Series comparison

-[Qemu-devel] [PULL 0/4] Block patches
+[PULL 00/23] Block patches
-The following changes since commit d992f2f1368ceb92e6bfd8efece174110f4236ff:
+The following changes since commit 9d662a6b22a0838a85c5432385f35db2488a33a5:
-  Merge remote-tracking branch 'remotes/artyom/tags/pull-sun4v-20170226' into staging (2017-02-26 22:40:23 +0000)
+  Merge remote-tracking branch 'remotes/legoater/tags/pull-ppc-20220305' into staging (2022-03-05 18:03:15 +0000)
-are available in the git repository at:
+are available in the Git repository at:
-  git://github.com/stefanha/qemu.git tags/block-pull-request
+  https://gitlab.com/hreitz/qemu.git tags/pull-block-2022-03-07
-for you to fetch changes up to 1ab17f9f5c63c2798d707aeb22588e4fcc17b2cd:
+for you to fetch changes up to 743da0b401cdc3ee94bc519975e339a3cdbe0ad1:
-  tests-aio-multithread: use atomic_read properly (2017-02-27 14:00:53 +0000)
+  iotests/image-fleecing: test push backup with fleecing (2022-03-07 09:33:31 +0100)
 ----------------------------------------------------------------
+Block patches for 7.0-rc0:
+- New fleecing backup scheme
+- iotest fixes
+- Fixes for the curl block driver
+- Fix for the preallocate block driver
+- IDE fix for zero-length TRIM requests
 ----------------------------------------------------------------
+Hanna Reitz (2):
+  ide: Increment BB in-flight counter for TRIM BH
+  iotests: Write test output to TEST_DIR
-Paolo Bonzini (4):
+Peter Maydell (2):
-  curl: do not use aio_context_acquire/release
+  block/curl.c: Set error message string if curl_init_state() fails
-  nfs: do not use aio_context_acquire/release
+  block/curl.c: Check error return from curl_easy_setopt()
   iscsi: do not use aio_context_acquire/release
   tests-aio-multithread: use atomic_read properly
- block/curl.c                 | 24 ++++++++-----
+Thomas Huth (2):
- block/iscsi.c                | 83 ++++++++++++++++++++++++++++++++++----------
+  tests/qemu-iotests/040: Skip TestCommitWithFilters without 'throttle'
- block/nfs.c                  | 23 +++++++++---
+  tests/qemu-iotests/testrunner: Quote "case not run" lines in TAP mode
- tests/test-aio-multithread.c |  4 +--
-files changed, 100 insertions(+), 34 deletions(-)
+Vladimir Sementsov-Ogievskiy (17):
   block: fix preallocate filter: don't do unaligned preallocate requests
   block/block-copy: move copy_bitmap initialization to
     block_copy_state_new()
   block/dirty-bitmap: bdrv_merge_dirty_bitmap(): add return value
   block/block-copy: block_copy_state_new(): add bitmap parameter
   block/copy-before-write: add bitmap open parameter
   block/block-copy: add block_copy_reset()
   block: intoduce reqlist
   block/reqlist: reqlist_find_conflict(): use ranges_overlap()
   block/dirty-bitmap: introduce bdrv_dirty_bitmap_status()
   block/reqlist: add reqlist_wait_all()
   block/io: introduce block driver snapshot-access API
   block: introduce snapshot-access block driver
   block: copy-before-write: realize snapshot-access API
   iotests/image-fleecing: add test-case for fleecing format node
   iotests.py: add qemu_io_pipe_and_status()
   iotests/image-fleecing: add test case with bitmap
   iotests/image-fleecing: test push backup with fleecing
  qapi/block-core.json                        |  14 +-
  include/block/block-common.h                |   3 +-
  include/block/block-copy.h                  |   2 +
  include/block/block_int-common.h            |  24 ++
  include/block/block_int-io.h                |   9 +
  include/block/dirty-bitmap.h                |   4 +-
  include/block/reqlist.h                     |  75 ++++++
  include/qemu/hbitmap.h                      |  12 +
  block/block-copy.c                          | 150 +++++------
  block/copy-before-write.c                   | 265 +++++++++++++++++++-
  block/curl.c                                |  92 ++++---
  block/dirty-bitmap.c                        |  15 +-
  block/io.c                                  |  76 ++++++
  block/monitor/bitmap-qmp-cmds.c             |   5 +-
  block/preallocate.c                         |  15 +-
  block/reqlist.c                             |  85 +++++++
  block/snapshot-access.c                     | 132 ++++++++++
  hw/ide/core.c                               |   7 +
  util/hbitmap.c                              |  33 +++
  MAINTAINERS                                 |   5 +-
  block/meson.build                           |   2 +
  tests/qemu-iotests/040                      |   1 +
  tests/qemu-iotests/257.out                  | 224 +++++++++++++++++
  tests/qemu-iotests/common.rc                |   6 +-
  tests/qemu-iotests/iotests.py               |   8 +-
  tests/qemu-iotests/testenv.py               |   5 +-
  tests/qemu-iotests/testrunner.py            |  19 +-
  tests/qemu-iotests/tests/image-fleecing     | 185 +++++++++++---
  tests/qemu-iotests/tests/image-fleecing.out | 221 +++++++++++++++-
 files changed, 1499 insertions(+), 195 deletions(-)
  create mode 100644 include/block/reqlist.h
  create mode 100644 block/reqlist.c
  create mode 100644 block/snapshot-access.c
 --
-.9.3
+.34.1

-New patch
+[PULL 01/23] ide: Increment BB in-flight counter for TRIM BH
+When we still have an AIOCB registered for DMA operations, we try to
+settle the respective operation by draining the BlockBackend associated
+with the IDE device.
+However, this assumes that every DMA operation is associated with an
+increment of the BlockBackend’s in-flight counter (e.g. through some
+ongoing I/O operation), so that draining the BB until its in-flight
+counter reaches 0 will settle all DMA operations.  That is not the case:
+For TRIM, the guest can issue a zero-length operation that will not
+result in any I/O operation forwarded to the BlockBackend, and also not
+increment the in-flight counter in any other way.  In such a case,
+blk_drain() will be a no-op if no other operations are in flight.
+It is clear that if blk_drain() is a no-op, the value of
+s->bus->dma->aiocb will not change between checking it in the `if`
+condition and asserting that it is NULL after blk_drain().
+The particular problem is that ide_issue_trim() creates a BH
+(ide_trim_bh_cb()) to settle the TRIM request: iocb->common.cb() is
+ide_dma_cb(), which will either create a new request, or find the
+transfer to be done and call ide_set_inactive(), which clears
+s->bus->dma->aiocb.  Therefore, the blk_drain() must wait for
+ide_trim_bh_cb() to run, which currently it will not always do.
+To fix this issue, we increment the BlockBackend's in-flight counter
+when the TRIM operation begins (in ide_issue_trim(), when the
+ide_trim_bh_cb() BH is created) and decrement it when ide_trim_bh_cb()
+is done.
+Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2029980
+Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+Message-Id: <20220120142259.120189-1-hreitz@redhat.com>
+Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
+Reviewed-by: John Snow <jsnow@redhat.com>
+Tested-by: John Snow <jsnow@redhat.com>
+---
+ hw/ide/core.c | 7 +++++++
+file changed, 7 insertions(+)
+diff --git a/hw/ide/core.c b/hw/ide/core.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/ide/core.c
++++ b/hw/ide/core.c
+@@ -XXX,XX +XXX,XX @@ static const AIOCBInfo trim_aiocb_info = {
+ static void ide_trim_bh_cb(void *opaque)
+ {
+     TrimAIOCB *iocb = opaque;
++    BlockBackend *blk = iocb->s->blk;
+     iocb->common.cb(iocb->common.opaque, iocb->ret);
+     qemu_bh_delete(iocb->bh);
+     iocb->bh = NULL;
+     qemu_aio_unref(iocb);
++
++    /* Paired with an increment in ide_issue_trim() */
++    blk_dec_in_flight(blk);
+ }
+ static void ide_issue_trim_cb(void *opaque, int ret)
+@@ -XXX,XX +XXX,XX @@ BlockAIOCB *ide_issue_trim(
+     IDEState *s = opaque;
+     TrimAIOCB *iocb;
++    /* Paired with a decrement in ide_trim_bh_cb() */
++    blk_inc_in_flight(s->blk);
++
+     iocb = blk_aio_get(&trim_aiocb_info, s->blk, cb, cb_opaque);
+     iocb->s = s;
+     iocb->bh = qemu_bh_new(ide_trim_bh_cb, iocb);
+--
+.34.1

-[Qemu-devel] [PULL 4/4] tests-aio-multithread: use atomic_read properly
+[PULL 02/23] block/curl.c: Set error message string if curl_init_state() fails
-From: Paolo Bonzini <pbonzini@redhat.com>
+From: Peter Maydell <peter.maydell@linaro.org>
-nodes[id].next is written by other threads.  If atomic_read is not used
+In curl_open(), the 'out' label assumes that the state->errmsg string
-(matching atomic_set in mcs_mutex_lock!) the compiler can optimize the
+has been set (either by curl_easy_perform() or by manually copying a
-whole "if" away!
+string into it); however if curl_init_state() fails we will jump to
 that label without setting the string.  Add the missing error string
 setup.
-Reported-by: Alex Bennée <alex.bennee@linaro.org>
+(We can't be specific about the cause of failure: the documentation
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+of curl_easy_init() just says "If this function returns NULL,
-Tested-by: Greg Kurz <groug@kaod.org>
+something went wrong".)
-Message-id: 20170227111726.9237-1-pbonzini@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Message-Id: <20220222152341.850419-2-peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Hanna Reitz <hreitz@redhat.com>
 Signed-off-by: Hanna Reitz <hreitz@redhat.com>
 ---
- tests/test-aio-multithread.c | 4 ++--
+ block/curl.c | 2 ++
-file changed, 2 insertions(+), 2 deletions(-)
+file changed, 2 insertions(+)
-diff --git a/tests/test-aio-multithread.c b/tests/test-aio-multithread.c
+diff --git a/block/curl.c b/block/curl.c
 index XXXXXXX..XXXXXXX 100644
---- a/tests/test-aio-multithread.c
+--- a/block/curl.c
-+++ b/tests/test-aio-multithread.c
++++ b/block/curl.c
-@@ -XXX,XX +XXX,XX @@ static void mcs_mutex_lock(void)
+@@ -XXX,XX +XXX,XX @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags,
- static void mcs_mutex_unlock(void)
+     // Get file size
- {
-     int next;
+     if (curl_init_state(s, state) < 0) {
--    if (nodes[id].next == -1) {
++        pstrcpy(state->errmsg, CURL_ERROR_SIZE,
-+    if (atomic_read(&nodes[id].next) == -1) {
++                "curl library initialization failed.");
-         if (atomic_read(&mutex_head) == id &&
+         goto out;
              atomic_cmpxchg(&mutex_head, id, -1) == id) {
              /* Last item in the list, exit.  */
@@ -XXX,XX +XXX,XX @@ static void mcs_mutex_unlock(void)
      }
-     /* Wake up the next in line.  */
--    next = nodes[id].next;
-+    next = atomic_read(&nodes[id].next);
-     nodes[next].locked = 0;
-     qemu_futex_wake(&nodes[next].locked, 1);
- }
 --
-.9.3
+.34.1

-[Qemu-devel] [PULL 1/4] curl: do not use aio_context_acquire/release
+[PULL 03/23] block/curl.c: Check error return from curl_easy_setopt()
-From: Paolo Bonzini <pbonzini@redhat.com>
+From: Peter Maydell <peter.maydell@linaro.org>
-Now that all bottom halves and callbacks take care of taking the
+Coverity points out that we aren't checking the return value
-AioContext lock, we can migrate some users away from it and to a
+from curl_easy_setopt() for any of the calls to it we make
-specific QemuMutex or CoMutex.
+in block/curl.c.
-Protect BDRVCURLState access with a QemuMutex.
+Some of these options are documented as always succeeding (e.g.
 CURLOPT_VERBOSE) but others have documented failure cases (e.g.
 CURLOPT_URL).  For consistency we check every call, even the ones
 that theoretically cannot fail.
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Fixes: Coverity CID 1459336, 1459482, 1460331
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20170222180725.28611-2-pbonzini@redhat.com
+Message-Id: <20220222152341.850419-3-peter.maydell@linaro.org>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Reviewed-by: Hanna Reitz <hreitz@redhat.com>
 Signed-off-by: Hanna Reitz <hreitz@redhat.com>
 ---
- block/curl.c | 24 +++++++++++++++---------
+ block/curl.c | 90 +++++++++++++++++++++++++++++++++-------------------
-file changed, 15 insertions(+), 9 deletions(-)
+file changed, 57 insertions(+), 33 deletions(-)
 diff --git a/block/curl.c b/block/curl.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/curl.c
 +++ b/block/curl.c
-@@ -XXX,XX +XXX,XX @@ typedef struct BDRVCURLState {
+@@ -XXX,XX +XXX,XX @@ static int curl_init_state(BDRVCURLState *s, CURLState *state)
-     char *cookie;
+         if (!state->curl) {
-     bool accept_range;
+             return -EIO;
-     AioContext *aio_context;
+         }
-+    QemuMutex mutex;
+-        curl_easy_setopt(state->curl, CURLOPT_URL, s->url);
-     char *username;
+-        curl_easy_setopt(state->curl, CURLOPT_SSL_VERIFYPEER,
-     char *password;
+-                         (long) s->sslverify);
-     char *proxyusername;
+-        curl_easy_setopt(state->curl, CURLOPT_SSL_VERIFYHOST,
-@@ -XXX,XX +XXX,XX @@ static int curl_find_buf(BDRVCURLState *s, size_t start, size_t len,
+-                         s->sslverify ? 2L : 0L);
-     return FIND_RET_NONE;
++        if (curl_easy_setopt(state->curl, CURLOPT_URL, s->url) ||
 +            curl_easy_setopt(state->curl, CURLOPT_SSL_VERIFYPEER,
 +                             (long) s->sslverify) ||
 +            curl_easy_setopt(state->curl, CURLOPT_SSL_VERIFYHOST,
 +                             s->sslverify ? 2L : 0L)) {
 +            goto err;
 +        }
          if (s->cookie) {
 -            curl_easy_setopt(state->curl, CURLOPT_COOKIE, s->cookie);
 +            if (curl_easy_setopt(state->curl, CURLOPT_COOKIE, s->cookie)) {
 +                goto err;
 +            }
 +        }
 +        if (curl_easy_setopt(state->curl, CURLOPT_TIMEOUT, (long)s->timeout) ||
 +            curl_easy_setopt(state->curl, CURLOPT_WRITEFUNCTION,
 +                             (void *)curl_read_cb) ||
 +            curl_easy_setopt(state->curl, CURLOPT_WRITEDATA, (void *)state) ||
 +            curl_easy_setopt(state->curl, CURLOPT_PRIVATE, (void *)state) ||
 +            curl_easy_setopt(state->curl, CURLOPT_AUTOREFERER, 1) ||
 +            curl_easy_setopt(state->curl, CURLOPT_FOLLOWLOCATION, 1) ||
 +            curl_easy_setopt(state->curl, CURLOPT_NOSIGNAL, 1) ||
 +            curl_easy_setopt(state->curl, CURLOPT_ERRORBUFFER, state->errmsg) ||
 +            curl_easy_setopt(state->curl, CURLOPT_FAILONERROR, 1)) {
 +            goto err;
          }
 -        curl_easy_setopt(state->curl, CURLOPT_TIMEOUT, (long)s->timeout);
 -        curl_easy_setopt(state->curl, CURLOPT_WRITEFUNCTION,
 -                         (void *)curl_read_cb);
 -        curl_easy_setopt(state->curl, CURLOPT_WRITEDATA, (void *)state);
 -        curl_easy_setopt(state->curl, CURLOPT_PRIVATE, (void *)state);
 -        curl_easy_setopt(state->curl, CURLOPT_AUTOREFERER, 1);
 -        curl_easy_setopt(state->curl, CURLOPT_FOLLOWLOCATION, 1);
 -        curl_easy_setopt(state->curl, CURLOPT_NOSIGNAL, 1);
 -        curl_easy_setopt(state->curl, CURLOPT_ERRORBUFFER, state->errmsg);
 -        curl_easy_setopt(state->curl, CURLOPT_FAILONERROR, 1);
 -
          if (s->username) {
 -            curl_easy_setopt(state->curl, CURLOPT_USERNAME, s->username);
 +            if (curl_easy_setopt(state->curl, CURLOPT_USERNAME, s->username)) {
 +                goto err;
 +            }
          }
          if (s->password) {
 -            curl_easy_setopt(state->curl, CURLOPT_PASSWORD, s->password);
 +            if (curl_easy_setopt(state->curl, CURLOPT_PASSWORD, s->password)) {
 +                goto err;
 +            }
          }
          if (s->proxyusername) {
 -            curl_easy_setopt(state->curl,
 -                             CURLOPT_PROXYUSERNAME, s->proxyusername);
 +            if (curl_easy_setopt(state->curl,
 +                                 CURLOPT_PROXYUSERNAME, s->proxyusername)) {
 +                goto err;
 +            }
          }
          if (s->proxypassword) {
 -            curl_easy_setopt(state->curl,
 -                             CURLOPT_PROXYPASSWORD, s->proxypassword);
 +            if (curl_easy_setopt(state->curl,
 +                                 CURLOPT_PROXYPASSWORD, s->proxypassword)) {
 +                goto err;
 +            }
          }
          /* Restrict supported protocols to avoid security issues in the more
@@ -XXX,XX +XXX,XX @@ static int curl_init_state(BDRVCURLState *s, CURLState *state)
           * Restricting protocols is only supported from 7.19.4 upwards.
           */
  #if LIBCURL_VERSION_NUM >= 0x071304
 -        curl_easy_setopt(state->curl, CURLOPT_PROTOCOLS, PROTOCOLS);
 -        curl_easy_setopt(state->curl, CURLOPT_REDIR_PROTOCOLS, PROTOCOLS);
 +        if (curl_easy_setopt(state->curl, CURLOPT_PROTOCOLS, PROTOCOLS) ||
 +            curl_easy_setopt(state->curl, CURLOPT_REDIR_PROTOCOLS, PROTOCOLS)) {
 +            goto err;
 +        }
  #endif
  #ifdef DEBUG_VERBOSE
 -        curl_easy_setopt(state->curl, CURLOPT_VERBOSE, 1);
 +        if (curl_easy_setopt(state->curl, CURLOPT_VERBOSE, 1)) {
 +            goto err;
 +        }
  #endif
      }
      state->s = s;
      return 0;
 +
 +err:
 +    curl_easy_cleanup(state->curl);
 +    state->curl = NULL;
 +    return -EIO;
  }
-+/* Called with s->mutex held.  */
+ /* Called with s->mutex held.  */
- static void curl_multi_check_completion(BDRVCURLState *s)
+@@ -XXX,XX +XXX,XX @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags,
  {
      int msgs_in_queue;
@@ -XXX,XX +XXX,XX @@ static void curl_multi_check_completion(BDRVCURLState *s)
                          continue;
                      }
 +                    qemu_mutex_unlock(&s->mutex);
                      acb->common.cb(acb->common.opaque, -EPROTO);
 +                    qemu_mutex_lock(&s->mutex);
                      qemu_aio_unref(acb);
                      state->acb[i] = NULL;
                  }
@@ -XXX,XX +XXX,XX @@ static void curl_multi_check_completion(BDRVCURLState *s)
      }
- }
+     s->accept_range = false;
-+/* Called with s->mutex held.  */
+-    curl_easy_setopt(state->curl, CURLOPT_NOBODY, 1);
- static void curl_multi_do_locked(CURLState *s)
+-    curl_easy_setopt(state->curl, CURLOPT_HEADERFUNCTION,
- {
+-                     curl_header_cb);
-     CURLSocket *socket, *next_socket;
+-    curl_easy_setopt(state->curl, CURLOPT_HEADERDATA, s);
-@@ -XXX,XX +XXX,XX @@ static void curl_multi_do(void *arg)
++    if (curl_easy_setopt(state->curl, CURLOPT_NOBODY, 1) ||
- {
++        curl_easy_setopt(state->curl, CURLOPT_HEADERFUNCTION, curl_header_cb) ||
-     CURLState *s = (CURLState *)arg;
++        curl_easy_setopt(state->curl, CURLOPT_HEADERDATA, s)) {
++        pstrcpy(state->errmsg, CURL_ERROR_SIZE,
--    aio_context_acquire(s->s->aio_context);
++                "curl library initialization failed.");
-+    qemu_mutex_lock(&s->s->mutex);
++        goto out;
-     curl_multi_do_locked(s);
++    }
--    aio_context_release(s->s->aio_context);
+     if (curl_easy_perform(state->curl))
-+    qemu_mutex_unlock(&s->s->mutex);
+         goto out;
- }
+     if (curl_easy_getinfo(state->curl, CURLINFO_CONTENT_LENGTH_DOWNLOAD, &d)) {
+@@ -XXX,XX +XXX,XX @@ static void curl_setup_preadv(BlockDriverState *bs, CURLAIOCB *acb)
- static void curl_multi_read(void *arg)
- {
+     snprintf(state->range, 127, "%" PRIu64 "-%" PRIu64, start, end);
-     CURLState *s = (CURLState *)arg;
+     trace_curl_setup_preadv(acb->bytes, start, state->range);
+-    curl_easy_setopt(state->curl, CURLOPT_RANGE, state->range);
--    aio_context_acquire(s->s->aio_context);
+-
-+    qemu_mutex_lock(&s->s->mutex);
+-    if (curl_multi_add_handle(s->multi, state->curl) != CURLM_OK) {
-     curl_multi_do_locked(s);
++    if (curl_easy_setopt(state->curl, CURLOPT_RANGE, state->range) ||
-     curl_multi_check_completion(s->s);
++        curl_multi_add_handle(s->multi, state->curl) != CURLM_OK) {
--    aio_context_release(s->s->aio_context);
+         state->acb[0] = NULL;
-+    qemu_mutex_unlock(&s->s->mutex);
+         acb->ret = -EIO;
- }
  static void curl_multi_timeout_do(void *arg)
@@ -XXX,XX +XXX,XX @@ static void curl_multi_timeout_do(void *arg)
          return;
      }
 -    aio_context_acquire(s->aio_context);
 +    qemu_mutex_lock(&s->mutex);
      curl_multi_socket_action(s->multi, CURL_SOCKET_TIMEOUT, 0, &running);
      curl_multi_check_completion(s);
 -    aio_context_release(s->aio_context);
 +    qemu_mutex_unlock(&s->mutex);
  #else
      abort();
  #endif
@@ -XXX,XX +XXX,XX @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags,
      curl_easy_cleanup(state->curl);
      state->curl = NULL;
 +    qemu_mutex_init(&s->mutex);
      curl_attach_aio_context(bs, bdrv_get_aio_context(bs));
      qemu_opts_del(opts);
@@ -XXX,XX +XXX,XX @@ static void curl_readv_bh_cb(void *p)
      CURLAIOCB *acb = p;
      BlockDriverState *bs = acb->common.bs;
      BDRVCURLState *s = bs->opaque;
 -    AioContext *ctx = bdrv_get_aio_context(bs);
      size_t start = acb->sector_num * BDRV_SECTOR_SIZE;
      size_t end;
 -    aio_context_acquire(ctx);
 +    qemu_mutex_lock(&s->mutex);
      // In case we have the requested data already (e.g. read-ahead),
      // we can just call the callback and be done.
@@ -XXX,XX +XXX,XX @@ static void curl_readv_bh_cb(void *p)
      curl_multi_socket_action(s->multi, CURL_SOCKET_TIMEOUT, 0, &running);
  out:
 -    aio_context_release(ctx);
 +    qemu_mutex_unlock(&s->mutex);
      if (ret != -EINPROGRESS) {
          acb->common.cb(acb->common.opaque, ret);
          qemu_aio_unref(acb);
@@ -XXX,XX +XXX,XX @@ static void curl_close(BlockDriverState *bs)
      DPRINTF("CURL: Close\n");
      curl_detach_aio_context(bs);
 +    qemu_mutex_destroy(&s->mutex);
      g_free(s->cookie);
      g_free(s->url);
 --
-.9.3
+.34.1

-New patch
+[PULL 04/23] block: fix preallocate filter: don't do unaligned preallocate requests
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+There is a bug in handling BDRV_REQ_NO_WAIT flag: we still may wait in
+wait_serialising_requests() if request is unaligned. And this is
+possible for the only user of this flag (preallocate filter) if
+underlying file is unaligned to its request_alignment on start.
+So, we have to fix preallocate filter to do only aligned preallocate
+requests.
+Next, we should fix generic block/io.c somehow. Keeping in mind that
+preallocate is the only user of BDRV_REQ_NO_WAIT and that we have to
+fix its behavior now, it seems more safe to just assert that we never
+use BDRV_REQ_NO_WAIT with unaligned requests and add corresponding
+comment. Let's do so.
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Reviewed-by: Denis V. Lunev <den@openvz.org>
+Message-Id: <20220215121609.38570-1-vsementsov@virtuozzo.com>
+[hreitz: Rebased on block GS/IO split]
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+---
+ include/block/block-common.h |  3 ++-
+ block/io.c                   |  4 ++++
+ block/preallocate.c          | 15 ++++++++++++---
+files changed, 18 insertions(+), 4 deletions(-)
+diff --git a/include/block/block-common.h b/include/block/block-common.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/block/block-common.h
++++ b/include/block/block-common.h
+@@ -XXX,XX +XXX,XX @@ typedef enum {
+     /*
+      * If we need to wait for other requests, just fail immediately. Used
+-     * only together with BDRV_REQ_SERIALISING.
++     * only together with BDRV_REQ_SERIALISING. Used only with requests aligned
++     * to request_alignment (corresponding assertions are in block/io.c).
+      */
+     BDRV_REQ_NO_WAIT = 0x400,
+diff --git a/block/io.c b/block/io.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/io.c
++++ b/block/io.c
+@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_co_do_zero_pwritev(BdrvChild *child,
+     padding = bdrv_init_padding(bs, offset, bytes, &pad);
+     if (padding) {
++        assert(!(flags & BDRV_REQ_NO_WAIT));
+         bdrv_make_request_serialising(req, align);
+         bdrv_padding_rmw_read(child, req, &pad, true);
+@@ -XXX,XX +XXX,XX @@ int coroutine_fn bdrv_co_pwritev_part(BdrvChild *child,
+          * serialize the request to prevent interactions of the
+          * widened region with other transactions.
+          */
++        assert(!(flags & BDRV_REQ_NO_WAIT));
+         bdrv_make_request_serialising(&req, align);
+         bdrv_padding_rmw_read(child, &req, &pad, false);
+     }
+@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_co_copy_range_internal(
+     /* TODO We can support BDRV_REQ_NO_FALLBACK here */
+     assert(!(read_flags & BDRV_REQ_NO_FALLBACK));
+     assert(!(write_flags & BDRV_REQ_NO_FALLBACK));
++    assert(!(read_flags & BDRV_REQ_NO_WAIT));
++    assert(!(write_flags & BDRV_REQ_NO_WAIT));
+     if (!dst || !dst->bs || !bdrv_is_inserted(dst->bs)) {
+         return -ENOMEDIUM;
+diff --git a/block/preallocate.c b/block/preallocate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/preallocate.c
++++ b/block/preallocate.c
+@@ -XXX,XX +XXX,XX @@ static bool coroutine_fn handle_write(BlockDriverState *bs, int64_t offset,
+     int64_t end = offset + bytes;
+     int64_t prealloc_start, prealloc_end;
+     int ret;
++    uint32_t file_align = bs->file->bs->bl.request_alignment;
++    uint32_t prealloc_align = MAX(s->opts.prealloc_align, file_align);
++
++    assert(QEMU_IS_ALIGNED(prealloc_align, file_align));
+     if (!has_prealloc_perms(bs)) {
+         /* We don't have state neither should try to recover it */
+@@ -XXX,XX +XXX,XX @@ static bool coroutine_fn handle_write(BlockDriverState *bs, int64_t offset,
+     /* Now we want new preallocation, as request writes beyond s->file_end. */
+-    prealloc_start = want_merge_zero ? MIN(offset, s->file_end) : s->file_end;
+-    prealloc_end = QEMU_ALIGN_UP(end + s->opts.prealloc_size,
+-                                 s->opts.prealloc_align);
++    prealloc_start = QEMU_ALIGN_UP(
++            want_merge_zero ? MIN(offset, s->file_end) : s->file_end,
++            file_align);
++    prealloc_end = QEMU_ALIGN_UP(
++            MAX(prealloc_start, end) + s->opts.prealloc_size,
++            prealloc_align);
++
++    want_merge_zero = want_merge_zero && (prealloc_start <= offset);
+     ret = bdrv_co_pwrite_zeroes(
+             bs->file, prealloc_start, prealloc_end - prealloc_start,
+--
+.34.1

-New patch
+[PULL 05/23] tests/qemu-iotests/040: Skip TestCommitWithFilters without 'throttle'
+From: Thomas Huth <thuth@redhat.com>
+iotest 040 already has some checks for the availability of the 'throttle'
+driver, but some new code has been added in the course of time that
+depends on 'throttle' but does not check for its availability. Add
+a check to the TestCommitWithFilters class so that this iotest now
+also passes again if 'throttle' has not been enabled in the QEMU
+binaries.
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+Message-Id: <20220223123127.3206042-1-thuth@redhat.com>
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+---
+ tests/qemu-iotests/040 | 1 +
+file changed, 1 insertion(+)
+diff --git a/tests/qemu-iotests/040 b/tests/qemu-iotests/040
+index XXXXXXX..XXXXXXX 100755
+--- a/tests/qemu-iotests/040
++++ b/tests/qemu-iotests/040
+@@ -XXX,XX +XXX,XX @@ class TestCommitWithFilters(iotests.QMPTestCase):
+                              pattern_file)
+             self.assertFalse('Pattern verification failed' in result)
++    @iotests.skip_if_unsupported(['throttle'])
+     def setUp(self):
+         qemu_img('create', '-f', iotests.imgfmt, self.img0, '64M')
+         qemu_img('create', '-f', iotests.imgfmt, self.img1, '64M')
+--
+.34.1

-New patch
+[PULL 06/23] tests/qemu-iotests/testrunner: Quote "case not run" lines in TAP mode
+From: Thomas Huth <thuth@redhat.com>
+In TAP mode, the stdout is reserved for the TAP protocol, so we
+have to make sure to mark other lines with a comment '#' character
+at the beginning to avoid that the TAP parser at the other end
+gets confused.
+To test this condition, run "configure" for example with:
+ --block-drv-rw-whitelist=copy-before-write,qcow2,raw,file,host_device,blkdebug,null-co,copy-on-read
+so that iotest 041 will report that some tests are not run due to
+the missing "quorum" driver. Without this change, "make check-block"
+fails since the meson tap parser gets confused by these messages.
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+Message-Id: <20220223124353.3273898-1-thuth@redhat.com>
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+---
+ tests/qemu-iotests/testrunner.py | 5 ++++-
+file changed, 4 insertions(+), 1 deletion(-)
+diff --git a/tests/qemu-iotests/testrunner.py b/tests/qemu-iotests/testrunner.py
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/qemu-iotests/testrunner.py
++++ b/tests/qemu-iotests/testrunner.py
+@@ -XXX,XX +XXX,XX @@ def run_test(self, test: str,
+                                  description=res.description)
+         if res.casenotrun:
+-            print(res.casenotrun)
++            if self.tap:
++                print('#' + res.casenotrun.replace('\n', '\n#'))
++            else:
++                print(res.casenotrun)
+         return res
+--
+.34.1

-New patch
+[PULL 07/23] iotests: Write test output to TEST_DIR
+Drop the use of OUTPUT_DIR (test/qemu-iotests under the build
+directory), and instead write test output files (.out.bad, .notrun, and
+.casenotrun) to TEST_DIR.
+With this, the same test can be run concurrently without the separate
+instances interfering, because they will need separate TEST_DIRs anyway.
+Running the same test separately is useful when running the iotests with
+various format/protocol combinations in parallel, or when you just want
+to aggressively exercise a single test (e.g. when it fails only
+sporadically).
+Putting this output into TEST_DIR means that it will stick around for
+inspection after the test run is done (though running the same test in
+the same TEST_DIR will overwrite it, just as it used to be); but given
+that TEST_DIR is a scratch directory, it should be clear that users can
+delete all of its content at any point.  (And if TEST_DIR is on tmpfs,
+it will just disappear on shutdown.)  Contrarily, alternative approaches
+that would put these output files into OUTPUT_DIR with some prefix to
+differentiate between separate test runs might easily lead to cluttering
+OUTPUT_DIR.
+(This change means OUTPUT_DIR is no longer written to by the iotests, so
+we can drop its usage altogether.)
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+Message-Id: <20220221172909.762858-1-hreitz@redhat.com>
+[hreitz: Simplified `Path(os.path.join(x, y))` to `Path(x, y)`, as
+         suggested by Vladimir; and rebased on 9086c7639822b6
+         ("tests/qemu-iotests: Rework the checks and spots using GNU
+         sed")]
+Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+---
+ tests/qemu-iotests/common.rc     |  6 +++---
+ tests/qemu-iotests/iotests.py    |  5 ++---
+ tests/qemu-iotests/testenv.py    |  5 +----
+ tests/qemu-iotests/testrunner.py | 14 ++++++++------
+files changed, 14 insertions(+), 16 deletions(-)
+diff --git a/tests/qemu-iotests/common.rc b/tests/qemu-iotests/common.rc
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/qemu-iotests/common.rc
++++ b/tests/qemu-iotests/common.rc
+@@ -XXX,XX +XXX,XX @@
+ # bail out, setting up .notrun file
+ _notrun()
+ {
+-    echo "$*" >"$OUTPUT_DIR/$seq.notrun"
++    echo "$*" >"$TEST_DIR/$seq.notrun"
+     echo "$seq not run: $*"
+     status=0
+     exit
+@@ -XXX,XX +XXX,XX @@ _img_info()
+ #
+ _casenotrun()
+ {
+-    echo "    [case not run] $*" >>"$OUTPUT_DIR/$seq.casenotrun"
++    echo "    [case not run] $*" >>"$TEST_DIR/$seq.casenotrun"
+ }
+ # just plain bail out
+ #
+ _fail()
+ {
+-    echo "$*" | tee -a "$OUTPUT_DIR/$seq.full"
++    echo "$*" | tee -a "$TEST_DIR/$seq.full"
+     echo "(see $seq.full for details)"
+     status=1
+     exit 1
+diff --git a/tests/qemu-iotests/iotests.py b/tests/qemu-iotests/iotests.py
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/qemu-iotests/iotests.py
++++ b/tests/qemu-iotests/iotests.py
+@@ -XXX,XX +XXX,XX @@
+ imgfmt = os.environ.get('IMGFMT', 'raw')
+ imgproto = os.environ.get('IMGPROTO', 'file')
+-output_dir = os.environ.get('OUTPUT_DIR', '.')
+ try:
+     test_dir = os.environ['TEST_DIR']
+@@ -XXX,XX +XXX,XX @@ def notrun(reason):
+     # Each test in qemu-iotests has a number ("seq")
+     seq = os.path.basename(sys.argv[0])
+-    with open('%s/%s.notrun' % (output_dir, seq), 'w', encoding='utf-8') \
++    with open('%s/%s.notrun' % (test_dir, seq), 'w', encoding='utf-8') \
+             as outfile:
+         outfile.write(reason + '\n')
+     logger.warning("%s not run: %s", seq, reason)
+@@ -XXX,XX +XXX,XX @@ def case_notrun(reason):
+     # Each test in qemu-iotests has a number ("seq")
+     seq = os.path.basename(sys.argv[0])
+-    with open('%s/%s.casenotrun' % (output_dir, seq), 'a', encoding='utf-8') \
++    with open('%s/%s.casenotrun' % (test_dir, seq), 'a', encoding='utf-8') \
+             as outfile:
+         outfile.write('    [case not run] ' + reason + '\n')
+diff --git a/tests/qemu-iotests/testenv.py b/tests/qemu-iotests/testenv.py
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/qemu-iotests/testenv.py
++++ b/tests/qemu-iotests/testenv.py
+@@ -XXX,XX +XXX,XX @@ class TestEnv(ContextManager['TestEnv']):
+     # pylint: disable=too-many-instance-attributes
+     env_variables = ['PYTHONPATH', 'TEST_DIR', 'SOCK_DIR', 'SAMPLE_IMG_DIR',
+-                     'OUTPUT_DIR', 'PYTHON', 'QEMU_PROG', 'QEMU_IMG_PROG',
++                     'PYTHON', 'QEMU_PROG', 'QEMU_IMG_PROG',
+                      'QEMU_IO_PROG', 'QEMU_NBD_PROG', 'QSD_PROG',
+                      'QEMU_OPTIONS', 'QEMU_IMG_OPTIONS',
+                      'QEMU_IO_OPTIONS', 'QEMU_IO_OPTIONS_NO_FMT',
+@@ -XXX,XX +XXX,XX @@ def init_directories(self) -> None:
+              TEST_DIR
+              SOCK_DIR
+              SAMPLE_IMG_DIR
+-             OUTPUT_DIR
+         """
+         # Path where qemu goodies live in this source tree.
+@@ -XXX,XX +XXX,XX @@ def init_directories(self) -> None:
+                                         os.path.join(self.source_iotests,
+                                                      'sample_images'))
+-        self.output_dir = os.getcwd()  # OUTPUT_DIR
+-
+     def init_binaries(self) -> None:
+         """Init binary path variables:
+              PYTHON (for bash tests)
+diff --git a/tests/qemu-iotests/testrunner.py b/tests/qemu-iotests/testrunner.py
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/qemu-iotests/testrunner.py
++++ b/tests/qemu-iotests/testrunner.py
+@@ -XXX,XX +XXX,XX @@ def do_run_test(self, test: str, mp: bool) -> TestResult:
+         """
+         f_test = Path(test)
+-        f_bad = Path(f_test.name + '.out.bad')
+-        f_notrun = Path(f_test.name + '.notrun')
+-        f_casenotrun = Path(f_test.name + '.casenotrun')
+         f_reference = Path(self.find_reference(test))
+         if not f_test.exists():
+@@ -XXX,XX +XXX,XX @@ def do_run_test(self, test: str, mp: bool) -> TestResult:
+                               description='No qualified output '
+                                           f'(expected {f_reference})')
+-        for p in (f_bad, f_notrun, f_casenotrun):
+-            silent_unlink(p)
+-
+         args = [str(f_test.resolve())]
+         env = self.env.prepare_subprocess(args)
+         if mp:
+@@ -XXX,XX +XXX,XX @@ def do_run_test(self, test: str, mp: bool) -> TestResult:
+                 env[d] = os.path.join(env[d], f_test.name)
+                 Path(env[d]).mkdir(parents=True, exist_ok=True)
++        test_dir = env['TEST_DIR']
++        f_bad = Path(test_dir, f_test.name + '.out.bad')
++        f_notrun = Path(test_dir, f_test.name + '.notrun')
++        f_casenotrun = Path(test_dir, f_test.name + '.casenotrun')
++
++        for p in (f_notrun, f_casenotrun):
++            silent_unlink(p)
++
+         t0 = time.time()
+         with f_bad.open('w', encoding="utf-8") as f:
+             with subprocess.Popen(args, cwd=str(f_test.parent), env=env,
+--
+.34.1

