Series comparison

-[Qemu-devel] [PULL 0/3] Block patches
+[PULL 0/8] Block patches
-The following changes since commit fe8ee082db5038a05dbd8872e946049e9a9c550e:
+The following changes since commit 013a18edbbc59cdad019100c7d03c0494642b74c:
-  Merge remote-tracking branch 'remotes/armbru/tags/pull-qapi-2017-02-22' into staging (2017-02-24 15:00:51 +0000)
+  Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-2020051=
 ' into staging (2020-05-14 16:17:55 +0100)
-are available in the git repository at:
+are available in the Git repository at:
-  https://github.com/codyprime/qemu-kvm-jtc.git tags/block-pull-request
+  https://github.com/stefanha/qemu.git tags/block-pull-request
-for you to fetch changes up to 1d393bdeae22fde2cb83c1ea719675747c85c40e:
+for you to fetch changes up to ba607ca8bff4d2c2062902f8355657c865ac7c29:
-  RBD: Add support readv,writev for rbd (2017-02-24 12:43:01 -0500)
+  aio-posix: disable fdmon-io_uring when GSource is used (2020-05-18 18:16:00=
  +0100)
 ----------------------------------------------------------------
-Block patches for 2.9
+Pull request
 ----------------------------------------------------------------
-Peter Lieven (2):
+Philippe Mathieu-Daud=C3=A9 (6):
-  block/nfs: convert to preadv / pwritev
+  tests/fuzz/Makefile: Do not link code using unavailable devices
-  block/nfs: try to avoid the bounce buffer in pwritev
+  Makefile: List fuzz targets in 'make help'
   tests/fuzz: Add missing space in test description
   tests/fuzz: Remove unuseful/unused typedefs
   tests/fuzz: Extract pciconfig_fuzz_qos() method
   tests/fuzz: Extract ioport_fuzz_qtest() method
-tianqing (1):
+Stefan Hajnoczi (2):
-  RBD: Add support readv,writev for rbd
+  aio-posix: don't duplicate fd handler deletion in
     fdmon_io_uring_destroy()
   aio-posix: disable fdmon-io_uring when GSource is used
- block/nfs.c | 62 +++++++++++++++++++++++++----------------------
+ Makefile                          |  6 +++-
- block/rbd.c | 80 ++++++++++++++++++++++++++++++++++++++++++-------------------
+ tests/qtest/fuzz/Makefile.include |  6 ++--
-files changed, 90 insertions(+), 52 deletions(-)
+ include/block/aio.h               |  3 ++
  tests/qtest/fuzz/i440fx_fuzz.c    | 47 ++++++++++++++++++++-----------
  util/aio-posix.c                  | 13 +++++++++
  util/aio-win32.c                  |  4 +++
  util/async.c                      |  1 +
  util/fdmon-io_uring.c             | 13 +++++++--
 files changed, 69 insertions(+), 24 deletions(-)
---
+--=20
-.9.3
+.25.3

-New patch
+[PULL 1/8] tests/fuzz/Makefile: Do not link code using unavailable devices
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
+Some devices availability depends on CONFIG options.
+Use these options to only link tests when requested device
+is available.
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20200514143433.18569-2-philmd@redhat.com
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ tests/qtest/fuzz/Makefile.include | 6 +++---
+file changed, 3 insertions(+), 3 deletions(-)
+diff --git a/tests/qtest/fuzz/Makefile.include b/tests/qtest/fuzz/Makefile.include
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/qtest/fuzz/Makefile.include
++++ b/tests/qtest/fuzz/Makefile.include
+@@ -XXX,XX +XXX,XX @@ fuzz-obj-y += tests/qtest/fuzz/fork_fuzz.o
+ fuzz-obj-y += tests/qtest/fuzz/qos_fuzz.o
+ # Targets
+-fuzz-obj-y += tests/qtest/fuzz/i440fx_fuzz.o
+-fuzz-obj-y += tests/qtest/fuzz/virtio_net_fuzz.o
+-fuzz-obj-y += tests/qtest/fuzz/virtio_scsi_fuzz.o
++fuzz-obj-$(CONFIG_PCI_I440FX) += tests/qtest/fuzz/i440fx_fuzz.o
++fuzz-obj-$(CONFIG_VIRTIO_NET) += tests/qtest/fuzz/virtio_net_fuzz.o
++fuzz-obj-$(CONFIG_SCSI) += tests/qtest/fuzz/virtio_scsi_fuzz.o
+ FUZZ_CFLAGS += -I$(SRC_PATH)/tests -I$(SRC_PATH)/tests/qtest
+--
+.25.3

-New patch
+[PULL 2/8] Makefile: List fuzz targets in 'make help'
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
+List softmmu fuzz targets in 'make help' output:
+  $ make help
+  ...
+  Architecture specific targets:
+  aarch64-softmmu/all            - Build for aarch64-softmmu
+  aarch64-softmmu/fuzz           - Build fuzzer for aarch64-softmmu
+  alpha-softmmu/all              - Build for alpha-softmmu
+  alpha-softmmu/fuzz             - Build fuzzer for alpha-softmmu
+  arm-softmmu/all                - Build for arm-softmmu
+  arm-softmmu/fuzz               - Build fuzzer for arm-softmmu
+  ...
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20200514143433.18569-3-philmd@redhat.com
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ Makefile | 6 +++++-
+file changed, 5 insertions(+), 1 deletion(-)
+diff --git a/Makefile b/Makefile
+index XXXXXXX..XXXXXXX 100644
+--- a/Makefile
++++ b/Makefile
+@@ -XXX,XX +XXX,XX @@ endif
+     @$(if $(TARGET_DIRS), \
+         echo 'Architecture specific targets:'; \
+         $(foreach t, $(TARGET_DIRS), \
+-        $(call print-help-run,$(t)/all,Build for $(t));) \
++        $(call print-help-run,$(t)/all,Build for $(t)); \
++        $(if $(CONFIG_FUZZ), \
++            $(if $(findstring softmmu,$(t)), \
++                $(call print-help-run,$(t)/fuzz,Build fuzzer for $(t)); \
++        ))) \
+         echo '')
+     @$(if $(TOOLS), \
+         echo 'Tools targets:'; \
+--
+.25.3

-New patch
+[PULL 3/8] tests/fuzz: Add missing space in test description
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20200514143433.18569-4-philmd@redhat.com
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ tests/qtest/fuzz/i440fx_fuzz.c | 6 +++---
+file changed, 3 insertions(+), 3 deletions(-)
+diff --git a/tests/qtest/fuzz/i440fx_fuzz.c b/tests/qtest/fuzz/i440fx_fuzz.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/qtest/fuzz/i440fx_fuzz.c
++++ b/tests/qtest/fuzz/i440fx_fuzz.c
+@@ -XXX,XX +XXX,XX @@ static void register_pci_fuzz_targets(void)
+     /* Uses simple qtest commands and reboots to reset state */
+     fuzz_add_target(&(FuzzTarget){
+                 .name = "i440fx-qtest-reboot-fuzz",
+-                .description = "Fuzz the i440fx using raw qtest commands and"
++                .description = "Fuzz the i440fx using raw qtest commands and "
+                                "rebooting after each run",
+                 .get_init_cmdline = i440fx_argv,
+                 .fuzz = i440fx_fuzz_qtest});
+@@ -XXX,XX +XXX,XX @@ static void register_pci_fuzz_targets(void)
+     /* Uses libqos and forks to prevent state leakage */
+     fuzz_add_qos_target(&(FuzzTarget){
+                 .name = "i440fx-qos-fork-fuzz",
+-                .description = "Fuzz the i440fx using raw qtest commands and"
++                .description = "Fuzz the i440fx using raw qtest commands and "
+                                "rebooting after each run",
+                 .pre_vm_init = &fork_init,
+                 .fuzz = i440fx_fuzz_qos_fork,},
+@@ -XXX,XX +XXX,XX @@ static void register_pci_fuzz_targets(void)
+      */
+     fuzz_add_qos_target(&(FuzzTarget){
+                 .name = "i440fx-qos-noreset-fuzz",
+-                .description = "Fuzz the i440fx using raw qtest commands and"
++                .description = "Fuzz the i440fx using raw qtest commands and "
+                                "rebooting after each run",
+                 .fuzz = i440fx_fuzz_qos,},
+                 "i440FX-pcihost",
+--
+.25.3

