_num * BDRV_SECTOR_SIZE, &op->qiov,
-                    0, mirror_write_complete, op);
+    aio_context_release(blk_get_aio_context(s->common.blk));
 }
 
 static inline void mirror_clip_sectors(MirrorBlockJob *s,
diff --git a/block/null.c b/block/null.c
index XXXXXXX..XXXXXXX 100644
--- a/block/null.c
+++ b/block/null.c
@@ -XXX,XX +XXX,XX @@ static const AIOCBInfo null_aiocb_info = {
 static void null_bh_cb(void *opaque)
 {
     NullAIOCB *acb = opaque;
-    AioContext *ctx = bdrv_get_aio_context(acb->common.bs);
-
-    aio_context_acquire(ctx);
     acb->common.cb(acb->common.opaque, 0);
-    aio_context_release(ctx);
     qemu_aio_unref(acb);
 }
 
 static void null_timer_cb(void *opaque)
 {
     NullAIOCB *acb = opaque;
-    AioContext *ctx = bdrv_get_aio_context(acb->common.bs);
-
-    aio_context_acquire(ctx);
     acb->common.cb(acb->common.opaque, 0);
-    aio_context_release(ctx);
     timer_deinit(&acb->timer);
     qemu_aio_unref(acb);
 }
diff --git a/block/qed-cluster.c b/block/qed-cluster.c
index XXXXXXX..XXXXXXX 100644
--- a/block/qed-cluster.c
+++ b/block/qed-cluster.c
@@ -XXX,XX +XXX,XX @@ static void qed_find_cluster_cb(void *opaque, int ret)
     unsigned int index;
     unsigned int n;
 
+    qed_acquire(s);
     if (ret) {
         goto out;
     }
@@ -XXX,XX +XXX,XX @@ static void qed_find_cluster_cb(void *opaque, int ret)
 
 out:
     find_cluster_cb->cb(find_cluster_cb->opaque, ret, offset, len);
+    qed_release(s);
     g_free(find_cluster_cb);
 }
 
diff --git a/block/qed-table.c b/block/qed-table.c
index XXXXXXX..XXXXXXX 100644
--- a/block/qed-table.c
+++ b/block/qed-table.c
@@ -XXX,XX +XXX,XX @@ static void qed_read_table_cb(void *opaque, int ret)
 {
     QEDReadTableCB *read_table_cb = opaque;
     QEDTable *table = read_table_cb->table;
+    BDRVQEDState *s = read_table_cb->s;
     int noffsets = read_table_cb->qiov.size / sizeof(uint64_t);
     int i;
 
@@ -XXX,XX +XXX,XX @@ static void qed_read_table_cb(void *opaque, int ret)
     }
 
     /* Byteswap offsets */
+    qed_acquire(s);
     for (i = 0; i < noffsets; i++) {
         table->offsets[i] = le64_to_cpu(table->offsets[i]);
     }
+    qed_release(s);
 
 out:
     /* Completion */
-    trace_qed_read_table_cb(read_table_cb->s, read_table_cb->table, ret);
+    trace_qed_read_table_cb(s, read_table_cb->table, ret);
     gencb_complete(&read_table_cb->gencb, ret);
 }
 
@@ -XXX,XX +XXX,XX @@ typedef struct {
 static void qed_write_table_cb(void *opaque, int ret)
 {
     QEDWriteTableCB *write_table_cb = opaque;
+    BDRVQEDState *s = write_table_cb->s;
 
-    trace_qed_write_table_cb(write_table_cb->s,
+    trace_qed_write_table_cb(s,
                              write_table_cb->orig_table,
                              write_table_cb->flush,
                              ret);
@@ -XXX,XX +XXX,XX @@ static void qed_write_table_cb(void *opaque, int ret)
     if (write_table_cb->flush) {
         /* We still need to flush first */
         write_table_cb->flush = false;
+        qed_acquire(s);
         bdrv_aio_flush(write_table_cb->s->bs, qed_write_table_cb,
                        write_table_cb);
+        qed_release(s);
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void qed_read_l2_table_cb(void *opaque, int ret)
     CachedL2Table *l2_table = request->l2_table;
     uint64_t l2_offset = read_l2_table_cb->l2_offset;
 
+    qed_acquire(s);
     if (ret) {
         /* can't trust loaded L2 table anymore */
         qed_unref_l2_cache_entry(l2_table);
@@ -XXX,XX +XXX,XX @@ static void qed_read_l2_table_cb(void *opaque, int ret)
         request->l2_table = qed_find_l2_cache_entry(&s->l2_cache, l2_offset);
         assert(request->l2_table != NULL);
     }
+    qed_release(s);
 
     gencb_complete(&read_l2_table_cb->gencb, ret);
 }
diff --git a/block/qed.c b/block/qed.c
index XXXXXXX..XXXXXXX 100644
--- a/block/qed.c
+++ b/block/qed.c
@@ -XXX,XX +XXX,XX @@ static void qed_is_allocated_cb(void *opaque, int ret, uint64_t offset, size_t l
     }
 
     if (cb->co) {
-        qemu_coroutine_enter(cb->co);
+        aio_co_wake(cb->co);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn qed_co_pwrite_zeroes_cb(void *opaque, int ret)
     cb->done = true;
     cb->ret = ret;
     if (cb->co) {
-        qemu_coroutine_enter(cb->co);
+        aio_co_wake(cb->co);
     }
 }
 
diff --git a/block/rbd.c b/block/rbd.c
index XXXXXXX..XXXXXXX 100644
--- a/block/rbd.c
+++ b/block/rbd.c
@@ -XXX,XX +XXX,XX @@ shutdown:
 static void qemu_rbd_complete_aio(RADOSCB *rcb)
 {
     RBDAIOCB *acb = rcb->acb;
-    AioContext *ctx = bdrv_get_aio_context(acb->common.bs);
     int64_t r;
 
     r = rcb->ret;
@@ -XXX,XX +XXX,XX @@ static void qemu_rbd_complete_aio(RADOSCB *rcb)
         qemu_iovec_from_buf(acb->qiov, 0, acb->bounce, acb->qiov->size);
     }
     qemu_vfree(acb->bounce);
-
-    aio_context_acquire(ctx);
     acb->common.cb(acb->common.opaque, (acb->ret > 0 ? 0 : acb->ret));
-    aio_context_release(ctx);
 
     qemu_aio_unref(acb);
 }
diff --git a/block/win32-aio.c b/block/win32-aio.c
index XXXXXXX..XXXXXXX 100644
--- a/block/win32-aio.c
+++ b/block/win32-aio.c
@@ -XXX,XX +XXX,XX @@ static void win32_aio_process_completion(QEMUWin32AIOState *s,
         qemu_vfree(waiocb->buf);
     }
 
-
-    aio_context_acquire(s->aio_ctx);
     waiocb->common.cb(waiocb->common.opaque, ret);
-    aio_context_release(s->aio_ctx);
     qemu_aio_unref(waiocb);
 }
 
diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/virtio-blk.c
+++ b/hw/block/virtio-blk.c
@@ -XXX,XX +XXX,XX @@ static int virtio_blk_handle_rw_error(VirtIOBlockReq *req, int error,
 static void virtio_blk_rw_complete(void *opaque, int ret)
 {
     VirtIOBlockReq *next = opaque;
+    VirtIOBlock *s = next->dev;
 
+    aio_context_acquire(blk_get_aio_context(s->conf.conf.blk));
     while (next) {
         VirtIOBlockReq *req = next;
         next = req->mr_next;
@@ -XXX,XX +XXX,XX @@ static void virtio_blk_rw_complete(void *opaque, int ret)
         block_acct_done(blk_get_stats(req->dev->blk), &req->acct);
         virtio_blk_free_request(req);
     }
+    aio_context_release(blk_get_aio_context(s->conf.conf.blk));
 }
 
 static void virtio_blk_flush_complete(void *opaque, int ret)
 {
     VirtIOBlockReq *req = opaque;
+    VirtIOBlock *s = req->dev;
 
+    aio_context_acquire(blk_get_aio_context(s->conf.conf.blk));
     if (ret) {
         if (virtio_blk_handle_rw_error(req, -ret, 0)) {
-            return;
+            goto out;
         }
     }
 
     virtio_blk_req_complete(req, VIRTIO_BLK_S_OK);
     block_acct_done(blk_get_stats(req->dev->blk), &req->acct);
     virtio_blk_free_request(req);
+
+out:
+    aio_context_release(blk_get_aio_context(s->conf.conf.blk));
 }
 
 #ifdef __linux__
@@ -XXX,XX +XXX,XX @@ static void virtio_blk_ioctl_complete(void *opaque, int status)
     virtio_stl_p(vdev, &scsi->data_len, hdr->dxfer_len);
 
 out:
+    aio_context_acquire(blk_get_aio_context(s->conf.conf.blk));
     virtio_blk_req_complete(req, status);
     virtio_blk_free_request(req);
+    aio_context_release(blk_get_aio_context(s->conf.conf.blk));
     g_free(ioctl_req);
 }
 
diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/scsi/scsi-disk.c
+++ b/hw/scsi/scsi-disk.c
@@ -XXX,XX +XXX,XX @@ static void scsi_aio_complete(void *opaque, int ret)
 
     assert(r->req.aiocb != NULL);
     r->req.aiocb = NULL;
+    aio_context_acquire(blk_get_aio_context(s->qdev.conf.blk));
     if (scsi_disk_req_check_error(r, ret, true)) {
         goto done;
     }
@@ -XXX,XX +XXX,XX @@ static void scsi_aio_complete(void *opaque, int ret)
     scsi_req_complete(&r->req, GOOD);
 
 done:
+    aio_context_release(blk_get_aio_context(s->qdev.conf.blk));
     scsi_req_unref(&r->req);
 }
 
@@ -XXX,XX +XXX,XX @@ static void scsi_dma_complete(void *opaque, int ret)
     assert(r->req.aiocb != NULL);
     r->req.aiocb = NULL;
 
+    aio_context_acquire(blk_get_aio_context(s->qdev.conf.blk));
     if (ret < 0) {
         block_acct_failed(blk_get_stats(s->qdev.conf.blk), &r->acct);
     } else {
         block_acct_done(blk_get_stats(s->qdev.conf.blk), &r->acct);
     }
     scsi_dma_complete_noio(r, ret);
+    aio_context_release(blk_get_aio_context(s->qdev.conf.blk));
 }
 
 static void scsi_read_complete(void * opaque, int ret)
@@ -XXX,XX +XXX,XX @@ static void scsi_read_complete(void * opaque, int ret)
 
     assert(r->req.aiocb != NULL);
     r->req.aiocb = NULL;
+    aio_context_acquire(blk_get_aio_context(s->qdev.conf.blk));
     if (scsi_disk_req_check_error(r, ret, true)) {
         goto done;
     }
@@ -XXX,XX +XXX,XX @@ static void scsi_read_complete(void * opaque, int ret)
 
 done:
     scsi_req_unref(&r->req);
+    aio_context_release(blk_get_aio_context(s->qdev.conf.blk));
 }
 
 /* Actually issue a read to the block device.  */
@@ -XXX,XX +XXX,XX @@ static void scsi_do_read_cb(void *opaque, int ret)
     assert (r->req.aiocb != NULL);
     r->req.aiocb = NULL;
 
+    aio_context_acquire(blk_get_aio_context(s->qdev.conf.blk));
     if (ret < 0) {
         block_acct_failed(blk_get_stats(s->qdev.conf.blk), &r->acct);
     } else {
         block_acct_done(blk_get_stats(s->qdev.conf.blk), &r->acct);
     }
     scsi_do_read(opaque, ret);
+    aio_context_release(blk_get_aio_context(s->qdev.conf.blk));
 }
 
 /* Read more data from scsi device into buffer.  */
@@ -XXX,XX +XXX,XX @@ static void scsi_write_complete(void * opaque, int ret)
     assert (r->req.aiocb != NULL);
     r->req.aiocb = NULL;
 
+    aio_context_acquire(blk_get_aio_context(s->qdev.conf.blk));
     if (ret < 0) {
         block_acct_failed(blk_get_stats(s->qdev.conf.blk), &r->acct);
     } else {
         block_acct_done(blk_get_stats(s->qdev.conf.blk), &r->acct);
     }
     scsi_write_complete_noio(r, ret);
+    aio_context_release(blk_get_aio_context(s->qdev.conf.blk));
 }
 
 static void scsi_write_data(SCSIRequest *req)
@@ -XXX,XX +XXX,XX @@ static void scsi_unmap_complete(void *opaque, int ret)
 {
     UnmapCBData *data = opaque;
     SCSIDiskReq *r = data->r;
+    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
 
     assert(r->req.aiocb != NULL);
     r->req.aiocb = NULL;
 
+    aio_context_acquire(blk_get_aio_context(s->qdev.conf.blk));
     scsi_unmap_complete_noio(data, ret);
+    aio_context_release(blk_get_aio_context(s->qdev.conf.blk));
 }
 
 static void scsi_disk_emulate_unmap(SCSIDiskReq *r, uint8_t *inbuf)
@@ -XXX,XX +XXX,XX @@ static void scsi_write_same_complete(void *opaque, int ret)
 
     assert(r->req.aiocb != NULL);
     r->req.aiocb = NULL;
+    aio_context_acquire(blk_get_aio_context(s->qdev.conf.blk));
     if (scsi_disk_req_check_error(r, ret, true)) {
         goto done;
     }
@@ -XXX,XX +XXX,XX @@ done:
     scsi_req_unref(&r->req);
     qemu_vfree(data->iov.iov_base);
     g_free(data);
+    aio_context_release(blk_get_aio_context(s->qdev.conf.blk));
 }
 
 static void scsi_disk_emulate_write_same(SCSIDiskReq *r, uint8_t *inbuf)
diff --git a/hw/scsi/scsi-generic.c b/hw/scsi/scsi-generic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/scsi/scsi-generic.c
+++ b/hw/scsi/scsi-generic.c
@@ -XXX,XX +XXX,XX @@ done:
 static void scsi_command_complete(void *opaque, int ret)
 {
     SCSIGenericReq *r = (SCSIGenericReq *)opaque;
+    SCSIDevice *s = r->req.dev;
 
     assert(r->req.aiocb != NULL);
     r->req.aiocb = NULL;
+
+    aio_context_acquire(blk_get_aio_context(s->conf.blk));
     scsi_command_complete_noio(r, ret);
+    aio_context_release(blk_get_aio_context(s->conf.blk));
 }
 
 static int execute_command(BlockBackend *blk,
@@ -XXX,XX +XXX,XX @@ static void scsi_read_complete(void * opaque, int ret)
     assert(r->req.aiocb != NULL);
     r->req.aiocb = NULL;
 
+    aio_context_acquire(blk_get_aio_context(s->conf.blk));
+
     if (ret || r->req.io_canceled) {
         scsi_command_complete_noio(r, ret);
-        return;
+        goto done;
     }
 
     len = r->io_header.dxfer_len - r->io_header.resid;
@@ -XXX,XX +XXX,XX @@ static void scsi_read_complete(void * opaque, int ret)
     r->len = -1;
     if (len == 0) {
         scsi_command_complete_noio(r, 0);
-        return;
+        goto done;
     }
 
     /* Snoop READ CAPACITY output to set the blocksize.  */
@@ -XXX,XX +XXX,XX @@ static void scsi_read_complete(void * opaque, int ret)
     }
     scsi_req_data(&r->req, len);
     scsi_req_unref(&r->req);
+
+done:
+    aio_context_release(blk_get_aio_context(s->conf.blk));
 }
 
 /* Read more data from scsi device into buffer.  */
@@ -XXX,XX +XXX,XX @@ static void scsi_write_complete(void * opaque, int ret)
     assert(r->req.aiocb != NULL);
     r->req.aiocb = NULL;
 
+    aio_context_acquire(blk_get_aio_context(s->conf.blk));
+
     if (ret || r->req.io_canceled) {
         scsi_command_complete_noio(r, ret);
-        return;
+        goto done;
     }
 
     if (r->req.cmd.buf[0] == MODE_SELECT && r->req.cmd.buf[4] == 12 &&
@@ -XXX,XX +XXX,XX @@ static void scsi_write_complete(void * opaque, int ret)
     }
 
     scsi_command_complete_noio(r, ret);
+
+done:
+    aio_context_release(blk_get_aio_context(s->conf.blk));
 }
 
 /* Write data to a scsi device.  Returns nonzero on failure.
diff --git a/util/thread-pool.c b/util/thread-pool.c
index XXXXXXX..XXXXXXX 100644
--- a/util/thread-pool.c
+++ b/util/thread-pool.c
@@ -XXX,XX +XXX,XX @@ restart:
              */
             qemu_bh_schedule(pool->completion_bh);
 
+            aio_context_release(pool->ctx);
             elem->common.cb(elem->common.opaque, elem->ret);
+            aio_context_acquire(pool->ctx);
             qemu_aio_unref(elem);
             goto restart;
         } else {
@@ -XXX,XX +XXX,XX @@ static void thread_pool_co_cb(void *opaque, int ret)
     ThreadPoolCo *co = opaque;
 
     co->ret = ret;
-    qemu_coroutine_enter(co->co);
+    aio_co_wake(co->co);
 }
 
 int coroutine_fn thread_pool_submit_co(ThreadPool *pool, ThreadPoolFunc *func,
-- 
2.9.3

From: Paolo Bonzini <pbonzini@redhat.com>

This patch prepares for the removal of unnecessary lockcnt inc/dec pairs.
Extract the dispatching loop for file descriptor handlers into a new
function aio_dispatch_handlers, and then inline aio_dispatch into
aio_poll.

aio_dispatch can now become void.

diff --git a/include/block/aio.h b/include/block/aio.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/aio.h
+++ b/include/block/aio.h
@@ -XXX,XX +XXX,XX @@ bool aio_pending(AioContext *ctx);
 /* Dispatch any pending callbacks from the GSource attached to the AioContext.
  *
  * This is used internally in the implementation of the GSource.
- *
- * @dispatch_fds: true to process fds, false to skip them
- *                (can be used as an optimization by callers that know there
- *                are no fds ready)
  */
-bool aio_dispatch(AioContext *ctx, bool dispatch_fds);
+void aio_dispatch(AioContext *ctx);
 
 /* Progress in completing AIO work to occur.  This can issue new pending
  * aio as a result of executing I/O completion or bh callbacks.
diff --git a/util/aio-posix.c b/util/aio-posix.c
index XXXXXXX..XXXXXXX 100644
--- a/util/aio-posix.c
+++ b/util/aio-posix.c
@@ -XXX,XX +XXX,XX @@ static bool aio_dispatch_handlers(AioContext *ctx)
     AioHandler *node, *tmp;
     bool progress = false;
 
-    /*
-     * We have to walk very carefully in case aio_set_fd_handler is
-     * called while we're walking.
-     */
-    qemu_lockcnt_inc(&ctx->list_lock);
-
     QLIST_FOREACH_SAFE_RCU(node, &ctx->aio_handlers, node, tmp) {
         int revents;
 
@@ -XXX,XX +XXX,XX @@ static bool aio_dispatch_handlers(AioContext *ctx)
         }
     }
 
-    qemu_lockcnt_dec(&ctx->list_lock);
     return progress;
 }
 
-/*
- * Note that dispatch_fds == false has the side-effect of post-poning the
- * freeing of deleted handlers.
- */
-bool aio_dispatch(AioContext *ctx, bool dispatch_fds)
+void aio_dispatch(AioContext *ctx)
 {
-    bool progress;
+    aio_bh_poll(ctx);
 
-    /*
-     * If there are callbacks left that have been queued, we need to call them.
-     * Do not call select in this case, because it is possible that the caller
-     * does not need a complete flush (as is the case for aio_poll loops).
-     */
-    progress = aio_bh_poll(ctx);
+    qemu_lockcnt_inc(&ctx->list_lock);
+    aio_dispatch_handlers(ctx);
+    qemu_lockcnt_dec(&ctx->list_lock);
 
-    if (dispatch_fds) {
-        progress |= aio_dispatch_handlers(ctx);
-    }
-
-    /* Run our timers */
-    progress |= timerlistgroup_run_timers(&ctx->tlg);
-
-    return progress;
+    timerlistgroup_run_timers(&ctx->tlg);
 }
 
 /* These thread-local variables are used only in a small part of aio_poll
@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
     npfd = 0;
     qemu_lockcnt_dec(&ctx->list_lock);
 
-    /* Run dispatch even if there were no readable fds to run timers */
-    if (aio_dispatch(ctx, ret > 0)) {
-        progress = true;
+    progress |= aio_bh_poll(ctx);
+
+    if (ret > 0) {
+        qemu_lockcnt_inc(&ctx->list_lock);
+        progress |= aio_dispatch_handlers(ctx);
+        qemu_lockcnt_dec(&ctx->list_lock);
     }
 
+    progress |= timerlistgroup_run_timers(&ctx->tlg);
+
     return progress;
 }
 
diff --git a/util/aio-win32.c b/util/aio-win32.c
index XXXXXXX..XXXXXXX 100644
--- a/util/aio-win32.c
+++ b/util/aio-win32.c
@@ -XXX,XX +XXX,XX @@ static bool aio_dispatch_handlers(AioContext *ctx, HANDLE event)
     return progress;
 }
 
-bool aio_dispatch(AioContext *ctx, bool dispatch_fds)
+void aio_dispatch(AioContext *ctx)
 {
-    bool progress;
-
-    progress = aio_bh_poll(ctx);
-    if (dispatch_fds) {
-        progress |= aio_dispatch_handlers(ctx, INVALID_HANDLE_VALUE);
-    }
-    progress |= timerlistgroup_run_timers(&ctx->tlg);
-    return progress;
+    aio_bh_poll(ctx);
+    aio_dispatch_handlers(ctx, INVALID_HANDLE_VALUE);
+    timerlistgroup_run_timers(&ctx->tlg);
 }
 
 bool aio_poll(AioContext *ctx, bool blocking)
diff --git a/util/async.c b/util/async.c
index XXXXXXX..XXXXXXX 100644
--- a/util/async.c
+++ b/util/async.c
@@ -XXX,XX +XXX,XX @@ aio_ctx_dispatch(GSource     *source,
     AioContext *ctx = (AioContext *) source;
 
     assert(callback == NULL);
-    aio_dispatch(ctx, true);
+    aio_dispatch(ctx);
     return true;
 }
 