-New patch
+[PULL 08/23] block/block-copy: move copy_bitmap initialization to block_copy_state_new()
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+We are going to complicate bitmap initialization in the further
+commit. And in future, backup job will be able to work without filter
+(when source is immutable), so we'll need same bitmap initialization in
+copy-before-write filter and in backup job. So, it's reasonable to do
+it in block-copy.
+Note that for now cbw_open() is the only caller of
+block_copy_state_new().
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Reviewed-by: Hanna Reitz <hreitz@redhat.com>
+Message-Id: <20220303194349.2304213-2-vsementsov@virtuozzo.com>
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+---
+ block/block-copy.c        | 1 +
+ block/copy-before-write.c | 4 ----
+files changed, 1 insertion(+), 4 deletions(-)
+diff --git a/block/block-copy.c b/block/block-copy.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/block-copy.c
++++ b/block/block-copy.c
+@@ -XXX,XX +XXX,XX @@ BlockCopyState *block_copy_state_new(BdrvChild *source, BdrvChild *target,
+         return NULL;
+     }
+     bdrv_disable_dirty_bitmap(copy_bitmap);
++    bdrv_set_dirty_bitmap(copy_bitmap, 0, bdrv_dirty_bitmap_size(copy_bitmap));
+     /*
+      * If source is in backing chain of target assume that target is going to be
+diff --git a/block/copy-before-write.c b/block/copy-before-write.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/copy-before-write.c
++++ b/block/copy-before-write.c
+@@ -XXX,XX +XXX,XX @@ static int cbw_open(BlockDriverState *bs, QDict *options, int flags,
+                     Error **errp)
+ {
+     BDRVCopyBeforeWriteState *s = bs->opaque;
+-    BdrvDirtyBitmap *copy_bitmap;
+     bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
+                                BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
+@@ -XXX,XX +XXX,XX @@ static int cbw_open(BlockDriverState *bs, QDict *options, int flags,
+         return -EINVAL;
+     }
+-    copy_bitmap = block_copy_dirty_bitmap(s->bcs);
+-    bdrv_set_dirty_bitmap(copy_bitmap, 0, bdrv_dirty_bitmap_size(copy_bitmap));
+-
+     return 0;
+ }
+--
+.34.1

-New patch
+[PULL 09/23] block/dirty-bitmap: bdrv_merge_dirty_bitmap(): add return value
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+That simplifies handling failure in existing code and in further new
+usage of bdrv_merge_dirty_bitmap().
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Reviewed-by: Hanna Reitz <hreitz@redhat.com>
+Message-Id: <20220303194349.2304213-3-vsementsov@virtuozzo.com>
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+---
+ include/block/dirty-bitmap.h    | 2 +-
+ block/dirty-bitmap.c            | 9 +++++++--
+ block/monitor/bitmap-qmp-cmds.c | 5 +----
+files changed, 9 insertions(+), 7 deletions(-)
+diff --git a/include/block/dirty-bitmap.h b/include/block/dirty-bitmap.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/block/dirty-bitmap.h
++++ b/include/block/dirty-bitmap.h
+@@ -XXX,XX +XXX,XX @@ void bdrv_dirty_bitmap_set_persistence(BdrvDirtyBitmap *bitmap,
+                                        bool persistent);
+ void bdrv_dirty_bitmap_set_inconsistent(BdrvDirtyBitmap *bitmap);
+ void bdrv_dirty_bitmap_set_busy(BdrvDirtyBitmap *bitmap, bool busy);
+-void bdrv_merge_dirty_bitmap(BdrvDirtyBitmap *dest, const BdrvDirtyBitmap *src,
++bool bdrv_merge_dirty_bitmap(BdrvDirtyBitmap *dest, const BdrvDirtyBitmap *src,
+                              HBitmap **backup, Error **errp);
+ void bdrv_dirty_bitmap_skip_store(BdrvDirtyBitmap *bitmap, bool skip);
+ bool bdrv_dirty_bitmap_get(BdrvDirtyBitmap *bitmap, int64_t offset);
+diff --git a/block/dirty-bitmap.c b/block/dirty-bitmap.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/dirty-bitmap.c
++++ b/block/dirty-bitmap.c
+@@ -XXX,XX +XXX,XX @@ bool bdrv_dirty_bitmap_next_dirty_area(BdrvDirtyBitmap *bitmap,
+  * Ensures permissions on bitmaps are reasonable; use for public API.
+  *
+  * @backup: If provided, make a copy of dest here prior to merge.
++ *
++ * Returns true on success, false on failure. In case of failure bitmaps are
++ * untouched.
+  */
+-void bdrv_merge_dirty_bitmap(BdrvDirtyBitmap *dest, const BdrvDirtyBitmap *src,
++bool bdrv_merge_dirty_bitmap(BdrvDirtyBitmap *dest, const BdrvDirtyBitmap *src,
+                              HBitmap **backup, Error **errp)
+ {
+-    bool ret;
++    bool ret = false;
+     bdrv_dirty_bitmaps_lock(dest->bs);
+     if (src->bs != dest->bs) {
+@@ -XXX,XX +XXX,XX @@ out:
+     if (src->bs != dest->bs) {
+         bdrv_dirty_bitmaps_unlock(src->bs);
+     }
++
++    return ret;
+ }
+ /**
+diff --git a/block/monitor/bitmap-qmp-cmds.c b/block/monitor/bitmap-qmp-cmds.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/monitor/bitmap-qmp-cmds.c
++++ b/block/monitor/bitmap-qmp-cmds.c
+@@ -XXX,XX +XXX,XX @@ BdrvDirtyBitmap *block_dirty_bitmap_merge(const char *node, const char *target,
+     BlockDriverState *bs;
+     BdrvDirtyBitmap *dst, *src, *anon;
+     BlockDirtyBitmapMergeSourceList *lst;
+-    Error *local_err = NULL;
+     GLOBAL_STATE_CODE();
+@@ -XXX,XX +XXX,XX @@ BdrvDirtyBitmap *block_dirty_bitmap_merge(const char *node, const char *target,
+             abort();
+         }
+-        bdrv_merge_dirty_bitmap(anon, src, NULL, &local_err);
+-        if (local_err) {
+-            error_propagate(errp, local_err);
++        if (!bdrv_merge_dirty_bitmap(anon, src, NULL, errp)) {
+             dst = NULL;
+             goto out;
+         }
+--
+.34.1

-New patch
+[PULL 10/23] block/block-copy: block_copy_state_new(): add bitmap parameter
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+This will be used in the following commit to bring "incremental" mode
+to copy-before-write filter.
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Reviewed-by: Hanna Reitz <hreitz@redhat.com>
+Message-Id: <20220303194349.2304213-4-vsementsov@virtuozzo.com>
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+---
+ include/block/block-copy.h |  1 +
+ block/block-copy.c         | 14 +++++++++++++-
+ block/copy-before-write.c  |  2 +-
+files changed, 15 insertions(+), 2 deletions(-)
+diff --git a/include/block/block-copy.h b/include/block/block-copy.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/block/block-copy.h
++++ b/include/block/block-copy.h
+@@ -XXX,XX +XXX,XX @@ typedef struct BlockCopyState BlockCopyState;
+ typedef struct BlockCopyCallState BlockCopyCallState;
+ BlockCopyState *block_copy_state_new(BdrvChild *source, BdrvChild *target,
++                                     const BdrvDirtyBitmap *bitmap,
+                                      Error **errp);
+ /* Function should be called prior any actual copy request */
+diff --git a/block/block-copy.c b/block/block-copy.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/block-copy.c
++++ b/block/block-copy.c
+@@ -XXX,XX +XXX,XX @@ static int64_t block_copy_calculate_cluster_size(BlockDriverState *target,
+ }
+ BlockCopyState *block_copy_state_new(BdrvChild *source, BdrvChild *target,
++                                     const BdrvDirtyBitmap *bitmap,
+                                      Error **errp)
+ {
++    ERRP_GUARD();
+     BlockCopyState *s;
+     int64_t cluster_size;
+     BdrvDirtyBitmap *copy_bitmap;
+@@ -XXX,XX +XXX,XX @@ BlockCopyState *block_copy_state_new(BdrvChild *source, BdrvChild *target,
+         return NULL;
+     }
+     bdrv_disable_dirty_bitmap(copy_bitmap);
+-    bdrv_set_dirty_bitmap(copy_bitmap, 0, bdrv_dirty_bitmap_size(copy_bitmap));
++    if (bitmap) {
++        if (!bdrv_merge_dirty_bitmap(copy_bitmap, bitmap, NULL, errp)) {
++            error_prepend(errp, "Failed to merge bitmap '%s' to internal "
++                          "copy-bitmap: ", bdrv_dirty_bitmap_name(bitmap));
++            bdrv_release_dirty_bitmap(copy_bitmap);
++            return NULL;
++        }
++    } else {
++        bdrv_set_dirty_bitmap(copy_bitmap, 0,
++                              bdrv_dirty_bitmap_size(copy_bitmap));
++    }
+     /*
+      * If source is in backing chain of target assume that target is going to be
+diff --git a/block/copy-before-write.c b/block/copy-before-write.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/copy-before-write.c
++++ b/block/copy-before-write.c
+@@ -XXX,XX +XXX,XX @@ static int cbw_open(BlockDriverState *bs, QDict *options, int flags,
+             ((BDRV_REQ_FUA | BDRV_REQ_MAY_UNMAP | BDRV_REQ_NO_FALLBACK) &
+              bs->file->bs->supported_zero_flags);
+-    s->bcs = block_copy_state_new(bs->file, s->target, errp);
++    s->bcs = block_copy_state_new(bs->file, s->target, NULL, errp);
+     if (!s->bcs) {
+         error_prepend(errp, "Cannot create block-copy-state: ");
+         return -EINVAL;
+--
+.34.1

-New patch
+[PULL 11/23] block/copy-before-write: add bitmap open parameter
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+This brings "incremental" mode to copy-before-write filter: user can
+specify bitmap so that filter will copy only "dirty" areas.
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Message-Id: <20220303194349.2304213-5-vsementsov@virtuozzo.com>
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+---
+ qapi/block-core.json      | 10 +++++++-
+ block/copy-before-write.c | 51 ++++++++++++++++++++++++++++++++++++++-
+files changed, 59 insertions(+), 2 deletions(-)
+diff --git a/qapi/block-core.json b/qapi/block-core.json
+index XXXXXXX..XXXXXXX 100644
+--- a/qapi/block-core.json
++++ b/qapi/block-core.json
+@@ -XXX,XX +XXX,XX @@
+ #
+ # @target: The target for copy-before-write operations.
+ #
++# @bitmap: If specified, copy-before-write filter will do
++#          copy-before-write operations only for dirty regions of the
++#          bitmap. Bitmap size must be equal to length of file and
++#          target child of the filter. Note also, that bitmap is used
++#          only to initialize internal bitmap of the process, so further
++#          modifications (or removing) of specified bitmap doesn't
++#          influence the filter. (Since 7.0)
++#
+ # Since: 6.2
+ ##
+ { 'struct': 'BlockdevOptionsCbw',
+   'base': 'BlockdevOptionsGenericFormat',
+-  'data': { 'target': 'BlockdevRef' } }
++  'data': { 'target': 'BlockdevRef', '*bitmap': 'BlockDirtyBitmap' } }
+ ##
+ # @BlockdevOptions:
+diff --git a/block/copy-before-write.c b/block/copy-before-write.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/copy-before-write.c
++++ b/block/copy-before-write.c
+@@ -XXX,XX +XXX,XX @@
+ #include "block/copy-before-write.h"
++#include "qapi/qapi-visit-block-core.h"
++
+ typedef struct BDRVCopyBeforeWriteState {
+     BlockCopyState *bcs;
+     BdrvChild *target;
+@@ -XXX,XX +XXX,XX @@ static void cbw_child_perm(BlockDriverState *bs, BdrvChild *c,
+     }
+ }
++static bool cbw_parse_bitmap_option(QDict *options, BdrvDirtyBitmap **bitmap,
++                                    Error **errp)
++{
++    QDict *bitmap_qdict = NULL;
++    BlockDirtyBitmap *bmp_param = NULL;
++    Visitor *v = NULL;
++    bool ret = false;
++
++    *bitmap = NULL;
++
++    qdict_extract_subqdict(options, &bitmap_qdict, "bitmap.");
++    if (!qdict_size(bitmap_qdict)) {
++        ret = true;
++        goto out;
++    }
++
++    v = qobject_input_visitor_new_flat_confused(bitmap_qdict, errp);
++    if (!v) {
++        goto out;
++    }
++
++    visit_type_BlockDirtyBitmap(v, NULL, &bmp_param, errp);
++    if (!bmp_param) {
++        goto out;
++    }
++
++    *bitmap = block_dirty_bitmap_lookup(bmp_param->node, bmp_param->name, NULL,
++                                        errp);
++    if (!*bitmap) {
++        goto out;
++    }
++
++    ret = true;
++
++out:
++    qapi_free_BlockDirtyBitmap(bmp_param);
++    visit_free(v);
++    qobject_unref(bitmap_qdict);
++
++    return ret;
++}
++
+ static int cbw_open(BlockDriverState *bs, QDict *options, int flags,
+                     Error **errp)
+ {
+     BDRVCopyBeforeWriteState *s = bs->opaque;
++    BdrvDirtyBitmap *bitmap = NULL;
+     bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
+                                BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
+@@ -XXX,XX +XXX,XX @@ static int cbw_open(BlockDriverState *bs, QDict *options, int flags,
+         return -EINVAL;
+     }
++    if (!cbw_parse_bitmap_option(options, &bitmap, errp)) {
++        return -EINVAL;
++    }
++
+     bs->total_sectors = bs->file->bs->total_sectors;
+     bs->supported_write_flags = BDRV_REQ_WRITE_UNCHANGED |
+             (BDRV_REQ_FUA & bs->file->bs->supported_write_flags);
+@@ -XXX,XX +XXX,XX @@ static int cbw_open(BlockDriverState *bs, QDict *options, int flags,
+             ((BDRV_REQ_FUA | BDRV_REQ_MAY_UNMAP | BDRV_REQ_NO_FALLBACK) &
+              bs->file->bs->supported_zero_flags);
+-    s->bcs = block_copy_state_new(bs->file, s->target, NULL, errp);
++    s->bcs = block_copy_state_new(bs->file, s->target, bitmap, errp);
+     if (!s->bcs) {
+         error_prepend(errp, "Cannot create block-copy-state: ");
+         return -EINVAL;
+--
+.34.1

-New patch
+[PULL 12/23] block/block-copy: add block_copy_reset()
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Split block_copy_reset() out of block_copy_reset_unallocated() to be
+used separately later.
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Reviewed-by: Hanna Reitz <hreitz@redhat.com>
+Message-Id: <20220303194349.2304213-6-vsementsov@virtuozzo.com>
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+---
+ include/block/block-copy.h |  1 +
+ block/block-copy.c         | 21 +++++++++++++--------
+files changed, 14 insertions(+), 8 deletions(-)
+diff --git a/include/block/block-copy.h b/include/block/block-copy.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/block/block-copy.h
++++ b/include/block/block-copy.h
+@@ -XXX,XX +XXX,XX @@ void block_copy_set_progress_meter(BlockCopyState *s, ProgressMeter *pm);
+ void block_copy_state_free(BlockCopyState *s);
++void block_copy_reset(BlockCopyState *s, int64_t offset, int64_t bytes);
+ int64_t block_copy_reset_unallocated(BlockCopyState *s,
+                                      int64_t offset, int64_t *count);
+diff --git a/block/block-copy.c b/block/block-copy.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/block-copy.c
++++ b/block/block-copy.c
+@@ -XXX,XX +XXX,XX @@ static int block_copy_is_cluster_allocated(BlockCopyState *s, int64_t offset,
+     }
+ }
++void block_copy_reset(BlockCopyState *s, int64_t offset, int64_t bytes)
++{
++    QEMU_LOCK_GUARD(&s->lock);
++
++    bdrv_reset_dirty_bitmap(s->copy_bitmap, offset, bytes);
++    if (s->progress) {
++        progress_set_remaining(s->progress,
++                               bdrv_get_dirty_count(s->copy_bitmap) +
++                               s->in_flight_bytes);
++    }
++}
++
+ /*
+  * Reset bits in copy_bitmap starting at offset if they represent unallocated
+  * data in the image. May reset subsequent contiguous bits.
+@@ -XXX,XX +XXX,XX @@ int64_t block_copy_reset_unallocated(BlockCopyState *s,
+     bytes = clusters * s->cluster_size;
+     if (!ret) {
+-        qemu_co_mutex_lock(&s->lock);
+-        bdrv_reset_dirty_bitmap(s->copy_bitmap, offset, bytes);
+-        if (s->progress) {
+-            progress_set_remaining(s->progress,
+-                                   bdrv_get_dirty_count(s->copy_bitmap) +
+-                                   s->in_flight_bytes);
+-        }
+-        qemu_co_mutex_unlock(&s->lock);
++        block_copy_reset(s, offset, bytes);
+     }
+     *count = bytes;
+--
+.34.1

-[Qemu-devel] [PULL 3/4] iscsi: do not use aio_context_acquire/release
+[PULL 13/23] block: intoduce reqlist
-From: Paolo Bonzini <pbonzini@redhat.com>
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Now that all bottom halves and callbacks take care of taking the
+Split intersecting-requests functionality out of block-copy to be
-AioContext lock, we can migrate some users away from it and to a
+reused in copy-before-write filter.
 specific QemuMutex or CoMutex.
-Protect libiscsi calls with a QemuMutex.  Callbacks are invoked
+Note: while being here, fix tiny typo in MAINTAINERS.
 using bottom halves, so we don't even have to drop it around
 callback invocations.
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Reviewed-by: Hanna Reitz <hreitz@redhat.com>
-Message-id: 20170222180725.28611-4-pbonzini@redhat.com
+Message-Id: <20220303194349.2304213-7-vsementsov@virtuozzo.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
 ---
- block/iscsi.c | 83 +++++++++++++++++++++++++++++++++++++++++++++--------------
+ include/block/reqlist.h |  67 +++++++++++++++++++++++
-file changed, 64 insertions(+), 19 deletions(-)
+ block/block-copy.c      | 116 +++++++++++++---------------------------
  block/reqlist.c         |  76 ++++++++++++++++++++++++++
  MAINTAINERS             |   4 +-
  block/meson.build       |   1 +
 files changed, 184 insertions(+), 80 deletions(-)
  create mode 100644 include/block/reqlist.h
  create mode 100644 block/reqlist.c
-diff --git a/block/iscsi.c b/block/iscsi.c
+diff --git a/include/block/reqlist.h b/include/block/reqlist.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/include/block/reqlist.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * reqlist API
 + *
 + * Copyright (C) 2013 Proxmox Server Solutions
 + * Copyright (c) 2021 Virtuozzo International GmbH.
 + *
 + * Authors:
 + *  Dietmar Maurer (dietmar@proxmox.com)
 + *  Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + */
 +
 +#ifndef REQLIST_H
 +#define REQLIST_H
 +
 +#include "qemu/coroutine.h"
 +
 +/*
 + * The API is not thread-safe and shouldn't be. The struct is public to be part
 + * of other structures and protected by third-party locks, see
 + * block/block-copy.c for example.
 + */
 +
 +typedef struct BlockReq {
 +    int64_t offset;
 +    int64_t bytes;
 +
 +    CoQueue wait_queue; /* coroutines blocked on this req */
 +    QLIST_ENTRY(BlockReq) list;
 +} BlockReq;
 +
 +typedef QLIST_HEAD(, BlockReq) BlockReqList;
 +
 +/*
 + * Initialize new request and add it to the list. Caller must be sure that
 + * there are no conflicting requests in the list.
 + */
 +void reqlist_init_req(BlockReqList *reqs, BlockReq *req, int64_t offset,
 +                      int64_t bytes);
 +/* Search for request in the list intersecting with @offset/@bytes area. */
 +BlockReq *reqlist_find_conflict(BlockReqList *reqs, int64_t offset,
 +                                int64_t bytes);
 +
 +/*
 + * If there are no intersecting requests return false. Otherwise, wait for the
 + * first found intersecting request to finish and return true.
 + *
 + * @lock is passed to qemu_co_queue_wait()
 + * False return value proves that lock was released at no point.
 + */
 +bool coroutine_fn reqlist_wait_one(BlockReqList *reqs, int64_t offset,
 +                                   int64_t bytes, CoMutex *lock);
 +
 +/*
 + * Shrink request and wake all waiting coroutines (maybe some of them are not
 + * intersecting with shrunk request).
 + */
 +void coroutine_fn reqlist_shrink_req(BlockReq *req, int64_t new_bytes);
 +
 +/*
 + * Remove request and wake all waiting coroutines. Do not release any memory.
 + */
 +void coroutine_fn reqlist_remove_req(BlockReq *req);
 +
 +#endif /* REQLIST_H */
 diff --git a/block/block-copy.c b/block/block-copy.c
 index XXXXXXX..XXXXXXX 100644
---- a/block/iscsi.c
+--- a/block/block-copy.c
-+++ b/block/iscsi.c
++++ b/block/block-copy.c
-@@ -XXX,XX +XXX,XX @@ typedef struct IscsiLun {
+@@ -XXX,XX +XXX,XX @@
-     int events;
+ #include "trace.h"
-     QEMUTimer *nop_timer;
+ #include "qapi/error.h"
-     QEMUTimer *event_timer;
+ #include "block/block-copy.h"
-+    QemuMutex mutex;
++#include "block/reqlist.h"
-     struct scsi_inquiry_logical_block_provisioning lbp;
+ #include "sysemu/block-backend.h"
-     struct scsi_inquiry_block_limits bl;
+ #include "qemu/units.h"
-     unsigned char *zeroblock;
+ #include "qemu/coroutine.h"
-@@ -XXX,XX +XXX,XX @@ static int iscsi_translate_sense(struct scsi_sense *sense)
+@@ -XXX,XX +XXX,XX @@ typedef struct BlockCopyTask {
-     return ret;
+      */
      BlockCopyState *s;
      BlockCopyCallState *call_state;
 -    int64_t offset;
      /*
       * @method can also be set again in the while loop of
       * block_copy_dirty_clusters(), but it is never accessed concurrently
@@ -XXX,XX +XXX,XX @@ typedef struct BlockCopyTask {
      BlockCopyMethod method;
      /*
 -     * Fields whose state changes throughout the execution
 -     * Protected by lock in BlockCopyState.
 +     * Generally, req is protected by lock in BlockCopyState, Still req.offset
 +     * is only set on task creation, so may be read concurrently after creation.
 +     * req.bytes is changed at most once, and need only protecting the case of
 +     * parallel read while updating @bytes value in block_copy_task_shrink().
       */
 -    CoQueue wait_queue; /* coroutines blocked on this task */
 -    /*
 -     * Only protect the case of parallel read while updating @bytes
 -     * value in block_copy_task_shrink().
 -     */
 -    int64_t bytes;
 -    QLIST_ENTRY(BlockCopyTask) list;
 +    BlockReq req;
  } BlockCopyTask;
  static int64_t task_end(BlockCopyTask *task)
  {
 -    return task->offset + task->bytes;
 +    return task->req.offset + task->req.bytes;
  }
-+/* Called (via iscsi_service) with QemuMutex held.  */
+ typedef struct BlockCopyState {
- static void
+@@ -XXX,XX +XXX,XX @@ typedef struct BlockCopyState {
- iscsi_co_generic_cb(struct iscsi_context *iscsi, int status,
+     CoMutex lock;
-                         void *command_data, void *opaque)
+     int64_t in_flight_bytes;
-@@ -XXX,XX +XXX,XX @@ static const AIOCBInfo iscsi_aiocb_info = {
+     BlockCopyMethod method;
- static void iscsi_process_read(void *arg);
+-    QLIST_HEAD(, BlockCopyTask) tasks; /* All tasks from all block-copy calls */
- static void iscsi_process_write(void *arg);
++    BlockReqList reqs;
+     QLIST_HEAD(, BlockCopyCallState) calls;
-+/* Called with QemuMutex held.  */
+     /*
- static void
+      * skip_unallocated:
- iscsi_set_events(IscsiLun *iscsilun)
+@@ -XXX,XX +XXX,XX @@ typedef struct BlockCopyState {
      RateLimit rate_limit;
  } BlockCopyState;
 -/* Called with lock held */
 -static BlockCopyTask *find_conflicting_task(BlockCopyState *s,
 -                                            int64_t offset, int64_t bytes)
 -{
 -    BlockCopyTask *t;
 -
 -    QLIST_FOREACH(t, &s->tasks, list) {
 -        if (offset + bytes > t->offset && offset < t->offset + t->bytes) {
 -            return t;
 -        }
 -    }
 -
 -    return NULL;
 -}
 -
 -/*
 - * If there are no intersecting tasks return false. Otherwise, wait for the
 - * first found intersecting tasks to finish and return true.
 - *
 - * Called with lock held. May temporary release the lock.
 - * Return value of 0 proves that lock was NOT released.
 - */
 -static bool coroutine_fn block_copy_wait_one(BlockCopyState *s, int64_t offset,
 -                                             int64_t bytes)
 -{
 -    BlockCopyTask *task = find_conflicting_task(s, offset, bytes);
 -
 -    if (!task) {
 -        return false;
 -    }
 -
 -    qemu_co_queue_wait(&task->wait_queue, &s->lock);
 -
 -    return true;
 -}
 -
  /* Called with lock held */
  static int64_t block_copy_chunk_size(BlockCopyState *s)
  {
-@@ -XXX,XX +XXX,XX @@ iscsi_process_read(void *arg)
+@@ -XXX,XX +XXX,XX @@ block_copy_task_create(BlockCopyState *s, BlockCopyCallState *call_state,
-     IscsiLun *iscsilun = arg;
+     bytes = QEMU_ALIGN_UP(bytes, s->cluster_size);
-     struct iscsi_context *iscsi = iscsilun->iscsi;
+     /* region is dirty, so no existent tasks possible in it */
--    aio_context_acquire(iscsilun->aio_context);
+-    assert(!find_conflicting_task(s, offset, bytes));
-+    qemu_mutex_lock(&iscsilun->mutex);
++    assert(!reqlist_find_conflict(&s->reqs, offset, bytes));
-     iscsi_service(iscsi, POLLIN);
-     iscsi_set_events(iscsilun);
+     bdrv_reset_dirty_bitmap(s->copy_bitmap, offset, bytes);
--    aio_context_release(iscsilun->aio_context);
+     s->in_flight_bytes += bytes;
-+    qemu_mutex_unlock(&iscsilun->mutex);
+@@ -XXX,XX +XXX,XX @@ block_copy_task_create(BlockCopyState *s, BlockCopyCallState *call_state,
          .task.func = block_copy_task_entry,
          .s = s,
          .call_state = call_state,
 -        .offset = offset,
 -        .bytes = bytes,
          .method = s->method,
      };
 -    qemu_co_queue_init(&task->wait_queue);
 -    QLIST_INSERT_HEAD(&s->tasks, task, list);
 +    reqlist_init_req(&s->reqs, &task->req, offset, bytes);
      return task;
  }
+@@ -XXX,XX +XXX,XX @@ static void coroutine_fn block_copy_task_shrink(BlockCopyTask *task,
- static void
+                                                 int64_t new_bytes)
-@@ -XXX,XX +XXX,XX @@ iscsi_process_write(void *arg)
+ {
-     IscsiLun *iscsilun = arg;
+     QEMU_LOCK_GUARD(&task->s->lock);
-     struct iscsi_context *iscsi = iscsilun->iscsi;
+-    if (new_bytes == task->bytes) {
++    if (new_bytes == task->req.bytes) {
--    aio_context_acquire(iscsilun->aio_context);
+         return;
-+    qemu_mutex_lock(&iscsilun->mutex);
+     }
-     iscsi_service(iscsi, POLLOUT);
-     iscsi_set_events(iscsilun);
+-    assert(new_bytes > 0 && new_bytes < task->bytes);
--    aio_context_release(iscsilun->aio_context);
++    assert(new_bytes > 0 && new_bytes < task->req.bytes);
-+    qemu_mutex_unlock(&iscsilun->mutex);
 -    task->s->in_flight_bytes -= task->bytes - new_bytes;
 +    task->s->in_flight_bytes -= task->req.bytes - new_bytes;
      bdrv_set_dirty_bitmap(task->s->copy_bitmap,
 -                          task->offset + new_bytes, task->bytes - new_bytes);
 +                          task->req.offset + new_bytes,
 +                          task->req.bytes - new_bytes);
 -    task->bytes = new_bytes;
 -    qemu_co_queue_restart_all(&task->wait_queue);
 +    reqlist_shrink_req(&task->req, new_bytes);
  }
- static int64_t sector_lun2qemu(int64_t sector, IscsiLun *iscsilun)
+ static void coroutine_fn block_copy_task_end(BlockCopyTask *task, int ret)
-@@ -XXX,XX +XXX,XX @@ iscsi_co_writev_flags(BlockDriverState *bs, int64_t sector_num, int nb_sectors,
+ {
-     uint64_t lba;
+     QEMU_LOCK_GUARD(&task->s->lock);
-     uint32_t num_sectors;
+-    task->s->in_flight_bytes -= task->bytes;
-     bool fua = flags & BDRV_REQ_FUA;
++    task->s->in_flight_bytes -= task->req.bytes;
-+    int r = 0;
+     if (ret < 0) {
+-        bdrv_set_dirty_bitmap(task->s->copy_bitmap, task->offset, task->bytes);
-     if (fua) {
++        bdrv_set_dirty_bitmap(task->s->copy_bitmap, task->req.offset,
-         assert(iscsilun->dpofua);
++                              task->req.bytes);
@@ -XXX,XX +XXX,XX @@ iscsi_co_writev_flags(BlockDriverState *bs, int64_t sector_num, int nb_sectors,
      lba = sector_qemu2lun(sector_num, iscsilun);
      num_sectors = sector_qemu2lun(nb_sectors, iscsilun);
      iscsi_co_init_iscsitask(iscsilun, &iTask);
 +    qemu_mutex_lock(&iscsilun->mutex);
  retry:
      if (iscsilun->use_16_for_rw) {
  #if LIBISCSI_API_VERSION >= (20160603)
@@ -XXX,XX +XXX,XX @@ retry:
  #endif
      while (!iTask.complete) {
          iscsi_set_events(iscsilun);
 +        qemu_mutex_unlock(&iscsilun->mutex);
          qemu_coroutine_yield();
 +        qemu_mutex_lock(&iscsilun->mutex);
      }
+-    QLIST_REMOVE(task, list);
-     if (iTask.task != NULL) {
+     if (task->s->progress) {
-@@ -XXX,XX +XXX,XX @@ retry:
+         progress_set_remaining(task->s->progress,
+                                bdrv_get_dirty_count(task->s->copy_bitmap) +
-     if (iTask.status != SCSI_STATUS_GOOD) {
+                                task->s->in_flight_bytes);
          iscsi_allocmap_set_invalid(iscsilun, sector_num, nb_sectors);
 -        return iTask.err_code;
 +        r = iTask.err_code;
 +        goto out_unlock;
      }
+-    qemu_co_queue_restart_all(&task->wait_queue);
-     iscsi_allocmap_set_allocated(iscsilun, sector_num, nb_sectors);
++    reqlist_remove_req(&task->req);
 -    return 0;
 +out_unlock:
 +    qemu_mutex_unlock(&iscsilun->mutex);
 +    return r;
  }
+ void block_copy_state_free(BlockCopyState *s)
-@@ -XXX,XX +XXX,XX @@ static int64_t coroutine_fn iscsi_co_get_block_status(BlockDriverState *bs,
+@@ -XXX,XX +XXX,XX @@ BlockCopyState *block_copy_state_new(BdrvChild *source, BdrvChild *target,
-         goto out;
-     }
+     ratelimit_init(&s->rate_limit);
+     qemu_co_mutex_init(&s->lock);
-+    qemu_mutex_lock(&iscsilun->mutex);
+-    QLIST_INIT(&s->tasks);
- retry:
++    QLIST_INIT(&s->reqs);
-     if (iscsi_get_lba_status_task(iscsilun->iscsi, iscsilun->lun,
+     QLIST_INIT(&s->calls);
-                                   sector_qemu2lun(sector_num, iscsilun),
-+ 16, iscsi_co_generic_cb,
+     return s;
-                                   &iTask) == NULL) {
+@@ -XXX,XX +XXX,XX @@ static coroutine_fn int block_copy_task_run(AioTaskPool *pool,
-         ret = -ENOMEM;
--        goto out;
+     aio_task_pool_wait_slot(pool);
-+        goto out_unlock;
+     if (aio_task_pool_status(pool) < 0) {
-     }
+-        co_put_to_shres(task->s->mem, task->bytes);
++        co_put_to_shres(task->s->mem, task->req.bytes);
-     while (!iTask.complete) {
+         block_copy_task_end(task, -ECANCELED);
-         iscsi_set_events(iscsilun);
+         g_free(task);
-+        qemu_mutex_unlock(&iscsilun->mutex);
+         return -ECANCELED;
-         qemu_coroutine_yield();
+@@ -XXX,XX +XXX,XX @@ static coroutine_fn int block_copy_task_entry(AioTask *task)
-+        qemu_mutex_lock(&iscsilun->mutex);
+     BlockCopyMethod method = t->method;
-     }
+     int ret;
-     if (iTask.do_retry) {
+-    ret = block_copy_do_copy(s, t->offset, t->bytes, &method, &error_is_read);
-@@ -XXX,XX +XXX,XX @@ retry:
++    ret = block_copy_do_copy(s, t->req.offset, t->req.bytes, &method,
-          * because the device is busy or the cmd is not
++                             &error_is_read);
-          * supported) we pretend all blocks are allocated
-          * for backwards compatibility */
+     WITH_QEMU_LOCK_GUARD(&s->lock) {
--        goto out;
+         if (s->method == t->method) {
-+        goto out_unlock;
+@@ -XXX,XX +XXX,XX @@ static coroutine_fn int block_copy_task_entry(AioTask *task)
-     }
+                 t->call_state->error_is_read = error_is_read;
+             }
-     lbas = scsi_datain_unmarshall(iTask.task);
+         } else if (s->progress) {
-     if (lbas == NULL) {
+-            progress_work_done(s->progress, t->bytes);
-         ret = -EIO;
++            progress_work_done(s->progress, t->req.bytes);
 -        goto out;
 +        goto out_unlock;
      }
      lbasd = &lbas->descriptors[0];
      if (sector_qemu2lun(sector_num, iscsilun) != lbasd->lba) {
          ret = -EIO;
 -        goto out;
 +        goto out_unlock;
      }
      *pnum = sector_lun2qemu(lbasd->num_blocks, iscsilun);
@@ -XXX,XX +XXX,XX @@ retry:
      if (*pnum > nb_sectors) {
          *pnum = nb_sectors;
      }
 +out_unlock:
 +    qemu_mutex_unlock(&iscsilun->mutex);
  out:
      if (iTask.task != NULL) {
          scsi_free_scsi_task(iTask.task);
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn iscsi_co_readv(BlockDriverState *bs,
      num_sectors = sector_qemu2lun(nb_sectors, iscsilun);
      iscsi_co_init_iscsitask(iscsilun, &iTask);
 +    qemu_mutex_lock(&iscsilun->mutex);
  retry:
      if (iscsilun->use_16_for_rw) {
  #if LIBISCSI_API_VERSION >= (20160603)
@@ -XXX,XX +XXX,XX @@ retry:
  #endif
      while (!iTask.complete) {
          iscsi_set_events(iscsilun);
 +        qemu_mutex_unlock(&iscsilun->mutex);
          qemu_coroutine_yield();
 +        qemu_mutex_lock(&iscsilun->mutex);
      }
      if (iTask.task != NULL) {
@@ -XXX,XX +XXX,XX @@ retry:
          iTask.complete = 0;
          goto retry;
      }
 +    qemu_mutex_unlock(&iscsilun->mutex);
      if (iTask.status != SCSI_STATUS_GOOD) {
          return iTask.err_code;
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn iscsi_co_flush(BlockDriverState *bs)
      struct IscsiTask iTask;
      iscsi_co_init_iscsitask(iscsilun, &iTask);
 +    qemu_mutex_lock(&iscsilun->mutex);
  retry:
      if (iscsi_synchronizecache10_task(iscsilun->iscsi, iscsilun->lun, 0, 0, 0,
 , iscsi_co_generic_cb, &iTask) == NULL) {
@@ -XXX,XX +XXX,XX @@ retry:
      while (!iTask.complete) {
          iscsi_set_events(iscsilun);
 +        qemu_mutex_unlock(&iscsilun->mutex);
          qemu_coroutine_yield();
 +        qemu_mutex_lock(&iscsilun->mutex);
      }
      if (iTask.task != NULL) {
@@ -XXX,XX +XXX,XX @@ retry:
          iTask.complete = 0;
          goto retry;
      }
 +    qemu_mutex_unlock(&iscsilun->mutex);
      if (iTask.status != SCSI_STATUS_GOOD) {
          return iTask.err_code;
@@ -XXX,XX +XXX,XX @@ retry:
  }
  #ifdef __linux__
 +/* Called (via iscsi_service) with QemuMutex held.  */
  static void
  iscsi_aio_ioctl_cb(struct iscsi_context *iscsi, int status,
                       void *command_data, void *opaque)
@@ -XXX,XX +XXX,XX @@ static BlockAIOCB *iscsi_aio_ioctl(BlockDriverState *bs,
      acb->task->expxferlen = acb->ioh->dxfer_len;
      data.size = 0;
 +    qemu_mutex_lock(&iscsilun->mutex);
      if (acb->task->xfer_dir == SCSI_XFER_WRITE) {
          if (acb->ioh->iovec_count == 0) {
              data.data = acb->ioh->dxferp;
@@ -XXX,XX +XXX,XX @@ static BlockAIOCB *iscsi_aio_ioctl(BlockDriverState *bs,
                                   iscsi_aio_ioctl_cb,
                                   (data.size > 0) ? &data : NULL,
                                   acb) != 0) {
 +        qemu_mutex_unlock(&iscsilun->mutex);
          scsi_free_scsi_task(acb->task);
          qemu_aio_unref(acb);
          return NULL;
@@ -XXX,XX +XXX,XX @@ static BlockAIOCB *iscsi_aio_ioctl(BlockDriverState *bs,
      }
      iscsi_set_events(iscsilun);
 +    qemu_mutex_unlock(&iscsilun->mutex);
      return &acb->common;
  }
@@ -XXX,XX +XXX,XX @@ coroutine_fn iscsi_co_pdiscard(BlockDriverState *bs, int64_t offset, int count)
      IscsiLun *iscsilun = bs->opaque;
      struct IscsiTask iTask;
      struct unmap_list list;
 +    int r = 0;
      if (!is_byte_request_lun_aligned(offset, count, iscsilun)) {
          return -ENOTSUP;
@@ -XXX,XX +XXX,XX @@ coroutine_fn iscsi_co_pdiscard(BlockDriverState *bs, int64_t offset, int count)
      list.num = count / iscsilun->block_size;
      iscsi_co_init_iscsitask(iscsilun, &iTask);
 +    qemu_mutex_lock(&iscsilun->mutex);
  retry:
      if (iscsi_unmap_task(iscsilun->iscsi, iscsilun->lun, 0, 0, &list, 1,
                           iscsi_co_generic_cb, &iTask) == NULL) {
 -        return -ENOMEM;
 +        r = -ENOMEM;
 +        goto out_unlock;
      }
      while (!iTask.complete) {
          iscsi_set_events(iscsilun);
 +        qemu_mutex_unlock(&iscsilun->mutex);
          qemu_coroutine_yield();
 +        qemu_mutex_lock(&iscsilun->mutex);
      }
      if (iTask.task != NULL) {
@@ -XXX,XX +XXX,XX @@ retry:
          /* the target might fail with a check condition if it
             is not happy with the alignment of the UNMAP request
             we silently fail in this case */
 -        return 0;
 +        goto out_unlock;
      }
      if (iTask.status != SCSI_STATUS_GOOD) {
 -        return iTask.err_code;
 +        r = iTask.err_code;
 +        goto out_unlock;
      }
      iscsi_allocmap_set_invalid(iscsilun, offset >> BDRV_SECTOR_BITS,
                                 count >> BDRV_SECTOR_BITS);
 -    return 0;
 +out_unlock:
 +    qemu_mutex_unlock(&iscsilun->mutex);
 +    return r;
  }
  static int
@@ -XXX,XX +XXX,XX @@ coroutine_fn iscsi_co_pwrite_zeroes(BlockDriverState *bs, int64_t offset,
      uint64_t lba;
      uint32_t nb_blocks;
      bool use_16_for_ws = iscsilun->use_16_for_rw;
 +    int r = 0;
      if (!is_byte_request_lun_aligned(offset, count, iscsilun)) {
          return -ENOTSUP;
@@ -XXX,XX +XXX,XX @@ coroutine_fn iscsi_co_pwrite_zeroes(BlockDriverState *bs, int64_t offset,
          }
      }
+-    co_put_to_shres(s->mem, t->bytes);
-+    qemu_mutex_lock(&iscsilun->mutex);
++    co_put_to_shres(s->mem, t->req.bytes);
-     iscsi_co_init_iscsitask(iscsilun, &iTask);
+     block_copy_task_end(t, ret);
- retry:
-     if (use_16_for_ws) {
+     return ret;
-@@ -XXX,XX +XXX,XX @@ retry:
+@@ -XXX,XX +XXX,XX @@ block_copy_dirty_clusters(BlockCopyCallState *call_state)
+             trace_block_copy_skip_range(s, offset, bytes);
-     while (!iTask.complete) {
+             break;
-         iscsi_set_events(iscsilun);
+         }
-+        qemu_mutex_unlock(&iscsilun->mutex);
+-        if (task->offset > offset) {
-         qemu_coroutine_yield();
+-            trace_block_copy_skip_range(s, offset, task->offset - offset);
-+        qemu_mutex_lock(&iscsilun->mutex);
++        if (task->req.offset > offset) {
-     }
++            trace_block_copy_skip_range(s, offset, task->req.offset - offset);
+         }
-     if (iTask.status == SCSI_STATUS_CHECK_CONDITION &&
-@@ -XXX,XX +XXX,XX @@ retry:
+         found_dirty = true;
-         /* WRITE SAME is not supported by the target */
-         iscsilun->has_write_same = false;
+-        ret = block_copy_block_status(s, task->offset, task->bytes,
-         scsi_free_scsi_task(iTask.task);
++        ret = block_copy_block_status(s, task->req.offset, task->req.bytes,
--        return -ENOTSUP;
+                                       &status_bytes);
-+        r = -ENOTSUP;
+         assert(ret >= 0); /* never fail */
-+        goto out_unlock;
+-        if (status_bytes < task->bytes) {
-     }
++        if (status_bytes < task->req.bytes) {
+             block_copy_task_shrink(task, status_bytes);
-     if (iTask.task != NULL) {
+         }
-@@ -XXX,XX +XXX,XX @@ retry:
+         if (qatomic_read(&s->skip_unallocated) &&
-     if (iTask.status != SCSI_STATUS_GOOD) {
+             !(ret & BDRV_BLOCK_ALLOCATED)) {
-         iscsi_allocmap_set_invalid(iscsilun, offset >> BDRV_SECTOR_BITS,
+             block_copy_task_end(task, 0);
-                                    count >> BDRV_SECTOR_BITS);
+-            trace_block_copy_skip_range(s, task->offset, task->bytes);
--        return iTask.err_code;
++            trace_block_copy_skip_range(s, task->req.offset, task->req.bytes);
-+        r = iTask.err_code;
+             offset = task_end(task);
-+        goto out_unlock;
+             bytes = end - offset;
-     }
+             g_free(task);
+@@ -XXX,XX +XXX,XX @@ block_copy_dirty_clusters(BlockCopyCallState *call_state)
-     if (flags & BDRV_REQ_MAY_UNMAP) {
+             }
-@@ -XXX,XX +XXX,XX @@ retry:
+         }
-                                      count >> BDRV_SECTOR_BITS);
-     }
+-        ratelimit_calculate_delay(&s->rate_limit, task->bytes);
++        ratelimit_calculate_delay(&s->rate_limit, task->req.bytes);
--    return 0;
-+out_unlock:
+-        trace_block_copy_process(s, task->offset);
-+    qemu_mutex_unlock(&iscsilun->mutex);
++        trace_block_copy_process(s, task->req.offset);
-+    return r;
- }
+-        co_get_from_shres(s->mem, task->bytes);
++        co_get_from_shres(s->mem, task->req.bytes);
- static void apply_chap(struct iscsi_context *iscsi, QemuOpts *opts,
-@@ -XXX,XX +XXX,XX @@ static void iscsi_nop_timed_event(void *opaque)
+         offset = task_end(task);
- {
+         bytes = end - offset;
-     IscsiLun *iscsilun = opaque;
+@@ -XXX,XX +XXX,XX @@ static int coroutine_fn block_copy_common(BlockCopyCallState *call_state)
+                  * Check that there is no task we still need to
--    aio_context_acquire(iscsilun->aio_context);
+                  * wait to complete
-+    qemu_mutex_lock(&iscsilun->mutex);
+                  */
-     if (iscsi_get_nops_in_flight(iscsilun->iscsi) >= MAX_NOP_FAILURES) {
+-                ret = block_copy_wait_one(s, call_state->offset,
-         error_report("iSCSI: NOP timeout. Reconnecting...");
+-                                          call_state->bytes);
-         iscsilun->request_timed_out = true;
++                ret = reqlist_wait_one(&s->reqs, call_state->offset,
-@@ -XXX,XX +XXX,XX @@ static void iscsi_nop_timed_event(void *opaque)
++                                       call_state->bytes, &s->lock);
-     iscsi_set_events(iscsilun);
+                 if (ret == 0) {
+                     /*
- out:
+                      * No pending tasks, but check again the bitmap in this
--    aio_context_release(iscsilun->aio_context);
+@@ -XXX,XX +XXX,XX @@ static int coroutine_fn block_copy_common(BlockCopyCallState *call_state)
-+    qemu_mutex_unlock(&iscsilun->mutex);
+                      * between this and the critical section in
- }
+                      * block_copy_dirty_clusters().
+                      *
- static void iscsi_readcapacity_sync(IscsiLun *iscsilun, Error **errp)
+-                     * block_copy_wait_one return value 0 also means that it
-@@ -XXX,XX +XXX,XX @@ static int iscsi_open(BlockDriverState *bs, QDict *options, int flags,
++                     * reqlist_wait_one return value 0 also means that it
-     scsi_free_scsi_task(task);
+                      * didn't release the lock. So, we are still in the same
-     task = NULL;
+                      * critical section, not interrupted by any concurrent
+                      * access to state.
-+    qemu_mutex_init(&iscsilun->mutex);
+diff --git a/block/reqlist.c b/block/reqlist.c
-     iscsi_attach_aio_context(bs, iscsilun->aio_context);
+new file mode 100644
+index XXXXXXX..XXXXXXX
-     /* Guess the internal cluster (page) size of the iscsi target by the means
+--- /dev/null
-@@ -XXX,XX +XXX,XX @@ static void iscsi_close(BlockDriverState *bs)
++++ b/block/reqlist.c
-     iscsi_destroy_context(iscsi);
+@@ -XXX,XX +XXX,XX @@
-     g_free(iscsilun->zeroblock);
++/*
-     iscsi_allocmap_free(iscsilun);
++ * reqlist API
-+    qemu_mutex_destroy(&iscsilun->mutex);
++ *
-     memset(iscsilun, 0, sizeof(IscsiLun));
++ * Copyright (C) 2013 Proxmox Server Solutions
- }
++ * Copyright (c) 2021 Virtuozzo International GmbH.
++ *
 + * Authors:
 + *  Dietmar Maurer (dietmar@proxmox.com)
 + *  Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + */
 +
 +#include "qemu/osdep.h"
 +
 +#include "block/reqlist.h"
 +
 +void reqlist_init_req(BlockReqList *reqs, BlockReq *req, int64_t offset,
 +                      int64_t bytes)
 +{
 +    assert(!reqlist_find_conflict(reqs, offset, bytes));
 +
 +    *req = (BlockReq) {
 +        .offset = offset,
 +        .bytes = bytes,
 +    };
 +    qemu_co_queue_init(&req->wait_queue);
 +    QLIST_INSERT_HEAD(reqs, req, list);
 +}
 +
 +BlockReq *reqlist_find_conflict(BlockReqList *reqs, int64_t offset,
 +                                int64_t bytes)
 +{
 +    BlockReq *r;
 +
 +    QLIST_FOREACH(r, reqs, list) {
 +        if (offset + bytes > r->offset && offset < r->offset + r->bytes) {
 +            return r;
 +        }
 +    }
 +
 +    return NULL;
 +}
 +
 +bool coroutine_fn reqlist_wait_one(BlockReqList *reqs, int64_t offset,
 +                                   int64_t bytes, CoMutex *lock)
 +{
 +    BlockReq *r = reqlist_find_conflict(reqs, offset, bytes);
 +
 +    if (!r) {
 +        return false;
 +    }
 +
 +    qemu_co_queue_wait(&r->wait_queue, lock);
 +
 +    return true;
 +}
 +
 +void coroutine_fn reqlist_shrink_req(BlockReq *req, int64_t new_bytes)
 +{
 +    if (new_bytes == req->bytes) {
 +        return;
 +    }
 +
 +    assert(new_bytes > 0 && new_bytes < req->bytes);
 +
 +    req->bytes = new_bytes;
 +    qemu_co_queue_restart_all(&req->wait_queue);
 +}
 +
 +void coroutine_fn reqlist_remove_req(BlockReq *req)
 +{
 +    QLIST_REMOVE(req, list);
 +    qemu_co_queue_restart_all(&req->wait_queue);
 +}
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: block/stream.c
  F: block/mirror.c
  F: qapi/job.json
  F: block/block-copy.c
 -F: include/block/block-copy.c
 +F: include/block/block-copy.h
 +F: block/reqlist.c
 +F: include/block/reqlist.h
  F: block/copy-before-write.h
  F: block/copy-before-write.c
  F: include/block/aio_task.h
 diff --git a/block/meson.build b/block/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/block/meson.build
 +++ b/block/meson.build
@@ -XXX,XX +XXX,XX @@ block_ss.add(files(
    'qcow2.c',
    'quorum.c',
    'raw-format.c',
 +  'reqlist.c',
    'snapshot.c',
    'throttle-groups.c',
    'throttle.c',
 --
-.9.3
+.34.1