-[Qemu-devel] [PULL 2/3] block/nfs: try to avoid the bounce buffer in pwritev
+[PULL 4/8] tests/fuzz: Remove unuseful/unused typedefs
-From: Peter Lieven <pl@kamp.de>
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
-if the passed qiov contains exactly one iov we can
+These typedefs are not used. Use a simple structure,
-pass the buffer directly.
+remote the typedefs.
-Signed-off-by: Peter Lieven <pl@kamp.de>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Jeff Cody <jcody@redhat.com>
+Message-id: 20200514143433.18569-5-philmd@redhat.com
-Message-id: 1487349541-10201-3-git-send-email-pl@kamp.de
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Signed-off-by: Jeff Cody <jcody@redhat.com>
 ---
- block/nfs.c | 35 ++++++++++++++++++++++-------------
+ tests/qtest/fuzz/i440fx_fuzz.c | 10 ++++------
-file changed, 22 insertions(+), 13 deletions(-)
+file changed, 4 insertions(+), 6 deletions(-)
-diff --git a/block/nfs.c b/block/nfs.c
+diff --git a/tests/qtest/fuzz/i440fx_fuzz.c b/tests/qtest/fuzz/i440fx_fuzz.c
 index XXXXXXX..XXXXXXX 100644
---- a/block/nfs.c
+--- a/tests/qtest/fuzz/i440fx_fuzz.c
-+++ b/block/nfs.c
++++ b/tests/qtest/fuzz/i440fx_fuzz.c
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn nfs_co_pwritev(BlockDriverState *bs, uint64_t offset,
+@@ -XXX,XX +XXX,XX @@ static void i440fx_fuzz_qtest(QTestState *s,
-     NFSClient *client = bs->opaque;
+      * loop over the Data, breaking it up into actions. each action has an
-     NFSRPC task;
+      * opcode, address offset and value
-     char *buf = NULL;
+      */
-+    bool my_buffer = false;
+-    typedef struct QTestFuzzAction {
++    struct {
-     nfs_co_init_task(bs, &task);
+         uint8_t opcode;
+         uint8_t addr;
--    buf = g_try_malloc(bytes);
+         uint32_t value;
--    if (bytes && buf == NULL) {
+-    } QTestFuzzAction;
--        return -ENOMEM;
+-    QTestFuzzAction a;
-+    if (iov->niov != 1) {
++    } a;
-+        buf = g_try_malloc(bytes);
-+        if (bytes && buf == NULL) {
+     while (Size >= sizeof(a)) {
-+            return -ENOMEM;
+         /* make a copy of the action so we can normalize the values in-place */
-+        }
+@@ -XXX,XX +XXX,XX @@ static void i440fx_fuzz_qos(QTestState *s,
-+        qemu_iovec_to_buf(iov, 0, buf, bytes);
+      * Same as i440fx_fuzz_qtest, but using QOS. devfn is incorporated into the
-+        my_buffer = true;
+      * value written over Port IO
-+    } else {
+      */
-+        buf = iov->iov[0].iov_base;
+-    typedef struct QOSFuzzAction {
 +    struct {
          uint8_t opcode;
          uint8_t offset;
          int devfn;
          uint32_t value;
 -    } QOSFuzzAction;
 +    } a;
      static QPCIBus *bus;
      if (!bus) {
          bus = qpci_new_pc(s, fuzz_qos_alloc);
      }
--    qemu_iovec_to_buf(iov, 0, buf, bytes);
+-    QOSFuzzAction a;
--
+     while (Size >= sizeof(a)) {
-     if (nfs_pwrite_async(client->context, client->fh,
+         memcpy(&a, Data, sizeof(a));
-                          offset, bytes, buf,
+         switch (a.opcode % ACTION_MAX) {
                           nfs_co_generic_cb, &task) != 0) {
 +        if (my_buffer) {
 +            g_free(buf);
 +        }
 +        return -ENOMEM;
 +    }
 +
 +    nfs_set_events(client);
 +    while (!task.complete) {
 +        qemu_coroutine_yield();
 +    }
 +
 +    if (my_buffer) {
          g_free(buf);
 -        return -ENOMEM;
      }
 -    nfs_set_events(client);
 -    while (!task.complete) {
 -        qemu_coroutine_yield();
 -    }
 -
 -    g_free(buf);
 -
      if (task.ret != bytes) {
          return task.ret < 0 ? task.ret : -EIO;
      }
 --
-.9.3
+.25.3

-[Qemu-devel] [PULL 1/3] block/nfs: convert to preadv / pwritev
+[PULL 5/8] tests/fuzz: Extract pciconfig_fuzz_qos() method
-From: Peter Lieven <pl@kamp.de>
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
-Signed-off-by: Peter Lieven <pl@kamp.de>
+Extract the generic pciconfig_fuzz_qos() method from
-Reviewed-by: Jeff Cody <jcody@redhat.com>
+i440fx_fuzz_qos(). This will help to write tests not
-Message-id: 1487349541-10201-2-git-send-email-pl@kamp.de
+specific to the i440FX controller.
-Signed-off-by: Jeff Cody <jcody@redhat.com>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20200514143433.18569-6-philmd@redhat.com
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
- block/nfs.c | 33 +++++++++++++++------------------
+ tests/qtest/fuzz/i440fx_fuzz.c | 20 ++++++++++++++------
-file changed, 15 insertions(+), 18 deletions(-)
+file changed, 14 insertions(+), 6 deletions(-)
-diff --git a/block/nfs.c b/block/nfs.c
+diff --git a/tests/qtest/fuzz/i440fx_fuzz.c b/tests/qtest/fuzz/i440fx_fuzz.c
 index XXXXXXX..XXXXXXX 100644
---- a/block/nfs.c
+--- a/tests/qtest/fuzz/i440fx_fuzz.c
-+++ b/block/nfs.c
++++ b/tests/qtest/fuzz/i440fx_fuzz.c
-@@ -XXX,XX +XXX,XX @@ nfs_co_generic_cb(int ret, struct nfs_context *nfs, void *data,
+@@ -XXX,XX +XXX,XX @@ static void i440fx_fuzz_qtest(QTestState *s,
-                             nfs_co_generic_bh_cb, task);
+     flush_events(s);
  }
--static int coroutine_fn nfs_co_readv(BlockDriverState *bs,
+-static void i440fx_fuzz_qos(QTestState *s,
--                                     int64_t sector_num, int nb_sectors,
++static void pciconfig_fuzz_qos(QTestState *s, QPCIBus *bus,
--                                     QEMUIOVector *iov)
+         const unsigned char *Data, size_t Size) {
-+static int coroutine_fn nfs_co_preadv(BlockDriverState *bs, uint64_t offset,
+     /*
-+                                      uint64_t bytes, QEMUIOVector *iov,
+      * Same as i440fx_fuzz_qtest, but using QOS. devfn is incorporated into the
-+                                      int flags)
+@@ -XXX,XX +XXX,XX @@ static void i440fx_fuzz_qos(QTestState *s,
- {
+         uint32_t value;
-     NFSClient *client = bs->opaque;
+     } a;
-     NFSRPC task;
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn nfs_co_readv(BlockDriverState *bs,
+-    static QPCIBus *bus;
-     task.iov = iov;
+-    if (!bus) {
+-        bus = qpci_new_pc(s, fuzz_qos_alloc);
-     if (nfs_pread_async(client->context, client->fh,
+-    }
--                        sector_num * BDRV_SECTOR_SIZE,
+-
--                        nb_sectors * BDRV_SECTOR_SIZE,
+     while (Size >= sizeof(a)) {
--                        nfs_co_generic_cb, &task) != 0) {
+         memcpy(&a, Data, sizeof(a));
-+                        offset, bytes, nfs_co_generic_cb, &task) != 0) {
+         switch (a.opcode % ACTION_MAX) {
-         return -ENOMEM;
+@@ -XXX,XX +XXX,XX @@ static void i440fx_fuzz_qos(QTestState *s,
-     }
+     flush_events(s);
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn nfs_co_readv(BlockDriverState *bs,
      return 0;
  }
--static int coroutine_fn nfs_co_writev(BlockDriverState *bs,
++static void i440fx_fuzz_qos(QTestState *s,
--                                        int64_t sector_num, int nb_sectors,
++                            const unsigned char *Data,
--                                        QEMUIOVector *iov)
++                            size_t Size)
-+static int coroutine_fn nfs_co_pwritev(BlockDriverState *bs, uint64_t offset,
++{
-+                                       uint64_t bytes, QEMUIOVector *iov,
++    static QPCIBus *bus;
-+                                       int flags)
++
- {
++    if (!bus) {
-     NFSClient *client = bs->opaque;
++        bus = qpci_new_pc(s, fuzz_qos_alloc);
-     NFSRPC task;
++    }
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn nfs_co_writev(BlockDriverState *bs,
++
++    pciconfig_fuzz_qos(s, bus, Data, Size);
-     nfs_co_init_task(bs, &task);
++}
++
--    buf = g_try_malloc(nb_sectors * BDRV_SECTOR_SIZE);
+ static void i440fx_fuzz_qos_fork(QTestState *s,
--    if (nb_sectors && buf == NULL) {
+         const unsigned char *Data, size_t Size) {
-+    buf = g_try_malloc(bytes);
+     if (fork() == 0) {
 +    if (bytes && buf == NULL) {
          return -ENOMEM;
      }
 -    qemu_iovec_to_buf(iov, 0, buf, nb_sectors * BDRV_SECTOR_SIZE);
 +    qemu_iovec_to_buf(iov, 0, buf, bytes);
      if (nfs_pwrite_async(client->context, client->fh,
 -                         sector_num * BDRV_SECTOR_SIZE,
 -                         nb_sectors * BDRV_SECTOR_SIZE,
 -                         buf, nfs_co_generic_cb, &task) != 0) {
 +                         offset, bytes, buf,
 +                         nfs_co_generic_cb, &task) != 0) {
          g_free(buf);
          return -ENOMEM;
      }
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn nfs_co_writev(BlockDriverState *bs,
      g_free(buf);
 -    if (task.ret != nb_sectors * BDRV_SECTOR_SIZE) {
 +    if (task.ret != bytes) {
          return task.ret < 0 ? task.ret : -EIO;
      }
@@ -XXX,XX +XXX,XX @@ static BlockDriver bdrv_nfs = {
      .bdrv_create                    = nfs_file_create,
      .bdrv_reopen_prepare            = nfs_reopen_prepare,
 -    .bdrv_co_readv                  = nfs_co_readv,
 -    .bdrv_co_writev                 = nfs_co_writev,
 +    .bdrv_co_preadv                 = nfs_co_preadv,
 +    .bdrv_co_pwritev                = nfs_co_pwritev,
      .bdrv_co_flush_to_disk          = nfs_co_flush,
      .bdrv_detach_aio_context        = nfs_detach_aio_context,
 --
-.9.3
+.25.3