-- 
2.9.3

From: Paolo Bonzini <pbonzini@redhat.com>

Pull the increment/decrement pair out of aio_bh_poll and into the
callers.

diff --git a/util/aio-posix.c b/util/aio-posix.c
index XXXXXXX..XXXXXXX 100644
--- a/util/aio-posix.c
+++ b/util/aio-posix.c
@@ -XXX,XX +XXX,XX @@ static bool aio_dispatch_handlers(AioContext *ctx)
 
 void aio_dispatch(AioContext *ctx)
 {
+    qemu_lockcnt_inc(&ctx->list_lock);
     aio_bh_poll(ctx);
-
-    qemu_lockcnt_inc(&ctx->list_lock);
     aio_dispatch_handlers(ctx);
     qemu_lockcnt_dec(&ctx->list_lock);
 
@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
     }
 
     npfd = 0;
-    qemu_lockcnt_dec(&ctx->list_lock);
 
     progress |= aio_bh_poll(ctx);
 
     if (ret > 0) {
-        qemu_lockcnt_inc(&ctx->list_lock);
         progress |= aio_dispatch_handlers(ctx);
-        qemu_lockcnt_dec(&ctx->list_lock);
     }
 
+    qemu_lockcnt_dec(&ctx->list_lock);
+
     progress |= timerlistgroup_run_timers(&ctx->tlg);
 
     return progress;
diff --git a/util/aio-win32.c b/util/aio-win32.c
index XXXXXXX..XXXXXXX 100644
--- a/util/aio-win32.c
+++ b/util/aio-win32.c
@@ -XXX,XX +XXX,XX @@ static bool aio_dispatch_handlers(AioContext *ctx, HANDLE event)
     bool progress = false;
     AioHandler *tmp;
 
-    qemu_lockcnt_inc(&ctx->list_lock);
-
     /*
      * We have to walk very carefully in case aio_set_fd_handler is
      * called while we're walking.
@@ -XXX,XX +XXX,XX @@ static bool aio_dispatch_handlers(AioContext *ctx, HANDLE event)
         }
     }
 
-    qemu_lockcnt_dec(&ctx->list_lock);
     return progress;
 }
 
 void aio_dispatch(AioContext *ctx)
 {
+    qemu_lockcnt_inc(&ctx->list_lock);
     aio_bh_poll(ctx);
     aio_dispatch_handlers(ctx, INVALID_HANDLE_VALUE);
+    qemu_lockcnt_dec(&ctx->list_lock);
     timerlistgroup_run_timers(&ctx->tlg);
 }
 
@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
         }
     }
 
-    qemu_lockcnt_dec(&ctx->list_lock);
     first = true;
 
     /* ctx->notifier is always registered.  */
@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
         progress |= aio_dispatch_handlers(ctx, event);
     } while (count > 0);
 
+    qemu_lockcnt_dec(&ctx->list_lock);
+
     progress |= timerlistgroup_run_timers(&ctx->tlg);
     return progress;
 }
diff --git a/util/async.c b/util/async.c
index XXXXXXX..XXXXXXX 100644
--- a/util/async.c
+++ b/util/async.c
@@ -XXX,XX +XXX,XX @@ void aio_bh_call(QEMUBH *bh)
     bh->cb(bh->opaque);
 }
 
-/* Multiple occurrences of aio_bh_poll cannot be called concurrently */
+/* Multiple occurrences of aio_bh_poll cannot be called concurrently.
+ * The count in ctx->list_lock is incremented before the call, and is
+ * not affected by the call.
+ */
 int aio_bh_poll(AioContext *ctx)
 {
     QEMUBH *bh, **bhp, *next;
     int ret;
     bool deleted = false;
 
-    qemu_lockcnt_inc(&ctx->list_lock);
-
     ret = 0;
     for (bh = atomic_rcu_read(&ctx->first_bh); bh; bh = next) {
         next = atomic_rcu_read(&bh->next);
@@ -XXX,XX +XXX,XX @@ int aio_bh_poll(AioContext *ctx)
 
     /* remove deleted bhs */
     if (!deleted) {
-        qemu_lockcnt_dec(&ctx->list_lock);
         return ret;
     }
 
-    if (qemu_lockcnt_dec_and_lock(&ctx->list_lock)) {
+    if (qemu_lockcnt_dec_if_lock(&ctx->list_lock)) {
         bhp = &ctx->first_bh;
         while (*bhp) {
             bh = *bhp;
@@ -XXX,XX +XXX,XX @@ int aio_bh_poll(AioContext *ctx)
                 bhp = &bh->next;
             }
         }
-        qemu_lockcnt_unlock(&ctx->list_lock);
+        qemu_lockcnt_inc_and_unlock(&ctx->list_lock);
     }
     return ret;
 }
-- 
2.9.3

From: Paolo Bonzini <pbonzini@redhat.com>

diff --git a/include/block/block_int.h b/include/block/block_int.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/block_int.h
+++ b/include/block/block_int.h
@@ -XXX,XX +XXX,XX @@ struct BdrvChild {
  * copied as well.
  */
 struct BlockDriverState {
-    int64_t total_sectors; /* if we are reading a disk image, give its
-                              size in sectors */
+    /* Protected by big QEMU lock or read-only after opening.  No special
+     * locking needed during I/O...
+     */
     int open_flags; /* flags used to open the file, re-used for re-open */
     bool read_only; /* if true, the media is read only */
     bool encrypted; /* if true, the media is encrypted */
@@ -XXX,XX +XXX,XX @@ struct BlockDriverState {
     bool sg;        /* if true, the device is a /dev/sg* */
     bool probed;    /* if true, format was probed rather than specified */
 
-    int copy_on_read; /* if nonzero, copy read backing sectors into image.
-                         note this is a reference count */
-
-    CoQueue flush_queue;            /* Serializing flush queue */
-    bool active_flush_req;          /* Flush request in flight? */
-    unsigned int write_gen;         /* Current data generation */
-    unsigned int flushed_gen;       /* Flushed write generation */
-
     BlockDriver *drv; /* NULL means no media */
     void *opaque;
 
@@ -XXX,XX +XXX,XX @@ struct BlockDriverState {
     BdrvChild *backing;
     BdrvChild *file;
 
-    /* Callback before write request is processed */
-    NotifierWithReturnList before_write_notifiers;
-
-    /* number of in-flight requests; overall and serialising */
-    unsigned int in_flight;
-    unsigned int serialising_in_flight;
-
-    bool wakeup;
-
-    /* Offset after the highest byte written to */
-    uint64_t wr_highest_offset;
-
     /* I/O Limits */
     BlockLimits bl;
 
@@ -XXX,XX +XXX,XX @@ struct BlockDriverState {
     QTAILQ_ENTRY(BlockDriverState) bs_list;
     /* element of the list of monitor-owned BDS */
     QTAILQ_ENTRY(BlockDriverState) monitor_list;
-    QLIST_HEAD(, BdrvDirtyBitmap) dirty_bitmaps;
     int refcnt;
 
-    QLIST_HEAD(, BdrvTrackedRequest) tracked_requests;
-
     /* operation blockers */
     QLIST_HEAD(, BdrvOpBlocker) op_blockers[BLOCK_OP_TYPE_MAX];
 
@@ -XXX,XX +XXX,XX @@ struct BlockDriverState {
     /* The error object in use for blocking operations on backing_hd */
     Error *backing_blocker;
 
+    /* Protected by AioContext lock */
+
+    /* If true, copy read backing sectors into image.  Can be >1 if more
+     * than one client has requested copy-on-read.
+     */
+    int copy_on_read;
+
+    /* If we are reading a disk image, give its size in sectors.
+     * Generally read-only; it is written to by load_vmstate and save_vmstate,
+     * but the block layer is quiescent during those.
+     */
+    int64_t total_sectors;
+
+    /* Callback before write request is processed */
+    NotifierWithReturnList before_write_notifiers;
+
+    /* number of in-flight requests; overall and serialising */
+    unsigned int in_flight;
+    unsigned int serialising_in_flight;
+
+    bool wakeup;
+
+    /* Offset after the highest byte written to */
+    uint64_t wr_highest_offset;
+
     /* threshold limit for writes, in bytes. "High water mark". */
     uint64_t write_threshold_offset;
     NotifierWithReturn write_threshold_notifier;
@@ -XXX,XX +XXX,XX @@ struct BlockDriverState {
     /* counter for nested bdrv_io_plug */
     unsigned io_plugged;
 
+    QLIST_HEAD(, BdrvTrackedRequest) tracked_requests;
+    CoQueue flush_queue;                  /* Serializing flush queue */
+    bool active_flush_req;                /* Flush request in flight? */
+    unsigned int write_gen;               /* Current data generation */
+    unsigned int flushed_gen;             /* Flushed write generation */
+
+    QLIST_HEAD(, BdrvDirtyBitmap) dirty_bitmaps;
+
+    /* do we need to tell the quest if we have a volatile write cache? */
+    int enable_write_cache;
+
     int quiesce_counter;
 };
 
diff --git a/include/sysemu/block-backend.h b/include/sysemu/block-backend.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/block-backend.h
+++ b/include/sysemu/block-backend.h
@@ -XXX,XX +XXX,XX @@ typedef struct BlockDevOps {
  * fields that must be public. This is in particular for QLIST_ENTRY() and
  * friends so that BlockBackends can be kept in lists outside block-backend.c */
 typedef struct BlockBackendPublic {
-    /* I/O throttling.
-     * throttle_state tells us if this BlockBackend has I/O limits configured.
-     * io_limits_disabled tells us if they are currently being enforced */
+    /* I/O throttling has its own locking, but also some fields are
+     * protected by the AioContext lock.
+     */
+
+    /* Protected by AioContext lock.  */
     CoQueue      throttled_reqs[2];
+
+    /* Nonzero if the I/O limits are currently being ignored; generally
+     * it is zero.  */
     unsigned int io_limits_disabled;
 
     /* The following fields are protected by the ThrottleGroup lock.
-     * See the ThrottleGroup documentation for details. */
+     * See the ThrottleGroup documentation for details.
+     * throttle_state tells us if I/O limits are configured. */
     ThrottleState *throttle_state;
     ThrottleTimers throttle_timers;
     unsigned       pending_reqs[2];
-- 
2.9.3

From: Paolo Bonzini <pbonzini@redhat.com>

This uses the lock-free mutex described in the paper '"Blocking without
Locking", or LFTHREADS: A lock-free thread library' by Gidenstam and
Papatriantafilou.  The same technique is used in OSv, and in fact
the code is essentially a conversion to C of OSv's code.

[Added missing coroutine_fn in tests/test-aio-multithread.c.
--Stefan]

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Message-id: 20170213181244.16297-2-pbonzini@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 include/qemu/coroutine.h     |  17 ++++-
 tests/test-aio-multithread.c |  86 ++++++++++++++++++++++++
 util/qemu-coroutine-lock.c   | 155 ++++++++++++++++++++++++++++++++++++++++---
 util/trace-events            |   1 +
 4 files changed, 246 insertions(+), 13 deletions(-)

diff --git a/include/qemu/coroutine.h b/include/qemu/coroutine.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/coroutine.h
+++ b/include/qemu/coroutine.h
@@ -XXX,XX +XXX,XX @@ bool qemu_co_queue_empty(CoQueue *queue);
 /**
  * Provides a mutex that can be used to synchronise coroutines
  */
+struct CoWaitRecord;
 typedef struct CoMutex {
-    bool locked;
+    /* Count of pending lockers; 0 for a free mutex, 1 for an
+     * uncontended mutex.
+     */
+    unsigned locked;
+
+    /* A queue of waiters.  Elements are added atomically in front of
+     * from_push.  to_pop is only populated, and popped from, by whoever
+     * is in charge of the next wakeup.  This can be an unlocker or,
+     * through the handoff protocol, a locker that is about to go to sleep.
+     */
+    QSLIST_HEAD(, CoWaitRecord) from_push, to_pop;
+
+    unsigned handoff, sequence;
+
     Coroutine *holder;
-    CoQueue queue;
 } CoMutex;
 
 /**
diff --git a/tests/test-aio-multithread.c b/tests/test-aio-multithread.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/test-aio-multithread.c
+++ b/tests/test-aio-multithread.c
@@ -XXX,XX +XXX,XX @@ static void test_multi_co_schedule_10(void)
     test_multi_co_schedule(10);
 }
 
+/* CoMutex thread-safety.  */
+
+static uint32_t atomic_counter;
+static uint32_t running;
+static uint32_t counter;
+static CoMutex comutex;
+
+static void coroutine_fn test_multi_co_mutex_entry(void *opaque)
+{
+    while (!atomic_mb_read(&now_stopping)) {
+        qemu_co_mutex_lock(&comutex);
+        counter++;
+        qemu_co_mutex_unlock(&comutex);
+
+        /* Increase atomic_counter *after* releasing the mutex.  Otherwise
+         * there is a chance (it happens about 1 in 3 runs) that the iothread
+         * exits before the coroutine is woken up, causing a spurious
+         * assertion failure.
+         */
+        atomic_inc(&atomic_counter);
+    }
+    atomic_dec(&running);
+}
+
+static void test_multi_co_mutex(int threads, int seconds)
+{
+    int i;
+
+    qemu_co_mutex_init(&comutex);
+    counter = 0;
+    atomic_counter = 0;
+    now_stopping = false;
+
+    create_aio_contexts();
+    assert(threads <= NUM_CONTEXTS);
+    running = threads;
+    for (i = 0; i < threads; i++) {
+        Coroutine *co1 = qemu_coroutine_create(test_multi_co_mutex_entry, NULL);
+        aio_co_schedule(ctx[i], co1);
+    }
+
+    g_usleep(seconds * 1000000);
+
+    atomic_mb_set(&now_stopping, true);
+    while (running > 0) {
+        g_usleep(100000);
+    }
+
+    join_aio_contexts();
+    g_test_message("%d iterations/second\n", counter / seconds);
+    g_assert_cmpint(counter, ==, atomic_counter);
+}
+
+/* Testing with NUM_CONTEXTS threads focuses on the queue.  The mutex however
+ * is too contended (and the threads spend too much time in aio_poll)
+ * to actually stress the handoff protocol.
+ */
+static void test_multi_co_mutex_1(void)
+{
+    test_multi_co_mutex(NUM_CONTEXTS, 1);
+}
+
+static void test_multi_co_mutex_10(void)
+{
+    test_multi_co_mutex(NUM_CONTEXTS, 10);
+}
+
+/* Testing with fewer threads stresses the handoff protocol too.  Still, the
+ * case where the locker _can_ pick up a handoff is very rare, happening
+ * about 10 times in 1 million, so increase the runtime a bit compared to
+ * other "quick" testcases that only run for 1 second.
+ */
+static void test_multi_co_mutex_2_3(void)
+{
+    test_multi_co_mutex(2, 3);
+}
+
+static void test_multi_co_mutex_2_30(void)
+{
+    test_multi_co_mutex(2, 30);
+}
+
 /* End of tests.  */
 
 int main(int argc, char **argv)
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
     g_test_add_func("/aio/multi/lifecycle", test_lifecycle);
     if (g_test_quick()) {
         g_test_add_func("/aio/multi/schedule", test_multi_co_schedule_1);
+        g_test_add_func("/aio/multi/mutex/contended", test_multi_co_mutex_1);
+        g_test_add_func("/aio/multi/mutex/handoff", test_multi_co_mutex_2_3);
     } else {
         g_test_add_func("/aio/multi/schedule", test_multi_co_schedule_10);
+        g_test_add_func("/aio/multi/mutex/contended", test_multi_co_mutex_10);
+        g_test_add_func("/aio/multi/mutex/handoff", test_multi_co_mutex_2_30);
     }
     return g_test_run();
 }
diff --git a/util/qemu-coroutine-lock.c b/util/qemu-coroutine-lock.c
index XXXXXXX..XXXXXXX 100644
--- a/util/qemu-coroutine-lock.c
+++ b/util/qemu-coroutine-lock.c
@@ -XXX,XX +XXX,XX @@
  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
+ *
+ * The lock-free mutex implementation is based on OSv
+ * (core/lfmutex.cc, include/lockfree/mutex.hh).
+ * Copyright (C) 2013 Cloudius Systems, Ltd.
  */
 
 #include "qemu/osdep.h"
@@ -XXX,XX +XXX,XX @@ bool qemu_co_queue_empty(CoQueue *queue)
     return QSIMPLEQ_FIRST(&queue->entries) == NULL;
 }
 
+/* The wait records are handled with a multiple-producer, single-consumer
+ * lock-free queue.  There cannot be two concurrent pop_waiter() calls
+ * because pop_waiter() can only be called while mutex->handoff is zero.
+ * This can happen in three cases:
+ * - in qemu_co_mutex_unlock, before the hand-off protocol has started.
+ *   In this case, qemu_co_mutex_lock will see mutex->handoff == 0 and
+ *   not take part in the handoff.
+ * - in qemu_co_mutex_lock, if it steals the hand-off responsibility from
+ *   qemu_co_mutex_unlock.  In this case, qemu_co_mutex_unlock will fail
+ *   the cmpxchg (it will see either 0 or the next sequence value) and
+ *   exit.  The next hand-off cannot begin until qemu_co_mutex_lock has
+ *   woken up someone.
+ * - in qemu_co_mutex_unlock, if it takes the hand-off token itself.
+ *   In this case another iteration starts with mutex->handoff == 0;
+ *   a concurrent qemu_co_mutex_lock will fail the cmpxchg, and
+ *   qemu_co_mutex_unlock will go back to case (1).
+ *
+ * The following functions manage this queue.
+ */
+typedef struct CoWaitRecord {
+    Coroutine *co;
+    QSLIST_ENTRY(CoWaitRecord) next;
+} CoWaitRecord;
+
+static void push_waiter(CoMutex *mutex, CoWaitRecord *w)
+{
+    w->co = qemu_coroutine_self();
+    QSLIST_INSERT_HEAD_ATOMIC(&mutex->from_push, w, next);
+}
+
+static void move_waiters(CoMutex *mutex)
+{
+    QSLIST_HEAD(, CoWaitRecord) reversed;
+    QSLIST_MOVE_ATOMIC(&reversed, &mutex->from_push);
+    while (!QSLIST_EMPTY(&reversed)) {
+        CoWaitRecord *w = QSLIST_FIRST(&reversed);
+        QSLIST_REMOVE_HEAD(&reversed, next);
+        QSLIST_INSERT_HEAD(&mutex->to_pop, w, next);
+    }
+}
+
+static CoWaitRecord *pop_waiter(CoMutex *mutex)
+{
+    CoWaitRecord *w;
+
+    if (QSLIST_EMPTY(&mutex->to_pop)) {
+        move_waiters(mutex);
+        if (QSLIST_EMPTY(&mutex->to_pop)) {
+            return NULL;
+        }
+    }
+    w = QSLIST_FIRST(&mutex->to_pop);
+    QSLIST_REMOVE_HEAD(&mutex->to_pop, next);
+    return w;
+}
+
+static bool has_waiters(CoMutex *mutex)
+{
+    return QSLIST_EMPTY(&mutex->to_pop) || QSLIST_EMPTY(&mutex->from_push);
+}
+
 void qemu_co_mutex_init(CoMutex *mutex)
 {
     memset(mutex, 0, sizeof(*mutex));
-    qemu_co_queue_init(&mutex->queue);
 }
 
-void coroutine_fn qemu_co_mutex_lock(CoMutex *mutex)
+static void coroutine_fn qemu_co_mutex_lock_slowpath(CoMutex *mutex)
 {
     Coroutine *self = qemu_coroutine_self();
+    CoWaitRecord w;
+    unsigned old_handoff;
 
     trace_qemu_co_mutex_lock_entry(mutex, self);
+    w.co = self;
+    push_waiter(mutex, &w);
 
-    while (mutex->locked) {
-        qemu_co_queue_wait(&mutex->queue);
+    /* This is the "Responsibility Hand-Off" protocol; a lock() picks from
+     * a concurrent unlock() the responsibility of waking somebody up.
+     */
+    old_handoff = atomic_mb_read(&mutex->handoff);
+    if (old_handoff &&
+        has_waiters(mutex) &&
+        atomic_cmpxchg(&mutex->handoff, old_handoff, 0) == old_handoff) {
+        /* There can be no concurrent pops, because there can be only
+         * one active handoff at a time.
+         */
+        CoWaitRecord *to_wake = pop_waiter(mutex);
+        Coroutine *co = to_wake->co;
+        if (co == self) {
+            /* We got the lock ourselves!  */
+            assert(to_wake == &w);
+            return;
+        }
+
+        aio_co_wake(co);
     }
 
-    mutex->locked = true;
-    mutex->holder = self;
-    self->locks_held++;
-
+    qemu_coroutine_yield();
     trace_qemu_co_mutex_lock_return(mutex, self);
 }
 
+void coroutine_fn qemu_co_mutex_lock(CoMutex *mutex)
+{
+    Coroutine *self = qemu_coroutine_self();
+
+    if (atomic_fetch_inc(&mutex->locked) == 0) {
+        /* Uncontended.  */
+        trace_qemu_co_mutex_lock_uncontended(mutex, self);
+    } else {
+        qemu_co_mutex_lock_slowpath(mutex);
+    }
+    mutex->holder = self;
+    self->locks_held++;
+}
+
 void coroutine_fn qemu_co_mutex_unlock(CoMutex *mutex)
 {
     Coroutine *self = qemu_coroutine_self();
 
     trace_qemu_co_mutex_unlock_entry(mutex, self);
 
-    assert(mutex->locked == true);
+    assert(mutex->locked);
     assert(mutex->holder == self);
     assert(qemu_in_coroutine());
 
-    mutex->locked = false;
     mutex->holder = NULL;
     self->locks_held--;
-    qemu_co_queue_next(&mutex->queue);
+    if (atomic_fetch_dec(&mutex->locked) == 1) {
+        /* No waiting qemu_co_mutex_lock().  Pfew, that was easy!  */
+        return;
+    }
+
+    for (;;) {
+        CoWaitRecord *to_wake = pop_waiter(mutex);
+        unsigned our_handoff;
+
+        if (to_wake) {
+            Coroutine *co = to_wake->co;
+            aio_co_wake(co);
+            break;
+        }
+
+        /* Some concurrent lock() is in progress (we know this because
+         * mutex->locked was >1) but it hasn't yet put itself on the wait
+         * queue.  Pick a sequence number for the handoff protocol (not 0).
+         */
+        if (++mutex->sequence == 0) {
+            mutex->sequence = 1;
+        }
+
+        our_handoff = mutex->sequence;
+        atomic_mb_set(&mutex->handoff, our_handoff);
+        if (!has_waiters(mutex)) {
+            /* The concurrent lock has not added itself yet, so it
+             * will be able to pick our handoff.
+             */
+            break;
+        }
+
+        /* Try to do the handoff protocol ourselves; if somebody else has
+         * already taken it, however, we're done and they're responsible.
+         */
+        if (atomic_cmpxchg(&mutex->handoff, our_handoff, 0) != our_handoff) {
+            break;
+        }
+    }
 
     trace_qemu_co_mutex_unlock_return(mutex, self);
 }
diff --git a/util/trace-events b/util/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/util/trace-events
+++ b/util/trace-events
@@ -XXX,XX +XXX,XX @@ qemu_coroutine_terminate(void *co) "self %p"
 
 # util/qemu-coroutine-lock.c
 qemu_co_queue_run_restart(void *co) "co %p"
+qemu_co_mutex_lock_uncontended(void *mutex, void *self) "mutex %p self %p"
 qemu_co_mutex_lock_entry(void *mutex, void *self) "mutex %p self %p"
 qemu_co_mutex_lock_return(void *mutex, void *self) "mutex %p self %p"
 qemu_co_mutex_unlock_entry(void *mutex, void *self) "mutex %p self %p"
-- 
2.9.3

From: Paolo Bonzini <pbonzini@redhat.com>

Running a very small critical section on pthread_mutex_t and CoMutex
shows that pthread_mutex_t is much faster because it doesn't actually
go to sleep.  What happens is that the critical section is shorter
than the latency of entering the kernel and thus FUTEX_WAIT always
fails.  With CoMutex there is no such latency but you still want to
avoid wait and wakeup.  So introduce it artificially.