-New patch
+[PULL 14/23] block/reqlist: reqlist_find_conflict(): use ranges_overlap()
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Let's reuse convenient helper.
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Reviewed-by: Hanna Reitz <hreitz@redhat.com>
+Message-Id: <20220303194349.2304213-8-vsementsov@virtuozzo.com>
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+---
+ block/reqlist.c | 3 ++-
+file changed, 2 insertions(+), 1 deletion(-)
+diff --git a/block/reqlist.c b/block/reqlist.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/reqlist.c
++++ b/block/reqlist.c
+@@ -XXX,XX +XXX,XX @@
+  */
+ #include "qemu/osdep.h"
++#include "qemu/range.h"
+ #include "block/reqlist.h"
+@@ -XXX,XX +XXX,XX @@ BlockReq *reqlist_find_conflict(BlockReqList *reqs, int64_t offset,
+     BlockReq *r;
+     QLIST_FOREACH(r, reqs, list) {
+-        if (offset + bytes > r->offset && offset < r->offset + r->bytes) {
++        if (ranges_overlap(offset, bytes, r->offset, r->bytes)) {
+             return r;
+         }
+     }
+--
+.34.1

-New patch
+[PULL 15/23] block/dirty-bitmap: introduce bdrv_dirty_bitmap_status()
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Add a convenient function similar with bdrv_block_status() to get
+status of dirty bitmap.
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Reviewed-by: Hanna Reitz <hreitz@redhat.com>
+Message-Id: <20220303194349.2304213-9-vsementsov@virtuozzo.com>
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+---
+ include/block/dirty-bitmap.h |  2 ++
+ include/qemu/hbitmap.h       | 12 ++++++++++++
+ block/dirty-bitmap.c         |  6 ++++++
+ util/hbitmap.c               | 33 +++++++++++++++++++++++++++++++++
+files changed, 53 insertions(+)
+diff --git a/include/block/dirty-bitmap.h b/include/block/dirty-bitmap.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/block/dirty-bitmap.h
++++ b/include/block/dirty-bitmap.h
+@@ -XXX,XX +XXX,XX @@ int64_t bdrv_dirty_bitmap_next_zero(BdrvDirtyBitmap *bitmap, int64_t offset,
+ bool bdrv_dirty_bitmap_next_dirty_area(BdrvDirtyBitmap *bitmap,
+         int64_t start, int64_t end, int64_t max_dirty_count,
+         int64_t *dirty_start, int64_t *dirty_count);
++bool bdrv_dirty_bitmap_status(BdrvDirtyBitmap *bitmap, int64_t offset,
++                              int64_t bytes, int64_t *count);
+ BdrvDirtyBitmap *bdrv_reclaim_dirty_bitmap_locked(BdrvDirtyBitmap *bitmap,
+                                                   Error **errp);
+diff --git a/include/qemu/hbitmap.h b/include/qemu/hbitmap.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/qemu/hbitmap.h
++++ b/include/qemu/hbitmap.h
+@@ -XXX,XX +XXX,XX @@ bool hbitmap_next_dirty_area(const HBitmap *hb, int64_t start, int64_t end,
+                              int64_t max_dirty_count,
+                              int64_t *dirty_start, int64_t *dirty_count);
++/*
++ * bdrv_dirty_bitmap_status:
++ * @hb: The HBitmap to operate on
++ * @start: The bit to start from
++ * @count: Number of bits to proceed
++ * @pnum: Out-parameter. How many bits has same value starting from @start
++ *
++ * Returns true if bitmap is dirty at @start, false otherwise.
++ */
++bool hbitmap_status(const HBitmap *hb, int64_t start, int64_t count,
++                    int64_t *pnum);
++
+ /**
+  * hbitmap_iter_next:
+  * @hbi: HBitmapIter to operate on.
+diff --git a/block/dirty-bitmap.c b/block/dirty-bitmap.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/dirty-bitmap.c
++++ b/block/dirty-bitmap.c
+@@ -XXX,XX +XXX,XX @@ bool bdrv_dirty_bitmap_next_dirty_area(BdrvDirtyBitmap *bitmap,
+                                    dirty_start, dirty_count);
+ }
++bool bdrv_dirty_bitmap_status(BdrvDirtyBitmap *bitmap, int64_t offset,
++                              int64_t bytes, int64_t *count)
++{
++    return hbitmap_status(bitmap->bitmap, offset, bytes, count);
++}
++
+ /**
+  * bdrv_merge_dirty_bitmap: merge src into dest.
+  * Ensures permissions on bitmaps are reasonable; use for public API.
+diff --git a/util/hbitmap.c b/util/hbitmap.c
+index XXXXXXX..XXXXXXX 100644
+--- a/util/hbitmap.c
++++ b/util/hbitmap.c
+@@ -XXX,XX +XXX,XX @@ bool hbitmap_next_dirty_area(const HBitmap *hb, int64_t start, int64_t end,
+     return true;
+ }
++bool hbitmap_status(const HBitmap *hb, int64_t start, int64_t count,
++                    int64_t *pnum)
++{
++    int64_t next_dirty, next_zero;
++
++    assert(start >= 0);
++    assert(count > 0);
++    assert(start + count <= hb->orig_size);
++
++    next_dirty = hbitmap_next_dirty(hb, start, count);
++    if (next_dirty == -1) {
++        *pnum = count;
++        return false;
++    }
++
++    if (next_dirty > start) {
++        *pnum = next_dirty - start;
++        return false;
++    }
++
++    assert(next_dirty == start);
++
++    next_zero = hbitmap_next_zero(hb, start, count);
++    if (next_zero == -1) {
++        *pnum = count;
++        return true;
++    }
++
++    assert(next_zero > start);
++    *pnum = next_zero - start;
++    return false;
++}
++
+ bool hbitmap_empty(const HBitmap *hb)
+ {
+     return hb->count == 0;
+--
+.34.1

-New patch
+[PULL 16/23] block/reqlist: add reqlist_wait_all()
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Add function to wait for all intersecting requests.
+To be used in the further commit.
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Reviewed-by: Nikita Lapshin <nikita.lapshin@virtuozzo.com>
+Reviewed-by: Hanna Reitz <hreitz@redhat.com>
+Message-Id: <20220303194349.2304213-10-vsementsov@virtuozzo.com>
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+---
+ include/block/reqlist.h | 8 ++++++++
+ block/reqlist.c         | 8 ++++++++
+files changed, 16 insertions(+)
+diff --git a/include/block/reqlist.h b/include/block/reqlist.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/block/reqlist.h
++++ b/include/block/reqlist.h
+@@ -XXX,XX +XXX,XX @@ BlockReq *reqlist_find_conflict(BlockReqList *reqs, int64_t offset,
+ bool coroutine_fn reqlist_wait_one(BlockReqList *reqs, int64_t offset,
+                                    int64_t bytes, CoMutex *lock);
++/*
++ * Wait for all intersecting requests. It just calls reqlist_wait_one() in a
++ * loop, caller is responsible to stop producing new requests in this region
++ * in parallel, otherwise reqlist_wait_all() may never return.
++ */
++void coroutine_fn reqlist_wait_all(BlockReqList *reqs, int64_t offset,
++                                   int64_t bytes, CoMutex *lock);
++
+ /*
+  * Shrink request and wake all waiting coroutines (maybe some of them are not
+  * intersecting with shrunk request).
+diff --git a/block/reqlist.c b/block/reqlist.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/reqlist.c
++++ b/block/reqlist.c
+@@ -XXX,XX +XXX,XX @@ bool coroutine_fn reqlist_wait_one(BlockReqList *reqs, int64_t offset,
+     return true;
+ }
++void coroutine_fn reqlist_wait_all(BlockReqList *reqs, int64_t offset,
++                                   int64_t bytes, CoMutex *lock)
++{
++    while (reqlist_wait_one(reqs, offset, bytes, lock)) {
++        /* continue */
++    }
++}
++
+ void coroutine_fn reqlist_shrink_req(BlockReq *req, int64_t new_bytes)
+ {
+     if (new_bytes == req->bytes) {
+--
+.34.1

-New patch
+[PULL 17/23] block/io: introduce block driver snapshot-access API
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Add new block driver handlers and corresponding generic wrappers.
+It will be used to allow copy-before-write filter to provide
+reach fleecing interface in further commit.
+In future this approach may be used to allow reading qcow2 internal
+snapshots, for example to export them through NBD.
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Reviewed-by: Hanna Reitz <hreitz@redhat.com>
+Message-Id: <20220303194349.2304213-11-vsementsov@virtuozzo.com>
+[hreitz: Rebased on block GS/IO split]
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+---
+ include/block/block_int-common.h | 18 ++++++++
+ include/block/block_int-io.h     |  9 ++++
+ block/io.c                       | 72 ++++++++++++++++++++++++++++++++
+files changed, 99 insertions(+)
+diff --git a/include/block/block_int-common.h b/include/block/block_int-common.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/block/block_int-common.h
++++ b/include/block/block_int-common.h
+@@ -XXX,XX +XXX,XX @@ struct BlockDriver {
+         bool want_zero, int64_t offset, int64_t bytes, int64_t *pnum,
+         int64_t *map, BlockDriverState **file);
++    /*
++     * Snapshot-access API.
++     *
++     * Block-driver may provide snapshot-access API: special functions to access
++     * some internal "snapshot". The functions are similar with normal
++     * read/block_status/discard handler, but don't have any specific handling
++     * in generic block-layer: no serializing, no alignment, no tracked
++     * requests. So, block-driver that realizes these APIs is fully responsible
++     * for synchronization between snapshot-access API and normal IO requests.
++     */
++    int coroutine_fn (*bdrv_co_preadv_snapshot)(BlockDriverState *bs,
++        int64_t offset, int64_t bytes, QEMUIOVector *qiov, size_t qiov_offset);
++    int coroutine_fn (*bdrv_co_snapshot_block_status)(BlockDriverState *bs,
++        bool want_zero, int64_t offset, int64_t bytes, int64_t *pnum,
++        int64_t *map, BlockDriverState **file);
++    int coroutine_fn (*bdrv_co_pdiscard_snapshot)(BlockDriverState *bs,
++        int64_t offset, int64_t bytes);
++
+     /*
+      * Invalidate any cached meta-data.
+      */
+diff --git a/include/block/block_int-io.h b/include/block/block_int-io.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/block/block_int-io.h
++++ b/include/block/block_int-io.h
+@@ -XXX,XX +XXX,XX @@
+  * the I/O API.
+  */
++int coroutine_fn bdrv_co_preadv_snapshot(BdrvChild *child,
++    int64_t offset, int64_t bytes, QEMUIOVector *qiov, size_t qiov_offset);
++int coroutine_fn bdrv_co_snapshot_block_status(BlockDriverState *bs,
++    bool want_zero, int64_t offset, int64_t bytes, int64_t *pnum,
++    int64_t *map, BlockDriverState **file);
++int coroutine_fn bdrv_co_pdiscard_snapshot(BlockDriverState *bs,
++    int64_t offset, int64_t bytes);
++
++
+ int coroutine_fn bdrv_co_preadv(BdrvChild *child,
+     int64_t offset, int64_t bytes, QEMUIOVector *qiov,
+     BdrvRequestFlags flags);
+diff --git a/block/io.c b/block/io.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/io.c
++++ b/block/io.c
+@@ -XXX,XX +XXX,XX @@ void bdrv_cancel_in_flight(BlockDriverState *bs)
+         bs->drv->bdrv_cancel_in_flight(bs);
+     }
+ }
++
++int coroutine_fn
++bdrv_co_preadv_snapshot(BdrvChild *child, int64_t offset, int64_t bytes,
++                        QEMUIOVector *qiov, size_t qiov_offset)
++{
++    BlockDriverState *bs = child->bs;
++    BlockDriver *drv = bs->drv;
++    int ret;
++    IO_CODE();
++
++    if (!drv) {
++        return -ENOMEDIUM;
++    }
++
++    if (!drv->bdrv_co_preadv_snapshot) {
++        return -ENOTSUP;
++    }
++
++    bdrv_inc_in_flight(bs);
++    ret = drv->bdrv_co_preadv_snapshot(bs, offset, bytes, qiov, qiov_offset);
++    bdrv_dec_in_flight(bs);
++
++    return ret;
++}
++
++int coroutine_fn
++bdrv_co_snapshot_block_status(BlockDriverState *bs,
++                              bool want_zero, int64_t offset, int64_t bytes,
++                              int64_t *pnum, int64_t *map,
++                              BlockDriverState **file)
++{
++    BlockDriver *drv = bs->drv;
++    int ret;
++    IO_CODE();
++
++    if (!drv) {
++        return -ENOMEDIUM;
++    }
++
++    if (!drv->bdrv_co_snapshot_block_status) {
++        return -ENOTSUP;
++    }
++
++    bdrv_inc_in_flight(bs);
++    ret = drv->bdrv_co_snapshot_block_status(bs, want_zero, offset, bytes,
++                                             pnum, map, file);
++    bdrv_dec_in_flight(bs);
++
++    return ret;
++}
++
++int coroutine_fn
++bdrv_co_pdiscard_snapshot(BlockDriverState *bs, int64_t offset, int64_t bytes)
++{
++    BlockDriver *drv = bs->drv;
++    int ret;
++    IO_CODE();
++
++    if (!drv) {
++        return -ENOMEDIUM;
++    }
++
++    if (!drv->bdrv_co_pdiscard_snapshot) {
++        return -ENOTSUP;
++    }
++
++    bdrv_inc_in_flight(bs);
++    ret = drv->bdrv_co_pdiscard_snapshot(bs, offset, bytes);
++    bdrv_dec_in_flight(bs);
++
++    return ret;
++}
+--
+.34.1

-New patch
+[PULL 18/23] block: introduce snapshot-access block driver
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 The new block driver simply utilizes snapshot-access API of underlying
 block node.
 In further patches we want to use it like this:
 [guest]                   [NBD export]
    |                            |
    | root                       | root
    v                 file       v
 [copy-before-write]<------[snapshot-access]
    |           |
    | file      | target
    v           v
 [active-disk] [temp.img]
 This way, NBD client will be able to read snapshotted state of active
 disk, when active disk is continued to be written by guest. This is
 known as "fleecing", and currently uses another scheme based on qcow2
 temporary image which backing file is active-disk. New scheme comes
 with benefits - see next commit.
 The other possible application is exporting internal snapshots of
 qcow2, like this:
 [guest]          [NBD export]
    |                  |
    | root             | root
    v       file       v
 [qcow2]<---------[snapshot-access]
 For this, we'll need to implement snapshot-access API handlers in
 qcow2 driver, and improve snapshot-access block driver (and API) to
 make it possible to select snapshot by name. Another thing to improve
 is size of snapshot. Now for simplicity we just use size of bs->file,
 which is OK for backup, but for qcow2 snapshots export we'll need to
 imporve snapshot-access API to get size of snapshot.
 Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Message-Id: <20220303194349.2304213-12-vsementsov@virtuozzo.com>
 [hreitz: Rebased on block GS/IO split]
 Signed-off-by: Hanna Reitz <hreitz@redhat.com>
 ---
  qapi/block-core.json             |   4 +-
  include/block/block_int-common.h |   6 ++
  block/snapshot-access.c          | 132 +++++++++++++++++++++++++++++++
  MAINTAINERS                      |   1 +
  block/meson.build                |   1 +
 files changed, 143 insertions(+), 1 deletion(-)
  create mode 100644 block/snapshot-access.c
 diff --git a/qapi/block-core.json b/qapi/block-core.json
 index XXXXXXX..XXXXXXX 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
@@ -XXX,XX +XXX,XX @@
  # @blkreplay: Since 4.2
  # @compress: Since 5.0
  # @copy-before-write: Since 6.2
 +# @snapshot-access: Since 7.0
  #
  # Since: 2.9
  ##
  { 'enum': 'BlockdevDriver',
    'data': [ 'blkdebug', 'blklogwrites', 'blkreplay', 'blkverify', 'bochs',
              'cloop', 'compress', 'copy-before-write', 'copy-on-read', 'dmg',
 -            'file', 'ftp', 'ftps', 'gluster',
 +            'file', 'snapshot-access', 'ftp', 'ftps', 'gluster',
              {'name': 'host_cdrom', 'if': 'HAVE_HOST_BLOCK_DEVICE' },
              {'name': 'host_device', 'if': 'HAVE_HOST_BLOCK_DEVICE' },
              'http', 'https', 'iscsi',
@@ -XXX,XX +XXX,XX @@
        'rbd':        'BlockdevOptionsRbd',
        'replication': { 'type': 'BlockdevOptionsReplication',
                         'if': 'CONFIG_REPLICATION' },
 +      'snapshot-access': 'BlockdevOptionsGenericFormat',
        'ssh':        'BlockdevOptionsSsh',
        'throttle':   'BlockdevOptionsThrottle',
        'vdi':        'BlockdevOptionsGenericFormat',
 diff --git a/include/block/block_int-common.h b/include/block/block_int-common.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/block/block_int-common.h
 +++ b/include/block/block_int-common.h
@@ -XXX,XX +XXX,XX @@ struct BlockDriver {
       * in generic block-layer: no serializing, no alignment, no tracked
       * requests. So, block-driver that realizes these APIs is fully responsible
       * for synchronization between snapshot-access API and normal IO requests.
 +     *
 +     * TODO: To be able to support qcow2's internal snapshots, this API will
 +     * need to be extended to:
 +     * - be able to select a specific snapshot
 +     * - receive the snapshot's actual length (which may differ from bs's
 +     *   length)
       */
      int coroutine_fn (*bdrv_co_preadv_snapshot)(BlockDriverState *bs,
          int64_t offset, int64_t bytes, QEMUIOVector *qiov, size_t qiov_offset);
 diff --git a/block/snapshot-access.c b/block/snapshot-access.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/block/snapshot-access.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * snapshot_access block driver
 + *
 + * Copyright (c) 2022 Virtuozzo International GmbH.
 + *
 + * Author:
 + *  Sementsov-Ogievskiy Vladimir <vsementsov@virtuozzo.com>
 + *
 + * This program is free software; you can redistribute it and/or modify
 + * it under the terms of the GNU General Public License as published by
 + * the Free Software Foundation; either version 2 of the License, or
 + * (at your option) any later version.
 + *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU General Public License for more details.
 + *
 + * You should have received a copy of the GNU General Public License
 + * along with this program. If not, see <http://www.gnu.org/licenses/>.
 + */
 +
 +#include "qemu/osdep.h"
 +
 +#include "sysemu/block-backend.h"
 +#include "qemu/cutils.h"
 +#include "block/block_int.h"
 +
 +static coroutine_fn int
 +snapshot_access_co_preadv_part(BlockDriverState *bs,
 +                               int64_t offset, int64_t bytes,
 +                               QEMUIOVector *qiov, size_t qiov_offset,
 +                               BdrvRequestFlags flags)
 +{
 +    if (flags) {
 +        return -ENOTSUP;
 +    }
 +
 +    return bdrv_co_preadv_snapshot(bs->file, offset, bytes, qiov, qiov_offset);
 +}
 +
 +static int coroutine_fn
 +snapshot_access_co_block_status(BlockDriverState *bs,
 +                                bool want_zero, int64_t offset,
 +                                int64_t bytes, int64_t *pnum,
 +                                int64_t *map, BlockDriverState **file)
 +{
 +    return bdrv_co_snapshot_block_status(bs->file->bs, want_zero, offset,
 +                                         bytes, pnum, map, file);
 +}
 +
 +static int coroutine_fn snapshot_access_co_pdiscard(BlockDriverState *bs,
 +                                             int64_t offset, int64_t bytes)
 +{
 +    return bdrv_co_pdiscard_snapshot(bs->file->bs, offset, bytes);
 +}
 +
 +static int coroutine_fn
 +snapshot_access_co_pwrite_zeroes(BlockDriverState *bs,
 +                                 int64_t offset, int64_t bytes,
 +                                 BdrvRequestFlags flags)
 +{
 +    return -ENOTSUP;
 +}
 +
 +static coroutine_fn int
 +snapshot_access_co_pwritev_part(BlockDriverState *bs,
 +                                int64_t offset, int64_t bytes,
 +                                QEMUIOVector *qiov, size_t qiov_offset,
 +                                BdrvRequestFlags flags)
 +{
 +    return -ENOTSUP;
 +}
 +
 +
 +static void snapshot_access_refresh_filename(BlockDriverState *bs)
 +{
 +    pstrcpy(bs->exact_filename, sizeof(bs->exact_filename),
 +            bs->file->bs->filename);
 +}
 +
 +static int snapshot_access_open(BlockDriverState *bs, QDict *options, int flags,
 +                                Error **errp)
 +{
 +    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 +                               BDRV_CHILD_DATA | BDRV_CHILD_PRIMARY,
 +                               false, errp);
 +    if (!bs->file) {
 +        return -EINVAL;
 +    }
 +
 +    bs->total_sectors = bs->file->bs->total_sectors;
 +
 +    return 0;
 +}
 +
 +static void snapshot_access_child_perm(BlockDriverState *bs, BdrvChild *c,
 +                                BdrvChildRole role,
 +                                BlockReopenQueue *reopen_queue,
 +                                uint64_t perm, uint64_t shared,
 +                                uint64_t *nperm, uint64_t *nshared)
 +{
 +    /*
 +     * Currently, we don't need any permissions. If bs->file provides
 +     * snapshot-access API, we can use it.
 +     */
 +    *nperm = 0;
 +    *nshared = BLK_PERM_ALL;
 +}
 +
 +BlockDriver bdrv_snapshot_access_drv = {
 +    .format_name = "snapshot-access",
 +
 +    .bdrv_open                  = snapshot_access_open,
 +
 +    .bdrv_co_preadv_part        = snapshot_access_co_preadv_part,
 +    .bdrv_co_pwritev_part       = snapshot_access_co_pwritev_part,
 +    .bdrv_co_pwrite_zeroes      = snapshot_access_co_pwrite_zeroes,
 +    .bdrv_co_pdiscard           = snapshot_access_co_pdiscard,
 +    .bdrv_co_block_status       = snapshot_access_co_block_status,
 +
 +    .bdrv_refresh_filename      = snapshot_access_refresh_filename,
 +
 +    .bdrv_child_perm            = snapshot_access_child_perm,
 +};
 +
 +static void snapshot_access_init(void)
 +{
 +    bdrv_register(&bdrv_snapshot_access_drv);
 +}
 +
 +block_init(snapshot_access_init);
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: block/reqlist.c
  F: include/block/reqlist.h
  F: block/copy-before-write.h
  F: block/copy-before-write.c
 +F: block/snapshot-access.c
  F: include/block/aio_task.h
  F: block/aio_task.c
  F: util/qemu-co-shared-resource.c
 diff --git a/block/meson.build b/block/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/block/meson.build
 +++ b/block/meson.build
@@ -XXX,XX +XXX,XX @@ block_ss.add(files(
    'raw-format.c',
    'reqlist.c',
    'snapshot.c',
 +  'snapshot-access.c',
    'throttle-groups.c',
    'throttle.c',
    'vhdx-endian.c',
 --
 .34.1