-New patch
+[PULL 6/8] tests/fuzz: Extract ioport_fuzz_qtest() method
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
+Extract generic ioport_fuzz_qtest() method from
+i440fx_fuzz_qtest(). This will help to write tests
+not specific to the i440FX controller.
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20200514143433.18569-7-philmd@redhat.com
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ tests/qtest/fuzz/i440fx_fuzz.c | 11 +++++++++--
+file changed, 9 insertions(+), 2 deletions(-)
+diff --git a/tests/qtest/fuzz/i440fx_fuzz.c b/tests/qtest/fuzz/i440fx_fuzz.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/qtest/fuzz/i440fx_fuzz.c
++++ b/tests/qtest/fuzz/i440fx_fuzz.c
+@@ -XXX,XX +XXX,XX @@ enum action_id {
+     ACTION_MAX
+ };
+-static void i440fx_fuzz_qtest(QTestState *s,
++static void ioport_fuzz_qtest(QTestState *s,
+         const unsigned char *Data, size_t Size) {
+     /*
+      * loop over the Data, breaking it up into actions. each action has an
+@@ -XXX,XX +XXX,XX @@ static void i440fx_fuzz_qtest(QTestState *s,
+     flush_events(s);
+ }
++static void i440fx_fuzz_qtest(QTestState *s,
++                              const unsigned char *Data,
++                              size_t Size)
++{
++    ioport_fuzz_qtest(s, Data, Size);
++}
++
+ static void pciconfig_fuzz_qos(QTestState *s, QPCIBus *bus,
+         const unsigned char *Data, size_t Size) {
+     /*
+-     * Same as i440fx_fuzz_qtest, but using QOS. devfn is incorporated into the
++     * Same as ioport_fuzz_qtest, but using QOS. devfn is incorporated into the
+      * value written over Port IO
+      */
+     struct {
+--
+.25.3

-New patch
+[PULL 7/8] aio-posix: don't duplicate fd handler deletion in fdmon_io_uring_destroy()
+The io_uring file descriptor monitoring implementation has an internal
+list of fd handlers that are pending submission to io_uring.
+fdmon_io_uring_destroy() deletes all fd handlers on the list.
+Don't delete fd handlers directly in fdmon_io_uring_destroy() for two
+reasons:
+. This duplicates the aio-posix.c AioHandler deletion code and could
+   become outdated if the struct changes.
+. Only handlers with the FDMON_IO_URING_REMOVE flag set are safe to
+   remove. If the flag is not set then something still has a pointer to
+   the fd handler. Let aio-posix.c and its user worry about that. In
+   practice this isn't an issue because fdmon_io_uring_destroy() is only
+   called when shutting down so all users have removed their fd
+   handlers, but the next patch will need this!
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Tested-by: Oleksandr Natalenko <oleksandr@redhat.com>
+Message-id: 20200511183630.279750-2-stefanha@redhat.com
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ util/aio-posix.c      |  1 +
+ util/fdmon-io_uring.c | 13 ++++++++++---
+files changed, 11 insertions(+), 3 deletions(-)
+diff --git a/util/aio-posix.c b/util/aio-posix.c
+index XXXXXXX..XXXXXXX 100644
+--- a/util/aio-posix.c
++++ b/util/aio-posix.c
+@@ -XXX,XX +XXX,XX @@ void aio_context_destroy(AioContext *ctx)
+ {
+     fdmon_io_uring_destroy(ctx);
+     fdmon_epoll_disable(ctx);
++    aio_free_deleted_handlers(ctx);
+ }
+ void aio_context_set_poll_params(AioContext *ctx, int64_t max_ns,
+diff --git a/util/fdmon-io_uring.c b/util/fdmon-io_uring.c
+index XXXXXXX..XXXXXXX 100644
+--- a/util/fdmon-io_uring.c
++++ b/util/fdmon-io_uring.c
+@@ -XXX,XX +XXX,XX @@ void fdmon_io_uring_destroy(AioContext *ctx)
+         io_uring_queue_exit(&ctx->fdmon_io_uring);
+-        /* No need to submit these anymore, just free them. */
++        /* Move handlers due to be removed onto the deleted list */
+         while ((node = QSLIST_FIRST_RCU(&ctx->submit_list))) {
++            unsigned flags = atomic_fetch_and(&node->flags,
++                    ~(FDMON_IO_URING_PENDING |
++                      FDMON_IO_URING_ADD |
++                      FDMON_IO_URING_REMOVE));
++
++            if (flags & FDMON_IO_URING_REMOVE) {
++                QLIST_INSERT_HEAD_RCU(&ctx->deleted_aio_handlers, node, node_deleted);
++            }
++
+             QSLIST_REMOVE_HEAD_RCU(&ctx->submit_list, node_submitted);
+-            QLIST_REMOVE(node, node);
+-            g_free(node);
+         }
+         ctx->fdmon_ops = &fdmon_poll_ops;
+--
+.25.3