This only works with one waiters; because CoMutex is fair, it will
always have more waits and wakeups than a pthread_mutex_t.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Message-id: 20170213181244.16297-3-pbonzini@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 include/qemu/coroutine.h   |  5 +++++
 util/qemu-coroutine-lock.c | 51 ++++++++++++++++++++++++++++++++++++++++------
 util/qemu-coroutine.c      |  2 +-
 3 files changed, 51 insertions(+), 7 deletions(-)

diff --git a/include/qemu/coroutine.h b/include/qemu/coroutine.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/coroutine.h
+++ b/include/qemu/coroutine.h
@@ -XXX,XX +XXX,XX @@ typedef struct CoMutex {
      */
     unsigned locked;
 
+    /* Context that is holding the lock.  Useful to avoid spinning
+     * when two coroutines on the same AioContext try to get the lock. :)
+     */
+    AioContext *ctx;
+
     /* A queue of waiters.  Elements are added atomically in front of
      * from_push.  to_pop is only populated, and popped from, by whoever
      * is in charge of the next wakeup.  This can be an unlocker or,
diff --git a/util/qemu-coroutine-lock.c b/util/qemu-coroutine-lock.c
index XXXXXXX..XXXXXXX 100644
--- a/util/qemu-coroutine-lock.c
+++ b/util/qemu-coroutine-lock.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "qemu/coroutine.h"
 #include "qemu/coroutine_int.h"
+#include "qemu/processor.h"
 #include "qemu/queue.h"
 #include "block/aio.h"
 #include "trace.h"
@@ -XXX,XX +XXX,XX @@ void qemu_co_mutex_init(CoMutex *mutex)
     memset(mutex, 0, sizeof(*mutex));
 }
 
-static void coroutine_fn qemu_co_mutex_lock_slowpath(CoMutex *mutex)
+static void coroutine_fn qemu_co_mutex_wake(CoMutex *mutex, Coroutine *co)
+{
+    /* Read co before co->ctx; pairs with smp_wmb() in
+     * qemu_coroutine_enter().
+     */
+    smp_read_barrier_depends();
+    mutex->ctx = co->ctx;
+    aio_co_wake(co);
+}
+
+static void coroutine_fn qemu_co_mutex_lock_slowpath(AioContext *ctx,
+                                                     CoMutex *mutex)
 {
     Coroutine *self = qemu_coroutine_self();
     CoWaitRecord w;
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn qemu_co_mutex_lock_slowpath(CoMutex *mutex)
         if (co == self) {
             /* We got the lock ourselves!  */
             assert(to_wake == &w);
+            mutex->ctx = ctx;
             return;
         }
 
-        aio_co_wake(co);
+        qemu_co_mutex_wake(mutex, co);
     }
 
     qemu_coroutine_yield();
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn qemu_co_mutex_lock_slowpath(CoMutex *mutex)
 
 void coroutine_fn qemu_co_mutex_lock(CoMutex *mutex)
 {
+    AioContext *ctx = qemu_get_current_aio_context();
     Coroutine *self = qemu_coroutine_self();
+    int waiters, i;
 
-    if (atomic_fetch_inc(&mutex->locked) == 0) {
+    /* Running a very small critical section on pthread_mutex_t and CoMutex
+     * shows that pthread_mutex_t is much faster because it doesn't actually
+     * go to sleep.  What happens is that the critical section is shorter
+     * than the latency of entering the kernel and thus FUTEX_WAIT always
+     * fails.  With CoMutex there is no such latency but you still want to
+     * avoid wait and wakeup.  So introduce it artificially.
+     */
+    i = 0;
+retry_fast_path:
+    waiters = atomic_cmpxchg(&mutex->locked, 0, 1);
+    if (waiters != 0) {
+        while (waiters == 1 && ++i < 1000) {
+            if (atomic_read(&mutex->ctx) == ctx) {
+                break;
+            }
+            if (atomic_read(&mutex->locked) == 0) {
+                goto retry_fast_path;
+            }
+            cpu_relax();
+        }
+        waiters = atomic_fetch_inc(&mutex->locked);
+    }
+
+    if (waiters == 0) {
         /* Uncontended.  */
         trace_qemu_co_mutex_lock_uncontended(mutex, self);
+        mutex->ctx = ctx;
     } else {
-        qemu_co_mutex_lock_slowpath(mutex);
+        qemu_co_mutex_lock_slowpath(ctx, mutex);
     }
     mutex->holder = self;
     self->locks_held++;
@@ -XXX,XX +XXX,XX @@ void coroutine_fn qemu_co_mutex_unlock(CoMutex *mutex)
     assert(mutex->holder == self);
     assert(qemu_in_coroutine());
 
+    mutex->ctx = NULL;
     mutex->holder = NULL;
     self->locks_held--;
     if (atomic_fetch_dec(&mutex->locked) == 1) {
@@ -XXX,XX +XXX,XX @@ void coroutine_fn qemu_co_mutex_unlock(CoMutex *mutex)
         unsigned our_handoff;
 
         if (to_wake) {
-            Coroutine *co = to_wake->co;
-            aio_co_wake(co);
+            qemu_co_mutex_wake(mutex, to_wake->co);
             break;
         }
 
diff --git a/util/qemu-coroutine.c b/util/qemu-coroutine.c
index XXXXXXX..XXXXXXX 100644
--- a/util/qemu-coroutine.c
+++ b/util/qemu-coroutine.c
@@ -XXX,XX +XXX,XX @@ void qemu_coroutine_enter(Coroutine *co)
     co->ctx = qemu_get_current_aio_context();
 
     /* Store co->ctx before anything that stores co.  Matches
-     * barrier in aio_co_wake.
+     * barrier in aio_co_wake and qemu_co_mutex_wake.
      */
     smp_wmb();
 
-- 
2.9.3

From: Paolo Bonzini <pbonzini@redhat.com>

Add two implementations of the same benchmark as the previous patch,
but using pthreads.  One uses a normal QemuMutex, the other is Linux
only and implements a fair mutex based on MCS locks and futexes.
This shows that the slower performance of the 5-thread case is due to
the fairness of CoMutex, rather than to coroutines.  If fairness does
not matter, as is the case with two threads, CoMutex can actually be
faster than pthreads.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Message-id: 20170213181244.16297-4-pbonzini@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 tests/test-aio-multithread.c | 164 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 164 insertions(+)

diff --git a/tests/test-aio-multithread.c b/tests/test-aio-multithread.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/test-aio-multithread.c
+++ b/tests/test-aio-multithread.c
@@ -XXX,XX +XXX,XX @@ static void test_multi_co_mutex_2_30(void)
     test_multi_co_mutex(2, 30);
 }
 
+/* Same test with fair mutexes, for performance comparison.  */
+
+#ifdef CONFIG_LINUX
+#include "qemu/futex.h"
+
+/* The nodes for the mutex reside in this structure (on which we try to avoid
+ * false sharing).  The head of the mutex is in the "mutex_head" variable.
+ */
+static struct {
+    int next, locked;
+    int padding[14];
+} nodes[NUM_CONTEXTS] __attribute__((__aligned__(64)));
+
+static int mutex_head = -1;
+
+static void mcs_mutex_lock(void)
+{
+    int prev;
+
+    nodes[id].next = -1;
+    nodes[id].locked = 1;
+    prev = atomic_xchg(&mutex_head, id);
+    if (prev != -1) {
+        atomic_set(&nodes[prev].next, id);
+        qemu_futex_wait(&nodes[id].locked, 1);
+    }
+}
+
+static void mcs_mutex_unlock(void)
+{
+    int next;
+    if (nodes[id].next == -1) {
+        if (atomic_read(&mutex_head) == id &&
+            atomic_cmpxchg(&mutex_head, id, -1) == id) {
+            /* Last item in the list, exit.  */
+            return;
+        }
+        while (atomic_read(&nodes[id].next) == -1) {
+            /* mcs_mutex_lock did the xchg, but has not updated
+             * nodes[prev].next yet.
+             */
+        }
+    }
+
+    /* Wake up the next in line.  */
+    next = nodes[id].next;
+    nodes[next].locked = 0;
+    qemu_futex_wake(&nodes[next].locked, 1);
+}
+
+static void test_multi_fair_mutex_entry(void *opaque)
+{
+    while (!atomic_mb_read(&now_stopping)) {
+        mcs_mutex_lock();
+        counter++;
+        mcs_mutex_unlock();
+        atomic_inc(&atomic_counter);
+    }
+    atomic_dec(&running);
+}
+
+static void test_multi_fair_mutex(int threads, int seconds)
+{
+    int i;
+
+    assert(mutex_head == -1);
+    counter = 0;
+    atomic_counter = 0;
+    now_stopping = false;
+
+    create_aio_contexts();
+    assert(threads <= NUM_CONTEXTS);
+    running = threads;
+    for (i = 0; i < threads; i++) {
+        Coroutine *co1 = qemu_coroutine_create(test_multi_fair_mutex_entry, NULL);
+        aio_co_schedule(ctx[i], co1);
+    }
+
+    g_usleep(seconds * 1000000);
+
+    atomic_mb_set(&now_stopping, true);
+    while (running > 0) {
+        g_usleep(100000);
+    }
+
+    join_aio_contexts();
+    g_test_message("%d iterations/second\n", counter / seconds);
+    g_assert_cmpint(counter, ==, atomic_counter);
+}
+
+static void test_multi_fair_mutex_1(void)
+{
+    test_multi_fair_mutex(NUM_CONTEXTS, 1);
+}
+
+static void test_multi_fair_mutex_10(void)
+{
+    test_multi_fair_mutex(NUM_CONTEXTS, 10);
+}
+#endif
+
+/* Same test with pthread mutexes, for performance comparison and
+ * portability.  */
+
+static QemuMutex mutex;
+
+static void test_multi_mutex_entry(void *opaque)
+{
+    while (!atomic_mb_read(&now_stopping)) {
+        qemu_mutex_lock(&mutex);
+        counter++;
+        qemu_mutex_unlock(&mutex);
+        atomic_inc(&atomic_counter);
+    }
+    atomic_dec(&running);
+}
+
+static void test_multi_mutex(int threads, int seconds)
+{
+    int i;
+
+    qemu_mutex_init(&mutex);
+    counter = 0;
+    atomic_counter = 0;
+    now_stopping = false;
+
+    create_aio_contexts();
+    assert(threads <= NUM_CONTEXTS);
+    running = threads;
+    for (i = 0; i < threads; i++) {
+        Coroutine *co1 = qemu_coroutine_create(test_multi_mutex_entry, NULL);
+        aio_co_schedule(ctx[i], co1);
+    }
+
+    g_usleep(seconds * 1000000);
+
+    atomic_mb_set(&now_stopping, true);
+    while (running > 0) {
+        g_usleep(100000);
+    }
+
+    join_aio_contexts();
+    g_test_message("%d iterations/second\n", counter / seconds);
+    g_assert_cmpint(counter, ==, atomic_counter);
+}
+
+static void test_multi_mutex_1(void)
+{
+    test_multi_mutex(NUM_CONTEXTS, 1);
+}
+
+static void test_multi_mutex_10(void)
+{
+    test_multi_mutex(NUM_CONTEXTS, 10);
+}
+
 /* End of tests.  */
 
 int main(int argc, char **argv)
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
         g_test_add_func("/aio/multi/schedule", test_multi_co_schedule_1);
         g_test_add_func("/aio/multi/mutex/contended", test_multi_co_mutex_1);
         g_test_add_func("/aio/multi/mutex/handoff", test_multi_co_mutex_2_3);
+#ifdef CONFIG_LINUX
+        g_test_add_func("/aio/multi/mutex/mcs", test_multi_fair_mutex_1);
+#endif
+        g_test_add_func("/aio/multi/mutex/pthread", test_multi_mutex_1);
     } else {
         g_test_add_func("/aio/multi/schedule", test_multi_co_schedule_10);
         g_test_add_func("/aio/multi/mutex/contended", test_multi_co_mutex_10);
         g_test_add_func("/aio/multi/mutex/handoff", test_multi_co_mutex_2_30);
+#ifdef CONFIG_LINUX
+        g_test_add_func("/aio/multi/mutex/mcs", test_multi_fair_mutex_10);
+#endif
+        g_test_add_func("/aio/multi/mutex/pthread", test_multi_mutex_10);
     }
     return g_test_run();
 }
-- 
2.9.3

From: Paolo Bonzini <pbonzini@redhat.com>

This will avoid forward references in the next patch.  It is also
more logical because CoQueue is not anymore the basic primitive.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Message-id: 20170213181244.16297-5-pbonzini@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 include/qemu/coroutine.h | 89 ++++++++++++++++++++++++------------------------
 1 file changed, 44 insertions(+), 45 deletions(-)

diff --git a/include/qemu/coroutine.h b/include/qemu/coroutine.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/coroutine.h
+++ b/include/qemu/coroutine.h
@@ -XXX,XX +XXX,XX @@ bool qemu_in_coroutine(void);
  */
 bool qemu_coroutine_entered(Coroutine *co);
 
-
-/**
- * CoQueues are a mechanism to queue coroutines in order to continue executing
- * them later. They provide the fundamental primitives on which coroutine locks
- * are built.
- */
-typedef struct CoQueue {
-    QSIMPLEQ_HEAD(, Coroutine) entries;
-} CoQueue;
-
-/**
- * Initialise a CoQueue. This must be called before any other operation is used
- * on the CoQueue.
- */
-void qemu_co_queue_init(CoQueue *queue);
-
-/**
- * Adds the current coroutine to the CoQueue and transfers control to the
- * caller of the coroutine.
- */
-void coroutine_fn qemu_co_queue_wait(CoQueue *queue);
-
-/**
- * Restarts the next coroutine in the CoQueue and removes it from the queue.
- *
- * Returns true if a coroutine was restarted, false if the queue is empty.
- */
-bool coroutine_fn qemu_co_queue_next(CoQueue *queue);
-
-/**
- * Restarts all coroutines in the CoQueue and leaves the queue empty.
- */
-void coroutine_fn qemu_co_queue_restart_all(CoQueue *queue);
-
-/**
- * Enter the next coroutine in the queue
- */
-bool qemu_co_enter_next(CoQueue *queue);
-
-/**
- * Checks if the CoQueue is empty.
- */
-bool qemu_co_queue_empty(CoQueue *queue);
-
-
 /**
  * Provides a mutex that can be used to synchronise coroutines
  */
@@ -XXX,XX +XXX,XX @@ void coroutine_fn qemu_co_mutex_lock(CoMutex *mutex);
  */
 void coroutine_fn qemu_co_mutex_unlock(CoMutex *mutex);
 
+
+/**
+ * CoQueues are a mechanism to queue coroutines in order to continue executing
+ * them later.
+ */
+typedef struct CoQueue {
+    QSIMPLEQ_HEAD(, Coroutine) entries;
+} CoQueue;
+
+/**
+ * Initialise a CoQueue. This must be called before any other operation is used
+ * on the CoQueue.
+ */
+void qemu_co_queue_init(CoQueue *queue);
+
+/**
+ * Adds the current coroutine to the CoQueue and transfers control to the
+ * caller of the coroutine.
+ */
+void coroutine_fn qemu_co_queue_wait(CoQueue *queue);
+
+/**
+ * Restarts the next coroutine in the CoQueue and removes it from the queue.
+ *
+ * Returns true if a coroutine was restarted, false if the queue is empty.
+ */
+bool coroutine_fn qemu_co_queue_next(CoQueue *queue);
+
+/**
+ * Restarts all coroutines in the CoQueue and leaves the queue empty.
+ */
+void coroutine_fn qemu_co_queue_restart_all(CoQueue *queue);
+
+/**
+ * Enter the next coroutine in the queue
+ */
+bool qemu_co_enter_next(CoQueue *queue);
+
+/**
+ * Checks if the CoQueue is empty.
+ */
+bool qemu_co_queue_empty(CoQueue *queue);
+
+
 typedef struct CoRwlock {
     bool writer;
     int reader;
-- 
2.9.3

From: Paolo Bonzini <pbonzini@redhat.com>

All that CoQueue needs in order to become thread-safe is help
from an external mutex.  Add this to the API.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Message-id: 20170213181244.16297-6-pbonzini@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 include/qemu/coroutine.h   |  8 +++++---
 block/backup.c             |  2 +-
 block/io.c                 |  4 ++--
 block/nbd-client.c         |  2 +-
 block/qcow2-cluster.c      |  4 +---
 block/sheepdog.c           |  2 +-
 block/throttle-groups.c    |  2 +-
 hw/9pfs/9p.c               |  2 +-
 util/qemu-coroutine-lock.c | 24 +++++++++++++++++++++---
 9 files changed, 34 insertions(+), 16 deletions(-)

diff --git a/include/qemu/coroutine.h b/include/qemu/coroutine.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/coroutine.h
+++ b/include/qemu/coroutine.h
@@ -XXX,XX +XXX,XX @@ void coroutine_fn qemu_co_mutex_unlock(CoMutex *mutex);
 
 /**
  * CoQueues are a mechanism to queue coroutines in order to continue executing
- * them later.
+ * them later.  They are similar to condition variables, but they need help
+ * from an external mutex in order to maintain thread-safety.
  */
 typedef struct CoQueue {
     QSIMPLEQ_HEAD(, Coroutine) entries;
@@ -XXX,XX +XXX,XX @@ void qemu_co_queue_init(CoQueue *queue);
 
 /**
  * Adds the current coroutine to the CoQueue and transfers control to the
- * caller of the coroutine.
+ * caller of the coroutine.  The mutex is unlocked during the wait and
+ * locked again afterwards.
  */
-void coroutine_fn qemu_co_queue_wait(CoQueue *queue);
+void coroutine_fn qemu_co_queue_wait(CoQueue *queue, CoMutex *mutex);
 
 /**
  * Restarts the next coroutine in the CoQueue and removes it from the queue.
diff --git a/block/backup.c b/block/backup.c
index XXXXXXX..XXXXXXX 100644
--- a/block/backup.c
+++ b/block/backup.c
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn wait_for_overlapping_requests(BackupBlockJob *job,
         retry = false;
         QLIST_FOREACH(req, &job->inflight_reqs, list) {
             if (end > req->start && start < req->end) {
-                qemu_co_queue_wait(&req->wait_queue);
+                qemu_co_queue_wait(&req->wait_queue, NULL);
                 retry = true;
                 break;
             }
diff --git a/block/io.c b/block/io.c
index XXXXXXX..XXXXXXX 100644
--- a/block/io.c
+++ b/block/io.c
@@ -XXX,XX +XXX,XX @@ static bool coroutine_fn wait_serialising_requests(BdrvTrackedRequest *self)
                  * (instead of producing a deadlock in the former case). */
                 if (!req->waiting_for) {
                     self->waiting_for = req;
-                    qemu_co_queue_wait(&req->wait_queue);
+                    qemu_co_queue_wait(&req->wait_queue, NULL);
                     self->waiting_for = NULL;
                     retry = true;
                     waited = true;
@@ -XXX,XX +XXX,XX @@ int coroutine_fn bdrv_co_flush(BlockDriverState *bs)
 