-[Qemu-devel] [PULL 2/4] nfs: do not use aio_context_acquire/release
+[PULL 19/23] block: copy-before-write: realize snapshot-access API
-From: Paolo Bonzini <pbonzini@redhat.com>
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Now that all bottom halves and callbacks take care of taking the
+Current scheme of image fleecing looks like this:
-AioContext lock, we can migrate some users away from it and to a
-specific QemuMutex or CoMutex.
+[guest]                    [NBD export]
+  |                              |
-Protect libnfs calls with a QemuMutex.  Callbacks are invoked
+  |root                          | root
-using bottom halves, so we don't even have to drop it around
+  v                              v
-callback invocations.
+[copy-before-write] -----> [temp.qcow2]
+  |                 target  |
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+  |file                     |backing
-Message-id: 20170222180725.28611-3-pbonzini@redhat.com
+  v                         |
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+[active disk] <-------------+
  - On guest writes copy-before-write filter copies old data from active
    disk to temp.qcow2. So fleecing client (NBD export) when reads
    changed regions from temp.qcow2 image and unchanged from active disk
    through backing link.
 This patch makes possible new image fleecing scheme:
 [guest]                   [NBD export]
    |                            |
    | root                       | root
    v                 file       v
 [copy-before-write]<------[snapshot-access]
    |           |
    | file      | target
    v           v
 [active-disk] [temp.img]
  - copy-before-write does CBW operations and also provides
    snapshot-access API. The API may be accessed through
    snapshot-access driver.
 Benefits of new scheme:
 . Access control: if remote client try to read data that not covered
    by original dirty bitmap used on copy-before-write open, client gets
    -EACCES.
 . Discard support: if remote client do DISCARD, this additionally to
    discarding data in temp.img informs block-copy process to not copy
    these clusters. Next read from discarded area will return -EACCES.
    This is significant thing: when fleecing user reads data that was
    not yet copied to temp.img, we can avoid copying it on further guest
    write.
 . Synchronisation between client reads and block-copy write is more
    efficient. In old scheme we just rely on BDRV_REQ_SERIALISING flag
    used for writes to temp.qcow2. New scheme is less blocking:
      - fleecing reads are never blocked: if data region is untouched or
        in-flight, we just read from active-disk, otherwise we read from
        temp.img
      - writes to temp.img are not blocked by fleecing reads
      - still, guest writes of-course are blocked by in-flight fleecing
        reads, that currently read from active-disk - it's the minimum
        necessary blocking
 . Temporary image may be of any format, as we don't rely on backing
    feature.
 . Permission relation are simplified. With old scheme we have to share
    write permission on target child of copy-before-write, otherwise
    backing link conflicts with copy-before-write file child write
    permissions. With new scheme we don't have backing link, and
    copy-before-write node may have unshared access to temporary node.
    (Not realized in this commit, will be in future).
 . Having control on fleecing reads we'll be able to implement
    alternative behavior on failed copy-before-write operations.
    Currently we just break guest request (that's a historical behavior
    of backup). But in some scenarios it's a bad behavior: better
    is to drop the backup as failed but don't break guest request.
    With new scheme we can simply unset some bits in a bitmap on CBW
    failure and further fleecing reads will -EACCES, or something like
    this. (Not implemented in this commit, will be in future)
    Additional application for this is implementing timeout for CBW
    operations.
 Iotest 257 output is updated, as two more bitmaps now live in
 copy-before-write filter.
 Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Message-Id: <20220303194349.2304213-13-vsementsov@virtuozzo.com>
 Signed-off-by: Hanna Reitz <hreitz@redhat.com>
 ---
- block/nfs.c | 23 +++++++++++++++++++----
+ block/copy-before-write.c  | 212 ++++++++++++++++++++++++++++++++++-
-file changed, 19 insertions(+), 4 deletions(-)
+ tests/qemu-iotests/257.out | 224 +++++++++++++++++++++++++++++++++++++
+files changed, 435 insertions(+), 1 deletion(-)
-diff --git a/block/nfs.c b/block/nfs.c
 diff --git a/block/copy-before-write.c b/block/copy-before-write.c
 index XXXXXXX..XXXXXXX 100644
---- a/block/nfs.c
+--- a/block/copy-before-write.c
-+++ b/block/nfs.c
++++ b/block/copy-before-write.c
-@@ -XXX,XX +XXX,XX @@ typedef struct NFSClient {
+@@ -XXX,XX +XXX,XX @@
-     int events;
+ #include "block/block-copy.h"
-     bool has_zero_init;
-     AioContext *aio_context;
+ #include "block/copy-before-write.h"
-+    QemuMutex mutex;
++#include "block/reqlist.h"
-     blkcnt_t st_blocks;
-     bool cache_used;
+ #include "qapi/qapi-visit-block-core.h"
-     NFSServer *server;
-@@ -XXX,XX +XXX,XX @@ static void nfs_parse_filename(const char *filename, QDict *options,
+ typedef struct BDRVCopyBeforeWriteState {
- static void nfs_process_read(void *arg);
+     BlockCopyState *bcs;
- static void nfs_process_write(void *arg);
+     BdrvChild *target;
++
-+/* Called with QemuMutex held.  */
++    /*
- static void nfs_set_events(NFSClient *client)
++     * @lock: protects access to @access_bitmap, @done_bitmap and
- {
++     * @frozen_read_reqs
-     int ev = nfs_which_events(client->context);
++     */
-@@ -XXX,XX +XXX,XX @@ static void nfs_process_read(void *arg)
++    CoMutex lock;
- {
++
-     NFSClient *client = arg;
++    /*
++     * @access_bitmap: represents areas allowed for reading by fleecing user.
--    aio_context_acquire(client->aio_context);
++     * Reading from non-dirty areas leads to -EACCES.
-+    qemu_mutex_lock(&client->mutex);
++     */
-     nfs_service(client->context, POLLIN);
++    BdrvDirtyBitmap *access_bitmap;
-     nfs_set_events(client);
++
--    aio_context_release(client->aio_context);
++    /*
-+    qemu_mutex_unlock(&client->mutex);
++     * @done_bitmap: represents areas that was successfully copied to @target by
 +     * copy-before-write operations.
 +     */
 +    BdrvDirtyBitmap *done_bitmap;
 +
 +    /*
 +     * @frozen_read_reqs: current read requests for fleecing user in bs->file
 +     * node. These areas must not be rewritten by guest.
 +     */
 +    BlockReqList frozen_read_reqs;
  } BDRVCopyBeforeWriteState;
  static coroutine_fn int cbw_co_preadv(
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int cbw_co_preadv(
      return bdrv_co_preadv(bs->file, offset, bytes, qiov, flags);
  }
- static void nfs_process_write(void *arg)
++/*
- {
++ * Do copy-before-write operation.
-     NFSClient *client = arg;
++ *
++ * On failure guest request must be failed too.
--    aio_context_acquire(client->aio_context);
++ *
-+    qemu_mutex_lock(&client->mutex);
++ * On success, we also wait for all in-flight fleecing read requests in source
-     nfs_service(client->context, POLLOUT);
++ * node, and it's guaranteed that after cbw_do_copy_before_write() successful
-     nfs_set_events(client);
++ * return there are no such requests and they will never appear.
--    aio_context_release(client->aio_context);
++ */
-+    qemu_mutex_unlock(&client->mutex);
+ static coroutine_fn int cbw_do_copy_before_write(BlockDriverState *bs,
          uint64_t offset, uint64_t bytes, BdrvRequestFlags flags)
  {
      BDRVCopyBeforeWriteState *s = bs->opaque;
 +    int ret;
      uint64_t off, end;
      int64_t cluster_size = block_copy_cluster_size(s->bcs);
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int cbw_do_copy_before_write(BlockDriverState *bs,
      off = QEMU_ALIGN_DOWN(offset, cluster_size);
      end = QEMU_ALIGN_UP(offset + bytes, cluster_size);
 -    return block_copy(s->bcs, off, end - off, true);
 +    ret = block_copy(s->bcs, off, end - off, true);
 +    if (ret < 0) {
 +        return ret;
 +    }
 +
 +    WITH_QEMU_LOCK_GUARD(&s->lock) {
 +        bdrv_set_dirty_bitmap(s->done_bitmap, off, end - off);
 +        reqlist_wait_all(&s->frozen_read_reqs, off, end - off, &s->lock);
 +    }
 +
 +    return 0;
  }
- static void nfs_co_init_task(BlockDriverState *bs, NFSRPC *task)
+ static int coroutine_fn cbw_co_pdiscard(BlockDriverState *bs,
-@@ -XXX,XX +XXX,XX @@ static void nfs_co_generic_bh_cb(void *opaque)
+@@ -XXX,XX +XXX,XX @@ static int coroutine_fn cbw_co_flush(BlockDriverState *bs)
-     aio_co_wake(task->co);
+     return bdrv_co_flush(bs->file->bs);
  }
-+/* Called (via nfs_service) with QemuMutex held.  */
++/*
- static void
++ * If @offset not accessible - return NULL.
- nfs_co_generic_cb(int ret, struct nfs_context *nfs, void *data,
++ *
-                   void *private_data)
++ * Otherwise, set @pnum to some bytes that accessible from @file (@file is set
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn nfs_co_preadv(BlockDriverState *bs, uint64_t offset,
++ * to bs->file or to s->target). Return newly allocated BlockReq object that
-     nfs_co_init_task(bs, &task);
++ * should be than passed to cbw_snapshot_read_unlock().
-     task.iov = iov;
++ *
++ * It's guaranteed that guest writes will not interact in the region until
-+    qemu_mutex_lock(&client->mutex);
++ * cbw_snapshot_read_unlock() called.
-     if (nfs_pread_async(client->context, client->fh,
++ */
-                         offset, bytes, nfs_co_generic_cb, &task) != 0) {
++static BlockReq *cbw_snapshot_read_lock(BlockDriverState *bs,
-+        qemu_mutex_unlock(&client->mutex);
++                                        int64_t offset, int64_t bytes,
-         return -ENOMEM;
++                                        int64_t *pnum, BdrvChild **file)
 +{
 +    BDRVCopyBeforeWriteState *s = bs->opaque;
 +    BlockReq *req = g_new(BlockReq, 1);
 +    bool done;
 +
 +    QEMU_LOCK_GUARD(&s->lock);
 +
 +    if (bdrv_dirty_bitmap_next_zero(s->access_bitmap, offset, bytes) != -1) {
 +        g_free(req);
 +        return NULL;
 +    }
 +
 +    done = bdrv_dirty_bitmap_status(s->done_bitmap, offset, bytes, pnum);
 +    if (done) {
 +        /*
 +         * Special invalid BlockReq, that is handled in
 +         * cbw_snapshot_read_unlock(). We don't need to lock something to read
 +         * from s->target.
 +         */
 +        *req = (BlockReq) {.offset = -1, .bytes = -1};
 +        *file = s->target;
 +    } else {
 +        reqlist_init_req(&s->frozen_read_reqs, req, offset, bytes);
 +        *file = bs->file;
 +    }
 +
 +    return req;
 +}
 +
 +static void cbw_snapshot_read_unlock(BlockDriverState *bs, BlockReq *req)
 +{
 +    BDRVCopyBeforeWriteState *s = bs->opaque;
 +
 +    if (req->offset == -1 && req->bytes == -1) {
 +        g_free(req);
 +        return;
 +    }
 +
 +    QEMU_LOCK_GUARD(&s->lock);
 +
 +    reqlist_remove_req(req);
 +    g_free(req);
 +}
 +
 +static coroutine_fn int
 +cbw_co_preadv_snapshot(BlockDriverState *bs, int64_t offset, int64_t bytes,
 +                       QEMUIOVector *qiov, size_t qiov_offset)
 +{
 +    BlockReq *req;
 +    BdrvChild *file;
 +    int ret;
 +
 +    /* TODO: upgrade to async loop using AioTask */
 +    while (bytes) {
 +        int64_t cur_bytes;
 +
 +        req = cbw_snapshot_read_lock(bs, offset, bytes, &cur_bytes, &file);
 +        if (!req) {
 +            return -EACCES;
 +        }
 +
 +        ret = bdrv_co_preadv_part(file, offset, cur_bytes,
 +                                  qiov, qiov_offset, 0);
 +        cbw_snapshot_read_unlock(bs, req);
 +        if (ret < 0) {
 +            return ret;
 +        }
 +
 +        bytes -= cur_bytes;
 +        offset += cur_bytes;
 +        qiov_offset += cur_bytes;
 +    }
 +
 +    return 0;
 +}
 +
 +static int coroutine_fn
 +cbw_co_snapshot_block_status(BlockDriverState *bs,
 +                             bool want_zero, int64_t offset, int64_t bytes,
 +                             int64_t *pnum, int64_t *map,
 +                             BlockDriverState **file)
 +{
 +    BDRVCopyBeforeWriteState *s = bs->opaque;
 +    BlockReq *req;
 +    int ret;
 +    int64_t cur_bytes;
 +    BdrvChild *child;
 +
 +    req = cbw_snapshot_read_lock(bs, offset, bytes, &cur_bytes, &child);
 +    if (!req) {
 +        return -EACCES;
 +    }
 +
 +    ret = bdrv_block_status(child->bs, offset, cur_bytes, pnum, map, file);
 +    if (child == s->target) {
 +        /*
 +         * We refer to s->target only for areas that we've written to it.
 +         * And we can not report unallocated blocks in s->target: this will
 +         * break generic block-status-above logic, that will go to
 +         * copy-before-write filtered child in this case.
 +         */
 +        assert(ret & BDRV_BLOCK_ALLOCATED);
 +    }
 +
 +    cbw_snapshot_read_unlock(bs, req);
 +
 +    return ret;
 +}
 +
 +static int coroutine_fn cbw_co_pdiscard_snapshot(BlockDriverState *bs,
 +                                                 int64_t offset, int64_t bytes)
 +{
 +    BDRVCopyBeforeWriteState *s = bs->opaque;
 +
 +    WITH_QEMU_LOCK_GUARD(&s->lock) {
 +        bdrv_reset_dirty_bitmap(s->access_bitmap, offset, bytes);
 +    }
 +
 +    block_copy_reset(s->bcs, offset, bytes);
 +
 +    return bdrv_co_pdiscard(s->target, offset, bytes);
 +}
 +
  static void cbw_refresh_filename(BlockDriverState *bs)
  {
      pstrcpy(bs->exact_filename, sizeof(bs->exact_filename),
@@ -XXX,XX +XXX,XX @@ static int cbw_open(BlockDriverState *bs, QDict *options, int flags,
  {
      BDRVCopyBeforeWriteState *s = bs->opaque;
      BdrvDirtyBitmap *bitmap = NULL;
 +    int64_t cluster_size;
      bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
                                 BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
@@ -XXX,XX +XXX,XX @@ static int cbw_open(BlockDriverState *bs, QDict *options, int flags,
          return -EINVAL;
      }
-     nfs_set_events(client);
++    cluster_size = block_copy_cluster_size(s->bcs);
-+    qemu_mutex_unlock(&client->mutex);
++
-     while (!task.complete) {
++    s->done_bitmap = bdrv_create_dirty_bitmap(bs, cluster_size, NULL, errp);
-         qemu_coroutine_yield();
++    if (!s->done_bitmap) {
-     }
++        return -EINVAL;
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn nfs_co_pwritev(BlockDriverState *bs, uint64_t offset,
++    }
-         buf = iov->iov[0].iov_base;
++    bdrv_disable_dirty_bitmap(s->done_bitmap);
-     }
++
++    /* s->access_bitmap starts equal to bcs bitmap */
-+    qemu_mutex_lock(&client->mutex);
++    s->access_bitmap = bdrv_create_dirty_bitmap(bs, cluster_size, NULL, errp);
-     if (nfs_pwrite_async(client->context, client->fh,
++    if (!s->access_bitmap) {
-                          offset, bytes, buf,
++        return -EINVAL;
-                          nfs_co_generic_cb, &task) != 0) {
++    }
-+        qemu_mutex_unlock(&client->mutex);
++    bdrv_disable_dirty_bitmap(s->access_bitmap);
-         if (my_buffer) {
++    bdrv_dirty_bitmap_merge_internal(s->access_bitmap,
-             g_free(buf);
++                                     block_copy_dirty_bitmap(s->bcs), NULL,
-         }
++                                     true);
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn nfs_co_pwritev(BlockDriverState *bs, uint64_t offset,
++
-     }
++    qemu_co_mutex_init(&s->lock);
++    QLIST_INIT(&s->frozen_read_reqs);
-     nfs_set_events(client);
++
-+    qemu_mutex_unlock(&client->mutex);
+     return 0;
      while (!task.complete) {
          qemu_coroutine_yield();
      }
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn nfs_co_flush(BlockDriverState *bs)
      nfs_co_init_task(bs, &task);
 +    qemu_mutex_lock(&client->mutex);
      if (nfs_fsync_async(client->context, client->fh, nfs_co_generic_cb,
                          &task) != 0) {
 +        qemu_mutex_unlock(&client->mutex);
          return -ENOMEM;
      }
      nfs_set_events(client);
 +    qemu_mutex_unlock(&client->mutex);
      while (!task.complete) {
          qemu_coroutine_yield();
      }
@@ -XXX,XX +XXX,XX @@ static void nfs_file_close(BlockDriverState *bs)
  {
      NFSClient *client = bs->opaque;
      nfs_client_close(client);
 +    qemu_mutex_destroy(&client->mutex);
  }
- static NFSServer *nfs_config(QDict *options, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static void cbw_close(BlockDriverState *bs)
-@@ -XXX,XX +XXX,XX @@ static int nfs_file_open(BlockDriverState *bs, QDict *options, int flags,
+ {
-     if (ret < 0) {
+     BDRVCopyBeforeWriteState *s = bs->opaque;
-         return ret;
-     }
++    bdrv_release_dirty_bitmap(s->access_bitmap);
-+    qemu_mutex_init(&client->mutex);
++    bdrv_release_dirty_bitmap(s->done_bitmap);
-     bs->total_sectors = ret;
++
-     ret = 0;
+     block_copy_state_free(s->bcs);
-     return ret;
+     s->bcs = NULL;
@@ -XXX,XX +XXX,XX @@ static int nfs_has_zero_init(BlockDriverState *bs)
      return client->has_zero_init;
  }
+@@ -XXX,XX +XXX,XX @@ BlockDriver bdrv_cbw_filter = {
-+/* Called (via nfs_service) with QemuMutex held.  */
+     .bdrv_co_pdiscard           = cbw_co_pdiscard,
- static void
+     .bdrv_co_flush              = cbw_co_flush,
- nfs_get_allocated_file_size_cb(int ret, struct nfs_context *nfs, void *data,
-                                void *private_data)
++    .bdrv_co_preadv_snapshot       = cbw_co_preadv_snapshot,
 +    .bdrv_co_pdiscard_snapshot     = cbw_co_pdiscard_snapshot,
 +    .bdrv_co_snapshot_block_status = cbw_co_snapshot_block_status,
 +
      .bdrv_refresh_filename      = cbw_refresh_filename,
      .bdrv_child_perm            = cbw_child_perm,
 diff --git a/tests/qemu-iotests/257.out b/tests/qemu-iotests/257.out
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/qemu-iotests/257.out
 +++ b/tests/qemu-iotests/257.out
@@ -XXX,XX +XXX,XX @@ write -P0x67 0x3fe0000 0x20000
  {"return": ""}
  {
    "bitmaps": {
 +    "backup-top": [
 +      {
 +        "busy": false,
 +        "count": 67108864,
 +        "granularity": 65536,
 +        "persistent": false,
 +        "recording": false
 +      },
 +      {
 +        "busy": false,
 +        "count": 458752,
 +        "granularity": 65536,
 +        "persistent": false,
 +        "recording": false
 +      }
 +    ],
      "drive0": [
        {
          "busy": false,
@@ -XXX,XX +XXX,XX @@ write -P0x67 0x3fe0000 0x20000
  {"return": ""}
  {
    "bitmaps": {
 +    "backup-top": [
 +      {
 +        "busy": false,
 +        "count": 67108864,
 +        "granularity": 65536,
 +        "persistent": false,
 +        "recording": false
 +      },
 +      {
 +        "busy": false,
 +        "count": 458752,
 +        "granularity": 65536,
 +        "persistent": false,
 +        "recording": false
 +      }
 +    ],
      "drive0": [
        {
          "busy": false,
@@ -XXX,XX +XXX,XX @@ write -P0x67 0x3fe0000 0x20000
  {"return": ""}
  {
    "bitmaps": {
 +    "backup-top": [
 +      {
 +        "busy": false,
 +        "count": 67108864,
 +        "granularity": 65536,
 +        "persistent": false,
 +        "recording": false
 +      },
 +      {
 +        "busy": false,
 +        "count": 458752,
 +        "granularity": 65536,
 +        "persistent": false,
 +        "recording": false
 +      }
 +    ],
      "drive0": [
        {
          "busy": false,
@@ -XXX,XX +XXX,XX @@ write -P0x67 0x3fe0000 0x20000
  {"return": ""}
  {
    "bitmaps": {
 +    "backup-top": [
 +      {
 +        "busy": false,
 +        "count": 67108864,
 +        "granularity": 65536,
 +        "persistent": false,
 +        "recording": false
 +      },
 +      {
 +        "busy": false,
 +        "count": 458752,
 +        "granularity": 65536,
 +        "persistent": false,
 +        "recording": false
 +      }
 +    ],
      "drive0": [
        {
          "busy": false,
@@ -XXX,XX +XXX,XX @@ write -P0x67 0x3fe0000 0x20000
  {"return": ""}
  {
    "bitmaps": {
 +    "backup-top": [
 +      {
 +        "busy": false,
 +        "count": 67108864,
 +        "granularity": 65536,
 +        "persistent": false,
 +        "recording": false
 +      },
 +      {
 +        "busy": false,
 +        "count": 458752,
 +        "granularity": 65536,
 +        "persistent": false,
 +        "recording": false
 +      }
 +    ],
      "drive0": [
        {
          "busy": false,
@@ -XXX,XX +XXX,XX @@ write -P0x67 0x3fe0000 0x20000
  {"return": ""}
  {
    "bitmaps": {
 +    "backup-top": [
 +      {
 +        "busy": false,
 +        "count": 67108864,
 +        "granularity": 65536,
 +        "persistent": false,
 +        "recording": false
 +      },
 +      {
 +        "busy": false,
 +        "count": 458752,
 +        "granularity": 65536,
 +        "persistent": false,
 +        "recording": false
 +      }
 +    ],
      "drive0": [
        {
          "busy": false,
@@ -XXX,XX +XXX,XX @@ write -P0x67 0x3fe0000 0x20000
  {"return": ""}
  {
    "bitmaps": {
 +    "backup-top": [
 +      {
 +        "busy": false,
 +        "count": 67108864,
 +        "granularity": 65536,
 +        "persistent": false,
 +        "recording": false
 +      },
 +      {
 +        "busy": false,
 +        "count": 458752,
 +        "granularity": 65536,
 +        "persistent": false,
 +        "recording": false
 +      }
 +    ],
      "drive0": [
        {
          "busy": false,
@@ -XXX,XX +XXX,XX @@ write -P0x67 0x3fe0000 0x20000
  {"return": ""}
  {
    "bitmaps": {
 +    "backup-top": [
 +      {
 +        "busy": false,
 +        "count": 67108864,
 +        "granularity": 65536,
 +        "persistent": false,
 +        "recording": false
 +      },
 +      {
 +        "busy": false,
 +        "count": 458752,
 +        "granularity": 65536,
 +        "persistent": false,
 +        "recording": false
 +      }
 +    ],
      "drive0": [
        {
          "busy": false,
@@ -XXX,XX +XXX,XX @@ write -P0x67 0x3fe0000 0x20000
  {"return": ""}
  {
    "bitmaps": {
 +    "backup-top": [
 +      {
 +        "busy": false,
 +        "count": 67108864,
 +        "granularity": 65536,
 +        "persistent": false,
 +        "recording": false
 +      },
 +      {
 +        "busy": false,
 +        "count": 458752,
 +        "granularity": 65536,
 +        "persistent": false,
 +        "recording": false
 +      }
 +    ],
      "drive0": [
        {
          "busy": false,
@@ -XXX,XX +XXX,XX @@ write -P0x67 0x3fe0000 0x20000
  {"return": ""}
  {
    "bitmaps": {
 +    "backup-top": [
 +      {
 +        "busy": false,
 +        "count": 67108864,
 +        "granularity": 65536,
 +        "persistent": false,
 +        "recording": false
 +      },
 +      {
 +        "busy": false,
 +        "count": 458752,
 +        "granularity": 65536,
 +        "persistent": false,
 +        "recording": false
 +      }
 +    ],
      "drive0": [
        {
          "busy": false,
@@ -XXX,XX +XXX,XX @@ write -P0x67 0x3fe0000 0x20000
  {"return": ""}
  {
    "bitmaps": {
 +    "backup-top": [
 +      {
 +        "busy": false,
 +        "count": 67108864,
 +        "granularity": 65536,
 +        "persistent": false,
 +        "recording": false
 +      },
 +      {
 +        "busy": false,
 +        "count": 458752,
 +        "granularity": 65536,
 +        "persistent": false,
 +        "recording": false
 +      }
 +    ],
      "drive0": [
        {
          "busy": false,
@@ -XXX,XX +XXX,XX @@ write -P0x67 0x3fe0000 0x20000
  {"return": ""}
  {
    "bitmaps": {
 +    "backup-top": [
 +      {
 +        "busy": false,
 +        "count": 67108864,
 +        "granularity": 65536,
 +        "persistent": false,
 +        "recording": false
 +      },
 +      {
 +        "busy": false,
 +        "count": 458752,
 +        "granularity": 65536,
 +        "persistent": false,
 +        "recording": false
 +      }
 +    ],
      "drive0": [
        {
          "busy": false,
@@ -XXX,XX +XXX,XX @@ write -P0x67 0x3fe0000 0x20000
  {"return": ""}
  {
    "bitmaps": {
 +    "backup-top": [
 +      {
 +        "busy": false,
 +        "count": 67108864,
 +        "granularity": 65536,
 +        "persistent": false,
 +        "recording": false
 +      },
 +      {
 +        "busy": false,
 +        "count": 458752,
 +        "granularity": 65536,
 +        "persistent": false,
 +        "recording": false
 +      }
 +    ],
      "drive0": [
        {
          "busy": false,
@@ -XXX,XX +XXX,XX @@ write -P0x67 0x3fe0000 0x20000
  {"return": ""}
  {
    "bitmaps": {
 +    "backup-top": [
 +      {
 +        "busy": false,
 +        "count": 67108864,
 +        "granularity": 65536,
 +        "persistent": false,
 +        "recording": false
 +      },
 +      {
 +        "busy": false,
 +        "count": 458752,
 +        "granularity": 65536,
 +        "persistent": false,
 +        "recording": false
 +      }
 +    ],
      "drive0": [
        {
          "busy": false,
 --
-.9.3
+.34.1

-New patch
+[PULL 20/23] iotests/image-fleecing: add test-case for fleecing format node
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Reviewed-by: Hanna Reitz <hreitz@redhat.com>
+Message-Id: <20220303194349.2304213-14-vsementsov@virtuozzo.com>
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+---
+ tests/qemu-iotests/tests/image-fleecing     | 64 +++++++++++++-----
+ tests/qemu-iotests/tests/image-fleecing.out | 74 ++++++++++++++++++++-
+files changed, 119 insertions(+), 19 deletions(-)
+diff --git a/tests/qemu-iotests/tests/image-fleecing b/tests/qemu-iotests/tests/image-fleecing
+index XXXXXXX..XXXXXXX 100755
+--- a/tests/qemu-iotests/tests/image-fleecing
++++ b/tests/qemu-iotests/tests/image-fleecing
+@@ -XXX,XX +XXX,XX @@ remainder = [('0xd5', '0x108000',  '32k'), # Right-end of partial-left [1]
+              ('0xdc', '32M',       '32k'), # Left-end of partial-right [2]
+              ('0xcd', '0x3ff0000', '64k')] # patterns[3]
+-def do_test(use_cbw, base_img_path, fleece_img_path, nbd_sock_path, vm):
++def do_test(use_cbw, use_snapshot_access_filter, base_img_path,
++            fleece_img_path, nbd_sock_path, vm):
+     log('--- Setting up images ---')
+     log('')
+     assert qemu_img('create', '-f', iotests.imgfmt, base_img_path, '64M') == 0
+-    assert qemu_img('create', '-f', 'qcow2', fleece_img_path, '64M') == 0
++    if use_snapshot_access_filter:
++        assert use_cbw
++        assert qemu_img('create', '-f', 'raw', fleece_img_path, '64M') == 0
++    else:
++        assert qemu_img('create', '-f', 'qcow2', fleece_img_path, '64M') == 0
+     for p in patterns:
+         qemu_io('-f', iotests.imgfmt,
+@@ -XXX,XX +XXX,XX @@ def do_test(use_cbw, base_img_path, fleece_img_path, nbd_sock_path, vm):
+     log('')
+-    # create tmp_node backed by src_node
+-    log(vm.qmp('blockdev-add', {
+-        'driver': 'qcow2',
+-        'node-name': tmp_node,
+-        'file': {
++    if use_snapshot_access_filter:
++        log(vm.qmp('blockdev-add', {
++            'node-name': tmp_node,
+             'driver': 'file',
+             'filename': fleece_img_path,
+-        },
+-        'backing': src_node,
+-    }))
++        }))
++    else:
++        # create tmp_node backed by src_node
++        log(vm.qmp('blockdev-add', {
++            'driver': 'qcow2',
++            'node-name': tmp_node,
++            'file': {
++                'driver': 'file',
++                'filename': fleece_img_path,
++            },
++            'backing': src_node,
++        }))
+     # Establish CBW from source to fleecing node
+     if use_cbw:
+@@ -XXX,XX +XXX,XX @@ def do_test(use_cbw, base_img_path, fleece_img_path, nbd_sock_path, vm):
+         }))
+         log(vm.qmp('qom-set', path=qom_path, property='drive', value='fl-cbw'))
++
++        if use_snapshot_access_filter:
++            log(vm.qmp('blockdev-add', {
++                'driver': 'snapshot-access',
++                'node-name': 'fl-access',
++                'file': 'fl-cbw',
++            }))
+     else:
+         log(vm.qmp('blockdev-backup',
+                    job_id='fleecing',
+@@ -XXX,XX +XXX,XX @@ def do_test(use_cbw, base_img_path, fleece_img_path, nbd_sock_path, vm):
+                    target=tmp_node,
+                    sync='none'))
++    export_node = 'fl-access' if use_snapshot_access_filter else tmp_node
++
+     log('')
+     log('--- Setting up NBD Export ---')
+     log('')
+-    nbd_uri = 'nbd+unix:///%s?socket=%s' % (tmp_node, nbd_sock_path)
++    nbd_uri = 'nbd+unix:///%s?socket=%s' % (export_node, nbd_sock_path)
+     log(vm.qmp('nbd-server-start',
+                {'addr': {'type': 'unix',
+                          'data': {'path': nbd_sock_path}}}))
+-    log(vm.qmp('nbd-server-add', device=tmp_node))
++    log(vm.qmp('nbd-server-add', device=export_node))
+     log('')
+     log('--- Sanity Check ---')
+@@ -XXX,XX +XXX,XX @@ def do_test(use_cbw, base_img_path, fleece_img_path, nbd_sock_path, vm):
+     log('--- Cleanup ---')
+     log('')
++    log(vm.qmp('nbd-server-stop'))
++
+     if use_cbw:
++        if use_snapshot_access_filter:
++            log(vm.qmp('blockdev-del', node_name='fl-access'))
+         log(vm.qmp('qom-set', path=qom_path, property='drive', value=src_node))
+         log(vm.qmp('blockdev-del', node_name='fl-cbw'))
+     else:
+@@ -XXX,XX +XXX,XX @@ def do_test(use_cbw, base_img_path, fleece_img_path, nbd_sock_path, vm):
+         assert e is not None
+         log(e, filters=[iotests.filter_qmp_event])
+-    log(vm.qmp('nbd-server-stop'))
+     log(vm.qmp('blockdev-del', node_name=tmp_node))
+     vm.shutdown()
+@@ -XXX,XX +XXX,XX @@ def do_test(use_cbw, base_img_path, fleece_img_path, nbd_sock_path, vm):
+     log('Done')
+-def test(use_cbw):
++def test(use_cbw, use_snapshot_access_filter):
+     with iotests.FilePath('base.img') as base_img_path, \
+          iotests.FilePath('fleece.img') as fleece_img_path, \
+          iotests.FilePath('nbd.sock',
+                           base_dir=iotests.sock_dir) as nbd_sock_path, \
+          iotests.VM() as vm:
+-        do_test(use_cbw, base_img_path, fleece_img_path, nbd_sock_path, vm)
++        do_test(use_cbw, use_snapshot_access_filter, base_img_path,
++                fleece_img_path, nbd_sock_path, vm)
+ log('=== Test backup(sync=none) based fleecing ===\n')
+-test(False)
++test(False, False)
++
++log('=== Test cbw-filter based fleecing ===\n')
++test(True, False)
+-log('=== Test filter based fleecing ===\n')
+-test(True)
++log('=== Test fleecing-format based fleecing ===\n')
++test(True, True)
+diff --git a/tests/qemu-iotests/tests/image-fleecing.out b/tests/qemu-iotests/tests/image-fleecing.out
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/qemu-iotests/tests/image-fleecing.out
++++ b/tests/qemu-iotests/tests/image-fleecing.out
+@@ -XXX,XX +XXX,XX @@ read -P0 0x3fe0000 64k
+ --- Cleanup ---
++{"return": {}}
+ {"return": {}}
+ {"data": {"device": "fleecing", "len": 67108864, "offset": 393216, "speed": 0, "type": "backup"}, "event": "BLOCK_JOB_CANCELLED", "timestamp": {"microseconds": "USECS", "seconds": "SECS"}}
+ {"return": {}}
++
++--- Confirming writes ---
++
++read -P0xab 0 64k
++read -P0xad 0x00f8000 64k
++read -P0x1d 0x2008000 64k
++read -P0xea 0x3fe0000 64k
++read -P0xd5 0x108000 32k
++read -P0xdc 32M 32k
++read -P0xcd 0x3ff0000 64k
++
++Done
++=== Test cbw-filter based fleecing ===
++
++--- Setting up images ---
++
++Done
++
++--- Launching VM ---
++
++Done
++
++--- Setting up Fleecing Graph ---
++
++{"return": {}}
++{"return": {}}
++{"return": {}}
++
++--- Setting up NBD Export ---
++
++{"return": {}}
++{"return": {}}
++
++--- Sanity Check ---
++
++read -P0x5d 0 64k
++read -P0xd5 1M 64k
++read -P0xdc 32M 64k
++read -P0xcd 0x3ff0000 64k
++read -P0 0x00f8000 32k
++read -P0 0x2010000 32k
++read -P0 0x3fe0000 64k
++
++--- Testing COW ---
++
++write -P0xab 0 64k
++{"return": ""}
++write -P0xad 0x00f8000 64k
++{"return": ""}
++write -P0x1d 0x2008000 64k
++{"return": ""}
++write -P0xea 0x3fe0000 64k
++{"return": ""}
++
++--- Verifying Data ---
++
++read -P0x5d 0 64k
++read -P0xd5 1M 64k
++read -P0xdc 32M 64k
++read -P0xcd 0x3ff0000 64k
++read -P0 0x00f8000 32k
++read -P0 0x2010000 32k
++read -P0 0x3fe0000 64k
++
++--- Cleanup ---
++
++{"return": {}}
++{"return": {}}
++{"return": {}}
+ {"return": {}}
+ --- Confirming writes ---
+@@ -XXX,XX +XXX,XX @@ read -P0xdc 32M 32k
+ read -P0xcd 0x3ff0000 64k
+ Done
+-=== Test filter based fleecing ===
++=== Test fleecing-format based fleecing ===
+ --- Setting up images ---
+@@ -XXX,XX +XXX,XX @@ Done
+ {"return": {}}
+ {"return": {}}
+ {"return": {}}
++{"return": {}}
+ --- Setting up NBD Export ---
+@@ -XXX,XX +XXX,XX @@ read -P0 0x3fe0000 64k
+ {"return": {}}
+ {"return": {}}
+ {"return": {}}
++{"return": {}}
+ --- Confirming writes ---
+--
+.34.1

-New patch
+[PULL 21/23] iotests.py: add qemu_io_pipe_and_status()
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Add helper that returns both status and output, to be used in the
+following commit
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Message-Id: <20220303194349.2304213-15-vsementsov@virtuozzo.com>
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+---
+ tests/qemu-iotests/iotests.py | 3 +++
+file changed, 3 insertions(+)
+diff --git a/tests/qemu-iotests/iotests.py b/tests/qemu-iotests/iotests.py
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/qemu-iotests/iotests.py
++++ b/tests/qemu-iotests/iotests.py
+@@ -XXX,XX +XXX,XX @@ def qemu_io(*args):
+     '''Run qemu-io and return the stdout data'''
+     return qemu_tool_pipe_and_status('qemu-io', qemu_io_wrap_args(args))[0]
++def qemu_io_pipe_and_status(*args):
++    return qemu_tool_pipe_and_status('qemu-io', qemu_io_wrap_args(args))
++
+ def qemu_io_log(*args):
+     result = qemu_io(*args)
+     log(result, filters=[filter_testfiles, filter_qemu_io])
+--
+.34.1

-New patch
+[PULL 22/23] iotests/image-fleecing: add test case with bitmap
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Note that reads zero areas (not dirty in the bitmap) fails, that's
+correct.
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Message-Id: <20220303194349.2304213-16-vsementsov@virtuozzo.com>
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+---
+ tests/qemu-iotests/tests/image-fleecing     | 38 +++++++---
+ tests/qemu-iotests/tests/image-fleecing.out | 84 +++++++++++++++++++++
+files changed, 113 insertions(+), 9 deletions(-)
+diff --git a/tests/qemu-iotests/tests/image-fleecing b/tests/qemu-iotests/tests/image-fleecing
+index XXXXXXX..XXXXXXX 100755
+--- a/tests/qemu-iotests/tests/image-fleecing
++++ b/tests/qemu-iotests/tests/image-fleecing
+@@ -XXX,XX +XXX,XX @@
+ # Creator/Owner: John Snow <jsnow@redhat.com>
+ import iotests
+-from iotests import log, qemu_img, qemu_io, qemu_io_silent
++from iotests import log, qemu_img, qemu_io, qemu_io_silent, \
++    qemu_io_pipe_and_status
+ iotests.script_initialize(
+-    supported_fmts=['qcow2', 'qcow', 'qed', 'vmdk', 'vhdx', 'raw'],
++    supported_fmts=['qcow2'],
+     supported_platforms=['linux'],
+     required_fmts=['copy-before-write'],
++    unsupported_imgopts=['compat']
+ )
+ patterns = [('0x5d', '0',         '64k'),
+@@ -XXX,XX +XXX,XX @@ remainder = [('0xd5', '0x108000',  '32k'), # Right-end of partial-left [1]
+              ('0xcd', '0x3ff0000', '64k')] # patterns[3]
+ def do_test(use_cbw, use_snapshot_access_filter, base_img_path,
+-            fleece_img_path, nbd_sock_path, vm):
++            fleece_img_path, nbd_sock_path, vm,
++            bitmap=False):
+     log('--- Setting up images ---')
+     log('')
+     assert qemu_img('create', '-f', iotests.imgfmt, base_img_path, '64M') == 0
++    if bitmap:
++        assert qemu_img('bitmap', '--add', base_img_path, 'bitmap0') == 0
++
+     if use_snapshot_access_filter:
+         assert use_cbw
+         assert qemu_img('create', '-f', 'raw', fleece_img_path, '64M') == 0
+@@ -XXX,XX +XXX,XX @@ def do_test(use_cbw, use_snapshot_access_filter, base_img_path,
+     # Establish CBW from source to fleecing node
+     if use_cbw:
+-        log(vm.qmp('blockdev-add', {
++        fl_cbw = {
+             'driver': 'copy-before-write',
+             'node-name': 'fl-cbw',
+             'file': src_node,
+             'target': tmp_node
+-        }))
++        }
++
++        if bitmap:
++            fl_cbw['bitmap'] = {'node': src_node, 'name': 'bitmap0'}
++
++        log(vm.qmp('blockdev-add', fl_cbw))
+         log(vm.qmp('qom-set', path=qom_path, property='drive', value='fl-cbw'))
+@@ -XXX,XX +XXX,XX @@ def do_test(use_cbw, use_snapshot_access_filter, base_img_path,
+     for p in patterns + zeroes:
+         cmd = 'read -P%s %s %s' % p
+         log(cmd)
+-        assert qemu_io_silent('-r', '-f', 'raw', '-c', cmd, nbd_uri) == 0
++        out, ret = qemu_io_pipe_and_status('-r', '-f', 'raw', '-c', cmd,
++                                           nbd_uri)
++        if ret != 0:
++            print(out)
+     log('')
+     log('--- Testing COW ---')
+@@ -XXX,XX +XXX,XX @@ def do_test(use_cbw, use_snapshot_access_filter, base_img_path,
+     for p in patterns + zeroes:
+         cmd = 'read -P%s %s %s' % p
+         log(cmd)
+-        assert qemu_io_silent('-r', '-f', 'raw', '-c', cmd, nbd_uri) == 0
++        out, ret = qemu_io_pipe_and_status('-r', '-f', 'raw', '-c', cmd,
++                                           nbd_uri)
++        if ret != 0:
++            print(out)
+     log('')
+     log('--- Cleanup ---')
+@@ -XXX,XX +XXX,XX @@ def do_test(use_cbw, use_snapshot_access_filter, base_img_path,
+     log('Done')
+-def test(use_cbw, use_snapshot_access_filter):
++def test(use_cbw, use_snapshot_access_filter, bitmap=False):
+     with iotests.FilePath('base.img') as base_img_path, \
+          iotests.FilePath('fleece.img') as fleece_img_path, \
+          iotests.FilePath('nbd.sock',
+                           base_dir=iotests.sock_dir) as nbd_sock_path, \
+          iotests.VM() as vm:
+         do_test(use_cbw, use_snapshot_access_filter, base_img_path,
+-                fleece_img_path, nbd_sock_path, vm)
++                fleece_img_path, nbd_sock_path, vm, bitmap=bitmap)
+ log('=== Test backup(sync=none) based fleecing ===\n')
+@@ -XXX,XX +XXX,XX @@ test(True, False)
+ log('=== Test fleecing-format based fleecing ===\n')
+ test(True, True)
++
++log('=== Test fleecing-format based fleecing with bitmap ===\n')
++test(True, True, bitmap=True)
+diff --git a/tests/qemu-iotests/tests/image-fleecing.out b/tests/qemu-iotests/tests/image-fleecing.out
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/qemu-iotests/tests/image-fleecing.out
++++ b/tests/qemu-iotests/tests/image-fleecing.out
+@@ -XXX,XX +XXX,XX @@ read -P0 0x00f8000 32k
+ read -P0 0x2010000 32k
+ read -P0 0x3fe0000 64k
++--- Cleanup ---
++
++{"return": {}}
++{"return": {}}
++{"return": {}}
++{"return": {}}
++{"return": {}}
++
++--- Confirming writes ---
++
++read -P0xab 0 64k
++read -P0xad 0x00f8000 64k
++read -P0x1d 0x2008000 64k
++read -P0xea 0x3fe0000 64k
++read -P0xd5 0x108000 32k
++read -P0xdc 32M 32k
++read -P0xcd 0x3ff0000 64k
++
++Done
++=== Test fleecing-format based fleecing with bitmap ===
++
++--- Setting up images ---
++
++Done
++
++--- Launching VM ---
++
++Done
++
++--- Setting up Fleecing Graph ---
++
++{"return": {}}
++{"return": {}}
++{"return": {}}
++{"return": {}}
++
++--- Setting up NBD Export ---
++
++{"return": {}}
++{"return": {}}
++
++--- Sanity Check ---
++
++read -P0x5d 0 64k
++read -P0xd5 1M 64k
++read -P0xdc 32M 64k
++read -P0xcd 0x3ff0000 64k
++read -P0 0x00f8000 32k
++read failed: Invalid argument
++
++read -P0 0x2010000 32k
++read failed: Invalid argument
++
++read -P0 0x3fe0000 64k
++read failed: Invalid argument
++
++
++--- Testing COW ---
++
++write -P0xab 0 64k
++{"return": ""}
++write -P0xad 0x00f8000 64k
++{"return": ""}
++write -P0x1d 0x2008000 64k
++{"return": ""}
++write -P0xea 0x3fe0000 64k
++{"return": ""}
++
++--- Verifying Data ---
++
++read -P0x5d 0 64k
++read -P0xd5 1M 64k
++read -P0xdc 32M 64k
++read -P0xcd 0x3ff0000 64k
++read -P0 0x00f8000 32k
++read failed: Invalid argument
++
++read -P0 0x2010000 32k
++read failed: Invalid argument
++
++read -P0 0x3fe0000 64k
++read failed: Invalid argument
++
++
+ --- Cleanup ---
+ {"return": {}}
+--
+.34.1