-[Qemu-devel] [PULL 3/3] RBD: Add support readv,writev for rbd
+[PULL 8/8] aio-posix: disable fdmon-io_uring when GSource is used
-From: tianqing <tianqing@unitedstack.com>
+The glib event loop does not call fdmon_io_uring_wait() so fd handlers
 waiting to be submitted build up in the list. There is no benefit is
 using io_uring when the glib GSource is being used, so disable it
 instead of implementing a more complex fix.
-Rbd can do readv and writev directly, so wo do not need to transform
+This fixes a memory leak where AioHandlers would build up and increasing
-iov to buf or vice versa any more.
+amounts of CPU time were spent iterating them in aio_pending(). The
 symptom is that guests become slow when QEMU is built with io_uring
 support.
-Signed-off-by: tianqing <tianqing@unitedstack.com>
+Buglink: https://bugs.launchpad.net/qemu/+bug/1877716
-Reviewed-by: Jeff Cody <jcody@redhat.com>
+Fixes: 73fd282e7b6dd4e4ea1c3bbb3d302c8db51e4ccf ("aio-posix: add io_uring fd monitoring implementation")
-Signed-off-by: Jeff Cody <jcody@redhat.com>
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Tested-by: Oleksandr Natalenko <oleksandr@redhat.com>
 Message-id: 20200511183630.279750-3-stefanha@redhat.com
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
- block/rbd.c | 80 ++++++++++++++++++++++++++++++++++++++++++-------------------
+ include/block/aio.h |  3 +++
-file changed, 56 insertions(+), 24 deletions(-)
+ util/aio-posix.c    | 12 ++++++++++++
  util/aio-win32.c    |  4 ++++
  util/async.c        |  1 +
 files changed, 20 insertions(+)
-diff --git a/block/rbd.c b/block/rbd.c
+diff --git a/include/block/aio.h b/include/block/aio.h
 index XXXXXXX..XXXXXXX 100644
---- a/block/rbd.c
+--- a/include/block/aio.h
-+++ b/block/rbd.c
++++ b/include/block/aio.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ void aio_context_setup(AioContext *ctx);
- #define RBD_MAX_SNAP_NAME_SIZE 128
+  */
- #define RBD_MAX_SNAPS 100
+ void aio_context_destroy(AioContext *ctx);
-+/* The LIBRBD_SUPPORTS_IOVEC is defined in librbd.h */
++/* Used internally, do not call outside AioContext code */
-+#ifdef LIBRBD_SUPPORTS_IOVEC
++void aio_context_use_g_source(AioContext *ctx);
 +#define LIBRBD_USE_IOVEC 1
 +#else
 +#define LIBRBD_USE_IOVEC 0
 +#endif
 +
- typedef enum {
+ /**
-     RBD_AIO_READ,
+  * aio_context_set_poll_params:
-     RBD_AIO_WRITE,
+  * @ctx: the aio context
-@@ -XXX,XX +XXX,XX @@ static int qemu_rbd_set_conf(rados_t cluster, const char *conf,
+diff --git a/util/aio-posix.c b/util/aio-posix.c
-     return ret;
+index XXXXXXX..XXXXXXX 100644
 --- a/util/aio-posix.c
 +++ b/util/aio-posix.c
@@ -XXX,XX +XXX,XX @@ void aio_context_destroy(AioContext *ctx)
      aio_free_deleted_handlers(ctx);
  }
-+static void qemu_rbd_memset(RADOSCB *rcb, int64_t offs)
++void aio_context_use_g_source(AioContext *ctx)
 +{
-+    if (LIBRBD_USE_IOVEC) {
++    /*
-+        RBDAIOCB *acb = rcb->acb;
++     * Disable io_uring when the glib main loop is used because it doesn't
-+        iov_memset(acb->qiov->iov, acb->qiov->niov, offs, 0,
++     * support mixed glib/aio_poll() usage. It relies on aio_poll() being
-+                   acb->qiov->size - offs);
++     * called regularly so that changes to the monitored file descriptors are
-+    } else {
++     * submitted, otherwise a list of pending fd handlers builds up.
-+        memset(rcb->buf + offs, 0, rcb->size - offs);
++     */
-+    }
++    fdmon_io_uring_destroy(ctx);
 +    aio_free_deleted_handlers(ctx);
 +}
 +
- static int qemu_rbd_create(const char *filename, QemuOpts *opts, Error **errp)
+ void aio_context_set_poll_params(AioContext *ctx, int64_t max_ns,
                                   int64_t grow, int64_t shrink, Error **errp)
  {
-     Error *local_err = NULL;
+diff --git a/util/aio-win32.c b/util/aio-win32.c
-@@ -XXX,XX +XXX,XX @@ static void qemu_rbd_complete_aio(RADOSCB *rcb)
+index XXXXXXX..XXXXXXX 100644
-         }
+--- a/util/aio-win32.c
-     } else {
++++ b/util/aio-win32.c
-         if (r < 0) {
+@@ -XXX,XX +XXX,XX @@ void aio_context_destroy(AioContext *ctx)
--            memset(rcb->buf, 0, rcb->size);
+ {
-+            qemu_rbd_memset(rcb, 0);
+ }
-             acb->ret = r;
-             acb->error = 1;
++void aio_context_use_g_source(AioContext *ctx)
-         } else if (r < rcb->size) {
++{
--            memset(rcb->buf + r, 0, rcb->size - r);
++}
 +            qemu_rbd_memset(rcb, r);
              if (!acb->error) {
                  acb->ret = rcb->size;
              }
@@ -XXX,XX +XXX,XX @@ static void qemu_rbd_complete_aio(RADOSCB *rcb)
      g_free(rcb);
 -    if (acb->cmd == RBD_AIO_READ) {
 -        qemu_iovec_from_buf(acb->qiov, 0, acb->bounce, acb->qiov->size);
 +    if (!LIBRBD_USE_IOVEC) {
 +        if (acb->cmd == RBD_AIO_READ) {
 +            qemu_iovec_from_buf(acb->qiov, 0, acb->bounce, acb->qiov->size);
 +        }
 +        qemu_vfree(acb->bounce);
      }
 -    qemu_vfree(acb->bounce);
 +
-     acb->common.cb(acb->common.opaque, (acb->ret > 0 ? 0 : acb->ret));
+ void aio_context_set_poll_params(AioContext *ctx, int64_t max_ns,
+                                  int64_t grow, int64_t shrink, Error **errp)
-     qemu_aio_unref(acb);
+ {
-@@ -XXX,XX +XXX,XX @@ static BlockAIOCB *rbd_start_aio(BlockDriverState *bs,
+diff --git a/util/async.c b/util/async.c
-     RBDAIOCB *acb;
+index XXXXXXX..XXXXXXX 100644
-     RADOSCB *rcb = NULL;
+--- a/util/async.c
-     rbd_completion_t c;
++++ b/util/async.c
--    char *buf;
+@@ -XXX,XX +XXX,XX @@ static GSourceFuncs aio_source_funcs = {
-     int r;
+ GSource *aio_get_g_source(AioContext *ctx)
-     BDRVRBDState *s = bs->opaque;
+ {
-@@ -XXX,XX +XXX,XX @@ static BlockAIOCB *rbd_start_aio(BlockDriverState *bs,
++    aio_context_use_g_source(ctx);
-     acb->cmd = cmd;
+     g_source_ref(&ctx->source);
-     acb->qiov = qiov;
+     return &ctx->source;
      assert(!qiov || qiov->size == size);
 -    if (cmd == RBD_AIO_DISCARD || cmd == RBD_AIO_FLUSH) {
 -        acb->bounce = NULL;
 -    } else {
 -        acb->bounce = qemu_try_blockalign(bs, qiov->size);
 -        if (acb->bounce == NULL) {
 -            goto failed;
 +
 +    rcb = g_new(RADOSCB, 1);
 +
 +    if (!LIBRBD_USE_IOVEC) {
 +        if (cmd == RBD_AIO_DISCARD || cmd == RBD_AIO_FLUSH) {
 +            acb->bounce = NULL;
 +        } else {
 +            acb->bounce = qemu_try_blockalign(bs, qiov->size);
 +            if (acb->bounce == NULL) {
 +                goto failed;
 +            }
          }
 +        if (cmd == RBD_AIO_WRITE) {
 +            qemu_iovec_to_buf(acb->qiov, 0, acb->bounce, qiov->size);
 +        }
 +        rcb->buf = acb->bounce;
      }
 +
      acb->ret = 0;
      acb->error = 0;
      acb->s = s;
 -    if (cmd == RBD_AIO_WRITE) {
 -        qemu_iovec_to_buf(acb->qiov, 0, acb->bounce, qiov->size);
 -    }
 -
 -    buf = acb->bounce;
 -
 -    rcb = g_new(RADOSCB, 1);
      rcb->acb = acb;
 -    rcb->buf = buf;
      rcb->s = acb->s;
      rcb->size = size;
      r = rbd_aio_create_completion(rcb, (rbd_callback_t) rbd_finish_aiocb, &c);
@@ -XXX,XX +XXX,XX @@ static BlockAIOCB *rbd_start_aio(BlockDriverState *bs,
      switch (cmd) {
      case RBD_AIO_WRITE:
 -        r = rbd_aio_write(s->image, off, size, buf, c);
 +#ifdef LIBRBD_SUPPORTS_IOVEC
 +            r = rbd_aio_writev(s->image, qiov->iov, qiov->niov, off, c);
 +#else
 +            r = rbd_aio_write(s->image, off, size, rcb->buf, c);
 +#endif
          break;
      case RBD_AIO_READ:
 -        r = rbd_aio_read(s->image, off, size, buf, c);
 +#ifdef LIBRBD_SUPPORTS_IOVEC
 +            r = rbd_aio_readv(s->image, qiov->iov, qiov->niov, off, c);
 +#else
 +            r = rbd_aio_read(s->image, off, size, rcb->buf, c);
 +#endif
          break;
      case RBD_AIO_DISCARD:
          r = rbd_aio_discard_wrapper(s->image, off, size, c);
@@ -XXX,XX +XXX,XX @@ static BlockAIOCB *rbd_start_aio(BlockDriverState *bs,
      if (r < 0) {
          goto failed_completion;
      }
 -
      return &acb->common;
  failed_completion:
      rbd_aio_release(c);
  failed:
      g_free(rcb);
 -    qemu_vfree(acb->bounce);
 +    if (!LIBRBD_USE_IOVEC) {
 +        qemu_vfree(acb->bounce);
 +    }
 +
      qemu_aio_unref(acb);
      return NULL;
  }
 --
-.9.3
+.25.3