     /* Wait until any previous flushes are completed */
     while (bs->active_flush_req) {
-        qemu_co_queue_wait(&bs->flush_queue);
+        qemu_co_queue_wait(&bs->flush_queue, NULL);
     }
 
     bs->active_flush_req = true;
diff --git a/block/nbd-client.c b/block/nbd-client.c
index XXXXXXX..XXXXXXX 100644
--- a/block/nbd-client.c
+++ b/block/nbd-client.c
@@ -XXX,XX +XXX,XX @@ static void nbd_coroutine_start(NBDClientSession *s,
     /* Poor man semaphore.  The free_sema is locked when no other request
      * can be accepted, and unlocked after receiving one reply.  */
     if (s->in_flight == MAX_NBD_REQUESTS) {
-        qemu_co_queue_wait(&s->free_sema);
+        qemu_co_queue_wait(&s->free_sema, NULL);
         assert(s->in_flight < MAX_NBD_REQUESTS);
     }
     s->in_flight++;
diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
index XXXXXXX..XXXXXXX 100644
--- a/block/qcow2-cluster.c
+++ b/block/qcow2-cluster.c
@@ -XXX,XX +XXX,XX @@ static int handle_dependencies(BlockDriverState *bs, uint64_t guest_offset,
             if (bytes == 0) {
                 /* Wait for the dependency to complete. We need to recheck
                  * the free/allocated clusters when we continue. */
-                qemu_co_mutex_unlock(&s->lock);
-                qemu_co_queue_wait(&old_alloc->dependent_requests);
-                qemu_co_mutex_lock(&s->lock);
+                qemu_co_queue_wait(&old_alloc->dependent_requests, &s->lock);
                 return -EAGAIN;
             }
         }
diff --git a/block/sheepdog.c b/block/sheepdog.c
index XXXXXXX..XXXXXXX 100644
--- a/block/sheepdog.c
+++ b/block/sheepdog.c
@@ -XXX,XX +XXX,XX @@ static void wait_for_overlapping_aiocb(BDRVSheepdogState *s, SheepdogAIOCB *acb)
 retry:
     QLIST_FOREACH(cb, &s->inflight_aiocb_head, aiocb_siblings) {
         if (AIOCBOverlapping(acb, cb)) {
-            qemu_co_queue_wait(&s->overlapping_queue);
+            qemu_co_queue_wait(&s->overlapping_queue, NULL);
             goto retry;
         }
     }
diff --git a/block/throttle-groups.c b/block/throttle-groups.c
index XXXXXXX..XXXXXXX 100644
--- a/block/throttle-groups.c
+++ b/block/throttle-groups.c
@@ -XXX,XX +XXX,XX @@ void coroutine_fn throttle_group_co_io_limits_intercept(BlockBackend *blk,
     if (must_wait || blkp->pending_reqs[is_write]) {
         blkp->pending_reqs[is_write]++;
         qemu_mutex_unlock(&tg->lock);
-        qemu_co_queue_wait(&blkp->throttled_reqs[is_write]);
+        qemu_co_queue_wait(&blkp->throttled_reqs[is_write], NULL);
         qemu_mutex_lock(&tg->lock);
         blkp->pending_reqs[is_write]--;
     }
diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/9pfs/9p.c
+++ b/hw/9pfs/9p.c
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn v9fs_flush(void *opaque)
         /*
          * Wait for pdu to complete.
          */
-        qemu_co_queue_wait(&cancel_pdu->complete);
+        qemu_co_queue_wait(&cancel_pdu->complete, NULL);
         cancel_pdu->cancelled = 0;
         pdu_free(cancel_pdu);
     }
diff --git a/util/qemu-coroutine-lock.c b/util/qemu-coroutine-lock.c
index XXXXXXX..XXXXXXX 100644
--- a/util/qemu-coroutine-lock.c
+++ b/util/qemu-coroutine-lock.c
@@ -XXX,XX +XXX,XX @@ void qemu_co_queue_init(CoQueue *queue)
     QSIMPLEQ_INIT(&queue->entries);
 }
 
-void coroutine_fn qemu_co_queue_wait(CoQueue *queue)
+void coroutine_fn qemu_co_queue_wait(CoQueue *queue, CoMutex *mutex)
 {
     Coroutine *self = qemu_coroutine_self();
     QSIMPLEQ_INSERT_TAIL(&queue->entries, self, co_queue_next);
+
+    if (mutex) {
+        qemu_co_mutex_unlock(mutex);
+    }
+
+    /* There is no race condition here.  Other threads will call
+     * aio_co_schedule on our AioContext, which can reenter this
+     * coroutine but only after this yield and after the main loop
+     * has gone through the next iteration.
+     */
     qemu_coroutine_yield();
     assert(qemu_in_coroutine());
+
+    /* TODO: OSv implements wait morphing here, where the wakeup
+     * primitive automatically places the woken coroutine on the
+     * mutex's queue.  This avoids the thundering herd effect.
+     */
+    if (mutex) {
+        qemu_co_mutex_lock(mutex);
+    }
 }
 
 /**
@@ -XXX,XX +XXX,XX @@ void qemu_co_rwlock_rdlock(CoRwlock *lock)
     Coroutine *self = qemu_coroutine_self();
 
     while (lock->writer) {
-        qemu_co_queue_wait(&lock->queue);
+        qemu_co_queue_wait(&lock->queue, NULL);
     }
     lock->reader++;
     self->locks_held++;
@@ -XXX,XX +XXX,XX @@ void qemu_co_rwlock_wrlock(CoRwlock *lock)
     Coroutine *self = qemu_coroutine_self();
 
     while (lock->writer || lock->reader) {
-        qemu_co_queue_wait(&lock->queue);
+        qemu_co_queue_wait(&lock->queue, NULL);
     }
     lock->writer = true;
     self->locks_held++;
-- 
2.9.3

From: Paolo Bonzini <pbonzini@redhat.com>

This adds a CoMutex around the existing CoQueue.  Because the write-side
can just take CoMutex, the old "writer" field is not necessary anymore.
Instead of removing it altogether, count the number of pending writers
during a read-side critical section and forbid further readers from
entering.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Message-id: 20170213181244.16297-7-pbonzini@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 include/qemu/coroutine.h   |  3 ++-
 util/qemu-coroutine-lock.c | 35 ++++++++++++++++++++++++-----------
 2 files changed, 26 insertions(+), 12 deletions(-)

diff --git a/include/qemu/coroutine.h b/include/qemu/coroutine.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/coroutine.h
+++ b/include/qemu/coroutine.h
@@ -XXX,XX +XXX,XX @@ bool qemu_co_queue_empty(CoQueue *queue);
 
 
 typedef struct CoRwlock {
-    bool writer;
+    int pending_writer;
     int reader;
+    CoMutex mutex;
     CoQueue queue;
 } CoRwlock;
 
diff --git a/util/qemu-coroutine-lock.c b/util/qemu-coroutine-lock.c
index XXXXXXX..XXXXXXX 100644
--- a/util/qemu-coroutine-lock.c
+++ b/util/qemu-coroutine-lock.c
@@ -XXX,XX +XXX,XX @@ void qemu_co_rwlock_init(CoRwlock *lock)
 {
     memset(lock, 0, sizeof(*lock));
     qemu_co_queue_init(&lock->queue);
+    qemu_co_mutex_init(&lock->mutex);
 }
 
 void qemu_co_rwlock_rdlock(CoRwlock *lock)
 {
     Coroutine *self = qemu_coroutine_self();
 
-    while (lock->writer) {
-        qemu_co_queue_wait(&lock->queue, NULL);
+    qemu_co_mutex_lock(&lock->mutex);
+    /* For fairness, wait if a writer is in line.  */
+    while (lock->pending_writer) {
+        qemu_co_queue_wait(&lock->queue, &lock->mutex);
     }
     lock->reader++;
+    qemu_co_mutex_unlock(&lock->mutex);
+
+    /* The rest of the read-side critical section is run without the mutex.  */
     self->locks_held++;
 }
 
@@ -XXX,XX +XXX,XX @@ void qemu_co_rwlock_unlock(CoRwlock *lock)
     Coroutine *self = qemu_coroutine_self();
 
     assert(qemu_in_coroutine());
-    if (lock->writer) {
-        lock->writer = false;
+    if (!lock->reader) {
+        /* The critical section started in qemu_co_rwlock_wrlock.  */
         qemu_co_queue_restart_all(&lock->queue);
     } else {
+        self->locks_held--;
+
+        qemu_co_mutex_lock(&lock->mutex);
         lock->reader--;
         assert(lock->reader >= 0);
         /* Wakeup only one waiting writer */
@@ -XXX,XX +XXX,XX @@ void qemu_co_rwlock_unlock(CoRwlock *lock)
             qemu_co_queue_next(&lock->queue);
         }
     }
-    self->locks_held--;
+    qemu_co_mutex_unlock(&lock->mutex);
 }
 
 void qemu_co_rwlock_wrlock(CoRwlock *lock)
 {
-    Coroutine *self = qemu_coroutine_self();
-
-    while (lock->writer || lock->reader) {
-        qemu_co_queue_wait(&lock->queue, NULL);
+    qemu_co_mutex_lock(&lock->mutex);
+    lock->pending_writer++;
+    while (lock->reader) {
+        qemu_co_queue_wait(&lock->queue, &lock->mutex);
     }
-    lock->writer = true;
-    self->locks_held++;
+    lock->pending_writer--;
+
+    /* The rest of the write-side critical section is run with
+     * the mutex taken, so that lock->reader remains zero.
+     * There is no need to update self->locks_held.
+     */
 }
-- 
2.9.3

The following changes since commit 474f3938d79ab36b9231c9ad3b5a9314c2aeacde:

Merge remote-tracking branch 'remotes/amarkovic/tags/mips-queue-jun-21-2019' into staging (2019-06-21 15:40:50 +0100)

are available in the Git repository at:

https://github.com/XanClic/qemu.git tags/pull-block-2019-06-24

for you to fetch changes up to ab5d4a30f7f3803ca5106b370969c1b7b54136f8:

iotests: Fix 205 for concurrent runs (2019-06-24 16:01:40 +0200)

----------------------------------------------------------------
Block patches:
- The SSH block driver now uses libssh instead of libssh2
- The VMDK block driver gets read-only support for the seSparse
  subformat
- Various fixes

---

v2:
- Squashed Pino's fix for pre-0.8 libssh into the libssh patch

----------------------------------------------------------------
Anton Nefedov (1):
  iotest 134: test cluster-misaligned encrypted write

Klaus Birkelund Jensen (1):
  nvme: do not advertise support for unsupported arbitration mechanism

Max Reitz (1):
  iotests: Fix 205 for concurrent runs

Pino Toscano (1):
  ssh: switch from libssh2 to libssh

Sam Eiderman (3):
  vmdk: Fix comment regarding max l1_size coverage
  vmdk: Reduce the max bound for L1 table size
  vmdk: Add read-only support for seSparse snapshots

Vladimir Sementsov-Ogievskiy (1):
  blockdev: enable non-root nodes for transaction drive-backup source

-- 
2.21.0

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

We forget to enable it for transaction .prepare, while it is already
enabled in do_drive_backup since commit a2d665c1bc362
    "blockdev: loosen restrictions on drive-backup source node"

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-id: 20190618140804.59214-1-vsementsov@virtuozzo.com
Reviewed-by: John Snow <jsnow@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
---
 blockdev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blockdev.c b/blockdev.c
index XXXXXXX..XXXXXXX 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -XXX,XX +XXX,XX @@ static void drive_backup_prepare(BlkActionState *common, Error **errp)
     assert(common->action->type == TRANSACTION_ACTION_KIND_DRIVE_BACKUP);
     backup = common->action->u.drive_backup.data;
 
-    bs = qmp_get_root_bs(backup->device, errp);
+    bs = bdrv_lookup_bs(backup->device, backup->device, errp);
     if (!bs) {
         return;
     }
-- 
2.21.0

From: Anton Nefedov <anton.nefedov@virtuozzo.com>

COW (even empty/zero) areas require encryption too

Signed-off-by: Anton Nefedov <anton.nefedov@virtuozzo.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Message-id: 20190516143028.81155-1-anton.nefedov@virtuozzo.com
Signed-off-by: Max Reitz <mreitz@redhat.com>
---
 tests/qemu-iotests/134     |  9 +++++++++
 tests/qemu-iotests/134.out | 10 ++++++++++
 2 files changed, 19 insertions(+)

diff --git a/tests/qemu-iotests/134 b/tests/qemu-iotests/134
index XXXXXXX..XXXXXXX 100755
--- a/tests/qemu-iotests/134
+++ b/tests/qemu-iotests/134
@@ -XXX,XX +XXX,XX @@ echo
 echo "== reading whole image =="
 $QEMU_IO --object $SECRET -c "read 0 $size" --image-opts $IMGSPEC | _filter_qemu_io | _filter_testdir
 
+echo
+echo "== rewriting cluster part =="
+$QEMU_IO --object $SECRET -c "write -P 0xb 512 512" --image-opts $IMGSPEC | _filter_qemu_io | _filter_testdir
+
+echo
+echo "== verify pattern =="
+$QEMU_IO --object $SECRET -c "read -P 0 0 512"  --image-opts $IMGSPEC | _filter_qemu_io | _filter_testdir
+$QEMU_IO --object $SECRET -c "read -P 0xb 512 512"  --image-opts $IMGSPEC | _filter_qemu_io | _filter_testdir
+
 echo
 echo "== rewriting whole image =="
 $QEMU_IO --object $SECRET -c "write -P 0xa 0 $size" --image-opts $IMGSPEC | _filter_qemu_io | _filter_testdir
diff --git a/tests/qemu-iotests/134.out b/tests/qemu-iotests/134.out
index XXXXXXX..XXXXXXX 100644
--- a/tests/qemu-iotests/134.out
+++ b/tests/qemu-iotests/134.out
@@ -XXX,XX +XXX,XX @@ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 encryption=on encrypt.
 read 134217728/134217728 bytes at offset 0
 128 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 
+== rewriting cluster part ==
+wrote 512/512 bytes at offset 512
+512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+== verify pattern ==
+read 512/512 bytes at offset 0
+512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+read 512/512 bytes at offset 512
+512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
 == rewriting whole image ==
 wrote 134217728/134217728 bytes at offset 0
 128 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-- 
2.21.0

From: Sam Eiderman <shmuel.eiderman@oracle.com>

Commit b0651b8c246d ("vmdk: Move l1_size check into vmdk_add_extent")
extended the l1_size check from VMDK4 to VMDK3 but did not update the
default coverage in the moved comment.

The previous vmdk4 calculation:

(512 * 1024 * 1024) * 512(l2 entries) * 65536(grain) = 16PB

The added vmdk3 calculation:

(512 * 1024 * 1024) * 4096(l2 entries) * 512(grain) = 1PB

Adding the calculation of vmdk3 to the comment.

In any case, VMware does not offer virtual disks more than 2TB for
vmdk4/vmdk3 or 64TB for the new undocumented seSparse format which is
not implemented yet in qemu.

Reviewed-by: Karl Heubaum <karl.heubaum@oracle.com>
Reviewed-by: Eyal Moscovici <eyal.moscovici@oracle.com>
Reviewed-by: Liran Alon <liran.alon@oracle.com>
Reviewed-by: Arbel Moshe <arbel.moshe@oracle.com>
Signed-off-by: Sam Eiderman <shmuel.eiderman@oracle.com>
Message-id: 20190620091057.47441-2-shmuel.eiderman@oracle.com
Reviewed-by: yuchenlin <yuchenlin@synology.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
---
 block/vmdk.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/block/vmdk.c b/block/vmdk.c
index XXXXXXX..XXXXXXX 100644
--- a/block/vmdk.c
+++ b/block/vmdk.c
@@ -XXX,XX +XXX,XX @@ static int vmdk_add_extent(BlockDriverState *bs,
         return -EFBIG;
     }
     if (l1_size > 512 * 1024 * 1024) {
-        /* Although with big capacity and small l1_entry_sectors, we can get a
+        /*
+         * Although with big capacity and small l1_entry_sectors, we can get a
          * big l1_size, we don't want unbounded value to allocate the table.
-         * Limit it to 512M, which is 16PB for default cluster and L2 table
-         * size */
+         * Limit it to 512M, which is:
+         *     16PB - for default "Hosted Sparse Extent" (VMDK4)
+         *            cluster size: 64KB, L2 table size: 512 entries
+         *     1PB  - for default "ESXi Host Sparse Extent" (VMDK3/vmfsSparse)
+         *            cluster size: 512B, L2 table size: 4096 entries
+         */
         error_setg(errp, "L1 size too big");
         return -EFBIG;
     }
-- 
2.21.0

From: Sam Eiderman <shmuel.eiderman@oracle.com>

512M of L1 entries is a very loose bound, only 32M are required to store
the maximal supported VMDK file size of 2TB.

Fixed qemu-iotest 59# - now failure occures before on impossible L1
table size.

Reviewed-by: Karl Heubaum <karl.heubaum@oracle.com>
Reviewed-by: Eyal Moscovici <eyal.moscovici@oracle.com>
Reviewed-by: Liran Alon <liran.alon@oracle.com>
Reviewed-by: Arbel Moshe <arbel.moshe@oracle.com>
Signed-off-by: Sam Eiderman <shmuel.eiderman@oracle.com>
Message-id: 20190620091057.47441-3-shmuel.eiderman@oracle.com
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
---
 block/vmdk.c               | 13 +++++++------
 tests/qemu-iotests/059.out |  2 +-
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/block/vmdk.c b/block/vmdk.c
index XXXXXXX..XXXXXXX 100644
--- a/block/vmdk.c
+++ b/block/vmdk.c
@@ -XXX,XX +XXX,XX @@ static int vmdk_add_extent(BlockDriverState *bs,
         error_setg(errp, "Invalid granularity, image may be corrupt");
         return -EFBIG;
     }
-    if (l1_size > 512 * 1024 * 1024) {
+    if (l1_size > 32 * 1024 * 1024) {
         /*
          * Although with big capacity and small l1_entry_sectors, we can get a
          * big l1_size, we don't want unbounded value to allocate the table.
-         * Limit it to 512M, which is:
-         *     16PB - for default "Hosted Sparse Extent" (VMDK4)
-         *            cluster size: 64KB, L2 table size: 512 entries
-         *     1PB  - for default "ESXi Host Sparse Extent" (VMDK3/vmfsSparse)
-         *            cluster size: 512B, L2 table size: 4096 entries
+         * Limit it to 32M, which is enough to store:
+         *     8TB  - for both VMDK3 & VMDK4 with
+         *            minimal cluster size: 512B
+         *            minimal L2 table size: 512 entries
+         *            8 TB is still more than the maximal value supported for
+         *            VMDK3 & VMDK4 which is 2TB.
          */
         error_setg(errp, "L1 size too big");
         return -EFBIG;
diff --git a/tests/qemu-iotests/059.out b/tests/qemu-iotests/059.out
index XXXXXXX..XXXXXXX 100644
--- a/tests/qemu-iotests/059.out
+++ b/tests/qemu-iotests/059.out
@@ -XXX,XX +XXX,XX @@ Offset          Length          Mapped to       File
 0x140000000     0x10000         0x50000         TEST_DIR/t-s003.vmdk
 
 === Testing afl image with a very large capacity ===
-qemu-img: Can't get image size 'TEST_DIR/afl9.IMGFMT': File too large
+qemu-img: Could not open 'TEST_DIR/afl9.IMGFMT': L1 size too big
 *** done
-- 
2.21.0

From: Sam Eiderman <shmuel.eiderman@oracle.com>

Until ESXi 6.5 VMware used the vmfsSparse format for snapshots (VMDK3 in
QEMU).

This format was lacking in the following:

* Grain directory (L1) and grain table (L2) entries were 32-bit,
      allowing access to only 2TB (slightly less) of data.
    * The grain size (default) was 512 bytes - leading to data
      fragmentation and many grain tables.
    * For space reclamation purposes, it was necessary to find all the
      grains which are not pointed to by any grain table - so a reverse
      mapping of "offset of grain in vmdk" to "grain table" must be
      constructed - which takes large amounts of CPU/RAM.

The format specification can be found in VMware's documentation:
https://www.vmware.com/support/developer/vddk/vmdk_50_technote.pdf

In ESXi 6.5, to support snapshot files larger than 2TB, a new format was
introduced: SESparse (Space Efficient).

This format fixes the above issues:

* All entries are now 64-bit.
    * The grain size (default) is 4KB.
    * Grain directory and grain tables are now located at the beginning
      of the file.
      + seSparse format reserves space for all grain tables.
      + Grain tables can be addressed using an index.
      + Grains are located in the end of the file and can also be
        addressed with an index.
      - seSparse vmdks of large disks (64TB) have huge preallocated
        headers - mainly due to L2 tables, even for empty snapshots.
    * The header contains a reverse mapping ("backmap") of "offset of
      grain in vmdk" to "grain table" and a bitmap ("free bitmap") which
      specifies for each grain - whether it is allocated or not.
      Using these data structures we can implement space reclamation
      efficiently.
    * Due to the fact that the header now maintains two mappings:
        * The regular one (grain directory & grain tables)
        * A reverse one (backmap and free bitmap)
      These data structures can lose consistency upon crash and result
      in a corrupted VMDK.
      Therefore, a journal is also added to the VMDK and is replayed
      when the VMware reopens the file after a crash.

Since ESXi 6.7 - SESparse is the only snapshot format available.

Unfortunately, VMware does not provide documentation regarding the new
seSparse format.

This commit is based on black-box research of the seSparse format.
Various in-guest block operations and their effect on the snapshot file
were tested.

The only VMware provided source of information (regarding the underlying
implementation) was a log file on the ESXi:

/var/log/hostd.log

Whenever an seSparse snapshot is created - the log is being populated
with seSparse records.