-New patch
+[PULL 23/23] iotests/image-fleecing: test push backup with fleecing
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Message-Id: <20220303194349.2304213-17-vsementsov@virtuozzo.com>
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+---
+ tests/qemu-iotests/tests/image-fleecing     | 125 +++++++++++++++-----
+ tests/qemu-iotests/tests/image-fleecing.out |  63 ++++++++++
+files changed, 156 insertions(+), 32 deletions(-)
+diff --git a/tests/qemu-iotests/tests/image-fleecing b/tests/qemu-iotests/tests/image-fleecing
+index XXXXXXX..XXXXXXX 100755
+--- a/tests/qemu-iotests/tests/image-fleecing
++++ b/tests/qemu-iotests/tests/image-fleecing
+@@ -XXX,XX +XXX,XX @@ remainder = [('0xd5', '0x108000',  '32k'), # Right-end of partial-left [1]
+              ('0xdc', '32M',       '32k'), # Left-end of partial-right [2]
+              ('0xcd', '0x3ff0000', '64k')] # patterns[3]
+-def do_test(use_cbw, use_snapshot_access_filter, base_img_path,
+-            fleece_img_path, nbd_sock_path, vm,
++def do_test(vm, use_cbw, use_snapshot_access_filter, base_img_path,
++            fleece_img_path, nbd_sock_path=None,
++            target_img_path=None,
+             bitmap=False):
++    push_backup = target_img_path is not None
++    assert (nbd_sock_path is not None) != push_backup
++    if push_backup:
++        assert use_cbw
++
+     log('--- Setting up images ---')
+     log('')
+@@ -XXX,XX +XXX,XX @@ def do_test(use_cbw, use_snapshot_access_filter, base_img_path,
+     else:
+         assert qemu_img('create', '-f', 'qcow2', fleece_img_path, '64M') == 0
++    if push_backup:
++        assert qemu_img('create', '-f', 'qcow2', target_img_path, '64M') == 0
++
+     for p in patterns:
+         qemu_io('-f', iotests.imgfmt,
+                 '-c', 'write -P%s %s %s' % p, base_img_path)
+@@ -XXX,XX +XXX,XX @@ def do_test(use_cbw, use_snapshot_access_filter, base_img_path,
+     export_node = 'fl-access' if use_snapshot_access_filter else tmp_node
+-    log('')
+-    log('--- Setting up NBD Export ---')
+-    log('')
++    if push_backup:
++        log('')
++        log('--- Starting actual backup ---')
++        log('')
+-    nbd_uri = 'nbd+unix:///%s?socket=%s' % (export_node, nbd_sock_path)
+-    log(vm.qmp('nbd-server-start',
+-               {'addr': {'type': 'unix',
+-                         'data': {'path': nbd_sock_path}}}))
++        log(vm.qmp('blockdev-add', **{
++            'driver': iotests.imgfmt,
++            'node-name': 'target',
++            'file': {
++                'driver': 'file',
++                'filename': target_img_path
++            }
++        }))
++        log(vm.qmp('blockdev-backup', device=export_node,
++                   sync='full', target='target',
++                   job_id='push-backup', speed=1))
++    else:
++        log('')
++        log('--- Setting up NBD Export ---')
++        log('')
+-    log(vm.qmp('nbd-server-add', device=export_node))
++        nbd_uri = 'nbd+unix:///%s?socket=%s' % (export_node, nbd_sock_path)
++        log(vm.qmp('nbd-server-start',
++                   {'addr': { 'type': 'unix',
++                              'data': { 'path': nbd_sock_path } } }))
+-    log('')
+-    log('--- Sanity Check ---')
+-    log('')
++        log(vm.qmp('nbd-server-add', device=export_node))
+-    for p in patterns + zeroes:
+-        cmd = 'read -P%s %s %s' % p
+-        log(cmd)
+-        out, ret = qemu_io_pipe_and_status('-r', '-f', 'raw', '-c', cmd,
+-                                           nbd_uri)
+-        if ret != 0:
+-            print(out)
++        log('')
++        log('--- Sanity Check ---')
++        log('')
++
++        for p in patterns + zeroes:
++            cmd = 'read -P%s %s %s' % p
++            log(cmd)
++            out, ret = qemu_io_pipe_and_status('-r', '-f', 'raw', '-c', cmd,
++                                               nbd_uri)
++            if ret != 0:
++                print(out)
+     log('')
+     log('--- Testing COW ---')
+@@ -XXX,XX +XXX,XX @@ def do_test(use_cbw, use_snapshot_access_filter, base_img_path,
+         log(cmd)
+         log(vm.hmp_qemu_io(qom_path, cmd, qdev=True))
++    if push_backup:
++        # Check that previous operations were done during backup, not after
++        # If backup is already finished, it's possible that it was finished
++        # even before hmp qemu_io write, and we didn't actually test
++        # copy-before-write operation. This should not happen, as we use
++        # speed=1. But worth checking.
++        result = vm.qmp('query-block-jobs')
++        assert len(result['return']) == 1
++
++        result = vm.qmp('block-job-set-speed', device='push-backup', speed=0)
++        assert result == {'return': {}}
++
++        log(vm.event_wait(name='BLOCK_JOB_COMPLETED',
++                          match={'data': {'device': 'push-backup'}}),
++            filters=[iotests.filter_qmp_event])
++        log(vm.qmp('blockdev-del', node_name='target'))
++
+     log('')
+     log('--- Verifying Data ---')
+     log('')
+@@ -XXX,XX +XXX,XX @@ def do_test(use_cbw, use_snapshot_access_filter, base_img_path,
+     for p in patterns + zeroes:
+         cmd = 'read -P%s %s %s' % p
+         log(cmd)
+-        out, ret = qemu_io_pipe_and_status('-r', '-f', 'raw', '-c', cmd,
+-                                           nbd_uri)
++        args = ['-r', '-c', cmd]
++        if push_backup:
++            args += [target_img_path]
++        else:
++            args += ['-f', 'raw', nbd_uri]
++        out, ret = qemu_io_pipe_and_status(*args)
+         if ret != 0:
+             print(out)
+@@ -XXX,XX +XXX,XX @@ def do_test(use_cbw, use_snapshot_access_filter, base_img_path,
+     log('--- Cleanup ---')
+     log('')
+-    log(vm.qmp('nbd-server-stop'))
++    if not push_backup:
++        log(vm.qmp('nbd-server-stop'))
+     if use_cbw:
+         if use_snapshot_access_filter:
+@@ -XXX,XX +XXX,XX @@ def do_test(use_cbw, use_snapshot_access_filter, base_img_path,
+     log('Done')
+-def test(use_cbw, use_snapshot_access_filter, bitmap=False):
++def test(use_cbw, use_snapshot_access_filter,
++         nbd_sock_path=None, target_img_path=None, bitmap=False):
+     with iotests.FilePath('base.img') as base_img_path, \
+          iotests.FilePath('fleece.img') as fleece_img_path, \
+-         iotests.FilePath('nbd.sock',
+-                          base_dir=iotests.sock_dir) as nbd_sock_path, \
+          iotests.VM() as vm:
+-        do_test(use_cbw, use_snapshot_access_filter, base_img_path,
+-                fleece_img_path, nbd_sock_path, vm, bitmap=bitmap)
++        do_test(vm, use_cbw, use_snapshot_access_filter, base_img_path,
++                fleece_img_path, nbd_sock_path, target_img_path,
++                bitmap=bitmap)
++
++def test_pull(use_cbw, use_snapshot_access_filter, bitmap=False):
++    with iotests.FilePath('nbd.sock',
++                          base_dir=iotests.sock_dir) as nbd_sock_path:
++        test(use_cbw, use_snapshot_access_filter, nbd_sock_path, None,
++             bitmap=bitmap)
++
++def test_push():
++    with iotests.FilePath('target.img') as target_img_path:
++        test(True, True, None, target_img_path)
+ log('=== Test backup(sync=none) based fleecing ===\n')
+-test(False, False)
++test_pull(False, False)
+ log('=== Test cbw-filter based fleecing ===\n')
+-test(True, False)
++test_pull(True, False)
+ log('=== Test fleecing-format based fleecing ===\n')
+-test(True, True)
++test_pull(True, True)
+ log('=== Test fleecing-format based fleecing with bitmap ===\n')
+-test(True, True, bitmap=True)
++test_pull(True, True, bitmap=True)
++
++log('=== Test push backup with fleecing ===\n')
++test_push()
+diff --git a/tests/qemu-iotests/tests/image-fleecing.out b/tests/qemu-iotests/tests/image-fleecing.out
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/qemu-iotests/tests/image-fleecing.out
++++ b/tests/qemu-iotests/tests/image-fleecing.out
+@@ -XXX,XX +XXX,XX @@ read -P0xdc 32M 32k
+ read -P0xcd 0x3ff0000 64k
+ Done
++=== Test push backup with fleecing ===
++
++--- Setting up images ---
++
++Done
++
++--- Launching VM ---
++
++Done
++
++--- Setting up Fleecing Graph ---
++
++{"return": {}}
++{"return": {}}
++{"return": {}}
++{"return": {}}
++
++--- Starting actual backup ---
++
++{"return": {}}
++{"return": {}}
++
++--- Testing COW ---
++
++write -P0xab 0 64k
++{"return": ""}
++write -P0xad 0x00f8000 64k
++{"return": ""}
++write -P0x1d 0x2008000 64k
++{"return": ""}
++write -P0xea 0x3fe0000 64k
++{"return": ""}
++{"data": {"device": "push-backup", "len": 67108864, "offset": 67108864, "speed": 0, "type": "backup"}, "event": "BLOCK_JOB_COMPLETED", "timestamp": {"microseconds": "USECS", "seconds": "SECS"}}
++{"return": {}}
++
++--- Verifying Data ---
++
++read -P0x5d 0 64k
++read -P0xd5 1M 64k
++read -P0xdc 32M 64k
++read -P0xcd 0x3ff0000 64k
++read -P0 0x00f8000 32k
++read -P0 0x2010000 32k
++read -P0 0x3fe0000 64k
++
++--- Cleanup ---
++
++{"return": {}}
++{"return": {}}
++{"return": {}}
++{"return": {}}
++
++--- Confirming writes ---
++
++read -P0xab 0 64k
++read -P0xad 0x00f8000 64k
++read -P0x1d 0x2008000 64k
++read -P0xea 0x3fe0000 64k
++read -P0xd5 0x108000 32k
++read -P0xdc 32M 32k
++read -P0xcd 0x3ff0000 64k
++
++Done
+--
+.34.1

The following changes since commit d992f2f1368ceb92e6bfd8efece174110f4236ff:

Merge remote-tracking branch 'remotes/artyom/tags/pull-sun4v-20170226' into staging (2017-02-26 22:40:23 +0000)

are available in the git repository at:

git://github.com/stefanha/qemu.git tags/block-pull-request

for you to fetch changes up to 1ab17f9f5c63c2798d707aeb22588e4fcc17b2cd:

tests-aio-multithread: use atomic_read properly (2017-02-27 14:00:53 +0000)

----------------------------------------------------------------

Paolo Bonzini (4):
  curl: do not use aio_context_acquire/release
  nfs: do not use aio_context_acquire/release
  iscsi: do not use aio_context_acquire/release
  tests-aio-multithread: use atomic_read properly

block/curl.c                 | 24 ++++++++-----
 block/iscsi.c                | 83 ++++++++++++++++++++++++++++++++++----------
 block/nfs.c                  | 23 +++++++++---
 tests/test-aio-multithread.c |  4 +--
 4 files changed, 100 insertions(+), 34 deletions(-)

-- 
2.9.3

From: Paolo Bonzini <pbonzini@redhat.com>

Now that all bottom halves and callbacks take care of taking the
AioContext lock, we can migrate some users away from it and to a
specific QemuMutex or CoMutex.

Protect BDRVCURLState access with a QemuMutex.

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 20170222180725.28611-2-pbonzini@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/curl.c | 24 +++++++++++++++---------
 1 file changed, 15 insertions(+), 9 deletions(-)

diff --git a/block/curl.c b/block/curl.c
index XXXXXXX..XXXXXXX 100644
--- a/block/curl.c
+++ b/block/curl.c
@@ -XXX,XX +XXX,XX @@ typedef struct BDRVCURLState {
     char *cookie;
     bool accept_range;
     AioContext *aio_context;
+    QemuMutex mutex;
     char *username;
     char *password;
     char *proxyusername;
@@ -XXX,XX +XXX,XX @@ static int curl_find_buf(BDRVCURLState *s, size_t start, size_t len,
     return FIND_RET_NONE;
 }
 
+/* Called with s->mutex held.  */
 static void curl_multi_check_completion(BDRVCURLState *s)
 {
     int msgs_in_queue;
@@ -XXX,XX +XXX,XX @@ static void curl_multi_check_completion(BDRVCURLState *s)
                         continue;
                     }
 
+                    qemu_mutex_unlock(&s->mutex);
                     acb->common.cb(acb->common.opaque, -EPROTO);
+                    qemu_mutex_lock(&s->mutex);
                     qemu_aio_unref(acb);
                     state->acb[i] = NULL;
                 }
@@ -XXX,XX +XXX,XX @@ static void curl_multi_check_completion(BDRVCURLState *s)
     }
 }
 
+/* Called with s->mutex held.  */
 static void curl_multi_do_locked(CURLState *s)
 {
     CURLSocket *socket, *next_socket;
@@ -XXX,XX +XXX,XX @@ static void curl_multi_do(void *arg)
 {
     CURLState *s = (CURLState *)arg;
 
-    aio_context_acquire(s->s->aio_context);
+    qemu_mutex_lock(&s->s->mutex);
     curl_multi_do_locked(s);
-    aio_context_release(s->s->aio_context);
+    qemu_mutex_unlock(&s->s->mutex);
 }
 
 static void curl_multi_read(void *arg)
 {
     CURLState *s = (CURLState *)arg;
 
-    aio_context_acquire(s->s->aio_context);
+    qemu_mutex_lock(&s->s->mutex);
     curl_multi_do_locked(s);
     curl_multi_check_completion(s->s);
-    aio_context_release(s->s->aio_context);
+    qemu_mutex_unlock(&s->s->mutex);
 }
 
 static void curl_multi_timeout_do(void *arg)
@@ -XXX,XX +XXX,XX @@ static void curl_multi_timeout_do(void *arg)
         return;
     }
 
-    aio_context_acquire(s->aio_context);
+    qemu_mutex_lock(&s->mutex);
     curl_multi_socket_action(s->multi, CURL_SOCKET_TIMEOUT, 0, &running);
 
     curl_multi_check_completion(s);
-    aio_context_release(s->aio_context);
+    qemu_mutex_unlock(&s->mutex);
 #else
     abort();
 #endif
@@ -XXX,XX +XXX,XX @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags,
     curl_easy_cleanup(state->curl);
     state->curl = NULL;
 
+    qemu_mutex_init(&s->mutex);
     curl_attach_aio_context(bs, bdrv_get_aio_context(bs));
 
     qemu_opts_del(opts);
@@ -XXX,XX +XXX,XX @@ static void curl_readv_bh_cb(void *p)
     CURLAIOCB *acb = p;
     BlockDriverState *bs = acb->common.bs;
     BDRVCURLState *s = bs->opaque;
-    AioContext *ctx = bdrv_get_aio_context(bs);
 
     size_t start = acb->sector_num * BDRV_SECTOR_SIZE;
     size_t end;
 
-    aio_context_acquire(ctx);
+    qemu_mutex_lock(&s->mutex);
 
     // In case we have the requested data already (e.g. read-ahead),
     // we can just call the callback and be done.
@@ -XXX,XX +XXX,XX @@ static void curl_readv_bh_cb(void *p)
     curl_multi_socket_action(s->multi, CURL_SOCKET_TIMEOUT, 0, &running);
 
 out:
-    aio_context_release(ctx);
+    qemu_mutex_unlock(&s->mutex);
     if (ret != -EINPROGRESS) {
         acb->common.cb(acb->common.opaque, ret);
         qemu_aio_unref(acb);
@@ -XXX,XX +XXX,XX @@ static void curl_close(BlockDriverState *bs)
 
     DPRINTF("CURL: Close\n");
     curl_detach_aio_context(bs);
+    qemu_mutex_destroy(&s->mutex);
 
     g_free(s->cookie);
     g_free(s->url);
-- 
2.9.3

From: Paolo Bonzini <pbonzini@redhat.com>

Now that all bottom halves and callbacks take care of taking the
AioContext lock, we can migrate some users away from it and to a
specific QemuMutex or CoMutex.

Protect libnfs calls with a QemuMutex.  Callbacks are invoked
using bottom halves, so we don't even have to drop it around
callback invocations.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 20170222180725.28611-3-pbonzini@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/nfs.c | 23 +++++++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)

diff --git a/block/nfs.c b/block/nfs.c
index XXXXXXX..XXXXXXX 100644
--- a/block/nfs.c
+++ b/block/nfs.c
@@ -XXX,XX +XXX,XX @@ typedef struct NFSClient {
     int events;
     bool has_zero_init;
     AioContext *aio_context;
+    QemuMutex mutex;
     blkcnt_t st_blocks;
     bool cache_used;
     NFSServer *server;
@@ -XXX,XX +XXX,XX @@ static void nfs_parse_filename(const char *filename, QDict *options,
 static void nfs_process_read(void *arg);
 static void nfs_process_write(void *arg);
 
+/* Called with QemuMutex held.  */
 static void nfs_set_events(NFSClient *client)
 {
     int ev = nfs_which_events(client->context);
@@ -XXX,XX +XXX,XX @@ static void nfs_process_read(void *arg)
 {
     NFSClient *client = arg;
 
-    aio_context_acquire(client->aio_context);
+    qemu_mutex_lock(&client->mutex);
     nfs_service(client->context, POLLIN);
     nfs_set_events(client);
-    aio_context_release(client->aio_context);
+    qemu_mutex_unlock(&client->mutex);
 }
 
 static void nfs_process_write(void *arg)
 {
     NFSClient *client = arg;
 
-    aio_context_acquire(client->aio_context);
+    qemu_mutex_lock(&client->mutex);
     nfs_service(client->context, POLLOUT);
     nfs_set_events(client);
-    aio_context_release(client->aio_context);
+    qemu_mutex_unlock(&client->mutex);
 }
 
 static void nfs_co_init_task(BlockDriverState *bs, NFSRPC *task)
@@ -XXX,XX +XXX,XX @@ static void nfs_co_generic_bh_cb(void *opaque)
     aio_co_wake(task->co);
 }
 
+/* Called (via nfs_service) with QemuMutex held.  */
 static void
 nfs_co_generic_cb(int ret, struct nfs_context *nfs, void *data,
                   void *private_data)
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn nfs_co_preadv(BlockDriverState *bs, uint64_t offset,
     nfs_co_init_task(bs, &task);
     task.iov = iov;
 
+    qemu_mutex_lock(&client->mutex);
     if (nfs_pread_async(client->context, client->fh,
                         offset, bytes, nfs_co_generic_cb, &task) != 0) {
+        qemu_mutex_unlock(&client->mutex);
         return -ENOMEM;
     }
 
     nfs_set_events(client);
+    qemu_mutex_unlock(&client->mutex);
     while (!task.complete) {
         qemu_coroutine_yield();
     }
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn nfs_co_pwritev(BlockDriverState *bs, uint64_t offset,
         buf = iov->iov[0].iov_base;
     }
 
+    qemu_mutex_lock(&client->mutex);
     if (nfs_pwrite_async(client->context, client->fh,
                          offset, bytes, buf,
                          nfs_co_generic_cb, &task) != 0) {
+        qemu_mutex_unlock(&client->mutex);
         if (my_buffer) {
             g_free(buf);
         }
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn nfs_co_pwritev(BlockDriverState *bs, uint64_t offset,
     }
 
     nfs_set_events(client);
+    qemu_mutex_unlock(&client->mutex);
     while (!task.complete) {
         qemu_coroutine_yield();
     }
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn nfs_co_flush(BlockDriverState *bs)
 
     nfs_co_init_task(bs, &task);
 
+    qemu_mutex_lock(&client->mutex);
     if (nfs_fsync_async(client->context, client->fh, nfs_co_generic_cb,
                         &task) != 0) {
+        qemu_mutex_unlock(&client->mutex);
         return -ENOMEM;
     }
 
     nfs_set_events(client);
+    qemu_mutex_unlock(&client->mutex);
     while (!task.complete) {
         qemu_coroutine_yield();
     }
@@ -XXX,XX +XXX,XX @@ static void nfs_file_close(BlockDriverState *bs)
 {
     NFSClient *client = bs->opaque;
     nfs_client_close(client);
+    qemu_mutex_destroy(&client->mutex);
 }
 
 static NFSServer *nfs_config(QDict *options, Error **errp)
@@ -XXX,XX +XXX,XX @@ static int nfs_file_open(BlockDriverState *bs, QDict *options, int flags,
     if (ret < 0) {
         return ret;
     }
+    qemu_mutex_init(&client->mutex);
     bs->total_sectors = ret;
     ret = 0;
     return ret;
@@ -XXX,XX +XXX,XX @@ static int nfs_has_zero_init(BlockDriverState *bs)
     return client->has_zero_init;
 }
 
+/* Called (via nfs_service) with QemuMutex held.  */
 static void
 nfs_get_allocated_file_size_cb(int ret, struct nfs_context *nfs, void *data,
                                void *private_data)
-- 
2.9.3

From: Paolo Bonzini <pbonzini@redhat.com>

Now that all bottom halves and callbacks take care of taking the
AioContext lock, we can migrate some users away from it and to a
specific QemuMutex or CoMutex.

Protect libiscsi calls with a QemuMutex.  Callbacks are invoked
using bottom halves, so we don't even have to drop it around
callback invocations.

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 20170222180725.28611-4-pbonzini@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/iscsi.c | 83 +++++++++++++++++++++++++++++++++++++++++++++--------------
 1 file changed, 64 insertions(+), 19 deletions(-)

diff --git a/block/iscsi.c b/block/iscsi.c
index XXXXXXX..XXXXXXX 100644
--- a/block/iscsi.c
+++ b/block/iscsi.c
@@ -XXX,XX +XXX,XX @@ typedef struct IscsiLun {
     int events;
     QEMUTimer *nop_timer;
     QEMUTimer *event_timer;
+    QemuMutex mutex;
     struct scsi_inquiry_logical_block_provisioning lbp;
     struct scsi_inquiry_block_limits bl;
     unsigned char *zeroblock;
@@ -XXX,XX +XXX,XX @@ static int iscsi_translate_sense(struct scsi_sense *sense)
     return ret;
 }
 
+/* Called (via iscsi_service) with QemuMutex held.  */
 static void
 iscsi_co_generic_cb(struct iscsi_context *iscsi, int status,
                         void *command_data, void *opaque)
@@ -XXX,XX +XXX,XX @@ static const AIOCBInfo iscsi_aiocb_info = {
 static void iscsi_process_read(void *arg);
 static void iscsi_process_write(void *arg);
 
+/* Called with QemuMutex held.  */
 static void
 iscsi_set_events(IscsiLun *iscsilun)
 {
@@ -XXX,XX +XXX,XX @@ iscsi_process_read(void *arg)
     IscsiLun *iscsilun = arg;
     struct iscsi_context *iscsi = iscsilun->iscsi;
 
-    aio_context_acquire(iscsilun->aio_context);
+    qemu_mutex_lock(&iscsilun->mutex);
     iscsi_service(iscsi, POLLIN);
     iscsi_set_events(iscsilun);
-    aio_context_release(iscsilun->aio_context);
+    qemu_mutex_unlock(&iscsilun->mutex);
 }
 
 static void
@@ -XXX,XX +XXX,XX @@ iscsi_process_write(void *arg)
     IscsiLun *iscsilun = arg;
     struct iscsi_context *iscsi = iscsilun->iscsi;
 
-    aio_context_acquire(iscsilun->aio_context);
+    qemu_mutex_lock(&iscsilun->mutex);
     iscsi_service(iscsi, POLLOUT);
     iscsi_set_events(iscsilun);
-    aio_context_release(iscsilun->aio_context);
+    qemu_mutex_unlock(&iscsilun->mutex);
 }
 
 static int64_t sector_lun2qemu(int64_t sector, IscsiLun *iscsilun)
@@ -XXX,XX +XXX,XX @@ iscsi_co_writev_flags(BlockDriverState *bs, int64_t sector_num, int nb_sectors,
     uint64_t lba;
     uint32_t num_sectors;
     bool fua = flags & BDRV_REQ_FUA;
+    int r = 0;
 
     if (fua) {
         assert(iscsilun->dpofua);
@@ -XXX,XX +XXX,XX @@ iscsi_co_writev_flags(BlockDriverState *bs, int64_t sector_num, int nb_sectors,
     lba = sector_qemu2lun(sector_num, iscsilun);
     num_sectors = sector_qemu2lun(nb_sectors, iscsilun);
     iscsi_co_init_iscsitask(iscsilun, &iTask);
+    qemu_mutex_lock(&iscsilun->mutex);
 retry:
     if (iscsilun->use_16_for_rw) {
 #if LIBISCSI_API_VERSION >= (20160603)
@@ -XXX,XX +XXX,XX @@ retry:
 #endif
     while (!iTask.complete) {
         iscsi_set_events(iscsilun);
+        qemu_mutex_unlock(&iscsilun->mutex);
         qemu_coroutine_yield();
+        qemu_mutex_lock(&iscsilun->mutex);
     }
 
     if (iTask.task != NULL) {
@@ -XXX,XX +XXX,XX @@ retry:
 
     if (iTask.status != SCSI_STATUS_GOOD) {
         iscsi_allocmap_set_invalid(iscsilun, sector_num, nb_sectors);
-        return iTask.err_code;
+        r = iTask.err_code;
+        goto out_unlock;
     }
 
     iscsi_allocmap_set_allocated(iscsilun, sector_num, nb_sectors);
 
-    return 0;
+out_unlock:
+    qemu_mutex_unlock(&iscsilun->mutex);
+    return r;
 }
 
 
@@ -XXX,XX +XXX,XX @@ static int64_t coroutine_fn iscsi_co_get_block_status(BlockDriverState *bs,
         goto out;
     }
 
+    qemu_mutex_lock(&iscsilun->mutex);
 retry:
     if (iscsi_get_lba_status_task(iscsilun->iscsi, iscsilun->lun,
                                   sector_qemu2lun(sector_num, iscsilun),
                                   8 + 16, iscsi_co_generic_cb,
                                   &iTask) == NULL) {
         ret = -ENOMEM;
-        goto out;
+        goto out_unlock;
     }
 
     while (!iTask.complete) {
         iscsi_set_events(iscsilun);
+        qemu_mutex_unlock(&iscsilun->mutex);
         qemu_coroutine_yield();
+        qemu_mutex_lock(&iscsilun->mutex);
     }
 
     if (iTask.do_retry) {
@@ -XXX,XX +XXX,XX @@ retry:
          * because the device is busy or the cmd is not
          * supported) we pretend all blocks are allocated
          * for backwards compatibility */
-        goto out;
+        goto out_unlock;
     }
 
     lbas = scsi_datain_unmarshall(iTask.task);
     if (lbas == NULL) {
         ret = -EIO;
-        goto out;
+        goto out_unlock;
     }
 
     lbasd = &lbas->descriptors[0];
 
     if (sector_qemu2lun(sector_num, iscsilun) != lbasd->lba) {
         ret = -EIO;
-        goto out;
+        goto out_unlock;
     }
 
     *pnum = sector_lun2qemu(lbasd->num_blocks, iscsilun);
@@ -XXX,XX +XXX,XX @@ retry:
     if (*pnum > nb_sectors) {
         *pnum = nb_sectors;
     }
+out_unlock:
+    qemu_mutex_unlock(&iscsilun->mutex);
 out:
     if (iTask.task != NULL) {
         scsi_free_scsi_task(iTask.task);
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn iscsi_co_readv(BlockDriverState *bs,
     num_sectors = sector_qemu2lun(nb_sectors, iscsilun);
 
     iscsi_co_init_iscsitask(iscsilun, &iTask);
+    qemu_mutex_lock(&iscsilun->mutex);
 retry:
     if (iscsilun->use_16_for_rw) {
 #if LIBISCSI_API_VERSION >= (20160603)
@@ -XXX,XX +XXX,XX @@ retry:
 #endif
     while (!iTask.complete) {
         iscsi_set_events(iscsilun);
+        qemu_mutex_unlock(&iscsilun->mutex);
         qemu_coroutine_yield();
+        qemu_mutex_lock(&iscsilun->mutex);
     }
 
     if (iTask.task != NULL) {
@@ -XXX,XX +XXX,XX @@ retry:
         iTask.complete = 0;
         goto retry;
     }
+    qemu_mutex_unlock(&iscsilun->mutex);
 
     if (iTask.status != SCSI_STATUS_GOOD) {
         return iTask.err_code;
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn iscsi_co_flush(BlockDriverState *bs)
     struct IscsiTask iTask;
 
     iscsi_co_init_iscsitask(iscsilun, &iTask);
+    qemu_mutex_lock(&iscsilun->mutex);
 retry:
     if (iscsi_synchronizecache10_task(iscsilun->iscsi, iscsilun->lun, 0, 0, 0,
                                       0, iscsi_co_generic_cb, &iTask) == NULL) {
@@ -XXX,XX +XXX,XX @@ retry:
 
     while (!iTask.complete) {
         iscsi_set_events(iscsilun);
+        qemu_mutex_unlock(&iscsilun->mutex);
         qemu_coroutine_yield();
+        qemu_mutex_lock(&iscsilun->mutex);
     }
 
     if (iTask.task != NULL) {
@@ -XXX,XX +XXX,XX @@ retry:
         iTask.complete = 0;
         goto retry;
     }
+    qemu_mutex_unlock(&iscsilun->mutex);
 
     if (iTask.status != SCSI_STATUS_GOOD) {
         return iTask.err_code;
@@ -XXX,XX +XXX,XX @@ retry:
 }
 
 #ifdef __linux__
+/* Called (via iscsi_service) with QemuMutex held.  */
 static void
 iscsi_aio_ioctl_cb(struct iscsi_context *iscsi, int status,
                      void *command_data, void *opaque)
@@ -XXX,XX +XXX,XX @@ static BlockAIOCB *iscsi_aio_ioctl(BlockDriverState *bs,
     acb->task->expxferlen = acb->ioh->dxfer_len;
 
     data.size = 0;
+    qemu_mutex_lock(&iscsilun->mutex);
     if (acb->task->xfer_dir == SCSI_XFER_WRITE) {
         if (acb->ioh->iovec_count == 0) {
             data.data = acb->ioh->dxferp;
@@ -XXX,XX +XXX,XX @@ static BlockAIOCB *iscsi_aio_ioctl(BlockDriverState *bs,
                                  iscsi_aio_ioctl_cb,
                                  (data.size > 0) ? &data : NULL,
                                  acb) != 0) {
+        qemu_mutex_unlock(&iscsilun->mutex);
         scsi_free_scsi_task(acb->task);
         qemu_aio_unref(acb);
         return NULL;
@@ -XXX,XX +XXX,XX @@ static BlockAIOCB *iscsi_aio_ioctl(BlockDriverState *bs,
     }
 
     iscsi_set_events(iscsilun);
+    qemu_mutex_unlock(&iscsilun->mutex);
 
     return &acb->common;
 }
@@ -XXX,XX +XXX,XX @@ coroutine_fn iscsi_co_pdiscard(BlockDriverState *bs, int64_t offset, int count)
     IscsiLun *iscsilun = bs->opaque;
     struct IscsiTask iTask;
     struct unmap_list list;
+    int r = 0;
 
     if (!is_byte_request_lun_aligned(offset, count, iscsilun)) {
         return -ENOTSUP;
@@ -XXX,XX +XXX,XX @@ coroutine_fn iscsi_co_pdiscard(BlockDriverState *bs, int64_t offset, int count)
     list.num = count / iscsilun->block_size;
 
     iscsi_co_init_iscsitask(iscsilun, &iTask);
+    qemu_mutex_lock(&iscsilun->mutex);
 retry:
     if (iscsi_unmap_task(iscsilun->iscsi, iscsilun->lun, 0, 0, &list, 1,
                          iscsi_co_generic_cb, &iTask) == NULL) {
-        return -ENOMEM;
+        r = -ENOMEM;
+        goto out_unlock;
     }
 
     while (!iTask.complete) {
         iscsi_set_events(iscsilun);
+        qemu_mutex_unlock(&iscsilun->mutex);
         qemu_coroutine_yield();
+        qemu_mutex_lock(&iscsilun->mutex);
     }
 
     if (iTask.task != NULL) {
@@ -XXX,XX +XXX,XX @@ retry:
         /* the target might fail with a check condition if it
            is not happy with the alignment of the UNMAP request
            we silently fail in this case */
-        return 0;
+        goto out_unlock;
     }
 
     if (iTask.status != SCSI_STATUS_GOOD) {
-        return iTask.err_code;
+        r = iTask.err_code;
+        goto out_unlock;
     }
 
     iscsi_allocmap_set_invalid(iscsilun, offset >> BDRV_SECTOR_BITS,
                                count >> BDRV_SECTOR_BITS);
 
-    return 0;
+out_unlock:
+    qemu_mutex_unlock(&iscsilun->mutex);
+    return r;
 }
 
 static int
@@ -XXX,XX +XXX,XX @@ coroutine_fn iscsi_co_pwrite_zeroes(BlockDriverState *bs, int64_t offset,
     uint64_t lba;
     uint32_t nb_blocks;
     bool use_16_for_ws = iscsilun->use_16_for_rw;
+    int r = 0;
 
     if (!is_byte_request_lun_aligned(offset, count, iscsilun)) {
         return -ENOTSUP;
@@ -XXX,XX +XXX,XX @@ coroutine_fn iscsi_co_pwrite_zeroes(BlockDriverState *bs, int64_t offset,
         }
     }
 
+    qemu_mutex_lock(&iscsilun->mutex);
     iscsi_co_init_iscsitask(iscsilun, &iTask);
 retry:
     if (use_16_for_ws) {
@@ -XXX,XX +XXX,XX @@ retry:
 
     while (!iTask.complete) {
         iscsi_set_events(iscsilun);
+        qemu_mutex_unlock(&iscsilun->mutex);
         qemu_coroutine_yield();
+        qemu_mutex_lock(&iscsilun->mutex);
     }
 
     if (iTask.status == SCSI_STATUS_CHECK_CONDITION &&
@@ -XXX,XX +XXX,XX @@ retry:
         /* WRITE SAME is not supported by the target */
         iscsilun->has_write_same = false;
         scsi_free_scsi_task(iTask.task);
-        return -ENOTSUP;
+        r = -ENOTSUP;
+        goto out_unlock;
     }
 
     if (iTask.task != NULL) {
@@ -XXX,XX +XXX,XX @@ retry:
     if (iTask.status != SCSI_STATUS_GOOD) {
         iscsi_allocmap_set_invalid(iscsilun, offset >> BDRV_SECTOR_BITS,
                                    count >> BDRV_SECTOR_BITS);
-        return iTask.err_code;
+        r = iTask.err_code;
+        goto out_unlock;
     }
 
     if (flags & BDRV_REQ_MAY_UNMAP) {
@@ -XXX,XX +XXX,XX @@ retry:
                                      count >> BDRV_SECTOR_BITS);
     }
 
-    return 0;
+out_unlock:
+    qemu_mutex_unlock(&iscsilun->mutex);
+    return r;
 }
 
 static void apply_chap(struct iscsi_context *iscsi, QemuOpts *opts,
@@ -XXX,XX +XXX,XX @@ static void iscsi_nop_timed_event(void *opaque)
 {
     IscsiLun *iscsilun = opaque;
 
-    aio_context_acquire(iscsilun->aio_context);
+    qemu_mutex_lock(&iscsilun->mutex);
     if (iscsi_get_nops_in_flight(iscsilun->iscsi) >= MAX_NOP_FAILURES) {
         error_report("iSCSI: NOP timeout. Reconnecting...");
         iscsilun->request_timed_out = true;
@@ -XXX,XX +XXX,XX @@ static void iscsi_nop_timed_event(void *opaque)
     iscsi_set_events(iscsilun);
 
 out:
-    aio_context_release(iscsilun->aio_context);
+    qemu_mutex_unlock(&iscsilun->mutex);
 }
 
 static void iscsi_readcapacity_sync(IscsiLun *iscsilun, Error **errp)
@@ -XXX,XX +XXX,XX @@ static int iscsi_open(BlockDriverState *bs, QDict *options, int flags,
     scsi_free_scsi_task(task);
     task = NULL;
 
+    qemu_mutex_init(&iscsilun->mutex);
     iscsi_attach_aio_context(bs, iscsilun->aio_context);
 
     /* Guess the internal cluster (page) size of the iscsi target by the means
@@ -XXX,XX +XXX,XX @@ static void iscsi_close(BlockDriverState *bs)
     iscsi_destroy_context(iscsi);
     g_free(iscsilun->zeroblock);
     iscsi_allocmap_free(iscsilun);
+    qemu_mutex_destroy(&iscsilun->mutex);
     memset(iscsilun, 0, sizeof(IscsiLun));
 }
 
-- 
2.9.3

From: Paolo Bonzini <pbonzini@redhat.com>

nodes[id].next is written by other threads.  If atomic_read is not used
(matching atomic_set in mcs_mutex_lock!) the compiler can optimize the
whole "if" away!

Reported-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Tested-by: Greg Kurz <groug@kaod.org>
Message-id: 20170227111726.9237-1-pbonzini@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 tests/test-aio-multithread.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/test-aio-multithread.c b/tests/test-aio-multithread.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/test-aio-multithread.c
+++ b/tests/test-aio-multithread.c
@@ -XXX,XX +XXX,XX @@ static void mcs_mutex_lock(void)
 static void mcs_mutex_unlock(void)
 {
     int next;
-    if (nodes[id].next == -1) {
+    if (atomic_read(&nodes[id].next) == -1) {
         if (atomic_read(&mutex_head) == id &&
             atomic_cmpxchg(&mutex_head, id, -1) == id) {
             /* Last item in the list, exit.  */
@@ -XXX,XX +XXX,XX @@ static void mcs_mutex_unlock(void)
     }
 
     /* Wake up the next in line.  */
-    next = nodes[id].next;
+    next = atomic_read(&nodes[id].next);
     nodes[next].locked = 0;
     qemu_futex_wake(&nodes[next].locked, 1);
 }
-- 
2.9.3

The following changes since commit 9d662a6b22a0838a85c5432385f35db2488a33a5:

Merge remote-tracking branch 'remotes/legoater/tags/pull-ppc-20220305' into staging (2022-03-05 18:03:15 +0000)

are available in the Git repository at:

https://gitlab.com/hreitz/qemu.git tags/pull-block-2022-03-07

for you to fetch changes up to 743da0b401cdc3ee94bc519975e339a3cdbe0ad1:

iotests/image-fleecing: test push backup with fleecing (2022-03-07 09:33:31 +0100)

----------------------------------------------------------------
Block patches for 7.0-rc0:
- New fleecing backup scheme
- iotest fixes
- Fixes for the curl block driver
- Fix for the preallocate block driver
- IDE fix for zero-length TRIM requests

----------------------------------------------------------------
Hanna Reitz (2):
  ide: Increment BB in-flight counter for TRIM BH
  iotests: Write test output to TEST_DIR

Peter Maydell (2):
  block/curl.c: Set error message string if curl_init_state() fails
  block/curl.c: Check error return from curl_easy_setopt()

Thomas Huth (2):
  tests/qemu-iotests/040: Skip TestCommitWithFilters without 'throttle'
  tests/qemu-iotests/testrunner: Quote "case not run" lines in TAP mode

Vladimir Sementsov-Ogievskiy (17):
  block: fix preallocate filter: don't do unaligned preallocate requests
  block/block-copy: move copy_bitmap initialization to
    block_copy_state_new()
  block/dirty-bitmap: bdrv_merge_dirty_bitmap(): add return value
  block/block-copy: block_copy_state_new(): add bitmap parameter
  block/copy-before-write: add bitmap open parameter
  block/block-copy: add block_copy_reset()
  block: intoduce reqlist
  block/reqlist: reqlist_find_conflict(): use ranges_overlap()
  block/dirty-bitmap: introduce bdrv_dirty_bitmap_status()
  block/reqlist: add reqlist_wait_all()
  block/io: introduce block driver snapshot-access API
  block: introduce snapshot-access block driver
  block: copy-before-write: realize snapshot-access API
  iotests/image-fleecing: add test-case for fleecing format node
  iotests.py: add qemu_io_pipe_and_status()
  iotests/image-fleecing: add test case with bitmap
  iotests/image-fleecing: test push backup with fleecing

-- 
2.34.1

When we still have an AIOCB registered for DMA operations, we try to
settle the respective operation by draining the BlockBackend associated
with the IDE device.

However, this assumes that every DMA operation is associated with an
increment of the BlockBackend’s in-flight counter (e.g. through some
ongoing I/O operation), so that draining the BB until its in-flight
counter reaches 0 will settle all DMA operations.  That is not the case:
For TRIM, the guest can issue a zero-length operation that will not
result in any I/O operation forwarded to the BlockBackend, and also not
increment the in-flight counter in any other way.  In such a case,
blk_drain() will be a no-op if no other operations are in flight.

It is clear that if blk_drain() is a no-op, the value of
s->bus->dma->aiocb will not change between checking it in the `if`
condition and asserting that it is NULL after blk_drain().