From: Peter Lieven <pl@kamp.de>

Signed-off-by: Peter Lieven <pl@kamp.de>
Reviewed-by: Jeff Cody <jcody@redhat.com>
Message-id: 1487349541-10201-2-git-send-email-pl@kamp.de
Signed-off-by: Jeff Cody <jcody@redhat.com>
---
 block/nfs.c | 33 +++++++++++++++------------------
 1 file changed, 15 insertions(+), 18 deletions(-)

diff --git a/block/nfs.c b/block/nfs.c
index XXXXXXX..XXXXXXX 100644
--- a/block/nfs.c
+++ b/block/nfs.c
@@ -XXX,XX +XXX,XX @@ nfs_co_generic_cb(int ret, struct nfs_context *nfs, void *data,
                             nfs_co_generic_bh_cb, task);
 }
 
-static int coroutine_fn nfs_co_readv(BlockDriverState *bs,
-                                     int64_t sector_num, int nb_sectors,
-                                     QEMUIOVector *iov)
+static int coroutine_fn nfs_co_preadv(BlockDriverState *bs, uint64_t offset,
+                                      uint64_t bytes, QEMUIOVector *iov,
+                                      int flags)
 {
     NFSClient *client = bs->opaque;
     NFSRPC task;
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn nfs_co_readv(BlockDriverState *bs,
     task.iov = iov;
 
     if (nfs_pread_async(client->context, client->fh,
-                        sector_num * BDRV_SECTOR_SIZE,
-                        nb_sectors * BDRV_SECTOR_SIZE,
-                        nfs_co_generic_cb, &task) != 0) {
+                        offset, bytes, nfs_co_generic_cb, &task) != 0) {
         return -ENOMEM;
     }
 
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn nfs_co_readv(BlockDriverState *bs,
     return 0;
 }
 
-static int coroutine_fn nfs_co_writev(BlockDriverState *bs,
-                                        int64_t sector_num, int nb_sectors,
-                                        QEMUIOVector *iov)
+static int coroutine_fn nfs_co_pwritev(BlockDriverState *bs, uint64_t offset,
+                                       uint64_t bytes, QEMUIOVector *iov,
+                                       int flags)
 {
     NFSClient *client = bs->opaque;
     NFSRPC task;
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn nfs_co_writev(BlockDriverState *bs,
 
     nfs_co_init_task(bs, &task);
 
-    buf = g_try_malloc(nb_sectors * BDRV_SECTOR_SIZE);
-    if (nb_sectors && buf == NULL) {
+    buf = g_try_malloc(bytes);
+    if (bytes && buf == NULL) {
         return -ENOMEM;
     }
 
-    qemu_iovec_to_buf(iov, 0, buf, nb_sectors * BDRV_SECTOR_SIZE);
+    qemu_iovec_to_buf(iov, 0, buf, bytes);
 
     if (nfs_pwrite_async(client->context, client->fh,
-                         sector_num * BDRV_SECTOR_SIZE,
-                         nb_sectors * BDRV_SECTOR_SIZE,
-                         buf, nfs_co_generic_cb, &task) != 0) {
+                         offset, bytes, buf,
+                         nfs_co_generic_cb, &task) != 0) {
         g_free(buf);
         return -ENOMEM;
     }
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn nfs_co_writev(BlockDriverState *bs,
 
     g_free(buf);
 
-    if (task.ret != nb_sectors * BDRV_SECTOR_SIZE) {
+    if (task.ret != bytes) {
         return task.ret < 0 ? task.ret : -EIO;
     }
 
@@ -XXX,XX +XXX,XX @@ static BlockDriver bdrv_nfs = {
     .bdrv_create                    = nfs_file_create,
     .bdrv_reopen_prepare            = nfs_reopen_prepare,
 
-    .bdrv_co_readv                  = nfs_co_readv,
-    .bdrv_co_writev                 = nfs_co_writev,
+    .bdrv_co_preadv                 = nfs_co_preadv,
+    .bdrv_co_pwritev                = nfs_co_pwritev,
     .bdrv_co_flush_to_disk          = nfs_co_flush,
 
     .bdrv_detach_aio_context        = nfs_detach_aio_context,
-- 
2.9.3

From: Peter Lieven <pl@kamp.de>

if the passed qiov contains exactly one iov we can
pass the buffer directly.

Signed-off-by: Peter Lieven <pl@kamp.de>
Reviewed-by: Jeff Cody <jcody@redhat.com>
Message-id: 1487349541-10201-3-git-send-email-pl@kamp.de
Signed-off-by: Jeff Cody <jcody@redhat.com>
---
 block/nfs.c | 35 ++++++++++++++++++++++-------------
 1 file changed, 22 insertions(+), 13 deletions(-)

diff --git a/block/nfs.c b/block/nfs.c
index XXXXXXX..XXXXXXX 100644
--- a/block/nfs.c
+++ b/block/nfs.c
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn nfs_co_pwritev(BlockDriverState *bs, uint64_t offset,
     NFSClient *client = bs->opaque;
     NFSRPC task;
     char *buf = NULL;
+    bool my_buffer = false;
 
     nfs_co_init_task(bs, &task);
 
-    buf = g_try_malloc(bytes);
-    if (bytes && buf == NULL) {
-        return -ENOMEM;
+    if (iov->niov != 1) {
+        buf = g_try_malloc(bytes);
+        if (bytes && buf == NULL) {
+            return -ENOMEM;
+        }
+        qemu_iovec_to_buf(iov, 0, buf, bytes);
+        my_buffer = true;
+    } else {
+        buf = iov->iov[0].iov_base;
     }
 
-    qemu_iovec_to_buf(iov, 0, buf, bytes);
-
     if (nfs_pwrite_async(client->context, client->fh,
                          offset, bytes, buf,
                          nfs_co_generic_cb, &task) != 0) {
+        if (my_buffer) {
+            g_free(buf);
+        }
+        return -ENOMEM;
+    }
+
+    nfs_set_events(client);
+    while (!task.complete) {
+        qemu_coroutine_yield();
+    }
+
+    if (my_buffer) {
         g_free(buf);
-        return -ENOMEM;
     }
 
-    nfs_set_events(client);
-    while (!task.complete) {
-        qemu_coroutine_yield();
-    }
-
-    g_free(buf);
-
     if (task.ret != bytes) {
         return task.ret < 0 ? task.ret : -EIO;
     }
-- 
2.9.3

From: tianqing <tianqing@unitedstack.com>

Rbd can do readv and writev directly, so wo do not need to transform
iov to buf or vice versa any more.