Relevant log records are of the form:

[...] Const Header:
[...]  constMagic     = 0xcafebabe
[...]  version        = 2.1
[...]  capacity       = 204800
[...]  grainSize      = 8
[...]  grainTableSize = 64
[...]  flags          = 0
[...] Extents:
[...]  Header         : <1 : 1>
[...]  JournalHdr     : <2 : 2>
[...]  Journal        : <2048 : 2048>
[...]  GrainDirectory : <4096 : 2048>
[...]  GrainTables    : <6144 : 2048>
[...]  FreeBitmap     : <8192 : 2048>
[...]  BackMap        : <10240 : 2048>
[...]  Grain          : <12288 : 204800>
[...] Volatile Header:
[...] volatileMagic     = 0xcafecafe
[...] FreeGTNumber      = 0
[...] nextTxnSeqNumber  = 0
[...] replayJournal     = 0

The sizes that are seen in the log file are in sectors.
Extents are of the following format: <offset : size>

This commit is a strict implementation which enforces:
    * magics
    * version number 2.1
    * grain size of 8 sectors  (4KB)
    * grain table size of 64 sectors
    * zero flags
    * extent locations

Additionally, this commit proivdes only a subset of the functionality
offered by seSparse's format:
    * Read-only
    * No journal replay
    * No space reclamation
    * No unmap support

Hence, journal header, journal, free bitmap and backmap extents are
unused, only the "classic" (L1 -> L2 -> data) grain access is
implemented.

However there are several differences in the grain access itself.
Grain directory (L1):
    * Grain directory entries are indexes (not offsets) to grain
      tables.
    * Valid grain directory entries have their highest nibble set to
      0x1.
    * Since grain tables are always located in the beginning of the
      file - the index can fit into 32 bits - so we can use its low
      part if it's valid.
Grain table (L2):
    * Grain table entries are indexes (not offsets) to grains.
    * If the highest nibble of the entry is:
        0x0:
            The grain in not allocated.
            The rest of the bytes are 0.
        0x1:
            The grain is unmapped - guest sees a zero grain.
            The rest of the bits point to the previously mapped grain,
            see 0x3 case.
        0x2:
            The grain is zero.
        0x3:
            The grain is allocated - to get the index calculate:
            ((entry & 0x0fff000000000000) >> 48) |
            ((entry & 0x0000ffffffffffff) << 12)
    * The difference between 0x1 and 0x2 is that 0x1 is an unallocated
      grain which results from the guest using sg_unmap to unmap the
      grain - but the grain itself still exists in the grain extent - a
      space reclamation procedure should delete it.
      Unmapping a zero grain has no effect (0x2 will not change to 0x1)
      but unmapping an unallocated grain will (0x0 to 0x1) - naturally.

In order to implement seSparse some fields had to be changed to support
both 32-bit and 64-bit entry sizes.

Reviewed-by: Karl Heubaum <karl.heubaum@oracle.com>
Reviewed-by: Eyal Moscovici <eyal.moscovici@oracle.com>
Reviewed-by: Arbel Moshe <arbel.moshe@oracle.com>
Signed-off-by: Sam Eiderman <shmuel.eiderman@oracle.com>
Message-id: 20190620091057.47441-4-shmuel.eiderman@oracle.com
Signed-off-by: Max Reitz <mreitz@redhat.com>
---
 block/vmdk.c | 358 ++++++++++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 342 insertions(+), 16 deletions(-)

diff --git a/block/vmdk.c b/block/vmdk.c
index XXXXXXX..XXXXXXX 100644
--- a/block/vmdk.c
+++ b/block/vmdk.c
@@ -XXX,XX +XXX,XX @@ typedef struct {
     uint16_t compressAlgorithm;
 } QEMU_PACKED VMDK4Header;
 
+typedef struct VMDKSESparseConstHeader {
+    uint64_t magic;
+    uint64_t version;
+    uint64_t capacity;
+    uint64_t grain_size;
+    uint64_t grain_table_size;
+    uint64_t flags;
+    uint64_t reserved1;
+    uint64_t reserved2;
+    uint64_t reserved3;
+    uint64_t reserved4;
+    uint64_t volatile_header_offset;
+    uint64_t volatile_header_size;
+    uint64_t journal_header_offset;
+    uint64_t journal_header_size;
+    uint64_t journal_offset;
+    uint64_t journal_size;
+    uint64_t grain_dir_offset;
+    uint64_t grain_dir_size;
+    uint64_t grain_tables_offset;
+    uint64_t grain_tables_size;
+    uint64_t free_bitmap_offset;
+    uint64_t free_bitmap_size;
+    uint64_t backmap_offset;
+    uint64_t backmap_size;
+    uint64_t grains_offset;
+    uint64_t grains_size;
+    uint8_t pad[304];
+} QEMU_PACKED VMDKSESparseConstHeader;
+
+typedef struct VMDKSESparseVolatileHeader {
+    uint64_t magic;
+    uint64_t free_gt_number;
+    uint64_t next_txn_seq_number;
+    uint64_t replay_journal;
+    uint8_t pad[480];
+} QEMU_PACKED VMDKSESparseVolatileHeader;
+
 #define L2_CACHE_SIZE 16
 
 typedef struct VmdkExtent {
@@ -XXX,XX +XXX,XX @@ typedef struct VmdkExtent {
     bool compressed;
     bool has_marker;
     bool has_zero_grain;
+    bool sesparse;
+    uint64_t sesparse_l2_tables_offset;
+    uint64_t sesparse_clusters_offset;
+    int32_t entry_size;
     int version;
     int64_t sectors;
     int64_t end_sector;
     int64_t flat_start_offset;
     int64_t l1_table_offset;
     int64_t l1_backup_table_offset;
-    uint32_t *l1_table;
+    void *l1_table;
     uint32_t *l1_backup_table;
     unsigned int l1_size;
     uint32_t l1_entry_sectors;
 
     unsigned int l2_size;
-    uint32_t *l2_cache;
+    void *l2_cache;
     uint32_t l2_cache_offsets[L2_CACHE_SIZE];
     uint32_t l2_cache_counts[L2_CACHE_SIZE];
 
@@ -XXX,XX +XXX,XX @@ static int vmdk_add_extent(BlockDriverState *bs,
          *            minimal L2 table size: 512 entries
          *            8 TB is still more than the maximal value supported for
          *            VMDK3 & VMDK4 which is 2TB.
+         *     64TB - for "ESXi seSparse Extent"
+         *            minimal cluster size: 512B (default is 4KB)
+         *            L2 table size: 4096 entries (const).
+         *            64TB is more than the maximal value supported for
+         *            seSparse VMDKs (which is slightly less than 64TB)
          */
         error_setg(errp, "L1 size too big");
         return -EFBIG;
@@ -XXX,XX +XXX,XX @@ static int vmdk_add_extent(BlockDriverState *bs,
     extent->l2_size = l2_size;
     extent->cluster_sectors = flat ? sectors : cluster_sectors;
     extent->next_cluster_sector = ROUND_UP(nb_sectors, cluster_sectors);
+    extent->entry_size = sizeof(uint32_t);
 
     if (s->num_extents > 1) {
         extent->end_sector = (*(extent - 1)).end_sector + extent->sectors;
@@ -XXX,XX +XXX,XX @@ static int vmdk_init_tables(BlockDriverState *bs, VmdkExtent *extent,
     int i;
 
     /* read the L1 table */
-    l1_size = extent->l1_size * sizeof(uint32_t);
+    l1_size = extent->l1_size * extent->entry_size;
     extent->l1_table = g_try_malloc(l1_size);
     if (l1_size && extent->l1_table == NULL) {
         return -ENOMEM;
@@ -XXX,XX +XXX,XX @@ static int vmdk_init_tables(BlockDriverState *bs, VmdkExtent *extent,
         goto fail_l1;
     }
     for (i = 0; i < extent->l1_size; i++) {
-        le32_to_cpus(&extent->l1_table[i]);
+        if (extent->entry_size == sizeof(uint64_t)) {
+            le64_to_cpus((uint64_t *)extent->l1_table + i);
+        } else {
+            assert(extent->entry_size == sizeof(uint32_t));
+            le32_to_cpus((uint32_t *)extent->l1_table + i);
+        }
     }
 
     if (extent->l1_backup_table_offset) {
+        assert(!extent->sesparse);
         extent->l1_backup_table = g_try_malloc(l1_size);
         if (l1_size && extent->l1_backup_table == NULL) {
             ret = -ENOMEM;
@@ -XXX,XX +XXX,XX @@ static int vmdk_init_tables(BlockDriverState *bs, VmdkExtent *extent,
     }
 
     extent->l2_cache =
-        g_new(uint32_t, extent->l2_size * L2_CACHE_SIZE);
+        g_malloc(extent->entry_size * extent->l2_size * L2_CACHE_SIZE);
     return 0;
  fail_l1b:
     g_free(extent->l1_backup_table);
@@ -XXX,XX +XXX,XX @@ static int vmdk_open_vmfs_sparse(BlockDriverState *bs,
     return ret;
 }
 
+#define SESPARSE_CONST_HEADER_MAGIC UINT64_C(0x00000000cafebabe)
+#define SESPARSE_VOLATILE_HEADER_MAGIC UINT64_C(0x00000000cafecafe)
+
+/* Strict checks - format not officially documented */
+static int check_se_sparse_const_header(VMDKSESparseConstHeader *header,
+                                        Error **errp)
+{
+    header->magic = le64_to_cpu(header->magic);
+    header->version = le64_to_cpu(header->version);
+    header->grain_size = le64_to_cpu(header->grain_size);
+    header->grain_table_size = le64_to_cpu(header->grain_table_size);
+    header->flags = le64_to_cpu(header->flags);
+    header->reserved1 = le64_to_cpu(header->reserved1);
+    header->reserved2 = le64_to_cpu(header->reserved2);
+    header->reserved3 = le64_to_cpu(header->reserved3);
+    header->reserved4 = le64_to_cpu(header->reserved4);
+
+    header->volatile_header_offset =
+        le64_to_cpu(header->volatile_header_offset);
+    header->volatile_header_size = le64_to_cpu(header->volatile_header_size);
+
+    header->journal_header_offset = le64_to_cpu(header->journal_header_offset);
+    header->journal_header_size = le64_to_cpu(header->journal_header_size);
+
+    header->journal_offset = le64_to_cpu(header->journal_offset);
+    header->journal_size = le64_to_cpu(header->journal_size);
+
+    header->grain_dir_offset = le64_to_cpu(header->grain_dir_offset);
+    header->grain_dir_size = le64_to_cpu(header->grain_dir_size);
+
+    header->grain_tables_offset = le64_to_cpu(header->grain_tables_offset);
+    header->grain_tables_size = le64_to_cpu(header->grain_tables_size);
+
+    header->free_bitmap_offset = le64_to_cpu(header->free_bitmap_offset);
+    header->free_bitmap_size = le64_to_cpu(header->free_bitmap_size);
+
+    header->backmap_offset = le64_to_cpu(header->backmap_offset);
+    header->backmap_size = le64_to_cpu(header->backmap_size);
+
+    header->grains_offset = le64_to_cpu(header->grains_offset);
+    header->grains_size = le64_to_cpu(header->grains_size);
+
+    if (header->magic != SESPARSE_CONST_HEADER_MAGIC) {
+        error_setg(errp, "Bad const header magic: 0x%016" PRIx64,
+                   header->magic);
+        return -EINVAL;
+    }
+
+    if (header->version != 0x0000000200000001) {
+        error_setg(errp, "Unsupported version: 0x%016" PRIx64,
+                   header->version);
+        return -ENOTSUP;
+    }
+
+    if (header->grain_size != 8) {
+        error_setg(errp, "Unsupported grain size: %" PRIu64,
+                   header->grain_size);
+        return -ENOTSUP;
+    }
+
+    if (header->grain_table_size != 64) {
+        error_setg(errp, "Unsupported grain table size: %" PRIu64,
+                   header->grain_table_size);
+        return -ENOTSUP;
+    }
+
+    if (header->flags != 0) {
+        error_setg(errp, "Unsupported flags: 0x%016" PRIx64,
+                   header->flags);
+        return -ENOTSUP;
+    }
+
+    if (header->reserved1 != 0 || header->reserved2 != 0 ||
+        header->reserved3 != 0 || header->reserved4 != 0) {
+        error_setg(errp, "Unsupported reserved bits:"
+                   " 0x%016" PRIx64 " 0x%016" PRIx64
+                   " 0x%016" PRIx64 " 0x%016" PRIx64,
+                   header->reserved1, header->reserved2,
+                   header->reserved3, header->reserved4);
+        return -ENOTSUP;
+    }
+
+    /* check that padding is 0 */
+    if (!buffer_is_zero(header->pad, sizeof(header->pad))) {
+        error_setg(errp, "Unsupported non-zero const header padding");
+        return -ENOTSUP;
+    }
+
+    return 0;
+}
+
+static int check_se_sparse_volatile_header(VMDKSESparseVolatileHeader *header,
+                                           Error **errp)
+{
+    header->magic = le64_to_cpu(header->magic);
+    header->free_gt_number = le64_to_cpu(header->free_gt_number);
+    header->next_txn_seq_number = le64_to_cpu(header->next_txn_seq_number);
+    header->replay_journal = le64_to_cpu(header->replay_journal);
+
+    if (header->magic != SESPARSE_VOLATILE_HEADER_MAGIC) {
+        error_setg(errp, "Bad volatile header magic: 0x%016" PRIx64,
+                   header->magic);
+        return -EINVAL;
+    }
+
+    if (header->replay_journal) {
+        error_setg(errp, "Image is dirty, Replaying journal not supported");
+        return -ENOTSUP;
+    }
+
+    /* check that padding is 0 */
+    if (!buffer_is_zero(header->pad, sizeof(header->pad))) {
+        error_setg(errp, "Unsupported non-zero volatile header padding");
+        return -ENOTSUP;
+    }
+
+    return 0;
+}
+
+static int vmdk_open_se_sparse(BlockDriverState *bs,
+                               BdrvChild *file,
+                               int flags, Error **errp)
+{
+    int ret;
+    VMDKSESparseConstHeader const_header;
+    VMDKSESparseVolatileHeader volatile_header;
+    VmdkExtent *extent;
+
+    ret = bdrv_apply_auto_read_only(bs,
+            "No write support for seSparse images available", errp);
+    if (ret < 0) {
+        return ret;
+    }
+
+    assert(sizeof(const_header) == SECTOR_SIZE);
+
+    ret = bdrv_pread(file, 0, &const_header, sizeof(const_header));
+    if (ret < 0) {
+        bdrv_refresh_filename(file->bs);
+        error_setg_errno(errp, -ret,
+                         "Could not read const header from file '%s'",
+                         file->bs->filename);
+        return ret;
+    }
+
+    /* check const header */
+    ret = check_se_sparse_const_header(&const_header, errp);
+    if (ret < 0) {
+        return ret;
+    }
+
+    assert(sizeof(volatile_header) == SECTOR_SIZE);
+
+    ret = bdrv_pread(file,
+                     const_header.volatile_header_offset * SECTOR_SIZE,
+                     &volatile_header, sizeof(volatile_header));
+    if (ret < 0) {
+        bdrv_refresh_filename(file->bs);
+        error_setg_errno(errp, -ret,
+                         "Could not read volatile header from file '%s'",
+                         file->bs->filename);
+        return ret;
+    }
+
+    /* check volatile header */
+    ret = check_se_sparse_volatile_header(&volatile_header, errp);
+    if (ret < 0) {
+        return ret;
+    }
+
+    ret = vmdk_add_extent(bs, file, false,
+                          const_header.capacity,
+                          const_header.grain_dir_offset * SECTOR_SIZE,
+                          0,
+                          const_header.grain_dir_size *
+                          SECTOR_SIZE / sizeof(uint64_t),
+                          const_header.grain_table_size *
+                          SECTOR_SIZE / sizeof(uint64_t),
+                          const_header.grain_size,
+                          &extent,
+                          errp);
+    if (ret < 0) {
+        return ret;
+    }
+
+    extent->sesparse = true;
+    extent->sesparse_l2_tables_offset = const_header.grain_tables_offset;
+    extent->sesparse_clusters_offset = const_header.grains_offset;
+    extent->entry_size = sizeof(uint64_t);
+
+    ret = vmdk_init_tables(bs, extent, errp);
+    if (ret) {
+        /* free extent allocated by vmdk_add_extent */
+        vmdk_free_last_extent(bs);
+    }
+
+    return ret;
+}
+
 static int vmdk_open_desc_file(BlockDriverState *bs, int flags, char *buf,
                                QDict *options, Error **errp);
 
@@ -XXX,XX +XXX,XX @@ static int vmdk_parse_extents(const char *desc, BlockDriverState *bs,
          * RW [size in sectors] SPARSE "file-name.vmdk"
          * RW [size in sectors] VMFS "file-name.vmdk"
          * RW [size in sectors] VMFSSPARSE "file-name.vmdk"
+         * RW [size in sectors] SESPARSE "file-name.vmdk"
          */
         flat_offset = -1;
         matches = sscanf(p, "%10s %" SCNd64 " %10s \"%511[^\n\r\"]\" %" SCNd64,
@@ -XXX,XX +XXX,XX @@ static int vmdk_parse_extents(const char *desc, BlockDriverState *bs,
 
         if (sectors <= 0 ||
             (strcmp(type, "FLAT") && strcmp(type, "SPARSE") &&
-             strcmp(type, "VMFS") && strcmp(type, "VMFSSPARSE")) ||
+             strcmp(type, "VMFS") && strcmp(type, "VMFSSPARSE") &&
+             strcmp(type, "SESPARSE")) ||
             (strcmp(access, "RW"))) {
             continue;
         }
@@ -XXX,XX +XXX,XX @@ static int vmdk_parse_extents(const char *desc, BlockDriverState *bs,
                 return ret;
             }
             extent = &s->extents[s->num_extents - 1];
+        } else if (!strcmp(type, "SESPARSE")) {
+            ret = vmdk_open_se_sparse(bs, extent_file, bs->open_flags, errp);
+            if (ret) {
+                bdrv_unref_child(bs, extent_file);
+                return ret;
+            }
+            extent = &s->extents[s->num_extents - 1];
         } else {
             error_setg(errp, "Unsupported extent type '%s'", type);
             bdrv_unref_child(bs, extent_file);
@@ -XXX,XX +XXX,XX @@ static int vmdk_open_desc_file(BlockDriverState *bs, int flags, char *buf,
     if (strcmp(ct, "monolithicFlat") &&
         strcmp(ct, "vmfs") &&
         strcmp(ct, "vmfsSparse") &&
+        strcmp(ct, "seSparse") &&
         strcmp(ct, "twoGbMaxExtentSparse") &&
         strcmp(ct, "twoGbMaxExtentFlat")) {
         error_setg(errp, "Unsupported image type '%s'", ct);
@@ -XXX,XX +XXX,XX @@ static int get_cluster_offset(BlockDriverState *bs,
 {
     unsigned int l1_index, l2_offset, l2_index;
     int min_index, i, j;
-    uint32_t min_count, *l2_table;
+    uint32_t min_count;
+    void *l2_table;
     bool zeroed = false;
     int64_t ret;
     int64_t cluster_sector;
+    unsigned int l2_size_bytes = extent->l2_size * extent->entry_size;
 
     if (m_data) {
         m_data->valid = 0;
@@ -XXX,XX +XXX,XX @@ static int get_cluster_offset(BlockDriverState *bs,
     if (l1_index >= extent->l1_size) {
         return VMDK_ERROR;
     }
-    l2_offset = extent->l1_table[l1_index];
+    if (extent->sesparse) {
+        uint64_t l2_offset_u64;
+
+        assert(extent->entry_size == sizeof(uint64_t));
+
+        l2_offset_u64 = ((uint64_t *)extent->l1_table)[l1_index];
+        if (l2_offset_u64 == 0) {
+            l2_offset = 0;
+        } else if ((l2_offset_u64 & 0xffffffff00000000) != 0x1000000000000000) {
+            /*
+             * Top most nibble is 0x1 if grain table is allocated.
+             * strict check - top most 4 bytes must be 0x10000000 since max
+             * supported size is 64TB for disk - so no more than 64TB / 16MB
+             * grain directories which is smaller than uint32,
+             * where 16MB is the only supported default grain table coverage.
+             */
+            return VMDK_ERROR;
+        } else {
+            l2_offset_u64 = l2_offset_u64 & 0x00000000ffffffff;
+            l2_offset_u64 = extent->sesparse_l2_tables_offset +
+                l2_offset_u64 * l2_size_bytes / SECTOR_SIZE;
+            if (l2_offset_u64 > 0x00000000ffffffff) {
+                return VMDK_ERROR;
+            }
+            l2_offset = (unsigned int)(l2_offset_u64);
+        }
+    } else {
+        assert(extent->entry_size == sizeof(uint32_t));
+        l2_offset = ((uint32_t *)extent->l1_table)[l1_index];
+    }
     if (!l2_offset) {
         return VMDK_UNALLOC;
     }
@@ -XXX,XX +XXX,XX @@ static int get_cluster_offset(BlockDriverState *bs,
                     extent->l2_cache_counts[j] >>= 1;
                 }
             }
-            l2_table = extent->l2_cache + (i * extent->l2_size);
+            l2_table = (char *)extent->l2_cache + (i * l2_size_bytes);
             goto found;
         }
     }
@@ -XXX,XX +XXX,XX @@ static int get_cluster_offset(BlockDriverState *bs,
             min_index = i;
         }
     }
-    l2_table = extent->l2_cache + (min_index * extent->l2_size);
+    l2_table = (char *)extent->l2_cache + (min_index * l2_size_bytes);
     BLKDBG_EVENT(extent->file, BLKDBG_L2_LOAD);
     if (bdrv_pread(extent->file,
                 (int64_t)l2_offset * 512,
                 l2_table,
-                extent->l2_size * sizeof(uint32_t)
-            ) != extent->l2_size * sizeof(uint32_t)) {
+                l2_size_bytes
+            ) != l2_size_bytes) {
         return VMDK_ERROR;
     }
 