The particular problem is that ide_issue_trim() creates a BH
(ide_trim_bh_cb()) to settle the TRIM request: iocb->common.cb() is
ide_dma_cb(), which will either create a new request, or find the
transfer to be done and call ide_set_inactive(), which clears
s->bus->dma->aiocb.  Therefore, the blk_drain() must wait for
ide_trim_bh_cb() to run, which currently it will not always do.

To fix this issue, we increment the BlockBackend's in-flight counter
when the TRIM operation begins (in ide_issue_trim(), when the
ide_trim_bh_cb() BH is created) and decrement it when ide_trim_bh_cb()
is done.

Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2029980
Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Hanna Reitz <hreitz@redhat.com>
Message-Id: <20220120142259.120189-1-hreitz@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Tested-by: John Snow <jsnow@redhat.com>
---
 hw/ide/core.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/hw/ide/core.c b/hw/ide/core.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -XXX,XX +XXX,XX @@ static const AIOCBInfo trim_aiocb_info = {
 static void ide_trim_bh_cb(void *opaque)
 {
     TrimAIOCB *iocb = opaque;
+    BlockBackend *blk = iocb->s->blk;
 
     iocb->common.cb(iocb->common.opaque, iocb->ret);
 
     qemu_bh_delete(iocb->bh);
     iocb->bh = NULL;
     qemu_aio_unref(iocb);
+
+    /* Paired with an increment in ide_issue_trim() */
+    blk_dec_in_flight(blk);
 }
 
 static void ide_issue_trim_cb(void *opaque, int ret)
@@ -XXX,XX +XXX,XX @@ BlockAIOCB *ide_issue_trim(
     IDEState *s = opaque;
     TrimAIOCB *iocb;
 
+    /* Paired with a decrement in ide_trim_bh_cb() */
+    blk_inc_in_flight(s->blk);
+
     iocb = blk_aio_get(&trim_aiocb_info, s->blk, cb, cb_opaque);
     iocb->s = s;
     iocb->bh = qemu_bh_new(ide_trim_bh_cb, iocb);
-- 
2.34.1

From: Peter Maydell <peter.maydell@linaro.org>

In curl_open(), the 'out' label assumes that the state->errmsg string
has been set (either by curl_easy_perform() or by manually copying a
string into it); however if curl_init_state() fails we will jump to
that label without setting the string.  Add the missing error string
setup.

(We can't be specific about the cause of failure: the documentation
of curl_easy_init() just says "If this function returns NULL,
something went wrong".)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20220222152341.850419-2-peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Hanna Reitz <hreitz@redhat.com>
Signed-off-by: Hanna Reitz <hreitz@redhat.com>
---
 block/curl.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/block/curl.c b/block/curl.c
index XXXXXXX..XXXXXXX 100644
--- a/block/curl.c
+++ b/block/curl.c
@@ -XXX,XX +XXX,XX @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags,
     // Get file size
 
     if (curl_init_state(s, state) < 0) {
+        pstrcpy(state->errmsg, CURL_ERROR_SIZE,
+                "curl library initialization failed.");
         goto out;
     }
 
-- 
2.34.1

From: Peter Maydell <peter.maydell@linaro.org>

Coverity points out that we aren't checking the return value
from curl_easy_setopt() for any of the calls to it we make
in block/curl.c.

Some of these options are documented as always succeeding (e.g.
CURLOPT_VERBOSE) but others have documented failure cases (e.g.
CURLOPT_URL).  For consistency we check every call, even the ones
that theoretically cannot fail.

Fixes: Coverity CID 1459336, 1459482, 1460331
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20220222152341.850419-3-peter.maydell@linaro.org>
Reviewed-by: Hanna Reitz <hreitz@redhat.com>
Signed-off-by: Hanna Reitz <hreitz@redhat.com>
---
 block/curl.c | 90 +++++++++++++++++++++++++++++++++-------------------
 1 file changed, 57 insertions(+), 33 deletions(-)

diff --git a/block/curl.c b/block/curl.c
index XXXXXXX..XXXXXXX 100644
--- a/block/curl.c
+++ b/block/curl.c
@@ -XXX,XX +XXX,XX @@ static int curl_init_state(BDRVCURLState *s, CURLState *state)
         if (!state->curl) {
             return -EIO;
         }
-        curl_easy_setopt(state->curl, CURLOPT_URL, s->url);
-        curl_easy_setopt(state->curl, CURLOPT_SSL_VERIFYPEER,
-                         (long) s->sslverify);
-        curl_easy_setopt(state->curl, CURLOPT_SSL_VERIFYHOST,
-                         s->sslverify ? 2L : 0L);
+        if (curl_easy_setopt(state->curl, CURLOPT_URL, s->url) ||
+            curl_easy_setopt(state->curl, CURLOPT_SSL_VERIFYPEER,
+                             (long) s->sslverify) ||
+            curl_easy_setopt(state->curl, CURLOPT_SSL_VERIFYHOST,
+                             s->sslverify ? 2L : 0L)) {
+            goto err;
+        }
         if (s->cookie) {
-            curl_easy_setopt(state->curl, CURLOPT_COOKIE, s->cookie);
+            if (curl_easy_setopt(state->curl, CURLOPT_COOKIE, s->cookie)) {
+                goto err;
+            }
+        }
+        if (curl_easy_setopt(state->curl, CURLOPT_TIMEOUT, (long)s->timeout) ||
+            curl_easy_setopt(state->curl, CURLOPT_WRITEFUNCTION,
+                             (void *)curl_read_cb) ||
+            curl_easy_setopt(state->curl, CURLOPT_WRITEDATA, (void *)state) ||
+            curl_easy_setopt(state->curl, CURLOPT_PRIVATE, (void *)state) ||
+            curl_easy_setopt(state->curl, CURLOPT_AUTOREFERER, 1) ||
+            curl_easy_setopt(state->curl, CURLOPT_FOLLOWLOCATION, 1) ||
+            curl_easy_setopt(state->curl, CURLOPT_NOSIGNAL, 1) ||
+            curl_easy_setopt(state->curl, CURLOPT_ERRORBUFFER, state->errmsg) ||
+            curl_easy_setopt(state->curl, CURLOPT_FAILONERROR, 1)) {
+            goto err;
         }
-        curl_easy_setopt(state->curl, CURLOPT_TIMEOUT, (long)s->timeout);
-        curl_easy_setopt(state->curl, CURLOPT_WRITEFUNCTION,
-                         (void *)curl_read_cb);
-        curl_easy_setopt(state->curl, CURLOPT_WRITEDATA, (void *)state);
-        curl_easy_setopt(state->curl, CURLOPT_PRIVATE, (void *)state);
-        curl_easy_setopt(state->curl, CURLOPT_AUTOREFERER, 1);
-        curl_easy_setopt(state->curl, CURLOPT_FOLLOWLOCATION, 1);
-        curl_easy_setopt(state->curl, CURLOPT_NOSIGNAL, 1);
-        curl_easy_setopt(state->curl, CURLOPT_ERRORBUFFER, state->errmsg);
-        curl_easy_setopt(state->curl, CURLOPT_FAILONERROR, 1);
-
         if (s->username) {
-            curl_easy_setopt(state->curl, CURLOPT_USERNAME, s->username);
+            if (curl_easy_setopt(state->curl, CURLOPT_USERNAME, s->username)) {
+                goto err;
+            }
         }
         if (s->password) {
-            curl_easy_setopt(state->curl, CURLOPT_PASSWORD, s->password);
+            if (curl_easy_setopt(state->curl, CURLOPT_PASSWORD, s->password)) {
+                goto err;
+            }
         }
         if (s->proxyusername) {
-            curl_easy_setopt(state->curl,
-                             CURLOPT_PROXYUSERNAME, s->proxyusername);
+            if (curl_easy_setopt(state->curl,
+                                 CURLOPT_PROXYUSERNAME, s->proxyusername)) {
+                goto err;
+            }
         }
         if (s->proxypassword) {
-            curl_easy_setopt(state->curl,
-                             CURLOPT_PROXYPASSWORD, s->proxypassword);
+            if (curl_easy_setopt(state->curl,
+                                 CURLOPT_PROXYPASSWORD, s->proxypassword)) {
+                goto err;
+            }
         }
 
         /* Restrict supported protocols to avoid security issues in the more
@@ -XXX,XX +XXX,XX @@ static int curl_init_state(BDRVCURLState *s, CURLState *state)
          * Restricting protocols is only supported from 7.19.4 upwards.
          */
 #if LIBCURL_VERSION_NUM >= 0x071304
-        curl_easy_setopt(state->curl, CURLOPT_PROTOCOLS, PROTOCOLS);
-        curl_easy_setopt(state->curl, CURLOPT_REDIR_PROTOCOLS, PROTOCOLS);
+        if (curl_easy_setopt(state->curl, CURLOPT_PROTOCOLS, PROTOCOLS) ||
+            curl_easy_setopt(state->curl, CURLOPT_REDIR_PROTOCOLS, PROTOCOLS)) {
+            goto err;
+        }
 #endif
 
 #ifdef DEBUG_VERBOSE
-        curl_easy_setopt(state->curl, CURLOPT_VERBOSE, 1);
+        if (curl_easy_setopt(state->curl, CURLOPT_VERBOSE, 1)) {
+            goto err;
+        }
 #endif
     }
 
     state->s = s;
 
     return 0;
+
+err:
+    curl_easy_cleanup(state->curl);
+    state->curl = NULL;
+    return -EIO;
 }
 
 /* Called with s->mutex held.  */
@@ -XXX,XX +XXX,XX @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags,
     }
 
     s->accept_range = false;
-    curl_easy_setopt(state->curl, CURLOPT_NOBODY, 1);
-    curl_easy_setopt(state->curl, CURLOPT_HEADERFUNCTION,
-                     curl_header_cb);
-    curl_easy_setopt(state->curl, CURLOPT_HEADERDATA, s);
+    if (curl_easy_setopt(state->curl, CURLOPT_NOBODY, 1) ||
+        curl_easy_setopt(state->curl, CURLOPT_HEADERFUNCTION, curl_header_cb) ||
+        curl_easy_setopt(state->curl, CURLOPT_HEADERDATA, s)) {
+        pstrcpy(state->errmsg, CURL_ERROR_SIZE,
+                "curl library initialization failed.");
+        goto out;
+    }
     if (curl_easy_perform(state->curl))
         goto out;
     if (curl_easy_getinfo(state->curl, CURLINFO_CONTENT_LENGTH_DOWNLOAD, &d)) {
@@ -XXX,XX +XXX,XX @@ static void curl_setup_preadv(BlockDriverState *bs, CURLAIOCB *acb)
 
     snprintf(state->range, 127, "%" PRIu64 "-%" PRIu64, start, end);
     trace_curl_setup_preadv(acb->bytes, start, state->range);
-    curl_easy_setopt(state->curl, CURLOPT_RANGE, state->range);
-
-    if (curl_multi_add_handle(s->multi, state->curl) != CURLM_OK) {
+    if (curl_easy_setopt(state->curl, CURLOPT_RANGE, state->range) ||
+        curl_multi_add_handle(s->multi, state->curl) != CURLM_OK) {
         state->acb[0] = NULL;
         acb->ret = -EIO;
 
-- 
2.34.1

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

There is a bug in handling BDRV_REQ_NO_WAIT flag: we still may wait in
wait_serialising_requests() if request is unaligned. And this is
possible for the only user of this flag (preallocate filter) if
underlying file is unaligned to its request_alignment on start.

So, we have to fix preallocate filter to do only aligned preallocate
requests.

Next, we should fix generic block/io.c somehow. Keeping in mind that
preallocate is the only user of BDRV_REQ_NO_WAIT and that we have to
fix its behavior now, it seems more safe to just assert that we never
use BDRV_REQ_NO_WAIT with unaligned requests and add corresponding
comment. Let's do so.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Denis V. Lunev <den@openvz.org>
Message-Id: <20220215121609.38570-1-vsementsov@virtuozzo.com>
[hreitz: Rebased on block GS/IO split]
Signed-off-by: Hanna Reitz <hreitz@redhat.com>
---
 include/block/block-common.h |  3 ++-
 block/io.c                   |  4 ++++
 block/preallocate.c          | 15 ++++++++++++---
 3 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/include/block/block-common.h b/include/block/block-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/block-common.h
+++ b/include/block/block-common.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
 
     /*
      * If we need to wait for other requests, just fail immediately. Used
-     * only together with BDRV_REQ_SERIALISING.
+     * only together with BDRV_REQ_SERIALISING. Used only with requests aligned
+     * to request_alignment (corresponding assertions are in block/io.c).
      */
     BDRV_REQ_NO_WAIT = 0x400,
 
diff --git a/block/io.c b/block/io.c
index XXXXXXX..XXXXXXX 100644
--- a/block/io.c
+++ b/block/io.c
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_co_do_zero_pwritev(BdrvChild *child,
 
     padding = bdrv_init_padding(bs, offset, bytes, &pad);
     if (padding) {
+        assert(!(flags & BDRV_REQ_NO_WAIT));
         bdrv_make_request_serialising(req, align);
 
         bdrv_padding_rmw_read(child, req, &pad, true);
@@ -XXX,XX +XXX,XX @@ int coroutine_fn bdrv_co_pwritev_part(BdrvChild *child,
          * serialize the request to prevent interactions of the
          * widened region with other transactions.
          */
+        assert(!(flags & BDRV_REQ_NO_WAIT));
         bdrv_make_request_serialising(&req, align);
         bdrv_padding_rmw_read(child, &req, &pad, false);
     }
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_co_copy_range_internal(
     /* TODO We can support BDRV_REQ_NO_FALLBACK here */
     assert(!(read_flags & BDRV_REQ_NO_FALLBACK));
     assert(!(write_flags & BDRV_REQ_NO_FALLBACK));
+    assert(!(read_flags & BDRV_REQ_NO_WAIT));
+    assert(!(write_flags & BDRV_REQ_NO_WAIT));
 
     if (!dst || !dst->bs || !bdrv_is_inserted(dst->bs)) {
         return -ENOMEDIUM;
diff --git a/block/preallocate.c b/block/preallocate.c
index XXXXXXX..XXXXXXX 100644
--- a/block/preallocate.c
+++ b/block/preallocate.c
@@ -XXX,XX +XXX,XX @@ static bool coroutine_fn handle_write(BlockDriverState *bs, int64_t offset,
     int64_t end = offset + bytes;
     int64_t prealloc_start, prealloc_end;
     int ret;
+    uint32_t file_align = bs->file->bs->bl.request_alignment;
+    uint32_t prealloc_align = MAX(s->opts.prealloc_align, file_align);
+
+    assert(QEMU_IS_ALIGNED(prealloc_align, file_align));
 
     if (!has_prealloc_perms(bs)) {
         /* We don't have state neither should try to recover it */
@@ -XXX,XX +XXX,XX @@ static bool coroutine_fn handle_write(BlockDriverState *bs, int64_t offset,
 
     /* Now we want new preallocation, as request writes beyond s->file_end. */
 
-    prealloc_start = want_merge_zero ? MIN(offset, s->file_end) : s->file_end;
-    prealloc_end = QEMU_ALIGN_UP(end + s->opts.prealloc_size,
-                                 s->opts.prealloc_align);
+    prealloc_start = QEMU_ALIGN_UP(
+            want_merge_zero ? MIN(offset, s->file_end) : s->file_end,
+            file_align);
+    prealloc_end = QEMU_ALIGN_UP(
+            MAX(prealloc_start, end) + s->opts.prealloc_size,
+            prealloc_align);
+
+    want_merge_zero = want_merge_zero && (prealloc_start <= offset);
 
     ret = bdrv_co_pwrite_zeroes(
             bs->file, prealloc_start, prealloc_end - prealloc_start,
-- 
2.34.1

From: Thomas Huth <thuth@redhat.com>

iotest 040 already has some checks for the availability of the 'throttle'
driver, but some new code has been added in the course of time that
depends on 'throttle' but does not check for its availability. Add
a check to the TestCommitWithFilters class so that this iotest now
also passes again if 'throttle' has not been enabled in the QEMU
binaries.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20220223123127.3206042-1-thuth@redhat.com>
Signed-off-by: Hanna Reitz <hreitz@redhat.com>
---
 tests/qemu-iotests/040 | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/qemu-iotests/040 b/tests/qemu-iotests/040
index XXXXXXX..XXXXXXX 100755
--- a/tests/qemu-iotests/040
+++ b/tests/qemu-iotests/040
@@ -XXX,XX +XXX,XX @@ class TestCommitWithFilters(iotests.QMPTestCase):
                              pattern_file)
             self.assertFalse('Pattern verification failed' in result)
 
+    @iotests.skip_if_unsupported(['throttle'])
     def setUp(self):
         qemu_img('create', '-f', iotests.imgfmt, self.img0, '64M')
         qemu_img('create', '-f', iotests.imgfmt, self.img1, '64M')
-- 
2.34.1

From: Thomas Huth <thuth@redhat.com>

In TAP mode, the stdout is reserved for the TAP protocol, so we
have to make sure to mark other lines with a comment '#' character
at the beginning to avoid that the TAP parser at the other end
gets confused.

To test this condition, run "configure" for example with:

--block-drv-rw-whitelist=copy-before-write,qcow2,raw,file,host_device,blkdebug,null-co,copy-on-read

so that iotest 041 will report that some tests are not run due to
the missing "quorum" driver. Without this change, "make check-block"
fails since the meson tap parser gets confused by these messages.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20220223124353.3273898-1-thuth@redhat.com>
Signed-off-by: Hanna Reitz <hreitz@redhat.com>
---
 tests/qemu-iotests/testrunner.py | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tests/qemu-iotests/testrunner.py b/tests/qemu-iotests/testrunner.py
index XXXXXXX..XXXXXXX 100644
--- a/tests/qemu-iotests/testrunner.py
+++ b/tests/qemu-iotests/testrunner.py
@@ -XXX,XX +XXX,XX @@ def run_test(self, test: str,
                                  description=res.description)
 
         if res.casenotrun:
-            print(res.casenotrun)
+            if self.tap:
+                print('#' + res.casenotrun.replace('\n', '\n#'))
+            else:
+                print(res.casenotrun)
 
         return res
 
-- 
2.34.1

Drop the use of OUTPUT_DIR (test/qemu-iotests under the build
directory), and instead write test output files (.out.bad, .notrun, and
.casenotrun) to TEST_DIR.

With this, the same test can be run concurrently without the separate
instances interfering, because they will need separate TEST_DIRs anyway.
Running the same test separately is useful when running the iotests with
various format/protocol combinations in parallel, or when you just want
to aggressively exercise a single test (e.g. when it fails only
sporadically).

Putting this output into TEST_DIR means that it will stick around for
inspection after the test run is done (though running the same test in
the same TEST_DIR will overwrite it, just as it used to be); but given
that TEST_DIR is a scratch directory, it should be clear that users can
delete all of its content at any point.  (And if TEST_DIR is on tmpfs,
it will just disappear on shutdown.)  Contrarily, alternative approaches
that would put these output files into OUTPUT_DIR with some prefix to
differentiate between separate test runs might easily lead to cluttering
OUTPUT_DIR.

(This change means OUTPUT_DIR is no longer written to by the iotests, so
we can drop its usage altogether.)

Signed-off-by: Hanna Reitz <hreitz@redhat.com>
Message-Id: <20220221172909.762858-1-hreitz@redhat.com>
[hreitz: Simplified `Path(os.path.join(x, y))` to `Path(x, y)`, as
         suggested by Vladimir; and rebased on 9086c7639822b6
         ("tests/qemu-iotests: Rework the checks and spots using GNU
         sed")]
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
---
 tests/qemu-iotests/common.rc     |  6 +++---
 tests/qemu-iotests/iotests.py    |  5 ++---
 tests/qemu-iotests/testenv.py    |  5 +----
 tests/qemu-iotests/testrunner.py | 14 ++++++++------
 4 files changed, 14 insertions(+), 16 deletions(-)

diff --git a/tests/qemu-iotests/common.rc b/tests/qemu-iotests/common.rc
index XXXXXXX..XXXXXXX 100644
--- a/tests/qemu-iotests/common.rc
+++ b/tests/qemu-iotests/common.rc
@@ -XXX,XX +XXX,XX @@
 # bail out, setting up .notrun file
 _notrun()
 {
-    echo "$*" >"$OUTPUT_DIR/$seq.notrun"
+    echo "$*" >"$TEST_DIR/$seq.notrun"
     echo "$seq not run: $*"
     status=0
     exit
@@ -XXX,XX +XXX,XX @@ _img_info()
 #
 _casenotrun()
 {
-    echo "    [case not run] $*" >>"$OUTPUT_DIR/$seq.casenotrun"
+    echo "    [case not run] $*" >>"$TEST_DIR/$seq.casenotrun"
 }
 
 # just plain bail out
 #
 _fail()
 {
-    echo "$*" | tee -a "$OUTPUT_DIR/$seq.full"
+    echo "$*" | tee -a "$TEST_DIR/$seq.full"
     echo "(see $seq.full for details)"
     status=1
     exit 1
diff --git a/tests/qemu-iotests/iotests.py b/tests/qemu-iotests/iotests.py
index XXXXXXX..XXXXXXX 100644
--- a/tests/qemu-iotests/iotests.py
+++ b/tests/qemu-iotests/iotests.py
@@ -XXX,XX +XXX,XX @@
 
 imgfmt = os.environ.get('IMGFMT', 'raw')
 imgproto = os.environ.get('IMGPROTO', 'file')
-output_dir = os.environ.get('OUTPUT_DIR', '.')
 
 try:
     test_dir = os.environ['TEST_DIR']
@@ -XXX,XX +XXX,XX @@ def notrun(reason):
     # Each test in qemu-iotests has a number ("seq")
     seq = os.path.basename(sys.argv[0])
 
-    with open('%s/%s.notrun' % (output_dir, seq), 'w', encoding='utf-8') \
+    with open('%s/%s.notrun' % (test_dir, seq), 'w', encoding='utf-8') \
             as outfile:
         outfile.write(reason + '\n')
     logger.warning("%s not run: %s", seq, reason)
@@ -XXX,XX +XXX,XX @@ def case_notrun(reason):
     # Each test in qemu-iotests has a number ("seq")
     seq = os.path.basename(sys.argv[0])
 
-    with open('%s/%s.casenotrun' % (output_dir, seq), 'a', encoding='utf-8') \
+    with open('%s/%s.casenotrun' % (test_dir, seq), 'a', encoding='utf-8') \
             as outfile:
         outfile.write('    [case not run] ' + reason + '\n')
 
diff --git a/tests/qemu-iotests/testenv.py b/tests/qemu-iotests/testenv.py
index XXXXXXX..XXXXXXX 100644
--- a/tests/qemu-iotests/testenv.py
+++ b/tests/qemu-iotests/testenv.py
@@ -XXX,XX +XXX,XX @@ class TestEnv(ContextManager['TestEnv']):
     # pylint: disable=too-many-instance-attributes
 
     env_variables = ['PYTHONPATH', 'TEST_DIR', 'SOCK_DIR', 'SAMPLE_IMG_DIR',
-                     'OUTPUT_DIR', 'PYTHON', 'QEMU_PROG', 'QEMU_IMG_PROG',
+                     'PYTHON', 'QEMU_PROG', 'QEMU_IMG_PROG',
                      'QEMU_IO_PROG', 'QEMU_NBD_PROG', 'QSD_PROG',
                      'QEMU_OPTIONS', 'QEMU_IMG_OPTIONS',
                      'QEMU_IO_OPTIONS', 'QEMU_IO_OPTIONS_NO_FMT',
@@ -XXX,XX +XXX,XX @@ def init_directories(self) -> None:
              TEST_DIR
              SOCK_DIR
              SAMPLE_IMG_DIR
-             OUTPUT_DIR
         """
 
         # Path where qemu goodies live in this source tree.
@@ -XXX,XX +XXX,XX @@ def init_directories(self) -> None:
                                         os.path.join(self.source_iotests,
                                                      'sample_images'))
 
-        self.output_dir = os.getcwd()  # OUTPUT_DIR
-
     def init_binaries(self) -> None:
         """Init binary path variables:
              PYTHON (for bash tests)
diff --git a/tests/qemu-iotests/testrunner.py b/tests/qemu-iotests/testrunner.py
index XXXXXXX..XXXXXXX 100644
--- a/tests/qemu-iotests/testrunner.py
+++ b/tests/qemu-iotests/testrunner.py
@@ -XXX,XX +XXX,XX @@ def do_run_test(self, test: str, mp: bool) -> TestResult:
         """
 
         f_test = Path(test)
-        f_bad = Path(f_test.name + '.out.bad')
-        f_notrun = Path(f_test.name + '.notrun')
-        f_casenotrun = Path(f_test.name + '.casenotrun')
         f_reference = Path(self.find_reference(test))
 
         if not f_test.exists():
@@ -XXX,XX +XXX,XX @@ def do_run_test(self, test: str, mp: bool) -> TestResult:
                               description='No qualified output '
                                           f'(expected {f_reference})')
 
-        for p in (f_bad, f_notrun, f_casenotrun):
-            silent_unlink(p)
-
         args = [str(f_test.resolve())]
         env = self.env.prepare_subprocess(args)
         if mp:
@@ -XXX,XX +XXX,XX @@ def do_run_test(self, test: str, mp: bool) -> TestResult:
                 env[d] = os.path.join(env[d], f_test.name)
                 Path(env[d]).mkdir(parents=True, exist_ok=True)
 
+        test_dir = env['TEST_DIR']
+        f_bad = Path(test_dir, f_test.name + '.out.bad')
+        f_notrun = Path(test_dir, f_test.name + '.notrun')
+        f_casenotrun = Path(test_dir, f_test.name + '.casenotrun')
+
+        for p in (f_notrun, f_casenotrun):
+            silent_unlink(p)
+
         t0 = time.time()
         with f_bad.open('w', encoding="utf-8") as f:
             with subprocess.Popen(args, cwd=str(f_test.parent), env=env,
-- 
2.34.1

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

We are going to complicate bitmap initialization in the further
commit. And in future, backup job will be able to work without filter
(when source is immutable), so we'll need same bitmap initialization in
copy-before-write filter and in backup job. So, it's reasonable to do
it in block-copy.

Note that for now cbw_open() is the only caller of
block_copy_state_new().

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Hanna Reitz <hreitz@redhat.com>
Message-Id: <20220303194349.2304213-2-vsementsov@virtuozzo.com>
Signed-off-by: Hanna Reitz <hreitz@redhat.com>
---
 block/block-copy.c        | 1 +
 block/copy-before-write.c | 4 ----
 2 files changed, 1 insertion(+), 4 deletions(-)

diff --git a/block/block-copy.c b/block/block-copy.c
index XXXXXXX..XXXXXXX 100644
--- a/block/block-copy.c
+++ b/block/block-copy.c
@@ -XXX,XX +XXX,XX @@ BlockCopyState *block_copy_state_new(BdrvChild *source, BdrvChild *target,
         return NULL;
     }
     bdrv_disable_dirty_bitmap(copy_bitmap);
+    bdrv_set_dirty_bitmap(copy_bitmap, 0, bdrv_dirty_bitmap_size(copy_bitmap));
 
     /*
      * If source is in backing chain of target assume that target is going to be
diff --git a/block/copy-before-write.c b/block/copy-before-write.c
index XXXXXXX..XXXXXXX 100644
--- a/block/copy-before-write.c
+++ b/block/copy-before-write.c
@@ -XXX,XX +XXX,XX @@ static int cbw_open(BlockDriverState *bs, QDict *options, int flags,
                     Error **errp)
 {
     BDRVCopyBeforeWriteState *s = bs->opaque;
-    BdrvDirtyBitmap *copy_bitmap;
 
     bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
                                BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
@@ -XXX,XX +XXX,XX @@ static int cbw_open(BlockDriverState *bs, QDict *options, int flags,
         return -EINVAL;
     }
 
-    copy_bitmap = block_copy_dirty_bitmap(s->bcs);
-    bdrv_set_dirty_bitmap(copy_bitmap, 0, bdrv_dirty_bitmap_size(copy_bitmap));
-
     return 0;
 }
 
-- 
2.34.1

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

That simplifies handling failure in existing code and in further new
usage of bdrv_merge_dirty_bitmap().

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Hanna Reitz <hreitz@redhat.com>
Message-Id: <20220303194349.2304213-3-vsementsov@virtuozzo.com>
Signed-off-by: Hanna Reitz <hreitz@redhat.com>
---
 include/block/dirty-bitmap.h    | 2 +-
 block/dirty-bitmap.c            | 9 +++++++--
 block/monitor/bitmap-qmp-cmds.c | 5 +----
 3 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/include/block/dirty-bitmap.h b/include/block/dirty-bitmap.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/dirty-bitmap.h
+++ b/include/block/dirty-bitmap.h
@@ -XXX,XX +XXX,XX @@ void bdrv_dirty_bitmap_set_persistence(BdrvDirtyBitmap *bitmap,
                                        bool persistent);
 void bdrv_dirty_bitmap_set_inconsistent(BdrvDirtyBitmap *bitmap);
 void bdrv_dirty_bitmap_set_busy(BdrvDirtyBitmap *bitmap, bool busy);
-void bdrv_merge_dirty_bitmap(BdrvDirtyBitmap *dest, const BdrvDirtyBitmap *src,
+bool bdrv_merge_dirty_bitmap(BdrvDirtyBitmap *dest, const BdrvDirtyBitmap *src,
                              HBitmap **backup, Error **errp);
 void bdrv_dirty_bitmap_skip_store(BdrvDirtyBitmap *bitmap, bool skip);
 bool bdrv_dirty_bitmap_get(BdrvDirtyBitmap *bitmap, int64_t offset);
diff --git a/block/dirty-bitmap.c b/block/dirty-bitmap.c
index XXXXXXX..XXXXXXX 100644
--- a/block/dirty-bitmap.c
+++ b/block/dirty-bitmap.c
@@ -XXX,XX +XXX,XX @@ bool bdrv_dirty_bitmap_next_dirty_area(BdrvDirtyBitmap *bitmap,
  * Ensures permissions on bitmaps are reasonable; use for public API.
  *
  * @backup: If provided, make a copy of dest here prior to merge.
+ *
+ * Returns true on success, false on failure. In case of failure bitmaps are
+ * untouched.
  */
-void bdrv_merge_dirty_bitmap(BdrvDirtyBitmap *dest, const BdrvDirtyBitmap *src,
+bool bdrv_merge_dirty_bitmap(BdrvDirtyBitmap *dest, const BdrvDirtyBitmap *src,
                              HBitmap **backup, Error **errp)
 {
-    bool ret;
+    bool ret = false;
 
     bdrv_dirty_bitmaps_lock(dest->bs);
     if (src->bs != dest->bs) {
@@ -XXX,XX +XXX,XX @@ out:
     if (src->bs != dest->bs) {
         bdrv_dirty_bitmaps_unlock(src->bs);
     }
+
+    return ret;
 }
 
 /**
diff --git a/block/monitor/bitmap-qmp-cmds.c b/block/monitor/bitmap-qmp-cmds.c
index XXXXXXX..XXXXXXX 100644
--- a/block/monitor/bitmap-qmp-cmds.c
+++ b/block/monitor/bitmap-qmp-cmds.c
@@ -XXX,XX +XXX,XX @@ BdrvDirtyBitmap *block_dirty_bitmap_merge(const char *node, const char *target,
     BlockDriverState *bs;
     BdrvDirtyBitmap *dst, *src, *anon;
     BlockDirtyBitmapMergeSourceList *lst;
-    Error *local_err = NULL;
 
     GLOBAL_STATE_CODE();
 
@@ -XXX,XX +XXX,XX @@ BdrvDirtyBitmap *block_dirty_bitmap_merge(const char *node, const char *target,
             abort();
         }
 
-        bdrv_merge_dirty_bitmap(anon, src, NULL, &local_err);
-        if (local_err) {
-            error_propagate(errp, local_err);
+        if (!bdrv_merge_dirty_bitmap(anon, src, NULL, errp)) {
             dst = NULL;
             goto out;
         }
-- 
2.34.1

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

This will be used in the following commit to bring "incremental" mode
to copy-before-write filter.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Hanna Reitz <hreitz@redhat.com>
Message-Id: <20220303194349.2304213-4-vsementsov@virtuozzo.com>
Signed-off-by: Hanna Reitz <hreitz@redhat.com>
---
 include/block/block-copy.h |  1 +
 block/block-copy.c         | 14 +++++++++++++-
 block/copy-before-write.c  |  2 +-
 3 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/include/block/block-copy.h b/include/block/block-copy.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/block-copy.h
+++ b/include/block/block-copy.h
@@ -XXX,XX +XXX,XX @@ typedef struct BlockCopyState BlockCopyState;
 typedef struct BlockCopyCallState BlockCopyCallState;
 
 BlockCopyState *block_copy_state_new(BdrvChild *source, BdrvChild *target,
+                                     const BdrvDirtyBitmap *bitmap,
                                      Error **errp);
 
 /* Function should be called prior any actual copy request */
diff --git a/block/block-copy.c b/block/block-copy.c
index XXXXXXX..XXXXXXX 100644
--- a/block/block-copy.c
+++ b/block/block-copy.c
@@ -XXX,XX +XXX,XX @@ static int64_t block_copy_calculate_cluster_size(BlockDriverState *target,
 }
 
 BlockCopyState *block_copy_state_new(BdrvChild *source, BdrvChild *target,
+                                     const BdrvDirtyBitmap *bitmap,
                                      Error **errp)
 {
+    ERRP_GUARD();
     BlockCopyState *s;
     int64_t cluster_size;
     BdrvDirtyBitmap *copy_bitmap;
@@ -XXX,XX +XXX,XX @@ BlockCopyState *block_copy_state_new(BdrvChild *source, BdrvChild *target,
         return NULL;
     }
     bdrv_disable_dirty_bitmap(copy_bitmap);
-    bdrv_set_dirty_bitmap(copy_bitmap, 0, bdrv_dirty_bitmap_size(copy_bitmap));
+    if (bitmap) {
+        if (!bdrv_merge_dirty_bitmap(copy_bitmap, bitmap, NULL, errp)) {
+            error_prepend(errp, "Failed to merge bitmap '%s' to internal "
+                          "copy-bitmap: ", bdrv_dirty_bitmap_name(bitmap));
+            bdrv_release_dirty_bitmap(copy_bitmap);
+            return NULL;
+        }
+    } else {
+        bdrv_set_dirty_bitmap(copy_bitmap, 0,
+                              bdrv_dirty_bitmap_size(copy_bitmap));
+    }
 
     /*
      * If source is in backing chain of target assume that target is going to be
diff --git a/block/copy-before-write.c b/block/copy-before-write.c
index XXXXXXX..XXXXXXX 100644
--- a/block/copy-before-write.c
+++ b/block/copy-before-write.c
@@ -XXX,XX +XXX,XX @@ static int cbw_open(BlockDriverState *bs, QDict *options, int flags,
             ((BDRV_REQ_FUA | BDRV_REQ_MAY_UNMAP | BDRV_REQ_NO_FALLBACK) &
              bs->file->bs->supported_zero_flags);
 
-    s->bcs = block_copy_state_new(bs->file, s->target, errp);
+    s->bcs = block_copy_state_new(bs->file, s->target, NULL, errp);
     if (!s->bcs) {
         error_prepend(errp, "Cannot create block-copy-state: ");
         return -EINVAL;
-- 
2.34.1

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

This brings "incremental" mode to copy-before-write filter: user can
specify bitmap so that filter will copy only "dirty" areas.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20220303194349.2304213-5-vsementsov@virtuozzo.com>
Signed-off-by: Hanna Reitz <hreitz@redhat.com>
---
 qapi/block-core.json      | 10 +++++++-
 block/copy-before-write.c | 51 ++++++++++++++++++++++++++++++++++++++-
 2 files changed, 59 insertions(+), 2 deletions(-)

diff --git a/qapi/block-core.json b/qapi/block-core.json
index XXXXXXX..XXXXXXX 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -XXX,XX +XXX,XX @@
 #
 # @target: The target for copy-before-write operations.
 #
+# @bitmap: If specified, copy-before-write filter will do
+#          copy-before-write operations only for dirty regions of the
+#          bitmap. Bitmap size must be equal to length of file and
+#          target child of the filter. Note also, that bitmap is used
+#          only to initialize internal bitmap of the process, so further
+#          modifications (or removing) of specified bitmap doesn't
+#          influence the filter. (Since 7.0)
+#
 # Since: 6.2
 ##
 { 'struct': 'BlockdevOptionsCbw',
   'base': 'BlockdevOptionsGenericFormat',
-  'data': { 'target': 'BlockdevRef' } }
+  'data': { 'target': 'BlockdevRef', '*bitmap': 'BlockDirtyBitmap' } }
 
 ##
 # @BlockdevOptions:
diff --git a/block/copy-before-write.c b/block/copy-before-write.c
index XXXXXXX..XXXXXXX 100644
--- a/block/copy-before-write.c
+++ b/block/copy-before-write.c
@@ -XXX,XX +XXX,XX @@
 
 #include "block/copy-before-write.h"
 
+#include "qapi/qapi-visit-block-core.h"
+
 typedef struct BDRVCopyBeforeWriteState {
     BlockCopyState *bcs;
     BdrvChild *target;
@@ -XXX,XX +XXX,XX @@ static void cbw_child_perm(BlockDriverState *bs, BdrvChild *c,
     }
 }
 
+static bool cbw_parse_bitmap_option(QDict *options, BdrvDirtyBitmap **bitmap,
+                                    Error **errp)
+{
+    QDict *bitmap_qdict = NULL;
+    BlockDirtyBitmap *bmp_param = NULL;
+    Visitor *v = NULL;
+    bool ret = false;
+
+    *bitmap = NULL;
+
+    qdict_extract_subqdict(options, &bitmap_qdict, "bitmap.");
+    if (!qdict_size(bitmap_qdict)) {
+        ret = true;
+        goto out;
+    }
+
+    v = qobject_input_visitor_new_flat_confused(bitmap_qdict, errp);
+    if (!v) {
+        goto out;
+    }
+
+    visit_type_BlockDirtyBitmap(v, NULL, &bmp_param, errp);
+    if (!bmp_param) {
+        goto out;
+    }
+
+    *bitmap = block_dirty_bitmap_lookup(bmp_param->node, bmp_param->name, NULL,
+                                        errp);
+    if (!*bitmap) {
+        goto out;
+    }
+
+    ret = true;
+
+out:
+    qapi_free_BlockDirtyBitmap(bmp_param);
+    visit_free(v);
+    qobject_unref(bitmap_qdict);
+
+    return ret;
+}
+
 static int cbw_open(BlockDriverState *bs, QDict *options, int flags,
                     Error **errp)
 {
     BDRVCopyBeforeWriteState *s = bs->opaque;
+    BdrvDirtyBitmap *bitmap = NULL;
 
     bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
                                BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
@@ -XXX,XX +XXX,XX @@ static int cbw_open(BlockDriverState *bs, QDict *options, int flags,
         return -EINVAL;
     }
 
+    if (!cbw_parse_bitmap_option(options, &bitmap, errp)) {
+        return -EINVAL;
+    }
+
     bs->total_sectors = bs->file->bs->total_sectors;
     bs->supported_write_flags = BDRV_REQ_WRITE_UNCHANGED |
             (BDRV_REQ_FUA & bs->file->bs->supported_write_flags);
@@ -XXX,XX +XXX,XX @@ static int cbw_open(BlockDriverState *bs, QDict *options, int flags,
             ((BDRV_REQ_FUA | BDRV_REQ_MAY_UNMAP | BDRV_REQ_NO_FALLBACK) &
              bs->file->bs->supported_zero_flags);
 
-    s->bcs = block_copy_state_new(bs->file, s->target, NULL, errp);
+    s->bcs = block_copy_state_new(bs->file, s->target, bitmap, errp);
     if (!s->bcs) {
         error_prepend(errp, "Cannot create block-copy-state: ");
         return -EINVAL;
-- 
2.34.1

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Split block_copy_reset() out of block_copy_reset_unallocated() to be
used separately later.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Hanna Reitz <hreitz@redhat.com>
Message-Id: <20220303194349.2304213-6-vsementsov@virtuozzo.com>
Signed-off-by: Hanna Reitz <hreitz@redhat.com>
---
 include/block/block-copy.h |  1 +
 block/block-copy.c         | 21 +++++++++++++--------
 2 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/include/block/block-copy.h b/include/block/block-copy.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/block-copy.h
+++ b/include/block/block-copy.h
@@ -XXX,XX +XXX,XX @@ void block_copy_set_progress_meter(BlockCopyState *s, ProgressMeter *pm);
 
 void block_copy_state_free(BlockCopyState *s);
 
+void block_copy_reset(BlockCopyState *s, int64_t offset, int64_t bytes);
 int64_t block_copy_reset_unallocated(BlockCopyState *s,
                                      int64_t offset, int64_t *count);
 
diff --git a/block/block-copy.c b/block/block-copy.c
index XXXXXXX..XXXXXXX 100644
--- a/block/block-copy.c
+++ b/block/block-copy.c
@@ -XXX,XX +XXX,XX @@ static int block_copy_is_cluster_allocated(BlockCopyState *s, int64_t offset,
     }
 }
 
+void block_copy_reset(BlockCopyState *s, int64_t offset, int64_t bytes)
+{
+    QEMU_LOCK_GUARD(&s->lock);
+
+    bdrv_reset_dirty_bitmap(s->copy_bitmap, offset, bytes);
+    if (s->progress) {
+        progress_set_remaining(s->progress,
+                               bdrv_get_dirty_count(s->copy_bitmap) +
+                               s->in_flight_bytes);
+    }
+}
+
 /*
  * Reset bits in copy_bitmap starting at offset if they represent unallocated
  * data in the image. May reset subsequent contiguous bits.
@@ -XXX,XX +XXX,XX @@ int64_t block_copy_reset_unallocated(BlockCopyState *s,
     bytes = clusters * s->cluster_size;
 
     if (!ret) {
-        qemu_co_mutex_lock(&s->lock);
-        bdrv_reset_dirty_bitmap(s->copy_bitmap, offset, bytes);
-        if (s->progress) {
-            progress_set_remaining(s->progress,
-                                   bdrv_get_dirty_count(s->copy_bitmap) +
-                                   s->in_flight_bytes);
-        }
-        qemu_co_mutex_unlock(&s->lock);
+        block_copy_reset(s, offset, bytes);
     }
 
     *count = bytes;
-- 
2.34.1

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Split intersecting-requests functionality out of block-copy to be
reused in copy-before-write filter.