Signed-off-by: tianqing <tianqing@unitedstack.com>
Reviewed-by: Jeff Cody <jcody@redhat.com>
Signed-off-by: Jeff Cody <jcody@redhat.com>
---
 block/rbd.c | 80 ++++++++++++++++++++++++++++++++++++++++++-------------------
 1 file changed, 56 insertions(+), 24 deletions(-)

diff --git a/block/rbd.c b/block/rbd.c
index XXXXXXX..XXXXXXX 100644
--- a/block/rbd.c
+++ b/block/rbd.c
@@ -XXX,XX +XXX,XX @@
 #define RBD_MAX_SNAP_NAME_SIZE 128
 #define RBD_MAX_SNAPS 100
 
+/* The LIBRBD_SUPPORTS_IOVEC is defined in librbd.h */
+#ifdef LIBRBD_SUPPORTS_IOVEC
+#define LIBRBD_USE_IOVEC 1
+#else
+#define LIBRBD_USE_IOVEC 0
+#endif
+
 typedef enum {
     RBD_AIO_READ,
     RBD_AIO_WRITE,
@@ -XXX,XX +XXX,XX @@ static int qemu_rbd_set_conf(rados_t cluster, const char *conf,
     return ret;
 }
 
+static void qemu_rbd_memset(RADOSCB *rcb, int64_t offs)
+{
+    if (LIBRBD_USE_IOVEC) {
+        RBDAIOCB *acb = rcb->acb;
+        iov_memset(acb->qiov->iov, acb->qiov->niov, offs, 0,
+                   acb->qiov->size - offs);
+    } else {
+        memset(rcb->buf + offs, 0, rcb->size - offs);
+    }
+}
+
 static int qemu_rbd_create(const char *filename, QemuOpts *opts, Error **errp)
 {
     Error *local_err = NULL;
@@ -XXX,XX +XXX,XX @@ static void qemu_rbd_complete_aio(RADOSCB *rcb)
         }
     } else {
         if (r < 0) {
-            memset(rcb->buf, 0, rcb->size);
+            qemu_rbd_memset(rcb, 0);
             acb->ret = r;
             acb->error = 1;
         } else if (r < rcb->size) {
-            memset(rcb->buf + r, 0, rcb->size - r);
+            qemu_rbd_memset(rcb, r);
             if (!acb->error) {
                 acb->ret = rcb->size;
             }
@@ -XXX,XX +XXX,XX @@ static void qemu_rbd_complete_aio(RADOSCB *rcb)
 
     g_free(rcb);
 
-    if (acb->cmd == RBD_AIO_READ) {
-        qemu_iovec_from_buf(acb->qiov, 0, acb->bounce, acb->qiov->size);
+    if (!LIBRBD_USE_IOVEC) {
+        if (acb->cmd == RBD_AIO_READ) {
+            qemu_iovec_from_buf(acb->qiov, 0, acb->bounce, acb->qiov->size);
+        }
+        qemu_vfree(acb->bounce);
     }
-    qemu_vfree(acb->bounce);
+
     acb->common.cb(acb->common.opaque, (acb->ret > 0 ? 0 : acb->ret));
 
     qemu_aio_unref(acb);
@@ -XXX,XX +XXX,XX @@ static BlockAIOCB *rbd_start_aio(BlockDriverState *bs,
     RBDAIOCB *acb;
     RADOSCB *rcb = NULL;
     rbd_completion_t c;
-    char *buf;
     int r;
 
     BDRVRBDState *s = bs->opaque;
@@ -XXX,XX +XXX,XX @@ static BlockAIOCB *rbd_start_aio(BlockDriverState *bs,
     acb->cmd = cmd;
     acb->qiov = qiov;
     assert(!qiov || qiov->size == size);
-    if (cmd == RBD_AIO_DISCARD || cmd == RBD_AIO_FLUSH) {
-        acb->bounce = NULL;
-    } else {
-        acb->bounce = qemu_try_blockalign(bs, qiov->size);
-        if (acb->bounce == NULL) {
-            goto failed;
+
+    rcb = g_new(RADOSCB, 1);
+
+    if (!LIBRBD_USE_IOVEC) {
+        if (cmd == RBD_AIO_DISCARD || cmd == RBD_AIO_FLUSH) {
+            acb->bounce = NULL;
+        } else {
+            acb->bounce = qemu_try_blockalign(bs, qiov->size);
+            if (acb->bounce == NULL) {
+                goto failed;
+            }
         }
+        if (cmd == RBD_AIO_WRITE) {
+            qemu_iovec_to_buf(acb->qiov, 0, acb->bounce, qiov->size);
+        }
+        rcb->buf = acb->bounce;
     }
+
     acb->ret = 0;
     acb->error = 0;
     acb->s = s;
 
-    if (cmd == RBD_AIO_WRITE) {
-        qemu_iovec_to_buf(acb->qiov, 0, acb->bounce, qiov->size);
-    }
-
-    buf = acb->bounce;
-
-    rcb = g_new(RADOSCB, 1);
     rcb->acb = acb;
-    rcb->buf = buf;
     rcb->s = acb->s;
     rcb->size = size;
     r = rbd_aio_create_completion(rcb, (rbd_callback_t) rbd_finish_aiocb, &c);
@@ -XXX,XX +XXX,XX @@ static BlockAIOCB *rbd_start_aio(BlockDriverState *bs,
 
     switch (cmd) {
     case RBD_AIO_WRITE:
-        r = rbd_aio_write(s->image, off, size, buf, c);
+#ifdef LIBRBD_SUPPORTS_IOVEC
+            r = rbd_aio_writev(s->image, qiov->iov, qiov->niov, off, c);
+#else
+            r = rbd_aio_write(s->image, off, size, rcb->buf, c);
+#endif
         break;
     case RBD_AIO_READ:
-        r = rbd_aio_read(s->image, off, size, buf, c);
+#ifdef LIBRBD_SUPPORTS_IOVEC
+            r = rbd_aio_readv(s->image, qiov->iov, qiov->niov, off, c);
+#else
+            r = rbd_aio_read(s->image, off, size, rcb->buf, c);
+#endif
         break;
     case RBD_AIO_DISCARD:
         r = rbd_aio_discard_wrapper(s->image, off, size, c);
@@ -XXX,XX +XXX,XX @@ static BlockAIOCB *rbd_start_aio(BlockDriverState *bs,
     if (r < 0) {
         goto failed_completion;
     }
-
     return &acb->common;
 
 failed_completion:
     rbd_aio_release(c);
 failed:
     g_free(rcb);
-    qemu_vfree(acb->bounce);
+    if (!LIBRBD_USE_IOVEC) {
+        qemu_vfree(acb->bounce);
+    }
+
     qemu_aio_unref(acb);
     return NULL;
 }
-- 
2.9.3

The following changes since commit 013a18edbbc59cdad019100c7d03c0494642b74c:

Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-2020051=
4' into staging (2020-05-14 16:17:55 +0100)

are available in the Git repository at:

https://github.com/stefanha/qemu.git tags/block-pull-request

for you to fetch changes up to ba607ca8bff4d2c2062902f8355657c865ac7c29:

aio-posix: disable fdmon-io_uring when GSource is used (2020-05-18 18:16:00=
 +0100)

----------------------------------------------------------------
Pull request

----------------------------------------------------------------

Philippe Mathieu-Daud=C3=A9 (6):
  tests/fuzz/Makefile: Do not link code using unavailable devices
  Makefile: List fuzz targets in 'make help'
  tests/fuzz: Add missing space in test description
  tests/fuzz: Remove unuseful/unused typedefs
  tests/fuzz: Extract pciconfig_fuzz_qos() method
  tests/fuzz: Extract ioport_fuzz_qtest() method

Stefan Hajnoczi (2):
  aio-posix: don't duplicate fd handler deletion in
    fdmon_io_uring_destroy()
  aio-posix: disable fdmon-io_uring when GSource is used