@@ -XXX,XX +XXX,XX @@ static int get_cluster_offset(BlockDriverState *bs,
     extent->l2_cache_counts[min_index] = 1;
  found:
     l2_index = ((offset >> 9) / extent->cluster_sectors) % extent->l2_size;
-    cluster_sector = le32_to_cpu(l2_table[l2_index]);
 
-    if (extent->has_zero_grain && cluster_sector == VMDK_GTE_ZEROED) {
-        zeroed = true;
+    if (extent->sesparse) {
+        cluster_sector = le64_to_cpu(((uint64_t *)l2_table)[l2_index]);
+        switch (cluster_sector & 0xf000000000000000) {
+        case 0x0000000000000000:
+            /* unallocated grain */
+            if (cluster_sector != 0) {
+                return VMDK_ERROR;
+            }
+            break;
+        case 0x1000000000000000:
+            /* scsi-unmapped grain - fallthrough */
+        case 0x2000000000000000:
+            /* zero grain */
+            zeroed = true;
+            break;
+        case 0x3000000000000000:
+            /* allocated grain */
+            cluster_sector = (((cluster_sector & 0x0fff000000000000) >> 48) |
+                              ((cluster_sector & 0x0000ffffffffffff) << 12));
+            cluster_sector = extent->sesparse_clusters_offset +
+                cluster_sector * extent->cluster_sectors;
+            break;
+        default:
+            return VMDK_ERROR;
+        }
+    } else {
+        cluster_sector = le32_to_cpu(((uint32_t *)l2_table)[l2_index]);
+
+        if (extent->has_zero_grain && cluster_sector == VMDK_GTE_ZEROED) {
+            zeroed = true;
+        }
     }
 
     if (!cluster_sector || zeroed) {
         if (!allocate) {
             return zeroed ? VMDK_ZEROED : VMDK_UNALLOC;
         }
+        assert(!extent->sesparse);
 
         if (extent->next_cluster_sector >= VMDK_EXTENT_MAX_SECTORS) {
             return VMDK_ERROR;
@@ -XXX,XX +XXX,XX @@ static int get_cluster_offset(BlockDriverState *bs,
             m_data->l1_index = l1_index;
             m_data->l2_index = l2_index;
             m_data->l2_offset = l2_offset;
-            m_data->l2_cache_entry = &l2_table[l2_index];
+            m_data->l2_cache_entry = ((uint32_t *)l2_table) + l2_index;
         }
     }
     *cluster_offset = cluster_sector << BDRV_SECTOR_BITS;
@@ -XXX,XX +XXX,XX @@ static int vmdk_pwritev(BlockDriverState *bs, uint64_t offset,
         if (!extent) {
             return -EIO;
         }
+        if (extent->sesparse) {
+            return -ENOTSUP;
+        }
         offset_in_cluster = vmdk_find_offset_in_cluster(extent, offset);
         n_bytes = MIN(bytes, extent->cluster_sectors * BDRV_SECTOR_SIZE
                              - offset_in_cluster);
-- 
2.21.0

From: Pino Toscano <ptoscano@redhat.com>

Rewrite the implementation of the ssh block driver to use libssh instead
of libssh2.  The libssh library has various advantages over libssh2:
- easier API for authentication (for example for using ssh-agent)
- easier API for known_hosts handling
- supports newer types of keys in known_hosts

Use APIs/features available in libssh 0.8 conditionally, to support
older versions (which are not recommended though).

Adjust the iotest 207 according to the different error message, and to
find the default key type for localhost (to properly compare the
fingerprint with).
Contributed-by: Max Reitz <mreitz@redhat.com>

Adjust the various Docker/Travis scripts to use libssh when available
instead of libssh2. The mingw/mxe testing is dropped for now, as there
are no packages for it.

Signed-off-by: Pino Toscano <ptoscano@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Acked-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20190620200840.17655-1-ptoscano@redhat.com
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 5873173.t2JhDm7DL7@lindworm.usersys.redhat.com
Signed-off-by: Max Reitz <mreitz@redhat.com>
---
 configure                                     |  65 +-
 block/Makefile.objs                           |   6 +-
 block/ssh.c                                   | 652 ++++++++++--------
 .travis.yml                                   |   4 +-
 block/trace-events                            |  14 +-
 docs/qemu-block-drivers.texi                  |   2 +-
 .../dockerfiles/debian-win32-cross.docker     |   1 -
 .../dockerfiles/debian-win64-cross.docker     |   1 -
 tests/docker/dockerfiles/fedora.docker        |   4 +-
 tests/docker/dockerfiles/ubuntu.docker        |   2 +-
 tests/docker/dockerfiles/ubuntu1804.docker    |   2 +-
 tests/qemu-iotests/207                        |  54 +-
 tests/qemu-iotests/207.out                    |   2 +-
 13 files changed, 449 insertions(+), 360 deletions(-)

diff --git a/configure b/configure
index XXXXXXX..XXXXXXX 100755
--- a/configure
+++ b/configure
@@ -XXX,XX +XXX,XX @@ auth_pam=""
 vte=""
 virglrenderer=""
 tpm=""
-libssh2=""
+libssh=""
 live_block_migration="yes"
 numa=""
 tcmalloc="no"
@@ -XXX,XX +XXX,XX @@ for opt do
   ;;
   --enable-tpm) tpm="yes"
   ;;
-  --disable-libssh2) libssh2="no"
+  --disable-libssh) libssh="no"
   ;;
-  --enable-libssh2) libssh2="yes"
+  --enable-libssh) libssh="yes"
   ;;
   --disable-live-block-migration) live_block_migration="no"
   ;;
@@ -XXX,XX +XXX,XX @@ disabled with --disable-FEATURE, default is enabled if available:
   coroutine-pool  coroutine freelist (better performance)
   glusterfs       GlusterFS backend
   tpm             TPM support
-  libssh2         ssh block device support
+  libssh          ssh block device support
   numa            libnuma support
   libxml2         for Parallels image format
   tcmalloc        tcmalloc support
@@ -XXX,XX +XXX,XX @@ EOF
 fi
 
 ##########################################
-# libssh2 probe
-min_libssh2_version=1.2.8
-if test "$libssh2" != "no" ; then
-  if $pkg_config --atleast-version=$min_libssh2_version libssh2; then
-    libssh2_cflags=$($pkg_config libssh2 --cflags)
-    libssh2_libs=$($pkg_config libssh2 --libs)
-    libssh2=yes
+# libssh probe
+if test "$libssh" != "no" ; then
+  if $pkg_config --exists libssh; then
+    libssh_cflags=$($pkg_config libssh --cflags)
+    libssh_libs=$($pkg_config libssh --libs)
+    libssh=yes
   else
-    if test "$libssh2" = "yes" ; then
-      error_exit "libssh2 >= $min_libssh2_version required for --enable-libssh2"
+    if test "$libssh" = "yes" ; then
+      error_exit "libssh required for --enable-libssh"
     fi
-    libssh2=no
+    libssh=no
   fi
 fi
 
 ##########################################
-# libssh2_sftp_fsync probe
+# Check for libssh 0.8
+# This is done like this instead of using the LIBSSH_VERSION_* and
+# SSH_VERSION_* macros because some distributions in the past shipped
+# snapshots of the future 0.8 from Git, and those snapshots did not
+# have updated version numbers (still referring to 0.7.0).
 
-if test "$libssh2" = "yes"; then
+if test "$libssh" = "yes"; then
   cat > $TMPC <<EOF
-#include <stdio.h>
-#include <libssh2.h>
-#include <libssh2_sftp.h>
-int main(void) {
-    LIBSSH2_SESSION *session;
-    LIBSSH2_SFTP *sftp;
-    LIBSSH2_SFTP_HANDLE *sftp_handle;
-    session = libssh2_session_init ();
-    sftp = libssh2_sftp_init (session);
-    sftp_handle = libssh2_sftp_open (sftp, "/", 0, 0);
-    libssh2_sftp_fsync (sftp_handle);
-    return 0;
-}
+#include <libssh/libssh.h>
+int main(void) { return ssh_get_server_publickey(NULL, NULL); }
 EOF
-  # libssh2_cflags/libssh2_libs defined in previous test.
-  if compile_prog "$libssh2_cflags" "$libssh2_libs" ; then
-    QEMU_CFLAGS="-DHAS_LIBSSH2_SFTP_FSYNC $QEMU_CFLAGS"
+  if compile_prog "$libssh_cflags" "$libssh_libs"; then
+    libssh_cflags="-DHAVE_LIBSSH_0_8 $libssh_cflags"
   fi
 fi
 
@@ -XXX,XX +XXX,XX @@ echo "GlusterFS support $glusterfs"
 echo "gcov              $gcov_tool"
 echo "gcov enabled      $gcov"
 echo "TPM support       $tpm"
-echo "libssh2 support   $libssh2"
+echo "libssh support    $libssh"
 echo "QOM debugging     $qom_cast_debug"
 echo "Live block migration $live_block_migration"
 echo "lzo support       $lzo"
@@ -XXX,XX +XXX,XX @@ if test "$glusterfs_iocb_has_stat" = "yes" ; then
   echo "CONFIG_GLUSTERFS_IOCB_HAS_STAT=y" >> $config_host_mak
 fi
 
-if test "$libssh2" = "yes" ; then
-  echo "CONFIG_LIBSSH2=m" >> $config_host_mak
-  echo "LIBSSH2_CFLAGS=$libssh2_cflags" >> $config_host_mak
-  echo "LIBSSH2_LIBS=$libssh2_libs" >> $config_host_mak
+if test "$libssh" = "yes" ; then
+  echo "CONFIG_LIBSSH=m" >> $config_host_mak
+  echo "LIBSSH_CFLAGS=$libssh_cflags" >> $config_host_mak
+  echo "LIBSSH_LIBS=$libssh_libs" >> $config_host_mak
 fi
 
 if test "$live_block_migration" = "yes" ; then
diff --git a/block/Makefile.objs b/block/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/block/Makefile.objs
+++ b/block/Makefile.objs
@@ -XXX,XX +XXX,XX @@ block-obj-$(CONFIG_CURL) += curl.o
 block-obj-$(CONFIG_RBD) += rbd.o
 block-obj-$(CONFIG_GLUSTERFS) += gluster.o
 block-obj-$(CONFIG_VXHS) += vxhs.o
-block-obj-$(CONFIG_LIBSSH2) += ssh.o
+block-obj-$(CONFIG_LIBSSH) += ssh.o
 block-obj-y += accounting.o dirty-bitmap.o
 block-obj-y += write-threshold.o
 block-obj-y += backup.o
@@ -XXX,XX +XXX,XX @@ rbd.o-libs         := $(RBD_LIBS)
 gluster.o-cflags   := $(GLUSTERFS_CFLAGS)
 gluster.o-libs     := $(GLUSTERFS_LIBS)
 vxhs.o-libs        := $(VXHS_LIBS)
-ssh.o-cflags       := $(LIBSSH2_CFLAGS)
-ssh.o-libs         := $(LIBSSH2_LIBS)
+ssh.o-cflags       := $(LIBSSH_CFLAGS)
+ssh.o-libs         := $(LIBSSH_LIBS)
 block-obj-dmg-bz2-$(CONFIG_BZIP2) += dmg-bz2.o
 block-obj-$(if $(CONFIG_DMG),m,n) += $(block-obj-dmg-bz2-y)
 dmg-bz2.o-libs     := $(BZIP2_LIBS)
diff --git a/block/ssh.c b/block/ssh.c
index XXXXXXX..XXXXXXX 100644
--- a/block/ssh.c
+++ b/block/ssh.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 
-#include <libssh2.h>
-#include <libssh2_sftp.h>
+#include <libssh/libssh.h>
+#include <libssh/sftp.h>
 
 #include "block/block_int.h"
 #include "block/qdict.h"
@@ -XXX,XX +XXX,XX @@
 #include "trace.h"
 
 /*
- * TRACE_LIBSSH2=<bitmask> enables tracing in libssh2 itself.  Note
- * that this requires that libssh2 was specially compiled with the
- * `./configure --enable-debug' option, so most likely you will have
- * to compile it yourself.  The meaning of <bitmask> is described
- * here: http://www.libssh2.org/libssh2_trace.html
+ * TRACE_LIBSSH=<level> enables tracing in libssh itself.
+ * The meaning of <level> is described here:
+ * http://api.libssh.org/master/group__libssh__log.html
  */
-#define TRACE_LIBSSH2 0 /* or try: LIBSSH2_TRACE_SFTP */
+#define TRACE_LIBSSH  0 /* see: SSH_LOG_* */
 
 typedef struct BDRVSSHState {
     /* Coroutine. */
@@ -XXX,XX +XXX,XX @@ typedef struct BDRVSSHState {
 
     /* SSH connection. */
     int sock;                         /* socket */
-    LIBSSH2_SESSION *session;         /* ssh session */
-    LIBSSH2_SFTP *sftp;               /* sftp session */
-    LIBSSH2_SFTP_HANDLE *sftp_handle; /* sftp remote file handle */
+    ssh_session session;              /* ssh session */
+    sftp_session sftp;                /* sftp session */
+    sftp_file sftp_handle;            /* sftp remote file handle */
 
-    /* See ssh_seek() function below. */
-    int64_t offset;
-    bool offset_op_read;
-
-    /* File attributes at open.  We try to keep the .filesize field
+    /*
+     * File attributes at open.  We try to keep the .size field
      * updated if it changes (eg by writing at the end of the file).
      */
-    LIBSSH2_SFTP_ATTRIBUTES attrs;
+    sftp_attributes attrs;
 
     InetSocketAddress *inet;
 
@@ -XXX,XX +XXX,XX @@ static void ssh_state_init(BDRVSSHState *s)
 {
     memset(s, 0, sizeof *s);
     s->sock = -1;
-    s->offset = -1;
     qemu_co_mutex_init(&s->lock);
 }
 
@@ -XXX,XX +XXX,XX @@ static void ssh_state_free(BDRVSSHState *s)
 {
     g_free(s->user);
 
+    if (s->attrs) {
+        sftp_attributes_free(s->attrs);
+    }
     if (s->sftp_handle) {
-        libssh2_sftp_close(s->sftp_handle);
+        sftp_close(s->sftp_handle);
     }
     if (s->sftp) {
-        libssh2_sftp_shutdown(s->sftp);
+        sftp_free(s->sftp);
     }
     if (s->session) {
-        libssh2_session_disconnect(s->session,
-                                   "from qemu ssh client: "
-                                   "user closed the connection");
-        libssh2_session_free(s->session);
-    }
-    if (s->sock >= 0) {
-        close(s->sock);
+        ssh_disconnect(s->session);
+        ssh_free(s->session); /* This frees s->sock */
     }
 }
 
@@ -XXX,XX +XXX,XX @@ session_error_setg(Error **errp, BDRVSSHState *s, const char *fs, ...)
     va_end(args);
 
     if (s->session) {
-        char *ssh_err;
+        const char *ssh_err;
         int ssh_err_code;
 
-        /* This is not an errno.  See <libssh2.h>. */
-        ssh_err_code = libssh2_session_last_error(s->session,
-                                                  &ssh_err, NULL, 0);
-        error_setg(errp, "%s: %s (libssh2 error code: %d)",
+        /* This is not an errno.  See <libssh/libssh.h>. */
+        ssh_err = ssh_get_error(s->session);
+        ssh_err_code = ssh_get_error_code(s->session);
+        error_setg(errp, "%s: %s (libssh error code: %d)",
                    msg, ssh_err, ssh_err_code);
     } else {
         error_setg(errp, "%s", msg);
@@ -XXX,XX +XXX,XX @@ sftp_error_setg(Error **errp, BDRVSSHState *s, const char *fs, ...)
     va_end(args);
 
     if (s->sftp) {
-        char *ssh_err;
+        const char *ssh_err;
         int ssh_err_code;
-        unsigned long sftp_err_code;
+        int sftp_err_code;
 
-        /* This is not an errno.  See <libssh2.h>. */
-        ssh_err_code = libssh2_session_last_error(s->session,
-                                                  &ssh_err, NULL, 0);
-        /* See <libssh2_sftp.h>. */
-        sftp_err_code = libssh2_sftp_last_error((s)->sftp);
+        /* This is not an errno.  See <libssh/libssh.h>. */
+        ssh_err = ssh_get_error(s->session);
+        ssh_err_code = ssh_get_error_code(s->session);
+        /* See <libssh/sftp.h>. */
+        sftp_err_code = sftp_get_error(s->sftp);
 
         error_setg(errp,
-                   "%s: %s (libssh2 error code: %d, sftp error code: %lu)",
+                   "%s: %s (libssh error code: %d, sftp error code: %d)",
                    msg, ssh_err, ssh_err_code, sftp_err_code);
     } else {
         error_setg(errp, "%s", msg);
@@ -XXX,XX +XXX,XX @@ sftp_error_setg(Error **errp, BDRVSSHState *s, const char *fs, ...)
 
 static void sftp_error_trace(BDRVSSHState *s, const char *op)
 {
-    char *ssh_err;
+    const char *ssh_err;
     int ssh_err_code;
-    unsigned long sftp_err_code;
+    int sftp_err_code;
 
-    /* This is not an errno.  See <libssh2.h>. */
-    ssh_err_code = libssh2_session_last_error(s->session,
-                                              &ssh_err, NULL, 0);
-    /* See <libssh2_sftp.h>. */
-    sftp_err_code = libssh2_sftp_last_error((s)->sftp);
+    /* This is not an errno.  See <libssh/libssh.h>. */
+    ssh_err = ssh_get_error(s->session);
+    ssh_err_code = ssh_get_error_code(s->session);
+    /* See <libssh/sftp.h>. */
+    sftp_err_code = sftp_get_error(s->sftp);
 
     trace_sftp_error(op, ssh_err, ssh_err_code, sftp_err_code);
 }
@@ -XXX,XX +XXX,XX @@ static void ssh_parse_filename(const char *filename, QDict *options,
     parse_uri(filename, options, errp);
 }
 
-static int check_host_key_knownhosts(BDRVSSHState *s,
-                                     const char *host, int port, Error **errp)
+static int check_host_key_knownhosts(BDRVSSHState *s, Error **errp)
 {
-    const char *home;
-    char *knh_file = NULL;
-    LIBSSH2_KNOWNHOSTS *knh = NULL;
-    struct libssh2_knownhost *found;
-    int ret, r;
-    const char *hostkey;
-    size_t len;
-    int type;
-
-    hostkey = libssh2_session_hostkey(s->session, &len, &type);
-    if (!hostkey) {
+    int ret;
+#ifdef HAVE_LIBSSH_0_8
+    enum ssh_known_hosts_e state;
+    int r;
+    ssh_key pubkey;
+    enum ssh_keytypes_e pubkey_type;
+    unsigned char *server_hash = NULL;
+    size_t server_hash_len;
+    char *fingerprint = NULL;
+
+    state = ssh_session_is_known_server(s->session);
+    trace_ssh_server_status(state);
+
+    switch (state) {
+    case SSH_KNOWN_HOSTS_OK:
+        /* OK */
+        trace_ssh_check_host_key_knownhosts();
+        break;
+    case SSH_KNOWN_HOSTS_CHANGED:
         ret = -EINVAL;
-        session_error_setg(errp, s, "failed to read remote host key");
+        r = ssh_get_server_publickey(s->session, &pubkey);
+        if (r == 0) {
+            r = ssh_get_publickey_hash(pubkey, SSH_PUBLICKEY_HASH_SHA256,
+                                       &server_hash, &server_hash_len);
+            pubkey_type = ssh_key_type(pubkey);
+            ssh_key_free(pubkey);
+        }
+        if (r == 0) {
+            fingerprint = ssh_get_fingerprint_hash(SSH_PUBLICKEY_HASH_SHA256,
+                                                   server_hash,
+                                                   server_hash_len);
+            ssh_clean_pubkey_hash(&server_hash);
+        }
+        if (fingerprint) {
+            error_setg(errp,
+                       "host key (%s key with fingerprint %s) does not match "
+                       "the one in known_hosts; this may be a possible attack",
+                       ssh_key_type_to_char(pubkey_type), fingerprint);
+            ssh_string_free_char(fingerprint);
+        } else  {
+            error_setg(errp,
+                       "host key does not match the one in known_hosts; this "
+                       "may be a possible attack");
+        }
         goto out;
-    }
-
-    knh = libssh2_knownhost_init(s->session);
-    if (!knh) {
+    case SSH_KNOWN_HOSTS_OTHER:
         ret = -EINVAL;
-        session_error_setg(errp, s,
-                           "failed to initialize known hosts support");
+        error_setg(errp,
+                   "host key for this server not found, another type exists");
+        goto out;
+    case SSH_KNOWN_HOSTS_UNKNOWN:
+        ret = -EINVAL;
+        error_setg(errp, "no host key was found in known_hosts");
+        goto out;
+    case SSH_KNOWN_HOSTS_NOT_FOUND:
+        ret = -ENOENT;
+        error_setg(errp, "known_hosts file not found");
+        goto out;
+    case SSH_KNOWN_HOSTS_ERROR:
+        ret = -EINVAL;
+        error_setg(errp, "error while checking the host");
+        goto out;
+    default:
+        ret = -EINVAL;
+        error_setg(errp, "error while checking for known server (%d)", state);
         goto out;
     }
+#else /* !HAVE_LIBSSH_0_8 */
+    int state;
 