Note: while being here, fix tiny typo in MAINTAINERS.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Hanna Reitz <hreitz@redhat.com>
Message-Id: <20220303194349.2304213-7-vsementsov@virtuozzo.com>
Signed-off-by: Hanna Reitz <hreitz@redhat.com>
---
 include/block/reqlist.h |  67 +++++++++++++++++++++++
 block/block-copy.c      | 116 +++++++++++++---------------------------
 block/reqlist.c         |  76 ++++++++++++++++++++++++++
 MAINTAINERS             |   4 +-
 block/meson.build       |   1 +
 5 files changed, 184 insertions(+), 80 deletions(-)
 create mode 100644 include/block/reqlist.h
 create mode 100644 block/reqlist.c

diff --git a/include/block/reqlist.h b/include/block/reqlist.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/block/reqlist.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * reqlist API
+ *
+ * Copyright (C) 2013 Proxmox Server Solutions
+ * Copyright (c) 2021 Virtuozzo International GmbH.
+ *
+ * Authors:
+ *  Dietmar Maurer (dietmar@proxmox.com)
+ *  Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#ifndef REQLIST_H
+#define REQLIST_H
+
+#include "qemu/coroutine.h"
+
+/*
+ * The API is not thread-safe and shouldn't be. The struct is public to be part
+ * of other structures and protected by third-party locks, see
+ * block/block-copy.c for example.
+ */
+
+typedef struct BlockReq {
+    int64_t offset;
+    int64_t bytes;
+
+    CoQueue wait_queue; /* coroutines blocked on this req */
+    QLIST_ENTRY(BlockReq) list;
+} BlockReq;
+
+typedef QLIST_HEAD(, BlockReq) BlockReqList;
+
+/*
+ * Initialize new request and add it to the list. Caller must be sure that
+ * there are no conflicting requests in the list.
+ */
+void reqlist_init_req(BlockReqList *reqs, BlockReq *req, int64_t offset,
+                      int64_t bytes);
+/* Search for request in the list intersecting with @offset/@bytes area. */
+BlockReq *reqlist_find_conflict(BlockReqList *reqs, int64_t offset,
+                                int64_t bytes);
+
+/*
+ * If there are no intersecting requests return false. Otherwise, wait for the
+ * first found intersecting request to finish and return true.
+ *
+ * @lock is passed to qemu_co_queue_wait()
+ * False return value proves that lock was released at no point.
+ */
+bool coroutine_fn reqlist_wait_one(BlockReqList *reqs, int64_t offset,
+                                   int64_t bytes, CoMutex *lock);
+
+/*
+ * Shrink request and wake all waiting coroutines (maybe some of them are not
+ * intersecting with shrunk request).
+ */
+void coroutine_fn reqlist_shrink_req(BlockReq *req, int64_t new_bytes);
+
+/*
+ * Remove request and wake all waiting coroutines. Do not release any memory.
+ */
+void coroutine_fn reqlist_remove_req(BlockReq *req);
+
+#endif /* REQLIST_H */
diff --git a/block/block-copy.c b/block/block-copy.c
index XXXXXXX..XXXXXXX 100644
--- a/block/block-copy.c
+++ b/block/block-copy.c
@@ -XXX,XX +XXX,XX @@
 #include "trace.h"
 #include "qapi/error.h"
 #include "block/block-copy.h"
+#include "block/reqlist.h"
 #include "sysemu/block-backend.h"
 #include "qemu/units.h"
 #include "qemu/coroutine.h"
@@ -XXX,XX +XXX,XX @@ typedef struct BlockCopyTask {
      */
     BlockCopyState *s;
     BlockCopyCallState *call_state;
-    int64_t offset;
     /*
      * @method can also be set again in the while loop of
      * block_copy_dirty_clusters(), but it is never accessed concurrently
@@ -XXX,XX +XXX,XX @@ typedef struct BlockCopyTask {
     BlockCopyMethod method;
 
     /*
-     * Fields whose state changes throughout the execution
-     * Protected by lock in BlockCopyState.
+     * Generally, req is protected by lock in BlockCopyState, Still req.offset
+     * is only set on task creation, so may be read concurrently after creation.
+     * req.bytes is changed at most once, and need only protecting the case of
+     * parallel read while updating @bytes value in block_copy_task_shrink().
      */
-    CoQueue wait_queue; /* coroutines blocked on this task */
-    /*
-     * Only protect the case of parallel read while updating @bytes
-     * value in block_copy_task_shrink().
-     */
-    int64_t bytes;
-    QLIST_ENTRY(BlockCopyTask) list;
+    BlockReq req;
 } BlockCopyTask;
 
 static int64_t task_end(BlockCopyTask *task)
 {
-    return task->offset + task->bytes;
+    return task->req.offset + task->req.bytes;
 }
 
 typedef struct BlockCopyState {
@@ -XXX,XX +XXX,XX @@ typedef struct BlockCopyState {
     CoMutex lock;
     int64_t in_flight_bytes;
     BlockCopyMethod method;
-    QLIST_HEAD(, BlockCopyTask) tasks; /* All tasks from all block-copy calls */
+    BlockReqList reqs;
     QLIST_HEAD(, BlockCopyCallState) calls;
     /*
      * skip_unallocated:
@@ -XXX,XX +XXX,XX @@ typedef struct BlockCopyState {
     RateLimit rate_limit;
 } BlockCopyState;
 
-/* Called with lock held */
-static BlockCopyTask *find_conflicting_task(BlockCopyState *s,
-                                            int64_t offset, int64_t bytes)
-{
-    BlockCopyTask *t;
-
-    QLIST_FOREACH(t, &s->tasks, list) {
-        if (offset + bytes > t->offset && offset < t->offset + t->bytes) {
-            return t;
-        }
-    }
-
-    return NULL;
-}
-
-/*
- * If there are no intersecting tasks return false. Otherwise, wait for the
- * first found intersecting tasks to finish and return true.
- *
- * Called with lock held. May temporary release the lock.
- * Return value of 0 proves that lock was NOT released.
- */
-static bool coroutine_fn block_copy_wait_one(BlockCopyState *s, int64_t offset,
-                                             int64_t bytes)
-{
-    BlockCopyTask *task = find_conflicting_task(s, offset, bytes);
-
-    if (!task) {
-        return false;
-    }
-
-    qemu_co_queue_wait(&task->wait_queue, &s->lock);
-
-    return true;
-}
-
 /* Called with lock held */
 static int64_t block_copy_chunk_size(BlockCopyState *s)
 {
@@ -XXX,XX +XXX,XX @@ block_copy_task_create(BlockCopyState *s, BlockCopyCallState *call_state,
     bytes = QEMU_ALIGN_UP(bytes, s->cluster_size);
 
     /* region is dirty, so no existent tasks possible in it */
-    assert(!find_conflicting_task(s, offset, bytes));
+    assert(!reqlist_find_conflict(&s->reqs, offset, bytes));
 
     bdrv_reset_dirty_bitmap(s->copy_bitmap, offset, bytes);
     s->in_flight_bytes += bytes;
@@ -XXX,XX +XXX,XX @@ block_copy_task_create(BlockCopyState *s, BlockCopyCallState *call_state,
         .task.func = block_copy_task_entry,
         .s = s,
         .call_state = call_state,
-        .offset = offset,
-        .bytes = bytes,
         .method = s->method,
     };
-    qemu_co_queue_init(&task->wait_queue);
-    QLIST_INSERT_HEAD(&s->tasks, task, list);
+    reqlist_init_req(&s->reqs, &task->req, offset, bytes);
 
     return task;
 }
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn block_copy_task_shrink(BlockCopyTask *task,
                                                 int64_t new_bytes)
 {
     QEMU_LOCK_GUARD(&task->s->lock);
-    if (new_bytes == task->bytes) {
+    if (new_bytes == task->req.bytes) {
         return;
     }
 
-    assert(new_bytes > 0 && new_bytes < task->bytes);
+    assert(new_bytes > 0 && new_bytes < task->req.bytes);
 
-    task->s->in_flight_bytes -= task->bytes - new_bytes;
+    task->s->in_flight_bytes -= task->req.bytes - new_bytes;
     bdrv_set_dirty_bitmap(task->s->copy_bitmap,
-                          task->offset + new_bytes, task->bytes - new_bytes);
+                          task->req.offset + new_bytes,
+                          task->req.bytes - new_bytes);
 
-    task->bytes = new_bytes;
-    qemu_co_queue_restart_all(&task->wait_queue);
+    reqlist_shrink_req(&task->req, new_bytes);
 }
 
 static void coroutine_fn block_copy_task_end(BlockCopyTask *task, int ret)
 {
     QEMU_LOCK_GUARD(&task->s->lock);
-    task->s->in_flight_bytes -= task->bytes;
+    task->s->in_flight_bytes -= task->req.bytes;
     if (ret < 0) {
-        bdrv_set_dirty_bitmap(task->s->copy_bitmap, task->offset, task->bytes);
+        bdrv_set_dirty_bitmap(task->s->copy_bitmap, task->req.offset,
+                              task->req.bytes);
     }
-    QLIST_REMOVE(task, list);
     if (task->s->progress) {
         progress_set_remaining(task->s->progress,
                                bdrv_get_dirty_count(task->s->copy_bitmap) +
                                task->s->in_flight_bytes);
     }
-    qemu_co_queue_restart_all(&task->wait_queue);
+    reqlist_remove_req(&task->req);
 }
 
 void block_copy_state_free(BlockCopyState *s)
@@ -XXX,XX +XXX,XX @@ BlockCopyState *block_copy_state_new(BdrvChild *source, BdrvChild *target,
 
     ratelimit_init(&s->rate_limit);
     qemu_co_mutex_init(&s->lock);
-    QLIST_INIT(&s->tasks);
+    QLIST_INIT(&s->reqs);
     QLIST_INIT(&s->calls);
 
     return s;
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int block_copy_task_run(AioTaskPool *pool,
 
     aio_task_pool_wait_slot(pool);
     if (aio_task_pool_status(pool) < 0) {
-        co_put_to_shres(task->s->mem, task->bytes);
+        co_put_to_shres(task->s->mem, task->req.bytes);
         block_copy_task_end(task, -ECANCELED);
         g_free(task);
         return -ECANCELED;
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int block_copy_task_entry(AioTask *task)
     BlockCopyMethod method = t->method;
     int ret;
 
-    ret = block_copy_do_copy(s, t->offset, t->bytes, &method, &error_is_read);
+    ret = block_copy_do_copy(s, t->req.offset, t->req.bytes, &method,
+                             &error_is_read);
 
     WITH_QEMU_LOCK_GUARD(&s->lock) {
         if (s->method == t->method) {
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int block_copy_task_entry(AioTask *task)
                 t->call_state->error_is_read = error_is_read;
             }
         } else if (s->progress) {
-            progress_work_done(s->progress, t->bytes);
+            progress_work_done(s->progress, t->req.bytes);
         }
     }
-    co_put_to_shres(s->mem, t->bytes);
+    co_put_to_shres(s->mem, t->req.bytes);
     block_copy_task_end(t, ret);
 
     return ret;
@@ -XXX,XX +XXX,XX @@ block_copy_dirty_clusters(BlockCopyCallState *call_state)
             trace_block_copy_skip_range(s, offset, bytes);
             break;
         }
-        if (task->offset > offset) {
-            trace_block_copy_skip_range(s, offset, task->offset - offset);
+        if (task->req.offset > offset) {
+            trace_block_copy_skip_range(s, offset, task->req.offset - offset);
         }
 
         found_dirty = true;
 
-        ret = block_copy_block_status(s, task->offset, task->bytes,
+        ret = block_copy_block_status(s, task->req.offset, task->req.bytes,
                                       &status_bytes);
         assert(ret >= 0); /* never fail */
-        if (status_bytes < task->bytes) {
+        if (status_bytes < task->req.bytes) {
             block_copy_task_shrink(task, status_bytes);
         }
         if (qatomic_read(&s->skip_unallocated) &&
             !(ret & BDRV_BLOCK_ALLOCATED)) {
             block_copy_task_end(task, 0);
-            trace_block_copy_skip_range(s, task->offset, task->bytes);
+            trace_block_copy_skip_range(s, task->req.offset, task->req.bytes);
             offset = task_end(task);
             bytes = end - offset;
             g_free(task);
@@ -XXX,XX +XXX,XX @@ block_copy_dirty_clusters(BlockCopyCallState *call_state)
             }
         }
 
-        ratelimit_calculate_delay(&s->rate_limit, task->bytes);
+        ratelimit_calculate_delay(&s->rate_limit, task->req.bytes);
 
-        trace_block_copy_process(s, task->offset);
+        trace_block_copy_process(s, task->req.offset);
 
-        co_get_from_shres(s->mem, task->bytes);
+        co_get_from_shres(s->mem, task->req.bytes);
 
         offset = task_end(task);
         bytes = end - offset;
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn block_copy_common(BlockCopyCallState *call_state)
                  * Check that there is no task we still need to
                  * wait to complete
                  */
-                ret = block_copy_wait_one(s, call_state->offset,
-                                          call_state->bytes);
+                ret = reqlist_wait_one(&s->reqs, call_state->offset,
+                                       call_state->bytes, &s->lock);
                 if (ret == 0) {
                     /*
                      * No pending tasks, but check again the bitmap in this
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn block_copy_common(BlockCopyCallState *call_state)
                      * between this and the critical section in
                      * block_copy_dirty_clusters().
                      *
-                     * block_copy_wait_one return value 0 also means that it
+                     * reqlist_wait_one return value 0 also means that it
                      * didn't release the lock. So, we are still in the same
                      * critical section, not interrupted by any concurrent
                      * access to state.
diff --git a/block/reqlist.c b/block/reqlist.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/block/reqlist.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * reqlist API
+ *
+ * Copyright (C) 2013 Proxmox Server Solutions
+ * Copyright (c) 2021 Virtuozzo International GmbH.
+ *
+ * Authors:
+ *  Dietmar Maurer (dietmar@proxmox.com)
+ *  Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+
+#include "block/reqlist.h"
+
+void reqlist_init_req(BlockReqList *reqs, BlockReq *req, int64_t offset,
+                      int64_t bytes)
+{
+    assert(!reqlist_find_conflict(reqs, offset, bytes));
+
+    *req = (BlockReq) {
+        .offset = offset,
+        .bytes = bytes,
+    };
+    qemu_co_queue_init(&req->wait_queue);
+    QLIST_INSERT_HEAD(reqs, req, list);
+}
+
+BlockReq *reqlist_find_conflict(BlockReqList *reqs, int64_t offset,
+                                int64_t bytes)
+{
+    BlockReq *r;
+
+    QLIST_FOREACH(r, reqs, list) {
+        if (offset + bytes > r->offset && offset < r->offset + r->bytes) {
+            return r;
+        }
+    }
+
+    return NULL;
+}
+
+bool coroutine_fn reqlist_wait_one(BlockReqList *reqs, int64_t offset,
+                                   int64_t bytes, CoMutex *lock)
+{
+    BlockReq *r = reqlist_find_conflict(reqs, offset, bytes);
+
+    if (!r) {
+        return false;
+    }
+
+    qemu_co_queue_wait(&r->wait_queue, lock);
+
+    return true;
+}
+
+void coroutine_fn reqlist_shrink_req(BlockReq *req, int64_t new_bytes)
+{
+    if (new_bytes == req->bytes) {
+        return;
+    }
+
+    assert(new_bytes > 0 && new_bytes < req->bytes);
+
+    req->bytes = new_bytes;
+    qemu_co_queue_restart_all(&req->wait_queue);
+}
+
+void coroutine_fn reqlist_remove_req(BlockReq *req)
+{
+    QLIST_REMOVE(req, list);
+    qemu_co_queue_restart_all(&req->wait_queue);
+}
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: block/stream.c
 F: block/mirror.c
 F: qapi/job.json
 F: block/block-copy.c
-F: include/block/block-copy.c
+F: include/block/block-copy.h
+F: block/reqlist.c
+F: include/block/reqlist.h
 F: block/copy-before-write.h
 F: block/copy-before-write.c
 F: include/block/aio_task.h
diff --git a/block/meson.build b/block/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/block/meson.build
+++ b/block/meson.build
@@ -XXX,XX +XXX,XX @@ block_ss.add(files(
   'qcow2.c',
   'quorum.c',
   'raw-format.c',
+  'reqlist.c',
   'snapshot.c',
   'throttle-groups.c',
   'throttle.c',
-- 
2.34.1

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Add a convenient function similar with bdrv_block_status() to get
status of dirty bitmap.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Hanna Reitz <hreitz@redhat.com>
Message-Id: <20220303194349.2304213-9-vsementsov@virtuozzo.com>
Signed-off-by: Hanna Reitz <hreitz@redhat.com>
---
 include/block/dirty-bitmap.h |  2 ++
 include/qemu/hbitmap.h       | 12 ++++++++++++
 block/dirty-bitmap.c         |  6 ++++++
 util/hbitmap.c               | 33 +++++++++++++++++++++++++++++++++
 4 files changed, 53 insertions(+)

diff --git a/include/block/dirty-bitmap.h b/include/block/dirty-bitmap.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/dirty-bitmap.h
+++ b/include/block/dirty-bitmap.h
@@ -XXX,XX +XXX,XX @@ int64_t bdrv_dirty_bitmap_next_zero(BdrvDirtyBitmap *bitmap, int64_t offset,
 bool bdrv_dirty_bitmap_next_dirty_area(BdrvDirtyBitmap *bitmap,
         int64_t start, int64_t end, int64_t max_dirty_count,
         int64_t *dirty_start, int64_t *dirty_count);
+bool bdrv_dirty_bitmap_status(BdrvDirtyBitmap *bitmap, int64_t offset,
+                              int64_t bytes, int64_t *count);
 BdrvDirtyBitmap *bdrv_reclaim_dirty_bitmap_locked(BdrvDirtyBitmap *bitmap,
                                                   Error **errp);
 
diff --git a/include/qemu/hbitmap.h b/include/qemu/hbitmap.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/hbitmap.h
+++ b/include/qemu/hbitmap.h
@@ -XXX,XX +XXX,XX @@ bool hbitmap_next_dirty_area(const HBitmap *hb, int64_t start, int64_t end,
                              int64_t max_dirty_count,
                              int64_t *dirty_start, int64_t *dirty_count);
 
+/*
+ * bdrv_dirty_bitmap_status:
+ * @hb: The HBitmap to operate on
+ * @start: The bit to start from
+ * @count: Number of bits to proceed
+ * @pnum: Out-parameter. How many bits has same value starting from @start
+ *
+ * Returns true if bitmap is dirty at @start, false otherwise.
+ */
+bool hbitmap_status(const HBitmap *hb, int64_t start, int64_t count,
+                    int64_t *pnum);
+
 /**
  * hbitmap_iter_next:
  * @hbi: HBitmapIter to operate on.
diff --git a/block/dirty-bitmap.c b/block/dirty-bitmap.c
index XXXXXXX..XXXXXXX 100644
--- a/block/dirty-bitmap.c
+++ b/block/dirty-bitmap.c
@@ -XXX,XX +XXX,XX @@ bool bdrv_dirty_bitmap_next_dirty_area(BdrvDirtyBitmap *bitmap,
                                    dirty_start, dirty_count);
 }
 
+bool bdrv_dirty_bitmap_status(BdrvDirtyBitmap *bitmap, int64_t offset,
+                              int64_t bytes, int64_t *count)
+{
+    return hbitmap_status(bitmap->bitmap, offset, bytes, count);
+}
+
 /**
  * bdrv_merge_dirty_bitmap: merge src into dest.
  * Ensures permissions on bitmaps are reasonable; use for public API.
diff --git a/util/hbitmap.c b/util/hbitmap.c
index XXXXXXX..XXXXXXX 100644
--- a/util/hbitmap.c
+++ b/util/hbitmap.c
@@ -XXX,XX +XXX,XX @@ bool hbitmap_next_dirty_area(const HBitmap *hb, int64_t start, int64_t end,
     return true;
 }
 
+bool hbitmap_status(const HBitmap *hb, int64_t start, int64_t count,
+                    int64_t *pnum)
+{
+    int64_t next_dirty, next_zero;
+
+    assert(start >= 0);
+    assert(count > 0);
+    assert(start + count <= hb->orig_size);
+
+    next_dirty = hbitmap_next_dirty(hb, start, count);
+    if (next_dirty == -1) {
+        *pnum = count;
+        return false;
+    }
+
+    if (next_dirty > start) {
+        *pnum = next_dirty - start;
+        return false;
+    }
+
+    assert(next_dirty == start);
+
+    next_zero = hbitmap_next_zero(hb, start, count);
+    if (next_zero == -1) {
+        *pnum = count;
+        return true;
+    }
+
+    assert(next_zero > start);
+    *pnum = next_zero - start;
+    return false;
+}
+
 bool hbitmap_empty(const HBitmap *hb)
 {
     return hb->count == 0;
-- 
2.34.1

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Add function to wait for all intersecting requests.
To be used in the further commit.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Nikita Lapshin <nikita.lapshin@virtuozzo.com>
Reviewed-by: Hanna Reitz <hreitz@redhat.com>
Message-Id: <20220303194349.2304213-10-vsementsov@virtuozzo.com>
Signed-off-by: Hanna Reitz <hreitz@redhat.com>
---
 include/block/reqlist.h | 8 ++++++++
 block/reqlist.c         | 8 ++++++++
 2 files changed, 16 insertions(+)

diff --git a/include/block/reqlist.h b/include/block/reqlist.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/reqlist.h
+++ b/include/block/reqlist.h
@@ -XXX,XX +XXX,XX @@ BlockReq *reqlist_find_conflict(BlockReqList *reqs, int64_t offset,
 bool coroutine_fn reqlist_wait_one(BlockReqList *reqs, int64_t offset,
                                    int64_t bytes, CoMutex *lock);
 
+/*
+ * Wait for all intersecting requests. It just calls reqlist_wait_one() in a
+ * loop, caller is responsible to stop producing new requests in this region
+ * in parallel, otherwise reqlist_wait_all() may never return.
+ */
+void coroutine_fn reqlist_wait_all(BlockReqList *reqs, int64_t offset,
+                                   int64_t bytes, CoMutex *lock);
+
 /*
  * Shrink request and wake all waiting coroutines (maybe some of them are not
  * intersecting with shrunk request).
diff --git a/block/reqlist.c b/block/reqlist.c
index XXXXXXX..XXXXXXX 100644
--- a/block/reqlist.c
+++ b/block/reqlist.c
@@ -XXX,XX +XXX,XX @@ bool coroutine_fn reqlist_wait_one(BlockReqList *reqs, int64_t offset,
     return true;
 }
 
+void coroutine_fn reqlist_wait_all(BlockReqList *reqs, int64_t offset,
+                                   int64_t bytes, CoMutex *lock)
+{
+    while (reqlist_wait_one(reqs, offset, bytes, lock)) {
+        /* continue */
+    }
+}
+
 void coroutine_fn reqlist_shrink_req(BlockReq *req, int64_t new_bytes)
 {
     if (new_bytes == req->bytes) {
-- 
2.34.1

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Add new block driver handlers and corresponding generic wrappers.
It will be used to allow copy-before-write filter to provide
reach fleecing interface in further commit.

In future this approach may be used to allow reading qcow2 internal
snapshots, for example to export them through NBD.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Hanna Reitz <hreitz@redhat.com>
Message-Id: <20220303194349.2304213-11-vsementsov@virtuozzo.com>
[hreitz: Rebased on block GS/IO split]
Signed-off-by: Hanna Reitz <hreitz@redhat.com>
---
 include/block/block_int-common.h | 18 ++++++++
 include/block/block_int-io.h     |  9 ++++
 block/io.c                       | 72 ++++++++++++++++++++++++++++++++
 3 files changed, 99 insertions(+)

diff --git a/include/block/block_int-common.h b/include/block/block_int-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/block_int-common.h
+++ b/include/block/block_int-common.h
@@ -XXX,XX +XXX,XX @@ struct BlockDriver {
         bool want_zero, int64_t offset, int64_t bytes, int64_t *pnum,
         int64_t *map, BlockDriverState **file);
 
+    /*
+     * Snapshot-access API.
+     *
+     * Block-driver may provide snapshot-access API: special functions to access
+     * some internal "snapshot". The functions are similar with normal
+     * read/block_status/discard handler, but don't have any specific handling
+     * in generic block-layer: no serializing, no alignment, no tracked
+     * requests. So, block-driver that realizes these APIs is fully responsible
+     * for synchronization between snapshot-access API and normal IO requests.
+     */
+    int coroutine_fn (*bdrv_co_preadv_snapshot)(BlockDriverState *bs,
+        int64_t offset, int64_t bytes, QEMUIOVector *qiov, size_t qiov_offset);
+    int coroutine_fn (*bdrv_co_snapshot_block_status)(BlockDriverState *bs,
+        bool want_zero, int64_t offset, int64_t bytes, int64_t *pnum,
+        int64_t *map, BlockDriverState **file);
+    int coroutine_fn (*bdrv_co_pdiscard_snapshot)(BlockDriverState *bs,
+        int64_t offset, int64_t bytes);
+
     /*
      * Invalidate any cached meta-data.
      */
diff --git a/include/block/block_int-io.h b/include/block/block_int-io.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/block_int-io.h
+++ b/include/block/block_int-io.h
@@ -XXX,XX +XXX,XX @@
  * the I/O API.
  */
 
+int coroutine_fn bdrv_co_preadv_snapshot(BdrvChild *child,
+    int64_t offset, int64_t bytes, QEMUIOVector *qiov, size_t qiov_offset);
+int coroutine_fn bdrv_co_snapshot_block_status(BlockDriverState *bs,
+    bool want_zero, int64_t offset, int64_t bytes, int64_t *pnum,
+    int64_t *map, BlockDriverState **file);
+int coroutine_fn bdrv_co_pdiscard_snapshot(BlockDriverState *bs,
+    int64_t offset, int64_t bytes);
+
+
 int coroutine_fn bdrv_co_preadv(BdrvChild *child,
     int64_t offset, int64_t bytes, QEMUIOVector *qiov,
     BdrvRequestFlags flags);
diff --git a/block/io.c b/block/io.c
index XXXXXXX..XXXXXXX 100644
--- a/block/io.c
+++ b/block/io.c
@@ -XXX,XX +XXX,XX @@ void bdrv_cancel_in_flight(BlockDriverState *bs)
         bs->drv->bdrv_cancel_in_flight(bs);
     }
 }
+
+int coroutine_fn
+bdrv_co_preadv_snapshot(BdrvChild *child, int64_t offset, int64_t bytes,
+                        QEMUIOVector *qiov, size_t qiov_offset)
+{
+    BlockDriverState *bs = child->bs;
+    BlockDriver *drv = bs->drv;
+    int ret;
+    IO_CODE();
+
+    if (!drv) {
+        return -ENOMEDIUM;
+    }
+
+    if (!drv->bdrv_co_preadv_snapshot) {
+        return -ENOTSUP;
+    }
+
+    bdrv_inc_in_flight(bs);
+    ret = drv->bdrv_co_preadv_snapshot(bs, offset, bytes, qiov, qiov_offset);
+    bdrv_dec_in_flight(bs);
+
+    return ret;
+}
+
+int coroutine_fn
+bdrv_co_snapshot_block_status(BlockDriverState *bs,
+                              bool want_zero, int64_t offset, int64_t bytes,
+                              int64_t *pnum, int64_t *map,
+                              BlockDriverState **file)
+{
+    BlockDriver *drv = bs->drv;
+    int ret;
+    IO_CODE();
+
+    if (!drv) {
+        return -ENOMEDIUM;
+    }
+
+    if (!drv->bdrv_co_snapshot_block_status) {
+        return -ENOTSUP;
+    }
+
+    bdrv_inc_in_flight(bs);
+    ret = drv->bdrv_co_snapshot_block_status(bs, want_zero, offset, bytes,
+                                             pnum, map, file);
+    bdrv_dec_in_flight(bs);
+
+    return ret;
+}
+
+int coroutine_fn
+bdrv_co_pdiscard_snapshot(BlockDriverState *bs, int64_t offset, int64_t bytes)
+{
+    BlockDriver *drv = bs->drv;
+    int ret;
+    IO_CODE();
+
+    if (!drv) {
+        return -ENOMEDIUM;
+    }
+
+    if (!drv->bdrv_co_pdiscard_snapshot) {
+        return -ENOTSUP;
+    }
+
+    bdrv_inc_in_flight(bs);
+    ret = drv->bdrv_co_pdiscard_snapshot(bs, offset, bytes);
+    bdrv_dec_in_flight(bs);
+
+    return ret;
+}
-- 
2.34.1

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

The new block driver simply utilizes snapshot-access API of underlying
block node.

In further patches we want to use it like this:

This way, NBD client will be able to read snapshotted state of active
disk, when active disk is continued to be written by guest. This is
known as "fleecing", and currently uses another scheme based on qcow2
temporary image which backing file is active-disk. New scheme comes
with benefits - see next commit.

The other possible application is exporting internal snapshots of
qcow2, like this:

[guest]          [NBD export]
   |                  |
   | root             | root
   v       file       v
[qcow2]<---------[snapshot-access]

For this, we'll need to implement snapshot-access API handlers in
qcow2 driver, and improve snapshot-access block driver (and API) to
make it possible to select snapshot by name. Another thing to improve
is size of snapshot. Now for simplicity we just use size of bs->file,
which is OK for backup, but for qcow2 snapshots export we'll need to
imporve snapshot-access API to get size of snapshot.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20220303194349.2304213-12-vsementsov@virtuozzo.com>
[hreitz: Rebased on block GS/IO split]
Signed-off-by: Hanna Reitz <hreitz@redhat.com>
---
 qapi/block-core.json             |   4 +-
 include/block/block_int-common.h |   6 ++
 block/snapshot-access.c          | 132 +++++++++++++++++++++++++++++++
 MAINTAINERS                      |   1 +
 block/meson.build                |   1 +
 5 files changed, 143 insertions(+), 1 deletion(-)
 create mode 100644 block/snapshot-access.c

diff --git a/qapi/block-core.json b/qapi/block-core.json
index XXXXXXX..XXXXXXX 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -XXX,XX +XXX,XX @@
 # @blkreplay: Since 4.2
 # @compress: Since 5.0
 # @copy-before-write: Since 6.2
+# @snapshot-access: Since 7.0
 #
 # Since: 2.9
 ##
 { 'enum': 'BlockdevDriver',
   'data': [ 'blkdebug', 'blklogwrites', 'blkreplay', 'blkverify', 'bochs',
             'cloop', 'compress', 'copy-before-write', 'copy-on-read', 'dmg',
-            'file', 'ftp', 'ftps', 'gluster',
+            'file', 'snapshot-access', 'ftp', 'ftps', 'gluster',
             {'name': 'host_cdrom', 'if': 'HAVE_HOST_BLOCK_DEVICE' },
             {'name': 'host_device', 'if': 'HAVE_HOST_BLOCK_DEVICE' },
             'http', 'https', 'iscsi',
@@ -XXX,XX +XXX,XX @@
       'rbd':        'BlockdevOptionsRbd',
       'replication': { 'type': 'BlockdevOptionsReplication',
                        'if': 'CONFIG_REPLICATION' },
+      'snapshot-access': 'BlockdevOptionsGenericFormat',
       'ssh':        'BlockdevOptionsSsh',
       'throttle':   'BlockdevOptionsThrottle',
       'vdi':        'BlockdevOptionsGenericFormat',
diff --git a/include/block/block_int-common.h b/include/block/block_int-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/block_int-common.h
+++ b/include/block/block_int-common.h
@@ -XXX,XX +XXX,XX @@ struct BlockDriver {
      * in generic block-layer: no serializing, no alignment, no tracked
      * requests. So, block-driver that realizes these APIs is fully responsible
      * for synchronization between snapshot-access API and normal IO requests.
+     *
+     * TODO: To be able to support qcow2's internal snapshots, this API will
+     * need to be extended to:
+     * - be able to select a specific snapshot
+     * - receive the snapshot's actual length (which may differ from bs's
+     *   length)
      */
     int coroutine_fn (*bdrv_co_preadv_snapshot)(BlockDriverState *bs,
         int64_t offset, int64_t bytes, QEMUIOVector *qiov, size_t qiov_offset);
diff --git a/block/snapshot-access.c b/block/snapshot-access.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/block/snapshot-access.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * snapshot_access block driver
+ *
+ * Copyright (c) 2022 Virtuozzo International GmbH.
+ *
+ * Author:
+ *  Sementsov-Ogievskiy Vladimir <vsementsov@virtuozzo.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+
+#include "sysemu/block-backend.h"
+#include "qemu/cutils.h"
+#include "block/block_int.h"
+
+static coroutine_fn int
+snapshot_access_co_preadv_part(BlockDriverState *bs,
+                               int64_t offset, int64_t bytes,
+                               QEMUIOVector *qiov, size_t qiov_offset,
+                               BdrvRequestFlags flags)
+{
+    if (flags) {
+        return -ENOTSUP;
+    }
+
+    return bdrv_co_preadv_snapshot(bs->file, offset, bytes, qiov, qiov_offset);
+}
+
+static int coroutine_fn
+snapshot_access_co_block_status(BlockDriverState *bs,
+                                bool want_zero, int64_t offset,
+                                int64_t bytes, int64_t *pnum,
+                                int64_t *map, BlockDriverState **file)
+{
+    return bdrv_co_snapshot_block_status(bs->file->bs, want_zero, offset,
+                                         bytes, pnum, map, file);
+}
+
+static int coroutine_fn snapshot_access_co_pdiscard(BlockDriverState *bs,
+                                             int64_t offset, int64_t bytes)
+{
+    return bdrv_co_pdiscard_snapshot(bs->file->bs, offset, bytes);
+}
+
+static int coroutine_fn
+snapshot_access_co_pwrite_zeroes(BlockDriverState *bs,
+                                 int64_t offset, int64_t bytes,
+                                 BdrvRequestFlags flags)
+{
+    return -ENOTSUP;
+}
+
+static coroutine_fn int
+snapshot_access_co_pwritev_part(BlockDriverState *bs,
+                                int64_t offset, int64_t bytes,
+                                QEMUIOVector *qiov, size_t qiov_offset,
+                                BdrvRequestFlags flags)
+{
+    return -ENOTSUP;
+}
+
+
+static void snapshot_access_refresh_filename(BlockDriverState *bs)
+{
+    pstrcpy(bs->exact_filename, sizeof(bs->exact_filename),
+            bs->file->bs->filename);
+}
+
+static int snapshot_access_open(BlockDriverState *bs, QDict *options, int flags,
+                                Error **errp)
+{
+    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
+                               BDRV_CHILD_DATA | BDRV_CHILD_PRIMARY,
+                               false, errp);
+    if (!bs->file) {
+        return -EINVAL;
+    }
+
+    bs->total_sectors = bs->file->bs->total_sectors;
+
+    return 0;
+}
+
+static void snapshot_access_child_perm(BlockDriverState *bs, BdrvChild *c,
+                                BdrvChildRole role,
+                                BlockReopenQueue *reopen_queue,
+                                uint64_t perm, uint64_t shared,
+                                uint64_t *nperm, uint64_t *nshared)
+{
+    /*
+     * Currently, we don't need any permissions. If bs->file provides
+     * snapshot-access API, we can use it.
+     */
+    *nperm = 0;
+    *nshared = BLK_PERM_ALL;
+}
+
+BlockDriver bdrv_snapshot_access_drv = {
+    .format_name = "snapshot-access",
+
+    .bdrv_open                  = snapshot_access_open,
+
+    .bdrv_co_preadv_part        = snapshot_access_co_preadv_part,
+    .bdrv_co_pwritev_part       = snapshot_access_co_pwritev_part,
+    .bdrv_co_pwrite_zeroes      = snapshot_access_co_pwrite_zeroes,
+    .bdrv_co_pdiscard           = snapshot_access_co_pdiscard,
+    .bdrv_co_block_status       = snapshot_access_co_block_status,
+
+    .bdrv_refresh_filename      = snapshot_access_refresh_filename,
+
+    .bdrv_child_perm            = snapshot_access_child_perm,
+};
+
+static void snapshot_access_init(void)
+{
+    bdrv_register(&bdrv_snapshot_access_drv);
+}
+
+block_init(snapshot_access_init);
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: block/reqlist.c
 F: include/block/reqlist.h
 F: block/copy-before-write.h
 F: block/copy-before-write.c
+F: block/snapshot-access.c
 F: include/block/aio_task.h
 F: block/aio_task.c
 F: util/qemu-co-shared-resource.c
diff --git a/block/meson.build b/block/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/block/meson.build
+++ b/block/meson.build
@@ -XXX,XX +XXX,XX @@ block_ss.add(files(
   'raw-format.c',
   'reqlist.c',
   'snapshot.c',
+  'snapshot-access.c',
   'throttle-groups.c',
   'throttle.c',
   'vhdx-endian.c',
-- 
2.34.1

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Current scheme of image fleecing looks like this:

- On guest writes copy-before-write filter copies old data from active
   disk to temp.qcow2. So fleecing client (NBD export) when reads
   changed regions from temp.qcow2 image and unchanged from active disk
   through backing link.

This patch makes possible new image fleecing scheme:

- copy-before-write does CBW operations and also provides
   snapshot-access API. The API may be accessed through
   snapshot-access driver.