--=20
2.25.3

From: Philippe Mathieu-Daudé <philmd@redhat.com>

Some devices availability depends on CONFIG options.
Use these options to only link tests when requested device
is available.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200514143433.18569-2-philmd@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 tests/qtest/fuzz/Makefile.include | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tests/qtest/fuzz/Makefile.include b/tests/qtest/fuzz/Makefile.include
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/fuzz/Makefile.include
+++ b/tests/qtest/fuzz/Makefile.include
@@ -XXX,XX +XXX,XX @@ fuzz-obj-y += tests/qtest/fuzz/fork_fuzz.o
 fuzz-obj-y += tests/qtest/fuzz/qos_fuzz.o
 
 # Targets
-fuzz-obj-y += tests/qtest/fuzz/i440fx_fuzz.o
-fuzz-obj-y += tests/qtest/fuzz/virtio_net_fuzz.o
-fuzz-obj-y += tests/qtest/fuzz/virtio_scsi_fuzz.o
+fuzz-obj-$(CONFIG_PCI_I440FX) += tests/qtest/fuzz/i440fx_fuzz.o
+fuzz-obj-$(CONFIG_VIRTIO_NET) += tests/qtest/fuzz/virtio_net_fuzz.o
+fuzz-obj-$(CONFIG_SCSI) += tests/qtest/fuzz/virtio_scsi_fuzz.o
 
 FUZZ_CFLAGS += -I$(SRC_PATH)/tests -I$(SRC_PATH)/tests/qtest
 
-- 
2.25.3

From: Philippe Mathieu-Daudé <philmd@redhat.com>

List softmmu fuzz targets in 'make help' output:

$ make help
  ...
  Architecture specific targets:
  aarch64-softmmu/all            - Build for aarch64-softmmu
  aarch64-softmmu/fuzz           - Build fuzzer for aarch64-softmmu
  alpha-softmmu/all              - Build for alpha-softmmu
  alpha-softmmu/fuzz             - Build fuzzer for alpha-softmmu
  arm-softmmu/all                - Build for arm-softmmu
  arm-softmmu/fuzz               - Build fuzzer for arm-softmmu
  ...

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200514143433.18569-3-philmd@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 Makefile | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index XXXXXXX..XXXXXXX 100644
--- a/Makefile
+++ b/Makefile
@@ -XXX,XX +XXX,XX @@ endif
 	@$(if $(TARGET_DIRS), \
 		echo 'Architecture specific targets:'; \
 		$(foreach t, $(TARGET_DIRS), \
-		$(call print-help-run,$(t)/all,Build for $(t));) \
+		$(call print-help-run,$(t)/all,Build for $(t)); \
+		$(if $(CONFIG_FUZZ), \
+			$(if $(findstring softmmu,$(t)), \
+				$(call print-help-run,$(t)/fuzz,Build fuzzer for $(t)); \
+		))) \
 		echo '')
 	@$(if $(TOOLS), \
 		echo 'Tools targets:'; \
-- 
2.25.3

From: Philippe Mathieu-Daudé <philmd@redhat.com>

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200514143433.18569-4-philmd@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 tests/qtest/fuzz/i440fx_fuzz.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tests/qtest/fuzz/i440fx_fuzz.c b/tests/qtest/fuzz/i440fx_fuzz.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/fuzz/i440fx_fuzz.c
+++ b/tests/qtest/fuzz/i440fx_fuzz.c
@@ -XXX,XX +XXX,XX @@ static void register_pci_fuzz_targets(void)
     /* Uses simple qtest commands and reboots to reset state */
     fuzz_add_target(&(FuzzTarget){
                 .name = "i440fx-qtest-reboot-fuzz",
-                .description = "Fuzz the i440fx using raw qtest commands and"
+                .description = "Fuzz the i440fx using raw qtest commands and "
                                "rebooting after each run",
                 .get_init_cmdline = i440fx_argv,
                 .fuzz = i440fx_fuzz_qtest});
@@ -XXX,XX +XXX,XX @@ static void register_pci_fuzz_targets(void)
     /* Uses libqos and forks to prevent state leakage */
     fuzz_add_qos_target(&(FuzzTarget){
                 .name = "i440fx-qos-fork-fuzz",
-                .description = "Fuzz the i440fx using raw qtest commands and"
+                .description = "Fuzz the i440fx using raw qtest commands and "
                                "rebooting after each run",
                 .pre_vm_init = &fork_init,
                 .fuzz = i440fx_fuzz_qos_fork,},
@@ -XXX,XX +XXX,XX @@ static void register_pci_fuzz_targets(void)
      */
     fuzz_add_qos_target(&(FuzzTarget){
                 .name = "i440fx-qos-noreset-fuzz",
-                .description = "Fuzz the i440fx using raw qtest commands and"
+                .description = "Fuzz the i440fx using raw qtest commands and "
                                "rebooting after each run",
                 .fuzz = i440fx_fuzz_qos,},
                 "i440FX-pcihost",
-- 
2.25.3

From: Philippe Mathieu-Daudé <philmd@redhat.com>

These typedefs are not used. Use a simple structure,
remote the typedefs.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200514143433.18569-5-philmd@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 tests/qtest/fuzz/i440fx_fuzz.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/tests/qtest/fuzz/i440fx_fuzz.c b/tests/qtest/fuzz/i440fx_fuzz.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/fuzz/i440fx_fuzz.c
+++ b/tests/qtest/fuzz/i440fx_fuzz.c
@@ -XXX,XX +XXX,XX @@ static void i440fx_fuzz_qtest(QTestState *s,
      * loop over the Data, breaking it up into actions. each action has an
      * opcode, address offset and value
      */
-    typedef struct QTestFuzzAction {
+    struct {
         uint8_t opcode;
         uint8_t addr;
         uint32_t value;
-    } QTestFuzzAction;
-    QTestFuzzAction a;
+    } a;
 
     while (Size >= sizeof(a)) {
         /* make a copy of the action so we can normalize the values in-place */
@@ -XXX,XX +XXX,XX @@ static void i440fx_fuzz_qos(QTestState *s,
      * Same as i440fx_fuzz_qtest, but using QOS. devfn is incorporated into the
      * value written over Port IO
      */
-    typedef struct QOSFuzzAction {
+    struct {
         uint8_t opcode;
         uint8_t offset;
         int devfn;
         uint32_t value;
-    } QOSFuzzAction;
+    } a;
 
     static QPCIBus *bus;
     if (!bus) {
         bus = qpci_new_pc(s, fuzz_qos_alloc);
     }
 
-    QOSFuzzAction a;
     while (Size >= sizeof(a)) {
         memcpy(&a, Data, sizeof(a));
         switch (a.opcode % ACTION_MAX) {
-- 
2.25.3

From: Philippe Mathieu-Daudé <philmd@redhat.com>

Extract the generic pciconfig_fuzz_qos() method from
i440fx_fuzz_qos(). This will help to write tests not
specific to the i440FX controller.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200514143433.18569-6-philmd@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 tests/qtest/fuzz/i440fx_fuzz.c | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/tests/qtest/fuzz/i440fx_fuzz.c b/tests/qtest/fuzz/i440fx_fuzz.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/fuzz/i440fx_fuzz.c
+++ b/tests/qtest/fuzz/i440fx_fuzz.c
@@ -XXX,XX +XXX,XX @@ static void i440fx_fuzz_qtest(QTestState *s,
     flush_events(s);
 }
 
-static void i440fx_fuzz_qos(QTestState *s,
+static void pciconfig_fuzz_qos(QTestState *s, QPCIBus *bus,
         const unsigned char *Data, size_t Size) {
     /*
      * Same as i440fx_fuzz_qtest, but using QOS. devfn is incorporated into the
@@ -XXX,XX +XXX,XX @@ static void i440fx_fuzz_qos(QTestState *s,
         uint32_t value;
     } a;
 
-    static QPCIBus *bus;
-    if (!bus) {
-        bus = qpci_new_pc(s, fuzz_qos_alloc);
-    }
-
     while (Size >= sizeof(a)) {
         memcpy(&a, Data, sizeof(a));
         switch (a.opcode % ACTION_MAX) {
@@ -XXX,XX +XXX,XX @@ static void i440fx_fuzz_qos(QTestState *s,
     flush_events(s);
 }
 