-    home = getenv("HOME");
-    if (home) {
-        knh_file = g_strdup_printf("%s/.ssh/known_hosts", home);
-    } else {
-        knh_file = g_strdup_printf("/root/.ssh/known_hosts");
-    }
-
-    /* Read all known hosts from OpenSSH-style known_hosts file. */
-    libssh2_knownhost_readfile(knh, knh_file, LIBSSH2_KNOWNHOST_FILE_OPENSSH);
+    state = ssh_is_server_known(s->session);
+    trace_ssh_server_status(state);
 
-    r = libssh2_knownhost_checkp(knh, host, port, hostkey, len,
-                                 LIBSSH2_KNOWNHOST_TYPE_PLAIN|
-                                 LIBSSH2_KNOWNHOST_KEYENC_RAW,
-                                 &found);
-    switch (r) {
-    case LIBSSH2_KNOWNHOST_CHECK_MATCH:
+    switch (state) {
+    case SSH_SERVER_KNOWN_OK:
         /* OK */
-        trace_ssh_check_host_key_knownhosts(found->key);
+        trace_ssh_check_host_key_knownhosts();
         break;
-    case LIBSSH2_KNOWNHOST_CHECK_MISMATCH:
+    case SSH_SERVER_KNOWN_CHANGED:
         ret = -EINVAL;
-        session_error_setg(errp, s,
-                      "host key does not match the one in known_hosts"
-                      " (found key %s)", found->key);
+        error_setg(errp,
+                   "host key does not match the one in known_hosts; this "
+                   "may be a possible attack");
         goto out;
-    case LIBSSH2_KNOWNHOST_CHECK_NOTFOUND:
+    case SSH_SERVER_FOUND_OTHER:
         ret = -EINVAL;
-        session_error_setg(errp, s, "no host key was found in known_hosts");
+        error_setg(errp,
+                   "host key for this server not found, another type exists");
+        goto out;
+    case SSH_SERVER_FILE_NOT_FOUND:
+        ret = -ENOENT;
+        error_setg(errp, "known_hosts file not found");
         goto out;
-    case LIBSSH2_KNOWNHOST_CHECK_FAILURE:
+    case SSH_SERVER_NOT_KNOWN:
         ret = -EINVAL;
-        session_error_setg(errp, s,
-                      "failure matching the host key with known_hosts");
+        error_setg(errp, "no host key was found in known_hosts");
+        goto out;
+    case SSH_SERVER_ERROR:
+        ret = -EINVAL;
+        error_setg(errp, "server error");
         goto out;
     default:
         ret = -EINVAL;
-        session_error_setg(errp, s, "unknown error matching the host key"
-                      " with known_hosts (%d)", r);
+        error_setg(errp, "error while checking for known server (%d)", state);
         goto out;
     }
+#endif /* !HAVE_LIBSSH_0_8 */
 
     /* known_hosts checking successful. */
     ret = 0;
 
  out:
-    if (knh != NULL) {
-        libssh2_knownhost_free(knh);
-    }
-    g_free(knh_file);
     return ret;
 }
 
@@ -XXX,XX +XXX,XX @@ static int compare_fingerprint(const unsigned char *fingerprint, size_t len,
 
 static int
 check_host_key_hash(BDRVSSHState *s, const char *hash,
-                    int hash_type, size_t fingerprint_len, Error **errp)
+                    enum ssh_publickey_hash_type type, Error **errp)
 {
-    const char *fingerprint;
-
-    fingerprint = libssh2_hostkey_hash(s->session, hash_type);
-    if (!fingerprint) {
+    int r;
+    ssh_key pubkey;
+    unsigned char *server_hash;
+    size_t server_hash_len;
+
+#ifdef HAVE_LIBSSH_0_8
+    r = ssh_get_server_publickey(s->session, &pubkey);
+#else
+    r = ssh_get_publickey(s->session, &pubkey);
+#endif
+    if (r != SSH_OK) {
         session_error_setg(errp, s, "failed to read remote host key");
         return -EINVAL;
     }
 
-    if(compare_fingerprint((unsigned char *) fingerprint, fingerprint_len,
-                           hash) != 0) {
+    r = ssh_get_publickey_hash(pubkey, type, &server_hash, &server_hash_len);
+    ssh_key_free(pubkey);
+    if (r != 0) {
+        session_error_setg(errp, s,
+                           "failed reading the hash of the server SSH key");
+        return -EINVAL;
+    }
+
+    r = compare_fingerprint(server_hash, server_hash_len, hash);
+    ssh_clean_pubkey_hash(&server_hash);
+    if (r != 0) {
         error_setg(errp, "remote host key does not match host_key_check '%s'",
                    hash);
         return -EPERM;
@@ -XXX,XX +XXX,XX @@ check_host_key_hash(BDRVSSHState *s, const char *hash,
     return 0;
 }
 
-static int check_host_key(BDRVSSHState *s, const char *host, int port,
-                          SshHostKeyCheck *hkc, Error **errp)
+static int check_host_key(BDRVSSHState *s, SshHostKeyCheck *hkc, Error **errp)
 {
     SshHostKeyCheckMode mode;
 
@@ -XXX,XX +XXX,XX @@ static int check_host_key(BDRVSSHState *s, const char *host, int port,
     case SSH_HOST_KEY_CHECK_MODE_HASH:
         if (hkc->u.hash.type == SSH_HOST_KEY_CHECK_HASH_TYPE_MD5) {
             return check_host_key_hash(s, hkc->u.hash.hash,
-                                       LIBSSH2_HOSTKEY_HASH_MD5, 16, errp);
+                                       SSH_PUBLICKEY_HASH_MD5, errp);
         } else if (hkc->u.hash.type == SSH_HOST_KEY_CHECK_HASH_TYPE_SHA1) {
             return check_host_key_hash(s, hkc->u.hash.hash,
-                                       LIBSSH2_HOSTKEY_HASH_SHA1, 20, errp);
+                                       SSH_PUBLICKEY_HASH_SHA1, errp);
         }
         g_assert_not_reached();
         break;
     case SSH_HOST_KEY_CHECK_MODE_KNOWN_HOSTS:
-        return check_host_key_knownhosts(s, host, port, errp);
+        return check_host_key_knownhosts(s, errp);
     default:
         g_assert_not_reached();
     }
@@ -XXX,XX +XXX,XX @@ static int check_host_key(BDRVSSHState *s, const char *host, int port,
     return -EINVAL;
 }
 
-static int authenticate(BDRVSSHState *s, const char *user, Error **errp)
+static int authenticate(BDRVSSHState *s, Error **errp)
 {
     int r, ret;
-    const char *userauthlist;
-    LIBSSH2_AGENT *agent = NULL;
-    struct libssh2_agent_publickey *identity;
-    struct libssh2_agent_publickey *prev_identity = NULL;
+    int method;
 
-    userauthlist = libssh2_userauth_list(s->session, user, strlen(user));
-    if (strstr(userauthlist, "publickey") == NULL) {
+    /* Try to authenticate with the "none" method. */
+    r = ssh_userauth_none(s->session, NULL);
+    if (r == SSH_AUTH_ERROR) {
         ret = -EPERM;
-        error_setg(errp,
-                "remote server does not support \"publickey\" authentication");
+        session_error_setg(errp, s, "failed to authenticate using none "
+                                    "authentication");
         goto out;
-    }
-
-    /* Connect to ssh-agent and try each identity in turn. */
-    agent = libssh2_agent_init(s->session);
-    if (!agent) {
-        ret = -EINVAL;
-        session_error_setg(errp, s, "failed to initialize ssh-agent support");
-        goto out;
-    }
-    if (libssh2_agent_connect(agent)) {
-        ret = -ECONNREFUSED;
-        session_error_setg(errp, s, "failed to connect to ssh-agent");
-        goto out;
-    }
-    if (libssh2_agent_list_identities(agent)) {
-        ret = -EINVAL;
-        session_error_setg(errp, s,
-                           "failed requesting identities from ssh-agent");
+    } else if (r == SSH_AUTH_SUCCESS) {
+        /* Authenticated! */
+        ret = 0;
         goto out;
     }
 
-    for(;;) {
-        r = libssh2_agent_get_identity(agent, &identity, prev_identity);
-        if (r == 1) {           /* end of list */
-            break;
-        }
-        if (r < 0) {
+    method = ssh_userauth_list(s->session, NULL);
+    trace_ssh_auth_methods(method);
+
+    /*
+     * Try to authenticate with publickey, using the ssh-agent
+     * if available.
+     */
+    if (method & SSH_AUTH_METHOD_PUBLICKEY) {
+        r = ssh_userauth_publickey_auto(s->session, NULL, NULL);
+        if (r == SSH_AUTH_ERROR) {
             ret = -EINVAL;
-            session_error_setg(errp, s,
-                               "failed to obtain identity from ssh-agent");
+            session_error_setg(errp, s, "failed to authenticate using "
+                                        "publickey authentication");
             goto out;
-        }
-        r = libssh2_agent_userauth(agent, user, identity);
-        if (r == 0) {
+        } else if (r == SSH_AUTH_SUCCESS) {
             /* Authenticated! */
             ret = 0;
             goto out;
         }
-        /* Failed to authenticate with this identity, try the next one. */
-        prev_identity = identity;
     }
 
     ret = -EPERM;
@@ -XXX,XX +XXX,XX @@ static int authenticate(BDRVSSHState *s, const char *user, Error **errp)
                "and the identities held by your ssh-agent");
 
  out:
-    if (agent != NULL) {
-        /* Note: libssh2 implementation implicitly calls
-         * libssh2_agent_disconnect if necessary.
-         */
-        libssh2_agent_free(agent);
-    }
-
     return ret;
 }
 
@@ -XXX,XX +XXX,XX @@ static int connect_to_ssh(BDRVSSHState *s, BlockdevOptionsSsh *opts,
                           int ssh_flags, int creat_mode, Error **errp)
 {
     int r, ret;
-    long port = 0;
+    unsigned int port = 0;
+    int new_sock = -1;
 
     if (opts->has_user) {
         s->user = g_strdup(opts->user);
@@ -XXX,XX +XXX,XX @@ static int connect_to_ssh(BDRVSSHState *s, BlockdevOptionsSsh *opts,
     s->inet = opts->server;
     opts->server = NULL;
 
-    if (qemu_strtol(s->inet->port, NULL, 10, &port) < 0) {
+    if (qemu_strtoui(s->inet->port, NULL, 10, &port) < 0) {
         error_setg(errp, "Use only numeric port value");
         ret = -EINVAL;
         goto err;
     }
 
     /* Open the socket and connect. */
-    s->sock = inet_connect_saddr(s->inet, errp);
-    if (s->sock < 0) {
+    new_sock = inet_connect_saddr(s->inet, errp);
+    if (new_sock < 0) {
         ret = -EIO;
         goto err;
     }
 
+    /*
+     * Try to disable the Nagle algorithm on TCP sockets to reduce latency,
+     * but do not fail if it cannot be disabled.
+     */
+    r = socket_set_nodelay(new_sock);
+    if (r < 0) {
+        warn_report("can't set TCP_NODELAY for the ssh server %s: %s",
+                    s->inet->host, strerror(errno));
+    }
+
     /* Create SSH session. */
-    s->session = libssh2_session_init();
+    s->session = ssh_new();
     if (!s->session) {
         ret = -EINVAL;
-        session_error_setg(errp, s, "failed to initialize libssh2 session");
+        session_error_setg(errp, s, "failed to initialize libssh session");
         goto err;
     }
 
-#if TRACE_LIBSSH2 != 0
-    libssh2_trace(s->session, TRACE_LIBSSH2);
-#endif
+    /*
+     * Make sure we are in blocking mode during the connection and
+     * authentication phases.
+     */
+    ssh_set_blocking(s->session, 1);
 
-    r = libssh2_session_handshake(s->session, s->sock);
-    if (r != 0) {
+    r = ssh_options_set(s->session, SSH_OPTIONS_USER, s->user);
+    if (r < 0) {
+        ret = -EINVAL;
+        session_error_setg(errp, s,
+                           "failed to set the user in the libssh session");
+        goto err;
+    }
+
+    r = ssh_options_set(s->session, SSH_OPTIONS_HOST, s->inet->host);
+    if (r < 0) {
+        ret = -EINVAL;
+        session_error_setg(errp, s,
+                           "failed to set the host in the libssh session");
+        goto err;
+    }
+
+    if (port > 0) {
+        r = ssh_options_set(s->session, SSH_OPTIONS_PORT, &port);
+        if (r < 0) {
+            ret = -EINVAL;
+            session_error_setg(errp, s,
+                               "failed to set the port in the libssh session");
+            goto err;
+        }
+    }
+
+    r = ssh_options_set(s->session, SSH_OPTIONS_COMPRESSION, "none");
+    if (r < 0) {
+        ret = -EINVAL;
+        session_error_setg(errp, s,
+                           "failed to disable the compression in the libssh "
+                           "session");
+        goto err;
+    }
+
+    /* Read ~/.ssh/config. */
+    r = ssh_options_parse_config(s->session, NULL);
+    if (r < 0) {
+        ret = -EINVAL;
+        session_error_setg(errp, s, "failed to parse ~/.ssh/config");
+        goto err;
+    }
+
+    r = ssh_options_set(s->session, SSH_OPTIONS_FD, &new_sock);
+    if (r < 0) {
+        ret = -EINVAL;
+        session_error_setg(errp, s,
+                           "failed to set the socket in the libssh session");
+        goto err;
+    }
+    /* libssh took ownership of the socket. */
+    s->sock = new_sock;
+    new_sock = -1;
+
+    /* Connect. */
+    r = ssh_connect(s->session);
+    if (r != SSH_OK) {
         ret = -EINVAL;
         session_error_setg(errp, s, "failed to establish SSH session");
         goto err;
     }
 
     /* Check the remote host's key against known_hosts. */
-    ret = check_host_key(s, s->inet->host, port, opts->host_key_check, errp);
+    ret = check_host_key(s, opts->host_key_check, errp);
     if (ret < 0) {
         goto err;
     }
 
     /* Authenticate. */
-    ret = authenticate(s, s->user, errp);
+    ret = authenticate(s, errp);
     if (ret < 0) {
         goto err;
     }
 
     /* Start SFTP. */
-    s->sftp = libssh2_sftp_init(s->session);
+    s->sftp = sftp_new(s->session);
     if (!s->sftp) {
-        session_error_setg(errp, s, "failed to initialize sftp handle");
+        session_error_setg(errp, s, "failed to create sftp handle");
+        ret = -EINVAL;
+        goto err;
+    }
+
+    r = sftp_init(s->sftp);
+    if (r < 0) {
+        sftp_error_setg(errp, s, "failed to initialize sftp handle");
         ret = -EINVAL;
         goto err;
     }
 
     /* Open the remote file. */
     trace_ssh_connect_to_ssh(opts->path, ssh_flags, creat_mode);
-    s->sftp_handle = libssh2_sftp_open(s->sftp, opts->path, ssh_flags,
-                                       creat_mode);
+    s->sftp_handle = sftp_open(s->sftp, opts->path, ssh_flags, creat_mode);
     if (!s->sftp_handle) {
-        session_error_setg(errp, s, "failed to open remote file '%s'",
-                           opts->path);
+        sftp_error_setg(errp, s, "failed to open remote file '%s'",
+                        opts->path);
         ret = -EINVAL;
         goto err;
     }
 
-    r = libssh2_sftp_fstat(s->sftp_handle, &s->attrs);
-    if (r < 0) {
+    /* Make sure the SFTP file is handled in blocking mode. */
+    sftp_file_set_blocking(s->sftp_handle);
+
+    s->attrs = sftp_fstat(s->sftp_handle);
+    if (!s->attrs) {
         sftp_error_setg(errp, s, "failed to read file attributes");
         return -EINVAL;
     }
@@ -XXX,XX +XXX,XX @@ static int connect_to_ssh(BDRVSSHState *s, BlockdevOptionsSsh *opts,
     return 0;
 
  err:
+    if (s->attrs) {
+        sftp_attributes_free(s->attrs);
+    }
+    s->attrs = NULL;
     if (s->sftp_handle) {
-        libssh2_sftp_close(s->sftp_handle);
+        sftp_close(s->sftp_handle);
     }
     s->sftp_handle = NULL;
     if (s->sftp) {
-        libssh2_sftp_shutdown(s->sftp);
+        sftp_free(s->sftp);
     }
     s->sftp = NULL;
     if (s->session) {
-        libssh2_session_disconnect(s->session,
-                                   "from qemu ssh client: "
-                                   "error opening connection");
-        libssh2_session_free(s->session);
+        ssh_disconnect(s->session);
+        ssh_free(s->session);
     }
     s->session = NULL;
+    s->sock = -1;
+    if (new_sock >= 0) {
+        close(new_sock);
+    }
 
     return ret;
 }
@@ -XXX,XX +XXX,XX @@ static int ssh_file_open(BlockDriverState *bs, QDict *options, int bdrv_flags,
 
     ssh_state_init(s);
 
-    ssh_flags = LIBSSH2_FXF_READ;
+    ssh_flags = 0;
     if (bdrv_flags & BDRV_O_RDWR) {
-        ssh_flags |= LIBSSH2_FXF_WRITE;
+        ssh_flags |= O_RDWR;
+    } else {
+        ssh_flags |= O_RDONLY;
     }
 
     opts = ssh_parse_options(options, errp);
@@ -XXX,XX +XXX,XX @@ static int ssh_file_open(BlockDriverState *bs, QDict *options, int bdrv_flags,
     }
 
     /* Go non-blocking. */
-    libssh2_session_set_blocking(s->session, 0);
+    ssh_set_blocking(s->session, 0);
 
     qapi_free_BlockdevOptionsSsh(opts);
 
     return 0;
 
  err:
-    if (s->sock >= 0) {
-        close(s->sock);
-    }
-    s->sock = -1;
-
     qapi_free_BlockdevOptionsSsh(opts);
 
     return ret;
@@ -XXX,XX +XXX,XX @@ static int ssh_grow_file(BDRVSSHState *s, int64_t offset, Error **errp)
 {
     ssize_t ret;
     char c[1] = { '\0' };
-    int was_blocking = libssh2_session_get_blocking(s->session);
+    int was_blocking = ssh_is_blocking(s->session);
 
     /* offset must be strictly greater than the current size so we do
      * not overwrite anything */
-    assert(offset > 0 && offset > s->attrs.filesize);
+    assert(offset > 0 && offset > s->attrs->size);
 
-    libssh2_session_set_blocking(s->session, 1);
+    ssh_set_blocking(s->session, 1);
 
-    libssh2_sftp_seek64(s->sftp_handle, offset - 1);
-    ret = libssh2_sftp_write(s->sftp_handle, c, 1);
+    sftp_seek64(s->sftp_handle, offset - 1);
+    ret = sftp_write(s->sftp_handle, c, 1);
 
-    libssh2_session_set_blocking(s->session, was_blocking);
+    ssh_set_blocking(s->session, was_blocking);
 
     if (ret < 0) {
         sftp_error_setg(errp, s, "Failed to grow file");
         return -EIO;
     }
 
-    s->attrs.filesize = offset;
+    s->attrs->size = offset;
     return 0;
 }
 
@@ -XXX,XX +XXX,XX @@ static int ssh_co_create(BlockdevCreateOptions *options, Error **errp)
     ssh_state_init(&s);
 
     ret = connect_to_ssh(&s, opts->location,
-                         LIBSSH2_FXF_READ|LIBSSH2_FXF_WRITE|
-                         LIBSSH2_FXF_CREAT|LIBSSH2_FXF_TRUNC,
+                         O_RDWR | O_CREAT | O_TRUNC,
                          0644, errp);
     if (ret < 0) {
         goto fail;
@@ -XXX,XX +XXX,XX @@ static int ssh_has_zero_init(BlockDriverState *bs)
     /* Assume false, unless we can positively prove it's true. */
     int has_zero_init = 0;
 
-    if (s->attrs.flags & LIBSSH2_SFTP_ATTR_PERMISSIONS) {
-        if (s->attrs.permissions & LIBSSH2_SFTP_S_IFREG) {
-            has_zero_init = 1;
-        }
+    if (s->attrs->type == SSH_FILEXFER_TYPE_REGULAR) {
+        has_zero_init = 1;
     }
 
     return has_zero_init;
@@ -XXX,XX +XXX,XX @@ static coroutine_fn void co_yield(BDRVSSHState *s, BlockDriverState *bs)
         .co = qemu_coroutine_self()
     };
 
-    r = libssh2_session_block_directions(s->session);
+    r = ssh_get_poll_flags(s->session);
 
-    if (r & LIBSSH2_SESSION_BLOCK_INBOUND) {
+    if (r & SSH_READ_PENDING) {
         rd_handler = restart_coroutine;
     }
-    if (r & LIBSSH2_SESSION_BLOCK_OUTBOUND) {
+    if (r & SSH_WRITE_PENDING) {
         wr_handler = restart_coroutine;
     }
 
@@ -XXX,XX +XXX,XX @@ static coroutine_fn void co_yield(BDRVSSHState *s, BlockDriverState *bs)
     trace_ssh_co_yield_back(s->sock);
 }
 
-/* SFTP has a function `libssh2_sftp_seek64' which seeks to a position
- * in the remote file.  Notice that it just updates a field in the
- * sftp_handle structure, so there is no network traffic and it cannot
- * fail.
- *
- * However, `libssh2_sftp_seek64' does have a catastrophic effect on
- * performance since it causes the handle to throw away all in-flight
- * reads and buffered readahead data.  Therefore this function tries
- * to be intelligent about when to call the underlying libssh2 function.
- */
-#define SSH_SEEK_WRITE 0
-#define SSH_SEEK_READ  1
-#define SSH_SEEK_FORCE 2
-
-static void ssh_seek(BDRVSSHState *s, int64_t offset, int flags)
-{
-    bool op_read = (flags & SSH_SEEK_READ) != 0;
-    bool force = (flags & SSH_SEEK_FORCE) != 0;
-
-    if (force || op_read != s->offset_op_read || offset != s->offset) {
-        trace_ssh_seek(offset);
-        libssh2_sftp_seek64(s->sftp_handle, offset);
-        s->offset = offset;
-        s->offset_op_read = op_read;
-    }
-}
-
 static coroutine_fn int ssh_read(BDRVSSHState *s, BlockDriverState *bs,
                                  int64_t offset, size_t size,
                                  QEMUIOVector *qiov)
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int ssh_read(BDRVSSHState *s, BlockDriverState *bs,
 
     trace_ssh_read(offset, size);
 