Benefits of new scheme:

1. Access control: if remote client try to read data that not covered
   by original dirty bitmap used on copy-before-write open, client gets
   -EACCES.

2. Discard support: if remote client do DISCARD, this additionally to
   discarding data in temp.img informs block-copy process to not copy
   these clusters. Next read from discarded area will return -EACCES.
   This is significant thing: when fleecing user reads data that was
   not yet copied to temp.img, we can avoid copying it on further guest
   write.

3. Synchronisation between client reads and block-copy write is more
   efficient. In old scheme we just rely on BDRV_REQ_SERIALISING flag
   used for writes to temp.qcow2. New scheme is less blocking:
     - fleecing reads are never blocked: if data region is untouched or
       in-flight, we just read from active-disk, otherwise we read from
       temp.img
     - writes to temp.img are not blocked by fleecing reads
     - still, guest writes of-course are blocked by in-flight fleecing
       reads, that currently read from active-disk - it's the minimum
       necessary blocking

4. Temporary image may be of any format, as we don't rely on backing
   feature.

5. Permission relation are simplified. With old scheme we have to share
   write permission on target child of copy-before-write, otherwise
   backing link conflicts with copy-before-write file child write
   permissions. With new scheme we don't have backing link, and
   copy-before-write node may have unshared access to temporary node.
   (Not realized in this commit, will be in future).

6. Having control on fleecing reads we'll be able to implement
   alternative behavior on failed copy-before-write operations.
   Currently we just break guest request (that's a historical behavior
   of backup). But in some scenarios it's a bad behavior: better
   is to drop the backup as failed but don't break guest request.
   With new scheme we can simply unset some bits in a bitmap on CBW
   failure and further fleecing reads will -EACCES, or something like
   this. (Not implemented in this commit, will be in future)
   Additional application for this is implementing timeout for CBW
   operations.

Iotest 257 output is updated, as two more bitmaps now live in
copy-before-write filter.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20220303194349.2304213-13-vsementsov@virtuozzo.com>
Signed-off-by: Hanna Reitz <hreitz@redhat.com>
---
 block/copy-before-write.c  | 212 ++++++++++++++++++++++++++++++++++-
 tests/qemu-iotests/257.out | 224 +++++++++++++++++++++++++++++++++++++
 2 files changed, 435 insertions(+), 1 deletion(-)

diff --git a/block/copy-before-write.c b/block/copy-before-write.c
index XXXXXXX..XXXXXXX 100644
--- a/block/copy-before-write.c
+++ b/block/copy-before-write.c
@@ -XXX,XX +XXX,XX @@
 #include "block/block-copy.h"
 
 #include "block/copy-before-write.h"
+#include "block/reqlist.h"
 
 #include "qapi/qapi-visit-block-core.h"
 
 typedef struct BDRVCopyBeforeWriteState {
     BlockCopyState *bcs;
     BdrvChild *target;
+
+    /*
+     * @lock: protects access to @access_bitmap, @done_bitmap and
+     * @frozen_read_reqs
+     */
+    CoMutex lock;
+
+    /*
+     * @access_bitmap: represents areas allowed for reading by fleecing user.
+     * Reading from non-dirty areas leads to -EACCES.
+     */
+    BdrvDirtyBitmap *access_bitmap;
+
+    /*
+     * @done_bitmap: represents areas that was successfully copied to @target by
+     * copy-before-write operations.
+     */
+    BdrvDirtyBitmap *done_bitmap;
+
+    /*
+     * @frozen_read_reqs: current read requests for fleecing user in bs->file
+     * node. These areas must not be rewritten by guest.
+     */
+    BlockReqList frozen_read_reqs;
 } BDRVCopyBeforeWriteState;
 
 static coroutine_fn int cbw_co_preadv(
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int cbw_co_preadv(
     return bdrv_co_preadv(bs->file, offset, bytes, qiov, flags);
 }
 
+/*
+ * Do copy-before-write operation.
+ *
+ * On failure guest request must be failed too.
+ *
+ * On success, we also wait for all in-flight fleecing read requests in source
+ * node, and it's guaranteed that after cbw_do_copy_before_write() successful
+ * return there are no such requests and they will never appear.
+ */
 static coroutine_fn int cbw_do_copy_before_write(BlockDriverState *bs,
         uint64_t offset, uint64_t bytes, BdrvRequestFlags flags)
 {
     BDRVCopyBeforeWriteState *s = bs->opaque;
+    int ret;
     uint64_t off, end;
     int64_t cluster_size = block_copy_cluster_size(s->bcs);
 
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int cbw_do_copy_before_write(BlockDriverState *bs,
     off = QEMU_ALIGN_DOWN(offset, cluster_size);
     end = QEMU_ALIGN_UP(offset + bytes, cluster_size);
 
-    return block_copy(s->bcs, off, end - off, true);
+    ret = block_copy(s->bcs, off, end - off, true);
+    if (ret < 0) {
+        return ret;
+    }
+
+    WITH_QEMU_LOCK_GUARD(&s->lock) {
+        bdrv_set_dirty_bitmap(s->done_bitmap, off, end - off);
+        reqlist_wait_all(&s->frozen_read_reqs, off, end - off, &s->lock);
+    }
+
+    return 0;
 }
 
 static int coroutine_fn cbw_co_pdiscard(BlockDriverState *bs,
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn cbw_co_flush(BlockDriverState *bs)
     return bdrv_co_flush(bs->file->bs);
 }
 
+/*
+ * If @offset not accessible - return NULL.
+ *
+ * Otherwise, set @pnum to some bytes that accessible from @file (@file is set
+ * to bs->file or to s->target). Return newly allocated BlockReq object that
+ * should be than passed to cbw_snapshot_read_unlock().
+ *
+ * It's guaranteed that guest writes will not interact in the region until
+ * cbw_snapshot_read_unlock() called.
+ */
+static BlockReq *cbw_snapshot_read_lock(BlockDriverState *bs,
+                                        int64_t offset, int64_t bytes,
+                                        int64_t *pnum, BdrvChild **file)
+{
+    BDRVCopyBeforeWriteState *s = bs->opaque;
+    BlockReq *req = g_new(BlockReq, 1);
+    bool done;
+
+    QEMU_LOCK_GUARD(&s->lock);
+
+    if (bdrv_dirty_bitmap_next_zero(s->access_bitmap, offset, bytes) != -1) {
+        g_free(req);
+        return NULL;
+    }
+
+    done = bdrv_dirty_bitmap_status(s->done_bitmap, offset, bytes, pnum);
+    if (done) {
+        /*
+         * Special invalid BlockReq, that is handled in
+         * cbw_snapshot_read_unlock(). We don't need to lock something to read
+         * from s->target.
+         */
+        *req = (BlockReq) {.offset = -1, .bytes = -1};
+        *file = s->target;
+    } else {
+        reqlist_init_req(&s->frozen_read_reqs, req, offset, bytes);
+        *file = bs->file;
+    }
+
+    return req;
+}
+
+static void cbw_snapshot_read_unlock(BlockDriverState *bs, BlockReq *req)
+{
+    BDRVCopyBeforeWriteState *s = bs->opaque;
+
+    if (req->offset == -1 && req->bytes == -1) {
+        g_free(req);
+        return;
+    }
+
+    QEMU_LOCK_GUARD(&s->lock);
+
+    reqlist_remove_req(req);
+    g_free(req);
+}
+
+static coroutine_fn int
+cbw_co_preadv_snapshot(BlockDriverState *bs, int64_t offset, int64_t bytes,
+                       QEMUIOVector *qiov, size_t qiov_offset)
+{
+    BlockReq *req;
+    BdrvChild *file;
+    int ret;
+
+    /* TODO: upgrade to async loop using AioTask */
+    while (bytes) {
+        int64_t cur_bytes;
+
+        req = cbw_snapshot_read_lock(bs, offset, bytes, &cur_bytes, &file);
+        if (!req) {
+            return -EACCES;
+        }
+
+        ret = bdrv_co_preadv_part(file, offset, cur_bytes,
+                                  qiov, qiov_offset, 0);
+        cbw_snapshot_read_unlock(bs, req);
+        if (ret < 0) {
+            return ret;
+        }
+
+        bytes -= cur_bytes;
+        offset += cur_bytes;
+        qiov_offset += cur_bytes;
+    }
+
+    return 0;
+}
+
+static int coroutine_fn
+cbw_co_snapshot_block_status(BlockDriverState *bs,
+                             bool want_zero, int64_t offset, int64_t bytes,
+                             int64_t *pnum, int64_t *map,
+                             BlockDriverState **file)
+{
+    BDRVCopyBeforeWriteState *s = bs->opaque;
+    BlockReq *req;
+    int ret;
+    int64_t cur_bytes;
+    BdrvChild *child;
+
+    req = cbw_snapshot_read_lock(bs, offset, bytes, &cur_bytes, &child);
+    if (!req) {
+        return -EACCES;
+    }
+
+    ret = bdrv_block_status(child->bs, offset, cur_bytes, pnum, map, file);
+    if (child == s->target) {
+        /*
+         * We refer to s->target only for areas that we've written to it.
+         * And we can not report unallocated blocks in s->target: this will
+         * break generic block-status-above logic, that will go to
+         * copy-before-write filtered child in this case.
+         */
+        assert(ret & BDRV_BLOCK_ALLOCATED);
+    }
+
+    cbw_snapshot_read_unlock(bs, req);
+
+    return ret;
+}
+
+static int coroutine_fn cbw_co_pdiscard_snapshot(BlockDriverState *bs,
+                                                 int64_t offset, int64_t bytes)
+{
+    BDRVCopyBeforeWriteState *s = bs->opaque;
+
+    WITH_QEMU_LOCK_GUARD(&s->lock) {
+        bdrv_reset_dirty_bitmap(s->access_bitmap, offset, bytes);
+    }
+
+    block_copy_reset(s->bcs, offset, bytes);
+
+    return bdrv_co_pdiscard(s->target, offset, bytes);
+}
+
 static void cbw_refresh_filename(BlockDriverState *bs)
 {
     pstrcpy(bs->exact_filename, sizeof(bs->exact_filename),
@@ -XXX,XX +XXX,XX @@ static int cbw_open(BlockDriverState *bs, QDict *options, int flags,
 {
     BDRVCopyBeforeWriteState *s = bs->opaque;
     BdrvDirtyBitmap *bitmap = NULL;
+    int64_t cluster_size;
 
     bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
                                BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
@@ -XXX,XX +XXX,XX @@ static int cbw_open(BlockDriverState *bs, QDict *options, int flags,
         return -EINVAL;
     }
 
+    cluster_size = block_copy_cluster_size(s->bcs);
+
+    s->done_bitmap = bdrv_create_dirty_bitmap(bs, cluster_size, NULL, errp);
+    if (!s->done_bitmap) {
+        return -EINVAL;
+    }
+    bdrv_disable_dirty_bitmap(s->done_bitmap);
+
+    /* s->access_bitmap starts equal to bcs bitmap */
+    s->access_bitmap = bdrv_create_dirty_bitmap(bs, cluster_size, NULL, errp);
+    if (!s->access_bitmap) {
+        return -EINVAL;
+    }
+    bdrv_disable_dirty_bitmap(s->access_bitmap);
+    bdrv_dirty_bitmap_merge_internal(s->access_bitmap,
+                                     block_copy_dirty_bitmap(s->bcs), NULL,
+                                     true);
+
+    qemu_co_mutex_init(&s->lock);
+    QLIST_INIT(&s->frozen_read_reqs);
+
     return 0;
 }
 
@@ -XXX,XX +XXX,XX @@ static void cbw_close(BlockDriverState *bs)
 {
     BDRVCopyBeforeWriteState *s = bs->opaque;
 
+    bdrv_release_dirty_bitmap(s->access_bitmap);
+    bdrv_release_dirty_bitmap(s->done_bitmap);
+
     block_copy_state_free(s->bcs);
     s->bcs = NULL;
 }
@@ -XXX,XX +XXX,XX @@ BlockDriver bdrv_cbw_filter = {
     .bdrv_co_pdiscard           = cbw_co_pdiscard,
     .bdrv_co_flush              = cbw_co_flush,
 
+    .bdrv_co_preadv_snapshot       = cbw_co_preadv_snapshot,
+    .bdrv_co_pdiscard_snapshot     = cbw_co_pdiscard_snapshot,
+    .bdrv_co_snapshot_block_status = cbw_co_snapshot_block_status,
+
     .bdrv_refresh_filename      = cbw_refresh_filename,
 
     .bdrv_child_perm            = cbw_child_perm,
diff --git a/tests/qemu-iotests/257.out b/tests/qemu-iotests/257.out
index XXXXXXX..XXXXXXX 100644
--- a/tests/qemu-iotests/257.out
+++ b/tests/qemu-iotests/257.out
@@ -XXX,XX +XXX,XX @@ write -P0x67 0x3fe0000 0x20000
 {"return": ""}
 {
   "bitmaps": {
+    "backup-top": [
+      {
+        "busy": false,
+        "count": 67108864,
+        "granularity": 65536,
+        "persistent": false,
+        "recording": false
+      },
+      {
+        "busy": false,
+        "count": 458752,
+        "granularity": 65536,
+        "persistent": false,
+        "recording": false
+      }
+    ],
     "drive0": [
       {
         "busy": false,
@@ -XXX,XX +XXX,XX @@ write -P0x67 0x3fe0000 0x20000
 {"return": ""}
 {
   "bitmaps": {
+    "backup-top": [
+      {
+        "busy": false,
+        "count": 67108864,
+        "granularity": 65536,
+        "persistent": false,
+        "recording": false
+      },
+      {
+        "busy": false,
+        "count": 458752,
+        "granularity": 65536,
+        "persistent": false,
+        "recording": false
+      }
+    ],
     "drive0": [
       {
         "busy": false,
@@ -XXX,XX +XXX,XX @@ write -P0x67 0x3fe0000 0x20000
 {"return": ""}
 {
   "bitmaps": {
+    "backup-top": [
+      {
+        "busy": false,
+        "count": 67108864,
+        "granularity": 65536,
+        "persistent": false,
+        "recording": false
+      },
+      {
+        "busy": false,
+        "count": 458752,
+        "granularity": 65536,
+        "persistent": false,
+        "recording": false
+      }
+    ],
     "drive0": [
       {
         "busy": false,
@@ -XXX,XX +XXX,XX @@ write -P0x67 0x3fe0000 0x20000
 {"return": ""}
 {
   "bitmaps": {
+    "backup-top": [
+      {
+        "busy": false,
+        "count": 67108864,
+        "granularity": 65536,
+        "persistent": false,
+        "recording": false
+      },
+      {
+        "busy": false,
+        "count": 458752,
+        "granularity": 65536,
+        "persistent": false,
+        "recording": false
+      }
+    ],
     "drive0": [
       {
         "busy": false,
@@ -XXX,XX +XXX,XX @@ write -P0x67 0x3fe0000 0x20000
 {"return": ""}
 {
   "bitmaps": {
+    "backup-top": [
+      {
+        "busy": false,
+        "count": 67108864,
+        "granularity": 65536,
+        "persistent": false,
+        "recording": false
+      },
+      {
+        "busy": false,
+        "count": 458752,
+        "granularity": 65536,
+        "persistent": false,
+        "recording": false
+      }
+    ],
     "drive0": [
       {
         "busy": false,
@@ -XXX,XX +XXX,XX @@ write -P0x67 0x3fe0000 0x20000
 {"return": ""}
 {
   "bitmaps": {
+    "backup-top": [
+      {
+        "busy": false,
+        "count": 67108864,
+        "granularity": 65536,
+        "persistent": false,
+        "recording": false
+      },
+      {
+        "busy": false,
+        "count": 458752,
+        "granularity": 65536,
+        "persistent": false,
+        "recording": false
+      }
+    ],
     "drive0": [
       {
         "busy": false,
@@ -XXX,XX +XXX,XX @@ write -P0x67 0x3fe0000 0x20000
 {"return": ""}
 {
   "bitmaps": {
+    "backup-top": [
+      {
+        "busy": false,
+        "count": 67108864,
+        "granularity": 65536,
+        "persistent": false,
+        "recording": false
+      },
+      {
+        "busy": false,
+        "count": 458752,
+        "granularity": 65536,
+        "persistent": false,
+        "recording": false
+      }
+    ],
     "drive0": [
       {
         "busy": false,
@@ -XXX,XX +XXX,XX @@ write -P0x67 0x3fe0000 0x20000
 {"return": ""}
 {
   "bitmaps": {
+    "backup-top": [
+      {
+        "busy": false,
+        "count": 67108864,
+        "granularity": 65536,
+        "persistent": false,
+        "recording": false
+      },
+      {
+        "busy": false,
+        "count": 458752,
+        "granularity": 65536,
+        "persistent": false,
+        "recording": false
+      }
+    ],
     "drive0": [
       {
         "busy": false,
@@ -XXX,XX +XXX,XX @@ write -P0x67 0x3fe0000 0x20000
 {"return": ""}
 {
   "bitmaps": {
+    "backup-top": [
+      {
+        "busy": false,
+        "count": 67108864,
+        "granularity": 65536,
+        "persistent": false,
+        "recording": false
+      },
+      {
+        "busy": false,
+        "count": 458752,
+        "granularity": 65536,
+        "persistent": false,
+        "recording": false
+      }
+    ],
     "drive0": [
       {
         "busy": false,
@@ -XXX,XX +XXX,XX @@ write -P0x67 0x3fe0000 0x20000
 {"return": ""}
 {
   "bitmaps": {
+    "backup-top": [
+      {
+        "busy": false,
+        "count": 67108864,
+        "granularity": 65536,
+        "persistent": false,
+        "recording": false
+      },
+      {
+        "busy": false,
+        "count": 458752,
+        "granularity": 65536,
+        "persistent": false,
+        "recording": false
+      }
+    ],
     "drive0": [
       {
         "busy": false,
@@ -XXX,XX +XXX,XX @@ write -P0x67 0x3fe0000 0x20000
 {"return": ""}
 {
   "bitmaps": {
+    "backup-top": [
+      {
+        "busy": false,
+        "count": 67108864,
+        "granularity": 65536,
+        "persistent": false,
+        "recording": false
+      },
+      {
+        "busy": false,
+        "count": 458752,
+        "granularity": 65536,
+        "persistent": false,
+        "recording": false
+      }
+    ],
     "drive0": [
       {
         "busy": false,
@@ -XXX,XX +XXX,XX @@ write -P0x67 0x3fe0000 0x20000
 {"return": ""}
 {
   "bitmaps": {
+    "backup-top": [
+      {
+        "busy": false,
+        "count": 67108864,
+        "granularity": 65536,
+        "persistent": false,
+        "recording": false
+      },
+      {
+        "busy": false,
+        "count": 458752,
+        "granularity": 65536,
+        "persistent": false,
+        "recording": false
+      }
+    ],
     "drive0": [
       {
         "busy": false,
@@ -XXX,XX +XXX,XX @@ write -P0x67 0x3fe0000 0x20000
 {"return": ""}
 {
   "bitmaps": {
+    "backup-top": [
+      {
+        "busy": false,
+        "count": 67108864,
+        "granularity": 65536,
+        "persistent": false,
+        "recording": false
+      },
+      {
+        "busy": false,
+        "count": 458752,
+        "granularity": 65536,
+        "persistent": false,
+        "recording": false
+      }
+    ],
     "drive0": [
       {
         "busy": false,
@@ -XXX,XX +XXX,XX @@ write -P0x67 0x3fe0000 0x20000
 {"return": ""}
 {
   "bitmaps": {
+    "backup-top": [
+      {
+        "busy": false,
+        "count": 67108864,
+        "granularity": 65536,
+        "persistent": false,
+        "recording": false
+      },
+      {
+        "busy": false,
+        "count": 458752,
+        "granularity": 65536,
+        "persistent": false,
+        "recording": false
+      }
+    ],
     "drive0": [
       {
         "busy": false,
-- 
2.34.1

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Hanna Reitz <hreitz@redhat.com>
Message-Id: <20220303194349.2304213-14-vsementsov@virtuozzo.com>
Signed-off-by: Hanna Reitz <hreitz@redhat.com>
---
 tests/qemu-iotests/tests/image-fleecing     | 64 +++++++++++++-----
 tests/qemu-iotests/tests/image-fleecing.out | 74 ++++++++++++++++++++-
 2 files changed, 119 insertions(+), 19 deletions(-)

diff --git a/tests/qemu-iotests/tests/image-fleecing b/tests/qemu-iotests/tests/image-fleecing
index XXXXXXX..XXXXXXX 100755
--- a/tests/qemu-iotests/tests/image-fleecing
+++ b/tests/qemu-iotests/tests/image-fleecing
@@ -XXX,XX +XXX,XX @@ remainder = [('0xd5', '0x108000',  '32k'), # Right-end of partial-left [1]
              ('0xdc', '32M',       '32k'), # Left-end of partial-right [2]
              ('0xcd', '0x3ff0000', '64k')] # patterns[3]
 
-def do_test(use_cbw, base_img_path, fleece_img_path, nbd_sock_path, vm):
+def do_test(use_cbw, use_snapshot_access_filter, base_img_path,
+            fleece_img_path, nbd_sock_path, vm):
     log('--- Setting up images ---')
     log('')
 
     assert qemu_img('create', '-f', iotests.imgfmt, base_img_path, '64M') == 0
-    assert qemu_img('create', '-f', 'qcow2', fleece_img_path, '64M') == 0
+    if use_snapshot_access_filter:
+        assert use_cbw
+        assert qemu_img('create', '-f', 'raw', fleece_img_path, '64M') == 0
+    else:
+        assert qemu_img('create', '-f', 'qcow2', fleece_img_path, '64M') == 0
 
     for p in patterns:
         qemu_io('-f', iotests.imgfmt,
@@ -XXX,XX +XXX,XX @@ def do_test(use_cbw, base_img_path, fleece_img_path, nbd_sock_path, vm):
     log('')
 
 
-    # create tmp_node backed by src_node
-    log(vm.qmp('blockdev-add', {
-        'driver': 'qcow2',
-        'node-name': tmp_node,
-        'file': {
+    if use_snapshot_access_filter:
+        log(vm.qmp('blockdev-add', {
+            'node-name': tmp_node,
             'driver': 'file',
             'filename': fleece_img_path,
-        },
-        'backing': src_node,
-    }))
+        }))
+    else:
+        # create tmp_node backed by src_node
+        log(vm.qmp('blockdev-add', {
+            'driver': 'qcow2',
+            'node-name': tmp_node,
+            'file': {
+                'driver': 'file',
+                'filename': fleece_img_path,
+            },
+            'backing': src_node,
+        }))
 
     # Establish CBW from source to fleecing node
     if use_cbw:
@@ -XXX,XX +XXX,XX @@ def do_test(use_cbw, base_img_path, fleece_img_path, nbd_sock_path, vm):
         }))
 
         log(vm.qmp('qom-set', path=qom_path, property='drive', value='fl-cbw'))
+
+        if use_snapshot_access_filter:
+            log(vm.qmp('blockdev-add', {
+                'driver': 'snapshot-access',
+                'node-name': 'fl-access',
+                'file': 'fl-cbw',
+            }))
     else:
         log(vm.qmp('blockdev-backup',
                    job_id='fleecing',
@@ -XXX,XX +XXX,XX @@ def do_test(use_cbw, base_img_path, fleece_img_path, nbd_sock_path, vm):
                    target=tmp_node,
                    sync='none'))
 
+    export_node = 'fl-access' if use_snapshot_access_filter else tmp_node
+
     log('')
     log('--- Setting up NBD Export ---')
     log('')
 
-    nbd_uri = 'nbd+unix:///%s?socket=%s' % (tmp_node, nbd_sock_path)
+    nbd_uri = 'nbd+unix:///%s?socket=%s' % (export_node, nbd_sock_path)
     log(vm.qmp('nbd-server-start',
                {'addr': {'type': 'unix',
                          'data': {'path': nbd_sock_path}}}))
 
-    log(vm.qmp('nbd-server-add', device=tmp_node))
+    log(vm.qmp('nbd-server-add', device=export_node))
 
     log('')
     log('--- Sanity Check ---')
@@ -XXX,XX +XXX,XX @@ def do_test(use_cbw, base_img_path, fleece_img_path, nbd_sock_path, vm):
     log('--- Cleanup ---')
     log('')
 
+    log(vm.qmp('nbd-server-stop'))
+
     if use_cbw:
+        if use_snapshot_access_filter:
+            log(vm.qmp('blockdev-del', node_name='fl-access'))
         log(vm.qmp('qom-set', path=qom_path, property='drive', value=src_node))
         log(vm.qmp('blockdev-del', node_name='fl-cbw'))
     else:
@@ -XXX,XX +XXX,XX @@ def do_test(use_cbw, base_img_path, fleece_img_path, nbd_sock_path, vm):
         assert e is not None
         log(e, filters=[iotests.filter_qmp_event])
 
-    log(vm.qmp('nbd-server-stop'))
     log(vm.qmp('blockdev-del', node_name=tmp_node))
     vm.shutdown()
 
@@ -XXX,XX +XXX,XX @@ def do_test(use_cbw, base_img_path, fleece_img_path, nbd_sock_path, vm):
     log('Done')
 
 
-def test(use_cbw):
+def test(use_cbw, use_snapshot_access_filter):
     with iotests.FilePath('base.img') as base_img_path, \
          iotests.FilePath('fleece.img') as fleece_img_path, \
          iotests.FilePath('nbd.sock',
                           base_dir=iotests.sock_dir) as nbd_sock_path, \
          iotests.VM() as vm:
-        do_test(use_cbw, base_img_path, fleece_img_path, nbd_sock_path, vm)
+        do_test(use_cbw, use_snapshot_access_filter, base_img_path,
+                fleece_img_path, nbd_sock_path, vm)
 
 
 log('=== Test backup(sync=none) based fleecing ===\n')
-test(False)
+test(False, False)
+
+log('=== Test cbw-filter based fleecing ===\n')
+test(True, False)
 
-log('=== Test filter based fleecing ===\n')
-test(True)
+log('=== Test fleecing-format based fleecing ===\n')
+test(True, True)
diff --git a/tests/qemu-iotests/tests/image-fleecing.out b/tests/qemu-iotests/tests/image-fleecing.out
index XXXXXXX..XXXXXXX 100644
--- a/tests/qemu-iotests/tests/image-fleecing.out
+++ b/tests/qemu-iotests/tests/image-fleecing.out
@@ -XXX,XX +XXX,XX @@ read -P0 0x3fe0000 64k
 
 --- Cleanup ---
 
+{"return": {}}
 {"return": {}}
 {"data": {"device": "fleecing", "len": 67108864, "offset": 393216, "speed": 0, "type": "backup"}, "event": "BLOCK_JOB_CANCELLED", "timestamp": {"microseconds": "USECS", "seconds": "SECS"}}
 {"return": {}}
+
+--- Confirming writes ---
+
+read -P0xab 0 64k
+read -P0xad 0x00f8000 64k
+read -P0x1d 0x2008000 64k
+read -P0xea 0x3fe0000 64k
+read -P0xd5 0x108000 32k
+read -P0xdc 32M 32k
+read -P0xcd 0x3ff0000 64k
+
+Done
+=== Test cbw-filter based fleecing ===
+
+--- Setting up images ---
+
+Done
+
+--- Launching VM ---
+
+Done
+
+--- Setting up Fleecing Graph ---
+
+{"return": {}}
+{"return": {}}
+{"return": {}}
+
+--- Setting up NBD Export ---
+
+{"return": {}}
+{"return": {}}
+
+--- Sanity Check ---
+
+read -P0x5d 0 64k
+read -P0xd5 1M 64k
+read -P0xdc 32M 64k
+read -P0xcd 0x3ff0000 64k
+read -P0 0x00f8000 32k
+read -P0 0x2010000 32k
+read -P0 0x3fe0000 64k
+
+--- Testing COW ---
+
+write -P0xab 0 64k
+{"return": ""}
+write -P0xad 0x00f8000 64k
+{"return": ""}
+write -P0x1d 0x2008000 64k
+{"return": ""}
+write -P0xea 0x3fe0000 64k
+{"return": ""}
+
+--- Verifying Data ---
+
+read -P0x5d 0 64k
+read -P0xd5 1M 64k
+read -P0xdc 32M 64k
+read -P0xcd 0x3ff0000 64k
+read -P0 0x00f8000 32k
+read -P0 0x2010000 32k
+read -P0 0x3fe0000 64k
+
+--- Cleanup ---
+
+{"return": {}}
+{"return": {}}
+{"return": {}}
 {"return": {}}
 
 --- Confirming writes ---
@@ -XXX,XX +XXX,XX @@ read -P0xdc 32M 32k
 read -P0xcd 0x3ff0000 64k
 
 Done
-=== Test filter based fleecing ===
+=== Test fleecing-format based fleecing ===
 
 --- Setting up images ---
 
@@ -XXX,XX +XXX,XX @@ Done
 {"return": {}}
 {"return": {}}
 {"return": {}}
+{"return": {}}
 
 --- Setting up NBD Export ---
 
@@ -XXX,XX +XXX,XX @@ read -P0 0x3fe0000 64k
 {"return": {}}
 {"return": {}}
 {"return": {}}
+{"return": {}}
 
 --- Confirming writes ---
 
-- 
2.34.1

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Note that reads zero areas (not dirty in the bitmap) fails, that's
correct.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20220303194349.2304213-16-vsementsov@virtuozzo.com>
Signed-off-by: Hanna Reitz <hreitz@redhat.com>
---
 tests/qemu-iotests/tests/image-fleecing     | 38 +++++++---
 tests/qemu-iotests/tests/image-fleecing.out | 84 +++++++++++++++++++++
 2 files changed, 113 insertions(+), 9 deletions(-)

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20220303194349.2304213-17-vsementsov@virtuozzo.com>
Signed-off-by: Hanna Reitz <hreitz@redhat.com>
---
 tests/qemu-iotests/tests/image-fleecing     | 125 +++++++++++++++-----
 tests/qemu-iotests/tests/image-fleecing.out |  63 ++++++++++
 2 files changed, 156 insertions(+), 32 deletions(-)

diff --git a/tests/qemu-iotests/tests/image-fleecing b/tests/qemu-iotests/tests/image-fleecing
index XXXXXXX..XXXXXXX 100755
--- a/tests/qemu-iotests/tests/image-fleecing
+++ b/tests/qemu-iotests/tests/image-fleecing
@@ -XXX,XX +XXX,XX @@ remainder = [('0xd5', '0x108000',  '32k'), # Right-end of partial-left [1]
              ('0xdc', '32M',       '32k'), # Left-end of partial-right [2]
              ('0xcd', '0x3ff0000', '64k')] # patterns[3]
 
-def do_test(use_cbw, use_snapshot_access_filter, base_img_path,
-            fleece_img_path, nbd_sock_path, vm,
+def do_test(vm, use_cbw, use_snapshot_access_filter, base_img_path,
+            fleece_img_path, nbd_sock_path=None,
+            target_img_path=None,
             bitmap=False):
+    push_backup = target_img_path is not None
+    assert (nbd_sock_path is not None) != push_backup
+    if push_backup:
+        assert use_cbw
+
     log('--- Setting up images ---')
     log('')
 
@@ -XXX,XX +XXX,XX @@ def do_test(use_cbw, use_snapshot_access_filter, base_img_path,
     else:
         assert qemu_img('create', '-f', 'qcow2', fleece_img_path, '64M') == 0
 
+    if push_backup:
+        assert qemu_img('create', '-f', 'qcow2', target_img_path, '64M') == 0
+
     for p in patterns:
         qemu_io('-f', iotests.imgfmt,
                 '-c', 'write -P%s %s %s' % p, base_img_path)
@@ -XXX,XX +XXX,XX @@ def do_test(use_cbw, use_snapshot_access_filter, base_img_path,
 
     export_node = 'fl-access' if use_snapshot_access_filter else tmp_node
 
-    log('')
-    log('--- Setting up NBD Export ---')
-    log('')
+    if push_backup:
+        log('')
+        log('--- Starting actual backup ---')
+        log('')
 
-    nbd_uri = 'nbd+unix:///%s?socket=%s' % (export_node, nbd_sock_path)
-    log(vm.qmp('nbd-server-start',
-               {'addr': {'type': 'unix',
-                         'data': {'path': nbd_sock_path}}}))
+        log(vm.qmp('blockdev-add', **{
+            'driver': iotests.imgfmt,
+            'node-name': 'target',
+            'file': {
+                'driver': 'file',
+                'filename': target_img_path
+            }
+        }))
+        log(vm.qmp('blockdev-backup', device=export_node,
+                   sync='full', target='target',
+                   job_id='push-backup', speed=1))
+    else:
+        log('')
+        log('--- Setting up NBD Export ---')
+        log('')
 
-    log(vm.qmp('nbd-server-add', device=export_node))
+        nbd_uri = 'nbd+unix:///%s?socket=%s' % (export_node, nbd_sock_path)
+        log(vm.qmp('nbd-server-start',
+                   {'addr': { 'type': 'unix',
+                              'data': { 'path': nbd_sock_path } } }))
 
-    log('')
-    log('--- Sanity Check ---')
-    log('')
+        log(vm.qmp('nbd-server-add', device=export_node))
 
-    for p in patterns + zeroes:
-        cmd = 'read -P%s %s %s' % p
-        log(cmd)
-        out, ret = qemu_io_pipe_and_status('-r', '-f', 'raw', '-c', cmd,
-                                           nbd_uri)
-        if ret != 0:
-            print(out)
+        log('')
+        log('--- Sanity Check ---')
+        log('')
+
+        for p in patterns + zeroes:
+            cmd = 'read -P%s %s %s' % p
+            log(cmd)
+            out, ret = qemu_io_pipe_and_status('-r', '-f', 'raw', '-c', cmd,
+                                               nbd_uri)
+            if ret != 0:
+                print(out)
 
     log('')
     log('--- Testing COW ---')
@@ -XXX,XX +XXX,XX @@ def do_test(use_cbw, use_snapshot_access_filter, base_img_path,
         log(cmd)
         log(vm.hmp_qemu_io(qom_path, cmd, qdev=True))
 
+    if push_backup:
+        # Check that previous operations were done during backup, not after
+        # If backup is already finished, it's possible that it was finished
+        # even before hmp qemu_io write, and we didn't actually test
+        # copy-before-write operation. This should not happen, as we use
+        # speed=1. But worth checking.
+        result = vm.qmp('query-block-jobs')
+        assert len(result['return']) == 1
+
+        result = vm.qmp('block-job-set-speed', device='push-backup', speed=0)
+        assert result == {'return': {}}
+
+        log(vm.event_wait(name='BLOCK_JOB_COMPLETED',
+                          match={'data': {'device': 'push-backup'}}),
+            filters=[iotests.filter_qmp_event])
+        log(vm.qmp('blockdev-del', node_name='target'))
+
     log('')
     log('--- Verifying Data ---')
     log('')
@@ -XXX,XX +XXX,XX @@ def do_test(use_cbw, use_snapshot_access_filter, base_img_path,
     for p in patterns + zeroes:
         cmd = 'read -P%s %s %s' % p
         log(cmd)
-        out, ret = qemu_io_pipe_and_status('-r', '-f', 'raw', '-c', cmd,
-                                           nbd_uri)
+        args = ['-r', '-c', cmd]
+        if push_backup:
+            args += [target_img_path]
+        else:
+            args += ['-f', 'raw', nbd_uri]
+        out, ret = qemu_io_pipe_and_status(*args)
         if ret != 0:
             print(out)
 
@@ -XXX,XX +XXX,XX @@ def do_test(use_cbw, use_snapshot_access_filter, base_img_path,
     log('--- Cleanup ---')
     log('')
 
-    log(vm.qmp('nbd-server-stop'))
+    if not push_backup:
+        log(vm.qmp('nbd-server-stop'))
 
     if use_cbw:
         if use_snapshot_access_filter:
@@ -XXX,XX +XXX,XX @@ def do_test(use_cbw, use_snapshot_access_filter, base_img_path,
     log('Done')
 
 
-def test(use_cbw, use_snapshot_access_filter, bitmap=False):
+def test(use_cbw, use_snapshot_access_filter,
+         nbd_sock_path=None, target_img_path=None, bitmap=False):
     with iotests.FilePath('base.img') as base_img_path, \
          iotests.FilePath('fleece.img') as fleece_img_path, \
-         iotests.FilePath('nbd.sock',
-                          base_dir=iotests.sock_dir) as nbd_sock_path, \
          iotests.VM() as vm:
-        do_test(use_cbw, use_snapshot_access_filter, base_img_path,
-                fleece_img_path, nbd_sock_path, vm, bitmap=bitmap)
+        do_test(vm, use_cbw, use_snapshot_access_filter, base_img_path,
+                fleece_img_path, nbd_sock_path, target_img_path,
+                bitmap=bitmap)
+
+def test_pull(use_cbw, use_snapshot_access_filter, bitmap=False):
+    with iotests.FilePath('nbd.sock',
+                          base_dir=iotests.sock_dir) as nbd_sock_path:
+        test(use_cbw, use_snapshot_access_filter, nbd_sock_path, None,
+             bitmap=bitmap)
+
+def test_push():
+    with iotests.FilePath('target.img') as target_img_path:
+        test(True, True, None, target_img_path)
 
 
 log('=== Test backup(sync=none) based fleecing ===\n')
-test(False, False)
+test_pull(False, False)
 
 log('=== Test cbw-filter based fleecing ===\n')
-test(True, False)
+test_pull(True, False)
 
 log('=== Test fleecing-format based fleecing ===\n')
-test(True, True)
+test_pull(True, True)
 
 log('=== Test fleecing-format based fleecing with bitmap ===\n')
-test(True, True, bitmap=True)
+test_pull(True, True, bitmap=True)
+
+log('=== Test push backup with fleecing ===\n')
+test_push()
diff --git a/tests/qemu-iotests/tests/image-fleecing.out b/tests/qemu-iotests/tests/image-fleecing.out
index XXXXXXX..XXXXXXX 100644
--- a/tests/qemu-iotests/tests/image-fleecing.out
+++ b/tests/qemu-iotests/tests/image-fleecing.out
@@ -XXX,XX +XXX,XX @@ read -P0xdc 32M 32k
 read -P0xcd 0x3ff0000 64k
 
 Done
+=== Test push backup with fleecing ===
+
+--- Setting up images ---
+
+Done
+
+--- Launching VM ---
+
+Done
+
+--- Setting up Fleecing Graph ---
+
+{"return": {}}
+{"return": {}}
+{"return": {}}
+{"return": {}}
+
+--- Starting actual backup ---
+
+{"return": {}}
+{"return": {}}
+
+--- Testing COW ---
+
+write -P0xab 0 64k
+{"return": ""}
+write -P0xad 0x00f8000 64k
+{"return": ""}
+write -P0x1d 0x2008000 64k
+{"return": ""}
+write -P0xea 0x3fe0000 64k
+{"return": ""}
+{"data": {"device": "push-backup", "len": 67108864, "offset": 67108864, "speed": 0, "type": "backup"}, "event": "BLOCK_JOB_COMPLETED", "timestamp": {"microseconds": "USECS", "seconds": "SECS"}}
+{"return": {}}
+
+--- Verifying Data ---
+
+read -P0x5d 0 64k
+read -P0xd5 1M 64k
+read -P0xdc 32M 64k
+read -P0xcd 0x3ff0000 64k
+read -P0 0x00f8000 32k
+read -P0 0x2010000 32k
+read -P0 0x3fe0000 64k
+
+--- Cleanup ---
+
+{"return": {}}
+{"return": {}}
+{"return": {}}
+{"return": {}}
+
+--- Confirming writes ---
+
+read -P0xab 0 64k
+read -P0xad 0x00f8000 64k
+read -P0x1d 0x2008000 64k
+read -P0xea 0x3fe0000 64k
+read -P0xd5 0x108000 32k
+read -P0xdc 32M 32k
+read -P0xcd 0x3ff0000 64k
+
+Done
-- 
2.34.1