+static void i440fx_fuzz_qos(QTestState *s,
+                            const unsigned char *Data,
+                            size_t Size)
+{
+    static QPCIBus *bus;
+
+    if (!bus) {
+        bus = qpci_new_pc(s, fuzz_qos_alloc);
+    }
+
+    pciconfig_fuzz_qos(s, bus, Data, Size);
+}
+
 static void i440fx_fuzz_qos_fork(QTestState *s,
         const unsigned char *Data, size_t Size) {
     if (fork() == 0) {
-- 
2.25.3

From: Philippe Mathieu-Daudé <philmd@redhat.com>

Extract generic ioport_fuzz_qtest() method from
i440fx_fuzz_qtest(). This will help to write tests
not specific to the i440FX controller.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200514143433.18569-7-philmd@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 tests/qtest/fuzz/i440fx_fuzz.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/tests/qtest/fuzz/i440fx_fuzz.c b/tests/qtest/fuzz/i440fx_fuzz.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/fuzz/i440fx_fuzz.c
+++ b/tests/qtest/fuzz/i440fx_fuzz.c
@@ -XXX,XX +XXX,XX @@ enum action_id {
     ACTION_MAX
 };
 
-static void i440fx_fuzz_qtest(QTestState *s,
+static void ioport_fuzz_qtest(QTestState *s,
         const unsigned char *Data, size_t Size) {
     /*
      * loop over the Data, breaking it up into actions. each action has an
@@ -XXX,XX +XXX,XX @@ static void i440fx_fuzz_qtest(QTestState *s,
     flush_events(s);
 }
 
+static void i440fx_fuzz_qtest(QTestState *s,
+                              const unsigned char *Data,
+                              size_t Size)
+{
+    ioport_fuzz_qtest(s, Data, Size);
+}
+
 static void pciconfig_fuzz_qos(QTestState *s, QPCIBus *bus,
         const unsigned char *Data, size_t Size) {
     /*
-     * Same as i440fx_fuzz_qtest, but using QOS. devfn is incorporated into the
+     * Same as ioport_fuzz_qtest, but using QOS. devfn is incorporated into the
      * value written over Port IO
      */
     struct {
-- 
2.25.3

The io_uring file descriptor monitoring implementation has an internal
list of fd handlers that are pending submission to io_uring.
fdmon_io_uring_destroy() deletes all fd handlers on the list.

Don't delete fd handlers directly in fdmon_io_uring_destroy() for two
reasons:
1. This duplicates the aio-posix.c AioHandler deletion code and could
   become outdated if the struct changes.
2. Only handlers with the FDMON_IO_URING_REMOVE flag set are safe to
   remove. If the flag is not set then something still has a pointer to
   the fd handler. Let aio-posix.c and its user worry about that. In
   practice this isn't an issue because fdmon_io_uring_destroy() is only
   called when shutting down so all users have removed their fd
   handlers, but the next patch will need this!

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Tested-by: Oleksandr Natalenko <oleksandr@redhat.com>
Message-id: 20200511183630.279750-2-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 util/aio-posix.c      |  1 +
 util/fdmon-io_uring.c | 13 ++++++++++---
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/util/aio-posix.c b/util/aio-posix.c
index XXXXXXX..XXXXXXX 100644
--- a/util/aio-posix.c
+++ b/util/aio-posix.c
@@ -XXX,XX +XXX,XX @@ void aio_context_destroy(AioContext *ctx)
 {
     fdmon_io_uring_destroy(ctx);
     fdmon_epoll_disable(ctx);
+    aio_free_deleted_handlers(ctx);
 }
 
 void aio_context_set_poll_params(AioContext *ctx, int64_t max_ns,
diff --git a/util/fdmon-io_uring.c b/util/fdmon-io_uring.c
index XXXXXXX..XXXXXXX 100644
--- a/util/fdmon-io_uring.c
+++ b/util/fdmon-io_uring.c
@@ -XXX,XX +XXX,XX @@ void fdmon_io_uring_destroy(AioContext *ctx)
 
         io_uring_queue_exit(&ctx->fdmon_io_uring);
 
-        /* No need to submit these anymore, just free them. */
+        /* Move handlers due to be removed onto the deleted list */
         while ((node = QSLIST_FIRST_RCU(&ctx->submit_list))) {
+            unsigned flags = atomic_fetch_and(&node->flags,
+                    ~(FDMON_IO_URING_PENDING |
+                      FDMON_IO_URING_ADD |
+                      FDMON_IO_URING_REMOVE));
+
+            if (flags & FDMON_IO_URING_REMOVE) {
+                QLIST_INSERT_HEAD_RCU(&ctx->deleted_aio_handlers, node, node_deleted);
+            }
+
             QSLIST_REMOVE_HEAD_RCU(&ctx->submit_list, node_submitted);
-            QLIST_REMOVE(node, node);
-            g_free(node);
         }
 
         ctx->fdmon_ops = &fdmon_poll_ops;
-- 
2.25.3

The glib event loop does not call fdmon_io_uring_wait() so fd handlers
waiting to be submitted build up in the list. There is no benefit is
using io_uring when the glib GSource is being used, so disable it
instead of implementing a more complex fix.

This fixes a memory leak where AioHandlers would build up and increasing
amounts of CPU time were spent iterating them in aio_pending(). The
symptom is that guests become slow when QEMU is built with io_uring
support.

Buglink: https://bugs.launchpad.net/qemu/+bug/1877716
Fixes: 73fd282e7b6dd4e4ea1c3bbb3d302c8db51e4ccf ("aio-posix: add io_uring fd monitoring implementation")
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Tested-by: Oleksandr Natalenko <oleksandr@redhat.com>
Message-id: 20200511183630.279750-3-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 include/block/aio.h |  3 +++
 util/aio-posix.c    | 12 ++++++++++++
 util/aio-win32.c    |  4 ++++
 util/async.c        |  1 +
 4 files changed, 20 insertions(+)

diff --git a/include/block/aio.h b/include/block/aio.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/aio.h
+++ b/include/block/aio.h
@@ -XXX,XX +XXX,XX @@ void aio_context_setup(AioContext *ctx);
  */
 void aio_context_destroy(AioContext *ctx);
 
+/* Used internally, do not call outside AioContext code */
+void aio_context_use_g_source(AioContext *ctx);
+
 /**
  * aio_context_set_poll_params:
  * @ctx: the aio context
diff --git a/util/aio-posix.c b/util/aio-posix.c
index XXXXXXX..XXXXXXX 100644
--- a/util/aio-posix.c
+++ b/util/aio-posix.c
@@ -XXX,XX +XXX,XX @@ void aio_context_destroy(AioContext *ctx)
     aio_free_deleted_handlers(ctx);
 }
 
+void aio_context_use_g_source(AioContext *ctx)
+{
+    /*
+     * Disable io_uring when the glib main loop is used because it doesn't
+     * support mixed glib/aio_poll() usage. It relies on aio_poll() being
+     * called regularly so that changes to the monitored file descriptors are
+     * submitted, otherwise a list of pending fd handlers builds up.
+     */
+    fdmon_io_uring_destroy(ctx);
+    aio_free_deleted_handlers(ctx);
+}
+
 void aio_context_set_poll_params(AioContext *ctx, int64_t max_ns,
                                  int64_t grow, int64_t shrink, Error **errp)
 {
diff --git a/util/aio-win32.c b/util/aio-win32.c
index XXXXXXX..XXXXXXX 100644
--- a/util/aio-win32.c
+++ b/util/aio-win32.c
@@ -XXX,XX +XXX,XX @@ void aio_context_destroy(AioContext *ctx)
 {
 }
 
+void aio_context_use_g_source(AioContext *ctx)
+{
+}
+
 void aio_context_set_poll_params(AioContext *ctx, int64_t max_ns,
                                  int64_t grow, int64_t shrink, Error **errp)
 {
diff --git a/util/async.c b/util/async.c
index XXXXXXX..XXXXXXX 100644
--- a/util/async.c
+++ b/util/async.c
@@ -XXX,XX +XXX,XX @@ static GSourceFuncs aio_source_funcs = {
 
 GSource *aio_get_g_source(AioContext *ctx)
 {
+    aio_context_use_g_source(ctx);
     g_source_ref(&ctx->source);
     return &ctx->source;
 }
-- 
2.25.3