-    ssh_seek(s, offset, SSH_SEEK_READ);
+    trace_ssh_seek(offset);
+    sftp_seek64(s->sftp_handle, offset);
 
     /* This keeps track of the current iovec element ('i'), where we
      * will write to next ('buf'), and the end of the current iovec
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int ssh_read(BDRVSSHState *s, BlockDriverState *bs,
     buf = i->iov_base;
     end_of_vec = i->iov_base + i->iov_len;
 
-    /* libssh2 has a hard-coded limit of 2000 bytes per request,
-     * although it will also do readahead behind our backs.  Therefore
-     * we may have to do repeated reads here until we have read 'size'
-     * bytes.
-     */
     for (got = 0; got < size; ) {
+        size_t request_read_size;
     again:
-        trace_ssh_read_buf(buf, end_of_vec - buf);
-        r = libssh2_sftp_read(s->sftp_handle, buf, end_of_vec - buf);
-        trace_ssh_read_return(r);
+        /*
+         * The size of SFTP packets is limited to 32K bytes, so limit
+         * the amount of data requested to 16K, as libssh currently
+         * does not handle multiple requests on its own.
+         */
+        request_read_size = MIN(end_of_vec - buf, 16384);
+        trace_ssh_read_buf(buf, end_of_vec - buf, request_read_size);
+        r = sftp_read(s->sftp_handle, buf, request_read_size);
+        trace_ssh_read_return(r, sftp_get_error(s->sftp));
 
-        if (r == LIBSSH2_ERROR_EAGAIN || r == LIBSSH2_ERROR_TIMEOUT) {
+        if (r == SSH_AGAIN) {
             co_yield(s, bs);
             goto again;
         }
-        if (r < 0) {
-            sftp_error_trace(s, "read");
-            s->offset = -1;
-            return -EIO;
-        }
-        if (r == 0) {
+        if (r == SSH_EOF || (r == 0 && sftp_get_error(s->sftp) == SSH_FX_EOF)) {
             /* EOF: Short read so pad the buffer with zeroes and return it. */
             qemu_iovec_memset(qiov, got, 0, size - got);
             return 0;
         }
+        if (r <= 0) {
+            sftp_error_trace(s, "read");
+            return -EIO;
+        }
 
         got += r;
         buf += r;
-        s->offset += r;
         if (buf >= end_of_vec && got < size) {
             i++;
             buf = i->iov_base;
@@ -XXX,XX +XXX,XX @@ static int ssh_write(BDRVSSHState *s, BlockDriverState *bs,
 
     trace_ssh_write(offset, size);
 
-    ssh_seek(s, offset, SSH_SEEK_WRITE);
+    trace_ssh_seek(offset);
+    sftp_seek64(s->sftp_handle, offset);
 
     /* This keeps track of the current iovec element ('i'), where we
      * will read from next ('buf'), and the end of the current iovec
@@ -XXX,XX +XXX,XX @@ static int ssh_write(BDRVSSHState *s, BlockDriverState *bs,
     end_of_vec = i->iov_base + i->iov_len;
 
     for (written = 0; written < size; ) {
+        size_t request_write_size;
     again:
-        trace_ssh_write_buf(buf, end_of_vec - buf);
-        r = libssh2_sftp_write(s->sftp_handle, buf, end_of_vec - buf);
-        trace_ssh_write_return(r);
+        /*
+         * Avoid too large data packets, as libssh currently does not
+         * handle multiple requests on its own.
+         */
+        request_write_size = MIN(end_of_vec - buf, 131072);
+        trace_ssh_write_buf(buf, end_of_vec - buf, request_write_size);
+        r = sftp_write(s->sftp_handle, buf, request_write_size);
+        trace_ssh_write_return(r, sftp_get_error(s->sftp));
 
-        if (r == LIBSSH2_ERROR_EAGAIN || r == LIBSSH2_ERROR_TIMEOUT) {
+        if (r == SSH_AGAIN) {
             co_yield(s, bs);
             goto again;
         }
         if (r < 0) {
             sftp_error_trace(s, "write");
-            s->offset = -1;
             return -EIO;
         }
-        /* The libssh2 API is very unclear about this.  A comment in
-         * the code says "nothing was acked, and no EAGAIN was
-         * received!" which apparently means that no data got sent
-         * out, and the underlying channel didn't return any EAGAIN
-         * indication.  I think this is a bug in either libssh2 or
-         * OpenSSH (server-side).  In any case, forcing a seek (to
-         * discard libssh2 internal buffers), and then trying again
-         * works for me.
-         */
-        if (r == 0) {
-            ssh_seek(s, offset + written, SSH_SEEK_WRITE|SSH_SEEK_FORCE);
-            co_yield(s, bs);
-            goto again;
-        }
 
         written += r;
         buf += r;
-        s->offset += r;
         if (buf >= end_of_vec && written < size) {
             i++;
             buf = i->iov_base;
             end_of_vec = i->iov_base + i->iov_len;
         }
 
-        if (offset + written > s->attrs.filesize)
-            s->attrs.filesize = offset + written;
+        if (offset + written > s->attrs->size) {
+            s->attrs->size = offset + written;
+        }
     }
 
     return 0;
@@ -XXX,XX +XXX,XX @@ static void unsafe_flush_warning(BDRVSSHState *s, const char *what)
     }
 }
 
-#ifdef HAS_LIBSSH2_SFTP_FSYNC
+#ifdef HAVE_LIBSSH_0_8
 
 static coroutine_fn int ssh_flush(BDRVSSHState *s, BlockDriverState *bs)
 {
     int r;
 
     trace_ssh_flush();
+
+    if (!sftp_extension_supported(s->sftp, "fsync@openssh.com", "1")) {
+        unsafe_flush_warning(s, "OpenSSH >= 6.3");
+        return 0;
+    }
  again:
-    r = libssh2_sftp_fsync(s->sftp_handle);
-    if (r == LIBSSH2_ERROR_EAGAIN || r == LIBSSH2_ERROR_TIMEOUT) {
+    r = sftp_fsync(s->sftp_handle);
+    if (r == SSH_AGAIN) {
         co_yield(s, bs);
         goto again;
     }
-    if (r == LIBSSH2_ERROR_SFTP_PROTOCOL &&
-        libssh2_sftp_last_error(s->sftp) == LIBSSH2_FX_OP_UNSUPPORTED) {
-        unsafe_flush_warning(s, "OpenSSH >= 6.3");
-        return 0;
-    }
     if (r < 0) {
         sftp_error_trace(s, "fsync");
         return -EIO;
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int ssh_co_flush(BlockDriverState *bs)
     return ret;
 }
 
-#else /* !HAS_LIBSSH2_SFTP_FSYNC */
+#else /* !HAVE_LIBSSH_0_8 */
 
 static coroutine_fn int ssh_co_flush(BlockDriverState *bs)
 {
     BDRVSSHState *s = bs->opaque;
 
-    unsafe_flush_warning(s, "libssh2 >= 1.4.4");
+    unsafe_flush_warning(s, "libssh >= 0.8.0");
     return 0;
 }
 
-#endif /* !HAS_LIBSSH2_SFTP_FSYNC */
+#endif /* !HAVE_LIBSSH_0_8 */
 
 static int64_t ssh_getlength(BlockDriverState *bs)
 {
     BDRVSSHState *s = bs->opaque;
     int64_t length;
 
-    /* Note we cannot make a libssh2 call here. */
-    length = (int64_t) s->attrs.filesize;
+    /* Note we cannot make a libssh call here. */
+    length = (int64_t) s->attrs->size;
     trace_ssh_getlength(length);
 
     return length;
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn ssh_co_truncate(BlockDriverState *bs, int64_t offset,
         return -ENOTSUP;
     }
 
-    if (offset < s->attrs.filesize) {
+    if (offset < s->attrs->size) {
         error_setg(errp, "ssh driver does not support shrinking files");
         return -ENOTSUP;
     }
 
-    if (offset == s->attrs.filesize) {
+    if (offset == s->attrs->size) {
         return 0;
     }
 
@@ -XXX,XX +XXX,XX @@ static void bdrv_ssh_init(void)
 {
     int r;
 
-    r = libssh2_init(0);
+    r = ssh_init();
     if (r != 0) {
-        fprintf(stderr, "libssh2 initialization failed, %d\n", r);
+        fprintf(stderr, "libssh initialization failed, %d\n", r);
         exit(EXIT_FAILURE);
     }
 
+#if TRACE_LIBSSH != 0
+    ssh_set_log_level(TRACE_LIBSSH);
+#endif
+
     bdrv_register(&bdrv_ssh);
 }
 
diff --git a/.travis.yml b/.travis.yml
index XXXXXXX..XXXXXXX 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -XXX,XX +XXX,XX @@ addons:
       - libseccomp-dev
       - libspice-protocol-dev
       - libspice-server-dev
-      - libssh2-1-dev
+      - libssh-dev
       - liburcu-dev
       - libusb-1.0-0-dev
       - libvte-2.91-dev
@@ -XXX,XX +XXX,XX @@ matrix:
             - libseccomp-dev
             - libspice-protocol-dev
             - libspice-server-dev
-            - libssh2-1-dev
+            - libssh-dev
             - liburcu-dev
             - libusb-1.0-0-dev
             - libvte-2.91-dev
diff --git a/block/trace-events b/block/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/block/trace-events
+++ b/block/trace-events
@@ -XXX,XX +XXX,XX @@ nbd_client_connect_success(const char *export_name) "export '%s'"
 # ssh.c
 ssh_restart_coroutine(void *co) "co=%p"
 ssh_flush(void) "fsync"
-ssh_check_host_key_knownhosts(const char *key) "host key OK: %s"
+ssh_check_host_key_knownhosts(void) "host key OK"
 ssh_connect_to_ssh(char *path, int flags, int mode) "opening file %s flags=0x%x creat_mode=0%o"
 ssh_co_yield(int sock, void *rd_handler, void *wr_handler) "s->sock=%d rd_handler=%p wr_handler=%p"
 ssh_co_yield_back(int sock) "s->sock=%d - back"
 ssh_getlength(int64_t length) "length=%" PRIi64
 ssh_co_create_opts(uint64_t size) "total_size=%" PRIu64
 ssh_read(int64_t offset, size_t size) "offset=%" PRIi64 " size=%zu"
-ssh_read_buf(void *buf, size_t size) "sftp_read buf=%p size=%zu"
-ssh_read_return(ssize_t ret) "sftp_read returned %zd"
+ssh_read_buf(void *buf, size_t size, size_t actual_size) "sftp_read buf=%p size=%zu (actual size=%zu)"
+ssh_read_return(ssize_t ret, int sftp_err) "sftp_read returned %zd (sftp error=%d)"
 ssh_write(int64_t offset, size_t size) "offset=%" PRIi64 " size=%zu"
-ssh_write_buf(void *buf, size_t size) "sftp_write buf=%p size=%zu"
-ssh_write_return(ssize_t ret) "sftp_write returned %zd"
+ssh_write_buf(void *buf, size_t size, size_t actual_size) "sftp_write buf=%p size=%zu (actual size=%zu)"
+ssh_write_return(ssize_t ret, int sftp_err) "sftp_write returned %zd (sftp error=%d)"
 ssh_seek(int64_t offset) "seeking to offset=%" PRIi64
+ssh_auth_methods(int methods) "auth methods=0x%x"
+ssh_server_status(int status) "server status=%d"
 
 # curl.c
 curl_timer_cb(long timeout_ms) "timer callback timeout_ms %ld"
@@ -XXX,XX +XXX,XX @@ sheepdog_snapshot_create(const char *sn_name, const char *id) "%s %s"
 sheepdog_snapshot_create_inode(const char *name, uint32_t snap, uint32_t vdi) "s->inode: name %s snap_id 0x%" PRIx32 " vdi 0x%" PRIx32
 
 # ssh.c
-sftp_error(const char *op, const char *ssh_err, int ssh_err_code, unsigned long sftp_err_code) "%s failed: %s (libssh2 error code: %d, sftp error code: %lu)"
+sftp_error(const char *op, const char *ssh_err, int ssh_err_code, int sftp_err_code) "%s failed: %s (libssh error code: %d, sftp error code: %d)"
diff --git a/docs/qemu-block-drivers.texi b/docs/qemu-block-drivers.texi
index XXXXXXX..XXXXXXX 100644
--- a/docs/qemu-block-drivers.texi
+++ b/docs/qemu-block-drivers.texi
@@ -XXX,XX +XXX,XX @@ print a warning when @code{fsync} is not supported:
 
 warning: ssh server @code{ssh.example.com:22} does not support fsync
 
-With sufficiently new versions of libssh2 and OpenSSH, @code{fsync} is
+With sufficiently new versions of libssh and OpenSSH, @code{fsync} is
 supported.
 
 @node disk_images_nvme
diff --git a/tests/docker/dockerfiles/debian-win32-cross.docker b/tests/docker/dockerfiles/debian-win32-cross.docker
index XXXXXXX..XXXXXXX 100644
--- a/tests/docker/dockerfiles/debian-win32-cross.docker
+++ b/tests/docker/dockerfiles/debian-win32-cross.docker
@@ -XXX,XX +XXX,XX @@ RUN DEBIAN_FRONTEND=noninteractive eatmydata \
         mxe-$TARGET-w64-mingw32.shared-curl \
         mxe-$TARGET-w64-mingw32.shared-glib \
         mxe-$TARGET-w64-mingw32.shared-libgcrypt \
-        mxe-$TARGET-w64-mingw32.shared-libssh2 \
         mxe-$TARGET-w64-mingw32.shared-libusb1 \
         mxe-$TARGET-w64-mingw32.shared-lzo \
         mxe-$TARGET-w64-mingw32.shared-nettle \
diff --git a/tests/docker/dockerfiles/debian-win64-cross.docker b/tests/docker/dockerfiles/debian-win64-cross.docker
index XXXXXXX..XXXXXXX 100644
--- a/tests/docker/dockerfiles/debian-win64-cross.docker
+++ b/tests/docker/dockerfiles/debian-win64-cross.docker
@@ -XXX,XX +XXX,XX @@ RUN DEBIAN_FRONTEND=noninteractive eatmydata \
         mxe-$TARGET-w64-mingw32.shared-curl \
         mxe-$TARGET-w64-mingw32.shared-glib \
         mxe-$TARGET-w64-mingw32.shared-libgcrypt \
-        mxe-$TARGET-w64-mingw32.shared-libssh2 \
         mxe-$TARGET-w64-mingw32.shared-libusb1 \
         mxe-$TARGET-w64-mingw32.shared-lzo \
         mxe-$TARGET-w64-mingw32.shared-nettle \
diff --git a/tests/docker/dockerfiles/fedora.docker b/tests/docker/dockerfiles/fedora.docker
index XXXXXXX..XXXXXXX 100644
--- a/tests/docker/dockerfiles/fedora.docker
+++ b/tests/docker/dockerfiles/fedora.docker
@@ -XXX,XX +XXX,XX @@ ENV PACKAGES \
     libpng-devel \
     librbd-devel \
     libseccomp-devel \
-    libssh2-devel \
+    libssh-devel \
     libubsan \
     libusbx-devel \
     libxml2-devel \
@@ -XXX,XX +XXX,XX @@ ENV PACKAGES \
     mingw32-gtk3 \
     mingw32-libjpeg-turbo \
     mingw32-libpng \
-    mingw32-libssh2 \
     mingw32-libtasn1 \
     mingw32-nettle \
     mingw32-pixman \
@@ -XXX,XX +XXX,XX @@ ENV PACKAGES \
     mingw64-gtk3 \
     mingw64-libjpeg-turbo \
     mingw64-libpng \
-    mingw64-libssh2 \
     mingw64-libtasn1 \
     mingw64-nettle \
     mingw64-pixman \
diff --git a/tests/docker/dockerfiles/ubuntu.docker b/tests/docker/dockerfiles/ubuntu.docker
index XXXXXXX..XXXXXXX 100644
--- a/tests/docker/dockerfiles/ubuntu.docker
+++ b/tests/docker/dockerfiles/ubuntu.docker
@@ -XXX,XX +XXX,XX @@ ENV PACKAGES flex bison \
     libsnappy-dev \
     libspice-protocol-dev \
     libspice-server-dev \
-    libssh2-1-dev \
+    libssh-dev \
     libusb-1.0-0-dev \
     libusbredirhost-dev \
     libvdeplug-dev \
diff --git a/tests/docker/dockerfiles/ubuntu1804.docker b/tests/docker/dockerfiles/ubuntu1804.docker
index XXXXXXX..XXXXXXX 100644
--- a/tests/docker/dockerfiles/ubuntu1804.docker
+++ b/tests/docker/dockerfiles/ubuntu1804.docker
@@ -XXX,XX +XXX,XX @@ ENV PACKAGES flex bison \
     libsnappy-dev \
     libspice-protocol-dev \
     libspice-server-dev \
-    libssh2-1-dev \
+    libssh-dev \
     libusb-1.0-0-dev \
     libusbredirhost-dev \
     libvdeplug-dev \
diff --git a/tests/qemu-iotests/207 b/tests/qemu-iotests/207
index XXXXXXX..XXXXXXX 100755
--- a/tests/qemu-iotests/207
+++ b/tests/qemu-iotests/207
@@ -XXX,XX +XXX,XX @@ with iotests.FilePath('t.img') as disk_path, \
 
     iotests.img_info_log(remote_path)
 
-    md5_key = subprocess.check_output(
-        'ssh-keyscan -t rsa 127.0.0.1 2>/dev/null | grep -v "\\^#" | ' +
-        'cut -d" " -f3 | base64 -d | md5sum -b | cut -d" " -f1',
-        shell=True).rstrip().decode('ascii')
+    keys = subprocess.check_output(
+        'ssh-keyscan 127.0.0.1 2>/dev/null | grep -v "\\^#" | ' +
+        'cut -d" " -f3',
+        shell=True).rstrip().decode('ascii').split('\n')
+
+    # Mappings of base64 representations to digests
+    md5_keys = {}
+    sha1_keys = {}
+
+    for key in keys:
+        md5_keys[key] = subprocess.check_output(
+            'echo %s | base64 -d | md5sum -b | cut -d" " -f1' % key,
+            shell=True).rstrip().decode('ascii')
+
+        sha1_keys[key] = subprocess.check_output(
+            'echo %s | base64 -d | sha1sum -b | cut -d" " -f1' % key,
+            shell=True).rstrip().decode('ascii')
 
     vm.launch()
+
+    # Find correct key first
+    matching_key = None
+    for key in keys:
+        result = vm.qmp('blockdev-add',
+                        driver='ssh', node_name='node0', path=disk_path,
+                        server={
+                             'host': '127.0.0.1',
+                             'port': '22',
+                        }, host_key_check={
+                             'mode': 'hash',
+                             'type': 'md5',
+                             'hash': md5_keys[key],
+                        })
+
+        if 'error' not in result:
+            vm.qmp('blockdev-del', node_name='node0')
+            matching_key = key
+            break
+
+    if matching_key is None:
+        vm.shutdown()
+        iotests.notrun('Did not find a key that fits 127.0.0.1')
+
     blockdev_create(vm, { 'driver': 'ssh',
                           'location': {
                               'path': disk_path,
@@ -XXX,XX +XXX,XX @@ with iotests.FilePath('t.img') as disk_path, \
                               'host-key-check': {
                                   'mode': 'hash',
                                   'type': 'md5',
-                                  'hash': md5_key,
+                                  'hash': md5_keys[matching_key],
                               }
                           },
                           'size': 8388608 })
@@ -XXX,XX +XXX,XX @@ with iotests.FilePath('t.img') as disk_path, \
 
     iotests.img_info_log(remote_path)
 
-    sha1_key = subprocess.check_output(
-        'ssh-keyscan -t rsa 127.0.0.1 2>/dev/null | grep -v "\\^#" | ' +
-        'cut -d" " -f3 | base64 -d | sha1sum -b | cut -d" " -f1',
-        shell=True).rstrip().decode('ascii')
-
     vm.launch()
     blockdev_create(vm, { 'driver': 'ssh',
                           'location': {
@@ -XXX,XX +XXX,XX @@ with iotests.FilePath('t.img') as disk_path, \
                               'host-key-check': {
                                   'mode': 'hash',
                                   'type': 'sha1',
-                                  'hash': sha1_key,
+                                  'hash': sha1_keys[matching_key],
                               }
                           },
                           'size': 4194304 })
diff --git a/tests/qemu-iotests/207.out b/tests/qemu-iotests/207.out
index XXXXXXX..XXXXXXX 100644
--- a/tests/qemu-iotests/207.out
+++ b/tests/qemu-iotests/207.out
@@ -XXX,XX +XXX,XX @@ virtual size: 4 MiB (4194304 bytes)
 
 {"execute": "blockdev-create", "arguments": {"job-id": "job0", "options": {"driver": "ssh", "location": {"host-key-check": {"mode": "none"}, "path": "/this/is/not/an/existing/path", "server": {"host": "127.0.0.1", "port": "22"}}, "size": 4194304}}}
 {"return": {}}
-Job failed: failed to open remote file '/this/is/not/an/existing/path': Failed opening remote file (libssh2 error code: -31)
+Job failed: failed to open remote file '/this/is/not/an/existing/path': SFTP server: No such file (libssh error code: 1, sftp error code: 2)
 {"execute": "job-dismiss", "arguments": {"id": "job0"}}
 {"return": {}}
 
-- 
2.21.0